Description of problem: There are issues for option -z supported for long service account name in the 'oc policy' command Version-Release number of selected component (if applicable): # openshift version openshift v3.5.0.32-1+4f84c83 kubernetes v1.5.2+43a9be4 etcd 3.1.0 How reproducible: always Steps to Reproduce: 1.run command to the project admin permission to the service account, service account name use long name, such as 'oc policy add-role-to-user admin -z system:serviceaccount:test:default -n test' 2.run command to the project admin permission to the service account, service account name use long name, but set the namespace name different with the -n option,such as 'oc policy add-role-to-user admin -z system:serviceaccount:abc:default -n test' 3. Actual results: 1.the service account system:serviceaccount:test:default still don't have project admin permission as the setting. 2.no error report Expected results: 1.login by the service accout system:serviceaccount:test:default, and should have admin permission for the test project 2.error should be reported for the mix&match issue with -n and sa. Additional info:
IMHO this is not a bug. Per the docs: -z, --serviceaccount=[]: service account in the current namespace to use as a user Thus -z always refers to SAs in the current namespace. Therefore specifying the long name is invalid as that is just a construct used to refer to arbitrary SAs from cluster scope.
Agreed that -z is meant to be for the service account in the current namespace as per the doc and is not meant to accept the long form or reference a non-current namespace.
If the -z not accept the long form naming, then the command should raise error when use it.
Origin PR: https://github.com/openshift/origin/pull/17061
Commit pushed to master at https://github.com/openshift/origin https://github.com/openshift/origin/commit/d70ebd6f21d8e601ebaa6111842e76d47d248903 return error on long-form or invalid sa name bug: 1425398 Returns an error when the long-form name of a ServiceAccount is used with the --serviceaccount (-z) flag in `oc policy ...' commands, or if the name given is invalid.
Verified. # openshift version openshift v3.7.0-0.190.0 kubernetes v1.7.6+a08f5eeb62 etcd 3.2.8