Red Hat OpenShift Container Platform

Enabling multi-tenancy in network observability

Enable multi-tenancy in network observability by configuring cluster roles and namespace roles to grant project administrators and developers granular, restricted access to flows and metrics in Loki and Prometheus.

Access is enabled for project administrators. Project administrators who have limited access to some namespaces can access flows for only those namespaces.

For Developers, multi-tenancy is available for both Loki and Prometheus but requires different access rights.

Prerequisite

If you are using Loki, you have installed at least Loki Operator version 5.7.
You must be logged in as a project administrator.

Procedure

For per-tenant access, you must have the netobserv-loki-reader cluster role and the netobserv-metrics-reader namespace role to use the developer perspective. Run the following commands for this level of access:
```
$ oc adm policy add-cluster-role-to-user netobserv-loki-reader <user_group_or_name>
```
```
$ oc adm policy add-role-to-user netobserv-metrics-reader <user_group_or_name> -n <namespace>
```
For cluster-wide access, non-cluster-administrators must have the netobserv-loki-reader, cluster-monitoring-view, and netobserv-metrics-reader cluster roles. In this scenario, you can use either the admin perspective or the developer perspective. Run the following commands for this level of access:
```
$ oc adm policy add-cluster-role-to-user netobserv-loki-reader <user_group_or_name>
```
```
$ oc adm policy add-cluster-role-to-user cluster-monitoring-view <user_group_or_name>
```
```
$ oc adm policy add-cluster-role-to-user netobserv-metrics-reader <user_group_or_name>
```

Grant access to LokiStack secrets

Grant the Network Observability Operator permission to access the LokiStack secret when LokiStack is installed in a namespace other than netobserv.

Prerequisites

The Network Observability Operator is installed.
You have cluster-admin privileges.
You use the Loki Operator with LokiStack installed in a namespace other than netobserv.

Procedure

Replace <lokistack_namespace> with the namespace where LokiStack is installed and <namespace> with the namespace configured in spec.namespace of the FlowCollector resource.

Create the secret-watcher role binding in the LokiStack namespace by running the following command:

$ oc create rolebinding secret-watcher \
  -n <lokistack_namespace> \
  --clusterrole=netobserv-secret-watcher \
  --serviceaccount=openshift-netobserv-operator:netobserv-controller-manager

Create the secret-creator role binding by running the following command:

$ oc create rolebinding secret-creator \
  -n <namespace> \
  --clusterrole=netobserv-secret-creator \
  --serviceaccount=openshift-netobserv-operator:netobserv-controller-manager

Verification

Check the FlowCollector status for errors by running the following command:
```
$ oc get flowcollector cluster -o jsonpath='{.status.conditions}'
```

Verify that no conditions report permission-related errors.

If the FlowCollector status continues to show permission errors after you grant the required permissions, restart the Network Observability Operator pod for faster reconciliation:

$ oc delete pods -n openshift-netobserv-operator -l app=netobserv-operator

Grant access to Kafka secrets

Grant the Network Observability Operator permission to access Kafka secrets when you use the Kafka deployment model with TLS or mTLS enabled.

Prerequisites

The Network Observability Operator is installed.
You have cluster-admin privileges.
You configured the FlowCollector resource with spec.deploymentModel: Kafka and TLS or mTLS enabled.

Procedure

Replace <namespace> with the namespace configured in spec.namespace of the FlowCollector resource. The default value is netobserv.
1. If Kafka is installed in the same namespace as the Network Observability components, create the secret watcher role binding by running the following command:
  $ oc create rolebinding secret-watcher \ -n <namespace> \ --clusterrole=netobserv-secret-watcher \ --serviceaccount=openshift-netobserv-operator:netobserv-controller-manager
2. Create the secret creator role binding in the privileged namespace by running the following command:
  $ oc create rolebinding secret-creator \ -n <namespace>-privileged \ --clusterrole=netobserv-secret-creator \ --serviceaccount=openshift-netobserv-operator:netobserv-controller-manager

If Kafka is installed in a different namespace, create the secret watcher role binding in the Kafka namespace.

Replace <kafka_namespace> with the namespace where Kafka is installed by running the following command:

$ oc create rolebinding secret-watcher \
  -n <kafka_namespace> \
  --clusterrole=netobserv-secret-watcher \
  --serviceaccount=openshift-netobserv-operator:netobserv-controller-manager

Create the secret creator role binding by running the following command:

$ oc create rolebinding secret-creator \
  -n <namespace> \
  --clusterrole=netobserv-secret-creator \
  --serviceaccount=openshift-netobserv-operator:netobserv-controller-manager

Create the secret creator role binding in the privileged namespace by running the following command:

$ oc create rolebinding secret-creator \
  -n <namespace>-privileged \
  --clusterrole=netobserv-secret-creator \
  --serviceaccount=openshift-netobserv-operator:netobserv-controller-manager

Verification

Check the FlowCollector status for errors by running the following command:
```
$ oc get flowcollector cluster -o jsonpath='{.status.conditions}'
```

Verify that no conditions report permission-related errors.

If the FlowCollector status continues to show permission errors after you grant the required permissions, restart the Network Observability Operator pod for faster reconciliation:

$ oc delete pods -n openshift-netobserv-operator -l app=netobserv-operator