Alert error 'see all' long message extends off screen and can not be scrolled.

[sg00dwin]

This can occur even at full screen.

A larger question is should messages beyond a certain length be displayed in a different view? Open in a new window? Formatted?

[benjaminapetersen]

@enj so this is an interesting message from the server...seems a touch excessive?

[spadgett]

@benjaminapetersen Well you did say "see all".... :)

@enj Can we fix the error from the server?

cc @sg00dwin @rhamilto

[benjaminapetersen]

all --all --no-really-all --I-WANT-ALL-THE-THINGS

[enj]

The point of that error message it to be complete, so it shows everything:

apierrors.NewUnauthorized(fmt.Sprintf("attempt to grant extra privileges: %v user=%v ownerrules=%v ruleResolutionErrors=%v", missingRights, user, ownerRules, ruleResolutionErrors))

Anything less than all of this info makes it impossible to debug RBAC errors. I suggest truncating these in the web console since I doubt it helps a normal user (but is essential to me).

[spadgett]

We already truncate. This is after clicking see all.

My opinion though is that showing these kinds of errors leads to a poor user experience. It would be better if we could log it somewhere or put this level of detail into a separate property in the error response. Then the web console could handle these kinds of errors specially, maybe a view error details link with the full debugging information.

[enj]

It would be better if we could log it somewhere

No, users cannot see logs.

or put this level of detail into a separate property in the error response. Then the web console could handle these kinds of errors specially, maybe a view error details link with the full debugging information

We could shove it into Causes []StatusCause, but then you get something like:

$ oc create role foo --verb=get,list,watch --resource=nodes --loglevel=3
F1017 16:08:46.026871   17011 helpers.go:120] Error from server (Forbidden): roles.rbac.authorization.k8s.io "foo" is forbidden: attempt to grant extra privileges

$ oc create role foo --verb=get,list,watch --resource=nodes --loglevel=4
I1017 16:09:01.798028   17130 helpers.go:206] server response object: [{
  "metadata": {},
  "status": "Failure",
  "message": "roles.rbac.authorization.k8s.io \"foo\" is forbidden: attempt to grant extra privileges",
  "reason": "Forbidden",
  "details": {
    "name": "foo",
    "group": "rbac.authorization.k8s.io",
    "kind": "roles",
    "causes": [
      {
        "message": "user=\u0026{developer b3eff012-b376-11e7-8eb5-507b9dac97ff [system:authenticated:oauth system:authenticated] map[scopes.authorization.openshift.io:[user:full]]}"
      },
      {
        "message": "missingRights=[PolicyRule{Resources:[\"nodes\"], APIGroups:[\"\"], Verbs:[\"get\"]} PolicyRule{Resources:[\"nodes\"], APIGroups:[\"\"], Verbs:[\"list\"]} PolicyRule{Resources:[\"nodes\"], APIGroups:[\"\"], Verbs:[\"watch\"]}]"
      },
      {
        "message": "ownerRules=[PolicyRule{Resources:[\"users\"], ResourceNames:[\"~\"], APIGroups:[\"\" \"user.openshift.io\"], Verbs:[\"get\"]} PolicyRule{Resources:[\"projectrequests\"], APIGroups:[\"\" \"project.openshift.io\"], Verbs:[\"list\"]} PolicyRule{Resources:[\"clusterroles\"], APIGroups:[\"\" \"authorization.openshift.io\"], Verbs:[\"get\" \"list\"]} PolicyRule{Resources:[\"clusterroles\"], APIGroups:[\"rbac.authorization.k8s.io\"], Verbs:[\"get\" \"list\" \"watch\"]} PolicyRule{Resources:[\"storageclasses\"], APIGroups:[\"storage.k8s.io\"], Verbs:[\"get\" \"list\"]} PolicyRule{Resources:[\"projects\"], APIGroups:[\"\" \"project.openshift.io\"], Verbs:[\"list\" \"watch\"]} PolicyRule{Resources:[\"selfsubjectrulesreviews\"], APIGroups:[\"\" \"authorization.openshift.io\"], Verbs:[\"create\"]} PolicyRule{Resources:[\"selfsubjectaccessreviews\"], APIGroups:[\"authorization.k8s.io\"], Verbs:[\"create\"]} PolicyRule{NonResourceURLs:[\"/healthz\" \"/healthz/*\"], Verbs:[\"get\"]} PolicyRule{NonResourceURLs:[\"/version\" \"/version/*\" \"/api\" \"/api/*\" \"/apis\" \"/apis/*\" \"/oapi\" \"/oapi/*\" \"/swaggerapi\" \"/swaggerapi/*\" \"/swagger.json\" \"/osapi\" \"/osapi/\" \"/.well-known\" \"/.well-known/*\" \"/\"], Verbs:[\"get\"]} PolicyRule{Resources:[\"selfsubjectrulesreviews\"], APIGroups:[\"\" \"authorization.openshift.io\"], Verbs:[\"create\"]} PolicyRule{Resources:[\"selfsubjectaccessreviews\"], APIGroups:[\"authorization.k8s.io\"], Verbs:[\"create\"]} PolicyRule{Resources:[\"projectrequests\"], APIGroups:[\"\" \"project.openshift.io\"], Verbs:[\"create\"]} PolicyRule{Resources:[\"selfsubjectaccessreviews\"], APIGroups:[\"authorization.k8s.io\"], Verbs:[\"create\"]} PolicyRule{Resources:[\"builds/docker\" \"builds/optimizeddocker\"], APIGroups:[\"\" \"build.openshift.io\"], Verbs:[\"create\"]} PolicyRule{Resources:[\"builds/jenkinspipeline\"], APIGroups:[\"\" \"build.openshift.io\"], Verbs:[\"create\"]} PolicyRule{Resources:[\"builds/source\"], APIGroups:[\"\" \"build.openshift.io\"], Verbs:[\"create\"]} PolicyRule{NonResourceURLs:[\"/version\" \"/version/*\" \"/api\" \"/api/*\" \"/apis\" \"/apis/*\" \"/oapi\" \"/oapi/*\" \"/swaggerapi\" \"/swaggerapi/*\" \"/swagger.json\" \"/osapi\" \"/osapi/\" \"/.well-known\" \"/.well-known/*\" \"/\"], Verbs:[\"get\"]} PolicyRule{NonResourceURLs:[\"/version\" \"/version/*\" \"/api\" \"/api/*\" \"/apis\" \"/apis/*\" \"/oapi\" \"/oapi/*\" \"/swaggerapi\" \"/swaggerapi/*\" \"/swagger.json\" \"/osapi\" \"/osapi/\" \"/.well-known\" \"/.well-known/*\" \"/\"], Verbs:[\"get\"]} PolicyRule{Resources:[\"oauthaccesstokens\" \"oauthauthorizetokens\"], APIGroups:[\"\" \"oauth.openshift.io\"], Verbs:[\"delete\"]} PolicyRule{Resources:[\"userextras/scopes.authorization.openshift.io\"], APIGroups:[\"authentication.k8s.io\"], Verbs:[\"impersonate\"]} PolicyRule{Resources:[\"buildconfigs/webhooks\"], APIGroups:[\"\" \"build.openshift.io\"], Verbs:[\"create\" \"get\"]} PolicyRule{Resources:[\"pods\" \"pods/attach\" \"pods/exec\" \"pods/portforward\" \"pods/proxy\"], APIGroups:[\"\"], Verbs:[\"create\" \"delete\" \"deletecollection\" \"get\" \"list\" \"patch\" \"update\" \"watch\"]} PolicyRule{Resources:[\"configmaps\" \"endpoints\" \"persistentvolumeclaims\" \"replicationcontrollers\" \"replicationcontrollers/scale\" \"secrets\" \"serviceaccounts\" \"services\" \"services/proxy\"], APIGroups:[\"\"], Verbs:[\"create\" \"delete\" \"deletecollection\" \"get\" \"list\" \"patch\" \"update\" \"watch\"]} PolicyRule{Resources:[\"bindings\" \"events\" \"limitranges\" \"namespaces\" \"namespaces/status\" \"pods/log\" \"pods/status\" \"replicationcontrollers/status\" \"resourcequotas\" \"resourcequotas/status\"], APIGroups:[\"\"], Verbs:[\"get\" \"list\" \"watch\"]} PolicyRule{Resources:[\"serviceaccounts\"], APIGroups:[\"\"], Verbs:[\"impersonate\"]} PolicyRule{Resources:[\"horizontalpodautoscalers\"], APIGroups:[\"autoscaling\"], Verbs:[\"create\" \"delete\" \"deletecollection\" \"get\" \"list\" \"patch\" \"update\" \"watch\"]} PolicyRule{Resources:[\"cronjobs\" \"jobs\" \"scheduledjobs\"], APIGroups:[\"batch\"], Verbs:[\"create\" \"delete\" \"deletecollection\" \"get\" \"list\" \"patch\" \"update\" \"watch\"]} PolicyRule{Resources:[\"deployments\" \"deployments/rollback\" \"deployments/