<p dir="auto">[Fail] [k8s.io] NodeProblemDetector [k8s.io] KernelMonitor [It] should generate event when temporary error happens</p>
<p dir="auto"><a href="https://console.cloud.google.com/storage/browser/kubernetes-jenkins/pr-logs/pull/26894/kubernetes-pull-build-test-e2e-gce/44457/" rel="nofollow">https://console.cloud.google.com/storage/browser/kubernetes-jenkins/pr-logs/pull/26894/kubernetes-pull-build-test-e2e-gce/44457/</a></p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="â€¢ Failure [42.980 seconds]
[k8s.io] NodeProblemDetector
/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:660
  [k8s.io] KernelMonitor
  /go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:660
    should generate event when temporary error happens [It]
    /go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/node_problem_detector.go:221

    Expected success, but got an error:
        &lt;*errors.errorString | 0xc820b9cb30&gt;: {
            s: &quot;node condition \&quot;TestCondition\&quot; not found&quot;,
        }
        node condition &quot;TestCondition&quot; not found
"><pre class="notranslate"><code class="notranslate">â€¢ Failure [42.980 seconds]
[k8s.io] NodeProblemDetector
/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:660
  [k8s.io] KernelMonitor
  /go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:660
    should generate event when temporary error happens [It]
    /go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/node_problem_detector.go:221

    Expected success, but got an error:
        &lt;*errors.errorString | 0xc820b9cb30&gt;: {
            s: "node condition \"TestCondition\" not found",
        }
        node condition "TestCondition" not found

</code></pre></div>
<p dir="auto"><strong>Is this a request for help?</strong> (If yes, you should use our troubleshooting guide and community support channels, see <a href="http://kubernetes.io/docs/troubleshooting/" rel="nofollow">http://kubernetes.io/docs/troubleshooting/</a>.):</p>
<p dir="auto">No, already discussed on sig-auth</p>
<p dir="auto"><strong>What keywords did you search in Kubernetes issues before filing this one?</strong> (If you have found any duplicates, you should instead reply there.):</p>
<p dir="auto">confirmed issue on sig-auth channel</p>
<hr>
<p dir="auto"><strong>Is this a BUG REPORT or FEATURE REQUEST?</strong> (choose one):</p>
<p dir="auto">Depends on interpretation</p>

