Added permissions to resources for metrics exporter

[aruniiird]

Remove an accidental role permissions added to prometheus.
Add the same (missing) permissions to metrics exporter.

A minor code refactor to optimize role/rolebinding addition to metrics exporter
and a minor bug fix

[aruniiird]

@umangachapagain , we are not seeing any *v1.StorageClass errors anymore.
Fixing other permission issues as seen in the ocs-metrics-exporter logs.
Please take a look.

[aruniiird]

Still seeing error messages, like the following,

failed to get PVC appset1/busybox-pvc: persistentvolumeclaims "busybox-pvc" is forbidden:
User "system:serviceaccount:openshift-storage:ocs-metrics-exporter" cannot get resource "persistentvolumeclaims" in API group "" in the namespace "appset1"

This is an expected error message, as we are granting ocs-metrics-exporter permissions to watch only the namespace it is currently deployed (here it is openshift-storage).

Question here is, above error message popped up in a MCO cluster and is this an expected behavior in this type of scenario?

[umangachapagain]

Still seeing error messages, like the following,

failed to get PVC appset1/busybox-pvc: persistentvolumeclaims "busybox-pvc" is forbidden:
User "system:serviceaccount:openshift-storage:ocs-metrics-exporter" cannot get resource "persistentvolumeclaims" in API group "" in the namespace "appset1"

This is an expected error message, as we are granting ocs-metrics-exporter permissions to watch only the namespace it is currently deployed (here it is openshift-storage).

This shouldn't happen. There's a bug somewhere.

Question here is, above error message popped up in a MCO cluster and is this an expected behavior in this type of scenario?

Not expected in any case. It's a bug.

[aruniiird]

Still seeing error messages, like the following,

failed to get PVC appset1/busybox-pvc: persistentvolumeclaims "busybox-pvc" is forbidden:
User "system:serviceaccount:openshift-storage:ocs-metrics-exporter" cannot get resource "persistentvolumeclaims" in API group "" in the namespace "appset1"

This is an expected error message, as we are granting ocs-metrics-exporter permissions to watch only the namespace it is currently deployed (here it is openshift-storage).

This shouldn't happen. There's a bug somewhere.

Question here is, above error message popped up in a MCO cluster and is this an expected behavior in this type of scenario?

Not expected in any case. It's a bug.

Currently unable to repro the error. Raised a separate issue #2327 to track this

Attaching the current metrics exporter log

ocs-metrics-exporter.logs.tar.gz

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aruniiird, umangachapagain

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [umangachapagain]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[agarwal-mudit]

/cherry-pick release-4.15

[openshift-cherrypick-robot]

@agarwal-mudit: new pull request could not be created: failed to create pull request against red-hat-storage/ocs-operator#release-4.15 from head openshift-cherrypick-robot:cherry-pick-2322-to-release-4.15: status code 422 not one of [201], body: {"message":"Validation Failed","errors":[{"resource":"PullRequest","code":"custom","message":"No commits between red-hat-storage:release-4.15 and openshift-cherrypick-robot:cherry-pick-2322-to-release-4.15"}],"documentation_url":"https://docs.github.com/rest/pulls/pulls#create-a-pull-request"}

In response to this:

/cherry-pick release-4.15

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.