Red Hat Bugzilla – Bug 1382393
Individual OpenShift Project Not Listing Even Though It Exists
Last modified: 2017-03-08 13:43 EST
Description of problem: We are unable to see one project in webconsole or via the cli. We have about 20 projects and all are visible. Version-Release number of selected component (if applicable): 3.2.0 How reproducible: Unverified Actual results: [root@example master]# oc whoami system:admin [root@example master]# oc get projects | grep guests [root@example master]# oc project mc-guests-test Now using project "mc-guests-test" on server "https://ose-test.example.com:8443". We can however see the project if we directly use the full url https://ose-test.example.com:8443/console/project/name_of_project/overview Expected results: Would be able to see the project when running "oc get projects" or in console Additional info: # oadm policy who-can view namespaces Namespace: mc-guests-test Verb: view Resource: namespaces Users: osadmin Groups: system:cluster-admins system:masters # oadm policy who-can list namespaces Namespace: mc-guests-test Verb: list Resource: namespaces Users: deploy guest osadmin system:serviceaccount:logging:aggregated-logging-fluentd system:serviceaccount:management-infra:management-admin system:serviceaccount:openshift-infra:heapster system:serviceaccount:openshift-infra:namespace-controller system:serviceaccount:ose-test:default Groups: system:cluster-admins system:cluster-readers system:masters system:nodes
Given that there's a discrepancy between namespaces and projects I will have them run tests using the opposite, but opening the bug as they should still be appearing in the web console
This appears to be an issue with either of the following: a) project cache b) authz
What user are you logged into the web console as? Also, the right verb is "get", not "view" Can you capture the following from the CLI: oadm policy who-can get namespaces oc whoami oc get projects -o yaml --loglevel=8 oc get project/mc-guests-test -o yaml --loglevel=8
caused by an invalid roleRef in a rolebinding in the project. this short-circuited resourceaccessreview evaluation used to populate the project acl cache. fixed in https://github.com/openshift/origin/pull/11425
This has been merged into ose and is in OSE v3.4.0.17 or newer.
Verified. openshift v3.4.0.18+ada983f kubernetes v1.4.0+776c994 etcd 3.1.0-rc.0 1.oc new-project foo 2.oc create -f binding.yaml 3.oc get projects Actual results: the project containing the policybinding still exist.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:0066