Origin: oc adm policy add-cluster-role-to-user cluster-admin is not working oc v3.9.0

[gbaufake]

Description

Executing oc adm policy add-cluster-role-to-user cluster-admin user is not adding cluster admin

Version

oc version

oc v3.9.0+191fece
kubernetes v1.9.1+a0ce1bc657
features: Basic-Auth GSSAPI Kerberos SPNEG

Steps To Reproduce

1. Install Openshift Client Tools 3.9
2. Execute oc adm policy add-cluster-role-to-user cluster-admin gbaufake (my user)
3. Execute oc get clusterrolebindings cluster-admin

Current Result

NAME ROLE USERS GROUPS SERVICE ACCOUNTS SUBJECTS
cluster-admin /cluster-admin system:masters

Expected Result

NAME ROLE USERS GROUPS SERVICE ACCOUNTS SUBJECTS
cluster-admin /cluster-admin gbaufake system:master

Additional Information

• Executing the same command with oc37 (oc v3.7.2+282e43f)

1. oc37 adm policy add-cluster-role-to-user cluster-admin gbaufake
2. cluster role "cluster-admin" added: "gbaufake"
3. oc37 get clusterrolebindings cluster-admin

• Result:
  NAME ROLE USERS GROUPS SERVICE ACCOUNTS SUBJECTS
  cluster-admin /cluster-admin gbaufake system:master

[Reamer]

I can confirm this bug.
It seems that "oc adm policy add-cluster-role-to-user cluster-admin [user]" creates a new ClusterRole Object for every added user.
My User is in the cluster-admin-0 ClusterRole. The user of my colleague is in cluster-admin-1.

[jwforres]

@openshift/sig-security

[simo5]

If you want to add into a specific cluster-role binding then you need to specify it. eg:
oc adm policy add-cluster-role-to-user cluster-admin user --rolebinding-name=cluster-admin

Otherwise a new binding is created, having a different binding name has no functional difference, the user will be a cluster-admin it just uses a separate binding to give the user that role.

[Reamer]

@simo5 Thank you for this clarification.

[gbaufake]

@simo5 thanks!

[sghosh151]

Change in behavior from 3.7 - and not documented anywhere in release notes