Bug 1972898 - Cannot log in to prometheus UI (via delegated on-cluster oauth) on 4.8.0-fc.9
Summary: Cannot log in to prometheus UI (via delegated on-cluster oauth) on 4.8.0-fc.9
Keywords:
Status: CLOSED DUPLICATE of bug 1970828
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: oauth-apiserver
Version: 4.9
Hardware: Unspecified
OS: Unspecified
unspecified
urgent
Target Milestone: ---
: 4.8.0
Assignee: Standa Laznicka
QA Contact: liyao
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-06-16 20:20 UTC by Clayton Coleman
Modified: 2021-06-16 20:50 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-06-16 20:50:14 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Clayton Coleman 2021-06-16 20:20:44 UTC
Tried to log into prometheus UI on build02.  Get a 500 internal server error.  Logs for the prometheus-proxy have:

2021/06/16 20:03:12 provider.go:587: Performing OAuth discovery against https://172.30.0.1/.well-known/oauth-authorization-server
2021/06/16 20:03:12 provider.go:627: 200 GET https://172.30.0.1/.well-known/oauth-authorization-server {
  "issuer": "https://oauth-openshift.apps.build02.gcp.ci.openshift.org",
  "authorization_endpoint": "https://oauth-openshift.apps.build02.gcp.ci.openshift.org/oauth/authorize",
  "token_endpoint": "https://oauth-openshift.apps.build02.gcp.ci.openshift.org/oauth/token",
  "scopes_supported": [
    "user:check-access",
    "user:full",
    "user:info",
    "user:list-projects",
    "user:list-scoped-projects"
  ],
  "response_types_supported": [
    "code",
    "token"
  ],
  "grant_types_supported": [
    "authorization_code",
    "implicit"
  ],
  "code_challenge_methods_supported": [
    "plain",
    "S256"
  ]
}
2021/06/16 20:03:12 oauthproxy.go:656: error redeeming code (client:10.129.40.5:43122): got 400 from "https://oauth-openshift.apps.build02.gcp.ci.openshift.org/oauth/token" {"error":"unauthorized_client","error_description":"The client is not authorized to request a token using this method."}
2021/06/16 20:03:12 oauthproxy.go:445: ErrorPage 500 Internal Error Internal Error


Looks like the client for on cluster oauth is broken.  Not being able to log into things on cluster with delegated auth is urgent blocker+ to me.

Comment 1 Clayton Coleman 2021-06-16 20:21:15 UTC
https://prometheus-k8s-openshift-monitoring.apps.build02.gcp.ci.openshift.org/graph is what is failing

Comment 2 W. Trevor King 2021-06-16 20:25:24 UTC
setting blocker+ to match "is urgent blocker+" from comment 0.

Comment 3 W. Trevor King 2021-06-16 20:50:14 UTC

*** This bug has been marked as a duplicate of bug 1970828 ***


Note You need to log in before you can comment on or make changes to this bug.