Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 2058433

Summary:	URL's for BuildTriggers are wrong
Product:	OpenShift Container Platform	Reporter:	Eric Rich <erich>
Component:	Documentation	Assignee:	Rolfe Dlugy-Hegwer <rdlugyhe>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Jitendar Singh <jitsingh>
Severity:	urgent	Docs Contact:	Latha S <lmurthy>
Priority:	urgent
Version:	4.11	CC:	aos-bugs
Target Milestone:	---
Target Release:	4.6.z
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-03-31 20:00:59 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Eric Rich 2022-02-24 22:29:01 UTC

Document URL: https://docs.openshift.com/container-platform/4.7/cicd/builds/triggering-builds-build-hooks.html#builds-webhook-triggers_triggering-builds-build-hooks

Section Number and Name: All

Describe the issue: With in the webhook / build trigger docs, we referance the URL  structure: 

> https://<openshift_api_host:port>/oapi/v1/namespaces/<namespace>/buildconfigs/<name>/webhooks/<secret>/<servcie_type>

This API or URL path changed some time ago, and if you were / are to use this you will get a 403 error: 

> Hook executed successfully but returned HTTP 403 {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"forbidden: User \"system:anonymous\" cannot post path \"/oapi/v1/namespaces/<namespace>/buildconfigs/<build_config>/webhooks/<secret>/<service_type>\"","reason":"Forbidden","details":{},"code":403}

This is caused by the kube 1.6 auth changes as denoted in https://kubernetes.io/docs/reference/access-authn-authz/authentication/#anonymous-requests which required the product to move from /oapi to /api and use RBAC controls to gate this access. 

- Note: the product already has the proper RBAC configs in place for `system:anonymous` to authenticate to the suggested endpoints below; however if your going to the wrong place... you first see an unauthenticated message vs a 404. 

Suggestions for improvement: Change the URL to match that of what `oc decribe bc <bc>` would show you. 

> https://<openshift_api_host:port>/apis/build.openshift.io/v1/namespaces/<namespace>/buildconfigs/<name>/webhooks/<secret>/<servcie_type>

Additional information: 

We will want to back port any fixes here as far back as feasible possible.