Description of problem: When both "--namespace" and "--all-namespaces" are specified, "--namespace" should be ignored. See oc get -h Version-Release number of selected component (if applicable): openshift/oc v1.1-330-g693be19 kubernetes v1.1.0-origin-1107-g4c8e6f4 How reproducible: Always Steps to Reproduce: 1. Start openshift, oc login with user "xxia" and create two projects proj1, proj2 2. Make user "xxia" as cluster role (such as cluster-admin, view) so it can use "--all-namespaces" $ oadm policy add-cluster-role-to-user view xxia --config=admin.kubeconfig 3. Get resources from all namespaces with "--namespace" given as well. $ oc get pod --all-namespaces --namespace=proj1 Actual results: 3. It outputs: the namespace from the provided object "default" does not match the namespace "". You must pass '--namespace=default' to perform this operation. Expected results: 3. "--namespace" should be ignored and the command should succeed. Additional info: oc export has the same problem.
Additional info: For user that does not own cluster role, run "oc get" with "--all-namespaces" "--namespace" both given, it will prompt message like (This is expected, of course): Error from server: User "user" cannot list all pods in the cluster. I find, among all oc commands, only the following four commands have "--all-namespaces" option: oc get, oc export, oadm policy who-can, oc policy who-can *But* oadm policy who-can, oc policy who-can work fine: $ oadm policy who-can get pods --all-namespaces -n proj1 It outputs: Namespace: <all> Verb: get Resource: pods Users: system:serviceaccount:openshift-infra:build-controller system:serviceaccount:openshift-infra:deployment-controller system:serviceaccount:openshift-infra:pv-controller xxia <-- snip -->
"--namespace" and "--all-namespaces" must be mutually exclusive.
In "oc get -h", after "--all-namespaces" it says: Namespace in current context is ignored even if specified with --namespace. The actual result of step 3 in bug description is confusing (Even if assume "--namespace" and "--all-namespaces" must be mutually exclusive)
Not a 3.1.1 blocker. Lowering severity.
Sent following PR to address this issue: https://github.com/kubernetes/kubernetes/pull/20802
Merged upstream 3 years ago.