Admin role is not allowing the head verb

[simon3z]

The admin role (and probably other), cannot use the head verb:

curl -v -k -H 'Authorization: Bearer <token>' -X HEAD \
  https://<apiserver>:8443/api/v1/namespaces/<namespace>/pods/<pod>
< HTTP/1.1 403 Forbidden
< Cache-Control: no-store
< Content-Type: application/json
< Date: Thu, 19 Nov 2015 22:39:59 GMT
< Content-Length: 384

This may not be particularly interesting for the kubernetes/openshift api but it applies also to the proxy, effectively preventing admins from using head on any rest-api served by pods and services.

cc @deads2k @liggitt

[deads2k]

I'm assuming this permission is leading to the ClusterRole here: https://github.com/simon3z/manageiq.org/blob/containers-docs/source/documentation/getting-started.html.md#service-accounts ?

[deads2k]

I'm assuming this permission is leading to the ClusterRole here: https://github.com/simon3z/manageiq.org/blob/containers-docs/source/documentation/getting-started.html.md#service-accounts ?

[deads2k]

@liggitt You want to explicitly list the head verb or assume that our API works correctly and power to get implies power to head?

[deads2k]

@liggitt You want to explicitly list the head verb or assume that our API works correctly and power to get implies power to head?

[simon3z]

I'm assuming this permission is leading to the ClusterRole here:

@deads2k correct (there should be a note in that doc to this Issue).

@liggitt You want to explicitly list the head verb or assume that our API works correctly and power to get implies power to head

Adding head didn't work for me. Maybe I overlooked something (or maybe head is not expected as verb).

[simon3z]

I'm assuming this permission is leading to the ClusterRole here:

@deads2k correct (there should be a note in that doc to this Issue).

@liggitt You want to explicitly list the head verb or assume that our API works correctly and power to get implies power to head

Adding head didn't work for me. Maybe I overlooked something (or maybe head is not expected as verb).

[liggitt]

@simon3z head method wasn't handled at all. https://github.com/openshift/origin/pull/5985/files#diff-d8a717a6f0dc0916348eea8de58caac5R505 maps it to "get" for API requests

[liggitt]

@simon3z head method wasn't handled at all. https://github.com/openshift/origin/pull/5985/files#diff-d8a717a6f0dc0916348eea8de58caac5R505 maps it to "get" for API requests