Bug 1360675
| Summary: | Failed to access kibana web console | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | chunchen <chunchen> | ||||||||||||||
| Component: | Logging | Assignee: | Luke Meyer <lmeyer> | ||||||||||||||
| Status: | CLOSED NEXTRELEASE | QA Contact: | chunchen <chunchen> | ||||||||||||||
| Severity: | medium | Docs Contact: | |||||||||||||||
| Priority: | medium | ||||||||||||||||
| Version: | 3.3.0 | CC: | aos-bugs, chunchen, ewolinet, jcantril, wsun, xiazhao | ||||||||||||||
| Target Milestone: | --- | ||||||||||||||||
| Target Release: | --- | ||||||||||||||||
| Hardware: | Unspecified | ||||||||||||||||
| OS: | Unspecified | ||||||||||||||||
| Whiteboard: | |||||||||||||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||||||||||||
| Doc Text: | Story Points: | --- | |||||||||||||||
| Clone Of: | Environment: | ||||||||||||||||
| Last Closed: | 2016-08-09 13:30:33 UTC | Type: | Bug | ||||||||||||||
| Regression: | --- | Mount Type: | --- | ||||||||||||||
| Documentation: | --- | CRM: | |||||||||||||||
| Verified Versions: | Category: | --- | |||||||||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||||||||
| Embargoed: | |||||||||||||||||
| Attachments: |
|
||||||||||||||||
|
Description
chunchen
2016-07-27 10:06:09 UTC
Created attachment 1184570 [details]
kibana console screenshot
Created attachment 1184571 [details]
curator pod log
Created attachment 1184572 [details]
ES pod log
Created attachment 1184573 [details]
fluentd log
Created attachment 1184574 [details]
kibana container log
Created attachment 1184575 [details]
kibana-proxy pod log
@eric I believe @luke said this is a result of our index change to include uuid. Might this also be an opportunity to fix https://github.com/openshift/origin-aggregated-logging/issues/171 since I THINK you said the problem was with the query parameters and/or document fragments. This looks to be something else. The issue we were seeing with the index change was in regards to the kibana index that was generated within the OpenShift console. This looks like it was directly accessed and was unable to redirect for login? Also, the log format for Elasticsearch looks off still... have we rebuilt the image since http://pkgs.devel.redhat.com/cgit/rpms/logging-elasticsearch-docker/commit/?h=rhaos-3.3-rhel-7 ? @Chunchen, were you trying to access Kibana directly? What was the URL you used? I managed to reproduce this exactly once; still trying to figure out what the conditions are. I still don't understand how this is happening for you, but I have the following problem, which may be related. With a fresh install of OSE 3.3 and deploying EFK from brew as version 3.3, the server ends up looping through the following URL back to sign-in: https://kibana.example.com/auth/openshift/callback?error=server_error&error_description=The+authorization+server+encountered+an+unexpected+condition+that+prevented+it+from+fulfilling+the+request. OpenShift logs indicate this is due to token scope restrictions. If I `oc edit oauthclient/kibana-proxy` I see the following section which is new from this version: scopeRestrictions: - literals: - user:info - user:check-access - user:list-projects If I remove this, I can login and access Kibana as usual. I'm researching the best way to address this during the deployment; in the meantime you can do it manually. The fact that you could visit URLs from the console, but not log in directly, tends to indicate that there is something wrong with the OAuth process, though it's not necessarily the same as this, it seemed likely to be related. According to Comment #10, this bug is not a testblocker any more, so removed the TestBlocker keyword. It's fixed, checked with the latest logging images as below: brew-pulp-docker01.web...com:8888/openshift3/logging-auth-proxy 3.3.0 196ecb30fc93 brew-pulp-docker01.web...com:8888/openshift3/logging-elasticsearch 3.3.0 e71d2b04669c brew-pulp-docker01.web...com:8888/openshift3/logging-fluentd 3.3.0 80847240fa91 brew-pulp-docker01.web...com:8888/openshift3/logging-deployer 3.3.0 1c127f4f36a0 brew-pulp-docker01.web...com:8888/openshift3/logging-curator 3.3.0 2c88e1273c11 brew-pulp-docker01.web...com:8888/openshift3/logging-kibana 3.3.0 32d276bb46ae Great, thanks for testing. |