-
Bug
-
Resolution: Done
-
Blocker
-
Logging 5.8.0
-
False
-
-
False
-
NEW
-
VERIFIED
-
-
-
Log Storage - Sprint 242, Log Storage - Sprint 243
Description:
Getting 403 Forbidden error when regular user checks for Alerts on Dev console
Here testuser-0 owns the my-app namespace and has created alerting rule for the app running on the namespace. The alert can be seen firing under Dev-console for cluster-admin user but not for the regular user (testuser-0)
$ oc projects You have one project on this server: "my-app". Using project "my-app" on server "https://api.kbharti-0918c.qe.devcluster.openshift.com:6443". $ oc get pods NAME READY STATUS RESTARTS AGE centos-logtest-j4ww2 1/1 Running 0 5h11m $ oc get alertingrules NAME AGE dev-workload-alerts 5h11m
Steps to reproduce:
a) Deploy Logging 5.8.0
b) Forward logs to default Loki
c) Create a namespace and an app with testuser-0 regular user. Create Alertingrule defined now with the user.
d) Add cluster-monitoring-view, monitoring-rules-edit roles to the regular user
e) Login with cluster-admin and check for alerts under Dev-console. Alerts can be seen.
f) Login with regular user and check for firing alert under Dev-console. 403 error on rules API
How reproducible: Always
Actual Result: Regular should be able to see the firing alert
Expected Result: User gets 403 unauthorized error on Dev-console
Version:
OCP 4.14, Logging 5.8.0
AlertingRule.yaml
apiVersion: loki.grafana.com/v1 kind: AlertingRule metadata: labels: openshift.io/cluster-monitoring: 'true' name: dev-workload-alerts namespace: my-app spec: groups: - interval: 1m name: devAppAlert rules: - alert: DevAppLogVolumeIsHigh annotations: description: My application has high amount of logs. summary: project "my-app" log volume is high. expr: > count_over_time({kubernetes_namespace_name="my-app"}[2m]) > 10 for: 5m labels: severity: info devApp: 'true' tenantID: application
RBAC for regular user. User can see the logs on console successfully.
kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: simple-user-application-logs namespace: my-app uid: e858eb60-6677-4401-919c-ed304b675569 resourceVersion: '41606' creationTimestamp: '2023-09-18T11:02:41Z' managedFields: - manager: kubectl-create operation: Update apiVersion: rbac.authorization.k8s.io/v1 time: '2023-09-18T11:02:41Z' fieldsType: FieldsV1 fieldsV1: 'f:roleRef': {} 'f:subjects': {} subjects: - kind: User apiGroup: rbac.authorization.k8s.io name: testuser-0 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-logging-application-view
Screenshot for Dev-console attached.
