Kubeapps: Unable to login in Kubeapps deployed on Openshift (minishift)
I am attempting to spin up Kubeapps inside Openshift (using minishift). Kubeapps starts as expected however when attempting to login for the first time using a user token the below error is returned from
http://kubeapps-myproject.10.0.75.240.nip.io/api/tiller-deploy/v1/namespaces/default/releases
an error on the server ("This request caused apiserver to panic. Look in the logs for details.") has prevented the request from succeeding (post selfsubjectrulesreviews.authorization.k8s.io)
Is there a way to work around this or is it a minishift/openshift issue?
kinbug
sl33kr
All 9 comments
Thanks for filing the issue @sl33kr. Could you let us know what version fo OpenShift you're using? A quick look at the docs suggest that the issue might be that the SelfSubjectRulesReviews API is under the authorization.openshift.io api group instead of authorization.k8s.io in vanilla Kubernetes.
We will need to look into how to use this API across both vanilla Kubernetes and OpenShift.
cc @andresmgot
prydonius
on 3 Oct 2018
Hi sorry for some reason I thought I had included that.
I'm running in minishift 1.24.0 using Openshift v3.10.0.
sl33kr
on 3 Oct 2018
👍1
I could confirm the issue.
{
"code": 401,
"message": "an error on the server (\"This request caused apiserver to panic. Look in the logs for details.\") has prevented the request from succeeding (post selfsubjectrulesreviews.authorization.k8s.io)"
}
this was the entry in the log
E1022 16:12:24.533389 1 runtime.go:66] Observed a panic: "invalid memory address or nil pointer dereference" (runtime error: invalid memory address or nil pointer dereference)
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/apimachinery/pkg/util/runtime/runtime.go:72
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/apimachinery/pkg/util/runtime/runtime.go:65
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/apimachinery/pkg/util/runtime/runtime.go:51
/usr/local/go/src/runtime/asm_amd64.s:573
/usr/local/go/src/runtime/panic.go:502
/usr/local/go/src/runtime/panic.go:63
/usr/local/go/src/runtime/signal_unix.go:388
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/kubernetes/pkg/registry/authorization/selfsubjectrulesreview/rest.go:61
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/apiserver/pkg/endpoints/handlers/create.go:167
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/apiserver/pkg/endpoints/handlers/create.go:111
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/apiserver/pkg/endpoints/handlers/rest.go:182
/usr/local/go/src/runtime/asm_amd64.s:2361
E1022 16:12:24.533618 1 runtime.go:66] Observed a panic: "invalid memory address or nil pointer dereference" (runtime error: invalid memory address or nil pointer dereference)
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/apimachinery/pkg/util/runtime/runtime.go:72
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/apimachinery/pkg/util/runtime/runtime.go:65
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/apimachinery/pkg/util/runtime/runtime.go:51
/usr/local/go/src/runtime/asm_amd64.s:573
/usr/local/go/src/runtime/panic.go:502
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/apiserver/pkg/server/filters/timeout.go:101
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/apiserver/pkg/server/filters/waitgroup.go:51
/usr/local/go/src/net/http/server.go:1947
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/apiserver/pkg/endpoints/filters/requestinfo.go:45
/usr/local/go/src/net/http/server.go:1947
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/apiserver/pkg/endpoints/request/requestcontext.go:110
