{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/origin/issues/11909","repository_url":"https://api.github.com/repos/openshift/origin","labels_url":"https://api.github.com/repos/openshift/origin/issues/11909/labels{/name}","comments_url":"https://api.github.com/repos/openshift/origin/issues/11909/comments","events_url":"https://api.github.com/repos/openshift/origin/issues/11909/events","html_url":"https://github.com/openshift/origin/pull/11909","id":189266573,"node_id":"MDExOlB1bGxSZXF1ZXN0OTM2Nzc3NDk=","number":11909,"title":"WIP: User Read and Delete OauthClientAuthorizations ","user":{"login":"enj","id":7001223,"node_id":"MDQ6VXNlcjcwMDEyMjM=","avatar_url":"https://avatars0.githubusercontent.com/u/7001223?v=4","gravatar_id":"","url":"https://api.github.com/users/enj","html_url":"https://github.com/enj","followers_url":"https://api.github.com/users/enj/followers","following_url":"https://api.github.com/users/enj/following{/other_user}","gists_url":"https://api.github.com/users/enj/gists{/gist_id}","starred_url":"https://api.github.com/users/enj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/enj/subscriptions","organizations_url":"https://api.github.com/users/enj/orgs","repos_url":"https://api.github.com/users/enj/repos","events_url":"https://api.github.com/users/enj/events{/privacy}","received_events_url":"https://api.github.com/users/enj/received_events","type":"User","site_admin":false},"labels":[{"id":686389978,"node_id":"MDU6TGFiZWw2ODYzODk5Nzg=","url":"https://api.github.com/repos/openshift/origin/labels/do-not-merge/work-in-progress","name":"do-not-merge/work-in-progress","color":"e11d21","default":false},{"id":825084715,"node_id":"MDU6TGFiZWw4MjUwODQ3MTU=","url":"https://api.github.com/repos/openshift/origin/labels/lifecycle/frozen","name":"lifecycle/frozen","color":"d3e2f0","default":false},{"id":364523381,"node_id":"MDU6TGFiZWwzNjQ1MjMzODE=","url":"https://api.github.com/repos/openshift/origin/labels/needs-api-review","name":"needs-api-review","color":"b60205","default":false},{"id":276708012,"node_id":"MDU6TGFiZWwyNzY3MDgwMTI=","url":"https://api.github.com/repos/openshift/origin/labels/needs-rebase","name":"needs-rebase","color":"BDBDBD","default":false},{"id":640548662,"node_id":"MDU6TGFiZWw2NDA1NDg2NjI=","url":"https://api.github.com/repos/openshift/origin/labels/size/XXL","name":"size/XXL","color":"ee0000","default":false},{"id":225746078,"node_id":"MDU6TGFiZWwyMjU3NDYwNzg=","url":"https://api.github.com/repos/openshift/origin/labels/vendor-update","name":"vendor-update","color":"bfdadc","default":false}],"state":"open","locked":false,"assignee":{"login":"soltysh","id":576341,"node_id":"MDQ6VXNlcjU3NjM0MQ==","avatar_url":"https://avatars2.githubusercontent.com/u/576341?v=4","gravatar_id":"","url":"https://api.github.com/users/soltysh","html_url":"https://github.com/soltysh","followers_url":"https://api.github.com/users/soltysh/followers","following_url":"https://api.github.com/users/soltysh/following{/other_user}","gists_url":"https://api.github.com/users/soltysh/gists{/gist_id}","starred_url":"https://api.github.com/users/soltysh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/soltysh/subscriptions","organizations_url":"https://api.github.com/users/soltysh/orgs","repos_url":"https://api.github.com/users/soltysh/repos","events_url":"https://api.github.com/users/soltysh/events{/privacy}","received_events_url":"https://api.github.com/users/soltysh/received_events","type":"User","site_admin":false},"assignees":[{"login":"mfojtik","id":44136,"node_id":"MDQ6VXNlcjQ0MTM2","avatar_url":"https://avatars2.githubusercontent.com/u/44136?v=4","gravatar_id":"","url":"https://api.github.com/users/mfojtik","html_url":"https://github.com/mfojtik","followers_url":"https://api.github.com/users/mfojtik/followers","following_url":"https://api.github.com/users/mfojtik/following{/other_user}","gists_url":"https://api.github.com/users/mfojtik/gists{/gist_id}","starred_url":"https://api.github.com/users/mfojtik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mfojtik/subscriptions","organizations_url":"https://api.github.com/users/mfojtik/orgs","repos_url":"https://api.github.com/users/mfojtik/repos","events_url":"https://api.github.com/users/mfojtik/events{/privacy}","received_events_url":"https://api.github.com/users/mfojtik/received_events","type":"User","site_admin":false},{"login":"soltysh","id":576341,"node_id":"MDQ6VXNlcjU3NjM0MQ==","avatar_url":"https://avatars2.githubusercontent.com/u/576341?v=4","gravatar_id":"","url":"https://api.github.com/users/soltysh","html_url":"https://github.com/soltysh","followers_url":"https://api.github.com/users/soltysh/followers","following_url":"https://api.github.com/users/soltysh/following{/other_user}","gists_url":"https://api.github.com/users/soltysh/gists{/gist_id}","starred_url":"https://api.github.com/users/soltysh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/soltysh/subscriptions","organizations_url":"https://api.github.com/users/soltysh/orgs","repos_url":"https://api.github.com/users/soltysh/repos","events_url":"https://api.github.com/users/soltysh/events{/privacy}","received_events_url":"https://api.github.com/users/soltysh/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/openshift/origin/milestones/21","html_url":"https://github.com/openshift/origin/milestone/21","labels_url":"https://api.github.com/repos/openshift/origin/milestones/21/labels","id":2380090,"node_id":"MDk6TWlsZXN0b25lMjM4MDA5MA==","number":21,"title":"v3.7","description":"","creator":{"login":"smarterclayton","id":1163175,"node_id":"MDQ6VXNlcjExNjMxNzU=","avatar_url":"https://avatars0.githubusercontent.com/u/1163175?v=4","gravatar_id":"","url":"https://api.github.com/users/smarterclayton","html_url":"https://github.com/smarterclayton","followers_url":"https://api.github.com/users/smarterclayton/followers","following_url":"https://api.github.com/users/smarterclayton/following{/other_user}","gists_url":"https://api.github.com/users/smarterclayton/gists{/gist_id}","starred_url":"https://api.github.com/users/smarterclayton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smarterclayton/subscriptions","organizations_url":"https://api.github.com/users/smarterclayton/orgs","repos_url":"https://api.github.com/users/smarterclayton/repos","events_url":"https://api.github.com/users/smarterclayton/events{/privacy}","received_events_url":"https://api.github.com/users/smarterclayton/received_events","type":"User","site_admin":false},"open_issues":10,"closed_issues":180,"state":"open","created_at":"2017-03-12T06:20:11Z","updated_at":"2018-06-04T12:05:27Z","due_on":"2017-10-31T07:00:00Z","closed_at":null},"comments":25,"created_at":"2016-11-15T00:32:33Z","updated_at":"2018-07-09T18:09:07Z","closed_at":null,"author_association":"MEMBER","pull_request":{"url":"https://api.github.com/repos/openshift/origin/pulls/11909","html_url":"https://github.com/openshift/origin/pull/11909","diff_url":"https://github.com/openshift/origin/pull/11909.diff","patch_url":"https://github.com/openshift/origin/pull/11909.patch"},"body":"Each user now has their own bucket / folder where their `OauthClientAuthorizations` are stored: `/openshift.io/oauth/clientauthorizations/<userName>/<clientName>`.  This allows for fast lookup times per user.  Thus there must be enough information in the object's name to determine the user specific etcd key.\r\n\r\n**Backwards compatibility**\r\n\r\nUsers will only be able to see new `OauthClientAuthorizations`.  