Skip to content

Commit e64adc8

Browse files
deads2kdeads2k
committed
add oc create policybinding
1 parent b33f606 commit e64adc8

File tree

7 files changed

+223
-0
lines changed

7 files changed

+223
-0
lines changed

‎contrib/completions/bash/oc

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6652,6 +6652,47 @@ _oc_create_route()
66526652
must_have_one_noun=()
66536653
}
66546654

6655+
_oc_create_policybinding()
6656+
{
6657+
last_command="oc_create_policybinding"
6658+
commands=()
6659+
6660+
flags=()
6661+
two_word_flags=()
6662+
flags_with_completion=()
6663+
flags_completion=()
6664+
6665+
flags+=("--output=")
6666+
two_word_flags+=("-o")
6667+
flags+=("--api-version=")
6668+
flags+=("--certificate-authority=")
6669+
flags_with_completion+=("--certificate-authority")
6670+
flags_completion+=("_filedir")
6671+
flags+=("--client-certificate=")
6672+
flags_with_completion+=("--client-certificate")
6673+
flags_completion+=("_filedir")
6674+
flags+=("--client-key=")
6675+
flags_with_completion+=("--client-key")
6676+
flags_completion+=("_filedir")
6677+
flags+=("--cluster=")
6678+
flags+=("--config=")
6679+
flags_with_completion+=("--config")
6680+
flags_completion+=("_filedir")
6681+
flags+=("--context=")
6682+
flags+=("--google-json-key=")
6683+
flags+=("--insecure-skip-tls-verify")
6684+
flags+=("--log-flush-frequency=")
6685+
flags+=("--match-server-version")
6686+
flags+=("--namespace=")
6687+
two_word_flags+=("-n")
6688+
flags+=("--server=")
6689+
flags+=("--token=")
6690+
flags+=("--user=")
6691+
6692+
must_have_one_flag=()
6693+
must_have_one_noun=()
6694+
}
6695+
66556696
_oc_create()
66566697
{
66576698
last_command="oc_create"
@@ -6661,6 +6702,7 @@ _oc_create()
66616702
commands+=("configmap")
66626703
commands+=("serviceaccount")
66636704
commands+=("route")
6705+
commands+=("policybinding")
66646706

66656707
flags=()
66666708
two_word_flags=()

‎contrib/completions/bash/openshift

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10201,6 +10201,47 @@ _openshift_cli_create_route()
1020110201
must_have_one_noun=()
1020210202
}
1020310203

10204+
_openshift_cli_create_policybinding()
10205+
{
10206+
last_command="openshift_cli_create_policybinding"
10207+
commands=()
10208+
10209+
flags=()
10210+
two_word_flags=()
10211+
flags_with_completion=()
10212+
flags_completion=()
10213+
10214+
flags+=("--output=")
10215+
two_word_flags+=("-o")
10216+
flags+=("--api-version=")
10217+
flags+=("--certificate-authority=")
10218+
flags_with_completion+=("--certificate-authority")
10219+
flags_completion+=("_filedir")
10220+
flags+=("--client-certificate=")
10221+
flags_with_completion+=("--client-certificate")
10222+
flags_completion+=("_filedir")
10223+
flags+=("--client-key=")
10224+
flags_with_completion+=("--client-key")
10225+
flags_completion+=("_filedir")
10226+
flags+=("--cluster=")
10227+
flags+=("--config=")
10228+
flags_with_completion+=("--config")
10229+
flags_completion+=("_filedir")
10230+
flags+=("--context=")
10231+
flags+=("--google-json-key=")
10232+
flags+=("--insecure-skip-tls-verify")
10233+
flags+=("--log-flush-frequency=")
10234+
flags+=("--match-server-version")
10235+
flags+=("--namespace=")
10236+
two_word_flags+=("-n")
10237+
flags+=("--server=")
10238+
flags+=("--token=")
10239+
flags+=("--user=")
10240+
10241+
must_have_one_flag=()
10242+
must_have_one_noun=()
10243+
}
10244+
1020410245
_openshift_cli_create()
1020510246
{
1020610247
last_command="openshift_cli_create"
@@ -10210,6 +10251,7 @@ _openshift_cli_create()
1021010251
commands+=("configmap")
1021110252
commands+=("serviceaccount")
1021210253
commands+=("route")
10254+
commands+=("policybinding")
1021310255

