Description of problem: It's failed to access "apimanui/api-manager/catalog/api-catalog" page due to 401 issue, the other pages could be accessed, like "apimanui/api-manager/users/chunchen/apis". Version-Release number of selected component (if applicable): APIMan related images built from latest gitrepo source How reproducible: always Steps to Reproduce: 1. Deploy APIMan stack via https://github.com/openshift/origin-apiman/blob/master/README.md#building-from-source 2. Access to the console with a test form like: https://gist.githubusercontent.com/sosiouxme/1a069b243c5f227037fa0566acbd0420/raw/de474bef92673f152aaddb72a355e59530bdb6af/test.html 3. Access the "catalog" page https://<apiman-console-route>/apimanui/api-manager/catalog/api-catalog Actual results: Met 401 error, please refer to the screenshot in the attachment Expected results: Should access "catalog" pages successfully. Additional info:
Created attachment 1157846 [details] catalog page screenshot
sosiouxme: that page queries Kubernetes, so it’s likely to do with a service account not set up correctly.
I reproduced with this stack trace: https://paste.fedoraproject.org/368492/67078146/ Caused by: io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: GET at: https://kubernetes.default.svc/oapi/v1/templates. Message: Forbidden!Configured service account doesn't have access. However, if I ssh into the container and use the SA token to GET that URL with curl, then it works fine. So it seems either something is using the SA token wrong or it's using the wrong account entirely.
Hmm the templates are queried to grab an image only.. Did the security around this change? If templates is the only issue I can turn that off..
Neither service account nor user (most likely) should actually have access to all templates (https://kubernetes.default.svc/oapi/v1/templates) - everything should be scoped by one of the namespaces available to the user.
@dan I presume we can close this since our plans of supporting ApiMan have changed?
@jeff I believe so.
Closing as this is no longer relevent