Skip to content

fix(webhook): check probes and scrapeconfigs RBAC only when CRDs exist#5011

Draft
u-kai wants to merge 2 commits into
open-telemetry:mainfrom
u-kai:fix/issue-4456
Draft

fix(webhook): check probes and scrapeconfigs RBAC only when CRDs exist#5011
u-kai wants to merge 2 commits into
open-telemetry:mainfrom
u-kai:fix/issue-4456

Conversation

@u-kai
Copy link
Copy Markdown

@u-kai u-kai commented Apr 29, 2026

Description:

The webhook RBAC check for PrometheusCR only warned about servicemonitors and podmonitors,
missing probes and scrapeconfigs.

Also, warnings were emitted even when prometheus-operator was not installed in the cluster.

This fix dynamically discovers which monitoring.coreos.com CRDs exist in the cluster via the
discovery API, and only includes those in the RBAC check.

Clusters without prometheus-operator installed will no longer receive false-positive warnings.

Link to tracking Issue(s):

Testing:
Updated unit tests in targetallocator_webhook_test.go and collector_webhook_test.go to cover the new dynamic CRD discovery behavior, including a case where no prometheus-operator CRDs are installed (zero warnings expected).

Documentation:

(open-telemetry#4456)

Signed-off-by: u-kai <76635578+u-kai@users.noreply.github.com>
@swiatekm
Copy link
Copy Markdown
Contributor

Rather than doing this in the webhook, detecting these should be a part of the autodetect package. Right now we store a PrometheusCRAvailable boolean value in the config, whereas it should be a list of the available CRDs. Then the webhook would just pull it from the config. This may require some refactoring along the way.

Signed-off-by: u-kai <76635578+u-kai@users.noreply.github.com>
@u-kai
Copy link
Copy Markdown
Author

u-kai commented May 3, 2026

@swiatekm
Thanks for the comment!
I've fixed the code following your advice.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Incomplete RBAC validation for target allocator scrapeconfigs and probes permissions

2 participants