Repository navigation
ROX-37581: issue Sensor-bound metrics tokens from permission set - #23450
Draft
parametalol wants to merge 1 commit into
Draft
parametalol wants to merge 1 commit into
parametalol wants to merge 1 commit into
Conversation
|
Skipping CI for Draft Pull Request. |
Contributor
🚀 Build Images ReadyImages are ready for commit 80e6114. To use with deploy scripts: export MAIN_IMAGE_TAG=5.1.x-302-g80e6114786 |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## michael/ROX-37581-console-proxy-foundation #23450 +/- ##
===========================================================================
Coverage 51.97% 51.97%
===========================================================================
Files 2915 2915
Lines 183777 183793 +16
===========================================================================
+ Hits 95517 95533 +16
Misses 79889 79889
Partials 8371 8371
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
parametalol
force-pushed
the
michael/ROX-37581-sensor-metrics-token
branch
from
October 16, 2026 09:46
58d7211 to
a9bbaa8
Compare
parametalol
force-pushed
the
michael/ROX-37581-sensor-metrics-token
branch
from
October 16, 2026 13:42
a9bbaa8 to
80a6dfe
Compare
parametalol
removed this pull request from stack #23451
October 16, 2026 13:43
parametalol
changed the base branch from
michael/ROX-37581-secured-cluster-metrics-role
to
michael/ROX-37581-console-proxy-foundation
October 16, 2026 13:43
parametalol
added this pull request to stack #23471
October 16, 2026 13:43
5 of 9 tasks
parametalol
force-pushed
the
michael/ROX-37581-sensor-metrics-token
branch
from
October 16, 2026 14:41
80a6dfe to
39e2e57
Compare
parametalol
force-pushed
the
michael/ROX-37581-sensor-metrics-token
branch
from
October 16, 2026 15:45
39e2e57 to
c7b12c4
Compare
Use the managed Prometheus permission set for Sensor-bound metrics tokens and restrict each token to the authenticated cluster. AI-assisted: code partially generated with AI.
parametalol
force-pushed
the
michael/ROX-37581-sensor-metrics-token
branch
from
October 16, 2026 16:22
c7b12c4 to
80e6114
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Issue Sensor-proxied metrics tokens using the same configurable Prometheus metrics permission set as the Central Prometheus role. Scope tokens to the authenticated Sensor cluster and reject caller-supplied permissions or scopes. No separate secured-cluster metrics role is needed; changes to configured resources apply to newly issued tokens.
Depends on #23470. This replaces closed PR #23443, which GitHub could not reopen.
User-facing documentation
Testing and quality
Automated testing
How I validated my change
go test ./central/auth/internaltokens/service ./central/auth/openshift ./sensor/common/centralproxy -count=1