Bug 1538954

Summary: Meet error 'cannot get path "/swagger-2.0.0.pb-v1"' when run v3.9 `oc explain` resource against old server
Product: OpenShift Container Platform Reporter: Xingxing Xia <xxia>
Component: ocAssignee: Juan Vallejo <jvallejo>
Status: CLOSED ERRATA QA Contact: Xingxing Xia <xxia>
Severity: medium Docs Contact:
Priority: medium    
Version: 3.9.0CC: aos-bugs, jokerman, mmccomas
Target Milestone: ---   
Target Release: 3.7.z   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-04-05 09:36:18 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Xingxing Xia 2018-01-26 08:52:56 UTC 
Description of problem:
Meet error 'cannot get path "/swagger-2.0.0.pb-v1"' when run v3.9 `oc explain` resource against old server (e.g. v3.7). Other oc command does not replicate this.
It is not met when using oc v3.9 against openshift v3.9, or v3.7 against v3.7

Version-Release number of selected component (if applicable):
oc v3.9.0-0.24.0 against openshift v3.7.26

How reproducible:
Always

Steps to Reproduce:
1. Use oc v3.9 login v3.7 server
2. Run v3.9 `oc explain pod`
Error from server (Forbidden): User "xxia" cannot get path "/swagger-2.0.0.pb-v1": User "xxia" cannot "get" on "/swagger-2.0.0.pb-v1"

Actual results:
2. More log info:
$ oc explain pod --loglevel 6
I0126 16:24:35.047529    1714 round_trippers.go:436] GET https://MASTER:8443/swagger-2.0.0.pb-v1 403 Forbidden in 1013 milliseconds
I0126 16:24:35.048949    1714 helpers.go:201] server response object: [{
  "metadata": {},
  "status": "Failure",
  "message": "User \"xxia\" cannot get path \"/swagger-2.0.0.pb-v1\": User \"xxia\" cannot \"get\" on \"/swagger-2.0.0.pb-v1\"",
  "reason": "Forbidden",
  "details": {
    "causes": [
      {
        "reason": "UnexpectedServerResponse",
        "message": "User \"xxia\" cannot get path \"/swagger-2.0.0.pb-v1\": User \"xxia\" cannot \"get\" on \"/swagger-2.0.0.pb-v1\""
      }
    ]
  },
  "code": 403
}]
F0126 16:24:35.052265    1714 helpers.go:119] Error from server (Forbidden): User "xxia" cannot get path "/swagger-2.0.0.pb-v1": User "xxia" cannot "get" on "/swagger-2.0.0.pb-v1"

Expected results:
2. Command should work

Additional info:
Comment 1 Juan Vallejo 2018-01-26 18:46:55 UTC 
Pick into 3.7 branch: https://github.com/openshift/origin/pull/18309
Comment 2 Xingxing Xia 2018-01-30 07:51:02 UTC 
Waiting for 3.7 new puddle that will include the PR
Comment 4 Xingxing Xia 2018-02-06 12:10:44 UTC 
New 3.7 version v3.7.28 is built. Tested with oc 3.9 against v3.7.28 server, the bug is fixed, so moving it to VERIFIED:
$ oc version
oc v3.9.0-0.38.0
kubernetes v1.9.1+a0ce1bc657
features: Basic-Auth GSSAPI Kerberos SPNEGO

Server https://$MASTER:8443
openshift v3.7.28
kubernetes v1.7.6+a08f5eeb62

$ oc explain po
DESCRIPTION:
     Pod is a collection of containers that can run on a host. This resource is
     created by clients and scheduled onto hosts.

FIELDS:
...
Comment 8 errata-xmlrpc 2018-04-05 09:36:18 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0636