refactor(controller): drive policy-server metrics port via CLI flag by officialasishkumar · Pull Request #1744 · kubewarden/adm-controller

officialasishkumar · 2026-05-14T06:41:52Z

Summary

Closes #787.

The controller exposed exactly one piece of its configuration through an environment variable,
KUBEWARDEN_POLICY_SERVER_SERVICES_METRICS_PORT, while every other knob already lived behind a
flag.* CLI flag. The mismatch made the documentation harder to keep consistent and forced the
Helm chart to use a different mechanism for this single setting.

This PR moves the configuration onto the existing CLI surface as a new
--policy-server-metrics-port integer flag and updates everything downstream of that change.

What changes

File	Change
`cmd/controller/main.go`	Adds the `--policy-server-metrics-port` flag (default `constants.PolicyServerMetricsPort`, validated against the same `[1, 65535]` range as `--webhook-server-port`). Drops the `os.Getenv` block plus the `strconv` import. Removes the now-unused `gocognit` nolint on `main()`.
`internal/constants/constants.go`	Drops `PolicyServerMetricsPortEnvVar`.
`api/policies/v1/policyserver_types.go`	The PolicyServer CRD doc comment for `metricsPort` now points users at the new flag.
`charts/kubewarden-crds/templates/crds/policies.kubewarden.io_policyservers.yaml`	Regenerated from the updated comment.
`docs/crds/CRD-docs-for-docs-repo.{adoc,md}`	Regenerated from the updated comment.
`charts/kubewarden-controller/templates/deployment.yaml`	Emits `--policy-server-metrics-port=...` inside the existing sidecar-mode args block (where the env var was set previously) and drops the matching `env:` entry.
`charts/kubewarden-controller/tests/telemetry_configuration_test.yaml`	The two assertions that pinned the env-var name are rewritten as `args:` assertions for the new flag.
`internal/controller/policyserver_controller.go`	Doc comment on `PolicyServerMetricsPort` now describes the CLI flag origin.
`internal/controller/policyserver_controller_service_test.go`	The test commentary and the two subtest names that referenced "env var" are renamed to "CLI flag".

Compatibility note

Operators who run the controller binary directly with the old env var set will need to switch to
--policy-server-metrics-port=<n>. This breaking change matches the request in the issue. The
Helm chart upgrade is transparent because the chart drives both ends.

Test plan

go build ./... builds cleanly
go vet ./... clean
golangci-lint run ./cmd/... ./internal/... ./api/... reports zero issues
make test-go passes all 58 envtest controller specs
make helm-unittest passes for all three charts (62 + 25 + 5 tests). The
telemetry configuration suite still validates that the sidecar-mode flag is present
and that non-sidecar mode does not emit it.
make generate is idempotent (the regenerated CRD chart and CRD docs only differ in
the comment line that switched from env-var name to CLI flag name).

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR migrates the controller-wide default PolicyServer metrics Service port configuration from an environment variable to a dedicated CLI flag, and updates tests/docs/charts accordingly.

Changes:

Add --policy-server-metrics-port CLI flag (with range validation) to set the controller-wide default metrics Service port.
Remove the KUBEWARDEN_POLICY_SERVER_SERVICES_METRICS_PORT env var constant and related wiring.
Update CRD docs, controller comments, Helm templates, and chart tests to reference the CLI flag instead of the env var.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
internal/controller/policyserver_controller_service_test.go	Updates test descriptions/assertion messages to reflect CLI-flag-based priority.
internal/controller/policyserver_controller.go	Updates reconciler field documentation to reference CLI flag.
internal/constants/constants.go	Removes the env var name constant used for metrics port configuration.
docs/crds/CRD-docs-for-docs-repo.md	Updates CRD field docs to reference the CLI flag default.
docs/crds/CRD-docs-for-docs-repo.adoc	Updates CRD field docs to reference the CLI flag default.
cmd/controller/main.go	Introduces CLI flag + validation and removes env var parsing logic.
charts/kubewarden-crds/templates/crds/policies.kubewarden.io_policyservers.yaml	Updates CRD schema description to reference CLI flag default.
charts/kubewarden-controller/tests/telemetry_configuration_test.yaml	Updates Helm chart tests to assert args-based flag instead of env var.
charts/kubewarden-controller/templates/deployment.yaml	Switches Helm deployment from env var injection to CLI flag argument.
api/policies/v1/policyserver_types.go	Updates API field comment to reference CLI flag default.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

officialasishkumar · 2026-05-14T16:48:42Z

 }

-//nolint:funlen,gocognit // Avoid splitting the main function in multiple functions to avoid changing the retcode logic for metrics shutdown
+//nolint:funlen // Avoid splitting the main function in multiple functions to avoid changing the retcode logic for metrics shutdown


Restored the gocognit suppression in 0bae37d.

officialasishkumar · 2026-05-14T16:48:50Z

+	// Validate --policy-server-metrics-port range.
+	if int64(*policyServerMetricsPortFlag) < minAllowedPort ||
+		int64(*policyServerMetricsPortFlag) > maxAllowedPort {
+		setupLog.Error(
+			errors.New("port must be between 1 and 65535"),
+			"invalid policy server metrics port",
+			"flag", "--policy-server-metrics-port",
+			"value", *policyServerMetricsPortFlag,
+			"min", minAllowedPort,
+			"max", maxAllowedPort,
+		)
+		retcode = 1
+		return
 	}
+	policyServerMetricsPort := int32(*policyServerMetricsPortFlag)


Added the deprecated env-var fallback with migration warnings in 0bae37d; explicit --policy-server-metrics-port still takes precedence.

