-
Task
-
Resolution: Done
-
Critical
-
None
-
None
-
None
-
3
-
False
-
None
-
False
-
NEW
-
NEW
-
-
-
MON Sprint 250
In CMO, Alertmanager pods in the openshift-monitoring namespace have an Oauth-proxy on port 9095 for web access on all paths.
We are going to replace it with kube-rbac-proxy and constraint the access to /api/v2 pathes.
The current behavior is to allow access to the Alertmanager web server for any user having "get" access to "namespace" resources. We do not have to keep the same logic but have to make sure no regression happen. We may need use a stubbed custom resource to authorize both "post" and "get" HTTP requests from certain users.
There is a request to allow read-only access to alerts in Developer view. kube-rbac-proxy can facilitate this functionality.
- blocks
-
MON-3396 add role.rbac.authorization.k8s.io/monitoring-alertmanager-view
- Closed
- is depended on by
-
MON-3701 Clean up oauth-proxy references from CMO code base
- Closed
- relates to
-
OCPBUGS-17850 common user can view UWM alertmanager alerts
- Closed
- links to
1.
|
Post-merge Testing | Closed | Tai Gao | ||
2.
|
E2E Automation | Closed | Tai Gao | ||
3.
|
CI Integration | Closed | Tai Gao |