Skip to content

Improve error when SCC admission fails to create SecurityContextConstraintsProvider#22724

Merged
openshift-merge-robot merged 1 commit intoopenshift:masterfrom
sallyom:improve-err-msg-for-scc-failures
May 2, 2019
Merged

Improve error when SCC admission fails to create SecurityContextConstraintsProvider#22724
openshift-merge-robot merged 1 commit intoopenshift:masterfrom
sallyom:improve-err-msg-for-scc-failures

Conversation

@sallyom
Copy link
Copy Markdown
Contributor

@sallyom sallyom commented Apr 30, 2019

@deads2k
So the next person who messes with SCC admission has a better experience.

@openshift-ci-robot openshift-ci-robot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Apr 30, 2019
deads2k
deads2k reviewed Apr 30, 2019
View reviewed changes
Comment thread pkg/security/apiserver/admission/sccadmission/admission.go
@sallyom sallyom force-pushed the improve-err-msg-for-scc-failures branch from 4c4404e to 943f8f6 Compare April 30, 2019 15:55
deads2k
deads2k reviewed Apr 30, 2019
View reviewed changes
Comment thread pkg/security/apiserver/admission/sccadmission/admission.go
return nil, "", nil, admission.NewForbidden(a, err)
}
if len(constraints) == 0 {
return nil, "", nil, admission.NewForbidden(a, fmt.Errorf("no SecurityContextConstraints found in namespace %s", a.GetNamespace()))
Copy link
Copy Markdown
Contributor

@deads2k deads2k Apr 30, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wrong spot. YOu can still have a message here about no matching constraints for namespace, but do a separate list above this.

Copy link
Copy Markdown
Contributor Author

@sallyom sallyom Apr 30, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

only list all if didn't find any in the ns?

@sallyom sallyom force-pushed the improve-err-msg-for-scc-failures branch from 943f8f6 to 1352136 Compare April 30, 2019 17:53
@openshift-ci-robot openshift-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Apr 30, 2019
@sallyom
Copy link
Copy Markdown
Contributor Author

sallyom commented Apr 30, 2019

ok, so now installs are failing, in events I see 21 times:
"message": "Error creating: pods \"some-operator-7cd445d69-\" is forbidden: no SecurityContextConstraints found in cluster",
so.. that's not quite right.

@sallyom sallyom force-pushed the improve-err-msg-for-scc-failures branch from 1352136 to 863064c Compare May 1, 2019 00:09
@sallyom
Copy link
Copy Markdown
Contributor Author

sallyom commented May 1, 2019

/test e2e-aws

@deads2k
Copy link
Copy Markdown
Contributor

deads2k commented May 2, 2019

/lgtm

@openshift-ci-robot openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label May 2, 2019
@openshift-ci-robot
Copy link
Copy Markdown

openshift-ci-robot commented May 2, 2019

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deads2k, sallyom

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci-robot openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 2, 2019
@openshift-merge-robot openshift-merge-robot merged commit 00a7323 into openshift:master May 2, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@deads2k deads2k deads2k left review comments

@enj enj Awaiting requested review from enj

@pweil- pweil- Awaiting requested review from pweil-

Assignees

@deads2k deads2k

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@sallyom @deads2k @openshift-ci-robot @openshift-merge-robot