Moving forward kube-rbac-proxy sidecar container will be deprecated upstream.
https://github.com/openshift/cert-manager-operator-release/issues/95
Downstream we ship container images for kube-rbac-proxy to RH registry, but that's also not required once Operators start using WithAuthenticationAndAuthorization feature from controller-runtime. More cert-manager-operator specific details (as operator uses library-go): https://redhat-internal.slack.com/archives/C02J9SFS5RN/p1733394718477849?thread_ts=1733388226.325599&cid=C02J9SFS5RN
Hence, we can cleanup the redundant sidecar as operator's 8443 server.In the past, we've disabled http2 on the kube-rbac-proxy container for certain CVEs and having to depend upon it as an external dependencies has it's own challenges, so better to get rid of it sooner than later given we already includes Authorization and Authentication via https://github.com/openshift/cert-manager-operator/blob/master/vendor/github.com/openshift/library-go/pkg/controller/controllercmd/builder.go#L312-L337.
- is cloned by
-
CM-470 [1.14] Cleanup kube-rbac-proxy sidecar
-
- To Do
-
- is related to
-
CM-353 Cert-manager Operator 1.15 release
-
- Closed
-
- relates to
-
CM-448 CVE-2023-45288 - golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS
-
- To Do
-
- links to
- mentioned on