<p dir="auto"><strong>Kubernetes version</strong> (use <code class="notranslate">kubectl version</code>):</p>
<p dir="auto">Client Version: version.Info{Major:"1", Minor:"3", GitVersion:"v1.3.0", GitCommit:"283137936a498aed572ee22af6774b6fb6e9fd94", GitTreeState:"clean", BuildDate:"2016-07-01T19:26:38Z", GoVersion:"go1.6.2", Compiler:"gc", Platform:"darwin/amd64"}<br>
Server Version: version.Info{Major:"1", Minor:"3", GitVersion:"v1.3.4+coreos.0", GitCommit:"be9bf3e842a90537e48361aded2872e389e902e7", GitTreeState:"clean", BuildDate:"2016-08-02T00:54:53Z", GoVersion:"go1.6.2", Compiler:"gc", Platform:"linux/amd64"}</p>
<p dir="auto"><strong>Environment</strong>:</p>
<ul dir="auto">
<li><strong>Cloud provider or hardware configuration</strong>:  CoreOS Vagrant Image</li>
<li><strong>OS</strong> (e.g. from /etc/os-release):</li>
</ul>
<p dir="auto">NAME=CoreOS<br>
ID=coreos<br>
VERSION=1122.0.0<br>
VERSION_ID=1122.0.0<br>
BUILD_ID=2016-07-27-0739<br>
PRETTY_NAME="CoreOS 1122.0.0 (MoreOS)"<br>
ANSI_COLOR="1;32"<br>
HOME_URL="<a href="https://coreos.com/" rel="nofollow">https://coreos.com/</a>"<br>
BUG_REPORT_URL="<a href="https://github.com/coreos/bugs/issues">https://github.com/coreos/bugs/issues</a>"</p>
<ul dir="auto">
<li><strong>Kernel</strong> (e.g. <code class="notranslate">uname -a</code>):</li>
</ul>
<p dir="auto">Linux localhost 4.7.0-coreos <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="35192559" data-permission-text="Title is private" data-url="https://github.com/kubernetes/kubernetes/issues/1" data-hovercard-type="issue" data-hovercard-url="/kubernetes/kubernetes/issues/1/hovercard" href="https://github.com/kubernetes/kubernetes/issues/1">#1</a> SMP Wed Jul 27 07:30:04 UTC 2016 x86_64 Intel(R) Core(TM) i7-4980HQ CPU @ 2.80GHz GenuineIntel GNU/Linux</p>
<ul dir="auto">
<li><strong>Install tools</strong>:</li>
</ul>
<p dir="auto">Vagrant</p>
<ul dir="auto">
<li><strong>Others</strong>:</li>
</ul>
<p dir="auto"><strong>What happened</strong>:</p>
<p dir="auto">The claim named in --oidc-groups-claim MUST be list of strings, even if there is only one value.  Talking to <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/ericchiang/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/ericchiang">@ericchiang</a> this is by design since its assumed that users will have more then one group.</p>
<p dir="auto"><strong>What you expected to happen</strong>:</p>
<p dir="auto">The OIDC authenticator should accept either a list of strings or a single string since:</p>
<ol dir="auto">
<li>There is no concept of schema that marks an attribute as single value or multi value in JSON or a JWT</li>
<li>There is no standard for representing groups in a JWT</li>
<li>There is no standard for representing groups in OIDC</li>
</ol>
<p dir="auto">An OIDC should be flexible in how it accepts data.</p>
<p dir="auto"><strong>How to reproduce it</strong> (as minimally and precisely as possible):</p>
<ol dir="auto">
<li>Deploy with RBAC enabled</li>
<li>Create a role binding for the group "admin"</li>
<li>Generate a JWT such as the one that does NOT work below</li>
<li>User won't be able to login</li>
<li>Generate a JWT where the role is multi-value</li>
<li>User will be authorized</li>
</ol>
<p dir="auto">Does <em>NOT</em> Work:</p>
<div class="highlight highlight-source-json notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="{
  &quot;iss&quot;: &quot;https://mlb.tremolo.lan:8043/auth/idp/oidc&quot;,
  &quot;aud&quot;: &quot;kubernetes&quot;,
  &quot;exp&quot;: 1474562249,
  &quot;jti&quot;: &quot;8UgF8is2XOgqPUlExxlsdg&quot;,
  &quot;iat&quot;: 1474562189,
  &quot;nbf&quot;: 1474562069,
  &quot;sub&quot;: &quot;mmosley&quot;,
  &quot;user_role&quot;: &quot;admin&quot;,
  &quot;email&quot;: &quot;matt.mosley@tremolosecurity-test.com&quot;
}"><pre class="notranslate">{
  <span class="pl-ent">"iss"</span>: <span class="pl-s"><span class="pl-pds">"</span>https://mlb.tremolo.lan:8043/auth/idp/oidc<span class="pl-pds">"</span></span>,
  <span class="pl-ent">"aud"</span>: <span class="pl-s"><span class="pl-pds">"</span>kubernetes<span class="pl-pds">"</span></span>,
  <span class="pl-ent">"exp"</span>: <span class="pl-c1">1474562249</span>,
  <span class="pl-ent">"jti"</span>: <span class="pl-s"><span class="pl-pds">"</span>8UgF8is2XOgqPUlExxlsdg<span class="pl-pds">"</span></span>,
  <span class="pl-ent">"iat"</span>: <span class="pl-c1">1474562189</span>,
  <span class="pl-ent">"nbf"</span>: <span class="pl-c1">1474562069</span>,
  <span class="pl-ent">"sub"</span>: <span class="pl-s"><span class="pl-pds">"</span>mmosley<span class="pl-pds">"</span></span>,
  <span class="pl-ent">"user_role"</span>: <span class="pl-s"><span class="pl-pds">"</span>admin<span class="pl-pds">"</span></span>,
  <span class="pl-ent">"email"</span>: <span class="pl-s"><span class="pl-pds">"</span>matt.mosley@tremolosecurity-test.com<span class="pl-pds">"</span></span>
}</pre></div>
<p dir="auto"><em>DOES</em> Work:</p>
<div class="highlight highlight-source-json notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="{
  &quot;iss&quot;: &quot;https://mlb.tremolo.lan:8043/auth/idp/oidc&quot;,
  &quot;aud&quot;: &quot;kubernetes&quot;,
  &quot;exp&quot;: 1474564875,
  &quot;jti&quot;: &quot;3Oo35Su-oXPX3RoUY91xXg&quot;,
  &quot;iat&quot;: 1474564815,
  &quot;nbf&quot;: 1474564695,
  &quot;sub&quot;: &quot;mmosley&quot;,
  &quot;user_role&quot;: [
    &quot;admin&quot;,
    &quot;users&quot;,
    &quot;approvers&quot;
  ],
  &quot;email&quot;: &quot;matt.mosley@tremolosecurity-test.com&quot;
}"><pre class="notranslate">{
  <span class="pl-ent">"iss"</span>: <span class="pl-s"><span class="pl-pds">"</span>https://mlb.tremolo.lan:8043/auth/idp/oidc<span class="pl-pds">"</span></span>,
  <span class="pl-ent">"aud"</span>: <span class="pl-s"><span class="pl-pds">"</span>kubernetes<span class="pl-pds">"</span></span>,
  <span class="pl-ent">"exp"</span>: <span class="pl-c1">1474564875</span>,
  <span class="pl-ent">"jti"</span>: <span class="pl-s"><span class="pl-pds">"</span>3Oo35Su-oXPX3RoUY91xXg<span class="pl-pds">"</span></span>,
  <span class="pl-ent">"iat"</span>: <span class="pl-c1">1474564815</span>,
  <span class="pl-ent">"nbf"</span>: <span class="pl-c1">1474564695</span>,
  <span class="pl-ent">"sub"</span>: <span class="pl-s"><span class="pl-pds">"</span>mmosley<span class="pl-pds">"</span></span>,
  <span class="pl-ent">"user_role"</span>: [
    <span class="pl-s"><span class="pl-pds">"</span>admin<span class="pl-pds">"</span></span>,
    <span class="pl-s"><span class="pl-pds">"</span>users<span class="pl-pds">"</span></span>,
    <span class="pl-s"><span class="pl-pds">"</span>approvers<span class="pl-pds">"</span></span>
  ],
  <span class="pl-ent">"email"</span>: <span class="pl-s"><span class="pl-pds">"</span>matt.mosley@tremolosecurity-test.com<span class="pl-pds">"</span></span>
}</pre></div>
<p dir="auto"><strong>Anything else do we need to know</strong>:</p>