The controller exposed exactly one piece of its configuration through an environment variable, `KUBEWARDEN_POLICY_SERVER_SERVICES_METRICS_PORT`, while every other knob already lived behind a `flag.*` CLI flag. The mismatch made the documentation harder to keep consistent and forced the Helm chart to use a different mechanism for this single setting. This commit moves the configuration onto the existing CLI surface: - `cmd/controller/main.go` registers a new `--policy-server-metrics-port` integer flag (default `constants.PolicyServerMetricsPort`, range `1`-`65535`, validated with the same pattern as `--webhook-server-port`), and drops the `os.Getenv` block plus the now-unused `strconv` import. The unused `gocognit` nolint on `main()` is removed because trimming the env-var parser brings the function under the threshold. - `internal/constants/constants.go` drops the `PolicyServerMetricsPortEnvVar` constant; nothing else referenced it. - The PolicyServer CRD doc comment in `api/policies/v1/policyserver_types.go` now points users at the new flag, and the generated CRD YAML (`charts/kubewarden-crds/templates/crds/policies.kubewarden.io_policyservers.yaml`) and CRD docs (`docs/crds/CRD-docs-for-docs-repo.{adoc,md}`) are regenerated. - `charts/kubewarden-controller/templates/deployment.yaml` emits `--policy-server-metrics-port=...` inside the existing sidecar-mode args block (where the env var was set previously), and drops the matching `env:` entry. - The two helm-unittest assertions in `charts/kubewarden-controller/tests/telemetry_configuration_test.yaml` that pinned the env-var name are rewritten as `args:` assertions for the new flag. - The comments in `internal/controller/policyserver_controller.go` and `internal/controller/policyserver_controller_service_test.go` are refreshed to describe the priority chain in terms of the CLI flag. Operators who run the controller binary directly with the old env var set will need to switch to `--policy-server-metrics-port=<n>`; this breaking change is intentional and matches the request in the issue. The Helm chart upgrade is transparent because the chart already drives both ends. Closes kubewarden#787 Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>

Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>

jvanz · 2026-05-14T16:38:35Z

       {{- if or .Values.telemetry.metrics .Values.telemetry.tracing }}
       {{- if and (eq .Values.telemetry.mode "sidecar") }}
        - --enable-otel-sidecar
+        {{- if .Values.telemetry.metrics }}


If you migrating to the CLI, please ensure the helm chart template follow the same "if"

Updated in f3190f5. The template now uses the same and .Values.telemetry.metrics (eq .Values.telemetry.mode "sidecar") condition for --policy-server-metrics-port, with Helm unittest coverage for sidecar tracing-only mode.

jvanz · 2026-05-14T16:52:55Z

+	policyServerMetricsPortFlag := flag.Int("policy-server-metrics-port",
+		constants.PolicyServerMetricsPort,
+		"The default port exposed by every PolicyServer metrics Service. "+
+			"Per-PolicyServer overrides (spec.metricsPort) always take priority.")


Please, follow the other CLI flags parttern. Declare the var above and use it in the IntVar call.

Updated in f3190f5. policyServerMetricsPort is now declared with the other local flag variables and registered through flag.IntVar, matching the existing pattern.

Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>

Copilot AI review requested due to automatic review settings May 14, 2026 06:41

officialasishkumar requested a review from a team as a code owner May 14, 2026 06:41

github-project-automation Bot added this to Kubewarden Admission Controller May 14, 2026

github-project-automation Bot moved this to Pending review in Kubewarden Admission Controller May 14, 2026

Copilot AI reviewed May 14, 2026

View reviewed changes

officialasishkumar added 2 commits May 14, 2026 22:10

fix(controller): keep deprecated metrics port env fallback

0bae37d

Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>

officialasishkumar force-pushed the issue-787-metrics-port-cli-flag branch from a63cbd8 to 0bae37d Compare May 14, 2026 16:46

jvanz requested changes May 14, 2026

View reviewed changes

jvanz moved this from Pending review to Blocked in Kubewarden Admission Controller May 14, 2026

fix(controller): address metrics port review feedback

f3190f5

Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>

officialasishkumar force-pushed the issue-787-metrics-port-cli-flag branch from e2bfc81 to f3190f5 Compare May 15, 2026 06:37

viccuad assigned officialasishkumar May 18, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

refactor(controller): drive policy-server metrics port via CLI flag#1744

refactor(controller): drive policy-server metrics port via CLI flag#1744
officialasishkumar wants to merge 3 commits into
kubewarden:mainfrom
officialasishkumar:issue-787-metrics-port-cli-flag

officialasishkumar commented May 14, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

officialasishkumar May 14, 2026

Uh oh!

officialasishkumar May 14, 2026

Uh oh!

jvanz May 14, 2026

Uh oh!

officialasishkumar May 15, 2026

Uh oh!

jvanz May 14, 2026

Uh oh!

officialasishkumar May 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

officialasishkumar commented May 14, 2026

Summary

What changes

Compatibility note

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

officialasishkumar May 14, 2026

Choose a reason for hiding this comment

Uh oh!

officialasishkumar May 14, 2026

Choose a reason for hiding this comment

Uh oh!

jvanz May 14, 2026

Choose a reason for hiding this comment

Uh oh!

officialasishkumar May 15, 2026

Choose a reason for hiding this comment

Uh oh!

jvanz May 14, 2026

Choose a reason for hiding this comment

Uh oh!

officialasishkumar May 15, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants