Bug 1927882

Summary:	Can't create cluster role binding from UI when a project is selected
Product:	OpenShift Container Platform	Reporter:	Samuel Padgett <spadgett>
Component:	Management Console	Assignee:	Robb Hamilton <rhamilto>
Status:	CLOSED ERRATA	QA Contact:	Yanping Zhang <yanpzhan>
Severity:	high	Docs Contact:
Priority:	high
Version:	4.7	CC:	aos-bugs, jokerman, yapei
Target Milestone:	---
Target Release:	4.8.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	Cause: The fix for https://bugzilla.redhat.com/show_bug.cgi?id=1871996 to make the create RoleBinding links consistent resulted in the inability to select binding type when a namespace is selected. Consequence: Users who have an active namespace cannot create a cluster role binding without changing the active namespace to All namespaces. Fix: Revert part of the changes for https://bugzilla.redhat.com/show_bug.cgi?id=1871996 so that users can create a cluster role binding regardless of active namespace. Result: Users can create a cluster role binding regardless of active namespace.	Story Points:	---
Clone Of:		Environment:	Version: 4.7.0-0.nightly-2021-02-04-031352 Cluster ID: 62954ee4-3357-4d64-a592-2f1cc0640778 Browser: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:85.0) Gecko/20100101 Firefox/85.0
Last Closed:	2021-07-27 22:43:44 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1929198

Description Samuel Padgett 2021-02-11 17:51:02 UTC

Steps to reproduce:

1. Log into the cluster as kubeadmin
2. Select a project from the project list so that you have an active namespace
3. Open User Management -> RoleBindings
4. Click "Create binding"

Actual:

You are allowed to create a namespace role binding.

Expected:

You should be shown a radio button asking whether you want to create a namespace or cluster role binding.

Notes:

The above radio button is displayed when "All Projects" is selected, but it is not obvious you need to do that. It looks like there's no way to create cluster role bindings in the UI. Even on the search page when you select ClusterRoleBinding, there is no create button.

I believe this is a regression either in 4.7 or a recent release.

Comment 2 Yanping Zhang 2021-02-20 04:09:00 UTC

Checked on ocp 4.8 cluster with payload 4.8.0-0.nightly-2021-02-19-111007.
1. Log into the cluster as kubeadmin
2. Select a project from the project list so that you have an active namespace
3. Open User Management -> RoleBindings
4. Click "Create binding", now there are radio buttons for choosing namespace rolebinding and clusterrolebinding, and could create rolebinding/clusterrolebinding successfully.
The bug is fixed.

Comment 5 errata-xmlrpc 2021-07-27 22:43:44 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.8.2 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:2438