Bug 1893784

Summary:	OperatorHub generates incorrect RBAC
Product:	OpenShift Container Platform	Reporter:	OpenShift BugZilla Robot <openshift-bugzilla-robot>
Component:	Management Console	Assignee:	Samuel Padgett <spadgett>
Status:	CLOSED ERRATA	QA Contact:	Yadan Pei <yapei>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	4.4	CC:	aos-bugs, jhadvig, jokerman, nmukherj, spadgett, yapei
Target Milestone:	---
Target Release:	4.6.z
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	Previously, the web console was incorrectly granting permissions to the wrong service account, prometheus-operator, for scraping metrics for OLM operators. The console now correctly grants permissions to the prometheus-k8s service account, allowing metrics to be scraped.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-11-16 14:37:43 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1893724
Bug Blocks:	1894782

Description OpenShift BugZilla Robot 2020-11-02 15:40:46 UTC

+++ This bug was initially created as a clone of Bug #1893724 +++

Description of problem:
When using the OperatorHub Console to install an operator that supports reporting metrics to Telemeter the generated Service RoleBinding is created for the `prometheus-operator` ServiceAccount [1] instead of the `prometheus-k8s` ServiceAccount, preventing prometheus from scraping the operator's metrics.

Version-Release number of selected component (if applicable):
4.4

How reproducible:
Always

Steps to Reproduce:
1. Install an operator which includes the `operatorframework.io/cluster-monitoring=true` annotation.

Actual results:
The operator is installed but the Prometheus Service RBAC is generated for the `prometheus-operator` ServiceAccount.

Expected results:
The operator is installed and the Prometheus Service RBAC is generated for the `prometheus-k8s`ServiceAccount.


Additional info:
[1] https://github.com/openshift/console/blob/master/frontend/packages/operator-lifecycle-manager/src/components/operator-hub/operator-hub-subscribe.tsx#L283
[2]

Comment 2 Yadan Pei 2020-11-09 02:56:13 UTC

1. cluster admin user subscribe Metering operator which has `operatorframework.io/cluster-monitoring=true` annotation
2. check openshift-metering-prometheus rolebinding
$ oc describe rolebinding openshift-metering-prometheus -n openshift-metering
Name:         openshift-metering-prometheus
Labels:       <none>
Annotations:  <none>
Role:
  Kind:  Role
  Name:  openshift-metering-prometheus
Subjects:
  Kind            Name            Namespace
  ----            ----            ---------
  ServiceAccount  prometheus-k8s  openshift-monitoring

The operator is installed and the Prometheus Service RBAC is generated for the `prometheus-k8s`ServiceAccount

Verified on 4.6.0-0.nightly-2020-11-07-035509

Comment 5 errata-xmlrpc 2020-11-16 14:37:43 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (OpenShift Container Platform 4.6.4 bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:4987