Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-7289

Unauthorized access error when non-admin users query for rules and firing alerts

XMLWordPrintable

    • Log Storage - Sprint 272
    • Critical

      Description of problem: 

      When non-admins users query for rules API or check for firing alerts on dev-console, they get unauthorized errors from observatorium API.

      Error when querying rules API:

      $ curl -k -H "Authorization: Bearer $(oc whoami -t)" "https://logging-loki-openshift-logging.apps.<hidden>/api/logs/v1/application/loki/api/v1/rules?kubernetes_namespace_name=my-app" {"error":"unauthorized access for URL parameter \"k8s_namespace_name\" and value \"\"","errorType":"observatorium-api","status":"error"}

      Error when checking alerts:

      Request URL:
      https://console-openshift-console.apps.kbharti0605x.qe.devcluster.openshift.com/api/proxy/plugin/logging-view-plugin/backend/api/logs/v1/application/prometheus/api/v1/rules?kubernetes_namespace_name=testuser-0-app
      {
          "error": "unauthorized access for URL parameter \"k8s_namespace_name\" and value \"\"",
          "errorType": "observatorium-api",
          "status": "error"
      }
      

      Version-Release number of selected component (if applicable):

      Logging 6.3.0

      How reproducible:

      Always

      Steps to Reproduce:

      1. Deploy CLO and LO v6.3.0
      2. Create Alerting rules using non-admin user for the authorized namespace and create RBAC for namespace access.
      3. Query for Alerting Rules or check for firing alerts.

      Actual results:

      observatorium-api error on rules query

      Expected results:

      No error should be thrown for these users since they are authorized to access the rules API and alertingrules/firing alerts.

      Additional info:

      No such error when querying using kube:admin

              jmarcal@redhat.com Joao Marcal
              rhn-support-kbharti Kabir Bharti
              Kabir Bharti Kabir Bharti
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: