refactor: unify metricsGC controller init into controllers.go and add…

cmd/agent-sandbox-controller/main.go

@@ -290,19 +290,15 @@ func main() {
 		os.Exit(1)
 	}
 
-	metricsGC := sandboxmetricsgc.NewReconciler(sandboxmetricsgc.Options{
-		Workers:       metricsAsyncWorkers,
-		ChannelBuffer: metricsAsyncQueueCap,
-	})
-	if err := metricsGC.SetupWithManager(mgr); err != nil {
-		setupLog.Error(err, "unable to setup sandbox metrics GC controller")
-		os.Exit(1)
-	}
-
 	setupLog.Info("setup controllers",
 		"metricsAsyncWorkers", metricsAsyncWorkers,
 		"metricsAsyncQueueCap", metricsAsyncQueueCap)
-	if err = controller.SetupWithManager(mgr, controller.Deps{MetricsCleanup: metricsGC}); err != nil {
+	if err = controller.SetupWithManager(mgr, controller.Deps{
+		MetricsGCOptions: sandboxmetricsgc.Options{
+			Workers:       metricsAsyncWorkers,
+			ChannelBuffer: metricsAsyncQueueCap,
+		},
+	}); err != nil {
 		setupLog.Error(err, "unable to setup controllers")
 		os.Exit(1)
 	}

config/default/kustomization.yaml

@@ -35,7 +35,13 @@ resources:
 
 # Uncomment the patches line if you enable Metrics
 patches:
-# [METRICS] The following patch will enable the metrics endpoint using HTTPS and the port :8443.
+# [METRICS] The following patch enables the metrics endpoint on plain HTTP
+# port :8080 with authentication disabled. This trade-off allows in-cluster
+# scrapers (Prometheus, E2E tests via pods/proxy) to reach /metrics without
+# wiring a service-account bearer token; production deployments should add a
+# NetworkPolicy (see config/network-policy/) or a kube-rbac-proxy sidecar to
+# restrict access. To re-enable HTTPS+auth on :8443, edit
+# config/default/manager_metrics_patch.yaml.
 # More info: https://book.kubebuilder.io/reference/metrics
 - path: manager_metrics_patch.yaml
   target:

config/default/manager_metrics_patch.yaml

@@ -1,4 +1,23 @@
-# This patch adds the args to allow exposing the metrics endpoint using HTTPS
+# This patch configures the metrics endpoint to listen on plain HTTP on port
+# :8080 with authentication/authorization disabled.
+#
+# Rationale:
+#   - In-cluster scrapers (Prometheus, e2e tests via the kube-apiserver
+#     `pods/proxy` subresource) cannot easily forward bearer tokens to the
+#     upstream pod when going through the API server proxy, so the default
+#     kubebuilder `WithAuthenticationAndAuthorization` filter on :8443 cannot
+#     be reached without provisioning a service-account token on a curl pod.
+#   - Production hardening for the metrics endpoint is delegated to a
+#     NetworkPolicy (see config/network-policy/allow-metrics-traffic.yaml) or
+#     a kube-rbac-proxy sidecar, which are independent of the metrics server's
+#     own TLS+auth configuration.
+#
+# The patches below are applied as a JSON patch with `op: add` against the
+# existing args list defined in config/manager/manager.yaml, prepending the
+# two new flags so they take precedence over any inherited defaults.
 - op: add
   path: /spec/template/spec/containers/0/args/0
-  value: --metrics-bind-address=:8443
+  value: --metrics-bind-address=:8080
+- op: add
+  path: /spec/template/spec/containers/0/args/0
+  value: --metrics-secure=false

go.mod

@@ -19,6 +19,7 @@ require (
 	github.com/onsi/gomega v1.38.2
 	github.com/prometheus/client_golang v1.23.2
 	github.com/prometheus/client_model v0.6.2
+	github.com/prometheus/common v0.66.1
 	github.com/spf13/cobra v1.10.0
 	github.com/spf13/pflag v1.0.9
 	github.com/stretchr/testify v1.11.1
@@ -92,7 +93,6 @@ require (
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/prometheus/common v0.66.1 // indirect
 	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/robfig/cron/v3 v3.0.1 // indirect
 	github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 // indirect

pkg/controller/controllers.go

@@ -17,10 +17,13 @@ limitations under the License.
 package controller
 
 import (
+	"fmt"
+
 	"sigs.k8s.io/controller-runtime/pkg/manager"
 
 	"github.com/openkruise/agents/pkg/controller/sandbox"
 	"github.com/openkruise/agents/pkg/controller/sandboxclaim"
+	"github.com/openkruise/agents/pkg/controller/sandboxmetricsgc"
 	"github.com/openkruise/agents/pkg/controller/sandboxset"
 	"github.com/openkruise/agents/pkg/controller/sandboxupdateops"
 	"github.com/openkruise/agents/pkg/controller/securitytokenrefresh"
@@ -30,24 +33,28 @@ import (
 // New dependencies should be appended here rather than introducing extra
 // AddFunc parameters across all controllers.
 type Deps struct {
-	MetricsCleanup sandbox.Enqueuer
+	MetricsGCOptions sandboxmetricsgc.Options
 }
 
 func SetupWithManager(m manager.Manager, deps Deps) error {
-	if err := sandbox.Add(m, deps.MetricsCleanup); err != nil {
-		return err
+	metricsGC := sandboxmetricsgc.NewReconciler(deps.MetricsGCOptions)
+	if err := metricsGC.SetupWithManager(m); err != nil {
+		return fmt.Errorf("sandbox-metrics-gc: %w", err)
+	}
+	if err := sandbox.Add(m, metricsGC); err != nil {
+		return fmt.Errorf("sandbox: %w", err)
 	}
 	if err := sandboxset.Add(m); err != nil {
-		return err
+		return fmt.Errorf("sandboxset: %w", err)
 	}
 	if err := sandboxclaim.Add(m); err != nil {
-		return err
+		return fmt.Errorf("sandboxclaim: %w", err)
 	}
 	if err := sandboxupdateops.Add(m); err != nil {
-		return err
+		return fmt.Errorf("sandboxupdateops: %w", err)
 	}
 	if err := securitytokenrefresh.Add(m); err != nil {
-		return err
+		return fmt.Errorf("securitytokenrefresh: %w", err)
 	}
 	return nil
 }