Using a token from a serviceAccount granted to get application logs failing with not permission in RHOL
Issue
- Not able to access to the application logs stored in the Red Hat Managed LokiStack with the token from a
serviceAccountwith cluster-wide access granted through theclusterRole: cluster-logging-application-view - Not able to get application logs using the Loki route using a
serviceAccounttoken as received an error that "You don't have permission to access this tenant". When querying to the "infrastructure" or "audit" logs, the query is successful -
When trying to access to the application logs from the Red Hat Managed Log Store LokiStack through the Loki route using a
serviceAccountan error that not having permission is received:'{log_type="application",kubernetes_namespace_name="lokitest"}' 2025/03/20 18:55:42 https://<route>/api/logs/v1/application/loki/api/v1/query_range?direction=BACKWARD&end=1742515140000000000&limit=30&query=%7Blog_type%3D%22application%22%2Ckubernetes_namespace_name%3D%22lokitest%22%7D&start=1742428800000000000&step=3600 2025/03/20 18:55:43 Error response from server: {"error":"You don't have permission to access this tenant","errorType":"observatorium-api","status":"error"} (<nil>) attempts remaining: 0 2025/03/20 18:55:43 Query failed: run out of attempts while querying the server
Environment
- Red Hat OpenShift Container Platform (RHOCP)
- 4
- Red Hat OpenShift Logging (RHOL)
- 5
- 6
- LokiStack
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.