Use access to Alertmanager CR to gate access to AM

[cblecker]

This changes the permissions needed to access Alertmanager's UI, and the ability to view its config or create silences. Instead of having to rely in the ability to see all namespaces, this changes the permissions to the ability to view the Alertmanager CR. This way, access can be specifically granted to users based on the ability to view that CR.

Also fix a makefile syntax issue on systems (such as Darwin) that use a different file path for the make binary.

cc: @RiRa12621 @brancz @sichvoge
ref: https://jira.coreos.com/browse/SREP-1983

[cblecker]

/test e2e-aws

[s-urbaniak]

thanks @cblecker, the e2e test failure is valid here. The following alerts are being fired:

✔ALERTS{alertmanager="https://10.131.0.5:9095/api/v1/alerts",alertname="PrometheusErrorSendingAlertsToSomeAlertmanagers",alertstate="pending",endpoint="web",instance="10.131.0.7:9091",job="prometheus-k8s",namespace="openshift-monitoring",pod="prometheus-k8s-1",service="prometheus-k8s",severity="warning"}
✔ALERTS{alertmanager="https://10.131.0.5:9095/api/v1/alerts",alertname="PrometheusErrorSendingAlertsToSomeAlertmanagers",alertstate="pending",endpoint="web",instance="10.129.2.13:9091",job="prometheus-k8s",namespace="openshift-monitoring",pod="prometheus-k8s-0",service="prometheus-k8s",severity="warning"}
✔ALERTS{alertmanager="https://10.131.0.5:9095/api/v1/alerts",alertname="PrometheusErrorSendingAlertsToSomeAlertmanagers",alertstate="firing",endpoint="web",instance="10.131.0.7:9091",job="prometheus-k8s",namespace="openshift-monitoring",pod="prometheus-k8s-1",service="prometheus-k8s",severity="warning"}
✔ALERTS{alertmanager="https://10.131.0.5:9095/api/v1/alerts",alertname="PrometheusErrorSendingAlertsToSomeAlertmanagers",alertstate="firing",endpoint="web",instance="10.129.2.13:9091",job="prometheus-k8s",namespace="openshift-monitoring",pod="prometheus-k8s-0",service="prometheus-k8s",severity="warning"}
✔ALERTS{alertmanager="https://10.129.2.10:9095/api/v1/alerts",alertname="PrometheusErrorSendingAlertsToSomeAlertmanagers",alertstate="pending",endpoint="web",instance="10.131.0.7:9091",job="prometheus-k8s",namespace="openshift-monitoring",pod="prometheus-k8s-1",service="prometheus-k8s",severity="warning"}
✔ALERTS{alertmanager="https://10.129.2.10:9095/api/v1/alerts",alertname="PrometheusErrorSendingAlertsToSomeAlertmanagers",alertstate="pending",endpoint="web",instance="10.129.2.13:9091",job="prometheus-k8s",namespace="openshift-monitoring",pod="prometheus-k8s-0",service="prometheus-k8s",severity="warning"}
✔ALERTS{alertmanager="https://10.129.2.10:9095/api/v1/alerts",alertname="PrometheusErrorSendingAlertsToSomeAlertmanagers",alertstate="firing",endpoint="web",instance="10.131.0.7:9091",job="prometheus-k8s",namespace="openshift-monitoring",pod="prometheus-k8s-1",service="prometheus-k8s",severity="warning"}
✔ALERTS{alertmanager="https://10.129.2.10:9095/api/v1/alerts",alertname="PrometheusErrorSendingAlertsToSomeAlertmanagers",alertstate="firing",endpoint="web",instance="10.129.2.13:9091",job="prometheus-k8s",namespace="openshift-monitoring",pod="prometheus-k8s-0",service="prometheus-k8s",severity="warning"}
✔ALERTS{alertmanager="https://10.128.2.8:9095/api/v1/alerts",alertname="PrometheusErrorSendingAlertsToSomeAlertmanagers",alertstate="pending",endpoint="web",instance="10.131.0.7:9091",job="prometheus-k8s",namespace="openshift-monitoring",pod="prometheus-k8s-1",service="prometheus-k8s",severity="warning"}
✔ALERTS{alertmanager="https://10.128.2.8:9095/api/v1/alerts",alertname="PrometheusErrorSendingAlertsToSomeAlertmanagers",alertstate="pending",endpoint="web",instance="10.129.2.13:9091",job="prometheus-k8s",namespace="openshift-monitoring",pod="prometheus-k8s-0",service="prometheus-k8s",severity="warning"}
✔ALERTS{alertmanager="https://10.128.2.8:9095/api/v1/alerts",alertname="PrometheusErrorSendingAlertsToSomeAlertmanagers",alertstate="firing",endpoint="web",instance="10.131.0.7:9091",job="prometheus-k8s",namespace="openshift-monitoring",pod="prometheus-k8s-1",service="prometheus-k8s",severity="warning"}
✔ALERTS{alertmanager="https://10.128.2.8:9095/api/v1/alerts",alertname="PrometheusErrorSendingAlertsToSomeAlertmanagers",alertstate="firing",endpoint="web",instance="10.129.2.13:9091",job="prometheus-k8s",namespace="openshift-monitoring",pod="prometheus-k8s-0",service="prometheus-k8s",severity="warning"}

The resolution should be failry easy. We need to give Prometheus the permissions expressed in the oauth proxy SAR: '-openshift-sar={"group": "monitoring.coreos.com", "resource": "alertmanagers", "namespace": "openshift-monitoring", "verb": "get"}'

[s-urbaniak]

I believe adding another amRole here should do the trick:

cluster-monitoring-operator/jsonnet/prometheus.jsonnet

Lines 11 to 33 in 3387268

	local authenticationRole =
	policyRule.new() +
	policyRule.withApiGroups(['authentication.k8s.io']) +
	policyRule.withResources([
	'tokenreviews',
	]) +
	policyRule.withVerbs(['create']);
	local authorizationRole =
	policyRule.new() +
	policyRule.withApiGroups(['authorization.k8s.io']) +
	policyRule.withResources([
	'subjectaccessreviews',
	]) +
	policyRule.withVerbs(['create']);
	local namespacesRole =
	policyRule.new() +
	policyRule.withApiGroups(['']) +
	policyRule.withResources([
	'namespaces',
	]) +
	policyRule.withVerbs(['get']);

[s-urbaniak]

and referencing it here:

cluster-monitoring-operator/jsonnet/prometheus.jsonnet

Lines 114 to 115 in 3387268

	clusterRole+:
	clusterRole.withRulesMixin([authenticationRole, authorizationRole, namespacesRole]),

[cblecker]

@s-urbaniak Thanks for helping to identify the errors. Should this in in addition to the namespacesRole, or instead of the namespacesRole?

[cblecker]

@s-urbaniak I'm guessing instead of, and running tests now. If it turns out that prometheus needs both permissions, then I'll add namespaces back in.

[cblecker]

Turns out it needed to be an in addition to. I've updated the PR, as well as updated the docs to indicate how to grant permissions.

[s-urbaniak]

/lgtm

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cblecker, s-urbaniak

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [s-urbaniak]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment