func (m *VirtualStorage) getReferencedRole(roleRef kapi.ObjectReference) (*authorizationapi.Role, error) {
ctx := kapi.WithNamespace(kapi.NewContext(), roleRef.Namespace)
var policy *authorizationapi.Policy
var err error
switch {
case len(roleRef.Namespace) == 0:
var clusterPolicy *authorizationapi.ClusterPolicy
clusterPolicy, err = m.ClusterPolicyRegistry.GetClusterPolicy(ctx, authorizationapi.PolicyName)
policy = authorizationapi.ToPolicy(clusterPolicy)
default:
policy, err = m.PolicyRegistry.GetPolicy(ctx, authorizationapi.PolicyName)
}
if err != nil {
return nil, err
}
role, exists := policy.Roles[roleRef.Name]
if !exists {
return nil, kapierrors.NewNotFound("Role", roleRef.Name)
}
return role, nil
}
// Describe returns the description of a policy
// TODO make something a lot prettier
func (d *ClusterPolicyDescriber) Describe(namespace, name string) (string, error) {
c := d.ClusterPolicies()
policy, err := c.Get(name)
if err != nil {
return "", err
}
return DescribePolicy(authorizationapi.ToPolicy(policy))
}
// GetPolicy retrieves a specific policy. It conforms to rulevalidation.PolicyGetter.
func (c readOnlyAuthorizationCache) GetPolicy(ctx kapi.Context, name string) (*authorizationapi.Policy, error) {
namespace, _ := kapi.NamespaceFrom(ctx)
if namespaceRefersToCluster(namespace) {
clusterPolicy, err := c.ReadOnlyClusterPolicies().Get(name)
if err != nil {
return &authorizationapi.Policy{}, err
}
return authorizationapi.ToPolicy(clusterPolicy), nil
} else {
policy, err := c.ReadOnlyPolicies(namespace).Get(name)
if err != nil {
return &authorizationapi.Policy{}, err
}
return policy, nil
}
}
func printClusterPolicy(policy *authorizationapi.ClusterPolicy, w io.Writer, withNamespace bool) error {
return printPolicy(authorizationapi.ToPolicy(policy), w, withNamespace)
}
func (s *simulatedStorage) GetPolicy(ctx kapi.Context, name string) (*authorizationapi.Policy, error) {
ret, err := s.clusterRegistry.GetClusterPolicy(ctx, name)
return authorizationapi.ToPolicy(ret), err
}
func ValidateClusterPolicyUpdate(policy *authorizationapi.ClusterPolicy, oldPolicy *authorizationapi.ClusterPolicy) fielderrors.ValidationErrorList {
return ValidatePolicyUpdate(authorizationapi.ToPolicy(policy), authorizationapi.ToPolicy(oldPolicy), false)
}