• Type: Bug
• Resolution: Done
• Priority: Undefined
• Fix Version/s: rhosdt-3.6
• Affects Version/s: None
• Component/s: Tempo
• Labels:

  None

1. 

   Bildschirmfoto vom 2025-01-23 16-09-15.png

   92 kB

   2025/01/23 3:09 PM

[TRACING-5098] Fix token expiration in Tracing UI plugin

Collapse comment: Andreas Gerstmayr added a comment - 2025/03/19 5:23 PM

Andreas Gerstmayr added a comment - 2025/03/19 5:23 PM

Improve error message on Perses side: https://github.com/perses/plugins/pull/93

Expand comment: Andreas Gerstmayr added a comment - 2025/03/19 5:23 PM

Andreas Gerstmayr added a comment - 2025/03/19 5:23 PM Improve error message on Perses side: https://github.com/perses/plugins/pull/93

Collapse comment: Andreas Gerstmayr added a comment - 2025/03/14 1:26 PM

Andreas Gerstmayr added a comment - 2025/03/14 1:26 PM

The problem is that the naming of the cluster-wide ClusterRole and ClusterRoleBinding: we use "tempo-<instance>-gateway", and if we create a Tempo instance called "sample" in namespace A and another instance also called "sample" in namespace B, the ClusterRoleBinding gets overwritten because it's always "tempo-sample-gateway".

Expand comment: Andreas Gerstmayr added a comment - 2025/03/14 1:26 PM

Andreas Gerstmayr added a comment - 2025/03/14 1:26 PM The problem is that the naming of the cluster-wide ClusterRole and ClusterRoleBinding: we use "tempo-<instance>-gateway", and if we create a Tempo instance called "sample" in namespace A and another instance also called "sample" in namespace B, the ClusterRoleBinding gets overwritten because it's always "tempo-sample-gateway".

Collapse comment: Andreas Gerstmayr added a comment - 2025/02/27 2:53 PM

Andreas Gerstmayr added a comment - 2025/02/27 2:53 PM

Afaics this is related to this message on the gateway:

E0227 14:46:22.646025 1 webhook.go:154] Failed to make webhook authenticator request: tokenreviews.authentication.k8s.io is forbidden: User "system:serviceaccount:edge-monitoring:tempo-sample-gateway" cannot create resource "tokenreviews" in API group "authentication.k8s.io" at the cluster scope
level=info name=observatorium ts=2025-02-27T14:46:22.646051154Z caller=openshift.go:436 msg="fallback to read cookie, no serviceaccount bearer token or mTLS certs provided"

The token is likely correct, but the gateway fails to verify it because it doesn't have permissions to create the tokenreview, therefore it redirects to the login page.

Expand comment: Andreas Gerstmayr added a comment - 2025/02/27 2:53 PM

Andreas Gerstmayr added a comment - 2025/02/27 2:53 PM Afaics this is related to this message on the gateway: E0227 14:46:22.646025 1 webhook.go:154] Failed to make webhook authenticator request: tokenreviews.authentication.k8s.io is forbidden: User "system:serviceaccount:edge-monitoring:tempo-sample-gateway" cannot create resource "tokenreviews" in API group "authentication.k8s.io" at the cluster scope level=info name=observatorium ts=2025-02-27T14:46:22.646051154Z caller=openshift.go:436 msg="fallback to read cookie, no serviceaccount bearer token or mTLS certs provided" The token is likely correct, but the gateway fails to verify it because it doesn't have permissions to create the tokenreview, therefore it redirects to the login page.