fix: replace non-expiring metrics monitor SA token with TokenRequest

cmd/main.go

@@ -352,6 +352,14 @@ func main() {
 			setupLog.Error(err, "unable to create controller", "controller", "Argo CD metrics")
 			os.Exit(1)
 		}
+
+		if err = (&controllers.OperatorMetricsTokenReconciler{
+			Client: client,
+			Scheme: mgr.GetScheme(),
+		}).SetupWithManager(mgr); err != nil {
+			setupLog.Error(err, "unable to create controller", "controller", "Operator metrics token")
+			os.Exit(1)
+		}
 	} else {
 		setupLog.Info("Monitoring API not found, skipping Argo CD metrics controller setup")
 	}

config/prometheus/monitor.yaml

@@ -1,13 +1,6 @@
 ---
-apiVersion: v1
-kind: Secret
-metadata:
-  name: metrics-monitor-bearer-token
-  namespace: openshift-gitops-operator
-  annotations:
-    kubernetes.io/service-account.name: openshift-gitops-operator-controller-manager
-type: kubernetes.io/service-account-token
----
+# CA bundle for the operator metrics ServiceMonitor TLS config. The ServiceMonitor
+# itself is created by OperatorMetricsTokenReconciler after the bearer token Secret.
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -18,29 +11,3 @@ metadata:
     service.beta.openshift.io/inject-cabundle: "true"
   name: metrics-monitor-ca-bundle
   namespace: openshift-gitops-operator
----
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: metrics-monitor
-  namespace: openshift-gitops-operator
-  labels:
-    control-plane: gitops-operator
-spec:
-  selector:
-    matchLabels:
-      control-plane: gitops-operator
-  endpoints:
-    - bearerTokenSecret:
-        name: openshift-gitops-operator-metrics-monitor-bearer-token
-        key: token
-      interval: 30s
-      path: /metrics
-      port: metrics
-      scheme: https
-      tlsConfig:
-        ca:
-          configMap:
-            name: openshift-gitops-operator-metrics-monitor-ca-bundle
-            key: service-ca.crt
-        serverName: openshift-gitops-operator-metrics-service.openshift-gitops-operator.svc

controllers/argocd_controller.go

@@ -55,7 +55,6 @@ const (
 
 var (
 	encodedArgoImage string
-
 	//go:embed argocd/img/argo.png
 	argoImage []byte
 )

controllers/argocd_metrics_controller.go

@@ -20,7 +20,6 @@ import (
 	"context"
 	"embed"
 	"fmt"
-	"os"
 	"path/filepath"
 	"strings"
 
@@ -48,11 +47,9 @@ const (
 	readRoleBindingNameFormat = "%s-prometheus-k8s-read-binding"
 	alertRuleName             = "gitops-operator-argocd-alerts"
 	// Use a separate rule so upgrades install the sync-loop alerts.
-	syncLoopAlertRuleName      = "gitops-operator-argocd-sync-loop-alerts"
-	dashboardNamespace         = "openshift-config-managed"
-	dashboardFolder            = "dashboards"
-	operatorMetricsServiceName = "openshift-gitops-operator-metrics-service"
-	operatorMetricsMonitorName = "openshift-gitops-operator-metrics-monitor"
+	syncLoopAlertRuleName = "gitops-operator-argocd-sync-loop-alerts"
+	dashboardNamespace    = "openshift-config-managed"
+	dashboardFolder       = "dashboards"
 )
 
 type ArgoCDMetricsReconciler struct {
@@ -184,11 +181,6 @@ func (r *ArgoCDMetricsReconciler) Reconcile(ctx context.Context, request reconci
 		if err != nil {
 			return reconcile.Result{}, err
 		}
-
-		err = r.reconcileOperatorMetricsServiceMonitor(reqLogger)
-		if err != nil {
-			return reconcile.Result{}, err
-		}
 	} else {
 		if exists {
 			namespace.Labels[monitoringLabel] = "false"
@@ -373,43 +365,6 @@ func (r *ArgoCDMetricsReconciler) deleteServiceMonitor(name string, namespace st
 
 }
 
-func (r *ArgoCDMetricsReconciler) reconcileOperatorMetricsServiceMonitor(reqLogger logr.Logger) error {
-
-	data, err := os.ReadFile(operatorPodNamespacePath)
-	if err != nil {
-		if os.IsNotExist(err) {
-			reqLogger.Info(fmt.Sprintf("Unable to retrieve the operator's running namespace via '%s': you should only see this message when running within unit tests, otherwise it is an error.", operatorPodNamespacePath))
-			return nil
-		}
-		reqLogger.Error(err, "Error retrieving operator's running namespace")
-		return err
-	}
-
-	operatorNS := string(data)
-	desiredMetricsServerName := operatorMetricsServiceName + "." + operatorNS + ".svc"
-
-	existingServiceMonitor := &monitoringv1.ServiceMonitor{}
-	err = r.Client.Get(context.TODO(), types.NamespacedName{Name: operatorMetricsMonitorName, Namespace: operatorNS}, existingServiceMonitor)
-
-	if err != nil {
-		if !errors.IsNotFound(err) {
-			reqLogger.Error(err, "Error querying for ServiceMonitor", "Namespace", operatorNS, "Name", operatorMetricsMonitorName)
-			return err
-		}
-
-		// no svc monitor found, nothing to do
-		return nil
-	}
-
-	currentServerName := existingServiceMonitor.Spec.Endpoints[0].TLSConfig.ServerName
-	if currentServerName == nil || *currentServerName != desiredMetricsServerName {
-		existingServiceMonitor.Spec.Endpoints[0].TLSConfig.ServerName = &desiredMetricsServerName
-		return r.Client.Update(context.TODO(), existingServiceMonitor)
-	}
-
-	return nil
-}
-
 func (r *ArgoCDMetricsReconciler) createPrometheusRulesIfAbsent(namespace string, argocd *argoapp.ArgoCD, reqLogger logr.Logger) error {
 	if err := r.createPrometheusRuleIfAbsent(newPrometheusRule(namespace), argocd, reqLogger); err != nil {
 		return err