/usr/local/go/src/net/http/server.go:1947
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/apiserver/pkg/server/filters/wrap.go:41
/usr/local/go/src/net/http/server.go:1947
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/pkg/cmd/server/origin/handlers.go:171
/usr/local/go/src/net/http/server.go:1947
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/pkg/cmd/server/origin/handlers.go:54
/usr/local/go/src/net/http/server.go:1947
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/pkg/cmd/server/origin/webconsole_proxy.go:39
/usr/local/go/src/net/http/server.go:1947
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/pkg/cmd/server/origin/webconsole_proxy.go:49
/usr/local/go/src/net/http/server.go:1947
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/pkg/cmd/server/origin/master.go:466
/usr/local/go/src/net/http/server.go:1947
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/apiserver/pkg/server/handler.go:197
/usr/local/go/src/net/http/server.go:2694
/usr/local/go/src/net/http/server.go:3260
/usr/local/go/src/net/http/h2_bundle.go:5475
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/golang.org/x/net/http2/server.go:2053
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/golang.org/x/net/http2/server.go:2053
/usr/local/go/src/runtime/asm_amd64.s:2361
E1022 16:12:24.534004 1 wrap.go:34] apiserver panic'd on POST /apis/authorization.k8s.io/v1/selfsubjectrulesreviews: runtime error: invalid memory address or nil pointer dereference
goroutine 284108 [running]:
runtime/debug.Stack(0x6fae0e0, 0xc4306f9570, 0x4ec532b)
/usr/local/go/src/runtime/debug/stack.go:24 +0xa7
github.com/openshift/origin/vendor/k8s.io/apiserver/pkg/server/filters.WithPanicRecovery.func1.1(0x440c960, 0x9853850)
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/apiserver/pkg/server/filters/wrap.go:34 +0x74
github.com/openshift/origin/vendor/k8s.io/apimachinery/pkg/util/runtime.HandleCrash(0xc43393f910, 0x1, 0x1)
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/apimachinery/pkg/util/runtime/runtime.go:54 +0xc7
panic(0x440c960, 0x9853850)
/usr/local/go/src/runtime/panic.go:502 +0x229
github.com/openshift/origin/vendor/k8s.io/apiserver/pkg/server/filters.(*timeoutHandler).ServeHTTP(0xc423cfcae0, 0x6fae0e0, 0xc4306f9570, 0xc42dd86100)
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/apiserver/pkg/server/filters/timeout.go:101 +0x3ff
github.com/openshift/origin/vendor/k8s.io/apiserver/pkg/server/filters.WithWaitGroup.func1(0x6fae0e0, 0xc4306f9570, 0xc42dd86100)
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/apiserver/pkg/server/filters/waitgroup.go:51 +0xeb
net/http.HandlerFunc.ServeHTTP(0xc4272c9fc0, 0x6fae0e0, 0xc4306f9570, 0xc42dd86100)
/usr/local/go/src/net/http/server.go:1947 +0x44
github.com/openshift/origin/vendor/k8s.io/apiserver/pkg/endpoints/filters.WithRequestInfo.func1(0x6fae0e0, 0xc4306f9570, 0xc42dd86100)
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/apiserver/pkg/endpoints/filters/requestinfo.go:45 +0x1f9
net/http.HandlerFunc.ServeHTTP(0xc42694c000, 0x6fae0e0, 0xc4306f9570, 0xc42dd86100)
/usr/local/go/src/net/http/server.go:1947 +0x44
github.com/openshift/origin/vendor/k8s.io/apiserver/pkg/endpoints/request.WithRequestContext.func1(0x6fae0e0, 0xc4306f9570, 0xc42dd86100)
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/apiserver/pkg/endpoints/request/requestcontext.go:110 +0xcb
net/http.HandlerFunc.ServeHTTP(0xc423cfcb00, 0x6fae0e0, 0xc4306f9570, 0xc42dd86100)
/usr/local/go/src/net/http/server.go:1947 +0x44
github.com/openshift/origin/vendor/k8s.io/apiserver/pkg/server/filters.WithPanicRecovery.func1(0x6fae0e0, 0xc4306f9570, 0xc42dd86100)
