Skip to content

LOG-8977: Secure the metrics endpoint to restrict scraping to autorized client#3238

Merged
openshift-merge-bot[bot] merged 1 commit intoopenshift:masterfrom
jcantrill:log8977_claude
Apr 22, 2026
Merged

LOG-8977: Secure the metrics endpoint to restrict scraping to autorized client#3238
openshift-merge-bot[bot] merged 1 commit intoopenshift:masterfrom
jcantrill:log8977_claude

Conversation

@jcantrill
Copy link
Copy Markdown
Contributor

@jcantrill jcantrill commented Apr 1, 2026 •
edited
Loading

Description

This PR:

Links

cc @kabirbhartiRH @anpingli

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Apr 1, 2026
@openshift-ci-robot
Copy link
Copy Markdown

openshift-ci-robot commented Apr 1, 2026 •
edited by openshift-ci Bot
Loading

@jcantrill: This pull request references LOG-8977 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.8.0" version, but no target version was set.

Details

In response to this:

Description

This PR:

  • Enhances to the CLO to restrict scraping of metrics to users with a valid token and certs
  • Adds an operator e2e test for validating operator scraping with metrics and certs
  • Adds a test helper class to execute 'oc run' commands
  • Fixes 'oc get' helper to provide stderr when the command errors

Links

cc @kabirbhartiRH @anpingli

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci Bot requested review from cahartma and vparfonov April 1, 2026 20:17
@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented Apr 1, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jcantrill

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 1, 2026
@openshift-ci-robot
Copy link
Copy Markdown

openshift-ci-robot commented Apr 1, 2026 •
edited by openshift-ci Bot
Loading

@jcantrill: This pull request references LOG-8977 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.8.0" version, but no target version was set.

Details

In response to this:

Description

This PR:

Links

cc @kabirbhartiRH @anpingli

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@jcantrill
Copy link
Copy Markdown
Contributor Author

jcantrill commented Apr 1, 2026

/hold

@openshift-ci openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Apr 1, 2026
vparfonov
vparfonov reviewed Apr 1, 2026
View reviewed changes
Comment thread config/prometheus/service.yaml Outdated
@anpingli
Copy link
Copy Markdown

anpingli commented Apr 2, 2026 •
edited
Loading

LGTM

  1. Monitoring can scrape metrics using the Prometheus account token.
  2. Access to the cluster-logging-operator-metrics:8686 service is restricted via TLS. A valid bearer token is required for authentication
  3. tls-scanner passed.
    The configured tlsprofile is updated following the API server update.
    API Configured MinVersion is updated following the API server update.
    Ingress Configured MinVersion is VersionTLS12 when use old profile(>VersionTLS10).

Note: once tls-profile is updated. the cluster may take more than 30 minutes to Green status.

@jcantrill jcantrill mentioned this pull request Apr 2, 2026
Open
@jcantrill
Copy link
Copy Markdown
Contributor Author

jcantrill commented Apr 2, 2026

/tide merge-method squash

@jcantrill
Copy link
Copy Markdown
Contributor Author

jcantrill commented Apr 2, 2026

/label tide/merge-method-squash

@openshift-ci openshift-ci Bot added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Apr 2, 2026
Clee2691
Clee2691 reviewed Apr 6, 2026
View reviewed changes
Comment thread config/network-policy/clo-permissive-network-policy.yaml Outdated
@Clee2691 Clee2691 mentioned this pull request Apr 8, 2026
Open
@Clee2691
Copy link
Copy Markdown
Contributor

Clee2691 commented Apr 15, 2026

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Apr 15, 2026
Clee2691
Clee2691 reviewed Apr 15, 2026
View reviewed changes
Comment thread config/rbac/metrics_auth_role.yaml
kind: ClusterRole
metadata:
name: metrics-auth-role
name: cluster-logging-operator-metrics-auth
Copy link
Copy Markdown
Contributor

@Clee2691 Clee2691 Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this should actually continue to be a generic metrics-auth. The LFME PR #3247 will also need to use this ClusterRole.

Copy link
Copy Markdown
Contributor Author

@jcantrill jcantrill Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is likely true but the change was made here because the operator-sdk, when building the bundle has some logic where when it does not see 'cluster-logging-operator-metrics-auth' for this role, it creates separate bundle manifest files for the clusterrole and clusterrolebinding instead of adding them into the CSV and identifying the permissions the operator requires.

This is a side-affect of our config files which are a kustomize manifest and when you follow the normal artifact generation, you would normally set the 'namePrefix' field which applies to all created resources. We have variances and may be able to resolve them otherwise but this change is not that.

Copy link
Copy Markdown
Contributor

@Clee2691 Clee2691 Apr 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can reconcile a clusterrolebinding with this clusterrole for the LFME

@jcantrill jcantrill mentioned this pull request Apr 16, 2026
Open
@jcantrill
Copy link
Copy Markdown
Contributor Author

jcantrill commented Apr 16, 2026

/retest

@openshift-ci openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Apr 16, 2026
@jcantrill
Copy link
Copy Markdown
Contributor Author

jcantrill commented Apr 16, 2026

/hold cancel

@openshift-ci openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Apr 16, 2026
@jcantrill
Copy link
Copy Markdown
Contributor Author

jcantrill commented Apr 16, 2026

/retest

@vparfonov
Copy link
Copy Markdown
Contributor

vparfonov commented Apr 17, 2026

/test e2e-target

@vparfonov
Copy link
Copy Markdown
Contributor

vparfonov commented Apr 20, 2026

/retest

@jcantrill
Copy link
Copy Markdown
Contributor Author

jcantrill commented Apr 20, 2026

/test functional-target

@jcantrill
Copy link
Copy Markdown
Contributor Author

jcantrill commented Apr 21, 2026

/override ci/prow/functional-target

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented Apr 21, 2026

@jcantrill: Overrode contexts on behalf of jcantrill: ci/prow/functional-target

Details

In response to this:

/override ci/prow/functional-target

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@Clee2691
Copy link
Copy Markdown
Contributor

Clee2691 commented Apr 21, 2026

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Apr 21, 2026
@jcantrill
Copy link
Copy Markdown
Contributor Author

jcantrill commented Apr 21, 2026

/retest

@openshift-merge-bot
Copy link
Copy Markdown
Contributor

openshift-merge-bot Bot commented Apr 21, 2026

/retest-required

Remaining retests: 0 against base HEAD e47fca0 and 2 for PR HEAD 964fe35 in total

@vparfonov
Copy link
Copy Markdown
Contributor

vparfonov commented Apr 22, 2026

/test functional-target

1 similar comment
@jcantrill
Copy link
Copy Markdown
Contributor Author

jcantrill commented Apr 22, 2026

/test functional-target

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented Apr 22, 2026

@jcantrill: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-merge-bot openshift-merge-bot Bot merged commit c84abb5 into openshift:master Apr 22, 2026
7 checks passed
@jcantrill jcantrill deleted the log8977_claude branch April 22, 2026 14:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cahartma cahartma Awaiting requested review from cahartma

2 more reviewers

@vparfonov vparfonov vparfonov left review comments

@Clee2691 Clee2691 Clee2691 left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

@Clee2691 Clee2691

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. release/6.6 tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@jcantrill @openshift-ci-robot @anpingli @Clee2691 @vparfonov