You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<1> Substitute `<role>` with `monitoring-rules-view`, `monitoring-rules-edit`, or `monitoring-edit`.
26
-
+
27
-
[IMPORTANT]
28
-
====
29
-
Whichever role you choose, you must bind it against a specific project as a cluster administrator.
30
-
====
30
+
<1> Substitute `<role>` with the wanted monitoring role, `<user>` with the user to whom you want to assign the role, and `<namespace>` with the project where you want to grant the access.
31
+
32
+
* To assign a monitoring cluster role to a user for a project, enter the following command:
31
33
+
32
-
As an example, substitute `<role>` with `monitoring-edit`, `<user>` with `johnsmith`, and `<namespace>` with `ns1`. This assigns the user `johnsmith` permission to set up metrics collection and to create alerting rules in the `ns1` namespace.
<1> Substitute `<cluster-role>` with the wanted monitoring cluster role, `<user>` with the user to whom you want to assign the cluster role, and `<namespace>` with the project where you want to grant the access.
= Granting user permissions by using the web console
8
8
9
-
You can grant users permissions to monitor their own projects, by using the {product-title} web console.
9
+
You can grant users permissions for the `openshift-monitoring` project or their own projects, by using the {product-title} web console.
10
10
11
11
.Prerequisites
12
12
@@ -15,20 +15,20 @@ You can grant users permissions to monitor their own projects, by using the {pro
15
15
16
16
.Procedure
17
17
18
-
. In the *Administrator* perspective within the {product-title} web console, navigate to *User Management*->*RoleBindings*->*Create binding*.
18
+
. In the *Administrator* perspective of the {product-title} web console, go to *User Management*->*RoleBindings*->*Create binding*.
19
19
20
-
. In the *Binding Type* section, select the "Namespace Role Binding" type.
20
+
. In the *Binding Type* section, select the *Namespace Role Binding* type.
21
21
22
22
. In the *Name* field, enter a name for the role binding.
23
23
24
-
. In the *Namespace* field, select the user-defined project where you want to grant the access.
24
+
. In the *Namespace* field, select the project where you want to grant the access.
25
25
+
26
26
[IMPORTANT]
27
27
====
28
-
The monitoring role will be bound to the project that you apply in the *Namespace* field. The permissions that you grant to a user by using this procedure will apply only to the selected project.
28
+
The monitoring role or cluster role permissions that you grant to a user by using this procedure apply only to the project that you select in the *Namespace* field.
29
29
====
30
30
31
-
. Select `monitoring-rules-view`, `monitoring-rules-edit`, or `monitoring-edit` in the *Role Name* list.
31
+
. Select a monitoring role or cluster role from the *Role Name* list.
Copy file name to clipboardExpand all lines: modules/monitoring-granting-users-permission-to-monitor-user-defined-projects.adoc
+35-11Lines changed: 35 additions & 11 deletions
Original file line number
Diff line number
Diff line change
@@ -10,24 +10,48 @@ As a cluster administrator, you can monitor all core {product-title} and user-de
10
10
11
11
You can also grant developers and other users different permissions:
12
12
13
-
* To monitor user-defined projects.
14
-
* To configure the components that monitor user-defined projects.
15
-
* To configure alert routing for user-defined projects.
13
+
* Monitoring user-defined projects
14
+
* Configuring the components that monitor user-defined projects
15
+
* Configuring alert routing for user-defined projects
16
+
* Managing alerts and silences for user-defined projects
16
17
17
-
You can grant the permissions by assigning one of the following monitoring roles:
18
+
You can grant the permissions by assigning one of the following monitoring roles or cluster roles:
18
19
20
+
.Monitoring roles
19
21
|===
20
-
|Role name |Description
22
+
|Role name |Description |Project
21
23
22
-
|`monitoring-rules-view` | Users with this cluster role have read access to `PrometheusRule` custom resources for a user-defined project. They can also view the alerts in the *Developer* perspective of the {product-title} web console.
24
+
|`user-workload-monitoring-config-edit`
25
+
|Users with this role can edit the `user-workload-monitoring-config``ConfigMap` object to configure Prometheus, Prometheus Operator, Alertmanager, and Thanos Ruler for user-defined workload monitoring.
26
+
|`openshift-user-workload-monitoring`
23
27
24
-
|`monitoring-rules-edit` | Users with this cluster role can create, modify, and delete `PrometheusRule` custom resources for a user-defined project. They can also create and silence alerts in the *Developer* perspective of the {product-title} web console.
28
+
|`monitoring-alertmanager-api-reader`
29
+
|Users with this role have read access to the user-defined Alertmanager API for all projects, if the user-defined Alertmanager is enabled.
30
+
|`openshift-user-workload-monitoring`
25
31
26
-
|`monitoring-edit` | Users with this cluster role have the same privileges as users with the `monitoring-rules-edit` cluster role. Additionally, users can create, modify, and delete `ServiceMonitor` and `PodMonitor` resources to scrape metrics from services and pods.
32
+
|`monitoring-alertmanager-api-writer`
33
+
|Users with this role have read and write access to the user-defined Alertmanager API for all projects, if the user-defined Alertmanager is enabled.
