Add readiness check for metrics server when using `WithAuthenticationAndAuthorization()

We’ve observed that when using WithAuthenticationAndAuthorization() (with self-signed certs), the metrics server may take a few seconds to become available on Kubernetes 1.33+.

In particular, some Kubebuilder tests started failing against 1.33, where they were still passing in previous versions < 1.33. After debugging, the root cause seems to be a delay related to how Kubernetes 1.33 handles token availability and cert readiness, likely due to changes in the API server behaviour.

To solve our tests for 1.33+ we added a delay: https://github.com/kubernetes-sigs/kubebuilder/pull/4882/files

Just an Idea

It might be nice if controller-runtime could provide a ReadyzCheck for the metrics server. That would help in scenarios using either self-signed or provided certs, by allowing consumers to verify the /metrics endpoint is actually ready (serving over HTTPS and accepting tokens) before probing or testing.

Thanks for your work and for considering this 🙌

@camilamacedo86

@camilamacedo86 Not sure if a controller should be not ready because the metrics server is not up yet.

For reference, we already have something for the webhook server that can be used like this: https://github.com/kubernetes-sigs/cluster-api/blob/1efdb87b22a5e4f05e8d56e473732438572b9276/main.go#L436 (see also

controller-runtime/pkg/webhook/server.go

Line 273 in 3b0b995

func (s *DefaultServer) StartedChecker() healthz.Checker {

)

@alvaroaleman

But maybe it's fine to implement something similar for the metrics server so folks can ensure it actually works?

@alvaroaleman Do you have an opinion on this?

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue as fresh with /remove-lifecycle stale
Close this issue with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

/remove-lifecycle stale

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue as fresh with /remove-lifecycle rotten
Close this issue with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

/remove-lifecycle rotten

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue as fresh with /remove-lifecycle stale
Close this issue with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

/remove-lifecycle stale

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue as fresh with /remove-lifecycle stale
Close this issue with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

/remove-lifecycle rotten

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue as fresh with /remove-lifecycle rotten
Close this issue with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

/remove-lifecycle stale

/remove-lifecycle rotten

@sbueringer

Hi @sbueringer could we please add the frozen label in this one?

/remove-lifecycle rotten
/lifecycle frozen

Navigation Menu

Repository navigation

Add readiness check for metrics server when using `WithAuthenticationAndAuthorization() #3238

Just an Idea

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Add readiness check for metrics server when using `WithAuthenticationAndAuthorization() #3238

Description

Just an Idea

Activity

sbueringer commented on Jun 28, 2025

sbueringer commented on Jun 28, 2025

k8s-triage-robot commented on Sep 26, 2025

camilamacedo86 commented on Sep 26, 2025

k8s-triage-robot commented on Oct 26, 2025

camilamacedo86 commented on Oct 26, 2025

k8s-triage-robot commented on Jan 24, 2026

camilamacedo86 commented on Jan 25, 2026

k8s-triage-robot commented on Apr 25, 2026

camilamacedo86 commented on Apr 25, 2026

k8s-triage-robot commented on May 25, 2026

camilamacedo86 commented on May 25, 2026

camilamacedo86 commented on May 25, 2026

camilamacedo86 commented on May 25, 2026

sbueringer commented on May 26, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions