Skip to content

ROX-37586: stabilize Sensor metrics registry across token renewals - #23449

Draft
parametalol wants to merge 1 commit into
michael/ROX-37584-secured-cluster-monitoringfrom
michael/ROX-37586-stable-metrics-registry-key
Draft

parametalol wants to merge 1 commit into
michael/ROX-37584-secured-cluster-monitoringfrom
michael/ROX-37586-stable-metrics-registry-key

Conversation

@parametalol

Copy link
Copy Markdown
Contributor

Description

Short-lived Sensor metrics tokens rotate faster than inactive registries are cleaned up. Key the metrics registry by authenticated Sensor cluster and effective read permissions instead of token ID, while leaving the original identity available to data sources for authorization. Different clusters or changed permissions still use separate registries.

Depends on #23448. Extending token lifetime instead would delay permission changes and weaken token rotation.

User-facing documentation

Testing and quality

  • the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
  • CI results are inspected

Automated testing

  • added unit tests
  • added e2e tests
  • added regression tests
  • added compatibility tests
  • modified existing tests

How I validated my change

  • Unit tests cover token renewal, cluster isolation, and changes to effective permissions. No local tests rerun for opening this PR; CI pending.
  • No benchmarks applicable.

@openshift-ci

openshift-ci Bot commented Oct 15, 2026

Copy link
Copy Markdown

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@github-actions

github-actions Bot commented Oct 15, 2026 •

Copy link
Copy Markdown
Contributor

🚀 Build Images Ready

Images are ready for commit bea9105. To use with deploy scripts:

export MAIN_IMAGE_TAG=5.1.x-305-gbea9105ca6

@parametalol
parametalol force-pushed the michael/ROX-37586-stable-metrics-registry-key branch from 3b1a865 to 67c2eb0 Compare October 16, 2026 09:46
@parametalol
parametalol force-pushed the michael/ROX-37586-stable-metrics-registry-key branch from 67c2eb0 to 80b5654 Compare October 16, 2026 13:42
@parametalol
parametalol removed this pull request from stack #23451 October 16, 2026 13:43
@parametalol
parametalol added this pull request to stack #23471 October 16, 2026 13:43
@parametalol
parametalol force-pushed the michael/ROX-37586-stable-metrics-registry-key branch 2 times, most recently from 69fe012 to 75613be Compare October 16, 2026 15:45
Keep the metrics registry stable across Sensor token renewals.

AI-assisted: code partially generated with AI.
@parametalol
parametalol force-pushed the michael/ROX-37586-stable-metrics-registry-key branch from 75613be to bea9105 Compare October 16, 2026 16:22

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant