Issue 1:
[Fail] [k8s.io] NodeProblemDetector [k8s.io] KernelMonitor [It] should generate event when temporary error happens

https://console.cloud.google.com/storage/browser/kubernetes-jenkins/pr-logs/pull/26894/kubernetes-pull-build-test-e2e-gce/44457/

â€¢ Failure [42.980 seconds]
[k8s.io] NodeProblemDetector
/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:660
[k8s.io] KernelMonitor
/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:660
should generate event when temporary error happens [It]
/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/node_problem_detector.go:221

Expected success, but got an error:
<*errors.errorString | 0xc820b9cb30>: {
s: "node condition \"TestCondition\" not found",
}
node condition "TestCondition" not found

Issue 2:
Is this a request for help? (If yes, you should use our troubleshooting guide and community support channels, see http://kubernetes.io/docs/troubleshooting/.):

No, already discussed on sig-auth

What keywords did you search in Kubernetes issues before filing this one? (If you have found any duplicates, you should instead reply there.):

confirmed issue on sig-auth channel

Is this a BUG REPORT or FEATURE REQUEST? (choose one):

Depends on interpretation

Kubernetes version (use kubectl version):

Client Version: version.Info{Major:"1", Minor:"3", GitVersion:"v1.3.0", GitCommit:"283137936a498aed572ee22af6774b6fb6e9fd94", GitTreeState:"clean", BuildDate:"2016-07-01T19:26:38Z", GoVersion:"go1.6.2", Compiler:"gc", Platform:"darwin/amd64"}

Server Version: version.Info{Major:"1", Minor:"3", GitVersion:"v1.3.4+coreos.0", GitCommit:"be9bf3e842a90537e48361aded2872e389e902e7", GitTreeState:"clean", BuildDate:"2016-08-02T00:54:53Z", GoVersion:"go1.6.2", Compiler:"gc", Platform:"linux/amd64"}

Environment:

Cloud provider or hardware configuration: CoreOS Vagrant Image

OS (e.g. from /etc/os-release):

NAME=CoreOS

ID=coreos

VERSION=1122.0.0

VERSION_ID=1122.0.0

BUILD_ID=2016-07-27-0739

PRETTY_NAME="CoreOS 1122.0.0 (MoreOS)"

ANSI_COLOR="1;32"

HOME_URL="https://coreos.com/"

BUG_REPORT_URL="https://github.com/coreos/bugs/issues"

Kernel (e.g. uname -a):

Linux localhost 4.7.0-coreos #1 SMP Wed Jul 27 07:30:04 UTC 2016 x86_64 Intel(R) Core(TM) i7-4980HQ CPU @ 2.80GHz GenuineIntel GNU/Linux

Install tools:

Vagrant

Others:

What happened:

The claim named in --oidc-groups-claim MUST be list of strings, even if there is only one value. Talking to @ericchiang this is by design since its assumed that users will have more then one group.

What you expected to happen:

The OIDC authenticator should accept either a list of strings or a single string since:

There is no concept of schema that marks an attribute as single value or multi value in JSON or a JWT

There is no standard for representing groups in a JWT

There is no standard for representing groups in OIDC

An OIDC should be flexible in how it accepts data.

How to reproduce it (as minimally and precisely as possible):

Deploy with RBAC enabled

Create a role binding for the group "admin"

Generate a JWT such as the one that does NOT work below

User won't be able to login

Generate a JWT where the role is multi-value

User will be authorized

Does NOT Work:

{
"iss": "https://mlb.tremolo.lan:8043/auth/idp/oidc",
"aud": "kubernetes",
"exp": 1474562249,
"jti": "8UgF8is2XOgqPUlExxlsdg",
"iat": 1474562189,
"nbf": 1474562069,
"sub": "mmosley",
"user_role": "admin",
"email": "matt.mosley@tremolosecurity-test.com"
}

DOES Work:

{
"iss": "https://mlb.tremolo.lan:8043/auth/idp/oidc",
"aud": "kubernetes",
"exp": 1474564875,
"jti": "3Oo35Su-oXPX3RoUY91xXg",
"iat": 1474564815,
"nbf": 1474564695,
"sub": "mmosley",
"user_role": [
"admin",
"users",
"approvers"
],
"email": "matt.mosley@tremolosecurity-test.com"
}

Anything else do we need to know: