Opensearch-2.13 /Opensearch-2.15
Describe the issue : We are trying to create the alert monitors in different tenants but however all the monitors are being visible in both the tenants and app teams are complaining about the RBAC in the alerting plugin.
Even after enabling the backend roles the rbac with alerting plugin is not working. Below is the settings that are enabled in the cluster.
settings_in_cluster :
{
“persistent”: {
“cluster”: {
“routing”: {
“allocation”: {
“cluster_concurrent_rebalance”: “50”,
“node_concurrent_recoveries”: “50”,
“enable”: “all”,
“total_shards_per_node”: “5000”
}
},
“max_shards_per_node”: “5000”
},
“indices”: {
“breaker”: {
“fielddata”: {
“limit”: “60%”
}
},
“recovery”: {
“max_bytes_per_sec”: “1024mb”,
“max_concurrent_file_chunks”: “5”,
“max_concurrent_operations”: “4”
}
},
“opensearch”: {
“notifications”: {
“general”: {
“filter_by_backend_roles”: “true”
}
}
},
“plugins”: {
“index_state_management”: {
“metadata_migration”: {
“status”: “1”
},
“template_migration”: {
“control”: “-1”
}
},
“alerting”: {
“filter_by_backend_roles”: “true”
}
}
},
“transient”: {
“cluster”: {
“routing”: {
“allocation”: {
“disk”: {
“watermark”: {
“low”: “95%”,
“flood_stage”: “95%”,
“high”: “95%”
}
},
“enable”: “all”,
“total_shards_per_node”: “5000”
}
},
“info”: {
“update”: {
“interval”: “1m”
}
},
“max_shards_per_node”: “5000”
},
“plugins”: {
“anomaly_detection”: {
“filter_by_backend_roles”: “true”
},
“alerting”: {
“filter_by_backend_roles”: “true”
}
}
}
}
Roles&users :
Below are the configuration I have used for the tenants , Roles, Internal users.
For the internal users We have provided the pre-defined roles as alerting_full_access
Relevant Logs or Screenshots :
When I start to create the monitors , the monitors are being appeared on both the tenants regardless in which tenant space they are created.
I need the help to debug the issue to create the monitors for individual tenants and no app team has to view the other app teams monitors.
This self service has been a blocker on our side to provide the access to app teams.
Hi @sreekanth3
We are also in need of this feature please do let us know if you find any solution for this issue, we have also enabled the backend roles and created monitors in two different tenants, but no matter what the monitors are visible in both the tenants irrespective of the tenant where they were created.
Thanks & Regards
Navya Goli
Eugene7
September 13, 2024, 7:50am
3
Hi @navyagoli ,
Could you please share the response to the following request in DevTools?
GET _plugins/_security/api/roles/<your-alert-role>
Also, please share the list of roles that your admin user has:
GET _plugins/_security/api/internalusers/<username>
Thank you!
Hi @Eugene7 ,
These are the results for the queries you asked for:
GET _plugins/_security/api/roles/tenant1-role
{
“tenant1-role”: {
“reserved”: false,
“hidden”: false,
“cluster_permissions”: [
“cluster_monitor”,
“cluster:admin/opendistro/alerting/"
],
“index_permissions”: [
{
“index_patterns”: [
" ”
],
“fls”: ,
“masked_fields”: ,
“allowed_actions”: [
“indices_monitor”,
“indices:admin/aliases/get”,
“indices:admin/mappings/get”,
“indices_all”
]
}
],
“tenant_permissions”: [
{
“tenant_patterns”: [
“tenant1”
],
“allowed_actions”: [
“kibana_all_write”
]
}
],
“static”: false
}
}
GET _plugins/_security/api/internalusers/tenant1-user
{
“tenant1-user”: {
“hash”: “”,
“reserved”: false,
“hidden”: false,
“backend_roles”: [
“alerting_full_access”
],
“attributes”: {},
“opendistro_security_roles”: ,
“static”: false
}
}
the same set of permissions and roles are given to tenant2 user as well.
Thanks
Navya Goli
pablo
September 13, 2024, 2:34pm
5
@navyagoli @sreekanth3 According to this GitHub feature request this is a missing and still not implemented feature.
opened 03:28AM - 07 Sep 23 UTC
enhancement
**Is your feature request related to a problem?**
A large organization is most … likely to have multiple administrators for managing cluster resources. For example, `admin_a` and `admin_b` could be responsible for managing indices `index_x`, `index_y` and associated resources such as alerts and monitors. Similarly `admin_a`, `admin_c` could be responsible for `index_z`.
Alerting does not have a concept of ownership, any user with the right permissions can read/delete alerting resources. [#138](https://github.com/opensearch-project/alerting/issues/138) provided some segmentation based on backend roles.
To ease the administrative process, Dashboard tenancy provides a way to group related objects together although such support is only available for Dashboard objects such as visualizations, index patterns. For cluster owned items such as alerting, tenancy separation is not available. For example, in the above scenario, `admin_a` would like to group `index_x` and `index_y` related Information in one tenant and `index_z` in another tenant. Such tenant separation is currently available for items such as index patterns but for plugin objects like monitors.
**What solution would you like?**
Would like the ability to group not only Dashboard objects but Cluster/Plugin/Extension objects (specifically alerting) with tenants/[workspaces](https://github.com/opensearch-project/OpenSearch-Dashboards/issues/4615)
Possible approaches could be to store references to the alerting objects as part of Dashboard tenants or store tenant information as metadata in the alerting object which can then be used later as filter during display.x
**What alternatives have you considered?**
Considered [#138](https://github.com/opensearch-project/alerting/issues/138) but is has few drawbacks. It does not address scenarios such as the one mentioned, requires additional backend roles to be created in some instances and end users need to be aware of backend roles that need to be mapped.
**Do you have any additional context?**
Add any other context or screenshots about the feature request here.
This is a bug reported a week ago.
opened 09:11AM - 06 Sep 24 UTC
bug
untriaged
**Describe the bug**
There is a bug in the Alerting feature of the OpenSearch… Plugin: Although users can be granted the ability to view items on the Alerting monitor or alert pages by assigning them the alerting_read_access_new role (a new role copied from alerting_read_access), the Alerting Items cannot be isolated by Tenant. This means that as long as a user’s role includes alerting_read_access_new, they can see all Alerting Items across the entire system, even if I have added a tenant specific to this user in alerting_read_access_new.
**Expected behavior**
I hope this bug can be fixed in the next version so that user roles can isolate alerting items by tenant.
**OpenSearch Version**
2.15.0
**Dashboards Version**
2.15.0
**Plugins**
Alerting
Reporting
**Host/Environment (please complete the following information):**
- OS: Rocky Linux release 8 (x86_64)
Unfortunately, current Alerting is not a tenant-aware plugin.
Thankyou @pablo for the information .Appreciate it.
1 Like