rbac api changes for aggregation

pkg/apis/rbac/types.go

@@ -155,6 +155,18 @@ type ClusterRole struct {
 
 	// Rules holds all the PolicyRules for this ClusterRole
 	Rules []PolicyRule
+
+	// AggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
+	// If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be
+	// stomped by the controller.
+	AggregationRule *AggregationRule
+}
+
+// AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole
+type AggregationRule struct {
+	// ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
+	// If any of the selectors match, then the ClusterRole's permissions will be added
+	ClusterRoleSelectors []metav1.LabelSelector
 }
 
 // +genclient

pkg/apis/rbac/validation/validation.go

@@ -18,6 +18,8 @@ package validation
 
 import (
 	"k8s.io/apimachinery/pkg/api/validation/path"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	unversionedvalidation "k8s.io/apimachinery/pkg/apis/meta/v1/validation"
 	"k8s.io/apimachinery/pkg/util/validation/field"
 	"k8s.io/kubernetes/pkg/apis/core/validation"
 	"k8s.io/kubernetes/pkg/apis/rbac"
@@ -61,6 +63,22 @@ func ValidateClusterRole(role *rbac.ClusterRole) field.ErrorList {
 			allErrs = append(allErrs, err...)
 		}
 	}
+
+	if role.AggregationRule != nil {
+		if len(role.AggregationRule.ClusterRoleSelectors) == 0 {
+			allErrs = append(allErrs, field.Required(field.NewPath("aggregationRule", "clusterRoleSelectors"), "at least one clusterRoleSelector required if aggregationRule is non-nil"))
+		}
+		for i, selector := range role.AggregationRule.ClusterRoleSelectors {
+			fieldPath := field.NewPath("aggregationRule", "clusterRoleSelectors").Index(i)
+			allErrs = append(allErrs, unversionedvalidation.ValidateLabelSelector(&selector, fieldPath)...)
+
+			selector, err := metav1.LabelSelectorAsSelector(&selector)
+			if err != nil {
+				allErrs = append(allErrs, field.Invalid(fieldPath, selector, "invalid label selector."))
+			}
+		}
+	}
+
 	if len(allErrs) != 0 {
 		return allErrs
 	}