Uploaded image for project: 'OpenShift Service Mesh'
  1. OpenShift Service Mesh
  2. OSSM-6008

Kiali can't fetch metrics from Thanos Querier on OCP 4.15

XMLWordPrintable

    • Icon: Task Task
    • Resolution: Done
    • Icon: Critical Critical
    • None
    • None
    • Customer Impact, Maistra
    • None

      Authorization rules for Thanos Querier were changed on OCP 4.15 and Kiali can't fetch metrics - it receives "403 Forbidden".

      We have to update our docs as follows:

      1) Replace step 1 with this:
      1. Grant cluster-monitoring-view to Kiali service account.

      apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata: 
  name: kiali-monitoring-rbac
roleRef: 
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-monitoring-view
subjects: 
- kind: ServiceAccount
  name: kiali-service-account
  namespace: <kiali-namespace>

      2) Update Kiali CR:

      apiVersion: kiali.io/v1alpha1
kind: Kiali
metadata: 
  name: kiali-user-workload-monitoring
spec: 
  external_services: 
    istio: 
      config_map_name: istio-<smcp-name>
      istio_sidecar_injector_config_map_name: istio-sidecar-injector-<smcp-name>
      istiod_deployment_name: istiod-<smcp-name>
      url_service_version: 'http://istiod-<smcp-name>.istio-system:15014/version'
    prometheus: 
      auth: 
        type: bearer
        use_kiali_token: true
      query_scope: 
        mesh_id: "basic-istio-system"
      thanos_proxy: 
        enabled: true
      url: https://thanos-querier.openshift-monitoring.svc.cluster.local:9091
  version: v1.65

            jewertow@redhat.com Jacek Ewertowski
            jewertow@redhat.com Jacek Ewertowski
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: