Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

return forbidden api status object #1452

Merged
merged 2 commits into from
Mar 25, 2015
Merged

return forbidden api status object #1452

merged 2 commits into from
Mar 25, 2015

Conversation

deads2k
Copy link
Contributor

@deads2k deads2k commented Mar 25, 2015

Fixes #1421.

By using the API status object, we get a message on the cli that looks like this:

[deads@deads-dev-01 origin]$ osc get nodes
F0325 09:21:42.892396    8611 get.go:67] Error received from API: "/api/v1beta1/nodes?namespace=default" is forbidden because anypassword:asdf cannot list on nodes in default

I think the code will fall out much cleaner for forbidden resource requests once we have full access to the APIInstaller information to properly determine kinds, names, namespaces and codecs, but this is an improvement.

@liggitt

@deads2k deads2k force-pushed the deads-return-forbidden-api-object branch from 88ea797 to c76aaba Compare March 25, 2015 14:52
liggitt
liggitt reviewed Mar 25, 2015
View reviewed changes
pkg/cmd/server/origin/master.go
// We create a NewForbidden to stay close the API, but then we override the message to get a serialization
// that makes sense when a human reads it.
forbiddenError, _ := kapierror.NewForbidden("", "", errors.New("")).(*kapierror.StatusError)
forbiddenError.ErrStatus.Message = fmt.Sprintf("%q is forbidden because %s", req.RequestURI, reason)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

rather than jumping through hoops to use NewForbidden, can we just do

&kapierror.StatusError{
  kapi.Status{
    Status: kapi.StatusFailure,
    Code:   http.StatusForbidden,
    Reason: kapi.StatusReasonForbidden,
    Message: fmt.Sprintf("%q is forbidden because %s", req.RequestURI, reason),
  },
}

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think I'd rather stay with the library function and rely on it to set every field except for the message. That keeps us in sync if make changes. It will also alert a rebaser if we end up fixing it upstream.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is it more correct to have a nil Details field or a Details field with empty name and kind?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd read it as, "a reason forbidden indicates that the StatusDetails MUST be present, and MAY have 'kind' set and MAY have 'id' set". The other reading wouldn't make much sense because it would say, "a reason forbidden indicates that the StatusDetails MUST be present, and MAY have a details stanza. If there is a details stanza, it MUST have both 'kind' and 'id'". That doesn't make much sense since id's aren't always available.

Clearly we should demand RFC style godoc for clarity!

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, you could see an argument for including Verb and Namespace in the details. We want to set all those fields in a structured way someday.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok

@liggitt
Copy link
Contributor

liggitt commented Mar 25, 2015

LGTM

@deads2k
Copy link
Contributor Author

deads2k commented Mar 25, 2015

[merge]

@openshift-bot
Copy link
Contributor

continuous-integration/openshift-jenkins/merge SUCCESS (https://ci.openshift.redhat.com/jenkins/job/merge_pull_requests_openshift3/1294/) (Image: devenv-fedora_1131)

@openshift-bot
Copy link
Contributor

Evaluated for origin up to c76aaba

openshift-bot pushed a commit that referenced this pull request Mar 25, 2015
Merge pull request #1452 from deads2k/deads-return-forbidden-api-object
6a1184a 
Merged by openshift-bot
@openshift-bot openshift-bot merged commit 6a1184a into openshift:master Mar 25, 2015
@deads2k deads2k deleted the deads-return-forbidden-api-object branch March 25, 2015 19:39
jpeeler added a commit to jpeeler/origin that referenced this pull request Oct 23, 2017
@jpeeler
Squashed 'cmd/service-catalog/go/src/github.com/kubernetes-incubator/…
4572a66 
…service-catalog/' changes from aa27078754..dabde2eb85

