metrics.secure: true serves over HTTPS with a self-signed certificate and no authentication or authorization: anything able to reach the pod on that port can read the series. (The chart used to claim "HTTPS with authn/authz", which was wrong; that comment now says what it does.)
What leaks is modest — pool and namespace names, cell phases, capacity figures. No credentials, no guest data. Which is why this is an enhancement rather than a defect.
The fix is controller-runtime's standard filter:
FilterProvider: filters.WithAuthenticationAndAuthorization
plus create on tokenreviews and subjectaccessreviews, and a metrics-reader ClusterRole for Prometheus's ServiceAccount to bind.
The reason it is not done already: sigs.k8s.io/controller-runtime/pkg/metrics/filters imports k8s.io/apiserver, which pulls a large dependency tree into an operator whose first design principle is avoiding exactly that. That is a deliberate trade to make consciously, not a line to add in passing.
Interim mitigation for anyone who cares: a NetworkPolicy restricting the metrics port to the Prometheus namespace, or metrics.bindAddress: "0" to serve nothing.
metrics.secure: trueserves over HTTPS with a self-signed certificate and no authentication or authorization: anything able to reach the pod on that port can read the series. (The chart used to claim "HTTPS with authn/authz", which was wrong; that comment now says what it does.)What leaks is modest — pool and namespace names, cell phases, capacity figures. No credentials, no guest data. Which is why this is an enhancement rather than a defect.
The fix is controller-runtime's standard filter:
plus
createontokenreviewsandsubjectaccessreviews, and ametrics-readerClusterRole for Prometheus's ServiceAccount to bind.The reason it is not done already:
sigs.k8s.io/controller-runtime/pkg/metrics/filtersimportsk8s.io/apiserver, which pulls a large dependency tree into an operator whose first design principle is avoiding exactly that. That is a deliberate trade to make consciously, not a line to add in passing.Interim mitigation for anyone who cares: a NetworkPolicy restricting the metrics port to the Prometheus namespace, or
metrics.bindAddress: "0"to serve nothing.