Broken tagging between projects with 1.0.12

[livelace]

https://paste.fedoraproject.org/368841/14637447/

With 1.0.11 all working fine.

[gabemontero]

OK ... I think I've reproduced this, though some confirmation of the details would be good. In particular, from the job output provided, I surmised that: 1) Jenkins was not running in either of the projects involved in the tagging 2) as such, you provided auth tokens for both the source and destination projects 3) I took at stab and guessed you provided edit access of the destination project to the service account of the source project 4) If so, I believe I saw the tagging work from scratch with v1.0.11, but not work with v1.0.12 5) Conversely, if the image stream already existed, it failed with v1.0.11 (a known bug I fixed in v1.0.12), but worked with v1.0.12

Also, after reproducing, I was able to address the issue without having to make a code change to the plugin, but instead run an additional oc policy add-role-to-user command, adding edit access of the source project to the service account of the destination project (the inverse if you will for what I did in 3) above). When doing this, the tagging then worked for me (irregardless of whether the ImageStream previously existed or not) with v1.0.12.

With those details, and for handling the previous bug wrt the image stream existing, I believe this is the correct approach (updating the policy of the service account of each project), and I'll be updating the README.

@livelace - assuming my repro attempt sounds close enough to your env, please try adding edit access to the service accounts of each project to themselves as well as the project on the other side of the oc tag operation, and let me know the results.

[livelace]

@gabemontero

Its works. Thanks. So we should give "edit" access to source and destination projects in future ?

[gabemontero]

Thanks for the confirmation @livelace . For now, the answer is "yes" to your question.

We do have some discussions going on in the background wrt our Jenkins scenarios and the various roles/bindings/access for the associated service accounts. I also want to circle back to this and experiment with varying the roles used, see if something less than edit is workable.

I'll keep this issue open until I minimally try those experiments, or if the background discussions I referenced reach a conclusion relatively soon.

[gabemontero]

@livelace - finally circled back to this, and confirmed that each project's service account needs edit access to the other project. There are updates that occur to the source project's image stream as part of creating the destination tag.

[livelace]

@gabemontero Thanks!