-
Task
-
Resolution: Done
-
Major
-
None
-
None
-
None
-
None
After we have replaced all oauth-proxy occurrences in the monitoring stack, we need to make sure that all references to oauth-proxy are removed from the cluster monitoring operator. Examples:
- https://github.com/openshift/cluster-monitoring-operator/blob/1bbf0f0a3a8f9a5227077df683b908b69a9ac26b/pkg/manifests/config.go#L137
- https://github.com/openshift/cluster-monitoring-operator/blob/1bbf0f0a3a8f9a5227077df683b908b69a9ac26b/manifests/image-references#L33-L36
- https://github.com/openshift/cluster-monitoring-operator/blob/1bbf0f0a3a8f9a5227077df683b908b69a9ac26b/jsonnet/main.jsonnet#L74
- Because oauth-proxy couldn't live-reload the trusted CA bundles, CMO had to generate "hashed" configmaps (e.g. alertmanager-trusted-ca-bundle-xxx) and mount them into Alertmanager, Prometheus, ... While the pods still need the trusted CA bundle for remote write, webhooks and so on, these "hashed" configmaps aren't needed anymore since components use the trusted CA bundle configmaps generated by the service CA operator.
- depends on
-
MON-3380 Replace oauth-proxy container with kube-rbac-proxy in Prometheus pod
- Closed
-
MON-3381 Replace oauth-proxy container with kube-rbac-proxy in Alertmanager pods
- Closed
-
MON-3700 Replace oauth-proxy container with kube-rbac-proxy in ThanosRuler
- Closed
-
MON-3379 Replace OAuth-proxy container with kube-rbac-proxy in Thanos-Querier pod
- Closed
- links to
(7 links to)