Non-admin user viewing the console with developer console perspective #136

Avni-Sharma · 2019-04-23T11:08:49Z

Refers https://jira.coreos.com/browse/ODC-347

This PR provides a script to install

the latest console with the developer perspective, and
the devconsole operator needed to enable the perspective.

The prerequisites for testing this are
export KUBECONFIG=kubeconfig file

Run the script consoledeveloper.sh
It does the following:
1)Replaces the existing openshift console with the talamer console
2)Installs the operator. (Prompts if it already exists)
3)Creates a non-admin user consoledeveloper with the password as developer with the suitable rolebinding(rolebinding being used here is self-provisioner and view)

Steps to test this

sh consoledeveloper.sh
oc login -u consoledeveloper -p developer
Logging in as the consoledeveloper user, you can now create a new project and do oc get csvs in the suitable namespace to see the installed operator.

Expected Output-
On the UI you can now see a consoledeveloper user under the kubeadmin.
You can enter the username as consoledeveloper and the password as developer here

… perspective Refers https://jira.coreos.com/browse/ODC-347 The prerequisites for testing this are export KUBECONFIG=<kubeconfig file> export OC_LOGIN_PASSWORD=<kubeadmin login password> Run the script consoledeveloper.sh It does the following: 1)Replaces the existing openshift console with the talamer console 2)Installs the operator. (Prompts if it already exists) 3)Creates a non-admin user `consoledeveloper` with the password as `developer` with the suitable rolebinding(roleinding being used here is `self-provisioner`) After this you can login as the `consoledeveloper` user. Create a new project and do `oc get csvs` in the suitable namespace to see the installed operator.

rgarg1

The script works fine @Avni-Sharma. Good job!

I was able to enable developer console on my OCP4 cluster hosted on AWS using this script. Since I already had the consoledeveloper user crreated prior, the script detected that duly and informed me of the same.

rgarg1 · 2019-04-23T12:57:57Z

install_devconsole/consoledeveloper.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+set -x


The script is dumping all commands executed along with passwords on the terminal. May be set +x would be a better option here, even though this is going to be executed by kubeadmins.

rgarg1 · 2019-04-23T12:59:43Z

install_devconsole/consoledeveloper.sh

+
+oc apply -f ./yamls/unmanage.yaml
+oc scale --replicas 0 deployment console-operator --namespace openshift-console-operator
+sleep 20s


Are we going to let our customers use this script at any point? If yes then we should consider using conditional while loops instead of hard sleeps, as different environments may need different waits.

Technically, we could have a loop here which checks if the console deployment in openshift-console namespace is updated to use the right image.

baijum · 2019-04-24T03:19:29Z

How about creating a hack directory at top-level and moving these scripts under that. I have noticed the hack directory in many OpenShift and Kubernetes repositories.

sbose78 · 2019-04-24T04:05:36Z

hack or install. Anything is good.

baijum · 2019-04-24T04:20:14Z

hack or install. Anything is good.

How about creating a hack directory and within that install directory?

baijum · 2019-04-24T13:31:16Z

install_devconsole/consoledeveloper.sh

+#!/bin/bash
+set +x
+OC_LOGIN_USERNAME=kubeadmin
+oc login -u ${OC_LOGIN_USERNAME} -p ${OC_LOGIN_PASSWORD}


Why login? Why not use KUBECONFIG?

We can do this as well.. thanks Baiju :)

sbose78 · 2019-04-24T20:26:27Z

install_devconsole/create_user.sh

+sleep 10s
+oc create clusterrolebinding ${USERNAME}_role --clusterrole=self-provisioner --user=${USERNAME}
+sleep 15s
+oc login -u ${USERNAME} -p ${USERPASS}


Would be wrong to have the script login with a different user than what the user had initially started as. I would suggest that we only print out the command to login with the user.

sbose78 · 2019-04-24T20:29:12Z

install_devconsole/consoledeveloper.sh

+do
+    sleep 1s
+done
+oc scale --replicas 1 deployment console --namespace openshift-console


Could you add a loop which checks if the deploymentconfig/console has got updated with the new image?

There is no deploymentconfig as such... just the deployment and when we apply that redeploy file then the image is there. (The new-image is already there in the yaml..it is not being replaced)

I wanted to imply deployment/console :)

You are redeploying the deployment/console-operator not deployment/console. On re-deploying deployment/console-operator, the operator should update deployment/console's image which could take a while.

After the redeployment the pod for this console-operator comes up. After this step the devconsole.sh script is called. So till the catalogsource and subscription is being applied that pod comes up and these two are kind of independent. so i thought of not putting it there. For pulling the latest image though I have a new commit which changes the imagePullPolicy to Always in the desired yaml and also does some changes in the consoledeveloper.sh

@Avni-Sharma could you share the link to the workaround please? If there's an issue I would like to point people towards it every time they hit the bug.

rgarg1 · 2019-04-25T07:44:07Z

@Avni-Sharma The scripts work only partially for me on OCP4 cluster hosted on AWS. Here are the logs, please notice the error messages:

sh consoledeveloper.sh 
Login successful.

You have access to the following projects and can switch between them with 'oc project <projectname>':

  * default
    kube-public
    kube-system
    openshift
    openshift-apiserver
    openshift-apiserver-operator
    openshift-authentication
    openshift-authentication-operator
    openshift-cloud-credential-operator
    openshift-cluster-machine-approver
    openshift-cluster-node-tuning-operator
    openshift-cluster-samples-operator
    openshift-cluster-storage-operator
    openshift-cluster-version
    openshift-config
    openshift-config-managed
    openshift-console
    openshift-console-operator
    openshift-controller-manager
    openshift-controller-manager-operator
    openshift-dns
    openshift-dns-operator
    openshift-image-registry
    openshift-infra
    openshift-ingress
    openshift-ingress-operator
    openshift-kube-apiserver
    openshift-kube-apiserver-operator
    openshift-kube-controller-manager
    openshift-kube-controller-manager-operator
    openshift-kube-scheduler
    openshift-kube-scheduler-operator
    openshift-machine-api
    openshift-machine-config-operator
    openshift-marketplace
    openshift-monitoring
    openshift-multus
    openshift-network-operator
    openshift-node
    openshift-operator-lifecycle-manager
    openshift-operators
    openshift-sdn
    openshift-service-ca
    openshift-service-ca-operator
    openshift-service-catalog-apiserver-operator
    openshift-service-catalog-controller-manager-operator

Using project "default".
Warning: oc apply should be used on resource created by either oc create --save-config or oc apply
clusterversion "version" configured
deployment "console-operator" scaled
deployment "console" scaled
Warning: oc apply should be used on resource created by either oc create --save-config or oc apply
deployment "console-operator" configured
No resources found.
deployment "console" scaled
**Error: unknown command "api-versions" for "oc"**
Run 'oc --help' for usage.
Running Openshift Version 4.x 


 Installing DevConsole Operator... 


 Installing Catalog Source... 

catalogsource "my-catalog" created

 Waiting for catalog source to get installed before creating subscription 


 Creating Subscription... 

subscription "my-devconsole" created
No resources found.
Adding password for user consoledeveloper
secret "htpasswd-consoledeveloper-secret" created
Warning: oc apply should be used on resource created by either oc create --save-config or oc apply
oauth "cluster" configured
clusterrolebinding "consoledeveloper_role" created
**Login failed (401 Unauthorized)
Verify you have provided correct credentials.**

rgarg1 · 2019-04-25T08:00:06Z

@Avni-Sharma

Despite the errors, I could login using the developerconsole user and I could also see the perspective.

…le-operator into install_devconsole

Removing login through oc command. Instead using kubeconfig file. Prompting the user with credentials for login as a non admin user, instead of logging in through the script.

Avni-Sharma · 2019-04-29T08:57:23Z

@Avni-Sharma

Despite the errors, I could login using the developerconsole user and I could also see the perspective.

Hi Ruchir.
Instead of logging in through the script, we would be just prompting the user with the credentials as suggested by @sbose78

Avni-Sharma · 2019-04-29T10:35:12Z

/test lint

Avni-Sharma · 2019-04-29T11:04:28Z

/test lint

openshift-ci-robot · 2019-04-29T20:12:13Z

New changes are detected. LGTM label has been removed.

sbose78 · 2019-04-29T20:33:20Z

install_devconsole/yamls/redeploy-console-operator.yaml

        env:
        - name: IMAGE
          value: quay.io/redhat-developer/console:master-next
+          imagePullPolicy: Always


Thanks for adding this - this looks mandatory and I had missed it in my review.

sbose78 · 2019-04-29T20:35:06Z

install_devconsole/consoledeveloper.sh

+CONSOLE_POD="$(oc get pods -o=name -n openshift-console | cut -d'/' -f2- | cut -f 1 -d "-" | head -n 1)"
+CONSOLE_POD_NAME="$(oc get pods -o=name -n openshift-console | cut -d'/' -f2- | cut -d'-' -f1- | head -n 1)"
+if echo "${CONSOLE_POD}" == "console";then
+    oc delete pod ${CONSOLE_POD_NAME} -n openshift-console


These would have got deleted when

oc scale --replicas 0 deployment console --namespace openshift-console

was done?

yeah..but regarding this - If you are already using the quay.io/redhat-developer/console:master-next image and the image has been updated, the deployment doesn't naturally pull the updated image. So to be really sure that it is the new image we can delete the existing one. Because it's a Deployment, Kubernetes will automatically recreate the pod and pull the latest image.

baijum · 2019-04-30T02:48:04Z

hack or install. Anything is good.

How about creating a hack directory and within that install directory?

@Avni-Sharma Can you create a hack directory and move the install_devconsole directory (not individual files) under that?

sbose78 · 2019-04-30T04:14:05Z

While importing an application as consoledeveloper , I found out that the above error happened.
This happened because consoledeveloper didn't have view on the openshift namespace.

sbose78 · 2019-04-30T04:14:42Z

The output doesn't get printed properly on my mac terminal

-e 
\e[1;35m User consoledeveloper created with the password developer. Type the below\e[0m 

-e 
\e[1;32m oc login -u\e[3m \e[1;36mconsoledeveloper\e[0m \e[1;32m-p\e[3m \e[1;36mdeveloper\e[0m

rohitkrai03 · 2019-04-30T06:33:44Z

@sbose78 On my mac terminal the output looks fine with colors and all.

➜  ~ echo -e "\n\e[1;32m oc login -u\e[3m \e[1;36mconsoledeveloper\e[0m \e[1;32m-p\e[3m \e[1;36mdeveloper\e[0m \n"

 oc login -u consoledeveloper -p developer 

➜  ~ echo -e "\n\e[1;35m User consoledeveloper created with the password developer. Type the below\e[0m \n"

 User consoledeveloper created with the password developer. Type the below 

➜  ~ echo -e "\n\e[1;35m User consoledeveloper created with the password developer. Type the below\e[0m \n"

 User consoledeveloper created with the password developer. Type the below

Avni-Sharma · 2019-04-30T11:49:28Z

/test lint

sbose78 · 2019-04-30T12:49:21Z

install_devconsole/create_user.sh


 sleep 10s
 oc create clusterrolebinding ${USERNAME}_role --clusterrole=self-provisioner --user=${USERNAME}
+oc adm policy add-role-to-user view ${USERNAME}


Is this view only on the openshift namespace?

It is in all namespaces

The builder image in the Import Flow will now work.

sbose78 · 2019-05-01T16:28:59Z

/retest

rgarg1 · 2019-05-02T08:21:35Z

@Avni-Sharma The command oc api-versions is dependent on version of the oc utility installed on the client system. For example, this command will fail if the version installed on the system is v3.9.0, but works with latest v4.1.0. You should add this limitation to the list of pre-requisites.

Avni-Sharma · 2019-05-02T10:50:33Z

@rgarg1 This is only for v4. We are just exporting the kubeconfig for logging in(mentioned in the description above)) instead of the command oc login which is only possible in v4. so it is assumed that it is for the latest one..However, we can add it as well :)

baijum · 2019-05-02T10:57:13Z

Please add a README.md. The content used for PR description would be fine.

…le-operator into install_devconsole

baijum · 2019-05-02T12:10:20Z

@Avni-Sharma (nitpick) Can you format the README.md with better Markdown syntax: https://www.markdownguide.org/basic-syntax

sbose78 · 2019-05-02T18:14:52Z

Let's merge this.

openshift-ci-robot · 2019-05-02T18:27:29Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: baijum, sbose78

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [baijum,sbose78]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

baijum · 2019-05-02T18:28:12Z

I had some changes to README: https://paste.gnome.org/pv37d2syt
I can send a separate PR.

