Issue with opensearch-operator-controller-manager-metrics-service

[karan56625]

Hi Team, what is the significance of opensearch-operator-controller-manager-metrics-service service? It exposes 8443 port of opensearch-operator-controller-manager, but metrics of opensearch-operator-controller-manager are exposed at 8080 port. Whenever I try to hit opensearch-operator-controller-manager-metrics-service service, I always get unauthorised.

[swoehrl-mw]

Hi @karan56625.
This is a special construct to expose a metrics endpoint but protect its access. You can find more details here: https://book.kubebuilder.io/reference/metrics.html

The manager container offers its metrics at port 8080 as you have seen, but only on localhost (127.0.0.1). The kube-rbac-proxy (running as a sidecar) then exposes that to the kubernetes cluster on 8443 with TLS and authentication.