Bug 1574404

Summary: oc client v3.9 is not displaying all rolebindings
Product: OpenShift Container Platform Reporter: Jatan Malde <jmalde>
Component: ocAssignee: Jordan Liggitt <jliggitt>
Status: CLOSED CURRENTRELEASE QA Contact: Xingxing Xia <xxia>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 3.9.0CC: aos-bugs, byount, chuyu, jliggitt, jokerman, mmccomas, xxia
Target Milestone: ---   
Target Release: 3.9.z   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-06-11 00:57:06 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jatan Malde 2018-05-03 08:35:17 UTC 
Description of problem:

When `oc get rolebindings --all-namespaces` command is run as system-admin in our 3.9 cluster, we are not able to list the complete rolebindings. 

Only half of the rolebindings are listed in there.

$ oc version
oc v3.9.14
kubernetes v1.9.1+a0ce1bc657
features: Basic-Auth

Server https://master.example.com:443
openshift v3.9.14
kubernetes v1.9.1+a0ce1bc657

If there around 735 rolebindings the on running the command, only 501 are listed.

$ oc get rolebindings --all-namespaces | wc -l
501

The issue is happening when a number of rolebindings are more than 500.

Version-Release number of selected component (if applicable):


How reproducible:

Steps to Reproduce:
1. Setup a cluster of version v3.9.14. 
2. Arrange the cluster to have more than 500 rolebindings.
3. run the command oc get rolebindings --all-namespaces | wc -l using v3.9 OC client.
4. Run the previous command with OC client of v3.6 and it works fine there.

Actual results:
It only lists half of the rolebindings, that is around 501.

Expected results:
It is expected to show all the rolebindings if considered to have around 745 in it.

Additional info:
When the OC client of v3.6 is used, the listing is done properly and all the rolebindings are listed.


~~~~<when using 3.6 client>~~~~~
# oc version
oc v3.6.173.0.113
kubernetes v1.6.1+5115d708d7
features: Basic-Auth GSSAPI Kerberos SPNEGO

Server https://master.example.com:443
openshift v3.9.14
kubernetes v1.9.1+a0ce1bc657
[root@master-1 ~]# oc get rolebinding --all-namespaces | wc -l
753
~~~~~~~
Comment 1 Jordan Liggitt 2018-05-03 13:17:00 UTC 
the openshift RBAC endpoints proxy through to the kubernetes RBAC APIs.

they were not returning the continue token correctly, which meant the client did not know there was a second page of results

fixed in:
origin:  https://github.com/openshift/origin/pull/19607
ose 3.9: https://github.com/openshift/ose/pull/1241
Comment 2 Jordan Liggitt 2018-05-03 13:53:37 UTC 
ose 3.8: https://github.com/openshift/ose/pull/1242
Comment 3 Jordan Liggitt 2018-05-07 14:40:53 UTC 
fix available in:
3.8.38-1
3.9.28-1
Comment 4 Xingxing Xia 2018-05-09 05:39:26 UTC 
v3.9.28 infra images are not yet ready on brew and reg registries for env set-up. Continue waiting for them ready to verify bug.
Comment 5 Xingxing Xia 2018-05-10 07:27:39 UTC 
Verified in v3.9.29. When there are 800 rolebindings in all namespaces, `oc get rolebindings --all-namespaces` can show all 800 items