Skip to content

ROX-37581: issue Sensor-bound metrics tokens from managed role - #23443

Closed
parametalol wants to merge 1 commit into
michael/ROX-37581-secured-cluster-metrics-rolefrom
michael/ROX-37581-sensor-metrics-token
Closed

ROX-37581: issue Sensor-bound metrics tokens from managed role#23443
parametalol wants to merge 1 commit into
michael/ROX-37581-secured-cluster-metrics-rolefrom
michael/ROX-37581-sensor-metrics-token

Conversation

@parametalol

@parametalol parametalol commented Oct 15, 2026

Copy link
Copy Markdown
Contributor

Description

Allow Sensor-proxied OpenShift Prometheus requests to use read permissions from the Central-managed secured-cluster metrics role, scoped to the authenticated Sensor's cluster. Reject caller-supplied permissions/scopes and write grants. This keeps permissions configurable without allowing the caller to choose a cluster or broader access; unlike the alternative of hard-coded scrape permissions, operators can select the read resources they need.

User-facing documentation

Testing and quality

  • the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
  • CI results are inspected

Automated testing

  • added unit tests
  • added e2e tests
  • added regression tests
  • added compatibility tests
  • modified existing tests

How I validated my change

  • Added unit tests for role resolution, permission validation, and Sensor token policy.
  • No local tests run for this description-only follow-up; CI pending.

@openshift-ci

openshift-ci Bot commented Oct 15, 2026

Copy link
Copy Markdown

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@parametalol
ROX-37581: issue Sensor-bound metrics tokens from managed role
28f4fb2 
Request: 'mapping on the sensor side: path->role, and allow managing permissions for this new role for sensor scrape requests on the central side'; 'users will have to explicitly configure the permissions according to the selected metrics needs.'

A fixed metrics role request takes read permissions from Central's managed role, rejects client-supplied scopes and write grants, and binds the token to the verified Sensor cluster. Console token requests retain their existing policy. Also seed the role on non-OpenShift Central instances managing OpenShift secured clusters.

AI-assisted: code partially generated by AI.
@parametalol
parametalol force-pushed the michael/ROX-37581-sensor-metrics-token branch from f66eb25 to 28f4fb2 Compare October 15, 2026 13:48
@parametalol

parametalol commented Oct 15, 2026

Copy link
Copy Markdown
Contributor Author

Opened against the wrong stack layer for the requested role-description change. Moved the change to the secured-cluster role branch and opened #23444 instead.

@github-actions

github-actions Bot commented Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🚀 Build Images Ready

Images are ready for commit 28f4fb2. To use with deploy scripts:

export MAIN_IMAGE_TAG=5.1.x-291-g28f4fb2fc6

@codecov

codecov Bot commented Oct 15, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 81.57895% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 51.95%. Comparing base (57b405a) to head (28f4fb2).
⚠️ Report is 1 commits behind head on michael/ROX-37581-secured-cluster-metrics-role.

Files with missing lines Patch % Lines
central/auth/internaltokens/service/policy.go 71.42% 1 Missing and 1 partial ⚠️
...entral/auth/internaltokens/service/role_manager.go 90.90% 1 Missing and 1 partial ⚠️
central/auth/openshift/metrics_auth.go 0.00% 2 Missing ⚠️
central/auth/internaltokens/service/singleton.go 0.00% 1 Missing ⚠️
Additional details and impacted files 
@@                               Coverage Diff                               @@
##           michael/ROX-37581-secured-cluster-metrics-role   #23443   +/-   ##
===============================================================================
  Coverage                                           51.94%   51.95%           
===============================================================================
  Files                                                2914     2914           
  Lines                                              183665   183700   +35     
===============================================================================
+ Hits                                                95408    95443   +35     
  Misses                                              79888    79888           
  Partials                                             8369     8369
Flag Coverage Δ
go-unit-tests 51.95% <81.57%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

This was referenced Oct 15, 2026
Draft
Draft
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

ai-assisted area/central do-not-merge/work-in-progress

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@parametalol