Controller ServiceMonitor disables TLS verification by default #2746

Bug Report

General Information

• Environment description (GKE, VM-Kubeadm, vagrant-dev-env, minikube, microk8s, ...)
  Repository manifest/configuration issue in pkg/KubeArmorController; reproducible from the checked-in manifests without a live cluster.
• Kernel version (run uname -a)
  Not applicable for manifest inspection.
• Orchestration system version in use (e.g. kubectl version, ...)
  Not applicable for manifest inspection.
• Link to relevant artifacts (policies, deployments scripts, ...)
  pkg/KubeArmorController/config/prometheus/monitor.yaml, pkg/KubeArmorController/cmd/main.go, pkg/KubeArmorController/config/default/kustomization.yaml
• Target containers/pods
  controller-manager metrics endpoint scraped through the Prometheus ServiceMonitor.

To Reproduce

1. Open pkg/KubeArmorController/config/prometheus/monitor.yaml.
2. Inspect spec.endpoints[0].tlsConfig.
3. Observe that the repository default sets insecureSkipVerify: true for HTTPS scraping.
4. Compare that with pkg/KubeArmorController/cmd/main.go, where the metrics endpoint is served securely by default and falls back to a self-signed certificate when no managed cert is configured.

Expected behavior

The Prometheus integration should either verify the controller metrics certificate by default or require an explicit insecure opt-in, rather than shipping a ServiceMonitor that skips TLS verification.

Screenshots

Not applicable.

Summary

The controller ServiceMonitor currently disables TLS certificate verification by default. That weakens transport integrity for scraped metrics and bakes an insecure pattern into the repository manifest.

Affected Area

• pkg/KubeArmorController/config/prometheus/monitor.yaml
• pkg/KubeArmorController/config/default/kustomization.yaml
• pkg/KubeArmorController/cmd/main.go

Steps to Reproduce

1. Inspect pkg/KubeArmorController/config/prometheus/monitor.yaml.
2. Note the committed tlsConfig.insecureSkipVerify: true value under the HTTPS metrics endpoint.
3. Render or apply the controller Prometheus manifests and observe that the generated ServiceMonitor keeps TLS verification disabled.

Expected Behaviour

Default Prometheus manifests should verify the controller metrics certificate, with insecure scraping requiring an explicit opt-in.

Actual Behaviour

The repository-default ServiceMonitor skips TLS verification for the controller metrics endpoint.

Technical Evidence

• pkg/KubeArmorController/config/prometheus/monitor.yaml commits insecureSkipVerify: true with an inline warning that it is not recommended for production.
• pkg/KubeArmorController/cmd/main.go enables secure metrics by default via --metrics-secure=true, but notes that controller-runtime will auto-generate self-signed certs unless managed certs are configured.
• pkg/KubeArmorController/config/default/kustomization.yaml already contains commented cert-manager guidance, which suggests the intended secure path exists conceptually but is not wired for the metrics ServiceMonitor.

Suspected Root Cause

The Kubebuilder scaffold for secure metrics scraping was left incomplete: the repository exposes HTTPS metrics, but the Prometheus ServiceMonitor still uses the insecure development setting instead of cert-manager-backed verification.

Proposed Direction

Wire the controller metrics endpoint to a cert-manager-managed secret and patch the ServiceMonitor to reference that CA/cert material with insecureSkipVerify: false, while keeping insecure scraping out of the default manifest.

Acceptance Criteria

• Default controller manifests no longer set insecureSkipVerify: true.
• A documented cert-manager-backed path exists for Prometheus scraping of controller metrics.
• Rendered manifests show the ServiceMonitor using certificate verification instead of insecure skip verify.