Loading...

Type: Bug
Resolution: Done
Priority: Normal
Fix Version/s: Logging 6.3.0
Affects Version/s: Logging 5.8.z, Logging 5.9.z, Logging 6.0.z
Component/s: Log Console, Log Storage
Labels:
- devel_ack+
- regression

Activity Type:
Incidents & Support
Story Points:
5
Blocked:
True
Blocked Reason:

Hide

~~LOG-7289~~

Show
LOG-7289
Ready:
False
Docs QE Status:
NEW
QE Status:
VERIFIED
Release Note Text:

Hide
With https://issues.redhat.com/browse/LOG-4209 we broke the authorisation workflow for user Rules and Alerts which lead users to be able to see Alerts from other users. This bug fix has corrected this behaviour so now Users should only be able to see their own Rules and Alerts

Show
With https://issues.redhat.com/browse/LOG-4209 we broke the authorisation workflow for user Rules and Alerts which lead users to be able to see Alerts from other users. This bug fix has corrected this behaviour so now Users should only be able to see their own Rules and Alerts
Release Note Type:
Bug Fix
Git Pull Request:
https://github.com/observatorium/api/pull/805
Intelligence Requested:
Market:

Sprint:
Log Storage - Sprint 267, Log Storage - Sprint 268, Log Storage - Sprint 269, Log Storage - Sprint 270, Log Storage - Sprint 271, Log Storage - Sprint 272, Log Storage - Sprint 273

Target Version:

Logging 6.0.z, Logging 6.1.z, Logging 6.2.z

SFDC Cases Links:
SFDC Cases Open:
SFDC Cases Counter:

Description of problem:

When Loki Alerts are created for an application namespace, the Firing alert is visible under other application projects as well on dev-console.

AlertingRule is created under my-app namespace.

$ oc get alertingrule my-app-alert -n my-app -o json
{
    "apiVersion": "loki.grafana.com/v1",
    "kind": "AlertingRule",
    "metadata": {
        "creationTimestamp": "2024-09-24T11:59:20Z",
        "generation": 1,
        "labels": {
            "openshift.io/cluster-monitoring": "true"
        },
        "name": "my-app-alert",
        "namespace": "my-app",
        "resourceVersion": "135615",
        "uid": "bb3d6456-e94e-46c2-b56f-5e7cebfb6be8"
    },
    "spec": {
        "groups": [
            {
                "interval": "1m",
                "name": "MyApplication",
                "rules": [
                    {
                        "alert": "MyAppLogVolumeIsHigh",
                        "annotations": {
                            "description": "My app has high amount of logs.",
                            "summary": "project \"my-app\" log volume is high."
                        },
                        "expr": "count_over_time({kubernetes_namespace_name=\"my-app\"}[2m]) \u003e 10\n",
                        "for": "5m",
                        "labels": {
                            "project": "my-app",
                            "severity": "info"
                        }
                    }
                ]
            }
        ],
        "tenantID": "application"
    }
}

No AlertingRule is present under user-app namespace

$ oc get alertingrule -n user-app                      
No resources found in user-app namespace.

Request URL:

https://console-openshift-console.apps.kbhartiaws1.qe.devcluster.openshift.com/api/proxy/plugin/logging-view-plugin/backend/api/logs/v1/application/prometheus/api/v1/rules?kubernetes_namespace_name=user-app

https://console-openshift-console.apps.kbhartiaws1.qe.devcluster.openshift.com/api/proxy/plugin/logging-view-plugin/backend/api/logs/v1/application/prometheus/api/v1/rules?kubernetes_namespace_name=my-app

Both the above URL return the exact same response. Response is attached for the above URL's

Version-Release number of selected component (if applicable):

Logging 5.8.z, Logging 5.9.z, Logging 6.0.0

How reproducible: Always

Steps to Reproduce:

Deploy CLO and LO
Create an application (e.g my-app) and create a corresponding Loki log alerting rule for the namespace.
Create another application namespace (e.g. user-app) but without an alertingrule.
Check ruler logs
Migrate to dev-console.
Verify that the firing alert is being shown under both my-app and user-app namespace/project even though the alert is only defined for my-app namespace.