Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 13 additions & 5 deletions bundle/manifests/observability-operator.clusterserviceversion.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ metadata:
categories: Monitoring
certified: "false"
containerImage: observability-operator:1.3.0
createdAt: "2026-01-12T12:49:11Z"
createdAt: "2026-01-12T17:51:44Z"
description: A Go based Kubernetes operator to setup and manage highly available
Monitoring Stack using Prometheus, Alertmanager and Thanos Querier.
operatorframework.io/cluster-monitoring: "true"
Expand Down Expand Up @@ -86,16 +86,24 @@ spec:
kind: ObservabilityInstaller
name: observabilityinstallers.observability.openshift.io
version: v1alpha1
- kind: Perses
- description: Perses is the Schema for the perses API
displayName: Perses
kind: Perses
name: perses.perses.dev
version: v1alpha2
- kind: PersesDashboard
- description: A Perses Dashboard
displayName: Perses Dashboard
kind: PersesDashboard
name: persesdashboards.perses.dev
version: v1alpha2
- kind: PersesDatasource
- description: A Perses Datasource
displayName: Perses Datasource
kind: PersesDatasource
name: persesdatasources.perses.dev
version: v1alpha2
- kind: PersesGlobalDatasource
- description: A Perses GlobalDatasource
displayName: Perses GlobalDatasource
kind: PersesGlobalDatasource
name: persesglobaldatasources.perses.dev
version: v1alpha2
- description: PodMonitor defines monitoring for a set of pods
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
creationTimestamp: null
labels:
app.kubernetes.io/component: rbac
app.kubernetes.io/created-by: perses-operator
app.kubernetes.io/instance: persesglobaldatasource-editor-role
app.kubernetes.io/name: clusterrole
app.kubernetes.io/part-of: perses-operator
name: persesglobaldatasource-editor-role
rules:
- apiGroups:
- perses.dev
resources:
- persesglobaldatasources
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- perses.dev
resources:
- persesglobaldatasources/status
verbs:
- get
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
creationTimestamp: null
labels:
app.kubernetes.io/component: rbac
app.kubernetes.io/created-by: perses-operator
app.kubernetes.io/instance: persesglobaldatasource-viewer-role
app.kubernetes.io/name: clusterrole
app.kubernetes.io/part-of: perses-operator
name: persesglobaldatasource-viewer-role
rules:
- apiGroups:
- perses.dev
resources:
- persesglobaldatasources
verbs:
- get
- list
- watch
- apiGroups:
- perses.dev
resources:
- persesglobaldatasources/status
verbs:
- get
Original file line number Diff line number Diff line change
Expand Up @@ -136,17 +136,22 @@ spec:
displayName: Perses
kind: Perses
name: perses.perses.dev
version: v1alpha1
version: v1alpha2
- description: A Perses Dashboard
displayName: Perses Dashboard
kind: PersesDashboard
name: persesdashboards.perses.dev
version: v1alpha1
version: v1alpha2
- description: A Perses Datasource
displayName: Perses Datasource
kind: PersesDatasource
name: persesdatasources.perses.dev
version: v1alpha1
version: v1alpha2
- description: A Perses GlobalDatasource
displayName: Perses GlobalDatasource
kind: PersesGlobalDatasource
name: persesglobaldatasources.perses.dev
version: v1alpha2
description: >+

Observability Operator is a Go based Kubernetes operator to setup and
Expand Down
2 changes: 2 additions & 0 deletions deploy/perses/kustomization.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -12,4 +12,6 @@ resources:
- persesdashboard_viewer_role.yaml
- persesdatasource_editor_role.yaml
- persesdatasource_viewer_role.yaml
- persesglobaldatasource_editor_role.yaml
- persesglobaldatasource_viewer_role.yaml
- perses-service-account.yaml
2 changes: 2 additions & 0 deletions docs/user-guides/observability-ui-plugins.md
Original file line number Diff line number Diff line change
Expand Up @@ -162,6 +162,8 @@ The Cluster Observability Operator creates the following roles:
- `persesdashboard-viewer-role` - ability to read `PersesDashboard` Custom Resources under the PersesDashboards tab, and view Perses dashboards presentation in Dashboards (Perses).
- `persesdatasource-editor-role` - ability to create, read, update and delete `PersesDatasource` Custom Resources under the PersesDatasources tab, and view Perses dashboards with data being loaded from Perses datasource in Dashboards (Perses).
- `persesdatasource-viewer-role` - ability to read `PersesDatasource` Custom Resources under the PersesDatasources tab, and view Perses dashboards with data being loaded from Perses datasource in Dashboards (Perses).
- `persesglobaldatasource-editor-role` - ability to create, read, update and delete `PersesGlobalDatasource` Custom Resources under the PersesGlobalDatasources tab, and view Perses dashboards with data being loaded from Perses GlobalDatasource in Dashboards (Perses).
- `persesglobaldatasource-viewer-role` - ability to read `PersesGlobalDatasource` Custom Resources under the PersesGlobalDatasources tab, and view Perses dashboards with data being loaded from Perses GlobalDatasource in Dashboards (Perses).

When assigned via `ClusterRoleBinding`, a user has access to all Perses dashboards and datasources in all namespaces/projects. When assigned via `RoleBinding`, user has access to all Perses dashboards and datasources in the given namespace/project.

Expand Down
8 changes: 5 additions & 3 deletions docs/user-guides/perses-dashboards.md
Original file line number Diff line number Diff line change
Expand Up @@ -37,9 +37,9 @@ To verify the installation
kubectl wait --for=condition=Available --timeout=10s uiplugins monitoring
```

If you open the OpenShift console, you should see the new `Observe > Dashboards (Perses)` menu. Once `PersesDashboard` and `PersesDatasource` resources are created and the appropriate RBAC permissions are granted, a namespace selector will be available to show dashboards by the namespace(s) where the user has been granted RBAC permissions.
If you open the OpenShift console, you should see the new `Observe > Dashboards (Perses)` menu. Once `PersesDashboard`, `PersesDatasource`, and `PersesGlobalDatasource` resources are created and the appropriate RBAC permissions are granted, a namespace selector will be available to show dashboards by the namespace(s) where the user has been granted RBAC permissions.

Once the Monitoring UI Plugin is installed with Perses enabled, the Cluster Observability Operator deploys the [Perses Operator](https://github.com/perses/perses-operator), which is responsible for managing Perses dashboards and datasources. The COO also installs the `PersesDashboard` and `PersesDatasource` Custom Resources Definitions (CRDs). These CRDs are namespaced-scoped which allows to setup RBAC policies for them using the standard Kubernetes RBAC model.
Once the Monitoring UI Plugin is installed with Perses enabled, the Cluster Observability Operator deploys the [Perses Operator](https://github.com/perses/perses-operator), which is responsible for managing Perses dashboards and datasources. The COO also installs the `PersesDashboard`, `PersesDatasource` and `PersesGlobalDatasource` Custom Resources Definitions (CRDs). These CRDs are namespaced-scoped which allows to setup RBAC policies for them using the standard Kubernetes RBAC model.

Please refer to the [Monitoring UI Plugin](https://github.com/rhobs/observability-operator/blob/main/docs/user-guides/observability-ui-plugins.md#plugin-creation-4) documentation for more details.

Expand Down Expand Up @@ -215,6 +215,8 @@ The Perses operator creates the following `ClusterRole`s for datasources and das
- `persesdashboard-viewer-role`
- `persesdatasource-editor-role`
- `persesdatasource-viewer-role`
- `persesglobaldatasource-editor-role`
- `persesglobaldatasource-viewer-role`

The following `RoleBinding`s illustrate how to allow `user1` to view all dashboards in the `my-namespace` namespace:

Expand Down Expand Up @@ -248,4 +250,4 @@ roleRef:
name: persesdatasource-viewer-role
```

Provided that `PersesDashboard` and `PersesDatasource` resources are created and that the appropriate RBAC permissions are granted, users can go to the `Observe > Dashboards (Perses)` menu and use the namespace selector to visualize dashboards to which they have access to.
Provided that `PersesDashboard`, `PersesDatasource`, and `PersesGlobalDatasource` resources are created and that the appropriate RBAC permissions are granted, users can go to the `Observe > Dashboards (Perses)` menu and use the namespace selector to visualize dashboards to which they have access to.
2 changes: 1 addition & 1 deletion pkg/controllers/uiplugin/monitoring.go
Original file line number Diff line number Diff line change
Expand Up @@ -394,7 +394,7 @@ func newPersesClusterRole() *rbacv1.ClusterRole {
},
{
APIGroups: []string{"perses.dev"},
Resources: []string{"persesdashboards", "persesdatasources"},
Resources: []string{"persesdashboards", "persesdatasources", "persesglobaldatasources"},
Verbs: []string{"get", "list", "watch", "create", "update", "delete", "patch"},
},
{
Expand Down
Loading