Openshift - oc adm policy vs oc policy

[Richard4]

Hello

As a cluster user named admin, when I run the commnds below is there a difference in the end result? I am questioning the "oc adm policy" versus "oc policy". 

oc adm policy add-role-to-user admin tom -n games

oc policy add-role-to-user admin tom -n games

The main difference is that oc adm policy is for cluster admins while the oc policy  is for project admins ?

[Wasim_Raja]

@Richard4 Thanks for reaching out.

Yes, you are correct. The oc adm policy command is used by cluster administrators to manage cluster-wide policies, while the oc policy command is used by project administrators to manage policies within a project.

In your example, both commands will add the admin role to the user tom in the games project. However, the oc adm policy command is used to manage cluster-wide policies, while the oc policy command is used to manage policies within a project.

[Chetan_Tiwary_]

Hello @Richard4 !

Thanks for reaching out!

In all the latest official docs I can see only oc adm command :

https://docs.openshift.com/container-platform/4.12/authentication/using-rbac.html 

Recall - 

Take a look at this diagram : 

Cluster Role Binding maps a user, group or service account to a Cluster Role which will have policies that allow certain actions (such as create or delete or list) on certain resources (such as deployments, pods).

​Role Bindings maps a user, group or service account to a Role or to a Cluster Role which will have policies that allow certain actions (such as create or delete or list) on certain resources (such as deployments, pods).

oc .....add-role-to-user  is a local binding of a role in a specific project.

oc ....add-cluster-role-to-user is a cluster wide role binding.