installer should throw useful error message when pull secret is expired

[vasukulkarni]

Version

$ openshift-install version
<your output here>

v4.2.7
built from commit 425e4ff
release image registry.svc.ci.openshift.org/ocp/release@sha256:1792f2deda2dc3fd121b445790c01ac4aaf69dfa1f1c88d2d2ea6da3e16d7cda

Platform:

aws

What happened?

when the pull secret is expired, the error message is misleading

Error is Error from server (Forbidden): namespaces is forbidden: User "system:anonymous" cannot create namespaces at the cluster scope: no RBAC policy matched

What you expected to happen?

The installer should do these checks at the very beginning and should error out with clear error message.

How to reproduce it (as minimally and precisely as possible)?

use an expired pull secret key

[abhinavdahiya]

when the pull secret is expired, the error message is misleading

Error is Error from server (Forbidden): namespaces is forbidden: User "system:anonymous" cannot create namespaces at the cluster scope: no RBAC policy matched

the error doesn't seem like an issue due to pull-secret @vasukulkarni

[vasukulkarni]

@abhinavdahiya I think you are right, it was our must-gather invocation after failed create, but since I used loglevel INFO, there isnt meaningful error message when pull secret has expired, can something be done about that? and probably it can fail sooner than later. Thanks

10:12:11 - MainThread - ocs_ci.utility.utils - INFO - Executing command: /Users/vasukulkarni/ocs-ci/bin/openshift-install create cluster --dir /Users/vasukulkarni/cluster-path/ --log-level INFO
10:50:11 - MainThread - ocs_ci.ocs.utils - INFO - Must gather image: quay.io/openshift/origin-must-gather will be used.
10:50:11 - MainThread - ocs_ci.ocs.utils - INFO - OCS logs will be placed in location /tmp/failed_testcase_ocs_logs_1574187108/deployment_ocs_logs/ocp_must_gather
10:50:11 - MainThread - ocs_ci.utility.utils - INFO - Executing command: oc --kubeconfig /Users/vasukulkarni/vasu-cluster-path/auth/kubeconfig adm must-gather --image=quay.io/openshift/origin-must-gather --dest-dir=/tmp/failed_testcase_ocs_logs_1574187108/deployment_ocs_logs/ocp_must_gather
10:50:13 - MainThread - ocs_ci.ocs.utils - ERROR - Failed during must gather logs! Error: Error during execution of command: oc --kubeconfig /Users/vasukulkarni/vasu-cluster-path/auth/kubeconfig adm must-gather --image=quay.io/openshift/origin-must-gather --dest-dir=/tmp/failed_testcase_ocs_logs_1574187108/deployment_ocs_logs/ocp_must_gather.
                                                   Error is Error from server (Forbidden): namespaces is forbidden: User "system:anonymous" cannot create namespaces at the cluster scope: no RBAC policy matched

[abhinavdahiya]

 INFO - Executing command: oc --kubeconfig /Users/vasukulkarni/vasu-cluster-path/auth/kubeconfig adm must-gather --image=quay.io/openshift/origin-must-gather --dest-dir=/tmp/failed_testcase_ocs_logs_1574187108/deployment_ocs_logs/ocp_must_gather
 ERROR - Failed during must gather logs! Error: Error during execution of command: oc --kubeconfig /Users/vasukulkarni/vasu-cluster-path/auth/kubeconfig adm must-gather --image=quay.io/openshift/origin-must-gather --dest-dir=/tmp/failed_testcase_ocs_logs_1574187108/deployment_ocs_logs/ocp_must_gather.
                                                   Error is Error from server (Forbidden): namespaces is forbidden: User "system:anonymous" cannot create namespaces at the cluster scope: no RBAC policy matched

1. that is not controlled by the installer sadly, the kubeconfig should be trusted by api and oc adm must-gather is also not controlled by this repo.
2. but that is still not related to the pull-secret?
   Do you mean that the install failed due to invalid pull-secret?
   pull-secret is used to pull container-images, it is not used to authenticate with api.

[vasukulkarni]

@abhinavdahiya I am agreeing with you that installer is not responsible for the above error, but what I am asking is if we can improve the error message check when pull-secret is invalid, my pull-secret had expired yesterday and I was hitting above issue. I can try to give you exact error message when it fails with invalid pull-secret with --debug and I have seen its not very helpful.

[abhinavdahiya]

Ahh, I get it now.

closing it favor of #2569 as the installer cannot verify access to the release-image because there is no condition that the installer needs to have access to the release-image, only the cluster requires the access.

[openshift-ci-robot]

@abhinavdahiya: Closing this issue.

In response to this:

Ahh, I get it now.

closing it favor of #2569 as the installer cannot verify access to the release-image because there is no condition that the installer needs to have access to the release-image, only the cluster requires the access.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.