The old ones will stay in etcd but will no longer be considered valid and thus will need to be recreated.  The cluster admin will be able to clean up the old objects after an upgrade.  This is achieved by changing the naming scheme of new objects.  The old format was `<userName>:<clientName>` and the new format is `<userName>::<clientName>`.  This makes it easy to distinguish where the object would be stored.  Note that the name of the object is only used to determine the user when the cluster admin is doing a lookup.  User lookups use information from the context and enforce UID matching.\r\n\r\n**Examples**\r\n\r\n`oc get oauthclientauthorization` as `system:admin` (note the mix of old and new objects)\r\n\r\n```\r\nNAME                                                  USER NAME    CLIENT NAME                               SCOPES\r\ndeveloper::system:serviceaccount:myproject:jenkins    developer    system:serviceaccount:myproject:jenkins   user:info\r\ndeveloper1::system:serviceaccount:myproject:jenkins   developer1   system:serviceaccount:myproject:jenkins   user:info\r\ndeveloper1:system:serviceaccount:myproject:jenkins    developer1   system:serviceaccount:myproject:jenkins   user:info\r\ndeveloper:system:serviceaccount:myproject:jenkins     developer    system:serviceaccount:myproject:jenkins   user:info\r\n```\r\n\r\n`-o yaml`\r\n\r\n```yaml\r\napiVersion: v1\r\nitems:\r\n- apiVersion: v1\r\n  clientName: system:serviceaccount:myproject:jenkins\r\n  kind: OAuthClientAuthorization\r\n  metadata:\r\n    creationTimestamp: 2016-11-22T16:08:23Z\r\n    name: developer::system:serviceaccount:myproject:jenkins\r\n    resourceVersion: \"636\"\r\n    selfLink: /oapi/v1/oauthclientauthorizations/developer::system:serviceaccount:myproject:jenkins\r\n    uid: e5163dca-b0cd-11e6-b245-507b9dac97ff\r\n  scopes:\r\n  - user:info\r\n  userName: developer\r\n  userUID: cf29b7cb-b0ca-11e6-ac48-507b9dac97ff\r\n- apiVersion: v1\r\n  clientName: system:serviceaccount:myproject:jenkins\r\n  kind: OAuthClientAuthorization\r\n  metadata:\r\n    creationTimestamp: 2016-11-22T16:02:44Z\r\n    name: developer1::system:serviceaccount:myproject:jenkins\r\n    resourceVersion: \"599\"\r\n    selfLink: /oapi/v1/oauthclientauthorizations/developer1::system:serviceaccount:myproject:jenkins\r\n    uid: 1afc194d-b0cd-11e6-b245-507b9dac97ff\r\n  scopes:\r\n  - user:info\r\n  userName: developer1\r\n  userUID: fe3f3a4e-b0ca-11e6-ac48-507b9dac97ff\r\n- apiVersion: v1\r\n  clientName: system:serviceaccount:myproject:jenkins\r\n  kind: OAuthClientAuthorization\r\n  metadata:\r\n    creationTimestamp: 2016-11-22T15:48:39Z\r\n    name: developer1:system:serviceaccount:myproject:jenkins\r\n    resourceVersion: \"508\"\r\n    selfLink: /oapi/v1/oauthclientauthorizations/developer1:system:serviceaccount:myproject:jenkins\r\n    uid: 235cbdff-b0cb-11e6-ac48-507b9dac97ff\r\n  scopes:\r\n  - user:info\r\n  userName: developer1\r\n  userUID: fe3f3a4e-b0ca-11e6-ac48-507b9dac97ff\r\n- apiVersion: v1\r\n  clientName: system:serviceaccount:myproject:jenkins\r\n  kind: OAuthClientAuthorization\r\n  metadata:\r\n    creationTimestamp: 2016-11-22T15:47:12Z\r\n    name: developer:system:serviceaccount:myproject:jenkins\r\n    resourceVersion: \"494\"\r\n    selfLink: /oapi/v1/oauthclientauthorizations/developer:system:serviceaccount:myproject:jenkins\r\n    uid: ef5c24f2-b0ca-11e6-ac48-507b9dac97ff\r\n  scopes:\r\n  - user:info\r\n  userName: developer\r\n  userUID: cf29b7cb-b0ca-11e6-ac48-507b9dac97ff\r\nkind: List\r\nmetadata: {}\r\n```\r\n\r\n`oc get selfoauthclientauthorization -o yaml` as `developer` or  `developer1` (only new objects visible)\r\n\r\n```\r\nNAME                                      