[opentelemetry-operator] Remove kube-rbac-proxy and use built-in metrics auth by YASHMAHAKAL · Pull Request #2004 · open-telemetry/opentelemetry-helm-charts

YASHMAHAKAL · 2025-12-23T16:54:21Z

Description

Removes kube-rbac-proxy dependency and migrates to controller-runtime's built-in metrics authentication, aligning with upstream operator v0.142.0+ changes.

Changes

Removed kube-rbac-proxy sidecar container
Replaced kubeRBACProxy config with metricsServer config
Added support for --metrics-secure flag and TLS options
Updated RBAC to remove proxy-specific permissions
Simplified service to single metrics port
Chart version bumped to 0.103.0

Migration

Default behavior unchanged (metrics on port 8080). For secure metrics, set metricsServer.secure: true, as described in UPGRADING.md.

Testing

Helm lint passes
Templates render correctly
Examples regenerated
Tested on local cluster (Minikube)

Fixes #1999

Copilot

Pull request overview

This PR removes the kube-rbac-proxy sidecar dependency and migrates to controller-runtime's built-in metrics authentication, aligning with upstream OpenTelemetry Operator v0.142.0+ changes.

Key Changes

Removed kube-rbac-proxy sidecar container from the deployment
Replaced kubeRBACProxy configuration section with metricsServer configuration
Added support for --metrics-secure flag and TLS configuration options for built-in authentication

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
charts/opentelemetry-operator/values.yaml	Replaced kubeRBACProxy config with metricsServer config (secure, port, tls options)
charts/opentelemetry-operator/values.schema.json	Updated JSON schema to reflect metricsServer structure and validation rules
charts/opentelemetry-operator/templates/deployment.yaml	Removed kube-rbac-proxy container, added metrics-secure and TLS flags to manager container
charts/opentelemetry-operator/templates/service.yaml	Simplified service to use single metrics port based on metricsServer.secure setting
charts/opentelemetry-operator/templates/clusterrole.yaml	Changed RBAC condition from kubeRBACProxy.enabled to metricsServer.secure, removed proxy-specific ClusterRole
charts/opentelemetry-operator/templates/clusterrolebinding.yaml	Removed proxy-specific ClusterRoleBinding
charts/opentelemetry-operator/templates/tests/test-service-connection.yaml	Updated test to conditionally use metricsServer.port or manager.ports.metricsPort based on secure mode
charts/opentelemetry-operator/examples//rendered/.yaml	Regenerated examples reflecting removal of kube-rbac-proxy container and RBAC resources
charts/opentelemetry-operator/UPGRADING.md	Added migration guide from kubeRBACProxy to metricsServer configuration
charts/opentelemetry-operator/Chart.yaml	Bumped chart version to 0.103.0 and appVersion to 0.142.0

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 31 out of 31 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

TylerHelmuth · 2025-12-23T17:57:57Z

Switching to draft until CoPilot is done reviewing.

YASHMAHAKAL · 2025-12-23T18:08:46Z

@TylerHelmuth Copilot review is complete. I've already addressed the port default issue (commit d9931e6). The remaining comments are style suggestions. Should I address them all, or would you like to review first? because i'm not much sure as first two are regarding UPGRADING.md...

TylerHelmuth · 2025-12-23T18:46:35Z

@YASHMAHAKAL close any copilot reviews you're ignoring and then mark the PR ready for review when you want us to review it. I dont want to read through copilot comments.

YASHMAHAKAL · 2025-12-23T18:50:10Z

@TylerHelmuth , i apologize for inconvinience, i noticed same and have turned off specific settings !! : )

YASHMAHAKAL · 2025-12-28T17:22:01Z

Greetings @TylerHelmuth, Sir, could you please review mine changes, i'm waiting for our feedback : )

TylerHelmuth · 2026-01-06T18:44:20Z

@YASHMAHAKAL please fix CI failures.

YASHMAHAKAL · 2026-01-06T18:46:04Z

@YASHMAHAKAL please fix CI failures.

@TylerHelmuth, Thanks for review, i'm working on it !

jaronoff97

Should be good @pavolloffay mind taking a look?

