Bug 1344877

Summary:	The --api-prefix option of oc proxy gives not correct example
Product:	OKD	Reporter:	Xingxing Xia <xxia>
Component:	oc	Assignee:	Fabiano Franz <ffranz>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Xingxing Xia <xxia>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	3.x	CC:	aos-bugs, mmccomas
Target Milestone:	---	Keywords:	Reopened
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-09-19 13:49:20 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Xingxing Xia 2016-06-12 05:34:03 UTC

Description of problem:
The --api-prefix of oc proxy doesn't work per the example in 'oc proxy -h'

Version-Release number of selected component (if applicable):
oc v1.3.0-alpha.1-251-ga19279f
kubernetes v1.3.0-alpha.1-331-g0522e63

How reproducible:
Always

Steps to Reproduce:
1. oc login, create project xxia-proj, create pods.
2. Run oc proxy with --api-prefix
$ oc proxy --port=8011 --api-prefix=k8s-api 
3. Open another terminal:
$ curl -H "Authorization: Bearer <token>" 127.0.0.1:8011/k8s-api/v1/namespaces/xxia-proj/pods/

Actual results:
3.
404 page not found

Expected results:
3. Should succeed. Because the 'oc proxy -h' shows "This makes e.g. the pods api available at localhost:8011/k8s-api/..."

Additional info:
If step 2 runs without --api-prefix=k8s-api, step 3 succeeds:
$ curl -H "Authorization: Bearer <token>" 127.0.0.1:8011/api/v1/namespaces/xxia-proj/pods/

Comment 1 Avesh Agarwal 2016-06-20 17:30:52 UTC

I can reproduce it on latest kubernetes code base.

Comment 2 Avesh Agarwal 2016-06-21 16:58:16 UTC

I did some investigation and I found that it is working as expected.

The correct way to curl is :

curl -H "Authorization: Bearer <token>" 127.0.0.1:8011/k8s-api/api/v1/namespaces/xxia-proj/pods/

Please note this is: 127.0.0.1:8011/k8s-api/api/v1/...   not 127.0.0.1:8011/k8s-api/v1/

k8s-api is not a substitute for api, it is a prefix for /api/... .


And this is evident from kubectl proxy --help:

To proxy the entire kubernetes api at a different root, use:

kubectl proxy --api-prefix=/custom/

The above lets you 'curl localhost:8001/custom/api/v1/pods

I am closing this as not a bug.

Comment 3 Xingxing Xia 2016-06-22 02:40:39 UTC

Thanks! `kubectl proxy --help` examples are more detailed, clearer and updated (its example uses .../v1/... rather than .../v1beta3/...). It is good tips to understand oc usage by examining kubectl help info.

BTW, `oc proxy -h` says "localhost:8011/k8s-api/v1beta3/pods/" and "--api-prefix=k8s-api". This is not correct too. We must give "/", like "--api-prefix=/k8s-api" (the 2nd '/' is optional, that is, "--api-prefix=/k8s-api/" is also ok). See the comparison:

Test 1:
oc proxy --port=8011 --api-prefix=k8s-api  # No the 1st '/'
Starting to serve on 127.0.0.1:8011

On another terminal:
curl -H "Authorization: Bearer <token>" 127.0.0.1:8011/k8s-api/api/v1/namespaces/xxia-proj/pods/
404 page not found

curl -H "Authorization: Bearer <token>" 127.0.0.1:8011/k8s-api/api/v1/pods/
404 page not found

Test 2:
oc proxy --port=8011 --api-prefix=/k8s-api # Give the 1st '/'
Starting to serve on 127.0.0.1:8011

On another terminal:
curl -H "Authorization: Bearer <token>" 127.0.0.1:8011/k8s-api/api/v1/namespaces/xxia-proj/pods/  # Succeed and return json content of pods


curl -H "Authorization: Bearer <token>" 127.0.0.1:8011/k8s-api/api/v1/pods/  # Succeed and return json content of pods in all namespaces (if the <token> belongs to a cluster-admin user)

So I'd like to convert the bug to CLI help info bug.

Comment 4 Fabiano Franz 2016-06-22 21:13:14 UTC

CLI help fixed in https://github.com/openshift/origin/pull/9493.

Comment 5 Xingxing Xia 2016-06-23 09:02:29 UTC

Verified with:
oc v1.3.0-alpha.2-164-g24dcd13
kubernetes v1.3.0-alpha.3-599-g2746284