-
Bug
-
Resolution: Unresolved
-
Normal
-
None
-
4.20.0
-
None
-
Quality / Stability / Reliability
-
False
-
-
None
-
Moderate
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Description of problem:
see similar bug OCPBUGS-57585
checked in 4.20.0-0.nightly-2025-07-20-021531, openshift-cluster-samples-operator metrics endpoint 60000 port exposed all the information without any authorization
should implement proper authentication
$ oc -n openshift-cluster-samples-operator get pod -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
cluster-samples-operator-7c5b8cd45c-km2tz 2/2 Running 0 11h 10.130.0.17 ip-10-0-43-21.us-east-2.compute.internal <none> <none>
$ oc -n openshift-cluster-samples-operator get ep
Warning: v1 Endpoints is deprecated in v1.33+; use discovery.k8s.io/v1 EndpointSlice
NAME ENDPOINTS AGE
metrics 10.130.0.17:60000 11h
$ oc -n openshift-cluster-samples-operator exec -c cluster-samples-operator cluster-samples-operator-7c5b8cd45c-km2tz -- curl -k https://10.130.0.17:60000/metrics | head
# HELP go_gc_duration_seconds A summary of the pause duration of garbage collection cycles.
# TYPE go_gc_duration_seconds summary
go_gc_duration_seconds{quantile="0"} 2.3695e-05
go_gc_duration_seconds{quantile="0.25"} 3.8262e-05
go_gc_duration_seconds{quantile="0.5"} 4.6618e-05
go_gc_duration_seconds{quantile="0.75"} 6.5987e-05
go_gc_duration_seconds{quantile="1"} 0.000223554
go_gc_duration_seconds_sum 0.027658377
go_gc_duration_seconds_count 439
# HELP go_goroutines Number of goroutines that currently exist.
Version-Release number of selected component (if applicable):
$ oc get clusterversion NAME VERSION AVAILABLE PROGRESSING SINCE STATUS version 4.20.0-0.nightly-2025-07-20-021531 True False 11h Cluster version is 4.20.0-0.nightly-2025-07-20-021531
How reproducible:
always
Steps to Reproduce:
1. see descriptions
Actual results:
openshift-cluster-samples-operator metrics endpoint 60000 port exposed all the information without any authorization
Expected results:
should be with authorization
Additional info:
the issue also exist in 4.19 and previous versions
When the bug is fixed, please remove it from this code snippet to avoid regression.
