oc:build on openshift use pods/log to retrieve logs from build #2844
Comments
rohanKanojia
added
enhancement
|
I would like to work on this bug. |
|
@arsenalzp : This issue requires knowledge of Kubernetes and a Red Hat OpenShift cluster. Here is the code where we're trying to get logs of OpenShift Build Pod: |
|
Yes, I have enough knowledge of both solutions. Any way, if questions will arise I can ask this friendly community. |
|
Could you please assign it to me? Is there any deadline for this issue? |
@arsenalzp : Not that I know of, the user is able to perform build. He is only concerned about the warning due to additional permissions jkube is requesting. |
|
I've just tried to reproduce this issue on my sandbox, new service account was created, bound to the role below, related BuildConfig was also changed: Try to run As you may see no errors are observed. |
|
@arsenalzp : The problem @sbollwe is facing is due to using a ServiceAccount with restricted permissions, You would need to create a more strict Role and bind it to some ServiceAccount, then use that ServiceAccount. |
As you might see in my previous message I created the So it doesn't allow access to Check whether an action is allowed: |
|
@arsenalzp Could you please share your Role, RoleBinding and ServiceAccount YAML snippets that you're trying? The code snippet I had shared earlier is watching pod logs, it's quite strange that you're not getting the warning given that your ServiceAccount doesn't have permission. |
Yes, sure: Role RoleBinding ServiceAccount: @rohanKanojia I'm checking whether an action is allowed: As you may see neither get of |
|
Hello colleagues, |
|
@arsenalzp : Sorry, I didn't get time to look into it. I'll try to spend some time to reproduce it today. |
|
Are you sure that jkube is picking the correct ServiceAccount token while applying these objects onto OpenShift? If you're using this outside the cluster, I think jkube is going to pick up token from your local You can either try to create a tekton pipeline with configured ServiceAccount to build the application or copy the ServiceAccount token into your kubeconfig (just for the sake of testing). You should be able to see it in the secret created for that particular ServiceAccount: You can copy token from there and put this in kube config: users:
- name: developer/api-crc-testing:6443
user:
token: <jkubebuilder-access-token>With this, you should be able to test your ServiceAccount permissions from outside the cluster. |
Sorry for delay. by the following one: It works. But, that change is causing a failure of I suppose that's because neither I tried to set the labels by using the following part of code
however, labels weren't applied to resources. |
|
@rohanKanojia could you please be so kind to review how to properly label resources by using |
|
@arsenalzp : Are you talking about OpenShiftBuildServiceIntegrationTest ? I think you will need to add a new Kubernetes Server Mock(we use this testing library to mock Kubernetes API,see example in this blogpost) expectation for the code change you've done: |
Sorry I'm disturbing you! |
Not at all, it's part of our job to provide feedback and help to contributors. You're helping us a lot with your contributions, it doesn't take that much effort to compose a reply. If you want to communicate via chat, please don't hesitate to reach out to us on internal slack channel or Gitter channel. |
Hello support,
We running the openshift-maven-plugin against our openshift cluster to build images. The build its self works and pushes to artifactory without any errors.
But we got this message, which shows an error retrieving the logs for that build job.
The message shows that the plugin need access to the resource of pods/log. If I test this with the oc command (oc logs -f build/app-s2i-9), I can retrieve the logs with a service account without access to pods/log.
The service account is defined with the following rules:
In my opinion, the builds/log resource access should be sufficient to retrive the logs of oc:build. Can you adjust this, as it's not a good idea to give more rights than necessary.
openshift-maven-plugin: 1.16.1
Thanks for your work and best regards,
Steffen
The text was updated successfully, but these errors were encountered: