Description of problem: namespaces that use reserved names and were not created by infrastructure components should be blocked as they will cause the upgrade to fail How reproducible: Attempt an upgrade with a project created by a regular user such as 'openshift-shared-services' and the upgrade process will fail during the check for invalid namespaces and SDN errors. Actual results: Expected results: Additional info:
These are checked for and blocked in 3.6.0
Verified with 3.6.173.0.13, here is the verified steps: 1.login to openshift as normal user 2.try to create new project with reserved name, openshift-, kube-, etc. all failed: $ oc new-project openshift-shared-services Error from server (Forbidden): project.project.openshift.io "openshift-shared-services" is forbidden: cannot request a project starting with "openshift-" $ oc new-project kube-shared-services Error from server (Forbidden): project.project.openshift.io "kube-shared-services" is forbidden: cannot request a project starting with "kube-" # openshift version openshift v3.6.173.0.13 kubernetes v1.6.1+5115d708d7 etcd 3.2.1
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:2642