YASHMAHAKAL · 2026-01-07T17:23:52Z

Thanks @pavolloffay, @jaronoff97 !!

rogercoll

Should we bump opentelemetry-collector-k8s image to 0.142.0 as well? https://github.com/open-telemetry/opentelemetry-helm-charts/pull/2004/files#diff-56c52957e9b80d7dcb9b9771e329d7dc4f1a3ee8fb22acdcb3a75c1c92e75c18R53

jaronoff97 · 2026-01-12T21:45:15Z

@rogercoll yes i think we should @YASHMAHAKAL apologies one more change

YASHMAHAKAL · 2026-01-13T07:22:38Z

@rogercoll yes i think we should @YASHMAHAKAL apologies one more change

Thanks @jaronoff97, it's absolutely okay ! i'll be updating the PR with necessary changes : )

YASHMAHAKAL · 2026-01-13T08:57:53Z

@jaronoff97, @rogercoll, i've made desired changes, please take a look : )

jaronoff97 · 2026-01-28T16:02:17Z

@YASHMAHAKAL, @swiatekm are going to merge the PRs to bump the release numbers after which you can rebase and we can have a focused diff on just removing the rbac proxy. Please bear with us while we get these through, thank you for your patience!

YASHMAHAKAL · 2026-01-28T16:11:22Z

@jaronoff97, sorry again for delayed responses, yeah I will be fixing this today itself 🙂

jaronoff97 · 2026-01-28T16:55:30Z

@YASHMAHAKAL you should be good to rebase now, we have bumped the chart all the way up to latest

YASHMAHAKAL · 2026-01-28T18:20:45Z

@jaronoff97 one question, what about port missmatch ? should i change to 8443 or just a rebase ?

Signed-off-by: YASHMAHAKAL <yvsst01@gmail.com>

YASHMAHAKAL · 2026-01-29T05:12:39Z

@jaronoff97 @eenchevlp Rebased onto main and updated configuration to use port 8443 with secure: true, examples regenerated to reflect correct metrics configuration and added a clusterrole too.. change to 8443 will fix the failing tests, let me know if anything, Thanks !

jaronoff97

@YASHMAHAKAL PR looks good, but youll need to bump the Chart version. Given this is technically a breaking change, please bump the minor version instead of the patch version

YASHMAHAKAL · 2026-01-30T19:00:01Z

@YASHMAHAKAL PR looks good, but youll need to bump the Chart version. Given this is technically a breaking change, please bump the minor version instead of the patch version

okay @jaronoff97, Thanks !

swiatekm · 2026-01-30T19:36:26Z

@YASHMAHAKAL you'll need to revert the changes from 6c98bba to get the e2e tests to pass.

Remove invalid kubeRBACProxy configuration from workflow. Regenerate examples with new version labels. Signed-off-by: YASHMAHAKAL <yvsst01@gmail.com>

YASHMAHAKAL · 2026-01-31T17:40:20Z

-            --set "manager.extraEnvs[0].valueFrom.fieldRef.fieldPath=metadata.namespace" \
-            --set "kubeRBACProxy.enabled=false" \
-            --set "manager.ports.metricsPort=8443"
+            --set "manager.extraEnvs[0].valueFrom.fieldRef.fieldPath=metadata.namespace"


@swiatekm, i have reverted the changes as per your recommendation.....

YASHMAHAKAL · 2026-01-31T17:41:10Z

  namespace: default
  labels:
-    helm.sh/chart: opentelemetry-operator-0.105.0
+    helm.sh/chart: opentelemetry-operator-0.106.0


@jaronoff97 minor version bumped to 0.106.0 as per your recommendation, Thanks !

YASHMAHAKAL · 2026-02-03T06:43:56Z

Nice to see greenery in checks section 😃

swiatekm

I'd prefer if we put the new config section under manager and only had one way of setting the metrics port. I've left some comments with suggestions.

