-
Bug
-
Resolution: Done
-
Blocker
-
Logging 6.3.0
-
2
-
None
-
False
-
NEW
-
VERIFIED
-
Release Note Not Required
-
-
-
Log Storage - Sprint 272
-
Critical
Description of problem:
When non-admins users query for rules API or check for firing alerts on dev-console, they get unauthorized errors from observatorium API.
Error when querying rules API:
$ curl -k -H "Authorization: Bearer $(oc whoami -t)" "https://logging-loki-openshift-logging.apps.<hidden>/api/logs/v1/application/loki/api/v1/rules?kubernetes_namespace_name=my-app" {"error":"unauthorized access for URL parameter \"k8s_namespace_name\" and value \"\"","errorType":"observatorium-api","status":"error"}
Error when checking alerts:
Request URL: https://console-openshift-console.apps.kbharti0605x.qe.devcluster.openshift.com/api/proxy/plugin/logging-view-plugin/backend/api/logs/v1/application/prometheus/api/v1/rules?kubernetes_namespace_name=testuser-0-app { "error": "unauthorized access for URL parameter \"k8s_namespace_name\" and value \"\"", "errorType": "observatorium-api", "status": "error" }
Version-Release number of selected component (if applicable):
Logging 6.3.0
How reproducible:
Always
Steps to Reproduce:
- Deploy CLO and LO v6.3.0
- Create Alerting rules using non-admin user for the authorized namespace and create RBAC for namespace access.
- Query for Alerting Rules or check for firing alerts.
Actual results:
observatorium-api error on rules query
Expected results:
No error should be thrown for these users since they are authorized to access the rules API and alertingrules/firing alerts.
Additional info:
No such error when querying using kube:admin