Bug 1284501

Summary: Missing "reconcile-cluster-role-bindings" for upgrade
Product: OpenShift Container Platform Reporter: Eduardo Minguez <eminguez>
Component: DocumentationAssignee: Alex Dellapenta <adellape>
Status: CLOSED CURRENTRELEASE QA Contact: Vikram Goyal <vigoyal>
Severity: medium Docs Contact: Vikram Goyal <vigoyal>
Priority: high    
Version: 3.1.0CC: anli, aos-bugs, jliggitt, jokerman, mmccomas, pep
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-09-28 11:38:31 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1267746    

Description Eduardo Minguez 2015-11-23 13:46:26 UTC 
Document URL: https://docs.openshift.com/enterprise/3.1/install_config/upgrades.html#updating-policy-definitions

Section Number and Name: Updating Policy Definitions

Describe the issue: If you don't upgrade the cluster-role-bindings, there are some commands that will fail (oc logs, oc rsh)

Suggestions for improvement: Add how to reconcile cluster-role-bindings and sccs if needed

Additional information:
Comment 1 Jordan Liggitt 2015-11-23 15:03:09 UTC 
For reference, this is the command ansible runs when upgrading. It updates role bindings, only adding permissions, and not adding any permissions to all users (authenticated or unauthenticated) by default:

oadm policy reconcile-cluster-role-bindings \
  --exclude-groups=system:authenticated \
  --exclude-groups=system:unauthenticated \
  --exclude-users=system:anonymous \
  --additive-only=true \
  --confirm
Comment 2 Alex Dellapenta 2015-11-24 14:39:03 UTC 
This is being handled in https://github.com/openshift/openshift-docs/pull/1251.
Comment 3 Anping Li 2016-03-10 02:12:48 UTC 
There is  oadm policy reconcile-cluster-role-bindings in openshift-docs. so move to Verified