Merge pull request #19318 from simonpasquier/fix-17685

Allow Prometheus to get metrics from the router

Author: openshift-merge-robot

pkg/cmd/server/bootstrappolicy/policy.go

@@ -564,6 +564,7 @@ func GetOpenshiftBootstrapClusterRoles() []rbac.ClusterRole {
 				rbac.NewRule("list", "watch").Groups(kapiGroup).Resources("endpoints").RuleOrDie(),
 				rbac.NewRule("list", "watch").Groups(kapiGroup).Resources("services").RuleOrDie(),
 
+				rbac.NewRule("create").Groups(kAuthnGroup).Resources("tokenreviews").RuleOrDie(),
 				rbac.NewRule("create").Groups(kAuthzGroup).Resources("subjectaccessreviews").RuleOrDie(),
 
 				rbac.NewRule("list", "watch").Groups(routeGroup, legacyRouteGroup).Resources("routes").RuleOrDie(),

pkg/oc/admin/router/router.go

@@ -791,8 +791,6 @@ func RunCmdRouter(f *clientcmd.Factory, cmd *cobra.Command, out, errout io.Write
 			if t.Annotations == nil {
 				t.Annotations = make(map[string]string)
 			}
-			t.Annotations["prometheus.io/scrape"] = "true"
-			t.Annotations["prometheus.io/port"] = "1936"
 			t.Annotations["prometheus.openshift.io/username"] = cfg.StatsUsername
 			t.Annotations["prometheus.openshift.io/password"] = cfg.StatsPassword
 			t.Spec.ClusterIP = clusterIP

test/testdata/bootstrappolicy/bootstrap_cluster_roles.yaml

@@ -1764,6 +1764,12 @@ items:
     verbs:
     - list
     - watch
+  - apiGroups:
+    - authentication.k8s.io
+    resources:
+    - tokenreviews
+    verbs:
+    - create
   - apiGroups:
     - authorization.k8s.io
     resources:

test/testdata/bootstrappolicy/bootstrap_policy_file.yaml

@@ -1934,6 +1934,13 @@ items:
     verbs:
     - list
     - watch
+  - apiGroups:
+    - authentication.k8s.io
+    attributeRestrictions: null
+    resources:
+    - tokenreviews
+    verbs:
+    - create
   - apiGroups:
     - authorization.k8s.io
     attributeRestrictions: null