Notably, if we're enabling HTTPS by default, we also need to deal with #2063 by configuring the ServiceMonitor appropriately.

swiatekm · 2026-02-03T16:23:41Z

+## Metrics server configuration
+## The operator uses controller-runtime built-in auth for the metrics server
+## Authentication is disabled by default for backward compatibility
+metricsServer:


Is there a reason we're putting this in a new section? Intuitively, this should be under a path like manager.metrics, since it's really just configuring metrics for the operator binary. @jaronoff97 WDYT?

this makes sense to me.

swiatekm · 2026-02-03T16:25:18Z

          name: manager
          imagePullPolicy: {{ .Values.manager.image.imagePullPolicy }}
          ports:
            - containerPort: {{ .Values.manager.ports.metricsPort }}


This port should be conditional on the settings as well.

swiatekm · 2026-02-03T16:27:12Z

+
+  # Port for the metrics server
+  # Use 8443 when secure is true, 8080 when false
+  port: 8443


Can we not use manager.ports.metrics instead? That would remove a lot of the conditional logic we have around ports and we wouldn't have two sources of truth for them. The HTTPS settings could go into a separate section, like manager.metrics.

kravvcu · 2026-02-04T09:00:24Z

-            - --metrics-addr=0.0.0.0:{{ .Values.manager.ports.metricsPort }}
+            - --metrics-addr=0.0.0.0:{{ if .Values.metricsServer.secure }}{{ .Values.metricsServer.port }}{{ else }}{{ .Values.manager.ports.metricsPort }}{{ end }}
+            {{- if .Values.metricsServer.secure }}
+            - --metrics-secure=true


@YASHMAHAKAL

Sorry for butting in but I've stumbled upon this PR as I'm interested in it.

I'm wondering whether this should be passed always as such:

`

--metrics-secure={{ .Values.metricsServer.secure }}
`

The reason being this seems to be enabled by default in the operator (https://github.com/open-telemetry/opentelemetry-operator/blob/v0.144.0/internal/config/config.go#L179). Though I'm no go developer so I may be mistaken this is the default value and isn't overridden.

Is that a problem? We're always explicitly passing the value we want, without relying on defaults.

Correct me if I'm wrong but if currently the default within operator itself is 'enabled' and the current state of the Helm chart code in this PR conditionally enables then there's no way to disable secure metrics endpoint with Helm chart with the implementation this PR proposes.

Ah, I misread your comment. You're right, we should set it unconditionally.

eenchev · 2026-02-26T11:37:58Z

Hi @swiatekm @YASHMAHAKAL , do you think anything can be done re this PR? Essentially, the chart has no proper way to configure secure metrics collection on the newer versions of operator. So there is discrepency between the chart configuration and the actual operator until this is merged.

github-actions · 2026-05-15T13:33:56Z

This PR was marked stale due to lack of activity. It will be closed in 14 days.

github-actions · 2026-05-30T03:20:41Z

Closed as inactive. Feel free to reopen if this PR is still being worked on.

Copilot AI review requested due to automatic review settings December 23, 2025 16:54

YASHMAHAKAL requested review from a team, Allex1 and jvoravong as code owners December 23, 2025 16:54

Copilot started reviewing on behalf of YASHMAHAKAL December 23, 2025 16:54 View session

YASHMAHAKAL mentioned this pull request Dec 23, 2025

Migrate away from kube-rbac-proxy #1999

Closed

Copilot AI reviewed Dec 23, 2025

View reviewed changes

YASHMAHAKAL requested a review from Copilot December 23, 2025 17:10

Copilot started reviewing on behalf of YASHMAHAKAL December 23, 2025 17:10 View session

Copilot AI reviewed Dec 23, 2025

View reviewed changes

TylerHelmuth marked this pull request as draft December 23, 2025 17:58

YASHMAHAKAL marked this pull request as ready for review December 23, 2025 18:48

JaredTan95 changed the title ~~Remove kube-rbac-proxy and use built-in metrics auth~~ [opentelemetry-operator] Remove kube-rbac-proxy and use built-in metrics auth Jan 1, 2026

jaronoff97 approved these changes Jan 7, 2026

View reviewed changes

pavolloffay approved these changes Jan 7, 2026

View reviewed changes

rogercoll approved these changes Jan 12, 2026

View reviewed changes

rogercoll reviewed Jan 12, 2026

View reviewed changes

jaronoff97 approved these changes Jan 12, 2026

View reviewed changes

drisbee mentioned this pull request Jan 13, 2026

[opentelemetry-operator] - Configuring ImagePullConfig is not possible in Chart #2025

