Migrate from kube-rbac-proxy to Controller-Runtime’s feature WithAuthenticationAndAuthorization

CHANGELOG.md

@@ -9,6 +9,7 @@ Fix:
 * VaultPKISecret: correct Vault API path when issuerRef is set; path was rendered as `pki/issuer/<name>/<role>` instead of the correct `pki/issuer/<name>/issue/<role>`, causing Vault to return 404 for all cert issuance requests when issuerRef was specified ([#1336](https://github.com/hashicorp/vault-secrets-operator/pull/1336))
 
 BREAKING CHANGES:
+* Remove the `kube-rbac-proxy` sidecar, dropping the dependency on the discontinued `gcr.io/kubebuilder/kube-rbac-proxy` image. `/metrics` is now served by the operator itself over HTTPS on port `8443`, protected in-process by controller-runtime's `filters.WithAuthenticationAndAuthorization`, which performs the same `TokenReview`/`SubjectAccessReview` checks. The `controller.kubeRbacProxy.*` Helm values have been **removed**, and the chart now fails to render if they are still set — including via `helm upgrade --reuse-values` — so update your values before upgrading; use `controller.manager.resources` to tune manager resources. The metrics Service, its port, and the ServiceMonitor are unchanged, so existing Prometheus configuration keeps working, but unlike `kube-rbac-proxy` the filter accepts bearer tokens only and does not support client-certificate (mTLS) authentication ([#1352](https://github.com/hashicorp/vault-secrets-operator/pull/1352))
 * Remove HCP Vault Secrets (HVS) support. HVS reached end-of-life on July 1, 2026. The `HCPAuth` and `HCPVaultSecretsApp` CRDs, their controllers, credentials provider, RBAC manifests, Helm chart assets, and the `github.com/hashicorp/hcp-sdk-go` dependency have all been permanently removed. **Clusters with existing `HCPVaultSecretsApp` or `HCPAuth` resources must clean up those instances before upgrading** to avoid resources becoming stuck in `Terminating` due to the finalizer `hcpvaultsecretsapp.secrets.hashicorp.com/finalizer`. ([#1307](https://github.com/hashicorp/vault-secrets-operator/pull/1307))
 
 ## 1.5.1 (August 11th, 2026)

Makefile

@@ -4,9 +4,6 @@
 # - use the VERSION as arg of the bundle target (e.g make bundle VERSION=0.0.2)
 # - use environment variables to overwrite this value (e.g export VERSION=0.0.2)
 VERSION ?= 0.0.0-dev
-KUBE_RBAC_PROXY_VERSION ?= v0.18.1
-KUBE_RBAC_PROXY_REPOSITORY ?= quay.io/brancz/kube-rbac-proxy
-OPENSHIFT_KUBE_RBAC_PROXY_VERSION ?= v4.15.0
 VSO_CSI_DRIVER_VERSION ?= 1.0.3
 VSO_CSI_LIVENESS_PROBE_VERSION ?= v2.16.0
 VSO_CSI_NODE_DRIVER_REGISTRAR_VERSION ?= v2.14.0
@@ -348,7 +345,6 @@ integration-test-both: ## Run integration tests against Vault Enterprise and Vau
 integration-test-chart:
 	IMAGE_TAG_BASE=$(IMAGE_TAG_BASE) \
 	VERSION=$(VERSION) \
-	KUBE_RBAC_PROXY_VERSION=$(KUBE_RBAC_PROXY_VERSION) \
 	INTEGRATION_TESTS=true \
 	go test github.com/hashicorp/vault-secrets-operator/test/chart/... $(TESTARGS) -timeout=10m
 
@@ -683,8 +679,6 @@ endif
 .PHONY: check-versions
 check-versions: yq
 	VERSION=$(VERSION) \
-	KUBE_RBAC_PROXY_VERSION=$(KUBE_RBAC_PROXY_VERSION) \
-	OPENSHIFT_KUBE_RBAC_PROXY_VERSION=$(OPENSHIFT_KUBE_RBAC_PROXY_VERSION) \
 	VSO_CSI_DRIVER_VERSION=$(VSO_CSI_DRIVER_VERSION) \
 	VSO_CSI_LIVENESS_PROBE_VERSION=$(VSO_CSI_LIVENESS_PROBE_VERSION) \
 	VSO_CSI_NODE_DRIVER_REGISTRAR_VERSION=$(VSO_CSI_NODE_DRIVER_REGISTRAR_VERSION) ./scripts/check-versions.sh

chart/templates/deployment.yaml

@@ -3,6 +3,19 @@
 # SPDX-License-Identifier: BUSL-1.1
 */}}
 
+{{/*
+Fail if controller.kubeRbacProxy.* is still set. The sidecar has been removed, and
+Helm silently ignores unknown values, so without this guard a stale setting would
+appear to apply but have no effect.
+*/}}
+{{- if hasKey .Values.controller "kubeRbacProxy" }}
+{{- fail (printf "\n%s\n%s\n%s"
+  "controller.kubeRbacProxy.* is no longer supported."
+  "The sidecar was removed; the manager now serves metrics over HTTPS with built-in authn/authz."
+  "Remove it from your values; use controller.manager.resources to tune resources.")
+}}
+{{- end }}
+
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -46,28 +59,11 @@ spec:
       {{- end }}
     spec:
       containers:
-      - name: kube-rbac-proxy
-        args:
-        - --secure-listen-address=0.0.0.0:8443
-        - --upstream=http://127.0.0.1:8080/
-        - --logtostderr=true
-        - --v=0
-        env:
-        - name: KUBERNETES_CLUSTER_DOMAIN
-          value: {{ .Values.controller.kubernetesClusterDomain }}
-        image: {{ .Values.controller.kubeRbacProxy.image.repository }}:{{ .Values.controller.kubeRbacProxy.image.tag }}
-        imagePullPolicy: {{ .Values.controller.kubeRbacProxy.image.pullPolicy }}
-        ports:
-        - containerPort: 8443
-          name: https
-          protocol: TCP
-        resources: {{- toYaml .Values.controller.kubeRbacProxy.resources | nindent 10 }}
-        securityContext:
-          {{- toYaml .Values.controller.securityContext | nindent 10 }}
       - name: manager
         args:
         - --health-probe-bind-address=:8081
-        - --metrics-bind-address=127.0.0.1:8080
+        - --metrics-bind-address=:8443
+        - --metrics-secure=true
         - --leader-elect
         {{- if .Values.controller.manager.clientCache.persistenceModel }}
         - --client-cache-persistence-model={{ .Values.controller.manager.clientCache.persistenceModel }}
@@ -135,6 +131,10 @@ spec:
             port: 8081
           initialDelaySeconds: 5
           periodSeconds: 10
+        ports:
+        - containerPort: 8443
+          name: https
+          protocol: TCP
         resources: {{- toYaml .Values.controller.manager.resources | nindent 10 }}
         securityContext:
           {{- toYaml .Values.controller.securityContext | nindent 10 }}

chart/values.yaml

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: BUSL-1.1
 
 # Top level configuration for the vault secrets operator deployment.
-# This consists of a controller and a kube rbac proxy container.
+# This consists of the controller manager container.
 controller:
   # Set the number of replicas for the operator.
   # @type: integer
@@ -161,28 +161,6 @@ controller:
         # @type: boolean
         edit: false
 
-  # Settings related to the kubeRbacProxy container. This container is an HTTP proxy for the
-  # controller manager which performs RBAC authorization against the Kubernetes API using SubjectAccessReviews.
-  kubeRbacProxy:
-    # Image sets the repo and tag of the kube-rbac-proxy image to use for the controller.
-    image:
-      pullPolicy: IfNotPresent
-      repository: quay.io/brancz/kube-rbac-proxy
-      tag: v0.18.1
-
-    # Configures the default resources for the kube rbac proxy container.
-    # For more information on configuring resources, see the K8s documentation:
-    # https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-    # @recurse: true
-    # @type: map
-    resources:
-      limits:
-        cpu: 500m
-        memory: 128Mi
-      requests:
-        cpu: 5m
-        memory: 64Mi
-
   # Image pull secret to use for private container registry authentication which will be applied to the controllers
   # service account. Alternatively, the value may be specified as an array of strings.
   # Example:

config/default-openshift/kustomization.yaml

@@ -5,5 +5,4 @@ bases:
 - ../default
 
 patchesStrategicMerge:
-- manager_ubi_auth_proxy_patch.yaml
 - manager_resource_patch.yaml

config/default/manager_auth_proxy_patch.yaml

@@ -1,8 +1,20 @@
 # Copyright IBM Corp. 2024, 2026
 # SPDX-License-Identifier: BUSL-1.1
 
