Skip to content

Conversation

machine424
Copy link
Contributor

  • I added CHANGELOG entry for this change.
  • No user facing changes, so no entry in CHANGELOG was needed.

Copy link
Contributor

openshift-ci bot commented Feb 28, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: machine424

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 28, 2025
@openshift-bot
Copy link
Contributor

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

@openshift-ci openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jul 3, 2025
@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 3, 2025
@openshift-bot
Copy link
Contributor

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

@openshift-ci openshift-ci bot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Aug 2, 2025
@openshift-bot
Copy link
Contributor

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

@openshift-ci openshift-ci bot closed this Sep 2, 2025
Copy link
Contributor

openshift-ci bot commented Sep 2, 2025

@openshift-bot: Closed this PR.

In response to this:

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@machine424
Copy link
Contributor Author

/reopen

@openshift-ci openshift-ci bot reopened this Sep 2, 2025
Copy link
Contributor

openshift-ci bot commented Sep 2, 2025

@machine424: Reopened this PR.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 22, 2025
--serviceaccount=test-alertmanager-tenancy-monitoring-rules-edit:am-client
TOKEN=$(oc create token am-client --namespace=test-alertmanager-tenancy-monitoring-rules-edit)
CA_CERT=$(oc get secret router-certs-default -n openshift-ingress -o jsonpath='{.data.tls\.crt}' | base64 --decode)
curl --cacert <(printf "%s" "$CA_CERT") --fail -H "Authorization: Bearer $TOKEN" "https://alertmanager-main.openshift-monitoring:9092/api/v2/alerts?namespace=test-alertmanager-tenancy-monitoring-rules-edit"
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

echo

@machine424 machine424 force-pushed the doc2 branch 2 times, most recently from 8b95877 to 93e521a Compare October 1, 2025 13:27
s + '.'
else if namespace != '' then
s + ' in the `%s` project.'
s + ' in the `%s` project.' % namespace
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is needed for the PR

@machine424 machine424 force-pushed the doc2 branch 3 times, most recently from 338bdea to 7475bb0 Compare October 1, 2025 20:11
@machine424
Copy link
Contributor Author

machine424 commented Oct 2, 2025

/retitle MON-4383: feat(auto_docs_examples): adjust and add more examples

@openshift-ci openshift-ci bot changed the title feat(auto_docs_examples): adjust and add more examples MON-4383: feat(auto_docs_examples): adjust and add more examples Oct 2, 2025
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Oct 2, 2025
@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Oct 2, 2025

@machine424: This pull request references MON-4383 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.21.0" version, but no target version was set.

In response to this:

  • I added CHANGELOG entry for this change.
  • No user facing changes, so no entry in CHANGELOG was needed.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@machine424
Copy link
Contributor Author

/retest-required

@machine424
Copy link
Contributor Author

/skip

Copy link
Contributor

@eromanova97 eromanova97 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello @machine424 I have added a few suggestions for the wording and format. Thanks!

$ curl -k -H "Authorization: Bearer $TOKEN" "https://$ROUTE/api/v2/alerts?filter=alertname=Watchdog"
# The endpoints can also be accessed from within the cluster.
$ curl -k -H "Authorization: Bearer $TOKEN" "https://alertmanager-main.openshift-monitoring:9094/api/v2/alerts?filter=alertname=Watchdog"
----
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A few small suggestions for better flow:

Suggested change
----
+
The following example exercises permissions granted by the `monitoring-alertmanager-view` role. The binding commands must be run by a user with the necessary privileges.
+
[source,terminal]
----
# Create a test namespace and a service account.
$ oc create namespace test-alertmanager-web-monitoring-alertmanager-view
$ oc create serviceaccount am-client --namespace=test-alertmanager-web-monitoring-alertmanager-view
# Bind the role to the service account.
# The binding in this example is applied to a service account but can also be applied to any user.
$ oc create rolebinding test-alertmanager-web-monitoring-alertmanager-view \
--namespace=openshift-monitoring \
--role=monitoring-alertmanager-view \
--serviceaccount=test-alertmanager-web-monitoring-alertmanager-view:am-client
# Generate a token to access the endpoints.
$ TOKEN=$(oc create token am-client --namespace=test-alertmanager-web-monitoring-alertmanager-view)
# Access Alertmanager endpoints externally.
$ ROUTE=$(oc get route alertmanager-main --namespace=openshift-monitoring -ojsonpath={.spec.host})
$ curl -k -H "Authorization: Bearer $TOKEN" "https://$ROUTE/api/v2/alerts?filter=alertname=Watchdog"
# Access Alertmanager endpoints from within the cluster.
$ curl -k -H "Authorization: Bearer $TOKEN" "https://alertmanager-main.openshift-monitoring:9094/api/v2/alerts?filter=alertname=Watchdog"
----

Comment on lines +90 to +93
----
# The following example exercises permissions granted by the monitoring-alertmanager-edit Role.
# The binding commands are supposed to run by a user with the necessary privileges.
$ oc create namespace test-alertmanager-web-monitoring-alertmanager-edit
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
----
# The following example exercises permissions granted by the monitoring-alertmanager-edit Role.
# The binding commands are supposed to run by a user with the necessary privileges.
$ oc create namespace test-alertmanager-web-monitoring-alertmanager-edit
+
The following example exercises permissions granted by the `monitoring-alertmanager-edit` role. The binding commands must be run by a user with the necessary privileges.
+
[source,terminal]
----
# Create a test namespace and a service account.
$ oc create namespace test-alertmanager-web-monitoring-alertmanager-edit

Comment on lines 94 to 99
$ oc create serviceaccount am-client --namespace=test-alertmanager-web-monitoring-alertmanager-edit
# The binding is done to a ServiceAccount, but it can also be applied to any other user.
$ oc create rolebinding test-alertmanager-web-monitoring-alertmanager-edit \
--namespace=openshift-monitoring \
--role=monitoring-alertmanager-edit \
--serviceaccount=test-alertmanager-web-monitoring-alertmanager-edit:am-client
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
$ oc create serviceaccount am-client --namespace=test-alertmanager-web-monitoring-alertmanager-edit
# The binding is done to a ServiceAccount, but it can also be applied to any other user.
$ oc create rolebinding test-alertmanager-web-monitoring-alertmanager-edit \
--namespace=openshift-monitoring \
--role=monitoring-alertmanager-edit \
--serviceaccount=test-alertmanager-web-monitoring-alertmanager-edit:am-client
$ oc create serviceaccount am-client --namespace=test-alertmanager-web-monitoring-alertmanager-edit
# Bind the role to the service account.
# The binding in this example is applied to a service account but can also be applied to any user.
$ oc create rolebinding test-alertmanager-web-monitoring-alertmanager-edit \
--namespace=openshift-monitoring \
--role=monitoring-alertmanager-edit \
--serviceaccount=test-alertmanager-web-monitoring-alertmanager-edit:am-client

Comment on lines +100 to +101
# The token can then be used to access the endpoints on the port.
$ TOKEN=$(oc create token am-client --namespace=test-alertmanager-web-monitoring-alertmanager-edit)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
# The token can then be used to access the endpoints on the port.
$ TOKEN=$(oc create token am-client --namespace=test-alertmanager-web-monitoring-alertmanager-edit)
# Generate a token to access the endpoints on the port.
$ TOKEN=$(oc create token am-client --namespace=test-alertmanager-web-monitoring-alertmanager-edit)

Comment on lines +102 to +103
$ ROUTE=$(oc get route alertmanager-main --namespace=openshift-monitoring -ojsonpath={.spec.host})
$ curl -k -X POST "https://$ROUTE/api/v2/silences" \
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
$ ROUTE=$(oc get route alertmanager-main --namespace=openshift-monitoring -ojsonpath={.spec.host})
$ curl -k -X POST "https://$ROUTE/api/v2/silences" \
# Access Alertmanager endpoints externally.
$ ROUTE=$(oc get route alertmanager-main --namespace=openshift-monitoring -ojsonpath={.spec.host})
$ curl -k -X POST "https://$ROUTE/api/v2/silences" \

Comment on lines +362 to +366
----
----
# The following example exercises permissions granted by the monitoring-edit Cluster Role.
# The binding commands are supposed to run by a user with the necessary privileges.
$ oc create namespace test-thanos-querier-tenancy-rules-monitoring-edit
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
----
----
# The following example exercises permissions granted by the monitoring-edit Cluster Role.
# The binding commands are supposed to run by a user with the necessary privileges.
$ oc create namespace test-thanos-querier-tenancy-rules-monitoring-edit
----
+
The following example exercises permissions granted by the `monitoring-edit` cluster role. The binding commands must be run by a user with the necessary privileges.
+
[source,terminal]
----
# Create a test namespace and a service account.
$ oc create namespace test-thanos-querier-tenancy-rules-monitoring-edit

# The binding commands are supposed to run by a user with the necessary privileges.
$ oc create namespace test-thanos-querier-tenancy-rules-monitoring-edit
$ oc create serviceaccount thanos-client --namespace=test-thanos-querier-tenancy-rules-monitoring-edit
# The binding is done to a Service Account, but it can also be applied to any other user.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
# The binding is done to a Service Account, but it can also be applied to any other user.
# Bind the role to the service account.
# The binding in this example is applied to a service account but can also be applied to any user.

--namespace=test-thanos-querier-tenancy-rules-monitoring-edit \
--clusterrole=monitoring-edit \
--serviceaccount=test-thanos-querier-tenancy-rules-monitoring-edit:thanos-client
# The token can then be used to access the endpoints.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
# The token can then be used to access the endpoints.
# Generate a token to access the endpoints.