CLIENT NAME                               SCOPES\r\nsystem:serviceaccount:myproject:jenkins   system:serviceaccount:myproject:jenkins   user:info\r\n```\r\n\r\n`oc get selfoauthclientauthorization system:serviceaccount:myproject:jenkins -o yaml` as `developer1` (note the name of object is the clientName)\r\n\r\n```yaml\r\napiVersion: v1\r\nclientName: system:serviceaccount:myproject:jenkins\r\nkind: SelfOAuthClientAuthorization\r\nmetadata:\r\n  creationTimestamp: 2016-11-22T16:02:44Z\r\n  name: system:serviceaccount:myproject:jenkins\r\n  resourceVersion: \"599\"\r\n  selfLink: /oapi/v1/selfoauthclientauthorizations/system:serviceaccount:myproject:jenkins\r\n  uid: 1afc194d-b0cd-11e6-b245-507b9dac97ff\r\nscopes:\r\n- user:info\r\nuserUID: fe3f3a4e-b0ca-11e6-ac48-507b9dac97ff\r\n```\r\n\r\n**Cleanup old objects**\r\n\r\n`oc get oauthclientauthorization -o jsonpath=\"{range .items[*]}{.metadata.name}{\\\"\\\\n\\\"}{end}\" | grep -v '::' | xargs -n 1 echo oc delete oauthclientauthorization` (this could be piped to BASH)\r\n\r\n```\r\noc delete oauthclientauthorization developer1:system:serviceaccount:myproject:jenkins\r\noc delete oauthclientauthorization developer:system:serviceaccount:myproject:jenkins\r\n```\r\n\r\nTrello ref: https://trello.com/c/Tcabgp9F\r\n\r\ncc @openshift/api-review @mfojtik @soltysh @php-coder "},"comment":{"url":"https://api.github.com/repos/openshift/origin/issues/comments/403570003","html_url":"https://github.com/openshift/origin/pull/11909#issuecomment-403570003","issue_url":"https://api.github.com/repos/openshift/origin/issues/11909","id":403570003,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMzU3MDAwMw==","user":{"login":"openshift-ci-robot","id":30189103,"node_id":"MDQ6VXNlcjMwMTg5MTAz","avatar_url":"https://avatars1.githubusercontent.com/u/30189103?v=4","gravatar_id":"","url":"https://api.github.com/users/openshift-ci-robot","html_url":"https://github.com/openshift-ci-robot","followers_url":"https://api.github.com/users/openshift-ci-robot/followers","following_url":"https://api.github.com/users/openshift-ci-robot/following{/other_user}","gists_url":"https://api.github.com/users/openshift-ci-robot/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift-ci-robot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift-ci-robot/subscriptions","organizations_url":"https://api.github.com/users/openshift-ci-robot/orgs","repos_url":"https://api.github.com/users/openshift-ci-robot/repos","events_url":"https://api.github.com/users/openshift-ci-robot/events{/privacy}","received_events_url":"https://api.github.com/users/openshift-ci-robot/received_events","type":"User","site_admin":false},"created_at":"2018-07-09T18:09:07Z","updated_at":"2018-07-09T18:09:07Z","author_association":"NONE","body":"@enj: The following test **failed**, say `/retest` to rerun them all:\n\nTest name | Commit | Details | Rerun command\n--- | --- | --- | ---\nci/openshift-jenkins/cross | 7f73ea40cfe2b7e4157b26869c8dcb60a61a7214 | [link](https://openshift-gce-devel.appspot.com/build/origin-ci-test/pr-logs/pull/11909/test_pull_request_origin_cross/2117/) | `/test cross`\n\n[Full PR test history](https://openshift-gce-devel.appspot.com/pr/11909). [Your PR dashboard](https://openshift-gce-devel.appspot.com/pr/enj). Please help us cut down on flakes by [linking to](https://github.com/kubernetes/community/blob/master/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/openshift/origin/issues?q=is:issue+is:open) when you hit one in your PR.\n\n<details>\n\nInstructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/devel/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).\n</details>\n<!-- test report -->"}}
{"actor":{"display_login":"openshift-ci-robot"}}