Uploaded image for project: 'OpenShift Request For Enhancement'
  1. OpenShift Request For Enhancement
  2. RFE-2098

TTL on access tokens does not affect Prometheus/Alertmanager

XMLWordPrintable

    • Icon: Feature Request Feature Request
    • Resolution: Won't Do
    • Icon: Major Major
    • None
    • None
    • Auth
    • None
    • Product / Portfolio Work
    • None
    • False
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      TTL on access tokens does not affect Prometheus/Alertmanager

      My customer has requested:

      We've set a maximum TTL on the OAuth token and the OAuthClients and this works fine for the API token and the console.
      However, the maximum TTL does not apply to sessions in Prometheus, the Alertmanager and (probably) Grafana.
      From a security point of view, one of our customers requires a maximum TTL of 4 hours on these sessions as well.
       
      Is there a different way to configure the TTL of the tokens used by Prometheus, the Alertmanager and Grafana or is this a bug/missing configuration option within Openshift?
       
      Our Ansible code to configure the TTL for tokens:
      ```
      • name: Get OAuthClients
        k8s_info:
        kind: OAuthClient
        register: oauthclients
         
      • name: Set access token TTL for OAuthClients
        k8s:
        state: present
        kind: OAuthClient
        name: "{{ item.metadata.name }}"
        definition:
        accessTokenInactivityTimeoutSeconds: "{{ access_token_ttl }}"
        loop: "{{ oauthclients.resources }}"
         
      • name: Set access token TTL for api
        k8s:
        state: present
        kind: OAuth
        name: cluster
        definition:
        spec:
        tokenConfig:
        accessTokenMaxAgeSeconds: "{{ access_token_ttl }}"

      There is more detail on this in https://bugzilla.redhat.com/show_bug.cgi?id=1973575

       

              anachand Anandnatraj Chandramohan (Inactive)
              rhn-support-andbartl Andy Bartlett
              None
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved:
                None
                None