Using a token from a serviceAccount granted to get application logs failing with not permission in RHOL

Solution Verified - Updated -

Issue

  • Not able to access to the application logs stored in the Red Hat Managed LokiStack with the token from a serviceAccount with cluster-wide access granted through the clusterRole: cluster-logging-application-view
  • Not able to get application logs using the Loki route using a serviceAccount token as received an error that "You don't have permission to access this tenant". When querying to the "infrastructure" or "audit" logs, the query is successful
  • When trying to access to the application logs from the Red Hat Managed Log Store LokiStack through the Loki route using a serviceAccount an error that not having permission is received:

    '{log_type="application",kubernetes_namespace_name="lokitest"}' 2025/03/20 18:55:42 https://<route>/api/logs/v1/application/loki/api/v1/query_range?direction=BACKWARD&end=1742515140000000000&limit=30&query=%7Blog_type%3D%22application%22%2Ckubernetes_namespace_name%3D%22lokitest%22%7D&start=1742428800000000000&step=3600 2025/03/20 18:55:43 Error response from server: {"error":"You don't have permission to access this tenant","errorType":"observatorium-api","status":"error"}  (<nil>) attempts remaining: 0 2025/03/20 18:55:43 Query failed: run out of attempts while querying the server
    

Environment

  • Red Hat OpenShift Container Platform (RHOCP)
    • 4
  • Red Hat OpenShift Logging (RHOL)
    • 5
    • 6
  • LokiStack

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content