allow webconsole to discover cluster information #18075

deads2k · 2018-01-11T17:04:17Z

Adds permissions to the webconsole to inspect what clusterservicebrokers are present.

@pmorie please confirm this is a non-escalating resource which can be generally viewed.
@openshift/sig-security
@spadgett @jwforres you'll need this before merging openshift/origin-web-console-server#18

deads2k · 2018-01-11T18:12:21Z

@jpeeler are clusterservicebrokers safe for most people to see

spadgett · 2018-01-11T18:21:29Z

@sdodson I'm working on corresponding openshift-ansible changes for this

jpeeler · 2018-01-11T18:25:09Z

This to me seems ok since the authInfo only contains secret references: https://github.com/kubernetes-incubator/service-catalog/blob/605c9520f0713771ca8df4887652aa0bc30d5148/pkg/apis/servicecatalog/v1beta1/types.go#L112:6

deads2k · 2018-01-11T18:27:17Z

@jpeeler are clusterservicebrokers safe for most people to see

Confirmed via irc with @jpeeler and in person with @pmorie that we are ok to expose this.

liggitt · 2018-01-11T18:36:05Z

interesting... the web console server is doing live lookup to build config now?

deads2k · 2018-01-11T19:07:19Z

interesting... the web console server is doing live lookup to build config now?

Seems more reliable than having a set config for fully discoverable things. And the versions really have to be live look up'ed I didn't set up watches.

deads2k · 2018-01-11T19:08:47Z

/retest

enj · 2018-01-12T16:57:07Z

install/origin-web-console/rbac-template.yaml

+  name: web-console-server-rbac
+parameters:
+- name: NAMESPACE
+  # This namespace cannot be changed. Only `openshift-web-console` is supported.


Why make it a parameter then?

Why make it a parameter then?

Template processing will clear them unless you explicitly set it using the variable. This just makes all paramaters for all templates the same.

enj · 2018-01-12T18:20:24Z

Works for me:

$ oc whoami
system:serviceaccount:openshift-web-console:webconsole

$ oc get clusterservicebrokers
NAME                      AGE
template-service-broker   2m

enj · 2018-01-13T15:58:42Z

A related question - does running the console in a pod allow us to make it's OAuth client private now like the request token endpoint? IIRC it already supports the code flow?

That would leave oc as the only remaining public OAuth client, which is expected since it cannot protect any embedded secret, and it already uses PKCE.

liggitt · 2018-01-13T16:24:56Z

does running the console in a pod allow us to make it's OAuth client private now like the request token endpoint? IIRC it already supports the code flow?

That would require adding server side oauth handling to the web console, which isn't really worth it if the end goal is to hand the access token over to the user.

spadgett · 2018-01-15T13:51:28Z

@enj OK with this change? It's required for several other PRs

deads2k · 2018-01-15T14:27:32Z

@enj OK with this change? It's required for several other PRs

I suspect so. Tagging and @enj can hold if didn't make it through.

deads2k · 2018-01-15T18:34:18Z

/retest

enj · 2018-01-15T18:54:47Z

@enj OK with this change? It's required for several other PRs

Yup, just forgot to tag.

/lgtm

openshift-ci-robot · 2018-01-15T18:54:52Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deads2k, enj

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

~~OWNERS~~ [deads2k]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

openshift-bot · 2018-01-16T06:51:59Z

/retest

Please review the full test history for this PR and help us cut down flakes.

spadgett · 2018-01-16T12:42:17Z

/retest

spadgett · 2018-01-16T14:03:54Z

flake #16994

/retest

@sdodson

Automatic merge from submit-queue. Add console RBAC template Required for openshift/origin-web-console-server#18 Origin changes: openshift/origin#18075 /assign @sdodson /cc @deads2k

deads2k · 2018-01-16T16:38:42Z

/retest

deads2k · 2018-01-16T17:01:57Z

/retest

deads2k · 2018-01-16T17:02:31Z

This blocks a chain of coordinated pulls across three repos. bumping priority.

deads2k · 2018-01-16T17:48:40Z

/retest

deads2k · 2018-01-16T18:38:38Z

/retest

deads2k · 2018-01-16T19:06:25Z

/retest

deads2k · 2018-01-16T20:53:50Z

/retest

deads2k · 2018-01-16T22:28:05Z

/retest

spadgett · 2018-01-17T01:09:10Z

/retest

openshift-bot · 2018-01-17T11:05:59Z

/retest

Please review the full test history for this PR and help us cut down flakes.

spadgett · 2018-01-17T13:52:31Z

/retest

spadgett · 2018-01-17T17:50:57Z

/retest

spadgett · 2018-01-17T19:17:57Z

/retest

openshift-merge-robot · 2018-01-17T21:50:13Z

/test all [submit-queue is verifying that this PR is safe to merge]

spadgett · 2018-01-17T22:31:01Z

/retest

openshift-ci-robot · 2018-01-17T22:47:00Z

@deads2k: The following test failed, say /retest to rerun them all:

Test name	Commit	Details	Rerun command
ci/openshift-jenkins/extended_conformance_gce	`98b9fa6`	link	`/test extended_conformance_gce`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-merge-robot · 2018-01-17T23:45:55Z

Automatic merge from submit-queue (batch tested with PRs 18075, 17725, 16766, 18070, 18113).

pweil- · 2018-01-18T13:43:56Z

only 19 retests? That was too easy 🎉

jpeeler · 2018-01-18T16:39:14Z

It is funny to laugh about (sort of), but shouldn't this be considered a pretty big problem? It seems the test_pull_request_origin_extended_conformance_crio in particular is extremely problematic - https://openshift-gce-devel.appspot.com/pr/18075

pweil- · 2018-01-18T16:46:08Z

It is funny to laugh about (sort of), but shouldn't this be considered a pretty big problem?

Yes, it should be being treated as at least a p1 issue (which is a blocker) if it is something that is occurring all the time. The referenced flake is marked as p1, @mrunalp would have to comment on any progress there.

spadgett · 2018-01-18T16:58:29Z

If you look through the failures, it's a generally a different flake each time. We should do a better job of linking to a flake issue for each, but it's a bit disheartening doing it 20 times (multiplied by how many PRs you have open). And it's difficult to track down if you're trying to re-kick the tests from your phone in the evening. I also wonder if there's not an infrastructure issue since jobs fail consistently, but usually on different tests.

Fighting a similar problem now for #18114

allow webconsole to discover cluster information

98b9fa6

openshift-ci-robot added the sig/security label Jan 11, 2018

openshift-ci-robot requested review from bparees, coreydaley, jim-minter and liggitt January 11, 2018 17:04

openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 11, 2018

deads2k mentioned this pull request Jan 11, 2018

console autodetection openshift/origin-web-console-server#18

Merged

openshift-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Jan 11, 2018

bparees removed their request for review January 11, 2018 17:05

coreydaley removed their request for review January 11, 2018 18:09

spadgett mentioned this pull request Jan 11, 2018

Add console RBAC template openshift/openshift-ansible#6706

Merged

jim-minter removed their request for review January 11, 2018 22:17

enj reviewed Jan 12, 2018

View reviewed changes

deads2k added the lgtm Indicates that a PR is ready to be merged. label Jan 15, 2018

openshift-ci-robot assigned enj Jan 15, 2018

deads2k added the queue/blocks-others label Jan 16, 2018

openshift-merge-robot merged commit 91fbe83 into openshift:master Jan 17, 2018

deads2k deleted the webconsole-07-discovery branch January 24, 2018 14:40

allow webconsole to discover cluster information #18075

allow webconsole to discover cluster information #18075

Conversation

deads2k commented Jan 11, 2018

deads2k commented Jan 11, 2018

spadgett commented Jan 11, 2018

jpeeler commented Jan 11, 2018

deads2k commented Jan 11, 2018

liggitt commented Jan 11, 2018

deads2k commented Jan 11, 2018

deads2k commented Jan 11, 2018

enj Jan 12, 2018

Choose a reason for hiding this comment

deads2k Jan 15, 2018

Choose a reason for hiding this comment

enj commented Jan 12, 2018

enj commented Jan 13, 2018

liggitt commented Jan 13, 2018

spadgett commented Jan 15, 2018

deads2k commented Jan 15, 2018

deads2k commented Jan 15, 2018

enj commented Jan 15, 2018

openshift-ci-robot commented Jan 15, 2018

openshift-bot commented Jan 16, 2018

spadgett commented Jan 16, 2018

spadgett commented Jan 16, 2018

deads2k commented Jan 16, 2018

deads2k commented Jan 16, 2018

deads2k commented Jan 16, 2018

deads2k commented Jan 16, 2018

deads2k commented Jan 16, 2018

deads2k commented Jan 16, 2018

deads2k commented Jan 16, 2018

deads2k commented Jan 16, 2018

spadgett commented Jan 17, 2018

openshift-bot commented Jan 17, 2018

spadgett commented Jan 17, 2018

spadgett commented Jan 17, 2018

spadgett commented Jan 17, 2018

openshift-merge-robot commented Jan 17, 2018

spadgett commented Jan 17, 2018

openshift-ci-robot commented Jan 17, 2018 • edited Loading

openshift-merge-robot commented Jan 17, 2018

pweil- commented Jan 18, 2018

jpeeler commented Jan 18, 2018

pweil- commented Jan 18, 2018

spadgett commented Jan 18, 2018

openshift-ci-robot commented Jan 17, 2018 •

edited

Loading