Merge pull request #4004 from kubernetes-sigs/master

📖 Update book-v4 with changes from latest release v4.1.0

.github/workflows/release.yml

@@ -19,7 +19,7 @@ jobs:
         with:
           go-version: '~1.22'
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v5
+        uses: goreleaser/goreleaser-action@v6
         with:
           version: v1.11.2
           args: release -f ./build/.goreleaser.yml --rm-dist

.github/workflows/test-sample-go.yml

@@ -19,15 +19,13 @@ jobs:
 
       - name: Create kind cluster
         run: kind create cluster
-        
+
       - name: Prepare the environment
         run: |
           KUSTOMIZATION_FILE_PATH="testdata/project-v4/config/default/kustomization.yaml"
           sed -i '25s/^#//' $KUSTOMIZATION_FILE_PATH
-          sed -i '32s/^#//' $KUSTOMIZATION_FILE_PATH
-          sed -i '47s/^#//' $KUSTOMIZATION_FILE_PATH
-          sed -i '51,147s/^#//' $KUSTOMIZATION_FILE_PATH
-      
+          sed -i '46s/^#//' $KUSTOMIZATION_FILE_PATH
+
       - name: Test
         run: |
           cd testdata/project-v4

.github/workflows/testdata.yml

@@ -18,7 +18,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: '~1.22'
+          go-version: '1.22.3'
       - name: Remove pre-installed kustomize
         # This step is needed as the following one tries to remove
         # kustomize for each test but has no permission to do so

.golangci.yml

@@ -61,6 +61,7 @@ linters-settings:
       #
       - name: bool-literal-in-expr
       - name: constant-logical-expr
+      - name: comment-spacings
 
 linters:
   disable-all: true

CONTRIBUTING.md

@@ -53,7 +53,7 @@ $ git clone git@github.com:<user>/kubebuilder.git $GOPATH/src/sigs.k8s.io/kubebu
 
 - e2e tests use [`kind`][kind] and [`setup-envtest`][setup-envtest]. If you want to bring your own binaries, place them in `$(go env GOPATH)/bin`.
 
-**IMPORTANT:** The `make generate` is very helpful. By using it, you can check if good part of the commands still working successfully after the changes. Also, note that its usage is a pre-requirement to submit a PR.
+**IMPORTANT:** The `make generate` is very helpful. By using it, you can check if good part of the commands still working successfully after the changes. Also, note that its usage is a prerequisite to submit a PR.
 
 Following the targets that can be used to test your changes locally.
 
@@ -67,7 +67,27 @@ Following the targets that can be used to test your changes locally.
 | make check-testdata | Checks if the testdata dir is updated with the latest changes | yes                  |
 | make test-e2e-local | Runs the CI e2e tests locally                                 | no                   |
 
-**NOTE** To use the `make lint` is required to install `golangci-lint` locally. More info: https://github.com/golangci/golangci-lint#install
+**NOTE** `make lint` requires a local installation of `golangci-lint`. More info: https://github.com/golangci/golangci-lint#install
+
+### Running e2e tests locally
+
+See that you can run `test-e2e-local` to setup Kind and run e2e tests locally.
+Another option is by manually starting up Kind and configuring it and then,
+you can for example via your IDEA debug the e2e tests.
+
+To manually setup run:
+
+```shell
+# To generate an Kubebuilder local binary with your changes
+make install
+# To create the cluster and configure a CNI which supports NetworkPolicy
+kind create cluster --config ./test/e2e/kind-config.yaml
+kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml
+```
+
+Now, you can for example, run in debug mode the `test/e2e/v4/e2e_suite_test.go`:
+
+![example](https://github.com/kubernetes-sigs/kubebuilder/assets/7708031/277d26d5-c94d-41f0-8f02-1381458ef750)
 
