Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-7314

[release-6.1] Loki log based alerts for application tenant are not filtered by namespace on dev-console

XMLWordPrintable

    • Incidents & Support
    • 1
    • True
    • Show
      LOG-7289
    • False
    • NEW
    • NEW
    • Hide
      With https://issues.redhat.com/browse/LOG-4209 we broke the authorisation workflow for user Rules and Alerts which lead users to be able to see Alerts from other users. This bug fix has corrected this behaviour so now Users should only be able to see their own Rules and Alerts
      Show
      With https://issues.redhat.com/browse/LOG-4209 we broke the authorisation workflow for user Rules and Alerts which lead users to be able to see Alerts from other users. This bug fix has corrected this behaviour so now Users should only be able to see their own Rules and Alerts
    • Bug Fix
    • Logging - Sprint 275

      Description of problem:

      When Loki Alerts are created for an application namespace, the Firing alert is visible under other application projects as well on dev-console.

      AlertingRule is created under my-app namespace.

      $ oc get alertingrule my-app-alert -n my-app -o json
      {
          "apiVersion": "loki.grafana.com/v1",
          "kind": "AlertingRule",
          "metadata": {
              "creationTimestamp": "2024-09-24T11:59:20Z",
              "generation": 1,
              "labels": {
                  "openshift.io/cluster-monitoring": "true"
              },
              "name": "my-app-alert",
              "namespace": "my-app",
              "resourceVersion": "135615",
              "uid": "bb3d6456-e94e-46c2-b56f-5e7cebfb6be8"
          },
          "spec": {
              "groups": [
                  {
                      "interval": "1m",
                      "name": "MyApplication",
                      "rules": [
                          {
                              "alert": "MyAppLogVolumeIsHigh",
                              "annotations": {
                                  "description": "My app has high amount of logs.",
                                  "summary": "project \"my-app\" log volume is high."
                              },
                              "expr": "count_over_time({kubernetes_namespace_name=\"my-app\"}[2m]) \u003e 10\n",
                              "for": "5m",
                              "labels": {
                                  "project": "my-app",
                                  "severity": "info"
                              }
                          }
                      ]
                  }
              ],
              "tenantID": "application"
          }
      }

      No AlertingRule is present under user-app namespace

      $ oc get alertingrule -n user-app                      
      No resources found in user-app namespace.

      Request URL: 

      https://console-openshift-console.apps.kbhartiaws1.qe.devcluster.openshift.com/api/proxy/plugin/logging-view-plugin/backend/api/logs/v1/application/prometheus/api/v1/rules?kubernetes_namespace_name=user-app
       
      https://console-openshift-console.apps.kbhartiaws1.qe.devcluster.openshift.com/api/proxy/plugin/logging-view-plugin/backend/api/logs/v1/application/prometheus/api/v1/rules?kubernetes_namespace_name=my-app
       
      Both the above URL return the exact same response. Response is attached for the above URL's 

      Version-Release number of selected component (if applicable):

      Logging 5.8.z, Logging 5.9.z, Logging 6.0.0

      How reproducible: Always

      Steps to Reproduce:

      1. Deploy CLO and LO
      2. Create an application (e.g my-app) and create a corresponding Loki log alerting rule for the namespace.
      3. Create another application namespace (e.g. user-app) but without an alertingrule. 
      4. Check ruler logs
      5. Migrate to dev-console.
      6. Verify that the firing alert is being shown under both my-app and user-app namespace/project even though the alert is only defined for my-app namespace.

      Actual results:

      Alert is visible under other application namespaces unrelated to the AlertingRule

      Expected results:

      Alert should only be visible on the namespace under which they are created.

      Additional info:

      Attached Dev console screen. The alert is visible under user-app namespace when response shows the alert is defined for my-app namespace.

              jmarcal@redhat.com Joao Marcal
              rhn-support-kbharti Kabir Bharti
              Kabir Bharti Kabir Bharti
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: