running all-in-one openshift on localhost: lots of 403

[TomasTomecek]

Running it as openshift start --loglevel=5 --listen=https://127.0.0.1:8443/ --master=https://127.0.0.1:8443/

First error:

E0318 04:16:23.100578   32410 publish.go:61] Can't create master namespace: namespaces "default" already exists

and plenty of these:

E0318 04:16:23.553728   32410 master.go:398] Error creating namespace: &{{ } {master    10c2c53f-cd47-11e4-b68e-fa163ed7ae77  2015-03-18 04:16:23.552951598 -0400 EDT map[] map[]} {} {}} due to request [&{Method:POST URL:https://127.0.0.1:8443/v1beta1/namespaces Proto:HTTP/1.1 ProtoMajor:1 ProtoMinor:1 Header:map[] Body:{Reader:} ContentLength:172 TransferEncoding:[] Close:false Host:127.0.0.1:8443 Form:map[] PostForm:map[] MultipartForm:<nil> Trailer:map[] RemoteAddr: RequestURI: TLS:<nil>}] failed (403) 403 Forbidden: Forbidden: "/v1beta1/namespaces" denied by default

E0318 04:16:23.725934   32410 reflector.go:85] Failed to list *api.Pod: request [&{Method:GET URL:https://127.0.0.1:8443/v1beta1/pods?fields=DesiredState.Host%3D&namespace= Proto:HTTP/1.1 ProtoMajor:1 ProtoMinor:1 Header:map[] Body:<nil> ContentLength:0 TransferEncoding:[] Close:false Host:127.0.0.1:8443 Form:map[] PostForm:map[] MultipartForm:<nil> Trailer:map[] RemoteAddr: RequestURI: TLS:<nil>}] failed (403) 403 Forbidden: Forbidden: "/v1beta1/pods?fields=DesiredState.Host%3D&namespace=" denied by default

Looks like that everything ends with 403.

0.4.1 release

EDIT: auth setup:

OPENSHIFT_OAUTH_REQUEST_HANDLERS="requestheader,basicauth,session,bearer"

[deads2k]

First error:

benign

[deads2k]

Can you give a pastebin of the whole log, are you setting any authentication environment variables, and what is your authentication config?

[TomasTomecek]

resolution: the issue was trailing slashes, therefore it should be:

--listen=https://127.0.0.1:8443 --master=https://127.0.0.1:8443

[deads2k]

Just adding information as I find it. The issue isn't with the master config, it's with the generated .kubeconfig files. They include a server stanza like:

    server: https://127.0.0.1:8443/

which causes the client to build URLs like https://127.0.0.1:8443/v1beta1/deploymentConfigs?namespace= instead of https://127.0.0.1:8443/api./v1beta1/deploymentConfigs?namespace=

[deads2k]

Alright, found it in the code. Feature, not a bug. The trailing / indicates a URL path. If you were hosting your API on a different context root, then this would be the only way you had to describe the "no prefix on my api" case. See code: https://github.com/GoogleCloudPlatform/kubernetes/blob/master/pkg/client/helper.go#L307.

@liggitt I think we should strip a trailing URL path / on the openshift command line, but allow them in the .kubeconfig and in the master.yaml files. That prevents common fat-fingering and delivers expected behavior, but still allows the construct. If you agree, I'll put it together.