CNTRLPLANE-3584: Add RBAC for kube-scheduler /metrics/resources endpoint

control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go

@@ -1587,6 +1587,13 @@ func (r *HostedControlPlaneReconciler) reconcileOLMAndMiscCerts(ctx context.Cont
 		return fmt.Errorf("failed to reconcile olm operator serving cert: %w", err)
 	}
 
+	schedulerServerSecret := manifests.SchedulerServerCertSecret(hcp.Namespace)
+	if _, err := createOrUpdate(ctx, r, schedulerServerSecret, func() error {
+		return pki.ReconcileSchedulerServerSecret(schedulerServerSecret, rootCASecret, p.OwnerRef)
+	}); err != nil {
+		return fmt.Errorf("failed to reconcile scheduler serving cert: %w", err)
+	}
+
 	cvoServerCert := manifests.ClusterVersionOperatorServerCertSecret(hcp.Namespace)
 	if _, err := createOrUpdate(ctx, r, cvoServerCert, func() error {
 		return pki.ReconcileCVOServerSecret(cvoServerCert, rootCASecret, p.OwnerRef)

control-plane-operator/controllers/hostedcontrolplane/manifests/pki.go

@@ -272,6 +272,8 @@ func KASMachineBootstrapClientCertSecret(ns string) *corev1.Secret {
 
 func KCMServerCertSecret(ns string) *corev1.Secret { return secretFor(ns, "kcm-server") }
 
+func SchedulerServerCertSecret(ns string) *corev1.Secret { return secretFor(ns, "scheduler-server") }
+
 func ServiceAccountSigningKeySecret(ns string) *corev1.Secret { return secretFor(ns, "sa-signing-key") }
 
 func OpenShiftAPIServerCertSecret(ns string) *corev1.Secret {

control-plane-operator/controllers/hostedcontrolplane/pki/scheduler.go

@@ -0,0 +1,19 @@
+package pki
+
+import (
+	"fmt"
+
+	"github.com/openshift/hypershift/support/config"
+
+	corev1 "k8s.io/api/core/v1"
+)
+
+func ReconcileSchedulerServerSecret(secret, ca *corev1.Secret, ownerRef config.OwnerRef) error {
+	dnsNames := []string{
+		fmt.Sprintf("kube-scheduler.%s.svc", secret.Namespace),
+		fmt.Sprintf("kube-scheduler.%s.svc.cluster.local", secret.Namespace),
+		"kube-scheduler",
+		"localhost",
+	}
+	return reconcileSignedCertWithAddresses(secret, ca, ownerRef, "kube-scheduler", []string{"openshift"}, X509UsageClientServerAuth, dnsNames, nil)
+}

control-plane-operator/controllers/hostedcontrolplane/pki/scheduler_test.go

@@ -0,0 +1,76 @@
+package pki
+
+import (
+	"testing"
+
+	. "github.com/onsi/gomega"
+
+	"github.com/openshift/hypershift/support/certs"
+	"github.com/openshift/hypershift/support/config"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestReconcileSchedulerServerSecret(t *testing.T) {
+	t.Parallel()
+
+	t.Run("When secret is empty it should generate a valid cert", func(t *testing.T) {
+		t.Parallel()
+		g := NewWithT(t)
+
+		ca := createTestCA(t)
+		secret := &corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "scheduler-server",
+				Namespace: "test-namespace",
+			},
+		}
+
+		err := ReconcileSchedulerServerSecret(secret, ca, config.OwnerRef{})
+		g.Expect(err).ToNot(HaveOccurred())
+		g.Expect(secret.Data[corev1.TLSCertKey]).ToNot(BeEmpty())
+		g.Expect(secret.Data[corev1.TLSPrivateKeyKey]).ToNot(BeEmpty())
+	})
+
+	t.Run("When secret already has a valid cert it should not regenerate", func(t *testing.T) {
+		t.Parallel()
+		g := NewWithT(t)
+
+		ca := createTestCA(t)
+		secret := &corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "scheduler-server",
+				Namespace: "test-namespace",
+			},
+		}
+
+		err := ReconcileSchedulerServerSecret(secret, ca, config.OwnerRef{})
+		g.Expect(err).ToNot(HaveOccurred())
+
+		initialCert := make([]byte, len(secret.Data[corev1.TLSCertKey]))
+		copy(initialCert, secret.Data[corev1.TLSCertKey])
+
+		err = ReconcileSchedulerServerSecret(secret, ca, config.OwnerRef{})
+		g.Expect(err).ToNot(HaveOccurred())
+		g.Expect(secret.Data[corev1.TLSCertKey]).To(Equal(initialCert))
+	})
+}
+
+func createTestCA(t *testing.T) *corev1.Secret {
+	t.Helper()
+	g := NewWithT(t)
+
+	caSecret := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "root-ca",
+			Namespace: "test-namespace",
+		},
+	}
+	err := ReconcileRootCA(caSecret, config.OwnerRef{})
+	g.Expect(err).ToNot(HaveOccurred())
+	g.Expect(caSecret.Data[certs.CASignerCertMapKey]).ToNot(BeEmpty())
+	g.Expect(caSecret.Data[certs.CASignerKeyMapKey]).ToNot(BeEmpty())
+
+	return caSecret
+}