// ChangedClusterRoleBindings returns the role bindings that must be created and/or updated to
// match the recommended bootstrap policy
func (o *ReconcileClusterRoleBindingsOptions) ChangedClusterRoleBindings() ([]*authorizationapi.ClusterRoleBinding, error) {
changedRoleBindings := []*authorizationapi.ClusterRoleBinding{}
bootstrapClusterRoleBindings := bootstrappolicy.GetBootstrapClusterRoleBindings()
for i := range bootstrapClusterRoleBindings {
expectedClusterRoleBinding := &bootstrapClusterRoleBindings[i]
actualClusterRoleBinding, err := o.RoleBindingClient.Get(expectedClusterRoleBinding.Name)
if kapierrors.IsNotFound(err) {
// Remove excluded subjects from the new role binding
expectedClusterRoleBinding.Subjects, _ = DiffObjectReferenceLists(expectedClusterRoleBinding.Subjects, o.ExcludeSubjects)
changedRoleBindings = append(changedRoleBindings, expectedClusterRoleBinding)
continue
}
if err != nil {
return nil, err
}
// Copy any existing labels/annotations, so the displayed update is correct
// This assumes bootstrap role bindings will not set any labels/annotations
// These aren't actually used during update; the latest labels/annotations are pulled from the existing object again
expectedClusterRoleBinding.Labels = actualClusterRoleBinding.Labels
expectedClusterRoleBinding.Annotations = actualClusterRoleBinding.Annotations
if updatedClusterRoleBinding, needsUpdating := computeUpdatedBinding(*expectedClusterRoleBinding, *actualClusterRoleBinding, o.ExcludeSubjects, o.Union); needsUpdating {
changedRoleBindings = append(changedRoleBindings, updatedClusterRoleBinding)
}
}
return changedRoleBindings, nil
}
func TestBootstrapClusterRoleBindings(t *testing.T) {
roleBindings := bootstrappolicy.GetBootstrapClusterRoleBindings()
list := &api.List{}
for i := range roleBindings {
list.Items = append(list.Items, &roleBindings[i])
}
testObjects(t, list, "bootstrap_cluster_role_bindings.yaml")
}
func (o CreateBootstrapPolicyFileOptions) CreateBootstrapPolicyFile() error {
if err := os.MkdirAll(path.Dir(o.File), os.FileMode(0755)); err != nil {
return err
}
policyTemplate := &api.Template{}
clusterRoles := bootstrappolicy.GetBootstrapClusterRoles()
for i := range clusterRoles {
versionedObject, err := kapi.Scheme.ConvertToVersion(&clusterRoles[i], latest.Version.String())
if err != nil {
return err
}
policyTemplate.Objects = append(policyTemplate.Objects, versionedObject)
}
clusterRoleBindings := bootstrappolicy.GetBootstrapClusterRoleBindings()
for i := range clusterRoleBindings {
versionedObject, err := kapi.Scheme.ConvertToVersion(&clusterRoleBindings[i], latest.Version.String())
if err != nil {
return err
}
policyTemplate.Objects = append(policyTemplate.Objects, versionedObject)
}
openshiftRoles := bootstrappolicy.GetBootstrapOpenshiftRoles(o.OpenShiftSharedResourcesNamespace)
for i := range openshiftRoles {
versionedObject, err := kapi.Scheme.ConvertToVersion(&openshiftRoles[i], latest.Version.String())
if err != nil {
return err
}
policyTemplate.Objects = append(policyTemplate.Objects, versionedObject)
}
openshiftRoleBindings := bootstrappolicy.GetBootstrapOpenshiftRoleBindings(o.OpenShiftSharedResourcesNamespace)
for i := range openshiftRoleBindings {
versionedObject, err := kapi.Scheme.ConvertToVersion(&openshiftRoleBindings[i], latest.Version.String())
if err != nil {
return err
}
policyTemplate.Objects = append(policyTemplate.Objects, versionedObject)
}
versionedPolicyTemplate, err := kapi.Scheme.ConvertToVersion(policyTemplate, latest.Version.String())
if err != nil {
return err
}
buffer := &bytes.Buffer{}
(&kubectl.JSONPrinter{}).PrintObj(versionedPolicyTemplate, buffer)
if err := ioutil.WriteFile(o.File, buffer.Bytes(), 0644); err != nil {
return err
}
return nil
}
func GetBootstrapPolicyBinding() *authorizationapi.ClusterPolicyBinding {
policyBinding := &authorizationapi.ClusterPolicyBinding{
ObjectMeta: kapi.ObjectMeta{
Name: ":Default",
CreationTimestamp: unversioned.Now(),
UID: util.NewUUID(),
},
LastModified: unversioned.Now(),
RoleBindings: make(map[string]*authorizationapi.ClusterRoleBinding),
}
bindings := bootstrappolicy.GetBootstrapClusterRoleBindings()
for i := range bindings {
policyBinding.RoleBindings[bindings[i].Name] = &bindings[i]
}
return policyBinding
}
// ChangedClusterRoleBindings returns the role bindings that must be created and/or updated to
// match the recommended bootstrap policy. If roles to reconcile are provided, but not all are
// found, all partial results are returned.
func (o *ReconcileClusterRoleBindingsOptions) ChangedClusterRoleBindings() ([]*authorizationapi.ClusterRoleBinding, error) {
changedRoleBindings := []*authorizationapi.ClusterRoleBinding{}
rolesToReconcile := sets.NewString(o.RolesToReconcile...)
rolesNotFound := sets.NewString(o.RolesToReconcile...)
bootstrapClusterRoleBindings := bootstrappolicy.GetBootstrapClusterRoleBindings()
for i := range bootstrapClusterRoleBindings {
expectedClusterRoleBinding := &bootstrapClusterRoleBindings[i]
if (len(rolesToReconcile) > 0) && !rolesToReconcile.Has(expectedClusterRoleBinding.RoleRef.Name) {
continue
}
rolesNotFound.Delete(expectedClusterRoleBinding.RoleRef.Name)
actualClusterRoleBinding, err := o.RoleBindingClient.Get(expectedClusterRoleBinding.Name)
if kapierrors.IsNotFound(err) {
// Remove excluded subjects from the new role binding
expectedClusterRoleBinding.Subjects, _ = DiffObjectReferenceLists(expectedClusterRoleBinding.Subjects, o.ExcludeSubjects)
changedRoleBindings = append(changedRoleBindings, expectedClusterRoleBinding)
continue
}
if err != nil {
return nil, err
}
// Copy any existing labels/annotations, so the displayed update is correct
// This assumes bootstrap role bindings will not set any labels/annotations
// These aren't actually used during update; the latest labels/annotations are pulled from the existing object again
expectedClusterRoleBinding.Labels = actualClusterRoleBinding.Labels
expectedClusterRoleBinding.Annotations = actualClusterRoleBinding.Annotations
if updatedClusterRoleBinding, needsUpdating := computeUpdatedBinding(*expectedClusterRoleBinding, *actualClusterRoleBinding, o.ExcludeSubjects, o.Union); needsUpdating {
changedRoleBindings = append(changedRoleBindings, updatedClusterRoleBinding)
}
}
if len(rolesNotFound) != 0 {
// return the known changes and the error so that a caller can decide if he wants a partial update
return changedRoleBindings, NewClusterRoleBindingLookupError(rolesNotFound.List())
}
return changedRoleBindings, nil
}
