Description of problem: When `oc get rolebindings --all-namespaces` command is run as system-admin in our 3.9 cluster, we are not able to list the complete rolebindings. Only half of the rolebindings are listed in there. $ oc version oc v3.9.14 kubernetes v1.9.1+a0ce1bc657 features: Basic-Auth Server https://master.example.com:443 openshift v3.9.14 kubernetes v1.9.1+a0ce1bc657 If there around 735 rolebindings the on running the command, only 501 are listed. $ oc get rolebindings --all-namespaces | wc -l 501 The issue is happening when a number of rolebindings are more than 500. Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. Setup a cluster of version v3.9.14. 2. Arrange the cluster to have more than 500 rolebindings. 3. run the command oc get rolebindings --all-namespaces | wc -l using v3.9 OC client. 4. Run the previous command with OC client of v3.6 and it works fine there. Actual results: It only lists half of the rolebindings, that is around 501. Expected results: It is expected to show all the rolebindings if considered to have around 745 in it. Additional info: When the OC client of v3.6 is used, the listing is done properly and all the rolebindings are listed. ~~~~<when using 3.6 client>~~~~~ # oc version oc v3.6.173.0.113 kubernetes v1.6.1+5115d708d7 features: Basic-Auth GSSAPI Kerberos SPNEGO Server https://master.example.com:443 openshift v3.9.14 kubernetes v1.9.1+a0ce1bc657 [root@master-1 ~]# oc get rolebinding --all-namespaces | wc -l 753 ~~~~~~~
the openshift RBAC endpoints proxy through to the kubernetes RBAC APIs. they were not returning the continue token correctly, which meant the client did not know there was a second page of results fixed in: origin: https://github.com/openshift/origin/pull/19607 ose 3.9: https://github.com/openshift/ose/pull/1241
ose 3.8: https://github.com/openshift/ose/pull/1242
fix available in: 3.8.38-1 3.9.28-1
v3.9.28 infra images are not yet ready on brew and reg registries for env set-up. Continue waiting for them ready to verify bug.
Verified in v3.9.29. When there are 800 rolebindings in all namespaces, `oc get rolebindings --all-namespaces` can show all 800 items