[regression] oc explain doesn't work

[php-coder]

oc explain doesn't work anymore on the latest version:

$ oc explain Pod
Error from server (Forbidden): unknown

Version

oc v3.9.0-alpha.0+1c24d18-233-dirty
kubernetes v1.8.1+0d5291c
features: Basic-Auth GSSAPI Kerberos SPNEGO

Server https://10.34.129.148:8443
openshift v3.9.0-alpha.0+1c24d18-233-dirty
kubernetes v1.8.1+0d5291c

Steps To Reproduce

1. oc cluster up --version=latest
2. oc explain Pod

Current Result

$ oc explain Pod --loglevel=8
I1219 11:28:07.046240   27763 loader.go:357] Config loaded from file /home/coder/.kube/config
I1219 11:28:07.058325   27763 round_trippers.go:414] GET https://10.34.129.148:8443/swagger-2.0.0.pb-v1
I1219 11:28:07.058338   27763 round_trippers.go:421] Request Headers:
I1219 11:28:07.058346   27763 round_trippers.go:424]     Accept: application/json, */*
I1219 11:28:07.058353   27763 round_trippers.go:424]     User-Agent: oc/v1.8.1+0d5291c (linux/amd64) kubernetes/0d5291c
I1219 11:28:07.058359   27763 round_trippers.go:424]     Authorization: Bearer zMHaSA8jdJtUPX9cDEPdT9TSbzXqRsQSaZxXCQYi-eQ
I1219 11:28:07.068940   27763 round_trippers.go:439] Response Status: 403 Forbidden in 10 milliseconds
I1219 11:28:07.068962   27763 round_trippers.go:442] Response Headers:
I1219 11:28:07.068973   27763 round_trippers.go:445]     Content-Type: application/json
I1219 11:28:07.068980   27763 round_trippers.go:445]     X-Content-Type-Options: nosniff
I1219 11:28:07.068989   27763 round_trippers.go:445]     Content-Length: 260
I1219 11:28:07.068996   27763 round_trippers.go:445]     Date: Tue, 19 Dec 2017 10:28:07 GMT
I1219 11:28:07.069003   27763 round_trippers.go:445]     Cache-Control: no-store
I1219 11:28:07.069081   27763 request.go:873] Response Body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"forbidden: User \"developer\" cannot get path \"/swagger-2.0.0.pb-v1\": User \"developer\" cannot \"get\" on \"/swagger-2.0.0.pb-v1\"","reason":"Forbidden","details":{},"code":403}
I1219 11:28:07.069282   27763 helpers.go:201] server response object: [{
  "metadata": {},
  "status": "Failure",
  "message": "unknown",
  "reason": "Forbidden",
  "details": {
	"causes": [
	  {
		"reason": "UnexpectedServerResponse",
		"message": "unknown"
	  }
	]
  },
  "code": 403
}]
F1219 11:28:07.069316   27763 helpers.go:119] Error from server (Forbidden): unknown
$ oc policy can-i get /swagger-2.0.0.pb-v1
no

Expected Result

Pod schema should be displayed.

[php-coder]

CC @enj @deads2k @liggitt

[php-coder]

I tried to use older versions but it didn't work too, that surprised me. I tried to remove ~/.kube but the error remains the same. I tried to grant system:discovery role (and clusterrole) to the developer and it also didn't work. I don't know what is it.

[deads2k]

Is this different than #17766 ? When you run as a cluster-admin does it work or fail?

[deads2k]

Opened #17874 for permissions, but I still suspect it will fail

[php-coder]

Is this different than #17766 ?

Looks like the same.

When you run as a cluster-admin does it work or fail?

Yes, it works.