From 0c0a32d87067b7dafb7226ef6500d0c3fd5e7063 Mon Sep 17 00:00:00 2001
From: xilabao <chenr.fnst@cn.fujitsu.com>
Date: Fri, 28 Apr 2017 17:33:30 +0800
Subject: [PATCH] add validate in create rolebinding

---
 pkg/kubectl/clusterrolebinding.go | 2 +-
 pkg/kubectl/rolebinding.go        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkg/kubectl/clusterrolebinding.go b/pkg/kubectl/clusterrolebinding.go
index b5a0b0d1fdf..b19ca40754c 100644
--- a/pkg/kubectl/clusterrolebinding.go
+++ b/pkg/kubectl/clusterrolebinding.go
@@ -132,7 +132,7 @@ func (s ClusterRoleBindingGeneratorV1) StructuredGenerate() (runtime.Object, err
 	}
 	for _, sa := range sets.NewString(s.ServiceAccounts...).List() {
 		tokens := strings.Split(sa, ":")
-		if len(tokens) != 2 {
+		if len(tokens) != 2 || tokens[0] == "" || tokens[1] == "" {
 			return nil, fmt.Errorf("serviceaccount must be <namespace>:<name>")
 		}
 		clusterRoleBinding.Subjects = append(clusterRoleBinding.Subjects, rbac.Subject{
diff --git a/pkg/kubectl/rolebinding.go b/pkg/kubectl/rolebinding.go
index f9630efbe9e..6d1ae4ddaa0 100644
--- a/pkg/kubectl/rolebinding.go
+++ b/pkg/kubectl/rolebinding.go
@@ -147,7 +147,7 @@ func (s RoleBindingGeneratorV1) StructuredGenerate() (runtime.Object, error) {
 	}
 	for _, sa := range sets.NewString(s.ServiceAccounts...).List() {
 		tokens := strings.Split(sa, ":")
-		if len(tokens) != 2 {
+		if len(tokens) != 2 || tokens[1] == "" {
 			return nil, fmt.Errorf("serviceaccount must be <namespace>:<name>")
 		}
 		roleBinding.Subjects = append(roleBinding.Subjects, rbac.Subject{