Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-2480

EO shouldn't grant cluster-wide permission to system:serviceaccount:openshift-monitoring:prometheus-k8s when ES cluster is deployed. [openshift-logging 5.2]

    XMLWordPrintable

Details

    • False
    • None
    • False
    • NEW
    • VERIFIED
    • Hide
      Before this update, system:serviceaccount:openshift-monitoring:prometheus-k8s was given cluster level privileges as a clusterrole & clusterrolebinding. With this update, this serviceaccount is restricted to the openshift-logging namespace with a role & rolebinding.
      Show
      Before this update, system:serviceaccount:openshift-monitoring:prometheus-k8s was given cluster level privileges as a clusterrole & clusterrolebinding. With this update, this serviceaccount is restricted to the openshift-logging namespace with a role & rolebinding.
    • Logging (LogExp) - Sprint 217, Logging (LogExp) - Sprint 218

    Description

      Description of problem:

      The system:serviceaccount:openshift-monitoring:prometheus-k8s is granted more privileges because the EO creates clusterrole/elasticsearch-metrics and clusterrolebinding/elasticsearch-metrics when ES cluster is deployed.

      $ oc get clusterrole elasticsearch-metrics  -oyaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  creationTimestamp: "2022-03-31T01:33:01Z"
  name: elasticsearch-metrics
  resourceVersion: "55931"
  uid: 4feb9e30-b280-4796-97a4-039bae5d25f1
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - services
  - endpoints
  verbs:
  - list
  - watch
- nonResourceURLs:
  - /metrics
  verbs:
  - get
$ oc get clusterrolebinding elasticsearch-metrics -oyaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  creationTimestamp: "2022-03-31T01:33:02Z"
  name: elasticsearch-metrics
  resourceVersion: "55934"
  uid: 6ef51a25-e8d7-4c26-bf31-ded16491d547
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: elasticsearch-metrics
subjects:
- kind: ServiceAccount
  name: prometheus-k8s
  namespace: openshift-monitoring

      Version-Release number of selected component (if applicable):

      elasticsearch-operator.5.4.0-127

      How reproducible:

      100%

      Steps to Reproduce:
      1. subscribe EO and CLO
      2. deploy ES cluster
      3. check clusterrole and clusterrolebinding

      Actual results:

      Expected results:

      Additional info: 

      Attachments

        Issue Links

          clones

          Bug - A problem that impairs or prevents the functions of the product. LOG-2437 EO shouldn't grant cluster-wide permission to system:serviceaccount:openshift-monitoring:prometheus-k8s when ES cluster is deployed. [openshift-logging 5.4]

          • Undefined - Priority not specified.
          • Closed
          links to

          GitHub openshift/elasticsearch-operator#877: Log 2480: Changing prometheus-k8s permissions scope

          Activity

            People

              gvanloo Gerard Vanloo (Inactive)
              gvanloo Gerard Vanloo (Inactive)
              Qiaoling Tang Qiaoling Tang
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: