Problem statement

KGO utilizes kube-rbac-proxy for metrics endpoint protection: https://github.com/Kong/gateway-operator/blob/83702a93c24a603bb7219bac09a581af037f8f62/config/default/manager_auth_proxy_patch.yaml

Kubebuilder v4 removes support for that image. Images from gcr.io/kubebuilder/kube-rbac-proxy repo will be available until March 18, 2025.

Proposed solution

In order to keep support for metrics endpoint protection we can

• migrate to using https://quay.io/repository/brancz/kube-rbac-proxy which is not supported or endorsed by kubebuilder

• drop protection from metrics endpoint

• look into other solutions like introduced in kubebuilder 4.1.0

  Re-introduces authn/authz protection for the metrics endpoint using WithAuthenticationAndAuthorization provided by controller-runtime. (✨ Add protection to metrics endpoint using authn/authz via controller-runtime feature kubernetes-sigs/kubebuilder#4003)

Anything else ?

More information: kubernetes-sigs/kubebuilder#3907

Acceptance criteria

• KGO's repo doesn't use or include kube-rbac-proxy
• Helm chart is updated with a migration plan (in which chart version https://github.com/Kong/charts/blob/610f2b8c303e51c8af23d7a481d8d9d122fc3f59/charts/gateway-operator/values.yaml#L5-L16 setting are going to be removed) and a version expressing the deprecation (or straight out removal) is released.