document namespace stripping behavior of oc process

[deads2k]

I created a template that used ${PROJECT_NAME} multiple times, but it only got substituted once. See the output below

[deads@deads-dev-01 origin]$ oc get -n openshift templates/project-request -o yaml
apiVersion: v1
kind: Template
metadata:
  creationTimestamp: 2015-07-22T17:14:37Z
  name: project-request
  namespace: openshift
  resourceVersion: "3522"
  selfLink: /osapi/v1beta3/namespaces/openshift/templates/project-request
  uid: 21afea98-3095-11e5-828b-28d2447dc82b
objects:
- apiVersion: v1
  displayName: ${PROJECT_DISPLAYNAME}
  kind: Project
  metadata:
    annotations:
      description: ${PROJECT_DESCRIPTION}
      displayName: ${PROJECT_DISPLAYNAME}
    name: ${PROJECT_NAME}
  spec: {}
  status: {}
- apiVersion: v1
  groupNames: []
  kind: RoleBinding
  metadata:
    name: admins
    namespace: ${PROJECT_NAME}
  roleRef:
    name: admin
  userNames:
  - ${PROJECT_ADMIN_USER}
- apiVersion: v1
  kind: ResourceQuota
  metadata:
    name: quota
    namespace: ${PROJECT_NAME}
  spec:
    hard:
      cpu: "20"
      memory: 1Gi
      pods: "10"
      replicationcontrollers: "5"
      resourcequotas: "1"
      services: "5"
parameters:
- name: PROJECT_NAME
- name: PROJECT_DISPLAYNAME
- name: PROJECT_DESCRIPTION
- name: PROJECT_ADMIN_USER
[deads@deads-dev-01 origin]$ oc process -n openshift project-request -v PROJECT_NAME=demo,PROJECT_DISPLAYNAME=demo,PROJECT_DESCRIPTION="a fine demo",PROJECT_ADMIN_USER=joe
{
    "kind": "List",
    "apiVersion": "v1beta3",
    "metadata": {},
    "items": [
        {
            "apiVersion": "v1",
            "displayName": "demo",
            "kind": "Project",
            "metadata": {
                "annotations": {
                    "description": "a fine demo",
                    "displayName": "demo"
                },
                "name": "demo"
            },
            "spec": {},
            "status": {}
        },
        {
            "apiVersion": "v1",
            "groupNames": [],
            "kind": "RoleBinding",
            "metadata": {
                "name": "admins",
                "namespace": ""
            },
            "roleRef": {
                "name": "admin"
            },
            "userNames": [
                "joe"
            ]
        },
        {
            "apiVersion": "v1",
            "kind": "ResourceQuota",
            "metadata": {
                "name": "quota",
                "namespace": ""
            },
            "spec": {
                "hard": {
                    "cpu": "20",
                    "memory": "1Gi",
                    "pods": "10",
                    "replicationcontrollers": "5",
                    "resourcequotas": "1",
                    "services": "5"
                }
            }
        }
    ]
}
[deads@deads-dev-01 origin]$ 

@bparees who should have this?

@thoraxe fyi

[bparees]

i'll look at it later, but i think your description is wrong. multiple substitution definitely works, our samples all use it for db password. I suspect there's an issue w/ substitution into the ResourceQuota api object.

have you confirmed if you use a value instead of a parameter, that the value doesn't get eaten?

[deads2k]

have you confirmed if you use a value instead of a parameter, that the value doesn't get eaten?

You are correct, it gets eaten. The namespace comes back cleanly from a straight get of the template (oc get -n openshift template project-request -o yaml) and as part of a list (oc get quota -o yaml), so I wouldn't suspect conversions.

[deads2k]

@bparees this line is responsible and makes it impossible for me to create a template where I substitute in the value of two different namespaces to modify two projects at the same time.

https://github.com/openshift/origin/blob/master/pkg/template/template.go#L56

[bparees]

discussed with @deads2k, this is working correctly but we should do some doc so the behavior is better understood. and comment the "stripNames" line in the code.

[bparees]

to clarify further: namespace stripping is required since objects are going to get created in the namespace you are running the create (instantiate of template) in.

[smarterclayton]

I'm tempted to fix this. It's annoying. The original arguments were for a more limited namespace case, but templates are generally useful for many things.

[bparees]

@smarterclayton so instantiating a template could create objects across multiple namespaces, where objects would by default go into the current namespace, but if a namespace was specified on the object they'd go there instead? that's probably a backwards incompatible change since today we just strip the namespace if your template objects happen to have one.

[smarterclayton]

Probably would only be safe if we kept namespaces that had a replacement value (namespace: ${FOO} is not accidental). I did a quick scrape of github and about 1/30 templates in source code had namespaces on their objects. So not safe without some affordance. On Feb 3, 2017, at 7:33 PM, Ben Parees <[email protected]> wrote: @smarterclayton <https://github.com/smarterclayton> so instantiating a template could create objects across multiple namespaces, where objects would by default go into the current namespace, but if a namespace was specified on the object they'd go there instead? that's probably a backwards incompatible change since today we just strip the namespace if your template objects happen to have one. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#3840 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABG_p6K3qwUEtp402dOUm2m_3M38KKc3ks5rY8dRgaJpZM4FdwbS> .

[bparees]

So this would require:

1. updating the process api endpoint to check if the namespace field was parameterized and leave it alone if so, otherwise strip it (as i guess it currently does, but we'd have do to this before substitution now)

2. update all the clients that are instantiating templates to look at the namespace of the object they are about to instantiate(the one they got back from process), strip the namespace and do the create of the object in the correct namespace (so new-app, web console, eclipse, anyone else who's implemented instantiate)

[smarterclayton]

They should be doing 2 anyway.

Another option is to add a cluster template config endpoint (outside of the namespace scope). It would not strip namespace. We actually probably want one of these anyway. We'd have to figure out how to decide whether to use it.

[bparees]

fixed in #12918