Bug 2047927
| Summary: | 'oc get project' caused 'Observed a panic: cannot deep copy core.NamespacePhase' when AllRequestBodies is used | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Abu Kashem <akashem> |
| Component: | openshift-apiserver | Assignee: | Abu Kashem <akashem> |
| Status: | CLOSED ERRATA | QA Contact: | Rahul Gangwar <rgangwar> |
| Severity: | urgent | Docs Contact: | |
| Priority: | urgent | ||
| Version: | 4.10 | CC: | akashem, aos-bugs, mfojtik, rgangwar, wlewis, xxia |
| Target Milestone: | --- | Keywords: | Regression |
| Target Release: | 4.10.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 2047335 | Environment: | |
| Last Closed: | 2022-03-10 16:42:52 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2047335 | ||
| Bug Blocks: | |||
|
Description
Abu Kashem
2022-01-28 21:24:03 UTC
> oc get projects will panic if audit policy is set to AllRequestBodies
It should be a blocker+ for 4.10
xxia, can you verify that every openshift API works as expected (no panic) xxia, can you confirm that `oc get scc` also causes a panic with the current build? oc get clusterversion
NAME VERSION AVAILABLE PROGRESSING SINCE STATUS
version 4.10.0-0.ci-2022-02-01-092557 True False 16m Cluster version is 4.10.0-0.ci-2022-02-01-092557
[rgangwar@preserver-workloadrhel-1 ~]$ oc get pod -n openshift-kube-apiserver -l apiserver --show-labels
NAME READY STATUS RESTARTS AGE LABELS
kube-apiserver-rgangwar-01de2-dt8bf-master-0.c.openshift-qe.internal 5/5 Running 0 21m apiserver=true,app=openshift-kube-apiserver,revision=5
kube-apiserver-rgangwar-01de2-dt8bf-master-1.c.openshift-qe.internal 5/5 Running 0 18m apiserver=true,app=openshift-kube-apiserver,revision=5
kube-apiserver-rgangwar-01de2-dt8bf-master-2.c.openshift-qe.internal 5/5 Running 0 20m apiserver=true,app=openshift-kube-apiserver,revision=5
[rgangwar@preserver-workloadrhel-1 ~]$ oc edit apiserver/cluster
apiserver.config.openshift.io/cluster edited
oc get pod -n openshift-kube-apiserver -l apiserver --show-labels
NAME READY STATUS RESTARTS AGE LABELS
kube-apiserver-rgangwar-01de2-dt8bf-master-0.c.openshift-qe.internal 5/5 Running 0 3m42s apiserver=true,app=openshift-kube-apiserver,revision=6
kube-apiserver-rgangwar-01de2-dt8bf-master-1.c.openshift-qe.internal 5/5 Running 0 5m56s apiserver=true,app=openshift-kube-apiserver,revision=6
kube-apiserver-rgangwar-01de2-dt8bf-master-2.c.openshift-qe.internal 5/5 Running 0 86s apiserver=true,app=openshift-kube-apiserver,revision=6
oc get apiserver/cluster -o yaml
apiVersion: config.openshift.io/v1
kind: APIServer
metadata:
annotations:
include.release.openshift.io/ibm-cloud-managed: "true"
include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"
oauth-apiserver.openshift.io/secure-token-storage: "true"
release.openshift.io/create-only: "true"
creationTimestamp: "2022-02-01T11:52:32Z"
generation: 2
name: cluster
ownerReferences:
- apiVersion: config.openshift.io/v1
kind: ClusterVersion
name: version
uid: 0dde0018-5415-4e3b-8c61-5a3371429bff
resourceVersion: "33779"
uid: 14d90180-42fd-420d-bcf4-b3a22eb74ac1
spec:
audit:
profile: AllRequestBodies
oc get project default
NAME DISPLAY NAME STATUS
default Active
[rgangwar@preserver-workloadrhel-1 ~]$ oc get projects
NAME DISPLAY NAME STATUS
default Active
kube-node-lease Active
moving it back to assigned since we found two more cases of panic with SCC and Templates - once the master PR https://github.com/openshift/openshift-apiserver/pull/275 merges we will need to back port to 4.10 oc get clusterversion
NAME VERSION AVAILABLE PROGRESSING SINCE STATUS
version 4.10.0-0.nightly-2022-02-04-015640 True False 34m Cluster version is 4.10.0-0.nightly-2022-02-04-015640
rahulgangwar@rgangwar-mac ~ % oc get pod -n openshift-kube-apiserver -l apiserver --show-labels
NAME READY STATUS RESTARTS AGE LABELS
kube-apiserver-rgangwar-04de0-t8zdz-master-0.c.openshift-qe.internal 5/5 Running 0 38m apiserver=true,app=openshift-kube-apiserver,revision=8
kube-apiserver-rgangwar-04de0-t8zdz-master-1.c.openshift-qe.internal 5/5 Running 0 39m apiserver=true,app=openshift-kube-apiserver,revision=8
kube-apiserver-rgangwar-04de0-t8zdz-master-2.c.openshift-qe.internal 5/5 Running 0 36m apiserver=true,app=openshift-kube-apiserver,revision=8
rahulgangwar@rgangwar-mac ~ % oc edit apiserver/cluster
apiserver.config.openshift.io/cluster edited
oc get pod -n openshift-kube-apiserver -l apiserver --show-labels
NAME READY STATUS RESTARTS AGE LABELS
kube-apiserver-rgangwar-04de0-t8zdz-master-0.c.openshift-qe.internal 5/5 Running 0 10m apiserver=true,app=openshift-kube-apiserver,revision=9
kube-apiserver-rgangwar-04de0-t8zdz-master-1.c.openshift-qe.internal 5/5 Running 0 12m apiserver=true,app=openshift-kube-apiserver,revision=9
kube-apiserver-rgangwar-04de0-t8zdz-master-2.c.openshift-qe.internal 5/5 Running 0 15m apiserver=true,app=openshift-kube-apiserver,revision=9
oc get project default
NAME DISPLAY NAME STATUS
default Active
oc get templates -n openshift|head
NAME DESCRIPTION PARAMETERS OBJECTS
3scale-gateway 3scale's APIcast is an NGINX based API gateway used to integrate your interna... 17 (8 blank) 3
amq63-basic Application template for JBoss A-MQ brokers. These can be deployed as standal... 11 (4 blank) 6
amq63-persistent An example JBoss A-MQ application. For more information about using this temp... 13 (4 blank) 8
amq63-persistent-ssl An example JBoss A-MQ application. For more information about using this temp... 18 (6 blank) 12
amq63-ssl An example JBoss A-MQ application. For more information about using this temp... 16 (6 blank) 10
apicurito Design beautiful, functional APIs with zero coding, using a visual designer f... 7 (1 blank) 7
cache-service Red Hat Data Grid is an in-memory, distributed key/value store. 8 (1 blank) 4
cakephp-mysql-example An example CakePHP application with a MySQL database. For more information ab... 21 (4 blank) 8
cakephp-mysql-persistent An example CakePHP application with a MySQL database. For more information ab... 22 (4 blank)
9
cat scc.yaml
kind: SecurityContextConstraints
apiVersion: v1
metadata:
name: scc-admin
allowPrivilegedContainer: true
runAsUser:
type: RunAsAny
seLinuxContext:
type: RunAsAny
fsGroup:
type: RunAsAny
supplementalGroups:
type: RunAsAny
users:
- my-admin-user
groups:
- my-admin-group
oc create -f scc.yaml
W0204 13:31:44.213822 72388 shim_kubectl.go:55] Using non-groupfied API resources is deprecated and will be removed in a future release, update apiVersion to "security.openshift.io/v1" for your resource
securitycontextconstraints.security.openshift.io/scc-admin created
oc get scc scc-admin
NAME PRIV CAPS SELINUX RUNASUSER FSGROUP SUPGROUP PRIORITY READONLYROOTFS VOLUMES
scc-admin true <no value> RunAsAny RunAsAny RunAsAny RunAsAny <no value> false ["awsElasticBlockStore","azureDisk","azureFile","cephFS","cinder","configMap","csi","downwardAPI","emptyDir","ephemeral","fc","flexVolume","flocker","gcePersistentDisk","gitRepo","glusterfs","iscsi","nfs","persistentVolumeClaim","photonPersistentDisk","portworxVolume","projected","quobyte","rbd","scaleIO","secret","storageOS","vsphere"]
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: OpenShift Container Platform 4.10.3 security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2022:0056 |