Open cannibalisticcow opened 1 month ago
Observe page functions normally in 4.13.0-0.okd-2023-09-30-084937
Tested on 4.14.0-0.okd-2024-01-06-084517 Other than a bug with the plug-in rbac is working correctly for accessing the Observe page and querying the above endpoints.
Breaks from 4.15.0-0.okd-2024-02-10-035534
A 4.16 cluster has now been built too and the problem also exists there. 4.16.0-0.okd-scos-2024-08-14-110444
Thanks for testing. We'll take a look.
Describe the bug A user that has access to view the Observe panel and make queries to the endpoints; /api/prometheus/api/v1/rules and /api/alertmanager-user-workload/api/v2/alerts
On version 4.12 can no longer do this when the cluster is upgraded to 4.15. The Observe panel shows Forbidden and when looking at the network response the problem seems to be;![Screenshot from 2024-08-12 16-13-16](https://github.com/user-attachments/assets/43da526f-44c5-46a6-bebe-9b6ac37850d8)
Forbidden (user=robot, verb=get, resource=prometheuses, subresource=api)
When querying the user-workload endpoint the problem isForbidden (user=robot, verb=get, resource=alertmanagers, subresource=api)
I've been able to work around the problem by creating a new cluserrole and clusterrolebinding but feel like as this worked previously it should continue to work post upgrade. The user has a number of default custom roles applied to allow cluster metrics and state to be viewed. Default Roles applied
Work around
Version 4.15.0-0.okd-2024-03-10-010116
How reproducible We have multiple OKD clusters, all of the ones that have been upgraded from 4.12 to 4.15 are displaying this problem. The ones that are still at 4.12 continue to work. I've not had the opportunity yet to see if this is a problem that was introduced in .13, .14, or .15