build-logs for running build tells me "build not found"

[thoraxe]

[root@ose3-master openshift-ansible]# osc get build -n sinatra
NAME                             TYPE      STATUS    POD
simple-openshift-sinatra-sti-1   STI       Running   simple-openshift-sinatra-sti-1
[root@ose3-master openshift-ansible]# osc build-logs -n sinatra simple-openshift-sinatra-sti-1
Error from server: Build: not found 'simple-openshift-sinatra-sti-1'

osc version
osc v0.4.3.1
kubernetes v0.14.1-582-gb12d75d

[brenton]

@abhgupta, please excuse the noise. I thought this was a different issue.

@bparees, any idea who could investigate this?

[bparees]

@Kargakis you've been in this space relatively recently, can you take a look?

[smarterclayton]

This is a dupe of an existing issue, but started with the last rebase.

[0xmichalis]

@Kargakis you've been in this space relatively recently, can you take a look?

Sure, will do tomorrow.

[0xmichalis]

Hmm, doesn't seem I can reproduce this in the current master neither with build-logs nor with start-build --follow

[smarterclayton]

Try commenting out the set +e I added to test end to end.

It looks like it happens after builds complete.

On Apr 15, 2015, at 9:19 AM, Michail Kargakis notifications@github.com wrote:

Hmm, doesn't seem I can reproduce this in the current master neither with build-logs nor with start-build --follow

—
Reply to this email directly or view it on GitHub.

[0xmichalis]

@thoraxe can you

1. get the build-logs from a build in the default namespace?
2. process a template in another namespace than default?
   eg.

osc process -n test -f examples/sample-app/application-template-stibuild.json

[sdodson]

Both the default and a created namespace works as 'system:openshift-client' user. I suspect this is a user permissoins issue, it doesn't work as 'joe' which is a user defined via htpasswd identity provider.

Default namespace -- works

osc process -f examples/sample-app/application-template-stibuild.json > test.json
osc create -f test.json 
osc get builds
osc build-logs ruby-sample-build-1

Make a new namespace, re-test -- works

openshift admin new-project --admin=system:openshift-client issue1714
osc create -n issue1714 -f test.json 
osc get builds -n issue1714
osc build-logs -n issue1714 ruby-sample-build-1

Here it is as 'joe'

[joe@ose3 ~]$ osc login
Already logged into "https://ose3.os1.phx2.redhat.com:8443" as "joe".
Using project "sinatra"
[joe@ose3 ~]$ osc create -f test.json 
services/frontend
routes/route-edge
imageStreams/origin-ruby-sample
imageStreams/ruby-20-centos7
buildConfigs/ruby-sample-build
deploymentConfigs/frontend
services/database
deploymentConfigs/database
[joe@ose3 ~]$ osc get builds
NAME                             TYPE      STATUS     POD
ruby-sample-build-1              STI       Running    ruby-sample-build-1
simple-openshift-sinatra-sti-1   STI       Complete   simple-openshift-sinatra-sti-1
[joe@ose3 ~]$ osc build-logs ruby-sample-build-1
Error from server: "/osapi/v1beta1/proxy/buildLogs/ruby-sample-build-1?namespace=sinatra" is forbidden because joe cannot proxy on buildLogs with name "ruby-sample-build-1" in sinatra

[smarterclayton]

@csrwng please get involved here as well

[csrwng]

So the issue is that because we are now using the proxy to get at the build logs, we're exposing an issue in the Kubernetes proxy. It is responding with a 301 because the original request doesn't end with a "/" in the path, but the location in the 301 response doesn't include parameters that were passed in the original response, so we lose the namespace parameter:
A request to

https://10.0.2.15:8443/osapi/v1beta1/proxy/buildLogs/simple-openshift-sinatra-sti-1?namespace=project1

results in a 301 like:

HTTP/1.1 301 Moved Permanently
Location: /osapi/v1beta1/proxy/buildLogs/simple-openshift-sinatra-sti-1/

which doesn't include the namespace param.
Offending code is here:
https://github.com/GoogleCloudPlatform/kubernetes/blob/master/pkg/apiserver/proxy.go#L197-L201

I'll submit a fix for the proxy upstream and switch the origin build logs to use the new log sub-resource.

[csrwng]

Fixed with #1784

[brenton]

@csrwng, even after pulling in #1784 I'm seeing:

# osc build-logs simple-openshift-sinatra-sti-1
Error from server: "/osapi/v1beta1/proxy/buildLogs/simple-openshift-sinatra-sti-1?namespace=sinatra" is forbidden because joe cannot proxy on buildLogs with name "simple-openshift-sinatra-sti-1" in sinatra

Joe is the admin for the sinatra project.

[brenton]

cesar explains the fix for me in more detail. It this actually working as expected with the known current issue of only the admin's being able to access logs.