Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 2082310

Summary:	[STF 1.4] oauth-proxy container deployed as part of smart-gateway pods is missing cluster-level RBAC
Product:	Service Telemetry Framework	Reporter:	Leif Madsen <lmadsen>
Component:	sg-core-container	Assignee:	Leif Madsen <lmadsen>
Status:	CLOSED ERRATA	QA Contact:	Leif Madsen <lmadsen>
Severity:	urgent	Docs Contact:	Joanne O'Flynn <joflynn>
Priority:	urgent
Version:	1.4	Keywords:	Triaged, ZStream
Target Milestone:	z3
Target Release:	1.4 (STF)
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	smart-gateway-operator-container-4.0.3-1	Doc Type:	Bug Fix
Doc Text:	Cause: Cluster-level RBAC permissions were missing. Consequence: Prometheus was unable to access SmartGateways as a target for metrics. Fix: Implement the appropriate cluster-level RBAC permissions in Smart Gateway Operator so that oauth-proxy container can access the system interfaces required.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-05-16 12:52:13 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:	smart-gateway-operator-v4.0.3
Embargoed:

Description Leif Madsen 2022-05-05 19:04:55 UTC

Description of problem: When deploying STF 1.4 and creating SmartGateway deployments, the oauth-proxy container is missing access to RBAC permissions. The result is that Prometheus is unable to access the SmartGateways as targets for metrics.


Version-Release number of selected component (if applicable): STF 1.4


How reproducible: Always

Comment 1 Leif Madsen 2022-05-05 19:45:58 UTC

Work around is to apply the following manifest (updating the `namespace` with the appropriate namespace running Smart Gateway Operator). Tested on OCP 4.8.36. This can be done on a live system.


oc create -f - <<EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: smart-gateway-auth-delegator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
- kind: ServiceAccount
  name: smart-gateway-operator
  namespace: service-telemetry
- kind: ServiceAccount
  name: default
  namespace: service-telemetry
EOF

Comment 5 Leif Madsen 2022-05-06 19:36:35 UTC

Returning this back to ON_DEV as downstream product verification failed. Changes to upstream test pipeline need to be made in order to better represent what is tested for product releases.

Comment 6 Leif Madsen 2022-05-10 17:02:25 UTC

Additional testing and review has revealed some additional changes required in order to get this operational. Linked to https://github.com/infrawatch/smart-gateway-operator/pull/119 which contains the changes in the upstream main branch, which will need to be backported to stable-1.4.

Comment 10 Leif Madsen 2022-05-11 19:56:41 UTC

Executed smoke tests and they all pass. This issue is now verified.

*** [INFO] Cleanup resources...
job.batch "stf-smoketest-smoke1" deleted

*** [SUCCESS] Smoke test job completed successfully

Comment 16 errata-xmlrpc 2022-05-16 12:52:13 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Release of components for Service Telemetry Framework 1.4.3 - Container Images), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:2276