MON-4477: chore: add permissions on endpointslice to Prometheus Role and use serviceDiscoveryRole: EndpointSlice in ServiceMonitors by machine424 · Pull Request #1305 · openshift/cluster-version-operator

machine424 · 2026-01-23T10:37:31Z

This PR migrates Prometheus service discovery from the deprecated Endpoints API to the EndpointSlices API, by:

Setting serviceDiscoveryRole: EndpointSlice on ServiceMonitors.
Granting Prometheus endpointslices permissions.

We're taking a conservative approach by keeping the existing endpoints permissions alongside the new endpointslices ones. This provides a safety net in case any ServiceMonitors, whether deployed from this repo or from another source, still rely on the same Role and were missed during the migration.

That said, since both resources provide essentially the same data, keeping both isn't meaningfully more permissive from a security standpoint.

These changes target OpenShift 4.22+ and should not be backported to earlier releases.

…rviceDiscoveryRole: EndpointSlice in ServiceMonitors

coderabbitai · 2026-01-23T10:38:02Z

Walkthrough

Updates Prometheus RBAC configuration and service discovery for the cluster-version-operator to support EndpointSlice resources. Adds RBAC permissions for endpointslices in the discovery.k8s.io API group and configures the ServiceMonitor to use EndpointSlice for service discovery.

Changes

Cohort / File(s)	Summary
Cluster-version-operator EndpointSlice configuration `install/0000_90_cluster-version-operator_00_prometheusrole.yaml`, `install/0000_90_cluster-version-operator_02_servicemonitor.yaml`	Adds RBAC rule for endpointslices resource access in discovery.k8s.io API group with get, list, watch verbs. Updates ServiceMonitor to configure Prometheus service discovery to use EndpointSlice.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

machine424 · 2026-01-23T10:39:02Z

/retitle MON-4477: chore: add permissions on endpointslice to Prometheus Role and use serviceDiscoveryRole: EndpointSlice in ServiceMonitors

openshift-ci-robot · 2026-01-23T10:39:11Z

@machine424: This pull request references MON-4477 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-02-09T10:42:26Z

@machine424: This pull request references MON-4477 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.22.0" version, but no target version was set.

Details

In response to this:

This PR migrates Prometheus service discovery from the deprecated Endpoints API to the EndpointSlices API, by:

Setting serviceDiscoveryRole: EndpointSlice on ServiceMonitors.

Granting Prometheus endpointslices permissions.

We're taking a conservative approach by keeping the existing endpoints permissions alongside the new endpointslices ones. This provides a safety net in case any ServiceMonitors, whether deployed from this repo or from another source, still rely on the same Role and were missed during the migration.

That said, since both resources provide essentially the same data, keeping both isn't meaningfully more permissive from a security standpoint.

These changes target OpenShift 4.22+ and should not be backported to earlier releases.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

machine424 · 2026-02-09T19:34:25Z

/retest-required

machine424 · 2026-02-10T10:17:06Z

/retest-required

machine424 · 2026-03-09T10:40:41Z

/verified by existing tests
/jira refresh

openshift-ci-robot · 2026-03-09T10:40:54Z

@machine424: This PR has been marked as verified by existing tests.

Details

In response to this:

/verified by existing tests
/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-03-09T10:40:56Z

@machine424: This pull request references MON-4477 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.22.0" version, but no target version was set.

Details

In response to this:

/verified by existing tests
/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Tai-RedHat · 2026-03-17T03:33:42Z

/retest

simonpasquier · 2026-03-30T07:36:51Z

/lgtm

machine424 · 2026-04-28T07:17:33Z

/retest

wking

Poking around to understand the context here, prometheus-operator/prometheus-operator#6672 -> prometheus-operator/prometheus-operator#3862 -> prometheus/prometheus#6838 -> Kube docs explains the benefits of EndpointSlices for Services backed by many endpoints. That's not this CVO Service though, we just have the one backing endpoint, e.g. in this 4.22.0-rc.1 CI run:

$ curl -s https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/logs/periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-ovn-serial-1of2/2047770526054617088/artifacts/e2e-aws-ovn-serial/gather-extra/artifacts/endpoints.json | jq -r '.items[] | select(.metadata.namespace == "openshift-cluster-version") | {name: .metadata.name, subsets}'
{
  "name": "cluster-version-operator",
  "subsets": [
    {
      "addresses": [
        {
          "ip": "10.0.95.185",
          "nodeName": "ip-10-0-95-185.ec2.internal",
          "targetRef": {
            "kind": "Pod",
            "name": "cluster-version-operator-d747d47c9-zz95q",
            "namespace": "openshift-cluster-version",
            "uid": "0e69c72e-2c44-45bc-b46a-a8008d46271d"
          }
        }
      ],
      "ports": [
        {
          "name": "metrics",
          "port": 9099,
          "protocol": "TCP"
        }
      ]
    }
  ]
}
$ curl -s https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/test-platform-results/logs/periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-ovn-serial-1of2/2047770526054617088/artifacts/e2e-aws-ovn-serial/gather-extra/artifacts/endpointslices.json | jq -r '.items[] | select(.metadata.namespace == "openshift-cluster-version") | {name: .metadata.name, endpoints}'
{
  "name": "cluster-version-operator-l52jj",
  "endpoints": [
    {
      "addresses": [
        "10.0.95.185"
      ],
      "conditions": {
        "ready": true,
        "serving": true,
        "terminating": false
      },
      "nodeName": "ip-10-0-95-185.ec2.internal",
      "targetRef": {
        "kind": "Pod",
        "name": "cluster-version-operator-d747d47c9-zz95q",
        "namespace": "openshift-cluster-version",
        "uid": "0e69c72e-2c44-45bc-b46a-a8008d46271d"
      },
      "zone": "us-east-1c"
    }
  ]
}

