fix: Target Down for metrics monitor

[akhilnittala]

What type of PR is this?
/kind bug

What does this PR do / why we need it:
Target Down alerts are firing because of https handling is not happening as kube-rbac-proxy image has been deprecated. Implemented metrics monitor to work for https from prometheus scraping from controller main code.
Have you updated the necessary documentation?

• Documentation update is required by this PR.
• Documentation has been updated.

Which issue(s) this PR fixes:

Fixes #?
https://redhat.atlassian.net/browse/GITOPS-10273
Test acceptance criteria:

• Unit Test
• E2E Test

How to test changes / Special notes to the reviewer:

Deploy gitops operator with namespace having openshift.io/cluster-monitoring:'true' label on openshift-gitops-operator namespace
check alerts and target all are up.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: e2c37ffb-c35e-4971-8ca0-da0a0fe63a76

📥 Commits

Reviewing files that changed from the base of the PR and between b999418 and 427a4b4.

📒 Files selected for processing (1)

• cmd/main.go

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• argoproj-labs/argocd-operator (manual)

🚧 Files skipped from review as they are similar to previous changes (1)

• cmd/main.go

---

📝 Walkthrough

Summary by CodeRabbit

• New Features
  • Added an opt-in secure mode for the metrics endpoint (via a --metrics-secure flag), enabling HTTPS-only serving.
• Bug Fixes
  • Updated the metrics Service to reference the correct serving certificate secret.
  • Ensured the metrics certificate secret is mounted and used read-only for secure metrics.
  • Refined metrics server behavior so secure filtering/cert handling applies only when secure mode is enabled.

Walkthrough

Adds a --metrics-secure CLI flag and buildMetricsServerOptions helper to conditionally enable secure metrics serving. Updates manifests and bundle files to pass the flag, mount gitops-operator-metrics-tls, and point the metrics Service annotation at that secret.

Changes

Secure Metrics TLS

Layer / File(s)	Summary
metrics-secure flag and buildMetricsServerOptions helper cmd/main.go	Adds secureMetrics and --metrics-secure; replaces inline metrics server options with buildMetricsServerOptions to configure secure serving and conditional authn/authz filtering.
Deployment manifests: flag, volumeMount, and volumes for metrics TLS config/default/manager_metrics_patch.yaml, config/manager/manager.yaml, bundle/manifests/gitops-operator.clusterserviceversion.yaml	Adds --metrics-secure=true, mounts metrics-certs from gitops-operator-metrics-tls, and updates the bundle CSV timestamp and pod spec for secure metrics.
Service TLS secret annotation update config/rbac/metrics_service.yaml, bundle/manifests/openshift-gitops-operator-metrics-service_v1_service.yaml	Changes the serving-cert secret annotation to gitops-operator-metrics-tls in both service manifests.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly reflects the bug fix for metrics monitor target-down alerts.
Description check	✅ Passed	The description matches the changes by explaining the HTTPS metrics scraping fix and the target-down issue.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@cmd/main.go`:
- Line 184: The metrics server setup is rebuilding the TLS options instead of
using the already computed tlsOpts, so the HTTPS metrics listener misses the
cluster TLS profile. Update the buildMetricsServerOptions call in main to pass
the existing tlsOpts slice (which already includes disableHTTP2 and any cluster
profile settings) rather than constructing a new one inline. Use the nearby
tlsOpts setup and buildMetricsServerOptions to locate the change.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 85d3d968-67d1-40ed-a855-878bbfb9b3a2

📥 Commits

Reviewing files that changed from the base of the PR and between 93a8216 and b999418.

📒 Files selected for processing (6)

• bundle/manifests/gitops-operator.clusterserviceversion.yaml
• bundle/manifests/openshift-gitops-operator-metrics-service_v1_service.yaml
• cmd/main.go
• config/default/manager_metrics_patch.yaml
• config/manager/manager.yaml
• config/rbac/metrics_service.yaml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• argoproj-labs/argocd-operator (manual)

[akhilnittala]

/retest-required

[svghadi]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: svghadi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [svghadi]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[anandf]

Should we keep the name as openshift-gitops-operator-metrics-tls and in other places ?