kubeconfig: remove default namespace from crc-developer context #4420
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
| return err | ||
| } | ||
|
|
||
| developerToken, err := getTokenForUser("developer", "developer", ip, ca, clusterConfig, ingressHTTPSPort) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| if err := addContext(cfg, clusterConfig.ClusterAPI, developerContext, "developer", developerToken); err != nil { | ||
| if err := addContext(cfg, clusterConfig.ClusterAPI, developerContext, "developer", developerToken, ""); err != nil { |
There was a problem hiding this comment.
what happens with the namespace set to "" ?
There was a problem hiding this comment.
with an empty namespace in the context we still get the same error, but oc config get-contexts no longer shows a namespace for the crc-developer context
% oc config get-contexts
CURRENT NAME CLUSTER AUTHINFO NAMESPACE
crc-admin api-crc-testing:6443 kubeadmin/api-crc-testing:6443 default
* crc-developer api-crc-testing:6443 developer/api-crc-testing:6443
There was a problem hiding this comment.
It is not only that but now when user try to check project switch to any project then it provide better error message instead forbidden error, we should have that as part of commit log.
$ oc config get-contexts
CURRENT NAME CLUSTER AUTHINFO NAMESPACE
crc-admin api-crc-testing:6443 kubeadmin/api-crc-testing:6443 default
* crc-developer api-crc-testing:6443 developer/api-crc-testing:6443
$ oc project
No project has been set. Pass a project name to make that the default.
$ oc project demo
error: You are not a member of project "demo".
You are not a member of any projects. You can request a project to be created with the 'new-project' command.
There was a problem hiding this comment.
These are good reasons for the change, thanks for the explanations. Can this be added to the commit log?
There was a problem hiding this comment.
Thanks, i've updated the commit log to contain the error messages shown after the changes in this PR
| "foo/abcdd-api-com", | ||
| }, | ||
| { | ||
| input{"https://api.crc.testing:6443", "kubeadmin", "kubeadm", "secretToken"}, | ||
| input{"https://api.crc.testing:6443", "kubeadmin", "kubeadm", "secretToken", "default"}, | ||
| "kubeadmin/api-crc-testing:6443", | ||
| }, |
There was a problem hiding this comment.
@anjannath we should add one more test case which have empty string as namespace which make sure the context is added to kubeconfig but without namespace.
anjannath
force-pushed
the
con-dev
branch
3 times, most recently
from
f9b00f5
to
5237225
Compare
the 'developer' user don't have the required role-bindings to access
the 'default' namespace and when user tries to access it we get:
```
Error from server (Forbidden): pods is forbidden: User "developer" cannot list resource "pods" in API group "" in the namespace "default"
```
with the changes in this commit, we get a better error message:
```
$ oc config get-contexts
CURRENT NAME CLUSTER AUTHINFO NAMESPACE
crc-admin api-crc-testing:6443 kubeadmin/api-crc-testing:6443 default
* crc-developer api-crc-testing:6443 developer/api-crc-testing:6443
$ oc project
No project has been set. Pass a project name to make that the default.
$ oc project demo
error: You are not a member of project "demo".
You are not a member of any projects. You can request a project to be created with the 'new-project' command.
```
fixes crc-org/snc#703
|
@anjannath: The following test failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
the 'developer' user don't have the required role-bindings to access the 'default' namespace and when user tries to access it we get:
fixes crc-org/snc#703