1021410256
flags=()
1021510257
two_word_flags=()

‎docs/generated/oc_by_example_content.adoc

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -811,6 +811,19 @@ Create a namespace with the specified name.
811811
====
812812

813813

814+
== oc create policybinding
815+
Create a policy binding that references the policy in the targetted namespace.
816+
817+
====
818+
819+
[options="nowrap"]
820+
----
821+
# Create a policy binding in namespace "foo" that references the policy in namespace "bar"
822+
$ oc create policybinding bar -n foo
823+
----
824+
====
825+
826+
814827
== oc create route edge
815828
Create a route that uses edge TLS termination
816829

‎pkg/cmd/cli/cmd/create/policy_binding.go

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
package create
2+
3+
import (
4+
"fmt"
5+
"io"
6+
7+
"github.com/spf13/cobra"
8+
9+
"k8s.io/kubernetes/pkg/api/meta"
10+
cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
11+
"k8s.io/kubernetes/pkg/runtime"
12+
13+
authorizationapi "github.com/openshift/origin/pkg/authorization/api"
14+
"github.com/openshift/origin/pkg/client"
15+
"github.com/openshift/origin/pkg/cmd/util/clientcmd"
16+
)
17+
18+
const (
19+
PolicyBindingRecommendedName = "policybinding"
20+
21+
policyBindingLong = `
22+
Create a policy binding that references the policy in the targetted namespace.`
23+
24+
policyBindingExample = ` # Create a policy binding in namespace "foo" that references the policy in namespace "bar"
25+
$ %[1]s bar -n foo`
26+
)
27+
28+
type CreatePolicyBindingOptions struct {
29+
BindingNamespace string
30+
PolicyNamespace string
31+
32+
BindingClient client.PolicyBindingsNamespacer
33+
34+
Mapper meta.RESTMapper
35+
OutputFormat string
36+
Out io.Writer
37+
Printer ObjectPrinter
38+
}
39+
40+
type ObjectPrinter func(runtime.Object, io.Writer) error
41+
42+
// NewCmdCreateServiceAccount is a macro command to create a new service account
43+
func NewCmdCreatePolicyBinding(name, fullName string, f *clientcmd.Factory, out io.Writer) *cobra.Command {
44+
o := &CreatePolicyBindingOptions{Out: out}
45+
46+
cmd := &cobra.Command{
47+
Use: name + " TARGET_POLICY_NAMESPACE",
48+
Short: "Create a policy binding that references the policy in the targetted namespace.",
49+
Long: policyBindingLong,
50+
Example: fmt.Sprintf(policyBindingExample, fullName),
51+
Run: func(cmd *cobra.Command, args []string) {
52+
cmdutil.CheckErr(o.Complete(cmd, f, args))
53+
cmdutil.CheckErr(o.CreatePolicyBinding())
54+
},
55+
}
56+
cmdutil.AddOutputFlagsForMutation(cmd)
57+
return cmd
58+
}
59+
60+
func (o *CreatePolicyBindingOptions) Complete(cmd *cobra.Command, f *clientcmd.Factory, args []string) error {
61+
if len(args) != 1 {
62+
return fmt.Errorf("exactly one argument (policy namespace) is supported, not: %v", args)
63+
}
64+
o.PolicyNamespace = args[0]
65+
66+
namespace, _, err := f.DefaultNamespace()
67+
if err != nil {
68+
return err
69+
}
70+
o.BindingNamespace = namespace
71+
72+
client, _, err := f.Clients()
73+
if err != nil {
74+
return err
75+
}
76+
o.BindingClient = client
77+
78+
o.Mapper, _ = f.Object()
79+
o.OutputFormat = cmdutil.GetFlagString(cmd, "output")
80+
81+
o.Printer = func(obj runtime.Object, out io.Writer) error {
82+
return f.PrintObject(cmd, obj, out)
83+
}
84+
85+
return nil
86+
}
87+
88+
func (o *CreatePolicyBindingOptions) CreatePolicyBinding() error {
89+
binding := &authorizationapi.PolicyBinding{}
90+
binding.PolicyRef.Namespace = o.PolicyNamespace
91+
binding.PolicyRef.Name = authorizationapi.PolicyName
92+
binding.Name = authorizationapi.GetPolicyBindingName(binding.PolicyRef.Namespace)
93+
94+
actualBinding, err := o.BindingClient.PolicyBindings(o.BindingNamespace).Create(binding)
95+
if err != nil {
96+
return err
97+
}
98+
99+
if useShortOutput := o.OutputFormat == "name"; useShortOutput || len(o.OutputFormat) == 0 {
100+
cmdutil.PrintSuccess(o.Mapper, useShortOutput, o.Out, "policybinding", actualBinding.Name, "created")
101+
return nil
102+
}
103+
104+
return o.Printer(actualBinding, o.Out)
105+
}

