Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1740596

Summary:	Rolebinding patch is not working for "authorization.openshift.io/v1" apiservice
Product:	OpenShift Container Platform	Reporter:	Abhishek <aabhishe>
Component:	openshift-apiserver	Assignee:	Standa Laznicka <slaznick>
Status:	CLOSED NOTABUG	QA Contact:	Xingxing Xia <xxia>
Severity:	low	Docs Contact:
Priority:	low
Version:	3.11.0	CC:	aos-bugs, joerg.woehrle, ksathe, mfojtik, pkhaire
Target Milestone:	---	Keywords:	Reopened
Target Release:	3.11.z
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	1741169 (view as bug list)		Environment:
Last Closed:	2020-06-08 12:38:34 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1741169

Description Abhishek 2019-08-13 10:35:01 UTC

Description of problem: Rolebinding patch is not working for "authorization.openshift.io/v1" apiservice


# cat > rolebinding.yaml << EOL
apiVersion: authorization.openshift.io/v1
kind: RoleBinding
metadata:
  name: test-rolebinding
roleRef:
  kind: Role
  name: view
  apiGroup: rbac.authorization.openshift.io
subjects:
- kind: User
  name: user1
  apiGroup: rbac.authorization.openshift.io
EOL

# oc apply -f rolebinding.yaml
rolebinding.authorization.openshift.io/test-rolebinding created

# oc get rolebinding test-rolebinding
NAME               ROLE      USERS               GROUPS    SERVICE ACCOUNTS   SUBJECTS
test-rolebinding   /view     user1  


Edited yaml file and added below line

- kind: User
  name: user2
  apiGroup: rbac.authorization.openshift.io


# oc apply -f rolebinding.yaml
rolebinding.authorization.openshift.io/test-rolebinding configured

# oc get rolebinding test-rolebinding
NAME               ROLE      USERS               GROUPS    SERVICE ACCOUNTS   SUBJECTS
test-rolebinding   /view     user1

But when I use rbac.authorization.k8s.io/v1 apiversion it's working as expected.

Comment 1 Mo 2019-08-14 20:10:48 UTC

The schema for rbac.authorization.k8s.io/v1 and authorization.openshift.io/v1 are distinct.  You cannot apply patches from one to the other.

The two commands below refer to *same* resource:

$ oc get rolebinding.rbac admin -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  creationTimestamp: "2019-08-14T20:06:28Z"
  name: admin
  namespace: foobar
  resourceVersion: "96391"
  selfLink: /apis/rbac.authorization.k8s.io/v1/namespaces/foobar/rolebindings/admin
  uid: 002390fd-becf-11e9-94ee-02b450c5a768
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: system:admin



$ oc get rolebinding.auth admin -o yaml
apiVersion: authorization.openshift.io/v1
groupNames: null
kind: RoleBinding
metadata:
  creationTimestamp: "2019-08-14T20:06:28Z"
  name: admin
  namespace: foobar
  resourceVersion: "96391"
  selfLink: /apis/authorization.openshift.io/v1/namespaces/foobar/rolebindings/admin
  uid: 002390fd-becf-11e9-94ee-02b450c5a768
roleRef:
  name: admin
subjects:
- kind: SystemUser
  name: system:admin
userNames:
- system:admin

Comment 2 joerg.woehrle 2019-08-19 06:33:23 UTC

I think this shouldn't have been closed.

Note that in both of the above yaml `authorization.openshift.io/v1` is used as the apiVersion. 

It's only stated that the same `oc apply` command works as expected when you change it to `rbac.authorization.k8s.io/v1`

Please verify and reopen

Comment 11 Standa Laznicka 2020-05-20 09:31:46 UTC

You should really use authorization.k8s.io/v1 instead of its openshift version.

I've worked on things with more priority, I may be able to look into this the next sprint.

Comment 12 Standa Laznicka 2020-06-08 12:38:34 UTC

I've looked into this. Since you're using the openshift (legacy) authorization group, you need to specify `userNames` instead of subjects, subjects will be ignored. This is stated in the `oc explain` of the API:

$ oc explain rolebinding --version=authorization.openshift.io
<snip>
   userNames	<[]string>
     UserNames holds all the usernames directly bound to the role. This field
     should only be specified when supporting legacy clients and servers. See
     Subjects for further details.

   subjects	<[]Object> -required-
     Subjects hold object references to authorize with this rule. This field is
     ignored if UserNames or GroupNames are specified to support legacy clients
     and servers. Thus newer clients that do not need to support backwards
     compatibility should send only fully qualified Subjects and should omit the
     UserNames and GroupNames fields. Clients that need to support backwards
     compatibility can use this field to build the UserNames and GroupNames.