opened
fxue
username_0
Found this while resolving Kubeflow [issue](https://github.com/kubeflow/kubeflow/issues/521).
copying it here.

ok - updated the ksonnet version
```
➜  ks version
ksonnet version: 0.9.2
jsonnet version: v0.9.5
client-go version: 1.8
```
getting a different 404 error now. 
```
➜  ks show ${KF_ENV} -c kubeflow-core
ERROR Recieved status code '404' when trying to retrieve OpenAPI schema for cluster version 'v3.9.14' from URL 'https://raw.githubusercontent.com/kubernetes/kubernetes/v3.9.14/api/openapi-spec/swagger.json'

```
seems like the problem is with using the openshift version instead of k8s version
```
➜ oc version
oc v3.9.7
kubernetes v1.9.1+a0ce1bc657
features: Basic-Auth

Server https://api.starter-us-west-1.openshift.com:443
openshift v3.9.14
kubernetes v1.9.1+a0ce1bc657
```
ksonnet + openshift picking up wrong k8s version number
issue
created
fxue
username_0
trying 
```
oc adm policy add-scc-to-user anyuid -z ambassador
oc adm policy add-scc-to-user anyuid -z jupyter-hub

```
comment
created
pdmack
username_1
@username_0 unfortunately you won't be able to deploy Kubeflow in Online as a developer. It has RBAC enabled and you would need to be "system:admin".
comment
created
fxue
username_0
thanks @username_1. Indeed, this is the error I am getting. 
Since I work at Google cloud so looking for the best way to do a fully managed service or do a GCP deployment. Talking to the partner team on my side Monday on how best to proceed forward.
```
➜  my-kubeflow oc adm policy add-scc-to-user anyuid -z ambassador
oc adm policy add-scc-to-user anyuid -z jupyter-hub

Error from server (Forbidden): securitycontextconstraints.security.openshift.io "anyuid" is forbidden: User "***@***.com" cannot get securitycontextconstraints.security.openshift.io at the cluster scope: User "***@***.com" cannot get securitycontextconstraints.security.openshift.io at the cluster scope
Error from server (Forbidden): securitycontextconstraints.security.openshift.io "anyuid" is forbidden: User "***@***.com" cannot get securitycontextconstraints.security.openshift.io at the cluster scope: User "***@***.com" cannot get securitycontextconstraints.security.openshift.io at the cluster scope
```
comment
created
jayunit100
username_2
Some quick thoughts, new to this but i think underlying need to separate these namespaces if possible for security in the future... and for more composable installation to @username_1 's point.

### for now
The simple fix on an openshift cluster would be to give cluster admin to your current user, from ambassadors docs , similar in kube.

*kubectl*:  `kubectl create clusterrolebinding my-cluster-admin-binding --clusterrole=cluster-admin --user=$(gcloud info --format="value(config.account)")`, and for openshift, thats probably equivalent to 

*openshift* something like `oc adm policy add-cluster-role-to-user cluster-admin user --rolebinding-name=cluster-admin`... right?
 
### future ?
- The fix, i think , would be to decouple ambassador and jupyter-hub installations as separate components from kubeflow, From there
- come up w/ ways to apply PLP to the core kubeflow pods, and keep cluster-admin for those 2 and then
- let people independently come up w/ policies on how they want to install jupyter and ambassador, and just gate on those svc's being available.
comment