Uploaded image for project: 'OpenShift Monitoring'
  1. OpenShift Monitoring
  2. MON-3380

Replace oauth-proxy container with kube-rbac-proxy in Prometheus pod


    • Icon: Task Task
    • Resolution: Done
    • Icon: Critical Critical
    • None
    • None
    • Prometheus
    • None
    • MON Sprint 246, MON Sprint 249

      In CMO, Prometheus pods have an Oauth-proxy on port 9091 for web access on all paths.

      We are going to replace it with kube-rbac-proxy and constraint the access to /api/v1 paths. 

      The current behavior is to allow access to the Prometheus web server for any user having "get" access to "namespace" resources. We do not have to keep the same logic but have to make sure no regression happen. We may need use a stub custom resource to authorize both "post" and "get" HTTP requests from certain users.


      The insight component is using this port, figure out how to keep its access after replacing the Oauth proxy https://github.com/openshift/insights-operator/blob/master/pkg/controller/const.go

      Its service account "gather" and "operator" should use the prometheus endpoint. https://redhat-internal.slack.com/archives/CLABA9CHY/p1701345127689009




            spasquie@redhat.com Simon Pasquier
            hasun@redhat.com Haoyu Sun
            0 Vote for this issue
            2 Start watching this issue