Red Hat OpenShift Container Platform

Grant permissions for custom namespace and secret access

Grant RBAC permissions to allow the Network Observability Operator to access secrets across custom or non-default namespaces.

For security, the Network Observability Operator does not have cluster-wide permissions to read secrets. You must explicitly grant the required permissions when any of the following conditions apply:

You configured spec.namespace in the FlowCollector resource to a namespace other than netobserv.
You configured the FlowCollector resource with spec.deploymentModel: Kafka and TLS or mTLS enabled.
You use the Loki Operator with LokiStack installed in a namespace other than netobserv.

Complete only the procedures that apply to your configuration. If you do not meet any of these conditions, no additional permissions are required.

Create cluster role bindings for a custom namespace

Create cluster role bindings for the Network Observability Operator service accounts when you deploy in a namespace other than the default netobserv namespace.

Do not modify the existing default bindings. They are overwritten during Operator upgrades. Create new bindings as shown.

Prerequisites

The Network Observability Operator is installed.
You have cluster-admin privileges.
You configured spec.namespace in the FlowCollector resource to a namespace other than netobserv.

Procedure

Replace <namespace> with the namespace you configured in spec.namespace of the FlowCollector resource.

Create the netobserv-informers-custom cluster role binding by running the following command:

$ oc create clusterrolebinding netobserv-informers-custom \
  --clusterrole=netobserv-informers \
  --serviceaccount=<namespace>:flowlogs-pipeline \
  --serviceaccount=<namespace>:flowlogs-pipeline-transformer

Create the netobserv-lokiwriter-custom cluster role binding by running the following command:

$ oc create clusterrolebinding netobserv-lokiwriter-custom \
  --clusterrole=netobserv-loki-writer \
  --serviceaccount=<namespace>:flowlogs-pipeline \
  --serviceaccount=<namespace>:flowlogs-pipeline-transformer

Create the netobserv-hostnetwork-custom cluster role binding by running the following command:

$ oc create clusterrolebinding netobserv-hostnetwork-custom \
  --clusterrole=netobserv-hostnetwork \
  --serviceaccount=<namespace>:flowlogs-pipeline

Create the token review cluster role binding by running the following command:

$ oc create clusterrolebinding netobserv-tokenreview-custom \
  --clusterrole=netobserv-token-review \
  --serviceaccount=<namespace>:netobserv-plugin

Verification

Check the FlowCollector status for errors by running the following command:
```
$ oc get flowcollector cluster -o jsonpath='{.status.conditions}'
```

Verify that no conditions report permission-related errors.

If the FlowCollector status continues to show permission errors after you grant the required permissions, restart the Network Observability Operator pod for faster reconciliation:

$ oc delete pods -n openshift-netobserv-operator -l app=netobserv-operator