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/apiserver/pkg/server/filters/wrap.go:41 +0x108
net/http.HandlerFunc.ServeHTTP(0xc423cfcb40, 0x6fa3c60, 0xc42dfda058, 0xc42dd86100)
/usr/local/go/src/net/http/server.go:1947 +0x44
github.com/openshift/origin/pkg/cmd/server/origin.translateLegacyScopeImpersonation.func1(0x6fa3c60, 0xc42dfda058, 0xc42dd86100)
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/pkg/cmd/server/origin/handlers.go:171 +0x264
net/http.HandlerFunc.ServeHTTP(0xc423cfcb80, 0x6fa3c60, 0xc42dfda058, 0xc42dd86100)
/usr/local/go/src/net/http/server.go:1947 +0x44
github.com/openshift/origin/pkg/cmd/server/origin.withCacheControl.func1(0x6fa3c60, 0xc42dfda058, 0xc42dd86100)
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/pkg/cmd/server/origin/handlers.go:54 +0x1d7
net/http.HandlerFunc.ServeHTTP(0xc4266c22a0, 0x6fa3c60, 0xc42dfda058, 0xc42dd86100)
/usr/local/go/src/net/http/server.go:1947 +0x44
github.com/openshift/origin/pkg/cmd/server/origin.withAssetServerRedirect.func1(0x6fa3c60, 0xc42dfda058, 0xc42dd86100)
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/pkg/cmd/server/origin/webconsole_proxy.go:39 +0x6f
net/http.HandlerFunc.ServeHTTP(0xc423cfcbc0, 0x6fa3c60, 0xc42dfda058, 0xc42dd86100)
/usr/local/go/src/net/http/server.go:1947 +0x44
github.com/openshift/origin/pkg/cmd/server/origin.(*MasterConfig).withConsoleRedirection.func1(0x6fa3c60, 0xc42dfda058, 0xc42dd86100)
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/pkg/cmd/server/origin/webconsole_proxy.go:49 +0x1a7
net/http.HandlerFunc.ServeHTTP(0xc4266c2300, 0x6fa3c60, 0xc42dfda058, 0xc42dd86100)
/usr/local/go/src/net/http/server.go:1947 +0x44
github.com/openshift/origin/pkg/cmd/server/origin.WithPatternPrefixHandler.func1(0x6fa3c60, 0xc42dfda058, 0xc42dd86100)
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/pkg/cmd/server/origin/master.go:466 +0x12e
net/http.HandlerFunc.ServeHTTP(0xc42694c040, 0x6fa3c60, 0xc42dfda058, 0xc42dd86100)
/usr/local/go/src/net/http/server.go:1947 +0x44
github.com/openshift/origin/vendor/k8s.io/apiserver/pkg/server.(*APIServerHandler).ServeHTTP(0xc4266c2390, 0x6fa3c60, 0xc42dfda058, 0xc42dd86100)
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/apiserver/pkg/server/handler.go:197 +0x51
net/http.serverHandler.ServeHTTP(0xc425cb6000, 0x6fa3c60, 0xc42dfda058, 0xc42dd86100)
/usr/local/go/src/net/http/server.go:2694 +0xbc
net/http.initNPNRequest.ServeHTTP(0xc42ab32000, 0xc425cb6000, 0x6fa3c60, 0xc42dfda058, 0xc42dd86100)
/usr/local/go/src/net/http/server.go:3260 +0x9a
net/http.(Handler).ServeHTTP-fm(0x6fa3c60, 0xc42dfda058, 0xc42dd86100)
/usr/local/go/src/net/http/h2_bundle.go:5475 +0x4d
github.com/openshift/origin/vendor/golang.org/x/net/http2.(*serverConn).runHandler(0xc42600cc40, 0xc42dfda058, 0xc42dd86100, 0xc42d21e920)
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/golang.org/x/net/http2/server.go:2053 +0x89
created by github.com/openshift/origin/vendor/golang.org/x/net/http2.(*serverConn).processHeaders
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.10.0/_output/local/go/src/github.com/openshift/origin/vendor/golang.org/x/net/http2/server.go:1787 +0x46b
I1022 16:12:24.658932 1 trace.go:76] Trace[111727890]: "Get /api/v1/namespaces/kubeapps/pods/kubeapps-internal-tiller-proxy-9665798c-qfkbw/log" (started: 2018-10-22 15:51:00.641036561 +0000 UTC m=+480.326119881) (total time: 21m24.017852839s):
Trace[111727890]: [21m24.017852839s] [21m24.016494071s] END
migmartri
on 22 Oct 2018
Hello everyone,
I set hostNetwork=true and login with the cluster admin token (oc whoami -t) http://10.10.5.180:8080/login ,
Show this error: "There was an error connecting to the Kubernetes API. Please check that your token is valid".
But my token is correct，What is the problem？
Executed inside the container kubeapps-internal-tiller-proxy
curl --header "Authorization: Bearer $TOKEN" -k https://kubernetes.default.svc.cluster.local
{
"paths": [
"/api",
"/api/v1",
"/apis",
"/apis/",
"/apis/admissionregistration.k8s.io",
"/apis/admissionregistration.k8s.io/v1beta1",
"/apis/apiextensions.k8s.io",
"/apis/apiextensions.k8s.io/v1beta1",
"/apis/apiregistration.k8s.io",
"/apis/apiregistration.k8s.io/v1",
"/apis/apiregistration.k8s.io/v1beta1",
"/apis/apps",
"/apis/apps.openshift.io",
"/apis/apps.openshift.io/v1",
"/apis/apps/v1",
"/apis/apps/v1beta1",
"/apis/apps/v1beta2",
"/apis/policy",
"/apis/policy/v1beta1",
"/apis/project.openshift.io",
"/apis/project.openshift.io/v1",
"/apis/quota.openshift.io",
"/apis/quota.openshift.io/v1",
"/apis/rbac.authorization.k8s.io",
"/apis/rbac.authorization.k8s.io/v1",
"/apis/rbac.authorization.k8s.io/v1beta1",
"/apis/rbac.istio.io",
"/apis/rbac.istio.io/v1alpha1",
"/apis/rook.io",
"/apis/rook.io/v1alpha2",
"/apis/route.openshift.io",
"/apis/route.openshift.io/v1",
"/apis/scheduling.k8s.io",
"/apis/scheduling.k8s.io/v1beta1",
"/apis/security.openshift.io",
"/apis/security.openshift.io/v1",
"/apis/serving.knative.dev",
"/apis/serving.knative.dev/v1alpha1",
"/apis/sources.eventing.knative.dev",
"/apis/sources.eventing.knative.dev/v1alpha1",
"/apis/storage.k8s.io",
"/apis/storage.k8s.io/v1",
"/apis/storage.k8s.io/v1beta1",
"/apis/template.openshift.io",
"/apis/template.openshift.io/v1",
"/apis/user.openshift.io",
"/apis/user.openshift.io/v1",
"/healthz",
"/healthz/autoregister-completion",
"/healthz/etcd",
"/healthz/log",
"/healthz/ping",
"/healthz/poststarthook/apiservice-openapi-controller",
"/healthz/poststarthook/apiservice-registration-controller",
"/healthz/poststarthook/apiservice-status-available-controller",
"/healthz/poststarthook/authorization.openshift.io-bootstrapclusterroles",
"/healthz/poststarthook/authorization.openshift.io-ensureopenshift-infra",
"/healthz/poststarthook/bootstrap-controller",
"/healthz/poststarthook/ca-registration",
"/healthz/poststarthook/generic-apiserver-start-informers",
"/healthz/poststarthook/image.openshift.io-apiserver-caches",
"/healthz/poststarthook/kube-apiserver-autoregistration",
"/healthz/poststarthook/oauth.openshift.io-startoauthclientsbootstrapping",
"/healthz/poststarthook/openshift.io-restmapperupdater",
"/healthz/poststarthook/openshift.io-startinformers",
"/healthz/poststarthook/openshift.io-webconsolepublicurl",
"/healthz/poststarthook/project.openshift.io-projectauthorizationcache",
"/healthz/poststarthook/project.openshift.io-projectcache",
"/healthz/poststarthook/quota.openshift.io-clusterquotamapping",
"/healthz/poststarthook/rbac/bootstrap-roles",
"/healthz/poststarthook/scheduling/bootstrap-system-priority-classes",
"/healthz/poststarthook/security.openshift.io-bootstrapscc",
"/healthz/poststarthook/start-apiextensions-controllers",
"/healthz/poststarthook/start-apiextensions-informers",
"/healthz/poststarthook/start-kube-aggregator-informers",
"/healthz/ready",
"/metrics",
"/oapi",
"/oapi/v1",
"/openapi/v2",
"/swagger-2.0.0.json",
"/swagger-2.0.0.pb-v1",
"/swagger-2.0.0.pb-v1.gz",
"/swagger.json",
"/swaggerapi",
"/version",
"/version/openshift"
]
}
Execute with the same token，can return correct data
kubectl get pods --token=IabiX75opbh9fxJrQN-bov67eCeO9OLawgl4LgiHblY
NAME READY STATUS RESTARTS AGE
kubeapps-77bbf8957f-swnwq 1/1 Running 0 46m
kubeapps-internal-apprepository-controller-6d647cffd-4d5cx 1/1 Running 0 33m
kubeapps-internal-chartsvc-79b55db4b-hvk42 1/1 Running 0 47m
kubeapps-internal-dashboard-54d45495cc-sw5kf 1/1 Running 0 14m
kubeapps-internal-tiller-proxy-7f67dc4986-rklhp 1/1 Running 0 33m
kubeapps-mongodb-5458b5c6f8-sqbx5 1/1 Running 0 3d
curl --header "Authorization: Bearer $TOKEN" -k https://kubernetes.default/v1/namespaces/default/releases
{
"paths": [
"/apis",
"/apis/",
"/apis/apiextensions.k8s.io",
"/apis/apiextensions.k8s.io/v1beta1",
"/metrics",
"/version"
]
}
ConfigMap: kubeapps-frontend-config
apiVersion: v1
data:
vhost.conf: >-
# Retain the default nginx handling of requests without a "Connection"
header
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
# Allow websocket connections
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
server {
listen 8080;
server_name _;
location /healthz {
access_log off;
default_type text/plain;
return 200 "healthy\n";
}
location /api/kube {
rewrite /api/kube/(.*) /$1 break;
rewrite /api/kube / break;
proxy_pass https://kubernetes.default.svc.cluster.local:443;
# Disable buffering for log streaming
proxy_buffering off;
# Hide Www-Authenticate to prevent it triggering a basic auth prompt in
# the browser with some clusters
proxy_hide_header Www-Authenticate;
# Keep the connection open with the API server even if idle (the default is 60 seconds)
# Setting it to 1 hour which should be enough for our current use case of deploying/upgrading apps
# If we enable other use-cases in the future we might need to bump this value
# More info here https://github.com/kubeapps/kubeapps/issues/766
proxy_read_timeout 1h;
}
location /api/chartsvc {
rewrite /api/chartsvc/(.*) /$1 break;
rewrite /api/chartsvc / break;
proxy_pass http://kubeapps-internal-chartsvc.kubeapps.svc.cluster.local:8080;
}
location /api/tiller-deploy {
# Keep the connection open with the API server even if idle (the default is 60 seconds)
# Setting it to 10 minutes which should be enough for our current use case of deploying/upgrading/deleting apps
proxy_read_timeout 10m;
rewrite /api/tiller-deploy/(.*) /$1 break;
rewrite /api/tiller-deploy / break;
proxy_pass http://kubeapps-internal-tiller-proxy.kubeapps.svc.cluster.local:8080;
}
location / {
proxy_pass http://kubeapps-internal-dashboard.kubeapps.svc.cluster.local:8080;
}
}
kind: ConfigMap
aland-zhang
on 18 Dec 2018
Hey @aland-zhang, unfortunately OpenShift isn't supported yet by Kubeapps, see https://github.com/kubeapps/kubeapps/issues/676#issuecomment-436015118 for more information about the present issues.
Do you have the logs from your API server? There might be a similar issue as above, where the API server crashes when connecting from Kubeapps.
prydonius
on 19 Dec 2018
This is reproducible with OpenShift 3.10 via kubectl:
kubectl create -f - -o yaml << EOF
apiVersion: authorization.k8s.io/v1
kind: SelfSubjectRulesReview
spec:
namespace: default
EOF
Error from server (InternalError): error when creating "STDIN": an error on the server ("This request caused apiserver to panic. Look in the logs for details.") has prevented the request from succeeding (post selfsubjectrulesreviews.authorization.k8s.io)
As @prydonius guessed, using the openshift specific api group works fine in 3.10:
kubectl create -f - -o yaml << EOF
apiVersion: authorization.openshift.io/v1
kind: SelfSubjectRulesReview
spec:
namespace: default
EOF
apiVersion: authorization.openshift.io/v1
kind: SelfSubjectRulesReview
spec:
scopes: null
status:
rules:
- apiGroups:
- ""
...
On a 3.11 Openshift cluster, both api groups work:
$ oc version
oc v3.11.0+0cbc58b
kubernetes v1.11.0+d4cacc0
features: Basic-Auth GSSAPI Kerberos SPNEGO
Server https://192.168.42.36:8443
kubernetes v1.11.0+d4cacc0
$ kubectl create -f - -o yaml << EOF > rulesreview-k8s.yaml
apiVersion: authorization.k8s.io/v1
kind: SelfSubjectRulesReview
spec:
namespace: default
EOF
$ kubectl create -f - -o yaml << EOF > rulesreview-openshift.yaml
apiVersion: authorization.openshift.io/v1
kind: SelfSubjectRulesReview
spec:
namespace: default
EOF
The output is not identical (openshift appears to group the output differently).
Anyway, for Kubeapps to therefore support Openshift pre 3.11, we'd need to either stop using this apigroup, or provide an --authorization-api-group arg which defaults to authorization.k8s.io but can be set as required for openshift.
absoludity
on 22 Oct 2019
IMO I would not add support for Openshift 3.10 (since we don't know how the auth flow will work for Helm 3).
andresmgot
on 22 Oct 2019
Yeah, nor do we have any need to (and OpenShift is moving to 4.x and Kubeapps works with 3.11 already)
absoludity
on 23 Oct 2019
🎉1
I'm closing this given that we can demonstrate that it only affects Minishift with 3.10 (where the standard api group, rather than the openshift one, results in the panic) - and works fine with Minishift 3.11 as above.
We could work around it in 3.10 as well, but it doesn't seem worthwhile.
absoludity
on 1 Nov 2019
Was this page helpful?
0 / 5 - 0 ratings
Related issues
absoludity
·
8Comments
prydonius
·
5Comments
rarick
·
7Comments
doracl
·
7Comments
migmartri
·
4Comments