‎pkg/cmd/cli/cmd/wrappers.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ import (
1313
kcmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
1414
kvalidation "k8s.io/kubernetes/pkg/util/validation"
1515

16+
"github.com/openshift/origin/pkg/cmd/cli/cmd/create"
1617
cmdconfig "github.com/openshift/origin/pkg/cmd/cli/config"
1718
"github.com/openshift/origin/pkg/cmd/cli/describe"
1819
"github.com/openshift/origin/pkg/cmd/util/clientcmd"
@@ -157,6 +158,7 @@ func NewCmdCreate(parentName string, f *clientcmd.Factory, out io.Writer) *cobra
157158

158159
// create subcommands
159160
cmd.AddCommand(NewCmdCreateRoute(parentName, f, out))
161+
cmd.AddCommand(create.NewCmdCreatePolicyBinding(create.PolicyBindingRecommendedName, parentName+" create "+create.PolicyBindingRecommendedName, f, out))
160162

161163
adjustCmdExamples(cmd, parentName, "create")
162164

‎test/cmd/admin.sh

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -309,6 +309,21 @@ os::cmd::expect_success_and_not_text 'oc get scc/restricted -o yaml' 'topic: my-
309309
echo "reconcile-scc: ok"
310310

311311

312+
# Admin can't bind local roles without cluster-admin permissions
313+
os::cmd::expect_success "oc create -f test/extended/fixtures/roles/empty-role.yaml"
314+
os::cmd::expect_success 'oadm policy add-role-to-user admin local-admin'
315+
os::cmd::try_until_text "oc policy who-can get policybindings" "local-admin"
316+
os::cmd::expect_success 'oc login -u local-admin -p pw'
317+
os::cmd::expect_failure 'oc policy add-role-to-user empty-role other --role-namespace=cmd-admin'
318+
os::cmd::expect_success 'oc login -u system:admin'
319+
os::cmd::expect_success "oc create policybinding cmd-admin"
320+
os::cmd::expect_success 'oc login -u local-admin -p pw'
321+
oc policy add-role-to-user empty-role other --role-namespace=cmd-admin
322+
os::cmd::expect_success 'oc login -u system:admin'
323+
os::cmd::expect_success "oc delete role/empty-role"
324+
echo "policybinding-required: ok"
325+
326+
312327
# Create test users/identities and groups
313328
os::cmd::expect_success 'oc login -u cascaded-user -p pw'
314329
os::cmd::expect_success 'oc login -u orphaned-user -p pw'

‎test/extended/fixtures/roles/empty-role.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: v1
2+
kind: Role
3+
metadata:
4+
name: empty-role

0 commit comments

Comments
 (0)