scale\" \"horizontalpodautoscalers\" \"networkpolicies\" \"replicasets\" \"replicasets/scale\" \"replicationcontrollers/scale\"], APIGroups:[\"extensions\"], Verbs:[\"create\" \"delete\" \"deletecollection\" \"get\" \"list\" \"patch\" \"update\" \"watch\"]} PolicyRule{Resources:[\"daemonsets\"], APIGroups:[\"extensions\"], Verbs:[\"get\" \"list\" \"watch\"]} PolicyRule{Resources:[\"deployments\" \"deployments/scale\" \"deployments/status\" \"statefulsets\"], APIGroups:[\"apps\"], Verbs:[\"create\" \"delete\" \"deletecollection\" \"get\" \"list\" \"patch\" \"update\" \"watch\"]} PolicyRule{Resources:[\"rolebindings\" \"roles\"], APIGroups:[\"\" \"authorization.openshift.io\"], Verbs:[\"create\" \"delete\" \"deletecollection\" \"get\" \"list\" \"patch\" \"update\" \"watch\"]} PolicyRule{Resources:[\"rolebindings\" \"roles\"], APIGroups:[\"rbac.authorization.k8s.io\"], Verbs:[\"create\" \"delete\" \"deletecollection\" \"get\" \"list\" \"patch\" \"update\" \"watch\"]} PolicyRule{Resources:[\"localresourceaccessreviews\" \"localsubjectaccessreviews\" \"subjectrulesreviews\"], APIGroups:[\"\" \"authorization.openshift.io\"], Verbs:[\"create\"]} PolicyRule{Resources:[\"podsecuritypolicyreviews\" \"podsecuritypolicyselfsubjectreviews\" \"podsecuritypolicysubjectreviews\"], APIGroups:[\"\" \"security.openshift.io\"], Verbs:[\"create\"]} PolicyRule{Resources:[\"localsubjectaccessreviews\"], APIGroups:[\"authorization.k8s.io\"], Verbs:[\"create\"]} PolicyRule{Resources:[\"rolebindingrestrictions\"], APIGroups:[\"\" \"authorization.openshift.io\"], Verbs:[\"get\" \"list\" \"watch\"]} PolicyRule{Resources:[\"buildconfigs\" \"buildconfigs/webhooks\" \"builds\"], APIGroups:[\"\" \"build.openshift.io\"], Verbs:[\"create\" \"delete\" \"deletecollection\" \"get\" \"list\" \"patch\" \"update\" \"watch\"]} PolicyRule{Resources:[\"builds/log\"], APIGroups:[\"\" \"build.openshift.io\"], Verbs:[\"get\" \"list\" \"watch\"]} PolicyRule{Resources:[\"buildconfigs/instantiate\" \"buildconfigs/instantiatebinary\" \"builds/clone\"], APIGroups:[\"\" \"build.openshift.io\"], Verbs:[\"create\"]} PolicyRule{Resources:[\"builds/details\"], APIGroups:[\"\" \"build.openshift.io\"], Verbs:[\"update\"]} PolicyRule{Resources:[\"jenkins\"], APIGroups:[\"build.openshift.io\"], Verbs:[\"admin\" \"edit\" \"view\"]} PolicyRule{Resources:[\"deploymentconfigs\" \"deploymentconfigs/scale\"], APIGroups:[\"\" \"apps.openshift.io\"], Verbs:[\"create\" \"delete\" \"deletecollection\" \"get\" \"list\" \"patch\" \"update\" \"watch\"]} PolicyRule{Resources:[\"deploymentconfigrollbacks\" \"deploymentconfigs/instantiate\" \"deploymentconfigs/rollback\"], APIGroups:[\"\" \"apps.openshift.io\"], Verbs:[\"create\"]} PolicyRule{Resources:[\"deploymentconfigs/log\" \"deploymentconfigs/status\"], APIGroups:[\"\" \"apps.openshift.io\"], Verbs:[\"get\" \"list\" \"watch\"]} PolicyRule{Resources:[\"imagestreamimages\" \"imagestreammappings\" \"imagestreams\" \"imagestreams/secrets\" \"imagestreamtags\"], APIGroups:[\"\" \"image.openshift.io\"], Verbs:[\"create\" \"delete\" \"deletecollection\" \"get\" \"list\" \"patch\" \"update\" \"watch\"]} PolicyRule{Resources:[\"imagestreams/status\"], APIGroups:[\"\" \"image.openshift.io\"], Verbs:[\"get\" \"list\" \"watch\"]} PolicyRule{Resources:[\"imagestreams/layers\"], APIGroups:[\"\" \"image.openshift.io\"], Verbs:[\"get\" \"update\"]} PolicyRule{Resources:[\"imagestreamimports\"], APIGroups:[\"\" \"image.openshift.io\"], Verbs:[\"create\"]} PolicyRule{Resources:[\"projects\"], APIGroups:[\"\" \"project.openshift.io\"], Verbs:[\"delete\" \"get\" \"patch\" \"update\"]} PolicyRule{Resources:[\"appliedclusterresourcequotas\"], APIGroups:[\"\" \"quota.openshift.io\"], Verbs:[\"get\" \"list\" \"watch\"]} PolicyRule{Resources:[\"routes\"], APIGroups:[\"\" \"route.openshift.io\"], Verbs:[\"create\" \"delete\" \"deletecollection\" \"get\" \"list\" \"patch\" \"update\" \"watch\"]} PolicyRule{Resources:[\"routes/custom-host\"], APIGroups:[\"\" \"route.openshift.io\"], Verbs:[\"create\"]} PolicyRule{Resources:[\"routes/status\"], APIGroups:[\"\" \"route.openshift.io\"], Verbs:[\"get\" \"list\" \"watch\"]} PolicyRule{Resources:[\"routes/status\"], APIGroups:[\"\" \"route.openshift.io\"], Verbs:[\"update\"]} PolicyRule{Resources:[\"processedtemplates\" \"templateconfigs\" \"templateinstances\" \"templates\"], APIGroups:[\"\" \"template.openshift.io\"], Verbs:[\"create\" \"delete\" \"deletecollection\" \"get\" \"list\" \"patch\" \"update\" \"watch\"]} PolicyRule{Resources:[\"buildlogs\"], APIGroups:[\"\" \"build.openshift.io\"], Verbs:[\"create\" \"delete\" \"deletecollection\" \"get\" \"list\" \"patch\" \"update\" \"watch\"]} PolicyRule{Resources:[\"resourcequotausages\"], APIGroups:[\"\"], Verbs:[\"get\" \"list\" \"watch\"]} PolicyRule{Resources:[\"resourceaccessreviews\" \"subjectaccessreviews\"], APIGroups:[\"\" \"authorization.openshift.io\"], Verbs:[\"create\"]}]"
      },
      {
        "message": "ruleResolutionErrors=[]"
      }
    ]
  },
  "code": 403
}]
F1017 16:09:01.798138   17130 helpers.go:120] Error from server (Forbidden): roles.rbac.authorization.k8s.io "foo" is forbidden: attempt to grant extra privileges