* upstream/master: Set registry log (redhat-developer#176) Non-admin user viewing the console with developer console perspective (redhat-developer#136) Use the base image available in the OpenShift CI (redhat-developer#175)

openshift-ci-robot requested review from DhritiShikhar and corinnekrych April 23, 2019 11:08

openshift-ci-robot added the size/L label Apr 23, 2019

Avni-Sharma requested review from akashshinde, baijum, ldimaggi, sbose78 and tinakurian April 23, 2019 11:09

Avni-Sharma added 3 commits April 23, 2019 17:00

Fixed yaml lint issues. Added a new line at the end of each yaml

a8af84d

fixing lint issues

b198a21

Merge branch 'master' into install_devconsole

b29be88

rgarg1 reviewed Apr 23, 2019

View reviewed changes

Avni-Sharma added 2 commits April 24, 2019 13:10

updated to set +x

daa7846

Removing the hard-coded sleep

4a1144f

baijum suggested changes Apr 24, 2019

View reviewed changes

sbose78 reviewed Apr 24, 2019

View reviewed changes

sbose78 suggested changes Apr 24, 2019

View reviewed changes

Avni-Sharma added 3 commits April 26, 2019 13:17

Merge branch 'master' of https://github.com/redhat-developer/devconso…

49914d0

…le-operator into install_devconsole

Merge branch 'master' of https://github.com/redhat-developer/devconso…

157035d

…le-operator into install_devconsole

Making suggested changes

54fe184

Removing login through oc command. Instead using kubeconfig file. Prompting the user with credentials for login as a non admin user, instead of logging in through the script.

Indenting the echoed lines

ef6c579

openshift-ci-robot removed the lgtm label Apr 29, 2019

sbose78 reviewed Apr 29, 2019

View reviewed changes

Avni-Sharma added 2 commits April 30, 2019 14:31

adding view role

4a21be1

Making a new hack folder which will now have install_devconsole/

1e3be59

sbose78 reviewed Apr 30, 2019

View reviewed changes

Avni-Sharma added 2 commits May 1, 2019 14:01

Adding view as a new clusterrolebinding

246aa46

The builder image in the Import Flow will now work.

rebasing

46f0d58

sbose78 approved these changes May 2, 2019

View reviewed changes

Avni-Sharma added 3 commits May 2, 2019 16:43

Merge branch 'master' of https://github.com/redhat-developer/devconso…

09b2d23

…le-operator into install_devconsole

Adding Readme.md

b459d40

Update in README.md

ca2ee71

updates to README.md

1661542

baijum approved these changes May 2, 2019

View reviewed changes

sbose78 merged commit 446a075 into redhat-developer:master May 2, 2019

Non-admin user viewing the console with developer console perspective #136

Non-admin user viewing the console with developer console perspective #136

Uh oh!

Conversation

Avni-Sharma commented Apr 23, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rgarg1 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

baijum commented Apr 24, 2019

Uh oh!

sbose78 commented Apr 24, 2019

Uh oh!

baijum commented Apr 24, 2019

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sbose78 Apr 29, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rgarg1 commented Apr 25, 2019

Uh oh!

rgarg1 commented Apr 25, 2019

Uh oh!

Avni-Sharma commented Apr 29, 2019

Uh oh!

Avni-Sharma commented Apr 29, 2019

Uh oh!

Avni-Sharma commented Apr 29, 2019

Uh oh!

openshift-ci-robot commented Apr 29, 2019

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

baijum commented Apr 30, 2019

Uh oh!

sbose78 commented Apr 30, 2019

Uh oh!

sbose78 commented Apr 30, 2019

Uh oh!

rohitkrai03 commented Apr 30, 2019

Uh oh!

Avni-Sharma commented Apr 30, 2019

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sbose78 commented May 1, 2019

Uh oh!

rgarg1 commented May 2, 2019

Uh oh!

Avni-Sharma commented May 2, 2019

Uh oh!

baijum commented May 2, 2019

Uh oh!

Avni-Sharma commented Apr 23, 2019 •

edited

Loading

sbose78 Apr 29, 2019 •

edited

Loading

baijum commented May 2, 2019 •

edited

Loading