Bug 2040654

Summary:	'oc adm must-gather -- some_script' should exit with same non-zero code as the failed 'some_script' exits
Product:	OpenShift Container Platform	Reporter:	Xingxing Xia <xxia>
Component:	oc	Assignee:	Arda Guclu <aguclu>
oc sub component:	oc	QA Contact:	zhou ying <yinzhou>
Status:	CLOSED ERRATA	Docs Contact:
Severity:	medium
Priority:	medium	CC:	aos-bugs, mfojtik
Version:	4.10
Target Milestone:	---
Target Release:	4.11.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-08-10 10:42:31 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Xingxing Xia 2022-01-14 11:18:37 UTC

Description of problem:
'oc adm must-gather -- some_script' should exit with same non-zero code as the failed 'some_script' exits. It should be like 'oc rsh', 'oc rsh POD some_script' exits with same exit code as 'some_script'.

Version-Release number of selected component (if applicable):
$ oc version
Client Version: 4.10.0-202201122238.p0.gda3f635.assembly.stream-da3f635

How reproducible:
Always

Steps to Reproduce:
1. $ oc adm must-gather -- /usr/bin/gather_audit_logs
...
[must-gather-l696h] POD 2022-01-14T10:05:18.217810996Z ERROR: To raise a Red Hat support request, it is required to set the top level audit policy to 
...
[must-gather-l696h] POD 2022-01-14T10:05:18.217810996Z        ... Try 'oc edit apiservers' and set 'spec.audit.profile' back to
[must-gather-l696h] POD 2022-01-14T10:05:18.217810996Z        "Default" ...
...

$ echo $?
0

As per https://github.com/openshift/enhancements/blob/master/enhancements/kube-apiserver/audit-policy.md says:
"
the command will return with an error (non-zero exit code)
"

'/usr/bin/gather_audit_logs' indeed exits with 1, but the whole 'oc adm must-gather -- /usr/bin/gather_audit_logs' exits with 0.

2. Try other test:
$ oc adm must-gather -- invalid_script
$ echo $?
0

Actual results:
The whole command 'oc adm must-gather -- some_script' always exits with 0, even if the 'some_script' exits non-zero code.

Expected results:
The whole command 'oc adm must-gather -- some_script' should exit with same code as 'some_script'.


Additional info:
Checked/confirmed with Dev in Slack, so filing this bug.

Comment 2 zhou ying 2022-05-31 08:52:55 UTC

[root@localhost home]# oc adm must-gather -- invalid_script
[must-gather      ] OUT Using must-gather plug-in image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:2fce3fe73a0c94d396f2162d4db64c02fca64238fc0642aca03c6f302df4e916
When opening a support case, bugzilla, or issue please include the following summary data along with any other requested information:
ClusterID: ebd965f8-f9db-4b4f-b630-b43fd928748b
ClusterVersion: Stable at "4.11.0-0.nightly-2022-05-25-193227"
ClusterOperators:
	clusteroperator/kube-apiserver is not upgradeable because FeatureGatesUpgradeable: "TechPreviewNoUpgrade" does not allow updates


[must-gather      ] OUT namespace/openshift-must-gather-hdqjl created
[must-gather      ] OUT clusterrolebinding.rbac.authorization.k8s.io/must-gather-rfp4p created
Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (containers "gather", "copy" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "gather", "copy" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or containers "gather", "copy" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "gather", "copy" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
[must-gather      ] OUT pod for plug-in image quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:2fce3fe73a0c94d396f2162d4db64c02fca64238fc0642aca03c6f302df4e916 created
[must-gather-brfqk] POD 2022-05-31T08:41:47.512178191Z /bin/bash: invalid_script: command not found
[must-gather-brfqk] OUT waiting for gather to complete
[must-gather-brfqk] OUT downloading gather output
[must-gather-brfqk] OUT receiving incremental file list
[must-gather-brfqk] OUT ./
[must-gather-brfqk] OUT 
[must-gather-brfqk] OUT sent 27 bytes  received 40 bytes  19.14 bytes/sec
[must-gather-brfqk] OUT total size is 0  speedup is 0.00
[must-gather      ] OUT namespace/openshift-must-gather-hdqjl deleted
[must-gather      ] OUT clusterrolebinding.rbac.authorization.k8s.io/must-gather-rfp4p deleted


Reprinting Cluster State:
When opening a support case, bugzilla, or issue please include the following summary data along with any other requested information:
ClusterID: ebd965f8-f9db-4b4f-b630-b43fd928748b
ClusterVersion: Stable at "4.11.0-0.nightly-2022-05-25-193227"
ClusterOperators:
	clusteroperator/kube-apiserver is not upgradeable because FeatureGatesUpgradeable: "TechPreviewNoUpgrade" does not allow updates


[root@localhost home]# echo $?
0



oc version --client -o yaml 
clientVersion:
  buildDate: "2022-05-25T15:55:27Z"
  compiler: gc
  gitCommit: 1e9c2f992e8dc18985d789ad4094af685f42d2db
  gitTreeState: clean
  gitVersion: 4.11.0-202205251441.p0.g1e9c2f9.assembly.stream-1e9c2f9
  goVersion: go1.18
  major: ""
  minor: ""
  platform: linux/amd64
kustomizeVersion: v4.5.4
releaseClientVersion: 4.11.0-0.nightly-2022-05-26-013101

git log 1e9c2f992e8dc18985d789ad4094af685f42d2db 
commit 1e9c2f992e8dc18985d789ad4094af685f42d2db
Merge: 2e3d4acc9 99913a6cb
Author: OpenShift Merge Robot <openshift-merge-robot.github.com>
Date:   Wed May 25 07:30:46 2022 -0400

    Merge pull request #1150 from ardaguclu/bug-2040654
    
    Bug 2040654: Pass pod exit error codes to user

Comment 3 Arda Guclu 2022-05-31 09:37:27 UTC

Hi, 

Attached PR to this bug does not handle cases where script is not found like tested in here;

oc adm must-gather -- invalid_script

instead it mirrors the exit code when script is valid and returns some exit code other than 0.

For example, I tested with this;

oc adm must-gather -- exit 123
echo $?
123

Comment 5 zhou ying 2022-07-04 09:58:15 UTC

Refer https://bugzilla.redhat.com/show_bug.cgi?id=2040654#c3, move this to verified status.

Comment 7 errata-xmlrpc 2022-08-10 10:42:31 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: OpenShift Container Platform 4.11.0 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:5069