Job creation fails during fabric8:apply with error: forbidden

[ValentinLutz]

Description

When using mvn fabric8:resource fabric8:apply in the given sample project i get the following error:

[INFO] Scanning for projects...
[INFO]                                                                         
[INFO] ------------------------------------------------------------------------
[INFO] Building abcd 1.0-SNAPSHOT
[INFO] ------------------------------------------------------------------------
[INFO] 
[INFO] --- fabric8-maven-plugin:4.1.0:resource (default-cli) @ abcd ---
[INFO] F8: Using docker image name of namespace: myproject
[INFO] F8: using resource templates from C:\Users\vlutz\Projects\openshift-job\fabric8
[INFO] F8: fmp-revision-history: Adding revision history limit to 2
[INFO] F8: validating C:\Users\vlutz\Projects\openshift-job\target\classes\META-INF\fabric8\kubernetes\pi-job.yml resource
[INFO] F8: using resource templates from C:\Users\vlutz\Projects\openshift-job\fabric8
[INFO] F8: fmp-revision-history: Adding revision history limit to 2
[INFO] F8: validating C:\Users\vlutz\Projects\openshift-job\target\classes\META-INF\fabric8\openshift\pi-job.yml resource
[INFO] 
[INFO] --- fabric8-maven-plugin:4.1.0:apply (default-cli) @ abcd ---
[INFO] F8: Using OpenShift at https://10.0.75.2:8443/ in namespace myproject with manifest C:\Users\vlutz\Projects\openshift-job\target\classes\META-INF\fabric8\openshift.yml 
[INFO] OpenShift platform detected
[INFO] F8: Using project: myproject
[INFO] F8: Applying Job pi from openshift.yml
[ERROR] F8: Failed to create Job from openshift.yml. io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: GET at: https://10.0.75.2:8443/apis/batch/v1/namespaces/myproject/jobs/pi. Message: Forbidden! User developer/10-0-75-2:8443 doesn't have permission. jobs.extensions "pi" is forbidden: User "developer" cannot get jobs.extensions in the namespace "myproject": User "developer" cannot get jobs.extensions in project "myproject".: io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: GET at: https://10.0.75.2:8443/apis/batch/v1/namespaces/myproject/jobs/pi. Message: Forbidden! User developer/10-0-75-2:8443 doesn't have permission. jobs.extensions "pi" is forbidden: User "developer" cannot get jobs.extensions in the namespace "myproject": User "developer" cannot get jobs.extensions in project "myproject".
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 7.894 s
[INFO] Finished at: 2019-06-05T10:49:15+02:00
[INFO] Final Memory: 22M/77M
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal io.fabric8:fabric8-maven-plugin:4.1.0:apply (default-cli) on project abcd: Failed to create Job from openshift.yml. io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: GET at: https://10.0.75.2:8443/apis/batch/v1/namespaces/myproject/jobs/pi. Message: Forbidden! User developer/10-0-75-2:8443 doesn't have permission. jobs.extensions "pi" is forbidden: User "developer" cannot get jobs.extensions in the namespace "myproject": User "developer" cannot get jobs.extensions in project "myproject". -> [Help 1]
[ERROR] 
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR] 
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException

But with curl i have no permission problem

curl -k -H "Authorization: Bearer qKqaYkIFumcwX7CtZ711CcUt_ILTFpijEqQrWfLtCQE" -H 'Accept: application/json' https ://10.0.75.2:8443/apis/batch/v1/namespaces/myproject/jobs
{
  "kind": "JobList",
  "apiVersion": "batch/v1",
  "metadata": {
    "selfLink": "/apis/batch/v1/namespaces/myproject/jobs",
    "resourceVersion": "7131"
  },
  "items": []

 curl -k -H "Authorization: Bearer qKqaYkIFumcwX7CtZ711CcUt_ILTFpijEqQrWfLtCQE" -H 'Accept: application/json' https ://10.0.75.2:8443/apis/batch/v1/namespaces/myproject/jobs/pi
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {},
  "status": "Failure",
  "message": "jobs.batch \"pi\" not found",
  "reason": "NotFound",
  "details": {
    "name": "pi",
    "group": "batch",
    "kind": "jobs"
  },
  "code": 404

I alos can create the job with the yaml file over the openshift-cli

oc create -f job.yaml
job "pi" created

Info

• f-m-p version : 4.1.0
• Maven version (mvn -v) : 3.3.9
• Kubernetes / OpenShift setup and version : v3.9.0+191fece
• Sample project : https://github.com/ValentinLutz/openshift-job.git

[rohanKanojia]

Hmm, strange. Will try to reproduce.

[rohanKanojia]

I can confirm that this is happening, this is due to additional selectors being added in job spec:

Current generated Job yaml(on 4.1.0)

~/work/repos/openshift-job : $ cat /home/Rohaan/work/repos/openshift-job/target/classes/META-INF/fabric8/openshift/rohan-job-job.yml
---
apiVersion: batch/v1
kind: Job
metadata:
  annotations:
    fabric8.io/git-commit: 802f766ec5355c4163ed418cbcbd7cac97a16644
    fabric8.io/git-branch: master
    fabric8.io/git-url: [email protected]:ValentinLutz/openshift-job.git
  labels:
    app: abcd
    provider: fabric8
    version: 1.0-SNAPSHOT
    group: d.c.b.a
  name: rohan-job
spec:
  completions: 1
  parallelism: 1
  selector:
    matchLabels:
      app: abcd
      provider: fabric8
      version: 1.0-SNAPSHOT
      group: d.c.b.a
  template:
    metadata:
      labels:
        app: abcd
        provider: fabric8
        version: 1.0-SNAPSHOT
        group: d.c.b.a
      name: rohan-job
    spec:
      containers:
      - command:
        - perl
        - -Mbignum=bpi
        - -wle
        - print bpi(2000)
        image: perl
        name: rohan-job
      restartPolicy: OnFailure

Older Job resource yaml (on 3.5.42)

---
apiVersion: batch/v1
kind: Job
metadata:
  annotations:
    fabric8.io/git-commit: 802f766ec5355c4163ed418cbcbd7cac97a16644
    fabric8.io/git-branch: master
    fabric8.io/metrics-path: dashboard/file/kubernetes-pods.json/?var-project=abcd&var-version=1.0-SNAPSHOT
  labels:
    app: abcd
    provider: fabric8
    version: 1.0-SNAPSHOT
    group: d.c.b.a
  name: rohan-job
spec:
  completions: 1
  parallelism: 1
  template:
    metadata:
      labels:
        app: abcd
        provider: fabric8
        version: 1.0-SNAPSHOT
        group: d.c.b.a
      name: rohan-job
    spec:
      containers:
      - command:
        - perl
        - -Mbignum=bpi
        - -wle
        - print bpi(2000)
        image: perl
        name: rohan-job
      restartPolicy: OnFailure