Skip to content

Commit b96a100

Browse files
deads2kdeads2k
committed
add reconcile-cluster-roles command
1 parent d52510b commit b96a100

File tree

6 files changed

+219
-0
lines changed

6 files changed

+219
-0
lines changed

‎docs/generated/oadm_by_example_content.adoc

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,22 @@ Manage nodes - list pods, evacuate, or mark ready
168168
====
169169

170170

171+
== oadm policy reconcile-cluster-roles
172+
Replace cluster roles to match the recommended bootstrap policy
173+
174+
====
175+
176+
[options="nowrap"]
177+
----
178+
// Display the cluster roles that would be modified
179+
$ openshift admin policy reconcile-cluster-roles -o yaml
180+
181+
// Replace cluster roles that don't match the current defaults
182+
$ openshift admin policy reconcile-cluster-roles
183+
----
184+
====
185+
186+
171187
== oadm registry
172188
Install the OpenShift Docker registry
173189

‎hack/test-cmd.sh

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -666,6 +666,10 @@ oadm policy add-cluster-role-to-group cluster-admin system:unauthenticated
666666
oadm policy remove-cluster-role-from-group cluster-admin system:unauthenticated
667667
oadm policy add-cluster-role-to-user cluster-admin system:no-user
668668
oadm policy remove-cluster-role-from-user cluster-admin system:no-user
669+
oc delete clusterrole/cluster-status
670+
oc get clusterrole | grep -c "cluster-status" | grep -q "0"
671+
oadm policy reconcile-cluster-roles
672+
oc get clusterrole | grep -c "cluster-status" | grep -q "1"
669673

670674
oc policy add-role-to-group cluster-admin system:unauthenticated
671675
oc policy add-role-to-user cluster-admin system:no-user

‎pkg/cmd/admin/policy/policy.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ func NewCmdPolicy(name, fullName string, f *clientcmd.Factory, out io.Writer) *c
4343
cmds.AddCommand(NewCmdRemoveClusterRoleFromUser(RemoveClusterRoleFromUserRecommendedName, fullName+" "+RemoveClusterRoleFromUserRecommendedName, f, out))
4444
cmds.AddCommand(NewCmdAddClusterRoleToGroup(AddClusterRoleToGroupRecommendedName, fullName+" "+AddClusterRoleToGroupRecommendedName, f, out))
4545
cmds.AddCommand(NewCmdRemoveClusterRoleFromGroup(RemoveClusterRoleFromGroupRecommendedName, fullName+" "+RemoveClusterRoleFromGroupRecommendedName, f, out))
46+
cmds.AddCommand(NewCmdReconcileClusterRoles(ReconcileClusterRolesRecommendedName, fullName+" "+ReconcileClusterRolesRecommendedName, f, out))
4647

4748
return cmds
4849
}

‎pkg/cmd/admin/policy/reconcile_clusterroles.go

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
package policy
2+
3+
import (
4+
"errors"
5+
"fmt"
6+
"io"
7+
8+
"github.com/spf13/cobra"
9+
10+
kapi "github.com/GoogleCloudPlatform/kubernetes/pkg/api"
11+
kapierrors "github.com/GoogleCloudPlatform/kubernetes/pkg/api/errors"
12+
kcmdutil "github.com/GoogleCloudPlatform/kubernetes/pkg/kubectl/cmd/util"
13+
14+
authorizationapi "github.com/openshift/origin/pkg/authorization/api"
15+
"github.com/openshift/origin/pkg/client"
16+
"github.com/openshift/origin/pkg/cmd/server/bootstrappolicy"
17+
"github.com/openshift/origin/pkg/cmd/util/clientcmd"
18+
)
19+
20+
const ReconcileClusterRolesRecommendedName = "reconcile-cluster-roles"
21+
22+
type reconcileClusterOptions struct {
23+
Out io.Writer
24+
25+
RoleClient client.ClusterRoleInterface
26+
}
27+
28+
const (
29+
reconcileLong = `
30+
Replace cluster roles to match the recommended bootstrap policy
31+
32+
This command will inspect the cluster roles against the recommended bootstrap policy. Any cluster role
33+
that does not match will be replaced by the recommended bootstrap role. This command will not remove
34+
any additional cluster role.
35+
36+
You can see which cluster role have recommended changed by choosing an output type.`
37+
38+
reconcileExample = ` // Display the cluster roles that would be modified
39+
$ %[1]s -o yaml
40+
41+
// Replace cluster roles that don't match the current defaults
42+
$ %[1]s`
43+
)
44+
45+
// NewCmdReconcileClusterRoles implements the OpenShift cli reconcile-cluster-roles command
46+
func NewCmdReconcileClusterRoles(name, fullName string, f *clientcmd.Factory, out io.Writer) *cobra.Command {
47+
o := &reconcileClusterOptions{Out: out}
48+
49+
cmd := &cobra.Command{
50+
Use: name,
51+
Short: "Replace cluster roles to match the recommended bootstrap policy",
52+
Long: reconcileLong,
53+
Example: fmt.Sprintf(reconcileExample, fullName),
54+
Run: func(cmd *cobra.Command, args []string) {
55+
if err := o.Complete(cmd, f, args); err != nil {
56+
kcmdutil.CheckErr(kcmdutil.UsageError(cmd, err.Error()))
57+
}
58+
59+
changedClusterRoles, err := o.ChangedClusterRoles()
60+
kcmdutil.CheckErr(err)
61+
62+
if len(changedClusterRoles) == 0 {
63+
return
64+
}
65+
66+
if len(kcmdutil.GetFlagString(cmd, "output")) != 0 {
67+
list := &kapi.List{}
68+
for _, item := range changedClusterRoles {
69+
list.Items = append(list.Items, item)
70+
}
71+
72+
kcmdutil.CheckErr(f.Factory.PrintObject(cmd, list, out))
73+
return
74+
}
75+
76+
kcmdutil.CheckErr(o.ReplaceChangedRoles(changedClusterRoles))
77+
},
78+
}
79+
80+
kcmdutil.AddPrinterFlags(cmd)
81+
82+
return cmd
83+
}
84+
85+
func (o *reconcileClusterOptions) Complete(cmd *cobra.Command, f *clientcmd.Factory, args []string) error {
86+
if len(args) != 0 {
87+
return errors.New("No arguments are allowed")
88+
}
89+
90+
oclient, _, err := f.Clients()
91+
if err != nil {
92+
return err
93+
}
94+
o.RoleClient = oclient.ClusterRoles()
95+
96+
return nil
97+
}
98+
99+
func (o *reconcileClusterOptions) ReplaceChangedRoles(changedRoles []*authorizationapi.ClusterRole) error {
100+
for i := range changedRoles {
101+
role, err := o.RoleClient.Get(changedRoles[i].Name)
102+
if err != nil && !kapierrors.IsNotFound(err) {
103+
return err
104+
}
105+
106+
if kapierrors.IsNotFound(err) {
107+
createdRole, err := o.RoleClient.Create(changedRoles[i])
108+
if err != nil {
109+
return err
110+
}
111+
112+
fmt.Fprintf(o.Out, "clusterrole/%s\n", createdRole.Name)
113+
continue
114+
}
115+
116+
role.Rules = changedRoles[i].Rules
117+
updatedRole, err := o.RoleClient.Update(role)
118+
if err != nil {
119+
return err
120+
}
121+
122+
fmt.Fprintf(o.Out, "clusterrole/%s\n", updatedRole.Name)
123+
}
124+
125+
return nil
126+
}
127+
128+
func (o *reconcileClusterOptions) ChangedClusterRoles() ([]*authorizationapi.ClusterRole, error) {
129+
changedRoles := []*authorizationapi.ClusterRole{}
130+
131+
bootstrapClusterRoles := bootstrappolicy.GetBootstrapClusterRoles()
132+
for i := range bootstrapClusterRoles {
133+
expectedClusterRole := &bootstrapClusterRoles[i]
134+
135+
actualClusterRole, err := o.RoleClient.Get(expectedClusterRole.Name)
136+
if kapierrors.IsNotFound(err) {
137+
changedRoles = append(changedRoles, expectedClusterRole)
138+
continue
139+
}
140+
if err != nil {
141+
return nil, err
142+
}
143+
144+
if !kapi.Semantic.DeepEqual(expectedClusterRole.Rules, actualClusterRole.Rules) {
145+
changedRoles = append(changedRoles, expectedClusterRole)
146+
}
147+
}
148+
149+
return changedRoles, nil
150+
}

‎rel-eng/completions/bash/oadm

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -370,6 +370,29 @@ _oadm_policy_remove-cluster-role-from-group()
370370
must_have_one_noun=()
371371
}
372372

373+
_oadm_policy_reconcile-cluster-roles()
374+
{
375+
last_command="oadm_policy_reconcile-cluster-roles"
376+
commands=()
377+
378+
flags=()
379+
two_word_flags=()
380+
flags_with_completion=()
381+
flags_completion=()
382+
383+
flags+=("--help")
384+
flags+=("-h")
385+
flags+=("--no-headers")
386+
flags+=("--output=")
387+
two_word_flags+=("-o")
388+
flags+=("--output-version=")
389+
flags+=("--template=")
390+
two_word_flags+=("-t")
391+
392+
must_have_one_flag=()
393+
must_have_one_noun=()
394+
}
395+
373396
_oadm_policy()
374397
{
375398
last_command="oadm_policy"
@@ -385,6 +408,7 @@ _oadm_policy()
385408
commands+=("remove-cluster-role-from-user")
386409
commands+=("add-cluster-role-to-group")
387410
commands+=("remove-cluster-role-from-group")
411+
commands+=("reconcile-cluster-roles")
388412

389413
flags=()
390414
two_word_flags=()

‎rel-eng/completions/bash/openshift

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -748,6 +748,29 @@ _openshift_admin_policy_remove-cluster-role-from-group()
748748
must_have_one_noun=()
749749
}
750750

751+
_openshift_admin_policy_reconcile-cluster-roles()
752+
{
753+
last_command="openshift_admin_policy_reconcile-cluster-roles"
754+
commands=()
755+
756+
flags=()
757+
two_word_flags=()
758+
flags_with_completion=()
759+
flags_completion=()
760+
761+
flags+=("--help")
762+
flags+=("-h")
763+
flags+=("--no-headers")
764+
flags+=("--output=")
765+
two_word_flags+=("-o")
766+
flags+=("--output-version=")
767+
flags+=("--template=")
768+
two_word_flags+=("-t")
769+
770+
must_have_one_flag=()
771+
must_have_one_noun=()
772+
}
773+
751774
_openshift_admin_policy()
752775
{
753776
last_command="openshift_admin_policy"
@@ -763,6 +786,7 @@ _openshift_admin_policy()
763786
commands+=("remove-cluster-role-from-user")
764787
commands+=("add-cluster-role-to-group")
765788
commands+=("remove-cluster-role-from-group")
789+
commands+=("reconcile-cluster-roles")
766790

767791
flags=()
768792
two_word_flags=()

0 commit comments

Comments
 (0)