Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
First Last Prev Next    This bug is not in your last search results.
Bug 1585951 - [ASB] secret created in asb namespace when provision should be deleted when delete user namespace
[ASB] secret created in asb namespace when provision should be deleted when d...
Status: CLOSED ERRATA
Product: OpenShift Container Platform
Classification: Red Hat
Component: Service Broker (Show other bugs)
3.10.0
Unspecified Unspecified
medium Severity medium
: ---
: 3.11.0
Assigned To: Erik Nelson
Zihan Tang
:
Depends On:
Blocks:
  Show dependency tree / graph
 
Reported: 2018-06-05 03:40 EDT by Zihan Tang
Modified: 2018-10-11 03:21 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: ASB was not deleting secret containing provision credentials from its own namespace during deprovision. Consequence: Leaked secret containing credentials from provision. Fix: Delete the secret on deprovision. Result: Fixes leak.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2018-10-11 03:20:33 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:2652 None None None 2018-10-11 03:21 EDT

  None (edit)
Description Zihan Tang 2018-06-05 03:40:34 EDT 
Description of problem:
when delete a namespace, the secret created in provision in openshit-ansible-service-broker should also be deleted

Version-Release number of selected component (if applicable):
asb: 1.2.16

How reproducible:
always

Steps to Reproduce:
1. provision postgresql-apb  in project 'post'
2. check the serviceinstance and secret 
# oc get serviceinstances --all-namespaces
NAMESPACE   NAME                      AGE
post        rh-postgresql-apb-r4jlc   1m

# oc get secret --show-labels
NAME                                   TYPE                                  DATA      AGE       LABELS
9b7d19c6-688f-11e8-8a97-0a580a800003   Opaque                                1         1m        apbAction=provision,apbName=rh-postgresql-apb

3. delete project 
# oc delete project post
project.project.openshift.io "post" deleted

4. check the secret is deleted in openshfit-ansible-service-broker namespace

Actual results:
the secret in openshfit-ansible-service-broker namespace is not deleted

# oc get secret --show-labels
NAME                                   TYPE                                  DATA      AGE       LABELS
9b7d19c6-688f-11e8-8a97-0a580a800003   Opaque                                1         5m        apbAction=provision,apbName=rh-postgresql-apb
# oc get serviceinstance --all-namespaces
No resources found.

Asb Log:

[2018-06-05T07:13:44.175Z] [WARNING] - Broker configured to *NOT* launch and run APB unbind
10.128.0.1 - - [05/Jun/2018:07:13:44 +0000] "DELETE /ansible-service-broker/v2/service_instances/9b7d19c6-688f-11e8-8a97-0a580a800003/service_bindings/a943e0d3-688f-11e8-8a97-0a580a800003?plan_id=9783fc2e859f9179833a7dd003baa841&service_id=d5915e05b253df421efe6e41fb6a66ba HTTP/1.1" 200 3
[2018-06-05T07:13:44.617Z] [INFO] - All Jobs for instance: ab6bfc15-688f-11e8-8a97-0a580a800003 in state:  in progress - 
[]apb.JobState{}
[2018-06-05T07:13:45.417Z] [WARNING] - Broker configured to *NOT* launch and run APB unbind
10.128.0.1 - - [05/Jun/2018:07:13:44 +0000] "DELETE /ansible-service-broker/v2/service_instances/9b7d19c6-688f-11e8-8a97-0a580a800003/service_bindings/a943e0d3-688f-11e8-8a97-0a580a800003?plan_id=9783fc2e859f9179833a7dd003baa841&service_id=d5915e05b253df421efe6e41fb6a66ba HTTP/1.1" 410 5
10.128.0.1 - - [05/Jun/2018:07:13:44 +0000] "DELETE /ansible-service-broker/v2/service_instances/9b7d19c6-688f-11e8-8a97-0a580a800003/service_bindings/ab6bfc15-688f-11e8-8a97-0a580a800003?plan_id=9783fc2e859f9179833a7dd003baa841&service_id=d5915e05b253df421efe6e41fb6a66ba HTTP/1.1" 200 3
10.128.0.1 - - [05/Jun/2018:07:13:46 +0000] "DELETE /ansible-service-broker/v2/service_instances/9b7d19c6-688f-11e8-8a97-0a580a800003/service_bindings/ab6bfc15-688f-11e8-8a97-0a580a800003?plan_id=9783fc2e859f9179833a7dd003baa841&service_id=d5915e05b253df421efe6e41fb6a66ba HTTP/1.1" 410 5
[2018-06-05T07:13:47.617Z] [INFO] - All Jobs for instance: 9b7d19c6-688f-11e8-8a97-0a580a800003 in state:  in progress - 
[]apb.JobState{}
[2018-06-05T07:13:47.62Z] [INFO] - ASYNC deprovision in progress
10.128.0.1 - - [05/Jun/2018:07:13:46 +0000] "DELETE /ansible-service-broker/v2/service_instances/9b7d19c6-688f-11e8-8a97-0a580a800003?accepts_incomplete=true&plan_id=9783fc2e859f9179833a7dd003baa841&service_id=d5915e05b253df421efe6e41fb6a66ba HTTP/1.1" 202 58
[2018-06-05T07:13:48.647Z] [ERROR] - Could not find instance 9b7d19c6-688f-11e8-8a97-0a580a800003 associated with job state 66de9730-ed03-4228-931d-ff37bf7bbae0 - bundleinstances.automationbroker.io "9b7d19c6-688f-11e8-8a97-0a580a800003" not found
[2018-06-05T07:13:48.647Z] [WARNING] - unable to find job state: [9b7d19c6-688f-11e8-8a97-0a580a800003]. error: [bundleinstances.automationbroker.io "9b7d19c6-688f-11e8-8a97-0a580a800003" not found]


Expected results:
the secret in asb ns is deleted.

Additional info:
the binding secrets are deleted in asb ns when delete project.
Comment 1 Zhang Cheng 2018-06-05 03:57:05 EDT 
Setting "target release" to 3.10 in currently, please reset if you want to out of this release.
Comment 2 John Matthews 2018-06-05 08:48:45 EDT 
Aligning to 3.11
Comment 5 Zihan Tang 2018-08-08 23:21:38 EDT 
Verified 
ASB: 1.3.7
Comment 7 errata-xmlrpc 2018-10-11 03:20:33 EDT 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:2652
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.