dabde2eb85 origin build: add origin tooling
b70c076 Reorder class and plan creation; test plan conflict handling (openshift#1459)
4bea012 Use versioned client APIs (openshift#1458)
ff4af30 clean up logic for 410 gone deprovision poll (openshift#1452)
3fddf27 clean up logic and fix message for failed poll (openshift#1451)
40926cd Fix typo from openshift#1354 (openshift#1456)
ff86ef2 Delete removed serviceplans when they have no instances left (openshift#1444)
8411a16 tweak binding setAndUpdateOrphanMitigation function (openshift#1448)
ce28252 Combine apiserver and controller-manager into a single service-catalog image (openshift#1343)
7bbc8ee Check service class / plan before allowing provisioning or plan changes. (openshift#1439)
baf28de Create listers before adding event handlers in controller (openshift#1446)
294157d remove setServiceBindingCondition dependency on controller (openshift#1441)
118a0f7 Fix typo in validation (openshift#1447)
117bfbd clean up error logging (openshift#1443)
dff470f Move "External" around in some resource names/properties (openshift#1354)
0885edb Adding expectedGot function and using it. (openshift#1440)
a7d582e Pretty controller broker (openshift#1442)
c5edfaf Set apimachinery build variables with semver info (openshift#1429)
0e90d82 Add a pretty formatter for ClusterService[Class|Plan] (openshift#1408)
fb874df Remove deprecated basic auth config support (openshift#1431)
f4cd181 Migrate to metav1 methods for manipulating controllerRefs (openshift#1433)
96b286e Make service/plan reference fields on instance spec selectable (openshift#1422)
33f2b04 First example using the pretty context builder. (openshift#1403)
7852917 Stop using corev1.ObjectReference and corev1.LocalObjectReference (openshift#1417)
fcf9480 Add tests for plan updates (openshift#1412)
819332e Add root CAs (openshift#1419)
b49a76a Clean Makefile a little (openshift#1399)
d681da0 Use a separate etcd prefix for each integration test to keep tests isolated (openshift#1415)
314a622 Wire etcd prefix to storage and call complete with options (openshift#1394)
REVERT: aa27078754 origin build: add origin tooling

git-subtree-dir: cmd/service-catalog/go/src/github.com/kubernetes-incubator/service-catalog
git-subtree-split: dabde2eb859b5e31e97c01a704561fc27e1848b2
jpeeler added a commit to jpeeler/origin that referenced this pull request Oct 24, 2017
@jpeeler
Squashed 'cmd/service-catalog/go/src/github.com/kubernetes-incubator/…
ee4ff3f 
…service-catalog/' changes from aa27078754..510060232e

510060232e origin build: add origin tooling
de45e94 v0.1.0 chart changes (openshift#1468)
0bb9982 Modify Makefile to only specify ldflags once (openshift#1471)
5d6afac Fixes openshift#735: Add repo-sync script for charts (openshift#1453)
630f13f fix lingering unversioned client API (openshift#1466)
6f49128 Fix several logging errors (openshift#1464)
2aece61 Delete removed serviceClasses when they have no instances left (openshift#1450)
179d302 Uncommenting UID field after updating to k8s 1.8 (openshift#1457)
b70c076 Reorder class and plan creation; test plan conflict handling (openshift#1459)
4bea012 Use versioned client APIs (openshift#1458)
ff4af30 clean up logic for 410 gone deprovision poll (openshift#1452)
3fddf27 clean up logic and fix message for failed poll (openshift#1451)
40926cd Fix typo from openshift#1354 (openshift#1456)
ff86ef2 Delete removed serviceplans when they have no instances left (openshift#1444)
8411a16 tweak binding setAndUpdateOrphanMitigation function (openshift#1448)
ce28252 Combine apiserver and controller-manager into a single service-catalog image (openshift#1343)
7bbc8ee Check service class / plan before allowing provisioning or plan changes. (openshift#1439)
baf28de Create listers before adding event handlers in controller (openshift#1446)
294157d remove setServiceBindingCondition dependency on controller (openshift#1441)
118a0f7 Fix typo in validation (openshift#1447)
117bfbd clean up error logging (openshift#1443)
dff470f Move "External" around in some resource names/properties (openshift#1354)
0885edb Adding expectedGot function and using it. (openshift#1440)
a7d582e Pretty controller broker (openshift#1442)
c5edfaf Set apimachinery build variables with semver info (openshift#1429)
0e90d82 Add a pretty formatter for ClusterService[Class|Plan] (openshift#1408)
fb874df Remove deprecated basic auth config support (openshift#1431)
f4cd181 Migrate to metav1 methods for manipulating controllerRefs (openshift#1433)
96b286e Make service/plan reference fields on instance spec selectable (openshift#1422)
33f2b04 First example using the pretty context builder. (openshift#1403)
7852917 Stop using corev1.ObjectReference and corev1.LocalObjectReference (openshift#1417)
fcf9480 Add tests for plan updates (openshift#1412)
819332e Add root CAs (openshift#1419)
b49a76a Clean Makefile a little (openshift#1399)
d681da0 Use a separate etcd prefix for each integration test to keep tests isolated (openshift#1415)
314a622 Wire etcd prefix to storage and call complete with options (openshift#1394)
REVERT: aa27078754 origin build: add origin tooling

git-subtree-dir: cmd/service-catalog/go/src/github.com/kubernetes-incubator/service-catalog
git-subtree-split: 510060232e54eb64b294213bb5d7847e169a2fac
jpeeler pushed a commit to jpeeler/origin that referenced this pull request Feb 1, 2018
@kibbles-n-bytes @pmorie
clean up logic for 410 gone deprovision poll (openshift#1452)
ff4af30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Security filter should output standard json error when hitting /api and /osapi
3 participants
@deads2k @liggitt @openshift-bot