fix: replace non-expiring metrics monitor SA token with TokenRequest

bundle/manifests/gitops-operator.clusterserviceversion.yaml

@@ -190,7 +190,7 @@ metadata:
     capabilities: Deep Insights
     console.openshift.io/plugins: '["gitops-plugin"]'
     containerImage: quay.io/redhat-developer/gitops-operator
-    createdAt: "2026-07-31T05:20:33Z"
+    createdAt: "2026-08-17T09:26:28Z"
     description: Enables teams to adopt GitOps principles for managing cluster configurations
       and application delivery across hybrid multi-cluster Kubernetes environments.
     features.operators.openshift.io/disconnected: "true"

bundle/manifests/openshift-gitops-operator-metrics-monitor_monitoring.coreos.com_v1_servicemonitor.yaml

@@ -6,9 +6,11 @@ metadata:
   name: openshift-gitops-operator-metrics-monitor
 spec:
   endpoints:
-  - bearerTokenSecret:
-      key: token
-      name: openshift-gitops-operator-metrics-monitor-bearer-token
+  - authorization:
+      credentials:
+        key: token
+        name: openshift-gitops-operator-metrics-monitor-bearer-token
+      type: Bearer
     interval: 30s
     path: /metrics
     port: metrics

cmd/main.go

@@ -341,6 +341,14 @@ func main() {
 			setupLog.Error(err, "unable to create controller", "controller", "Argo CD metrics")
 			os.Exit(1)
 		}
+
+		if err = (&controllers.OperatorMetricsTokenReconciler{
+			Client: client,
+			Scheme: mgr.GetScheme(),
+		}).SetupWithManager(mgr); err != nil {
+			setupLog.Error(err, "unable to create controller", "controller", "Operator metrics token")
+			os.Exit(1)
+		}
 	} else {
 		setupLog.Info("Monitoring API not found, skipping Argo CD metrics controller setup")
 	}

config/prometheus/monitor.yaml

@@ -1,14 +1,5 @@
 ---
 apiVersion: v1
-kind: Secret
-metadata:
-  name: metrics-monitor-bearer-token
-  namespace: openshift-gitops-operator
-  annotations:
-    kubernetes.io/service-account.name: openshift-gitops-operator-controller-manager
-type: kubernetes.io/service-account-token
----
-apiVersion: v1
 kind: ConfigMap
 metadata:
   annotations:
@@ -31,9 +22,11 @@ spec:
     matchLabels:
       control-plane: gitops-operator
   endpoints:
-    - bearerTokenSecret:
-        name: openshift-gitops-operator-metrics-monitor-bearer-token
-        key: token
+    - authorization:
+        type: Bearer
+        credentials:
+          name: openshift-gitops-operator-metrics-monitor-bearer-token
+          key: token
       interval: 30s
       path: /metrics
       port: metrics

controllers/argocd_controller.go

@@ -45,16 +45,16 @@ import (
 )
 
 const (
-	argocdNS                 = "openshift-gitops"
-	depracatedArgoCDNS       = "openshift-pipelines-app-delivery"
-	consoleLinkName          = "argocd"
-	argocdRouteName          = "openshift-gitops-server"
-	iconFilePath             = "/argo.png"
-	operatorPodNamespacePath = "/var/run/secrets/kubernetes.io/serviceaccount/namespace"
+	argocdNS           = "openshift-gitops"
+	depracatedArgoCDNS = "openshift-pipelines-app-delivery"
+	consoleLinkName    = "argocd"
+	argocdRouteName    = "openshift-gitops-server"
+	iconFilePath       = "/argo.png"
 )
 
 var (
-	encodedArgoImage string
+	operatorPodNamespacePath = "/var/run/secrets/kubernetes.io/serviceaccount/namespace"
+	encodedArgoImage         string
 
 	//go:embed argocd/img/argo.png
 	argoImage []byte

controllers/argocd_metrics_controller.go

@@ -20,7 +20,6 @@ import (
 	"context"
 	"embed"
 	"fmt"
-	"os"
 	"path/filepath"
 	"strings"
 
@@ -44,13 +43,11 @@ import (
 )
 
 const (
-	readRoleNameFormat         = "%s-read"
-	readRoleBindingNameFormat  = "%s-prometheus-k8s-read-binding"
-	alertRuleName              = "gitops-operator-argocd-alerts"
-	dashboardNamespace         = "openshift-config-managed"
-	dashboardFolder            = "dashboards"
-	operatorMetricsServiceName = "openshift-gitops-operator-metrics-service"
-	operatorMetricsMonitorName = "openshift-gitops-operator-metrics-monitor"
+	readRoleNameFormat        = "%s-read"
+	readRoleBindingNameFormat = "%s-prometheus-k8s-read-binding"
+	alertRuleName             = "gitops-operator-argocd-alerts"
+	dashboardNamespace        = "openshift-config-managed"
+	dashboardFolder           = "dashboards"
 )
 
 type ArgoCDMetricsReconciler struct {
@@ -182,11 +179,6 @@ func (r *ArgoCDMetricsReconciler) Reconcile(ctx context.Context, request reconci
 		if err != nil {
 			return reconcile.Result{}, err
 		}
-
-		err = r.reconcileOperatorMetricsServiceMonitor(reqLogger)
-		if err != nil {
-			return reconcile.Result{}, err
-		}
 	} else {
 		if exists {
 			namespace.Labels[monitoringLabel] = "false"
@@ -369,43 +361,6 @@ func (r *ArgoCDMetricsReconciler) deleteServiceMonitor(name string, namespace st
 
 }
 
-func (r *ArgoCDMetricsReconciler) reconcileOperatorMetricsServiceMonitor(reqLogger logr.Logger) error {
-
-	data, err := os.ReadFile(operatorPodNamespacePath)
-	if err != nil {
-		if os.IsNotExist(err) {
-			reqLogger.Info(fmt.Sprintf("Unable to retrieve the operator's running namespace via '%s': you should only see this message when running within unit tests, otherwise it is an error.", operatorPodNamespacePath))
-			return nil
-		}
-		reqLogger.Error(err, "Error retrieving operator's running namespace")
-		return err
-	}
-
-	operatorNS := string(data)
-	desiredMetricsServerName := operatorMetricsServiceName + "." + operatorNS + ".svc"
-
-	existingServiceMonitor := &monitoringv1.ServiceMonitor{}
-	err = r.Client.Get(context.TODO(), types.NamespacedName{Name: operatorMetricsMonitorName, Namespace: operatorNS}, existingServiceMonitor)
-
-	if err != nil {
-		if !errors.IsNotFound(err) {
-			reqLogger.Error(err, "Error querying for ServiceMonitor", "Namespace", operatorNS, "Name", operatorMetricsMonitorName)
-			return err
-		}
-
-		// no svc monitor found, nothing to do
-		return nil
-	}
-
-	currentServerName := existingServiceMonitor.Spec.Endpoints[0].TLSConfig.ServerName
-	if currentServerName == nil || *currentServerName != desiredMetricsServerName {
-		existingServiceMonitor.Spec.Endpoints[0].TLSConfig.ServerName = &desiredMetricsServerName
-		return r.Client.Update(context.TODO(), existingServiceMonitor)
-	}
-
-	return nil
-}
-
 func (r *ArgoCDMetricsReconciler) createPrometheusRuleIfAbsent(namespace string, argocd *argoapp.ArgoCD, reqLogger logr.Logger) error {
 	alertRule := newPrometheusRule(namespace)
 	existingAlertRule := &monitoringv1.PrometheusRule{}