Bug 1573558 - Error message for sub resources is wrong
Summary: Error message for sub resources is wrong
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: apiserver-auth
Version: 3.9.0
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
: 3.11.0
Assignee: Simo Sorce
QA Contact: scheng
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-05-01 17:07 UTC by Clayton Coleman
Modified: 2018-10-11 07:19 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
undefined
Clone Of:
Environment:
Last Closed: 2018-10-11 07:19:10 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:2652 None None None 2018-10-11 07:19:39 UTC

Description Clayton Coleman 2018-05-01 17:07:30 UTC
Got rejected accessing build logs in a namespace directly via the API

error: Unable to retrieve logs from failed build: builds.build.openshift.io "src" is forbidden: User "smarterclayton" cannot get builds.build.openshift.io/logs in the namespace "test-ci-op": User "smarterclayton" cannot get builds/logs.build.openshift.io in project "test-ci-op"

We display the same subresource message in two different ways.  I also don't know why we show the error twice (shouldn't be nested).

Might be a build team problem.

Comment 1 Simo Sorce 2018-05-01 17:46:28 UTC
Known issue:
https://github.com/openshift/origin/issues/15828

Comment 2 Clayton Coleman 2018-05-02 02:16:33 UTC
Also 

Error from server (Forbidden): namespaces "ci-op-b11b8c1ba3" is forbidden: User "smarterclayton" cannot delete namespaces in the namespace "ci-op-b11b8c1ba3": User "smarterclayton" cannot delete namespaces in project "ci-op-b11b8c1ba3"

Duplicate plus "cannot delete namespaces in the namespace" makes me die a bit on the inside.

Comment 3 Simo Sorce 2018-07-20 17:04:44 UTC
https://github.com/openshift/origin/pull/20379

Comment 4 Simo Sorce 2018-08-06 12:27:10 UTC
Clayton,
a fix for this issue is available in the PR mentioned in #comment3
If you think this is 3.11 material please approve the PR, otherwise I'll shelve it for the following release and change this bugzilla target.

Comment 5 Simo Sorce 2018-08-08 09:50:24 UTC
Merged to master:
https://github.com/openshift/origin/pull/20379

Comment 7 scheng 2018-08-27 06:32:59 UTC
Verified.

# openshift version
openshift v3.11.0-0.22.0

# oc get bc -n install-test
No resources found.
Error from server (Forbidden): buildconfigs.build.openshift.io is forbidden: User "aa" cannot list buildconfigs.build.openshift.io in the namespace "install-test": no RBAC policy matched

# oc delete ns default
Error from server (Forbidden): namespaces "default" is forbidden: User "aa" cannot delete namespaces in the namespace "default": no RBAC policy matched

Comment 8 scheng 2018-08-28 09:59:14 UTC
# oc get --raw /apis/build.openshift.io/v1/namespaces/aa/builds/ruby-ex-1/log
Error from server (Forbidden): builds.build.openshift.io "ruby-ex-1" is forbidden: User "system:anonymous" cannot get builds.build.openshift.io/log in the namespace "aa": no RBAC policy matched

Comment 10 errata-xmlrpc 2018-10-11 07:19:10 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:2652


Note You need to log in before you can comment on or make changes to this bug.