Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-33378

Builds TestWebhook failed on step testing unauthenticated forbidden on upgrade

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done-Errata
    • Icon: Critical Critical
    • 4.16.0
    • 4.16
    • Build
    • None
    • Important
    • No
    • 2
    • Builds Sprint #3
    • 1
    • Proposed
    • False
    • Hide

      None

      Show
      None
    • Hide
      Previously, clusters that updated from earlier versions to 4.16 continued to allow builds to be triggered by unauthenticated webhooks. With this release, new clusters require build webhooks to be authenticated. Builds are not triggered by unauthenticated webhooks unless a cluster admin allows unauthenticated wehbooks in the namespace or cluster.
      Show
      Previously, clusters that updated from earlier versions to 4.16 continued to allow builds to be triggered by unauthenticated webhooks. With this release, new clusters require build webhooks to be authenticated. Builds are not triggered by unauthenticated webhooks unless a cluster admin allows unauthenticated wehbooks in the namespace or cluster.
    • Bug Fix
    • Done

      During jobs that upgrade to 4.16 from 4.15, the testing of unauthenticated build webhook invocation fails (I suspect due to the existing rolebindings from 4.15 surviving the upgrade).

      [sig-builds][Feature:Builds][webhook] TestWebhook [apigroup:build.openshift.io][apigroup:image.openshift.io] [Suite:openshift/conformance/parallel] 
.
.
.
    STEP: testing unauthenticated forbidden webhooks @ 05/07/24 20:03:20.024
    STEP: executing the webhook to get the build object @ 05/07/24 20:03:20.024
    [FAILED] in [It] - github.com/openshift/origin/test/extended/builds/webhook.go:36 @ 05/07/24 20:03:20.148

       

            [OCPBUGS-33378] Builds TestWebhook failed on step testing unauthenticated forbidden on upgrade

            Errata Tool added a comment -

            Since the problem described in this issue should be resolved in a recent advisory, it has been closed.

            For information on the advisory (Critical: OpenShift Container Platform 4.16.0 bug fix and security update), and where to find the updated files, follow the link below.

            If the solution does not work for you, open a new bug report.
            https://access.redhat.com/errata/RHSA-2024:0041

            Errata Tool added a comment - Since the problem described in this issue should be resolved in a recent advisory, it has been closed. For information on the advisory (Critical: OpenShift Container Platform 4.16.0 bug fix and security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2024:0041

            OpenShift Jira Bot added a comment -

            Hi adkaplan@redhat.com,

            Bugs should not be moved to Verified without first providing a Release Note Type("Bug Fix" or "No Doc Update") and for type "Bug Fix" the Release Note Text must also be provided. Please populate the necessary fields before moving the Bug to Verified.

            OpenShift Jira Bot added a comment - Hi adkaplan@redhat.com , Bugs should not be moved to Verified without first providing a Release Note Type("Bug Fix" or "No Doc Update") and for type "Bug Fix" the Release Note Text must also be provided. Please populate the necessary fields before moving the Bug to Verified.

            Devan Goodwin added a comment -

            Blocking payloads, elevating priority.

            Devan Goodwin added a comment - Blocking payloads, elevating priority.

            Adam Kaplan added a comment -

            (I suspect due to the existing rolebindings from 4.15 surviving the upgrade).

            That would be my assumption - in which case this is not a test framework bug. This is a fundamental issue with the underlying feature (AUTH-509). In its current state, we have no reliable, observable mechanism to determine if inbound build webhooks should require OpenShift auth tokens or not. "Inspect the bootstrap cluster roles" is not something that will scale across the thousands of clusters we manage.

            At this point I am going to advocate that AUTH-509 be reverted.

            Adam Kaplan added a comment - (I suspect due to the existing rolebindings from 4.15 surviving the upgrade). That would be my assumption - in which case this is not a test framework bug. This is a fundamental issue with the underlying feature ( AUTH-509 ). In its current state, we have no reliable, observable mechanism to determine if inbound build webhooks should require OpenShift auth tokens or not. "Inspect the bootstrap cluster roles" is not something that will scale across the thousands of clusters we manage. At this point I am going to advocate that AUTH-509 be reverted.

              adkaplan@redhat.com Adam Kaplan
              lusanche@redhat.com Luis Sanchez
              Sayan Biswas Sayan Biswas
              Votes:
              0 Vote for this issue
              Watchers:
              9 Start watching this issue

                Created:
                Updated:
                Resolved: