| Summary: | Access forbidden when trying to collect metrics | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Federico Simoncelli <fsimonce> |
| Component: | Hawkular | Assignee: | Matt Wringe <mwringe> |
| Status: | CLOSED NOTABUG | QA Contact: | chunchen <chunchen> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 3.1.0 | CC: | aos-bugs, fsimonce, wsun |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-03-31 15:32:07 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
Federico Simoncelli
2016-03-25 17:15:28 UTC
@Federico which version of metrics are you using and on what version of OpenShift? There is an issue where the OpenShift API interfaces have slightly changed between 3.1 and 3.2, this means that the 3.1 metrics containers will not be able to properly authenticate individual users and will result in a forbidden error message that you are seeing. It does not affect the basic username/password used, only when using the bearer token. This issue has been resolved in the 3.2 images and those should function properly on OSE 3.2 (In reply to Matt Wringe from comment #1) > @Federico which version of metrics are you using and on what version of > OpenShift? The versions were reported in the bug description. Version-Release number of selected component (if applicable): openshift3/metrics-hawkular-metrics:3.1.1 (5c02894a36cd) openshift 1.1.4-0.git.0.9d8230b.el7 Can you see if this command returns 'allowed': true?
curl --insecure -H "Authorization: Bearer $TOKEN" -H "Accept: application/json" -X POST -d '{"kind":"SubjectAccessReview", "resource": "pods", "verb":"list", "namespace":"default"}' https://localhost:8443/oapi/v1/subjectaccessreviews
# curl --insecure -H "Authorization: Bearer $TOKEN" -H "Accept: application/json" -X POST -d '{"kind":"SubjectAccessReview", "resource": "pods", "verb":"list", "namespace":"default"}' https://$HOSTNAME:8443/oapi/v1/subjectaccessreviews
{
"kind": "Status",
"apiVersion": "v1",
"metadata": {},
"status": "Failure",
"message": "Object 'apiVersion' is missing in '{\"kind\":\"SubjectAccessReview\", \"resource\": \"pods\", \"verb\":\"list\", \"namespace\":\"default\"}'",
"reason": "Forbidden",
"details": {
"kind": "subjectaccessreviews"
},
"code": 403
}
# curl --insecure -H "Authorization: Bearer $TOKEN" -H "Accept: application/json" -X POST -d '{"apiVersion":"v1", "kind":"SubjectAccessReview", "resource": "pods", "verb":"list", "namespace":"default"}' https://$HOSTNAME:8443/oapi/v1/subjectaccessreviews
{
"kind": "Status",
"apiVersion": "v1",
"metadata": {},
"status": "Failure",
"message": "the body of the request was in an unknown format - accepted media types include: application/json, application/yaml",
"reason": "UnsupportedMediaType",
"code": 415
}
# curl --insecure -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -H "Accept: application/json" -X POST -d '{"apiVersion":"v1", "kind":"SubjectAccessReview", "resource": "pods", "verb":"list", "namespace":"default"}' https://$HOSTNAME:8443/oapi/v1/subjectaccessreviews
{
"kind": "SubjectAccessReviewResponse",
"apiVersion": "v1",
"namespace": "default",
"allowed": true,
"reason": "allowed by cluster rule"
}
I think you may be missing the apiVersion and the new required Content-Type header in the request.
Are you absolutely sure you are running on OSE 3.1? That is exactly the issue you will be getting if running the 3.1 metric images on OSE 3.2 I can't reproduce with OSE 3.1 Closing as not a bug since its been revealed that this caused by the 3.1 metric images running on 3.2 which is not supported. For running on OSE 3.2 the 3.2 metric images must be used. |