Uploaded image for project: 'OpenShift Monitoring'
  1. OpenShift Monitoring
  2. MON-3379

Replace OAuth-proxy container with kube-rbac-proxy in Thanos-Querier pod

    XMLWordPrintable

Details

    • Task
    • Resolution: Done
    • Undefined
    • None
    • None
    • Thanos
    • None
    • MON Sprint 246, MON Sprint 248
    • 0

    Description

      In CMO, Thanos Querier pods have an Oauth-proxy on port 9091 for web access on all paths.

      We are going to replace it with kube-rbac-proxy. 

      The current behavior is allow access to the Thanos Querier web server for any user having "get" access to "namespace" resources. We do not have to keep the same logic but have to make sure no regression happen.

      We use the subresource "prometheus/api" to authorize both "post" and "get" HTTP requests to kube-rbac-proxy.

      We update the cluster role "cluster-monitoring-view" with new access priviledges and prepare a new role for api access.

       

       

      Attachments

        Issue Links

          is cloned by

          Task - Represents a small unit of work that is not end-user facing. OBSDOCS-850 Update CLI command for accessing metrics from outside the cluster

          • Critical - To be worked on immediately following BLOCKER issues.
          • Closed
          is depended on by

          Task - Represents a small unit of work that is not end-user facing. MON-3701 Clean up oauth-proxy references from CMO code base

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Code Review
          is documented by

          Task - Represents a small unit of work that is not end-user facing. OBSDOCS-850 Update CLI command for accessing metrics from outside the cluster

          • Critical - To be worked on immediately following BLOCKER issues.
          • Closed
          links to

          Web Link koku metrics operator permission update

          GitHub openshift/cluster-monitoring-operator#2136: MON-3379: Replace the oauth-proxy before thanos-querier with kube-rbac-proxy

          GitHub openshift/origin#28393: MON-3481: Thanos use /api/v1 endpoints for authentification test.

          Web Link PR 1st attempt

          Web Link Slides explaining the replacement of Oauth Proxy by Kube-rbac-proxy

          Web Link Video Explaining swapping Oauth-proxy with Kube-rbac-proxy

          Activity

            People

              spasquie@redhat.com Simon Pasquier
              hasun@redhat.com Haoyu Sun
              Simon Pasquier
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: