Bug 1893784 - OperatorHub generates incorrect RBAC
Summary: OperatorHub generates incorrect RBAC
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Management Console
Version: 4.4
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ---
: 4.6.z
Assignee: Samuel Padgett
QA Contact: Yadan Pei
URL:
Whiteboard:
Depends On: 1893724
Blocks: 1894782
TreeView+ depends on / blocked
 
Reported: 2020-11-02 15:40 UTC by OpenShift BugZilla Robot
Modified: 2020-11-16 14:38 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Previously, the web console was incorrectly granting permissions to the wrong service account, prometheus-operator, for scraping metrics for OLM operators. The console now correctly grants permissions to the prometheus-k8s service account, allowing metrics to be scraped.
Clone Of:
Environment:
Last Closed: 2020-11-16 14:37:43 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift console pull 7073 0 None closed [release-4.6] Bug 1893784: Use correct service account for operator monitoring 2020-11-13 18:37:45 UTC
Red Hat Product Errata RHBA-2020:4987 0 None None None 2020-11-16 14:38:00 UTC

Description OpenShift BugZilla Robot 2020-11-02 15:40:46 UTC
+++ This bug was initially created as a clone of Bug #1893724 +++

Description of problem:
When using the OperatorHub Console to install an operator that supports reporting metrics to Telemeter the generated Service RoleBinding is created for the `prometheus-operator` ServiceAccount [1] instead of the `prometheus-k8s` ServiceAccount, preventing prometheus from scraping the operator's metrics.

Version-Release number of selected component (if applicable):
4.4

How reproducible:
Always

Steps to Reproduce:
1. Install an operator which includes the `operatorframework.io/cluster-monitoring=true` annotation.

Actual results:
The operator is installed but the Prometheus Service RBAC is generated for the `prometheus-operator` ServiceAccount.

Expected results:
The operator is installed and the Prometheus Service RBAC is generated for the `prometheus-k8s`ServiceAccount.


Additional info:
[1] https://github.com/openshift/console/blob/master/frontend/packages/operator-lifecycle-manager/src/components/operator-hub/operator-hub-subscribe.tsx#L283
[2]

Comment 2 Yadan Pei 2020-11-09 02:56:13 UTC
1. cluster admin user subscribe Metering operator which has `operatorframework.io/cluster-monitoring=true` annotation
2. check openshift-metering-prometheus rolebinding
$ oc describe rolebinding openshift-metering-prometheus -n openshift-metering
Name:         openshift-metering-prometheus
Labels:       <none>
Annotations:  <none>
Role:
  Kind:  Role
  Name:  openshift-metering-prometheus
Subjects:
  Kind            Name            Namespace
  ----            ----            ---------
  ServiceAccount  prometheus-k8s  openshift-monitoring

The operator is installed and the Prometheus Service RBAC is generated for the `prometheus-k8s`ServiceAccount

Verified on 4.6.0-0.nightly-2020-11-07-035509

Comment 5 errata-xmlrpc 2020-11-16 14:37:43 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (OpenShift Container Platform 4.6.4 bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:4987


Note You need to log in before you can comment on or make changes to this bug.