Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-3020

Non-admin user cannot access Logging Console

    XMLWordPrintable

Details

    • False
    • None
    • False
    • NEW
    • NEW
    • Log Storage - Sprint 224

    Description

      Issue

      Lok'is logging console gets error as the attached image when we tried to access it with non-admin user.

      And the following error is recorded on our web browser's console.
      It seems that non-admin user has no enough permission to access the console.

      main-chunk-2367222d63b1979c8594.min.js:1 consoleFetch failed for url /api/kubernetes/api/v1/namespaces/logging-view/configmaps/logging-view-config a: configmaps "logging-view-config" is forbidden: User "test1" cannot get resource "configmaps" in API group "" in the namespace "logging-view" 
    at https://console-openshift-console.apps.hawk2p7-tmp.cluster.sub.nec.test/static/main-chunk-2367222d63b1979c8594.min.js:1:163568

      But, in EFK stack, non-admin user can access kibana.
      So it's a regression from the EFK stack.

      How to reproduce

      Setup Loki stack and enable RedHat OpenShift Logging Console Plugin according to https://docs.openshift.com/container-platform/4.11/logging/cluster-logging-loki.html#logging-loki-deploy_cluster-logging-loki .

      Then access https://console-openshift-console.apps.<domain>/monitoring/logs with non-admin user.

      Version

      $ oc get clusterversion
NAME      VERSION   AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.11.0    True        False         21d     Cluster version is 4.11.0

$ oc get csv -n openshift-logging
NAME                           DISPLAY                            VERSION   REPLACES                     PHASE
cluster-logging.5.5.0          Red Hat OpenShift Logging          5.5.0                                  Succeeded
loki-operator.5.5.0            Loki Operator                      5.5.0                                  Succeeded

      Attachments

        Issue Links

          duplicates

          Bug - A problem that impairs or prevents the functions of the product. LOG-2918 [release-5.5] Non-admin user with 'view' role can't see any logs in 'Logs' view

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Closed

          Bug - A problem that impairs or prevents the functions of the product. LOG-3072 Non-admin user with 'view' role can't see any logs in 'Logs' view

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Closed
          links to

          GitHub openshift/cluster-logging-operator#1641: LOG-2918: Reconcile role/binding allowing reading application logs

          mentioned on

          GitLab Merge request - Updated 6 upstream sources

          Activity

            People

              rojacob@redhat.com Robert Jacob
              kkii@redhat.com Keiichi Kii
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: