Configured service account doesn't have access to execute GET request

[dzianis-shkindzerau]

When I apply the scdf-ephemeral-datasources-template.yaml template instead of a project named scdf, the failure happens in SCDF logs (full log: log.txt):

2016-12-23 13:48:40.163 WARN 1 --- [ main] i.f.s.cloud.kubernetes.StandardPodUtils : Failed to get pod with name:[scdf-ephemeral-2-evs6k]. You should look into this if things aren't working as you expect. Are you missing serviceaccount permissions?
io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: GET at: https://xxxxxxx:8443/api/v1/namespaces/scdf/pods/scdf-ephemeral-2-evs6k. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked..
...

I`ve deployed openshift cluster in a cloud using ansible scripts (1 master, 5 nodes) and logged in on to a master.

My steps (according to instructions ):

1. oadm new-project scdf
2. oc policy add-role-to-user edit system:serviceaccount:scdf:scdf
3. oc adm policy add-scc-to-user anyuid system:serviceaccount:scdf:scdf
4. oc create -f scdf-sa.yaml
5. oc new-app -f scdf-ephemeral-datasources-template.yaml

$ openshift version
openshift v1.3.0
kubernetes v1.3.0+52492b4
etcd 2.3.0+git

$ oc status
In project scdf on server https://xxxxxx:8443

svc/mysql - 172.30.204.120:3306 -> mysql
dc/mysql deploys docker.io/library/mysql:5.6
deployment #1 deployed 56 minutes ago - 1 pod

svc/redis - 172.30.241.168:6379 -> redis
dc/redis deploys docker.io/library/redis:3-alpine
deployment #1 deployed 56 minutes ago - 1 pod

http://scdf-ephemeral-scdf.router.default.svc.cluster.local to pod port http (svc/scdf-ephemeral)
dc/scdf-ephemeral deploys docker.io/donovanmuller/spring-cloud-dataflow-server-openshift:1.1.0.RELEASE
deployment #2 failed 25 minutes ago: caused by a config change
deployment #1 failed 56 minutes ago: caused by a config change

Any ideas?

[donovanmuller]

@dzianis-shkindzerau thanks for the detailed issue.

I just confirmed that following your steps exactly on my local minishift instance works as expected.
Did you use the openshift-ansible playbook to stand up your cluster?

Just to get an idea of what could be wrong, could you please run this oc command:

$ oc describe policyBindings :default -n scdf

what you should see is this:

in addition, could you perhaps confirm that the scdf service account is being referenced by the DeploymentConfig (https://xxx:8443/console/project/scdf/browse/deployments/scdf-ephemeral):

[dzianis-shkindzerau]

@donovanmuller thanks for quick answer

Did you use the openshift-ansible playbook to stand up your cluster?

Yes. I did.

My screenshots look almost the same as your:

[donovanmuller]

@dzianis-shkindzerau yes, that looks fine.

I'll have to try spin up a cluster using the Ansible playbooks and try and reproduce.
Will feedback once I've done that.

[dzianis-shkindzerau]

Oh yes, one more thing.
A few month ago I tried to use SCDF for OpenShift 1.0.1.BUILD-SNAPSHOT version compiled from source code. It was worked as expected and without errors with Service Account.

spring-cloud-deployer_commitId 4d17be98738a6790addeb1849344de8e04f78b56
spring-cloud-dataflow-server-openshift_commitId 2c115fd
spring-cloud-deployer-openshift_commitId d3ca12c2706057c8fe02bd81900c2e4875c230bd

[donovanmuller]

@dzianis-shkindzerau I just spun up an OpenShift Origin 1.3.1 cluster with the openshiift-ansible (master branch, currently at openshift/openshift-ansible@930102c) playbooks.

I used your commands exactly as described and in the same order... and it worked as expected 🤔.

As per your #11 (comment), are you trying to install the 1.1.0.RELEASE templates on the same cluster you used for the 1.0.1.BUILD-SNAPSHOT version or is this a brand new cluster?

If that doesn't help, the only other way I can think of helping you is to allow you temporary access to the cluster I just spun up and you can poke around and try find out what the diff is? If you would like to try that you can DM me at @donovancmuller and I'll give you the connection details...

[dzianis-shkindzerau]

@donovanmuller thanks for the help

Now it works. It was my mistake with properties configuration. I deleted the next values -Dkubernetes.master=xxx -Dkubernetes.auth.basic.username=xxx -Dkubernetes.auth.basic.password=xxx from JAVA_OPTS property and everything is working now.

Thanks for great job with the SCDF on Openshift and good luck in the work!