 ### Test Plugin
 

Makefile

@@ -159,10 +159,8 @@ test-e2e-ci: ## Run the end-to-end tests (used in the CI)`
 
 .PHONY: test-book
 test-book: ## Run the cronjob tutorial's unit tests to make sure we don't break it
-	# TODO: Uncomment when we bump controller-runtime
-    # See: https://github.com/kubernetes-sigs/kubebuilder/issues/3917
-	# cd ./docs/book/src/cronjob-tutorial/testdata/project && make test
-	# cd ./docs/book/src/multiversion-tutorial/testdata/project && make test
+	cd ./docs/book/src/cronjob-tutorial/testdata/project && make test
+	cd ./docs/book/src/multiversion-tutorial/testdata/project && make test
 	cd ./docs/book/src/getting-started/testdata/project && make test
 
 .PHONY: test-license

docs/README.md

@@ -2,7 +2,7 @@
 
 The kubebuilder book is served using [mdBook](https://github.com/rust-lang-nursery/mdBook). If you want to test changes to the book locally, follow these directions:
 
-1. Follow the instructions at [https://github.com/rust-lang-nursery/mdBook#installation](https://github.com/rust-lang-nursery/mdBook#installation) to
+1. Follow the instructions at [https://rust-lang.github.io/mdBook/guide/installation.html](https://rust-lang.github.io/mdBook/guide/installation.html) to
    install mdBook.
 2. Make sure [controller-gen](https://pkg.go.dev/sigs.k8s.io/controller-tools/cmd/controller-gen) is installed in `$GOPATH`.
 3. cd into the `docs/book` directory

docs/book/src/cronjob-tutorial/testdata/project/.golangci.yml

@@ -34,8 +34,14 @@ linters:
     - misspell
     - nakedret
     - prealloc
+    - revive
     - staticcheck
     - typecheck
     - unconvert
     - unparam
     - unused
+
+linters-settings:
+  revive:
+    rules:
+      - name: comment-spacings

docs/book/src/cronjob-tutorial/testdata/project/cmd/main.go

@@ -32,6 +32,7 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
+	"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
 	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
 	"sigs.k8s.io/controller-runtime/pkg/webhook"
 
@@ -76,14 +77,14 @@ func main() {
 	var probeAddr string
 	var secureMetrics bool
 	var enableHTTP2 bool
-	flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metric endpoint binds to. "+
-		"Use the port :8080. If not set, it will be 0 in order to disable the metrics server")
+	flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metrics endpoint binds to. "+
+		"Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable the metrics service.")
 	flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
 	flag.BoolVar(&enableLeaderElection, "leader-elect", false,
 		"Enable leader election for controller manager. "+
 			"Enabling this will ensure there is only one active controller manager.")
-	flag.BoolVar(&secureMetrics, "metrics-secure", false,
-		"If set the metrics endpoint is served securely")
+	flag.BoolVar(&secureMetrics, "metrics-secure", true,
+		"If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead.")
 	flag.BoolVar(&enableHTTP2, "enable-http2", false,
 		"If set, HTTP/2 will be enabled for the metrics and webhook servers")
 	opts := zap.Options{
@@ -116,10 +117,25 @@ func main() {
 
 	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
 		Scheme: scheme,
+		// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
+		// More info:
+		// - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.18.4/pkg/metrics/server
+		// - https://book.kubebuilder.io/reference/metrics.html
 		Metrics: metricsserver.Options{
 			BindAddress:   metricsAddr,
 			SecureServing: secureMetrics,
-			TLSOpts:       tlsOpts,
+			// TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
+			// not provided, self-signed certificates will be generated by default. This option is not recommended for
+			// production environments as self-signed certificates do not offer the same level of trust and security
+			// as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
+			// unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
+			// to provide certificates, ensuring the server communicates using trusted and secure certificates.
+			TLSOpts: tlsOpts,
+			// FilterProvider is used to protect the metrics endpoint with authn/authz.
+			// These configurations ensure that only authorized users and service accounts
+			// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
+			// https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.18.4/pkg/metrics/filters#WithAuthenticationAndAuthorization
+			FilterProvider: filters.WithAuthenticationAndAuthorization,
 		},
 		WebhookServer:          webhookServer,
 		HealthProbeBindAddress: probeAddr,