MON-4473: Migrate Prometheus targets discovering from Endpoints to EndpointsSlices #823
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@machine424: This pull request references MON-4473 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.22.0" version, but no target version was set. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
WalkthroughAdded EndpointSlice support: Prometheus RBAC Roles were extended to allow Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: machine424 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
manifests/0000_90_cluster-authentication-operator_01_prometheusrbac.yaml (1)
12-18: EndpointSlice RBAC uses the wrong API group.
endpointsliceslive indiscovery.k8s.io, not the core""API group. The current rules will deny Prometheus authorization to list/watch EndpointSlices, causing endpoint discovery to fail.Proposed fix (apply to all three Roles)
@@ resources: - services - endpoints - - endpointslices - pods verbs: - get - list - watch +- apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - get + - list + - watch @@ resources: - services - endpoints - - endpointslices - pods verbs: - get - list - watch +- apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - get + - list + - watch @@ resources: - services - endpoints - - endpointslices - pods verbs: - get - list - watch +- apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - get + - list + - watchAlso applies to: 35-41, 58-64
|
good catch |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@manifests/0000_90_cluster-authentication-operator_01_prometheusrbac.yaml`:
- Around line 22-29: Fix the typo in the Role rules for the discovery.k8s.io
apiGroup: replace the invalid verb "watchg" with "watch" for the rules granting
access to resources "endpointslices" (the three occurrences currently showing
"watchg"); update each Role/Rule block that lists the verb to use "watch" so
Prometheus can properly watch EndpointSlice changes.
manifests/0000_90_cluster-authentication-operator_01_prometheusrbac.yaml
Outdated
Show resolved
Hide resolved
|
/retest-required |
|
@machine424: This pull request references MON-4473 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/retest-required |
|
@machine424: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/retest-required |
2 similar comments
|
/retest-required |
|
/retest-required |
3 participants
This PR migrates Prometheus service discovery from the deprecated Endpoints API to the EndpointSlices API, by:
serviceDiscoveryRole: EndpointSliceon ServiceMonitors.endpointslicespermissions.We're taking a conservative approach by keeping the existing
endpointspermissions alongside the newendpointslicesones. This provides a safety net in case any ServiceMonitors, whether deployed from this repo or from another source, still rely on the same Role and were missed during the migration.That said, since both resources provide essentially the same data, keeping both isn't meaningfully more permissive from a security standpoint.
These changes target OpenShift 4.22+ and should not be backported to earlier releases.