--serviceaccount=test-thanos-querier-tenancy-rules-monitoring-edit:thanos-client
# The token can then be used to access the endpoints.
$ TOKEN=$(oc create token thanos-client --namespace=test-thanos-querier-tenancy-rules-monitoring-edit)
# Because the port is not exposed by default, the endpoint is assumed to be accessed from within the cluster.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
# Because the port is not exposed by default, the endpoint is assumed to be accessed from within the cluster.
# Access Alertmanager endpoints from within the cluster. The port is not exposed externally by default.

Comment on lines +378 to +394
----
----
# The following example exercises permissions granted by the monitoring-rules-view Cluster Role.
# The binding commands are supposed to run by a user with the necessary privileges.
$ oc create namespace test-thanos-querier-tenancy-rules-monitoring-rules-view
$ oc create serviceaccount thanos-client --namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view
# The binding is done to a Service Account, but it can also be applied to any other user.
$ oc create rolebinding test-thanos-querier-tenancy-rules-monitoring-rules-view \
--namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view \
--clusterrole=monitoring-rules-view \
--serviceaccount=test-thanos-querier-tenancy-rules-monitoring-rules-view:thanos-client
# The token can then be used to access the endpoints.
$ TOKEN=$(oc create token thanos-client --namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view)
# Because the port is not exposed by default, the endpoint is assumed to be accessed from within the cluster.
$ curl -k -f -H "Authorization: Bearer $TOKEN" "https://thanos-querier.openshift-monitoring:9093/api/v1/rules?namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view"
$ curl -k -f -H "Authorization: Bearer $TOKEN" "https://thanos-querier.openshift-monitoring:9093/api/v1/alerts?namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view"
----
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
----
----
# The following example exercises permissions granted by the monitoring-rules-view Cluster Role.
# The binding commands are supposed to run by a user with the necessary privileges.
$ oc create namespace test-thanos-querier-tenancy-rules-monitoring-rules-view
$ oc create serviceaccount thanos-client --namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view
# The binding is done to a Service Account, but it can also be applied to any other user.
$ oc create rolebinding test-thanos-querier-tenancy-rules-monitoring-rules-view \
--namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view \
--clusterrole=monitoring-rules-view \
--serviceaccount=test-thanos-querier-tenancy-rules-monitoring-rules-view:thanos-client
# The token can then be used to access the endpoints.
$ TOKEN=$(oc create token thanos-client --namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view)
# Because the port is not exposed by default, the endpoint is assumed to be accessed from within the cluster.
$ curl -k -f -H "Authorization: Bearer $TOKEN" "https://thanos-querier.openshift-monitoring:9093/api/v1/rules?namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view"
$ curl -k -f -H "Authorization: Bearer $TOKEN" "https://thanos-querier.openshift-monitoring:9093/api/v1/alerts?namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view"
----
----
+
The following example exercises permissions granted by the `monitoring-rules-view` cluster role. The binding commands must be run by a user with the necessary privileges.
+
[source,terminal]
----
# Create a test namespace and a service account.
$ oc create namespace test-thanos-querier-tenancy-rules-monitoring-rules-view
$ oc create serviceaccount thanos-client --namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view
# Bind the role to the service account.
# The binding in this example is applied to a service account but can also be applied to any user.
$ oc create rolebinding test-thanos-querier-tenancy-rules-monitoring-rules-view \
--namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view \
--clusterrole=monitoring-rules-view \
--serviceaccount=test-thanos-querier-tenancy-rules-monitoring-rules-view:thanos-client
# Generate a token to access the endpoints.
$ TOKEN=$(oc create token thanos-client --namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view)
# Access Alertmanager endpoints from within the cluster. The port is not exposed externally by default.
$ curl -k -f -H "Authorization: Bearer $TOKEN" "https://thanos-querier.openshift-monitoring:9093/api/v1/rules?namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view"
$ curl -k -f -H "Authorization: Bearer $TOKEN" "https://thanos-querier.openshift-monitoring:9093/api/v1/alerts?namespace=test-thanos-querier-tenancy-rules-monitoring-rules-view"
----

Copy link
Contributor

@eromanova97 eromanova97 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello @machine424 I have added a few suggestions for the wording and format. Thanks!

Copy link
Contributor

openshift-ci bot commented Oct 2, 2025

@machine424: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-ovn-single-node 9852ee0 link false /test e2e-aws-ovn-single-node
ci/prow/e2e-hypershift-conformance 9852ee0 link true /test e2e-hypershift-conformance
ci/prow/e2e-agnostic-operator 9852ee0 link true /test e2e-agnostic-operator
ci/prow/e2e-aws-ovn-upgrade 9852ee0 link true /test e2e-aws-ovn-upgrade
ci/prow/ginkgo-tests 9852ee0 link false /test ginkgo-tests
ci/prow/e2e-aws-ovn-techpreview 9852ee0 link true /test e2e-aws-ovn-techpreview
ci/prow/okd-scos-e2e-aws-ovn 9852ee0 link false /test okd-scos-e2e-aws-ovn

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants