Bug 1574404 - oc client v3.9 is not displaying all rolebindings
Summary: oc client v3.9 is not displaying all rolebindings
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: oc
Version: 3.9.0
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
: 3.9.z
Assignee: Jordan Liggitt
QA Contact: Xingxing Xia
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-05-03 08:35 UTC by Jatan Malde
Modified: 2018-06-18 18:29 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-06-11 00:57:06 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Jatan Malde 2018-05-03 08:35:17 UTC
Description of problem:

When `oc get rolebindings --all-namespaces` command is run as system-admin in our 3.9 cluster, we are not able to list the complete rolebindings. 

Only half of the rolebindings are listed in there.

$ oc version
oc v3.9.14
kubernetes v1.9.1+a0ce1bc657
features: Basic-Auth

Server https://master.example.com:443
openshift v3.9.14
kubernetes v1.9.1+a0ce1bc657

If there around 735 rolebindings the on running the command, only 501 are listed.

$ oc get rolebindings --all-namespaces | wc -l
501

The issue is happening when a number of rolebindings are more than 500.

Version-Release number of selected component (if applicable):


How reproducible:

Steps to Reproduce:
1. Setup a cluster of version v3.9.14. 
2. Arrange the cluster to have more than 500 rolebindings.
3. run the command oc get rolebindings --all-namespaces | wc -l using v3.9 OC client.
4. Run the previous command with OC client of v3.6 and it works fine there.

Actual results:
It only lists half of the rolebindings, that is around 501.

Expected results:
It is expected to show all the rolebindings if considered to have around 745 in it.

Additional info:
When the OC client of v3.6 is used, the listing is done properly and all the rolebindings are listed.


~~~~<when using 3.6 client>~~~~~
# oc version
oc v3.6.173.0.113
kubernetes v1.6.1+5115d708d7
features: Basic-Auth GSSAPI Kerberos SPNEGO

Server https://master.example.com:443
openshift v3.9.14
kubernetes v1.9.1+a0ce1bc657
[root@master-1 ~]# oc get rolebinding --all-namespaces | wc -l
753
~~~~~~~

Comment 1 Jordan Liggitt 2018-05-03 13:17:00 UTC
the openshift RBAC endpoints proxy through to the kubernetes RBAC APIs.

they were not returning the continue token correctly, which meant the client did not know there was a second page of results

fixed in:
origin:  https://github.com/openshift/origin/pull/19607
ose 3.9: https://github.com/openshift/ose/pull/1241

Comment 2 Jordan Liggitt 2018-05-03 13:53:37 UTC
ose 3.8: https://github.com/openshift/ose/pull/1242

Comment 3 Jordan Liggitt 2018-05-07 14:40:53 UTC
fix available in:
3.8.38-1
3.9.28-1

Comment 4 Xingxing Xia 2018-05-09 05:39:26 UTC
v3.9.28 infra images are not yet ready on brew and reg registries for env set-up. Continue waiting for them ready to verify bug.

Comment 5 Xingxing Xia 2018-05-10 07:27:39 UTC
Verified in v3.9.29. When there are 800 rolebindings in all namespaces, `oc get rolebindings --all-namespaces` can show all 800 items


Note You need to log in before you can comment on or make changes to this bug.