KeyError: u'containerID' on OpenShift 3.7

[adelton]

In some situations I see custodia configured with custodia.openshift to fail with

2018-01-03 15:59:15 - ContainerAuth-[auth:container]   - Detected docker://6e3578420cc82950272a5a479e48222be99e9f9a35104a24751124dbcdd6e630 for pid 102522
2018-01-03 15:59:15 - SimplePathAuthz-[authz:paths]    - PASS: '102522' authorized for '/secrets'
2018-01-03 15:59:15 - server                           - Handler failed: KeyError(u'containerID',)
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/custodia/httpd/server.py", line 351, in handle_one_request
    response = self.pipeline(self.server.config, request)
  File "/usr/lib/python2.7/site-packages/custodia/httpd/server.py", line 450, in pipeline
    valid = authzers[authz].handle(request)
  File "/usr/lib/python2.7/site-packages/custodia/openshift/authz.py", line 83, in handle
    pod = self.find_pod(pods, containerid)
  File "/usr/lib/python2.7/site-packages/custodia/openshift/authz.py", line 68, in find_pod
    if status[u'containerID'] == containerid:
KeyError: u'containerID'

It seems the code in find_pod cycles containerStatuses but assumes that containerID has to be present.

I haven't seen my tests fail with OpenShift 3.6 but with 3.7, I've started to get the above traceback, so maybe in 3.7 containerID can be missing? Or perhaps with 3.6 I was just lucky. In any case, the code should likely check for containerID existence.

[adelton]

I see this with OCP 3.9 as well, even if not in deterministic fashion.