-# This patch inject a sidecar container which is a HTTP proxy for the
-# controller manager, it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews.
+# This patch configures the manager to serve its metrics endpoint over HTTPS,
+# protected by authentication and authorization (TokenReview and
+# SubjectAccessReview) performed in-process by controller-runtime's
+# filters.WithAuthenticationAndAuthorization. This replaces the kube-rbac-proxy
+# sidecar that previously fronted the metrics endpoint.
+#
+# --metrics-secure decides the mode. To serve /metrics without authn/authz, set
+# it to false here, change the bind address to a plain-HTTP one, and also
+# comment out the auth_proxy_* resources in config/rbac/kustomization.yaml.
+# Changing only one of the two leaves the deployment inconsistent.
+#
+# The "https" port name below is referenced by the metrics Service
+# (config/rbac/auth_proxy_service.yaml) via targetPort. If it is removed or
+# renamed the Service resolves to no endpoints and metrics silently break.
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -12,32 +24,13 @@ spec:
   template:
     spec:
       containers:
-      - name: kube-rbac-proxy
-        securityContext:
-          allowPrivilegeEscalation: false
-        # TODO(user): uncomment for common cases that do not require escalating privileges
-        # capabilities:
-        #   drop:
-        #     - "ALL"
-        image: quay.io/brancz/kube-rbac-proxy:v0.18.1
+      - name: manager
         args:
-        - "--secure-listen-address=0.0.0.0:8443"
-        - "--upstream=http://127.0.0.1:8080/"
-        - "--logtostderr=true"
-        - "--v=0"
+        - "--health-probe-bind-address=:8081"
+        - "--metrics-bind-address=:8443"
+        - "--metrics-secure=true"
+        - "--leader-elect"
         ports:
         - containerPort: 8443
           protocol: TCP
           name: https
-        resources:
-          limits:
-            cpu: 500m
-            memory: 128Mi
-          requests:
-            cpu: 5m
-            memory: 64Mi
-      - name: manager
-        args:
-        - "--health-probe-bind-address=:8081"
-        - "--metrics-bind-address=127.0.0.1:8080"
-        - "--leader-elect"

config/persistence-encrypted-test/kustomization.yaml

@@ -25,11 +25,15 @@ bases:
 # [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
 #- ../prometheus
 
-patchesStrategicMerge:
-# Protect the /metrics endpoint by putting it behind auth.
-# If you want your controller-manager to expose the /metrics
-# endpoint w/o any authn/z, please comment the following line.
-- manager_args_patch.yaml
+patchesJson6902:
+# Appends the persistence args to the manager container. Uses a JSON patch so
+# the base args (including the secure metrics configuration) are preserved.
+- target:
+    group: apps
+    version: v1
+    kind: Deployment
+    name: controller-manager
+  path: manager_args_patch.yaml
 
 # Mount the controller config file for loading manager configurations
 # through a ComponentConfig type

config/persistence-encrypted-test/manager_args_patch.yaml

@@ -1,16 +1,12 @@
 # Copyright IBM Corp. 2024, 2026
 # SPDX-License-Identifier: BUSL-1.1
 
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: controller-manager
-  namespace: system
-spec:
-  template:
-    spec:
-      containers:
-      - name: manager
-        args:
-        - "-client-cache-persistence-model=direct-encrypted"
-        - "-zap-log-level=6"
+# Appends to the manager's args rather than replacing them. A strategic-merge
+# patch would overwrite the whole list and drop the base args, including the
+# secure metrics configuration.
+- op: add
+  path: /spec/template/spec/containers/0/args/-
+  value: --client-cache-persistence-model=direct-encrypted
+- op: add
+  path: /spec/template/spec/containers/0/args/-
+  value: --zap-log-level=6

config/persistence-encrypted/kustomization.yaml

@@ -25,11 +25,15 @@ bases:
 # [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
 #- ../prometheus
 
-patchesStrategicMerge:
-# Protect the /metrics endpoint by putting it behind auth.
-# If you want your controller-manager to expose the /metrics
-# endpoint w/o any authn/z, please comment the following line.
-- manager_args_patch.yaml
+patchesJson6902:
+# Appends the persistence args to the manager container. Uses a JSON patch so
+# the base args (including the secure metrics configuration) are preserved.
+- target:
+    group: apps
+    version: v1
+    kind: Deployment
+    name: controller-manager
+  path: manager_args_patch.yaml
 
 # Mount the controller config file for loading manager configurations
 # through a ComponentConfig type

config/persistence-encrypted/manager_args_patch.yaml

@@ -1,15 +1,9 @@
 # Copyright IBM Corp. 2024, 2026
 # SPDX-License-Identifier: BUSL-1.1
 
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: controller-manager
-  namespace: system
-spec:
-  template:
-    spec:
-      containers:
-      - name: manager
-        args:
-        - "--client-cache-persistence-model=direct-encrypted"
+# Appends to the manager's args rather than replacing them. A strategic-merge
+# patch would overwrite the whole list and drop the base args, including the
+# secure metrics configuration.
+- op: add
+  path: /spec/template/spec/containers/0/args/-
+  value: --client-cache-persistence-model=direct-encrypted

config/persistence-unencrypted/kustomization.yaml

@@ -25,12 +25,15 @@ bases:
 # [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
 #- ../prometheus
 
-patchesStrategicMerge:
-# Protect the /metrics endpoint by putting it behind auth.
-# If you want your controller-manager to expose the /metrics
-# endpoint w/o any authn/z, please comment the following line.
-- manager_args_patch.yaml
-#- prometheus_patch.yaml
+patchesJson6902:
+# Appends the persistence args to the manager container. Uses a JSON patch so
+# the base args (including the secure metrics configuration) are preserved.
+- target:
+    group: apps
+    version: v1
+    kind: Deployment
+    name: controller-manager
+  path: manager_args_patch.yaml
 
 # Mount the controller config file for loading manager configurations
 # through a ComponentConfig type

config/persistence-unencrypted/manager_args_patch.yaml

@@ -1,15 +1,9 @@
 # Copyright IBM Corp. 2024, 2026
 # SPDX-License-Identifier: BUSL-1.1
 
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: controller-manager
-  namespace: system
-spec:
-  template:
-    spec:
-      containers:
-      - name: manager
-        args:
-        - "--client-cache-persistence-model=direct-unencrypted"
+# Appends to the manager's args rather than replacing them. A strategic-merge
+# patch would overwrite the whole list and drop the base args, including the
+# secure metrics configuration.
+- op: add
+  path: /spec/template/spec/containers/0/args/-
+  value: --client-cache-persistence-model=direct-unencrypted

config/rbac/auth_proxy_client_clusterrole.yaml

@@ -1,6 +1,9 @@
 # Copyright IBM Corp. 2024, 2026
 # SPDX-License-Identifier: BUSL-1.1
 
+# This ClusterRole is intended for clients (for example Prometheus) that need
+# to scrape the protected metrics endpoint. Bind it to the scraping
+# ServiceAccount to allow GET on /metrics.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:

config/rbac/auth_proxy_role.yaml

@@ -1,6 +1,10 @@
 # Copyright IBM Corp. 2024, 2026
 # SPDX-License-Identifier: BUSL-1.1
 
+# This ClusterRole grants the controller manager permission to create
+# TokenReviews and SubjectAccessReviews, which it uses to authenticate and
+# authorize requests to its metrics endpoint via
+# filters.WithAuthenticationAndAuthorization.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:

config/rbac/auth_proxy_role_binding.yaml

@@ -1,6 +1,8 @@
 # Copyright IBM Corp. 2024, 2026
 # SPDX-License-Identifier: BUSL-1.1
 
+# Binds the metrics authn/authz ClusterRole to the controller manager's
+# ServiceAccount, which performs the TokenReview/SubjectAccessReview checks.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:

config/rbac/auth_proxy_service.yaml

@@ -1,6 +1,8 @@
 # Copyright IBM Corp. 2024, 2026
 # SPDX-License-Identifier: BUSL-1.1
 
+# This Service exposes the manager's metrics endpoint over HTTPS. The endpoint
+# is served directly by the manager and protected with authn/authz in-process.
 apiVersion: v1
 kind: Service
 metadata: