Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1573558

Summary:	Error message for sub resources is wrong
Product:	OpenShift Container Platform	Reporter:	Clayton Coleman <ccoleman>
Component:	apiserver-auth	Assignee:	Simo Sorce <ssorce>
Status:	CLOSED ERRATA	QA Contact:	scheng
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	3.9.0	CC:	aos-bugs, ccoleman
Target Milestone:	---
Target Release:	3.11.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	No Doc Update
Doc Text:	undefined	Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-10-11 07:19:10 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Clayton Coleman 2018-05-01 17:07:30 UTC

Got rejected accessing build logs in a namespace directly via the API

error: Unable to retrieve logs from failed build: builds.build.openshift.io "src" is forbidden: User "smarterclayton" cannot get builds.build.openshift.io/logs in the namespace "test-ci-op": User "smarterclayton" cannot get builds/logs.build.openshift.io in project "test-ci-op"

We display the same subresource message in two different ways.  I also don't know why we show the error twice (shouldn't be nested).

Might be a build team problem.

Comment 1 Simo Sorce 2018-05-01 17:46:28 UTC

Known issue:
https://github.com/openshift/origin/issues/15828

Comment 2 Clayton Coleman 2018-05-02 02:16:33 UTC

Also 

Error from server (Forbidden): namespaces "ci-op-b11b8c1ba3" is forbidden: User "smarterclayton" cannot delete namespaces in the namespace "ci-op-b11b8c1ba3": User "smarterclayton" cannot delete namespaces in project "ci-op-b11b8c1ba3"

Duplicate plus "cannot delete namespaces in the namespace" makes me die a bit on the inside.

Comment 3 Simo Sorce 2018-07-20 17:04:44 UTC

https://github.com/openshift/origin/pull/20379

Comment 4 Simo Sorce 2018-08-06 12:27:10 UTC

Clayton,
a fix for this issue is available in the PR mentioned in #comment3
If you think this is 3.11 material please approve the PR, otherwise I'll shelve it for the following release and change this bugzilla target.

Comment 5 Simo Sorce 2018-08-08 09:50:24 UTC

Merged to master:
https://github.com/openshift/origin/pull/20379

Comment 7 scheng 2018-08-27 06:32:59 UTC

Verified.

# openshift version
openshift v3.11.0-0.22.0

# oc get bc -n install-test
No resources found.
Error from server (Forbidden): buildconfigs.build.openshift.io is forbidden: User "aa" cannot list buildconfigs.build.openshift.io in the namespace "install-test": no RBAC policy matched

# oc delete ns default
Error from server (Forbidden): namespaces "default" is forbidden: User "aa" cannot delete namespaces in the namespace "default": no RBAC policy matched

Comment 8 scheng 2018-08-28 09:59:14 UTC

# oc get --raw /apis/build.openshift.io/v1/namespaces/aa/builds/ruby-ex-1/log
Error from server (Forbidden): builds.build.openshift.io "ruby-ex-1" is forbidden: User "system:anonymous" cannot get builds.build.openshift.io/log in the namespace "aa": no RBAC policy matched

Comment 10 errata-xmlrpc 2018-10-11 07:19:10 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:2652