Bug 1253736

Summary:	oc process doesn't handle namespace correctly
Product:	OKD	Reporter:	Ben Parees <bparees>
Component:	oc	Assignee:	Michal Fojtik <mfojtik>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Yan Du <yadu>
Severity:	low	Docs Contact:
Priority:	unspecified
Version:	3.x	CC:	deads, dmcphers, ffranz, jliggitt, knakayam, libra-bugs, mmccomas, wsun, xxia
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-05-12 17:15:28 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ben Parees 2015-08-14 14:15:19 UTC

Description of problem:
Running "oc process sometemplate -n openshift" as a normal user fails.  The user has view access to openshift (needed to view the "sometemplate") but the process command also attempts to create the processed template in that namespace, which fails.



Version-Release number of selected component (if applicable):


How reproducible:
every time

Steps to Reproduce:
1. start openshift
2. register some template in the openshift namespace using cluster-admin
3. oc login as a normal user
4. oc process sometemplate -n openshift


Actual results:
error processing the template "rails-postgresql-example": User "test-admin" cannot create processedtemplates in project "openshift"

Expected results:
the processed template results should be returned to the user so they could potentially pipe the output to | oc create -f -

Comment 1 Jordan Liggitt 2015-08-14 14:17:49 UTC

Right now, the namespace where the template is submitted for processing doesn't matter, but we're discussing things that will make it significant (like a generator that produces the name of the processing namespace).

Normal users probably shouldn't be processing their templates against the openshift namespace

Comment 2 Ben Parees 2015-08-14 14:25:48 UTC

yeah but how do they locate the template then?  the problem here is the -n is being overloaded.

it means both:
1) the template i want to process is in the openshift namespace
and
2) do something else in the openshift namespace which i'm not clear about (whatever this "processedtemplates" resource is)

so if we want to do what you're describing we need two different arguments...one for where to get the namespace from, and one for what namespace to use for "context" when processing it.

Comment 3 Ben Parees 2015-08-20 15:22:29 UTC

see also:
https://github.com/openshift/origin/issues/3307

Comment 4 Fabiano Franz 2016-01-08 19:17:49 UTC

This is fixed in master, but note that the syntax for specifying the source namespace for process is not through -n but

namespace/resource/name

So for example

'oc process openshift/template/sometemplate'

or, with implicit resource kind,

'oc process openshift//sometemplate'

Comment 5 Wei Sun 2016-01-11 03:31:20 UTC

Verified this bug in devenv-rhel7_3110

Result:
# oc process openshift//ruby-helloworld-sample | oc create -f -
service "frontend" created
route "route-edge" created
imagestream "origin-ruby-sample" created
imagestream "ruby-22-centos7" created
buildconfig "ruby-sample-build" created
deploymentconfig "frontend" created
service "database" created
deploymentconfig "database" created


# oc process openshift/template/ruby-helloworld-sample | oc create -f -
service "frontend" created
route "route-edge" created
imagestream "origin-ruby-sample" created
imagestream "ruby-22-centos7" created
buildconfig "ruby-sample-build" created
deploymentconfig "frontend" created
service "database" created
deploymentconfig "database" created