get --watch specifying a resource uses "watch list" instead of "watch" API

[jethrogb]

Is this a request for help? (If yes, you should use our troubleshooting guide and community support channels, see http://kubernetes.io/docs/troubleshooting/.): no

What keywords did you search in Kubernetes issues before filing this one? (If you have found any duplicates, you should instead reply there.): watch

---

Is this a BUG REPORT or FEATURE REQUEST? (choose one): BUG REPORT

Kubernetes version (use kubectl version):

Client Version: version.Info{Major:"1", Minor:"8", GitVersion:"v1.8.7", GitCommit:"b30876a5539f09684ff9fde266fda10b37738c9c", GitTreeState:"clean", BuildDate:"2018-01-16T21:59:57Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"8", GitVersion:"v1.8.7", GitCommit:"b30876a5539f09684ff9fde266fda10b37738c9c", GitTreeState:"clean", BuildDate:"2018-01-16T21:52:38Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"linux/amd64"}

Environment:

• Cloud provider or hardware configuration: Bare metal
• OS (e.g. from /etc/os-release): Ubuntu Xenial
• Kernel (e.g. uname -a): 4.4.0-104-generic #127-Ubuntu
• Install tools: kubeadm
• Others:

What happened:
When running kubectl get RESOURCETYPE --watch OBJECTNAME, it uses the "watch list" API with a fieldSelector on the resource name. If the current role doesn't allow watch list for this resource type, this results in a 403.

What you expected to happen:
I expected the "watch" API to be used.

How to reproduce it (as minimally and precisely as possible):

# Setup RBAC on your account to allow watch but not watch list
$ kubectl --v=6 get cm -n swdist swdist --watch|&grep GET
I0220 22:20:41.482970    2907 round_trippers.go:436] GET https://10.245.0.1:443/api/v1/namespaces/swdist/configmaps/swdist 200 OK in 9 milliseconds
I0220 22:20:41.492379    2907 round_trippers.go:436] GET https://10.245.0.1:443/api/v1/namespaces/swdist/configmaps?fieldSelector=metadata.name%3Dswdist&resourceVersion=0&watch=true 403 Forbidden in 1 milliseconds

Anything else we need to know:

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[jethrogb]

/remove-lifecycle stale

[stealthybox]

I can confirm that this is still using the WatchList api for specific resources:

kubectl get pod/nginx-64f497f8fd-6qxk5 -w -v6  2>&1 | grep GET
I0815 19:17:41.101640   89726 round_trippers.go:405] GET https://10.22.191.4:6443/api/v1/namespaces/default/pods/nginx-64f497f8fd-6qxk5 200 OK in 36 milliseconds
I0815 19:17:41.115014   89726 round_trippers.go:405] GET https://10.22.191.4:6443/api/v1/namespaces/default/pods?fieldSelector=metadata.name%3Dnginx-64f497f8fd-6qxk5&resourceVersion=0&watch=true 200 OK in 6 milliseconds
^C

kubectl version
Client Version: version.Info{Major:"1", Minor:"11", GitVersion:"v1.11.1", GitCommit:"b1b29978270dc22fecc592ac55d903350454310a", GitTreeState:"clean", BuildDate:"2018-07-18T11:36:43Z", GoVersion:"go1.10.3", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"11", GitVersion:"v1.11.0", GitCommit:"91e7b4fd31fcd3d5f436da26c980becec37ceefe", GitTreeState:"clean", BuildDate:"2018-06-27T20:08:34Z", GoVersion:"go1.10.2", Compiler:"gc", Platform:"linux/amd64"}

[seans3]

/kind bug
/sig cli
/area kubectl
/priority P2

[stealthybox]

I just noticed this in the 1.12 release notes.
It looks like this is intentional behavior of client-go.
/watch is now deprecated in favor of passing ?watch=true.

ref: kubernetes/kubernetes#65147

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[jethrogb]

/remove-lifecycle stale

[liggitt]

as of 1.11, watch requests with a fieldSelector scoped to a single metadata.name can be authorized using an individual watch permission. see kubernetes/kubernetes#63469

/close

[k8s-ci-robot]

@liggitt: Closing this issue.

In response to this:

as of 1.11, watch requests with a fieldSelector scoped to a single metadata.name can be authorized using an individual watch permission. see kubernetes/kubernetes#63469

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[jethrogb]

Great!