Bug 2024199 - 400 Bad Request error for some queries for the non admin user
Summary: 400 Bad Request error for some queries for the non admin user
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Monitoring
Version: 4.9
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
: 4.10.0
Assignee: Jan Fajerski
QA Contact: Junqi Zhao
URL:
Whiteboard:
: 2020522 (view as bug list)
Depends On:
Blocks: 2030630
TreeView+ depends on / blocked
 
Reported: 2021-11-17 14:41 UTC by Vikram Raj
Modified: 2022-03-10 16:29 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 2030630 (view as bug list)
Environment:
Last Closed: 2022-03-10 16:28:46 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)
Observe dashboard 400 bad request error (115.93 KB, image/png)
2021-11-17 14:41 UTC, Vikram Raj
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2022:0056 0 None None None 2022-03-10 16:29:08 UTC

Description Vikram Raj 2021-11-17 14:41:18 UTC
Created attachment 1842365 [details]
Observe dashboard 400 bad request error

Description of problem:
After logging in as a non-admin user to the console. Getting 400 Bad Request error alert on dev console Observe dashboard.


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. Logged in as a non-admin user with a self-provision Role only.
2. Switched to Dev perspective and create a namespace and some add some workloads to it.
3. Navigate to Observe dashboard.
4. Select `Kubernetes / Compute Resources / Namespace (Workloads)` dashboard from the Dashboard dropdown.

Actual results:
1. Type dropdown not loading query fails with 400 Bad request error
2. Some of the graph is not loading query fails with 400 Bad request error

Expected results:
The dashboard should load without any error.

Additional info:
1. In the dev console Observe dashboard, we use `prometheus-tenancy` URL for getting data from queries.

2. After replacing `namespace=~` with `namespace=` in the query, we are not getting 400 Bad request error.

Comment 2 Andrew Pickering 2021-11-18 00:15:03 UTC
This is part of 4.9 regression bug 2022707, so I'm increasing this to medium severity.

Comment 3 Andrew Pickering 2021-11-18 00:25:27 UTC
The issue is that in order to fix bug 2022707, we want to add the `namespace` GET parameter to the query requests.

However, one PromQL query in the "Kubernetes / Compute Resources / Namespace (Workloads)" dashboard definition contains a `namespace=~` label matcher. This results in the error `label matcher value (namespace="dev-ns") conflicts with injected value (namespace=~"dev-ns")`.

I think the dashboard query can be changed from `=~` to `=`, which will solve the problem. (Maybe it should have always been `=`?)

Comment 4 Jan Fajerski 2021-11-19 08:13:52 UTC
(In reply to Andrew Pickering from comment #3)
> I think the dashboard query can be changed from `=~` to `=`, which will
> solve the problem. (Maybe it should have always been `=`?)

This is correct. In fact one could argue that the query really always was `=` and not `=~` as prom-label-proxy simply silently replaced this matcher. The recent change has simply exposed this.

I proposed https://github.com/kubernetes-monitoring/kubernetes-mixin/pull/706 to fix this.

Comment 5 Sahil Budhwar 2021-12-01 10:00:46 UTC
*** Bug 2020522 has been marked as a duplicate of this bug. ***

Comment 6 Jan Fajerski 2021-12-09 10:43:17 UTC
The fix is in CMO master now. Assigning to QA.

Comment 7 Junqi Zhao 2021-12-20 13:36:45 UTC
tested with 4.10.0-0.nightly-2021-12-18-034942, followed steps in comment 0, no error for the dashboard now

Comment 11 errata-xmlrpc 2022-03-10 16:28:46 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.10.3 security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:0056


Note You need to log in before you can comment on or make changes to this bug.