34
+
|`openshift-user-workload-monitoring`
35
+
|===
36
+
37
+
.Monitoring cluster roles
38
+
|===
39
+
|Cluster role name |Description |Project
40
+
41
+
|`monitoring-rules-view`
42
+
|Users with this cluster role have read access to `PrometheusRule` custom resources (CRs) for user-defined projects. They can also view the alerts and silences in the *Developer* perspective of the {product-title} web console.
43
+
|Can be bound with `RoleBinding` to any user project.
44
+
45
+
|`monitoring-rules-edit`
46
+
|Users with this cluster role can create, modify, and delete `PrometheusRule` CRs for user-defined projects. They can also manage alerts and silences in the *Developer* perspective of the {product-title} web console.
47
+
|Can be bound with `RoleBinding` to any user project.
27
48
28
-
|`user-workload-monitoring-config-edit` | This role is given in the `openshift-user-workload-monitoring` project. Users with this role can edit the `user-workload-monitoring-config``ConfigMap` object to configure Prometheus, Prometheus Operator, Alertmanager, and Thanos Ruler for user-defined workload monitoring.
49
+
|`monitoring-edit`
50
+
|Users with this cluster role have the same privileges as users with the `monitoring-rules-edit` cluster role. Additionally, users can create, read, modify, and delete `ServiceMonitor` and `PodMonitor` resources to scrape metrics from services and pods.
51
+
|Can be bound with `RoleBinding` to any user project.
29
52
30
-
|`alert-routing-edit` | Users with this cluster role can create, update, and delete `AlertmanagerConfig` custom resources for a user-defined project.
53
+
|`alert-routing-edit`
54
+
|Users with this cluster role can create, update, and delete `AlertmanagerConfig` CRs for user-defined projects.
55
+
|Can be bound with `RoleBinding` to any user project.
31
56
|===
32
57
33
-
The following sections provide details on how to assign these roles by using the {product-title} web console or the CLI.
= Granting users permissions for core platform monitoring
8
+
9
+
As a cluster administrator, you can monitor all core {product-title} and user-defined projects.
10
+
11
+
You can also grant developers and other users different permissions for core platform monitoring. You can grant the permissions by assigning one of the following monitoring roles or cluster roles:
12
+
13
+
|===
14
+
|Name |Description |Project
15
+
16
+
|`cluster-monitoring-metrics-api`
17
+
|Users with this role have the ability to access Thanos Querier API endpoints. Additionally, it grants access to the core platform Prometheus API and user-defined Thanos Ruler API endpoints.
|Users with this role can manage `AlertingRule` and `AlertRelabelConfig` resources for core platform monitoring. These permissions are required for the alert customization feature.
22
+
|`openshift-monitoring`
23
+
24
+
|`monitoring-alertmanager-edit`
25
+
|Users with this role can manage the Alertmanager API for core platform monitoring. They can also manage alert silences in the *Administrator* perspective of the {product-title} web console.
26
+
|`openshift-monitoring`
27
+
28
+
|`monitoring-alertmanager-view`
29
+
|Users with this role can monitor the Alertmanager API for core platform monitoring. They can also view alert silences in the *Administrator* perspective of the {product-title} web console.
30
+
|`openshift-monitoring`
31
+
32
+
|`cluster-monitoring-view`
33
+
|Users with this cluster role have the same access rights as `cluster-monitoring-metrics-api` role, with additional permissions, providing access to the `/federate` endpoint for the user-defined Prometheus.
34
+
|Must be bound with `ClusterRoleBinding` to gain access to the `/federate` endpoint for the user-defined Prometheus.
* xref:../../observability/monitoring/enabling-monitoring-for-user-defined-projects.adoc#granting-user-permissions-using-the-web-console_enabling-monitoring-for-user-defined-projects[Granting user permissions by using the web console]
84
+
* xref:../../observability/monitoring/enabling-monitoring-for-user-defined-projects.adoc#granting-user-permissions-using-the-cli_enabling-monitoring-for-user-defined-projects[Granting user permissions by using the CLI]
85
+
* xref:../../observability/monitoring/accessing-third-party-monitoring-apis.adoc#resources-reference-for-the-cluster-monitoring-operator[Resources reference for the {cmo-full}]
Copy file name to clipboardExpand all lines: observability/monitoring/managing-alerts.adoc
-6Lines changed: 0 additions & 6 deletions
Original file line number
Diff line number
Diff line change
@@ -15,12 +15,6 @@ In {product-title} {product-version}, the Alerting UI enables you to manage aler
15
15
[NOTE]
16
16
====
17
17
The alerts, silences, and alerting rules that are available in the Alerting UI relate to the projects that you have access to. For example, if you are logged in as a user with the `cluster-admin` role, you can access all alerts, silences, and alerting rules.
18
-
19
-
If you are a non-administrator user, you can create and silence alerts if you are assigned the following user roles:
20
-
21
-
* The `cluster-monitoring-view` cluster role, which allows you to access Alertmanager
22
-
* The `monitoring-alertmanager-edit` role, which permits you to create and silence alerts in the *Administrator* perspective in the web console
23
-
* The `monitoring-rules-edit` cluster role, which permits you to create and silence alerts in the *Developer* perspective in the web console
24
18
====
25
19
26
20
// Accessing the Alerting UI in the Administrator and Developer perspectives
0 commit comments