Bug 1253736 - oc process doesn't handle namespace correctly
oc process doesn't handle namespace correctly
Status: CLOSED CURRENTRELEASE
Product: OpenShift Origin
Classification: Red Hat
Component: Command Line Interface (Show other bugs)
3.x
Unspecified Unspecified
unspecified Severity low
: ---
: ---
Assigned To: Michal Fojtik
Yan Du
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2015-08-14 10:15 EDT by Ben Parees
Modified: 2016-09-05 02:41 EDT (History)
9 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-05-12 13:15:28 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Ben Parees 2015-08-14 10:15:19 EDT
Description of problem:
Running "oc process sometemplate -n openshift" as a normal user fails.  The user has view access to openshift (needed to view the "sometemplate") but the process command also attempts to create the processed template in that namespace, which fails.



Version-Release number of selected component (if applicable):


How reproducible:
every time

Steps to Reproduce:
1. start openshift
2. register some template in the openshift namespace using cluster-admin
3. oc login as a normal user
4. oc process sometemplate -n openshift


Actual results:
error processing the template "rails-postgresql-example": User "test-admin" cannot create processedtemplates in project "openshift"

Expected results:
the processed template results should be returned to the user so they could potentially pipe the output to | oc create -f -
Comment 1 Jordan Liggitt 2015-08-14 10:17:49 EDT
Right now, the namespace where the template is submitted for processing doesn't matter, but we're discussing things that will make it significant (like a generator that produces the name of the processing namespace).

Normal users probably shouldn't be processing their templates against the openshift namespace
Comment 2 Ben Parees 2015-08-14 10:25:48 EDT
yeah but how do they locate the template then?  the problem here is the -n is being overloaded.

it means both:
1) the template i want to process is in the openshift namespace
and
2) do something else in the openshift namespace which i'm not clear about (whatever this "processedtemplates" resource is)

so if we want to do what you're describing we need two different arguments...one for where to get the namespace from, and one for what namespace to use for "context" when processing it.
Comment 3 Ben Parees 2015-08-20 11:22:29 EDT
see also:
https://github.com/openshift/origin/issues/3307
Comment 4 Fabiano Franz 2016-01-08 14:17:49 EST
This is fixed in master, but note that the syntax for specifying the source namespace for process is not through -n but

namespace/resource/name

So for example

'oc process openshift/template/sometemplate'

or, with implicit resource kind,

'oc process openshift//sometemplate'
Comment 5 Wei Sun 2016-01-10 22:31:20 EST
Verified this bug in devenv-rhel7_3110

Result:
# oc process openshift//ruby-helloworld-sample | oc create -f -
service "frontend" created
route "route-edge" created
imagestream "origin-ruby-sample" created
imagestream "ruby-22-centos7" created
buildconfig "ruby-sample-build" created
deploymentconfig "frontend" created
service "database" created
deploymentconfig "database" created


# oc process openshift/template/ruby-helloworld-sample | oc create -f -
service "frontend" created
route "route-edge" created
imagestream "origin-ruby-sample" created
imagestream "ruby-22-centos7" created
buildconfig "ruby-sample-build" created
deploymentconfig "frontend" created
service "database" created
deploymentconfig "database" created

Note You need to log in before you can comment on or make changes to this bug.