Loading...

Blocked:
False
Ready:
False
Docs QE Status:
NEW
QE Status:
VERIFIED
Release Note Text:
With this change, the permissions granted to the prometheus service account are reduced from a cluster scoped role and binding to one that is specifically granted to the openshift-logging namespace

Sprint:
Logging (Core) - Sprint 214, Logging (Core) - Sprint 216, Logging (Core) - Sprint 218, Logging (Core) - Sprint 219, Logging (Core) - Sprint 220

Description of problem:

The Prometheus-k8s service account is granted more privileges because of the cluster logging cluster-role-binding.

Version-Release number of selected component (if applicable):

How reproducible:
100%

Steps to Reproduce:
1. Install ClusterLogging using OLM.
2.
3.

Actual results:
CRB that grants access to the prometheus-k8s service account to all namespaces

Expected results:
Only grant access to the cluster logging namespaces

Additional info:

blocks

LOG-2286 Prometheus can't watch pods/endpoints/services in openshift-logging namespace when only the CLO is deployed.

is related to

LOG-1972 Getting message, "Prometheus could not scrape fluentd for more than 10m."

links to

4.6 Bugzilla Issue

mentioned on

Merge request - Updated 6 upstream sources

(7 mentioned on)

Reduce Permissions granted for prometheus-k8s service account