This change seems to be breaking my application when upgrading from 6.5.0 to 6.5.1?

[shawkins]

          This change seems to be breaking my application when upgrading from 6.5.0 to 6.5.1?

Exception in thread "main" io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: GET at: https://paas.***.be:443/apis/template.openshift.io/v1/namespaces/cbss-test-custom-jobs/templates. Message: templates.template.openshift.io is forbidden: User "system:anonymous" cannot list templates.template.openshift.io in the namespace "cbss-test-custom-jobs": no RBAC policy matched. Received status: Status(apiVersion=v1, code=403, details=StatusDetails(causes=[], group=template.openshift.io, kind=templates, name=null, retryAfterSeconds=null, uid=null, additionalProperties={}), kind=Status, message=templates.template.openshift.io is forbidden: User "system:anonymous" cannot list templates.template.openshift.io in the namespace "cbss-test-custom-jobs": no RBAC policy matched, metadata=ListMeta(_continue=null, remainingItemCount=null, resourceVersion=null, selfLink=null, additionalProperties={}), reason=Forbidden, status=Failure, additionalProperties={}).
	at io.fabric8.kubernetes.client.KubernetesClientException.copyAsCause(KubernetesClientException.java:238)
	at io.fabric8.kubernetes.client.dsl.internal.OperationSupport.waitForResult(OperationSupport.java:546)
	at io.fabric8.kubernetes.client.dsl.internal.BaseOperation.list(BaseOperation.java:424)
	at io.fabric8.kubernetes.client.dsl.internal.BaseOperation.list(BaseOperation.java:392)
	at io.fabric8.kubernetes.client.dsl.internal.BaseOperation.list(BaseOperation.java:93)
	at be.fgov.kszbcss.batch.client.OpenShiftJobClient.listJobTemplates(OpenShiftJobClient.java:61)
	at be.fgov.kszbcss.batch.cli.ListJobCommand.call(ListJobCommand.java:11)
	at be.fgov.kszbcss.batch.cli.ListJobCommand.main(ListJobCommand.java:27)
Caused by: io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: GET at: https://paas.***.be:443/apis/template.openshift.io/v1/namespaces/cbss-test-custom-jobs/templates. Message: templates.template.openshift.io is forbidden: User "system:anonymous" cannot list templates.template.openshift.io in the namespace "cbss-test-custom-jobs": no RBAC policy matched. Received status: Status(apiVersion=v1, code=403, details=StatusDetails(causes=[], group=template.openshift.io, kind=templates, name=null, retryAfterSeconds=null, uid=null, additionalProperties={}), kind=Status, message=templates.template.openshift.io is forbidden: User "system:anonymous" cannot list templates.template.openshift.io in the namespace "cbss-test-custom-jobs": no RBAC policy matched, metadata=ListMeta(_continue=null, remainingItemCount=null, resourceVersion=null, selfLink=null, additionalProperties={}), reason=Forbidden, status=Failure, additionalProperties={}).
	at io.fabric8.kubernetes.client.dsl.internal.OperationSupport.requestFailure(OperationSupport.java:701)
	at io.fabric8.kubernetes.client.dsl.internal.OperationSupport.requestFailure(OperationSupport.java:681)
	at io.fabric8.kubernetes.client.dsl.internal.OperationSupport.assertResponseCode(OperationSupport.java:630)
	at io.fabric8.kubernetes.client.dsl.internal.OperationSupport.lambda$handleResponse$0(OperationSupport.java:591)
	at java.base/java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:642)
	at java.base/java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:506)
	at java.base/java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:2073)
	at io.fabric8.kubernetes.client.http.StandardHttpClient.lambda$completeOrCancel$5(StandardHttpClient.java:120)
	at java.base/java.util.concurrent.CompletableFuture.uniWhenComplete(CompletableFuture.java:859)
	at java.base/java.util.concurrent.CompletableFuture$UniWhenComplete.tryFire(CompletableFuture.java:837)
	at java.base/java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:506)
	at java.base/java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:2073)
	at io.fabric8.kubernetes.client.http.ByteArrayBodyHandler.onBodyDone(ByteArrayBodyHandler.java:52)
	at java.base/java.util.concurrent.CompletableFuture.uniWhenComplete(CompletableFuture.java:859)
	at java.base/java.util.concurrent.CompletableFuture$UniWhenComplete.tryFire(CompletableFuture.java:837)
	at java.base/java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:506)
	at java.base/java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:2073)
	at io.fabric8.kubernetes.client.okhttp.OkHttpClientImpl$OkHttpAsyncBody.doConsume(OkHttpClientImpl.java:135)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at java.base/java.lang.Thread.run(Thread.java:834)

Originally posted by @jpraet in #4970 (comment)

[shawkins]

Moved to a separate issue. Is this effectively a bug with openshift that fabric8 was compenstating for but other clients such as kubectl or oc are not? My understanding with 403 is that re-authentication won't make any difference. Or is there something else going on here?

[jpraet]

Looks like the 403 handling has been there from the start: a926786

I am authenticating with username and password. From what I see in the exception stacktrace
User "system:anonymous" cannot list templates.template.openshift.io in the namespace
it seems to be calling the API first without authenticating? Resulting in 403 for anonymous access?

[shawkins]

Looks like the 403 handling has been there from the start: a926786

Yes and we could not figure out why that handling was there.

I am authenticating with username and password. From what I see in the exception stacktrace User "system:anonymous" cannot list templates.template.openshift.io in the namespace it seems to be calling the API first without authenticating? Resulting in 403 for anonymous access?

Ah that is the issue, the auth interceptor is allowing the initial request to go through - even if the token does not yet exist. If the token isn't set, it should authenticate first - that will require a code change. Right now it will trigger a refresh and requests will fail until that completes - do you see that later reqeusts are successful?