Created attachment 1786772 [details] The /metrics endpoint is accessible to anyone without any authentication Description of problem: this bug is from bug 1960767, only grafana metrics endpoint is secured now, but alertmanager/prometheus/thanos-querier are not secured see the attached picture Version-Release number of selected component (if applicable): 4.8.0-0.nightly-2021-05-25-041803 How reproducible: always Steps to Reproduce: 1. login in grafana/alertmanager/prometheus/thanos-querier routes metrics endpoint one by one # oc get route -n openshift-monitoring Append the route UI URL with /metrics 2. 3. Actual results: The /metrics endpoint is accessible to anyone without any authentication. Expected results: The /metrics endpoint should not be accessible without authentication. Additional info:
*** Bug 1897630 has been marked as a duplicate of this bug. ***
same issue exists for thanos-ruler when enabled user-workload monitoring
@hongyli Thanks, I've updated the PR to include thanos-ruler as well.
checked with 4.8.0-0.nightly-2021-06-01-190440,alertmanager/prometheus/thanos-querier/thanos-ruler metrics endpoints are secured now
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: OpenShift Container Platform 4.8.2 bug fix and security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2021:2438