Bug 1894782

Summary:	OperatorHub generates incorrect RBAC
Product:	OpenShift Container Platform	Reporter:	OpenShift BugZilla Robot <openshift-bugzilla-robot>
Component:	Management Console	Assignee:	Samuel Padgett <spadgett>
Status:	CLOSED ERRATA	QA Contact:	Yadan Pei <yapei>
Severity:	high	Docs Contact:
Priority:	high
Version:	4.4	CC:	aos-bugs, jhadvig, jokerman, nmukherj, spadgett, yapei
Target Milestone:	---
Target Release:	4.5.z
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-11-24 12:42:10 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1893784
Bug Blocks:

Description OpenShift BugZilla Robot 2020-11-05 03:26:31 UTC

+++ This bug was initially created as a clone of Bug #1893784 +++

+++ This bug was initially created as a clone of Bug #1893724 +++

Description of problem:
When using the OperatorHub Console to install an operator that supports reporting metrics to Telemeter the generated Service RoleBinding is created for the `prometheus-operator` ServiceAccount [1] instead of the `prometheus-k8s` ServiceAccount, preventing prometheus from scraping the operator's metrics.

Version-Release number of selected component (if applicable):
4.4

How reproducible:
Always

Steps to Reproduce:
1. Install an operator which includes the `operatorframework.io/cluster-monitoring=true` annotation.

Actual results:
The operator is installed but the Prometheus Service RBAC is generated for the `prometheus-operator` ServiceAccount.

Expected results:
The operator is installed and the Prometheus Service RBAC is generated for the `prometheus-k8s`ServiceAccount.


Additional info:
[1] https://github.com/openshift/console/blob/master/frontend/packages/operator-lifecycle-manager/src/components/operator-hub/operator-hub-subscribe.tsx#L283
[2]

Comment 2 Yadan Pei 2020-11-13 06:54:02 UTC

1. Install Metering operator which has `operatorframework.io/cluster-monitoring=true` annotation
2. Check the rolebinding openshift-metering-prometheus, it is subjected to 'prometheus-k8s' serviceaccount
subjects:
  - kind: ServiceAccount
    name: prometheus-k8s
    namespace: openshift-monitoring


Verified on 4.5.0-0.nightly-2020-11-13-045120

Comment 5 errata-xmlrpc 2020-11-24 12:42:10 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.5.20 bug fix and golang security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:5118