However, MON-4477 points out:

Endpoints API is deprecated https://kubernetes.io/blog/2025/04/24/endpoints-deprecation/

And that's a great reason to move off the deprecated-in-Kubernetes-1.33 API, which this pull delivers. OCP 4.22 is based on Kubernetes 1.35, so I'm unclear on why we haven't been getting APIRemovedInNextReleaseInUse alerting since OCP 4.20. Possibly that's because there is no clear plan to remove Endpoints. I opened PI-1510 back in 2022 asking after alert coverage for deprecated APIs, but that ticket's been pretty quiet.

But context aside, looks good to me, thanks! Coverage is well-excercised in pre-merge CI (e.g. TargetDown and ClusterVersionOperatorDown alerting would fail us if we broke CVO monitoring), so no risk of destabilizing other CI or creating QE load:

/lgtm
/label acknowledge-critical-fixes-only

openshift-ci · 2026-04-29T00:04:13Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: machine424, simonpasquier, wking

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [wking]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-merge-bot · 2026-04-29T00:39:00Z

/retest-required

Remaining retests: 0 against base HEAD 39733be and 2 for PR HEAD 9435bf1 in total

simonpasquier · 2026-04-29T07:02:14Z

OCP 4.22 is based on Kubernetes 1.35, so I'm unclear on why we haven't been getting APIRemovedInNextReleaseInUse alerting since OCP 4.20. Possibly that's because there is no clear plan to remove Endpoints.

Correct, the Endpoints API is so ingrained in Kubernetes that it's likely never going to be removed.

openshift-ci · 2026-04-29T08:00:50Z

@machine424: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-agnostic-ovn-techpreview-serial-3of3	`9435bf1`	link	unknown	`/test e2e-agnostic-ovn-techpreview-serial-3of3`
ci/prow/e2e-hypershift-conformance	`9435bf1`	link	unknown	`/test e2e-hypershift-conformance`
ci/prow/e2e-agnostic-ovn-upgrade-out-of-change	`9435bf1`	link	unknown	`/test e2e-agnostic-ovn-upgrade-out-of-change`
ci/prow/e2e-aws-ovn-techpreview	`9435bf1`	link	unknown	`/test e2e-aws-ovn-techpreview`
ci/prow/e2e-agnostic-ovn-upgrade-into-change	`9435bf1`	link	unknown	`/test e2e-agnostic-ovn-upgrade-into-change`
ci/prow/e2e-hypershift	`9435bf1`	link	unknown	`/test e2e-hypershift`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

chore: add permissions on endpointslice to Prometheus Role and use se…

9435bf1

…rviceDiscoveryRole: EndpointSlice in ServiceMonitors

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jan 23, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Mar 9, 2026

openshift-ci Bot assigned simonpasquier Mar 30, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Mar 30, 2026

wking reviewed Apr 29, 2026

View reviewed changes

openshift-ci Bot added the acknowledge-critical-fixes-only Indicates if the issuer of the label is OK with the policy. label Apr 29, 2026

openshift-ci Bot assigned wking Apr 29, 2026

wking approved these changes Apr 29, 2026

View reviewed changes

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 29, 2026

Conversation

machine424 commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Uh oh!

machine424 commented Jan 23, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Jan 23, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Feb 9, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

machine424 commented Feb 9, 2026

Uh oh!

machine424 commented Feb 10, 2026

Uh oh!

machine424 commented Mar 9, 2026

Uh oh!

openshift-ci-robot commented Mar 9, 2026

Uh oh!

openshift-ci-robot commented Mar 9, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Tai-RedHat commented Mar 17, 2026

Uh oh!

simonpasquier commented Mar 30, 2026

Uh oh!

machine424 commented Apr 28, 2026

Uh oh!

wking left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Apr 29, 2026

Uh oh!

openshift-merge-bot Bot commented Apr 29, 2026

Uh oh!

simonpasquier commented Apr 29, 2026

Uh oh!

openshift-ci Bot commented Apr 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

machine424 commented Jan 23, 2026 •

edited

Loading

coderabbitai Bot commented Jan 23, 2026 •

edited

Loading

machine424 commented Jan 23, 2026 •

edited by openshift-ci Bot

Loading

openshift-ci-robot commented Jan 23, 2026 •

edited by openshift-ci Bot

Loading

openshift-ci-robot commented Feb 9, 2026 •

edited by openshift-ci Bot

Loading

openshift-ci-robot commented Mar 9, 2026 •

edited by openshift-ci Bot

Loading