see https://bugzilla.redhat.com/attachment.cgi?id=1351670&action=edit I've removed the TestBlocker flag as I am not aware of any functionality which is prevented by this issue. It might also not be a Regression, depending on if this new behavior is intentional.
@Rich, it is not a test block. We can continue following https://bugzilla.redhat.com/show_bug.cgi?id=1511432#c15. It should be a regression bug expect for we don't suggest logging in in using kibana route.
The issue exists in logging-elasticsearch:v3.6.173.0.63, logging-kibana: v3.6.173.0.63,logging-fluentd:v3.6.173.0.63
user can see the project indices by using workaround https://bugzilla.redhat.com/show_bug.cgi?id=1511432#c15 But if there are a lot of projects, it will make customers disappointed if we let customers do the workaround manually
Tested with v3.6.173.0.78-1 logging images, these images contain the fix of https://bugzilla.redhat.com/show_bug.cgi?id=1510118 (MBARGOED CVE-2017-12195 security: OpenShift Enterprise 3: authentication bypass for elasticsearch with external routes [openshift-enterprise-3.6]) project indices could be found in kibana UI, see the attached file
Created attachment 1357322 [details] project indices could be found on kibana UI.
What permissions are required for the workaround in #c15 of parent bug: https://bugzilla.redhat.com/show_bug.cgi?id=1511432 ? I created 2 users, "biguser" and "littleuser". I gave "admin" role to "biguser" and "view" role to "littleuser" and neither were able to configure the pattern "project.*". I had assumed they would be able to see the pattern but only projects they have access to would work. Giving cluster-admin to biguser allows it to see project.*, of course. Is there another workaround for non-cluster-admin users? For context, customer was trying to use project.* to workaround another issue where when trying to look at individual project index they get messages like: As a cluster-admin: Discover: "project.example.4e03e3cb-f0c2-11e7-9a3d-001a4aa86606.*" is not a configured pattern. Using the default index pattern: ".all" I do still see log data. An unprivileged user sees this: Discover: "project.example.4e03e3cb-f0c2-11e7-9a3d-001a4aa86606.*" is not a configured pattern. Using the default index pattern: "project.empty-project.*" They do not see any log data. I put this here instead of parent bug because it is 3.6
The issue wasn't in 3.6.173.0.96 which will be release soon.
Moving this to 'ON_QA' based on c#9