Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-4049

[release-5.7] User can list labels and label values for all user workload namespaces via Loki Label APIs

    XMLWordPrintable

Details

    • Log Storage - Sprint 236

    Description

      Description of problem:

      With an normal user that have limit access to some application namspaces in OpenShift I can query labels from all Namespaces via loki query endpoint.

      Version-Release number of selected component (if applicable):

      5.6.2

      How reproducible:

      Unconfirmed

      Steps to Reproduce:

       

      $ oc login --token=****** --server=https://api.example.com:6443
      Logged into "https://api.example.com:6443" as "myuser" using the token provided.
      
      You have access to the following projects and can switch between them with 'oc project <projectname>':
      
      project1
      project2
      ...
      
      ## User 'myuser' have permission to 16 namespaces
      $ oc get projects --no-headers | wc -l
      16
      
      
      ## QUERY Data/Labels via Logcli
      
      ## logcli login via oc token
      $ export LOKI_ADDR=https://logging-loki-openshift-logging.apps.example.com/api/logs/v1/application
      $ export LOKI_BEARER_TOKEN=$(oc whoami -t)
      
      ## list lables
      $ logcli labels
      2023/01/05 16:43:57 https://logging-loki-openshift-logging.apps.example.com/api/logs/v1/application/loki/api/v1/labels?end=1672933437341483502&start=1672929837341483502
      fluentd_thread
      kubernetes_container_name
      kubernetes_host
      kubernetes_namespace_name
      kubernetes_pod_name
      log_type
      tag
      
      ## Get labels
      $ logcli labels
      2023/02/23 20:02:05 https://logging-loki-openshift-logging.apps.example.com/api/logs/v1/application/loki/api/v1/labels?end=1677178925120970400&start=1677175325120970400
      fluentd_thread
      kubernetes_container_name
      kubernetes_host
      kubernetes_namespace_name
      kubernetes_pod_name
      log_type
      
      ## List all namespaces label values from the Cluster
      $ logcli labels kubernetes_namespace_name
      2023/02/23 20:02:15 https://logging-loki-openshift-logging.apps.example.com/api/logs/v1/application/loki/api/v1/label/kubernetes_namespace_name/values?end=1677178935787035238&start=1677175335787035238
      
      <lists every namespace in cluster>

       

      Expected results:

      Loki should not provide all namespaces

      Additional info:

      Possibly related issue was fixed in a recent version: https://issues.redhat.com/browse/LOG-2880

      Attachments

        Issue Links

          Activity

            People

              ptsiraki@redhat.com Periklis Tsirakidis
              rhn-support-stwalter Steven Walter
              Anping Li Anping Li
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: