⚠️ Action Required: Replace Deprecated gcr.io/kubebuilder/kube-rbac-proxy

[camilamacedo86]

Description

⚠️ The image gcr.io/kubebuilder/kube-rbac-proxy is deprecated and will become unavailable.
You must move as soon as possible, sometime from early 2025, the GCR will go away.

Unfortunately, we're unable to provide any guarantees regarding timelines or potential extensions at this time. Images provided under GRC will be unavailable from March 18, 2025, as per announcement. However, gcr.io/kubebuilder/may be unavailable before this date due to efforts to deprecate infrastructure.

• If your project uses gcr.io/kubebuilder/kube-rbac-proxy, it will be affected.
  Your project may fail to work if the image cannot be pulled. You must take action as soon as possible.

• However, if your project is no longer using this image, no action is required, and you can close this issue.

Using the image gcr.io/kubebuilder/kube-rbac-proxy?

kube-rbac-proxy was historically used to protect the metrics endpoint. However, its usage has been discontinued in Kubebuilder. The default scaffold now leverages the WithAuthenticationAndAuthorization feature provided by Controller-Runtime.

This feature provides integrated support for securing metrics endpoints by embedding authentication (authn) and authorization (authz) mechanisms directly into the controller manager's metrics server, replacing the need for (https://github.com/brancz/kube-rbac-proxy) to secure metrics endpoints.

What To Do?

You must replace the deprecated image gcr.io/kubebuilder/kube-rbac-proxy with an alternative approach. For example:

• Update your project to use WithAuthenticationAndAuthorization:

  You can fully upgrade your project to use the latest scaffolds provided by the tool or manually make the necessary changes. Refer to the FAQ and Discussion for detailed instructions on how to manually update your project and test the changes.

• Alternatively, replace the image with another trusted source at your own risk, as its usage has been discontinued in Kubebuilder.

For further information, suggestions, and guidance:

• 📖 FAQ and Discussion
• 💬 Join the Slack channel: #kubebuilder.

NOTE: This issue was opened automatically as part of our efforts to identify projects that might be affected and to raise awareness about this change within the community. If your project is no longer using this image, feel free to close this issue.

We sincerely apologize for any inconvenience this may cause.

Thank you for your cooperation and understanding! 🙏

[jtaleric]

hey @camilamacedo86 I tried to patch this up, but I am running into some issues, see below

jtaleric at polaris in ~/code/benchmark-operator on master* $ operator-sdk_linux_amd64 alpha generate 
INFO[0000] kubebuilder init:
$ kubebuilder init --plugins ansible.sdk.operatorframework.io/v1 --domain cloudbulldozer.io 
Error: no plugin could be resolved with key "ansible.sdk.operatorframework.io/v1"
Usage:
  kubebuilder [flags]

Examples:
The first step is to initialize your project:
    kubebuilder init [--plugins=<PLUGIN KEYS> [--project-version=<PROJECT VERSION>]]

<PLUGIN KEYS> is a comma-separated list of plugin keys from the following table
and <PROJECT VERSION> a supported project version for these plugins.

                             Plugin keys | Supported project versions
-----------------------------------------+----------------------------
               base.go.kubebuilder.io/v4 |                          3
 deploy-image.go.kubebuilder.io/v1-alpha |                          3
                    go.kubebuilder.io/v4 |                          3
         grafana.kubebuilder.io/v1-alpha |                          3
      kustomize.common.kubebuilder.io/v2 |                          3

For more specific help for the init command of a certain plugins and project version
configuration please run:
    kubebuilder init --help --plugins=<PLUGIN KEYS> [--project-version=<PROJECT VERSION>]

Default plugin keys: "go.kubebuilder.io/v4"
Default project version: "3"


Flags:
  -h, --help                     help for kubebuilder
      --plugins strings          plugin keys to be used for this subcommand execution
      --project-version string   project version (default "3")

FATA no plugin could be resolved with key "ansible.sdk.operatorframework.io/v1" 
FATA[0000] Failed to run init subcommand exit status 1  

[jtaleric]

FATA no plugin could be resolved with key "ansible.sdk.operatorframework.io/v1"

However, when I create a new project, I don't see this issue... is this a limitation of the upgrade path? It doesn't support Ansible plugin?

[camilamacedo86]

You are using SDK, so you need to download SDK tool
Then, see: migration guide

How you can do with ansibled one.
I hope that helps out.

[jtaleric]

@camilamacedo86

I used operator-sdk_linux_amd64 alpha generate is that not right?

[camilamacedo86]

The SDK does not provide an option to simply re-generate the project based on the PROJECT file. The command exists as a bug. You have two options to address this:

1. Use SDK to Re-Generate the Project

   • Re-run the same commands you used to create the project initially.

   So that mainly is:

   • a) create a new branch, example git branch -b upgrade
   • b) cleanup the local dir ( rm -rf * )
   • c) regenerate your project from the scratch. By looking at the PROJECT file, it shows to be:

   operator-sdk init --domain cloudbulldozer.io --plugins=ansible.sdk.operatorframework.io/v1
   operator-sdk create api --group=ripsaw --version=v1alpha1 --kind=Benchmark --namespaced
   make all
   

   d) Now, you can compare the local branch "upgrade" with the main branch and add all your code again on top of it.

OR

2. Follow the Documentation to Perform Manual Changes
   • Refer to the official documentation for upgrading the SDK version:
     Upgrading SDK Version v1.38.0
   • Perform the necessary changes manually based on the guidance provided.

I hope that helps you out.