Bug 1565545 - asb etcd '/extracted_credentials' should be migrated to secret in asb namepsace
Summary: asb etcd '/extracted_credentials' should be migrated to secret in asb namepsace
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Service Broker
Version: 3.10.0
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
: 3.10.0
Assignee: Shawn Hurley
QA Contact: Zihan Tang
URL:
Whiteboard:
Depends On: 1577867
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-04-10 09:28 UTC by Zihan Tang
Modified: 2018-07-30 19:13 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
undefined
Clone Of:
Environment:
Last Closed: 2018-07-30 19:12:35 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:1816 None None None 2018-07-30 19:13:02 UTC

Description Zihan Tang 2018-04-10 09:28:32 UTC
Description of problem:
the '/extracted_credentials' is not migrated from etcd to crd.
as discussed with developer in card , etcd '/extracted_credentials' should be migrated to crd.
Version-Release number of selected component (if applicable):
asb:3.10

How reproducible:
always

Steps to Reproduce:
1. check etcd directory before migration
  #etcdctl --ca-file *.crt --cert-file *client.crt --key-file *client.key --endpoints https://asb-etcd.openshift-ansible-service-broker.svc.cluster.local:2379 ls

/state
/extracted_credentials
/bind_instance
/spec
/plan_name
/service_instance

2. migrate asb to 3.10
3. check crd resource

Actual results:
the crd resource do not contain 'extracted_credentials' related crd object 

Expected results:
the crd resource contain 'extracted_credentials' related crd object

Additional info:

Comment 1 Shawn Hurley 2018-04-10 12:41:04 UTC
To be clear, we are not creating a CRD for extracted credentials. We are using secrets for extracted credentials now. We need to move etcd /extracted_credentials to secrets.

Comment 2 Zihan Tang 2018-04-12 08:50:59 UTC
Do you mean when provision a apb, will create a secret in openshift-ansible-service-broker namespace?
like : 

[root@host-172-16-120-160 ~]# oc get secret -n openshift-ansible-service-broker
NAME                                   TYPE                                  DATA      AGE
7bef73a9-3e1a-11e8-ba42-0a580a80000b   Opaque                                1         2h
9ed5381f-3e2c-11e8-ba42-0a580a80000b   Opaque                                1         2m
bb9745da-3e2c-11e8-ba42-0a580a80000b   Opaque                                1         12m

Then the secret key ref will be stored in jobstate  metedata.labels ?
 like :
[root@host-172-16-120-160 ~]# oc get jobstates 2b086f32-40bd-4f82-9f41-67fa8966dafb -o yaml
apiVersion: automationbroker.io/v1
kind: JobState
metadata:
  clusterName: ""
  creationTimestamp: 2018-04-12T08:37:30Z
  generation: 0
  labels:
    instanceId: bb9745da-3e2c-11e8-ba42-0a580a80000b
    state: succeeded
  name: 2b086f32-40bd-4f82-9f41-67fa8966dafb
  namespace: openshift-ansible-service-broker
  resourceVersion: "25794"
  selfLink: /apis/automationbroker.io/v1/namespaces/openshift-ansible-service-broker/jobstates/2b086f32-40bd-4f82-9f41-67fa8966dafb
  uid: bd0f76b0-3e2c-11e8-8cfd-fa163ea56fcb
spec:
  description: provision job completed
  error: ""
  method: provision
  podName: ""
  state: succeeded

Comment 3 Shawn Hurley 2018-04-12 13:10:12 UTC
Yes, that is mostly correct. One note is that the label reference is for the service instance id or the binding id and that is the same value we use the secret.

Comment 4 Zihan Tang 2018-04-13 10:06:19 UTC
Do you mean that  ?
1. the secret name when provision is the same with service instance id 
2. the secret name when binding is the same with service binding id 

but parameters of  2 secret for instance and binding are the same , 
why create a new secret for binding ?

btw, the secret is not easily readable to check its usage.

Comment 5 Shawn Hurley 2018-04-13 19:55:51 UTC
> 1. the secret name when provision is the same with service instance id 
> 2. the secret name when the binding is the same with service binding id 

Yes that is correct. 

> but parameters of  2 secrets for instance and binding are the same, 
> why create a new secret for binding?

Because we can delete a binding and we should delete the secret associated with that. More specifically, with async bind being supported this will not always be the case.

Comment 6 Zihan Tang 2018-04-16 02:47:51 UTC
Shawn,
In v3.9 
when create binding, it don't create new credentials in etcd '/extracted_credentials' , and no new jobstate in etcd 'state/serviceinstance_id/job',

In 3.10 , creating binding will create a new secret in asb ns, can you help clarify enhancement purpose?   thanks.

Comment 7 Shawn Hurley 2018-04-16 12:55:25 UTC
They are two different workflows. 

Async bind causes a jobstate to be added and an extracted credential. This is because of the configuration value `launch_apb_on_bind` is set to false and no action occurs for those bind calls.


If you are have set `launch_apb_on_bind` to false then you are correct about the behavior stated above.

Comment 8 Zihan Tang 2018-04-27 07:33:07 UTC
I tried this in v3.9 and v3.10
in summary 
                             v3.9                            
sync binding       no new job state/no extracted credential
async binding     new job state /extracted credential 
          
                             v3.10
sync binding      no new job state/extracted credential secret
async binding    new job state /extracted credential 

when in sync binding , 3.10 asb extract credential secret which is not in v3.9(in etcd) . 
in my opinion , it's better to keep the same behavior between 3.10 and 3.9 . please correct me if it is for some enhancement .

Comment 9 Shawn Hurley 2018-04-27 12:09:46 UTC
Hello,

When a binding is created we should create an extracted credential. This behavior is what is expected. 

It appears that the behavior changed between 3.7 and 3.9. I would expect for ease of use that the behavior would be that the extracted credential is created for a binding. This not only sets us up for future work but also fixes a bug in 3.9 that I just realized was happening.

Comment 12 Zihan Tang 2018-05-08 07:03:18 UTC
image is ready, change it to ON_QA

Comment 13 Zihan Tang 2018-05-09 09:16:59 UTC
the upgrade env is not ready ,change it to MODIFIED.

Comment 14 Zihan Tang 2018-05-15 07:44:33 UTC
bug 1577867 block to build env.

Comment 16 Zihan Tang 2018-05-22 07:23:18 UTC
In OCP 3.10, asb 1.2.12

when provision apb, will create a secret in openshift-ansible-service-broker ns. 
and this secret will be deleted when deprovision.
when create binding, will also create a secret in openshift-ansible-service-broker ns, and the secret will be deleted when unbind.

so marked this as verified.

will use other bug to trace the etcd migration from v3.9 to v3.10 issue.

Comment 18 errata-xmlrpc 2018-07-30 19:12:35 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:1816


Note You need to log in before you can comment on or make changes to this bug.