Closed

This was referenced Jan 27, 2026

[operator] Bump version to 0.144.0 #2055

Merged

[operator] Bump version to 0.142.0 #2057

Merged

YASHMAHAKAL added 2 commits January 29, 2026 00:00

Remove kube-rbac-proxy and use built-in metrics auth

19a578f

Signed-off-by: YASHMAHAKAL <yvsst01@gmail.com>

fix: remove trailing spaces in values.yaml

9117be8

Signed-off-by: YASHMAHAKAL <yvsst01@gmail.com>

YASHMAHAKAL force-pushed the migrate-awayfrom-kube-rbac-proxy branch from 37b1536 to b286583 Compare January 28, 2026 19:21

fix: add missing newline to values.schema.json

4e36599

Signed-off-by: YASHMAHAKAL <yvsst01@gmail.com>

YASHMAHAKAL force-pushed the migrate-awayfrom-kube-rbac-proxy branch from b286583 to 4e36599 Compare January 29, 2026 04:43

YASHMAHAKAL requested a review from jaronoff97 January 29, 2026 05:16

jaronoff97 reviewed Jan 30, 2026

View reviewed changes

chore: bump version to 0.106.0 and fix E2E tests

0fbffc3

Remove invalid kubeRBACProxy configuration from workflow. Regenerate examples with new version labels. Signed-off-by: YASHMAHAKAL <yvsst01@gmail.com>

YASHMAHAKAL commented Jan 31, 2026

View reviewed changes

swiatekm suggested changes Feb 3, 2026

View reviewed changes

kravvcu reviewed Feb 4, 2026

View reviewed changes

swiatekm mentioned this pull request Feb 4, 2026

ServiceMonitor not working after updating to 0.105.0 #2063

Closed

swiatekm mentioned this pull request Feb 13, 2026

[operator] Disable secure metrics serving by default #2075

Merged

swiatekm mentioned this pull request Apr 16, 2026

[opentelemetry-operator] Remove kube-rbac-proxy and use built-in metrics auth #2153

Merged

github-actions Bot added the Stale label May 15, 2026

github-actions Bot closed this May 30, 2026

Conversation

YASHMAHAKAL commented Dec 23, 2025

Description

Changes

Migration

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Key Changes

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TylerHelmuth commented Dec 23, 2025

Uh oh!

YASHMAHAKAL commented Dec 23, 2025

Uh oh!

TylerHelmuth commented Dec 23, 2025

Uh oh!

YASHMAHAKAL commented Dec 23, 2025

Uh oh!

YASHMAHAKAL commented Dec 28, 2025

Uh oh!

TylerHelmuth commented Jan 6, 2026

Uh oh!

YASHMAHAKAL commented Jan 6, 2026

Uh oh!

jaronoff97 left a comment

Choose a reason for hiding this comment

Uh oh!

YASHMAHAKAL commented Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rogercoll left a comment

Choose a reason for hiding this comment

Uh oh!

jaronoff97 commented Jan 12, 2026

Uh oh!

YASHMAHAKAL commented Jan 13, 2026

Uh oh!

YASHMAHAKAL commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jaronoff97 commented Jan 28, 2026

Uh oh!

YASHMAHAKAL commented Jan 28, 2026

Uh oh!

jaronoff97 commented Jan 28, 2026

Uh oh!

YASHMAHAKAL commented Jan 28, 2026

Uh oh!

YASHMAHAKAL commented Jan 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jaronoff97 left a comment

Choose a reason for hiding this comment

Uh oh!

YASHMAHAKAL commented Jan 30, 2026

Uh oh!

swiatekm commented Jan 30, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

YASHMAHAKAL commented Feb 3, 2026

YASHMAHAKAL commented Jan 7, 2026 •

edited

Loading

YASHMAHAKAL commented Jan 13, 2026 •

edited

Loading

YASHMAHAKAL commented Jan 29, 2026 •

edited

Loading