Bug 1838297

Summary:	OLM: Console is not creating role binding when enabling monitoring for an operator
Product:	OpenShift Container Platform	Reporter:	Samuel Padgett <spadgett>
Component:	Management Console	Assignee:	Jakub Hadvig <jhadvig>
Status:	CLOSED ERRATA	QA Contact:	Yadan Pei <yapei>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	4.5	CC:	aos-bugs, hasha, jhadvig, jokerman
Target Milestone:	---
Target Release:	4.5.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	Cause: Role and RoleBinding for let monitoring scrape metrics for operators when the `operatorframework.io/cluster-monitoring=true` is set, are not created when creating suggested-namespace Consequence: Monitoring metrics scraping fails Fix: Create Role and RoleBinding for let monitoring scrape metrics for operators when the `operatorframework.io/cluster-monitoring=true` is set Result: Monitoring metrics scraping succeeds	Story Points:	---
Clone Of:		Environment:	Version: 4.5.0-0.ci-2020-05-20-085335 Cluster ID: 5e1d119a-f4dd-41f6-bdbb-a8f12f65b250 Browser: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:76.0) Gecko/20100101 Firefox/76.0
Last Closed:	2020-07-13 17:40:29 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1841149

Description Samuel Padgett 2020-05-20 19:55:55 UTC

The console is not creating the role bindings to let monitoring scrape metrics for operators when the `operatorframework.io/cluster-monitoring=true` is set.

See https://github.com/openshift/enhancements/blob/master/enhancements/olm/olm-managed-operator-metrics.md#rbac-requirements

```
The operatorframework.io/cluster-monitoring=true annotation. When this annotation is set to true, the OpenShift Console will update the namespace that the operator is being deployed to with the openshift.io/cluster-monitoring=true label. When this annotation is present, the UI will update the OpenShift Monitoring Prometheus Operator ServiceAccount with the appropriate RBAC privileges for the given namespace as well, allowing operators to be scraped by the OpenShift Monitoring Prometheus Operator.
```

Comment 3 shahan 2020-05-28 02:01:45 UTC

install logging enabled monitoring on console.
[hasha@localhost ~]$ oc get role openshift-logging-prometheus -n openshift-logging  -oyaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  creationTimestamp: "2020-05-28T01:47:59Z"
  managedFields:
  - apiVersion: rbac.authorization.k8s.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:rules: {}
    manager: Mozilla
    operation: Update
    time: "2020-05-28T01:47:59Z"
  name: openshift-logging-prometheus
  namespace: openshift-logging
  resourceVersion: "67233"
  selfLink: /apis/rbac.authorization.k8s.io/v1/namespaces/openshift-logging/roles/openshift-logging-prometheus
  uid: fa021303-f1ff-48d5-8308-418aaa142b28
rules:
- apiGroups:
  - ""
  resources:
  - services
  - endpoints
  - pods
  verbs:
  - get
  - list
  - watch
[hasha@localhost ~]$ oc get rolebinding openshift-logging-prometheus -n openshift-logging  -oyaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  creationTimestamp: "2020-05-28T01:48:00Z"
  managedFields:
  - apiVersion: rbac.authorization.k8s.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:roleRef:
        f:apiGroup: {}
        f:kind: {}
        f:name: {}
      f:subjects: {}
    manager: Mozilla
    operation: Update
    time: "2020-05-28T01:48:00Z"
  name: openshift-logging-prometheus
  namespace: openshift-logging
  resourceVersion: "67238"
  selfLink: /apis/rbac.authorization.k8s.io/v1/namespaces/openshift-logging/rolebindings/openshift-logging-prometheus
  uid: e7532b0e-542a-4abc-9f4b-320418677f8a
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: openshift-logging-prometheus
subjects:
- kind: ServiceAccount
  name: prometheus-operator
  namespace: openshift-monitoring

4.5.0-0.nightly-2020-05-27-174108

Comment 4 errata-xmlrpc 2020-07-13 17:40:29 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:2409