Uploaded image for project: 'Observability and Data Analysis Program'
  1. Observability and Data Analysis Program
  2. OBSDA-881

Able to see as normal user logs from deleted namespaces

XMLWordPrintable

    • Icon: Feature Feature
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • None
    • None
    • None
    • False
    • Hide

      None

      Show
      None
    • False
    • Not Selected
    • 0

      Proposed title of this feature request

      Able to see as normal user logs from deleted namespaces without admin permissions

      What is the nature and description of the request?

      The current implementation of Loki that integrated with the OpenShift Authentication leads to when a namespace is deleted, the user is not able to query the logs anymore for the pods running in the deleted namespace. In an environment using CI/CD and with a high volume of creation/deletion of pods and namespaces, even, when speaking about short retention, 30 days or less, but the namespaces can be deleted after a few days.

      Then, a normal OpenShift user/developer is not able to query the logs from the deleted namespaces for helping in troubleshooting on their applications even when these logs are available in Loki, but really not able to be used by the interesed stackholders, this means, the Developers.

      The option used for now for being able to query these logs is to don't delete the pods during some time, but this leads to other limitations impacting to:

      1. the OpenShift performance in etcd as the big number of objects inside the database
      2. Node Unhealthy with the error `rpc error: code = ResourceExhausted desc = grpc: received message larger than max (16805161 vs. 16777216)` as exceeding the Kubelete grpc buffer size as described in https://access.redhat.com/solutions/7018759
      3. Loki query size limitation of 5120 bytes - in case the
      number of namespaces a user is authorized to access becomes too high as described in the article https://access.redhat.com/solutions/7053425

      Why does the customer need this? (List the business requirements)

      Requested a method for being able to assign permissions to the developers in a way that without giving admin permissions, they could be able to see the Application logs stored in Loki for deleted namespaces

      List any affected packages or components.

      Loki

              jamparke@redhat.com Jamie Parker
              rhn-support-ocasalsa Oscar Casal Sanchez
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated: