Skip to content

feat: make the webhook port configurable #301

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
+8 −0
Open

feat: make the webhook port configurable #301

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3fb096f
feat: make the webhook port configurable
Argannor Oct 11, 2024
0158134
feat: make the metrics bind address configurable
Argannor Oct 14, 2024
8f07e04
Merge branch 'main' into configurable-port
jeanduplessis May 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions cmd/provider/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@ import (
"sigs.k8s.io/controller-runtime/pkg/cache"
"sigs.k8s.io/controller-runtime/pkg/log/zap"
"sigs.k8s.io/controller-runtime/pkg/metrics"
metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
"sigs.k8s.io/controller-runtime/pkg/webhook"

changelogsv1alpha1 "github.com/crossplane/crossplane-runtime/apis/changelogs/proto/v1alpha1"
Expand Down Expand Up @@ -68,6 +69,8 @@ func main() {
leaderElection = app.Flag("leader-election", "Use leader election for the controller manager.").Short('l').Default("false").Envar("LEADER_ELECTION").Bool()
maxReconcileRate = app.Flag("max-reconcile-rate", "The number of concurrent reconciliations that may be running at one time.").Default("100").Int()
sanitizeSecrets = app.Flag("sanitize-secrets", "when enabled, redacts Secret data from Object status").Default("false").Envar("SANITIZE_SECRETS").Bool()
webhookPort = app.Flag("webhook-port", "The port the webhook listens on").Default("9443").Envar("WEBHOOK_PORT").Int()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

for all providers, also allow configuring metrics bind address which gets passed onto sigs.k8s.io/controller-runtime/pkg/metrics/server.Options ?
we can standardize on --webhook-port and --metrics-bind-address flags across all providers, similar to crossplane core flags..

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1 for standardizing. I added the --metrics-bind-address as well as requested. Thank you for the feedback!

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

by the time we finished crossplane/crossplane#5540, we ended up with:

      --webhook-port=9443                                     The port the webhook server listens on ($WEBHOOK_PORT).
      --metrics-port=8080                                     The port the metrics server listens on ($METRICS_PORT).

So we should update this PR to those values too, so we keep with the intended standardization. Let's try not ship a version of this provider and then change the flag later on 🤓

@Argannor are you still up for driving this PR to completion?

Copy link
Contributor

@ravilr ravilr May 7, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jbw976 please see crossplane/crossplane#5540 (comment)

the argument towards keeping the metrics port configuration as address string is: Some Security focussed setups would not want to expose the metrics port on all interfaces, instead only on 127.0.0.1:8080 and then front it with a rbac-proxy sidecar which requires auth for the prometheus scrapers to be able to reach it.

Intaking it as metrics-port int arg, will take away above ability.

the webhook port being passed in as int arg is fine because, the webhook server is TLS enabled and requires the client(Kuberntes API Server) to have access to self-signed CA for verification.

metricsBindAddress = app.Flag("metrics-bind-address", "The address the metrics server listens on").Default(":8080").Envar("METRICS_BIND_ADDRESS").String()
changelogsSocketPath = app.Flag("changelogs-socket-path", "Path for changelogs socket (if enabled)").Default("/var/run/changelogs/changelogs.sock").Envar("CHANGELOGS_SOCKET_PATH").String()

enableManagementPolicies = app.Flag("enable-management-policies", "Enable support for Management Policies.").Default("true").Envar("ENABLE_MANAGEMENT_POLICIES").Bool()
Expand Down Expand Up @@ -118,6 +121,10 @@ func main() {
SyncPeriod: syncInterval,
},

Metrics: metricsserver.Options{
BindAddress: *metricsBindAddress,
},

// controller-runtime uses both ConfigMaps and Leases for leader
// election by default. Leases expire after 15 seconds, with a
// 10 second renewal deadline. We've observed leader loss due to
Expand All @@ -132,6 +139,7 @@ func main() {
RenewDeadline: func() *time.Duration { d := 50 * time.Second; return &d }(),
WebhookServer: webhook.NewServer(webhook.Options{
CertDir: certDir,
Port: *webhookPort,
}),
})
kingpin.FatalIfError(err, "Cannot create controller manager")
Expand Down
Loading