Bug 1741169 - Rolebinding patch is not working for "authorization.openshift.io/v1" apiservice
Summary: Rolebinding patch is not working for "authorization.openshift.io/v1" apiservice
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: openshift-apiserver
Version: 4.2.0
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 4.2.0
Assignee: Mo
QA Contact: Xingxing Xia
URL:
Whiteboard:
Depends On: 1740596
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-08-14 12:03 UTC by Michal Fojtik
Modified: 2019-08-14 20:11 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1740596
Environment:
Last Closed: 2019-08-14 20:11:33 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Michal Fojtik 2019-08-14 12:03:22 UTC
+++ This bug was initially created as a clone of Bug #1740596 +++

Description of problem: Rolebinding patch is not working for "authorization.openshift.io/v1" apiservice


# cat > rolebinding.yaml << EOL
apiVersion: authorization.openshift.io/v1
kind: RoleBinding
metadata:
  name: test-rolebinding
roleRef:
  kind: Role
  name: view
  apiGroup: rbac.authorization.openshift.io
subjects:
- kind: User
  name: user1
  apiGroup: rbac.authorization.openshift.io
EOL

# oc apply -f rolebinding.yaml
rolebinding.authorization.openshift.io/test-rolebinding created

# oc get rolebinding test-rolebinding
NAME               ROLE      USERS               GROUPS    SERVICE ACCOUNTS   SUBJECTS
test-rolebinding   /view     user1  


Edited yaml file and added below line

- kind: User
  name: user2
  apiGroup: rbac.authorization.openshift.io


# oc apply -f rolebinding.yaml
rolebinding.authorization.openshift.io/test-rolebinding configured

# oc get rolebinding test-rolebinding
NAME               ROLE      USERS               GROUPS    SERVICE ACCOUNTS   SUBJECTS
test-rolebinding   /view     user1

But when I use rbac.authorization.k8s.io/v1 apiversion it's working as expected.

Comment 1 Michal Fojtik 2019-08-14 12:04:17 UTC
This was originally reported in 3.11, but I can reproduce the same problem in 4.2. Making this a blocker bug until we know why this happen.

Comment 2 Michal Fojtik 2019-08-14 12:05:46 UTC
Mo, FYI (this looks like something is broken on the server side, I can see `oc` sending and receiving the correct data, however the data are not persisted).


Note You need to log in before you can comment on or make changes to this bug.