So oc and kubectl will have to be updated to do a better job of showing causes. Seems like a decent amount of upstream work.

[spadgett]

There are a few things we can do:

1. Handle extremely large messages differently in toast notifications. If it's larger than a certain size, show it in a dialog when "See All" is clicked? Or there is the simple fix of adding a max-height and scrollbar so it at least doesn't go offscreen.
2. Handle errors specially on the membership page if we know we will get messages like this. We could show it in a dialog for instance instead of toast for instance.

[benjaminapetersen]

The point of that error message it to be complete, so it shows everything:

Hmm. So:

Reason: "Reason: rolebindings "system:controller:attachdetach-controller" is forbidden: attempt to grant extra privileges: [too many things to see if there is more to this message....]

I'm betting there is more to this error message, but it is shoving such a large set of data in there that I can't find the rest of the sentence. Still thinking this is not the most usable option.

[rhamilto]

Handle extremely large messages differently in toast notifications. If it's larger than a certain size, show it in a dialog when "See All" is clicked? Or there is the simple fix of adding a max-height and scrollbar so it at least doesn't go offscreen.

This isn't horrible?

.toast-notification-details {
    margin-right: -15px;
    max-height: 300px;
    overflow-y: auto;
}

[benjaminapetersen]

Is better, but is it usable...?