MON-4473: Migrate Prometheus targets discovering from Endpoints to EndpointsSlices#823
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@machine424: This pull request references MON-4473 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.22.0" version, but no target version was set. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
WalkthroughAdded EndpointSlice support: Prometheus RBAC Roles were extended to allow Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
manifests/0000_90_cluster-authentication-operator_01_prometheusrbac.yaml (1)
12-18: EndpointSlice RBAC uses the wrong API group.
endpointsliceslive indiscovery.k8s.io, not the core""API group. The current rules will deny Prometheus authorization to list/watch EndpointSlices, causing endpoint discovery to fail.Proposed fix (apply to all three Roles)
@@ resources: - services - endpoints - - endpointslices - pods verbs: - get - list - watch +- apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - get + - list + - watch @@ resources: - services - endpoints - - endpointslices - pods verbs: - get - list - watch +- apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - get + - list + - watch @@ resources: - services - endpoints - - endpointslices - pods verbs: - get - list - watch +- apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - get + - list + - watchAlso applies to: 35-41, 58-64
|
good catch |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@manifests/0000_90_cluster-authentication-operator_01_prometheusrbac.yaml`:
- Around line 22-29: Fix the typo in the Role rules for the discovery.k8s.io
apiGroup: replace the invalid verb "watchg" with "watch" for the rules granting
access to resources "endpointslices" (the three occurrences currently showing
"watchg"); update each Role/Rule block that lists the verb to use "watch" so
Prometheus can properly watch EndpointSlice changes.
manifests/0000_90_cluster-authentication-operator_01_prometheusrbac.yaml
Outdated
Show resolved
Hide resolved
|
/retest-required |
|
@machine424: This pull request references MON-4473 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/retest-required |
4 similar comments
|
/retest-required |
|
/retest-required |
|
/retest-required |
|
/retest-required |
|
/verified by existing tests |
openshift-ci-robot
added
the
verified
|
@machine424: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@machine424: This pull request references MON-4473 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: liouk, machine424 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
|
@machine424: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
openshift-merge-bot
bot
merged commit 0ad22f8
into
openshift:master
3 participants
This PR migrates Prometheus service discovery from the deprecated Endpoints API to the EndpointSlices API, by:
serviceDiscoveryRole: EndpointSliceon ServiceMonitors.endpointslicespermissions.We're taking a conservative approach by keeping the existing
endpointspermissions alongside the newendpointslicesones. This provides a safety net in case any ServiceMonitors, whether deployed from this repo or from another source, still rely on the same Role and were missed during the migration.That said, since both resources provide essentially the same data, keeping both isn't meaningfully more permissive from a security standpoint.
These changes target OpenShift 4.22+ and should not be backported to earlier releases.