Bug 1382454

Description of problem:

If a custom role is created it can not then be added to a group. An error message is returned.


Version-Release number of selected component (if applicable):


How reproducible:

100% of the time. Had multiple people reproduce on different OCP 3.2 and 3.3 clusters.


Steps to Reproduce:

> cat custom-role.json
{
    "kind": "Role",
    "apiVersion": "v1",
    "metadata": {
        "name": "template-editor"
    },
    "rules": [
        {
            "verbs": [
                "get",
                "list",
                "create",
                "update"
            ],
            "resources": [
                "templates"
            ]
        }
    ]
}
> oc create -f custom-role.json
> oadm policy add-role-to-group template-editor system:authenticated -n openshift
Error from server: role "template-editor" not found

Actual results:

Using the oadm to add the custom role failed.

Expected results:

The role should have been added.

Additional info:

A work around was found if the role binding is added via an oc create command.

> cat add-template-editor-to-authenticated.yml 
apiVersion: v1
groupNames:
- system:authenticated
kind: RoleBinding
metadata:
  name: template-editor
  namespace: openshift
roleRef:
  name: template-editor
  namespace: openshift
subjects:
- kind: SystemGroup
  name: system:authenticated
userNames: null
> oc create -f add-template-editor-to-authenticated.yml 
rolebinding "template-editor" created