Bug 1894782 - OperatorHub generates incorrect RBAC
Summary: OperatorHub generates incorrect RBAC
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Management Console
Version: 4.4
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 4.5.z
Assignee: Samuel Padgett
QA Contact: Yadan Pei
URL:
Whiteboard:
Depends On: 1893784
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-11-05 03:26 UTC by OpenShift BugZilla Robot
Modified: 2020-11-24 12:42 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-11-24 12:42:10 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift console pull 7107 0 None closed [release-4.5] Bug 1894782: Use correct service account for operator monitoring 2020-11-20 14:15:46 UTC
Red Hat Product Errata RHSA-2020:5118 0 None None None 2020-11-24 12:42:56 UTC

Description OpenShift BugZilla Robot 2020-11-05 03:26:31 UTC
+++ This bug was initially created as a clone of Bug #1893784 +++

+++ This bug was initially created as a clone of Bug #1893724 +++

Description of problem:
When using the OperatorHub Console to install an operator that supports reporting metrics to Telemeter the generated Service RoleBinding is created for the `prometheus-operator` ServiceAccount [1] instead of the `prometheus-k8s` ServiceAccount, preventing prometheus from scraping the operator's metrics.

Version-Release number of selected component (if applicable):
4.4

How reproducible:
Always

Steps to Reproduce:
1. Install an operator which includes the `operatorframework.io/cluster-monitoring=true` annotation.

Actual results:
The operator is installed but the Prometheus Service RBAC is generated for the `prometheus-operator` ServiceAccount.

Expected results:
The operator is installed and the Prometheus Service RBAC is generated for the `prometheus-k8s`ServiceAccount.


Additional info:
[1] https://github.com/openshift/console/blob/master/frontend/packages/operator-lifecycle-manager/src/components/operator-hub/operator-hub-subscribe.tsx#L283
[2]

Comment 2 Yadan Pei 2020-11-13 06:54:02 UTC
1. Install Metering operator which has `operatorframework.io/cluster-monitoring=true` annotation
2. Check the rolebinding openshift-metering-prometheus, it is subjected to 'prometheus-k8s' serviceaccount
subjects:
  - kind: ServiceAccount
    name: prometheus-k8s
    namespace: openshift-monitoring


Verified on 4.5.0-0.nightly-2020-11-13-045120

Comment 5 errata-xmlrpc 2020-11-24 12:42:10 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.5.20 bug fix and golang security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:5118


Note You need to log in before you can comment on or make changes to this bug.