oc:build on openshift use pods/log to retrieve logs from build #2844
Description
Hello support,
We running the openshift-maven-plugin against our openshift cluster to build images. The build its self works and pushes to artifactory without any errors.
But we got this message, which shows an error retrieving the logs for that build job.
[INFO] oc: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"pods ?? is forbidden: User \"system:serviceaccount:ns:user\" cannot get resource \"pods/log\" in API group \"\" in the namespace \"auswamt\"","reason":"Forbidden","details":{"name":"app-s2i-7-build","kind":"pods"},"code":403}
The message shows that the plugin need access to the resource of pods/log. If I test this with the oc command (oc logs -f build/app-s2i-9), I can retrieve the logs with a service account without access to pods/log.
The service account is defined with the following rules:
rules:
- verbs:
- create
- delete
- get
- list
- patch
- update
- watch
apiGroups:
- ''
- build.openshift.io
resources:
- buildconfigs
- verbs:
- create
apiGroups:
- ''
- build.openshift.io
resources:
- buildconfigs/instantiate
- buildconfigs/instantiatebinary
- verbs:
- get
- list
- watch
apiGroups:
- ''
- build.openshift.io
resources:
- builds
- builds/log
In my opinion, the builds/log resource access should be sufficient to retrive the logs of oc:build. Can you adjust this, as it's not a good idea to give more rights than necessary.
openshift-maven-plugin: 1.16.1
Thanks for your work and best regards,
Steffen