diff --git a/staging/src/k8s.io/kubectl/pkg/cmd/create/create_rolebinding.go b/staging/src/k8s.io/kubectl/pkg/cmd/create/create_rolebinding.go index aa680746c52..10e0a144c50 100644 --- a/staging/src/k8s.io/kubectl/pkg/cmd/create/create_rolebinding.go +++ b/staging/src/k8s.io/kubectl/pkg/cmd/create/create_rolebinding.go @@ -17,12 +17,21 @@ limitations under the License. package create import ( + "context" + "fmt" + "strings" + "github.com/spf13/cobra" + rbacv1 "k8s.io/api/rbac/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" "k8s.io/cli-runtime/pkg/genericclioptions" + "k8s.io/cli-runtime/pkg/resource" + rbacclientv1 "k8s.io/client-go/kubernetes/typed/rbac/v1" cmdutil "k8s.io/kubectl/pkg/cmd/util" - "k8s.io/kubectl/pkg/generate" - generateversioned "k8s.io/kubectl/pkg/generate/versioned" + "k8s.io/kubectl/pkg/scheme" + "k8s.io/kubectl/pkg/util" "k8s.io/kubectl/pkg/util/i18n" "k8s.io/kubectl/pkg/util/templates" ) @@ -37,15 +46,42 @@ var ( ) // RoleBindingOpts holds the options for 'create rolebinding' sub command -type RoleBindingOpts struct { - CreateSubcommandOptions *CreateSubcommandOptions +type RoleBindingOptions struct { + PrintFlags *genericclioptions.PrintFlags + PrintObj func(obj runtime.Object) error + + Name string + Namespace string + EnforceNamespace bool + ClusterRole string + Role string + Users []string + Groups []string + ServiceAccounts []string + FieldManager string + CreateAnnotation bool + + Client rbacclientv1.RbacV1Interface + DryRunStrategy cmdutil.DryRunStrategy + DryRunVerifier *resource.DryRunVerifier + + genericclioptions.IOStreams +} + +// NewRoleBindingOptions creates a new *RoleBindingOptions with sane defaults +func NewRoleBindingOptions(ioStreams genericclioptions.IOStreams) *RoleBindingOptions { + return &RoleBindingOptions{ + Users: []string{}, + Groups: []string{}, + ServiceAccounts: []string{}, + PrintFlags: genericclioptions.NewPrintFlags("created").WithTypeSetter(scheme.Scheme), + IOStreams: ioStreams, + } } // NewCmdCreateRoleBinding returns an initialized Command instance for 'create rolebinding' sub command func NewCmdCreateRoleBinding(f cmdutil.Factory, ioStreams genericclioptions.IOStreams) *cobra.Command { - o := &RoleBindingOpts{ - CreateSubcommandOptions: NewCreateSubcommandOptions(ioStreams), - } + o := NewRoleBindingOptions(ioStreams) cmd := &cobra.Command{ Use: "rolebinding NAME --clusterrole=NAME|--role=NAME [--user=username] [--group=groupname] [--serviceaccount=namespace:serviceaccountname] [--dry-run=server|client|none]", @@ -55,50 +91,167 @@ func NewCmdCreateRoleBinding(f cmdutil.Factory, ioStreams genericclioptions.IOSt Example: roleBindingExample, Run: func(cmd *cobra.Command, args []string) { cmdutil.CheckErr(o.Complete(f, cmd, args)) + cmdutil.CheckErr(o.Validate()) cmdutil.CheckErr(o.Run()) }, } - o.CreateSubcommandOptions.PrintFlags.AddFlags(cmd) + o.PrintFlags.AddFlags(cmd) cmdutil.AddApplyAnnotationFlags(cmd) cmdutil.AddValidateFlags(cmd) - cmdutil.AddGeneratorFlags(cmd, generateversioned.RoleBindingV1GeneratorName) - cmd.Flags().String("clusterrole", "", i18n.T("ClusterRole this RoleBinding should reference")) - cmd.Flags().String("role", "", i18n.T("Role this RoleBinding should reference")) - cmd.Flags().StringArray("user", []string{}, "Usernames to bind to the role") - cmd.Flags().StringArray("group", []string{}, "Groups to bind to the role") - cmd.Flags().StringArray("serviceaccount", []string{}, "Service accounts to bind to the role, in the format :") - cmdutil.AddFieldManagerFlagVar(cmd, &o.CreateSubcommandOptions.FieldManager, "kubectl-create") + cmdutil.AddDryRunFlag(cmd) + cmd.Flags().StringVar(&o.ClusterRole, "clusterrole", "", i18n.T("ClusterRole this RoleBinding should reference")) + cmd.Flags().StringVar(&o.Role, "role", "", i18n.T("Role this RoleBinding should reference")) + cmd.Flags().StringArrayVar(&o.Users, "user", o.Users, "Usernames to bind to the role") + cmd.Flags().StringArrayVar(&o.Groups, "group", o.Groups, "Groups to bind to the role") + cmd.Flags().StringArrayVar(&o.ServiceAccounts, "serviceaccount", o.ServiceAccounts, "Service accounts to bind to the role, in the format :") + cmdutil.AddFieldManagerFlagVar(cmd, &o.FieldManager, "kubectl-create") return cmd } // Complete completes all the required options -func (o *RoleBindingOpts) Complete(f cmdutil.Factory, cmd *cobra.Command, args []string) error { - name, err := NameFromCommandArgs(cmd, args) +func (o *RoleBindingOptions) Complete(f cmdutil.Factory, cmd *cobra.Command, args []string) error { + var err error + o.Name, err = NameFromCommandArgs(cmd, args) + if err != nil { + return err + } + clientConfig, err := f.ToRESTConfig() + if err != nil { + return err + } + o.Client, err = rbacclientv1.NewForConfig(clientConfig) if err != nil { return err } - var generator generate.StructuredGenerator - switch generatorName := cmdutil.GetFlagString(cmd, "generator"); generatorName { - case generateversioned.RoleBindingV1GeneratorName: - generator = &generateversioned.RoleBindingGeneratorV1{ - Name: name, - ClusterRole: cmdutil.GetFlagString(cmd, "clusterrole"), - Role: cmdutil.GetFlagString(cmd, "role"), - Users: cmdutil.GetFlagStringArray(cmd, "user"), - Groups: cmdutil.GetFlagStringArray(cmd, "group"), - ServiceAccounts: cmdutil.GetFlagStringArray(cmd, "serviceaccount"), - } - default: - return errUnsupportedGenerator(cmd, generatorName) + o.Namespace, o.EnforceNamespace, err = f.ToRawKubeConfigLoader().Namespace() + if err != nil { + return err } - return o.CreateSubcommandOptions.Complete(f, cmd, args, generator) + o.CreateAnnotation = cmdutil.GetFlagBool(cmd, cmdutil.ApplyAnnotationsFlag) + o.DryRunStrategy, err = cmdutil.GetDryRunStrategy(cmd) + if err != nil { + return err + } + dynamicCient, err := f.DynamicClient() + if err != nil { + return err + } + discoveryClient, err := f.ToDiscoveryClient() + if err != nil { + return err + } + o.DryRunVerifier = resource.NewDryRunVerifier(dynamicCient, discoveryClient) + cmdutil.PrintFlagsWithDryRunStrategy(o.PrintFlags, o.DryRunStrategy) + printer, err := o.PrintFlags.ToPrinter() + if err != nil { + return err + } + o.PrintObj = func(obj runtime.Object) error { + return printer.PrintObj(obj, o.Out) + } + return nil } -// Run calls the CreateSubcommandOptions.Run in RoleBindingOpts instance -func (o *RoleBindingOpts) Run() error { - return o.CreateSubcommandOptions.Run() +// Validate validates required fields are set +func (o *RoleBindingOptions) Validate() error { + if len(o.Name) == 0 { + return fmt.Errorf("name must be specified") + } + if (len(o.ClusterRole) == 0) == (len(o.Role) == 0) { + return fmt.Errorf("exactly one of clusterrole or role must be specified") + } + return nil +} + +// Run performs the execution of 'create rolebinding' sub command +func (o *RoleBindingOptions) Run() error { + roleBinding, err := o.createRoleBinding() + if err != nil { + return err + } + if err := util.CreateOrUpdateAnnotation(o.CreateAnnotation, roleBinding, scheme.DefaultJSONEncoder()); err != nil { + return err + } + + if o.DryRunStrategy != cmdutil.DryRunClient { + createOptions := metav1.CreateOptions{} + if o.FieldManager != "" { + createOptions.FieldManager = o.FieldManager + } + if o.DryRunStrategy == cmdutil.DryRunServer { + if err := o.DryRunVerifier.HasSupport(roleBinding.GroupVersionKind()); err != nil { + return err + } + createOptions.DryRun = []string{metav1.DryRunAll} + } + roleBinding, err = o.Client.RoleBindings(o.Namespace).Create(context.TODO(), roleBinding, createOptions) + if err != nil { + return fmt.Errorf("failed to create rolebinding: %v", err) + } + } + return o.PrintObj(roleBinding) +} + +func (o *RoleBindingOptions) createRoleBinding() (*rbacv1.RoleBinding, error) { + namespace := "" + if o.EnforceNamespace { + namespace = o.Namespace + } + + roleBinding := &rbacv1.RoleBinding{ + TypeMeta: metav1.TypeMeta{APIVersion: rbacv1.SchemeGroupVersion.String(), Kind: "RoleBinding"}, + ObjectMeta: metav1.ObjectMeta{ + Name: o.Name, + Namespace: namespace, + }, + } + + switch { + case len(o.Role) > 0: + roleBinding.RoleRef = rbacv1.RoleRef{ + APIGroup: rbacv1.GroupName, + Kind: "Role", + Name: o.Role, + } + case len(o.ClusterRole) > 0: + roleBinding.RoleRef = rbacv1.RoleRef{ + APIGroup: rbacv1.GroupName, + Kind: "ClusterRole", + Name: o.ClusterRole, + } + } + + for _, user := range o.Users { + roleBinding.Subjects = append(roleBinding.Subjects, rbacv1.Subject{ + Kind: rbacv1.UserKind, + APIGroup: rbacv1.GroupName, + Name: user, + }) + } + + for _, group := range o.Groups { + roleBinding.Subjects = append(roleBinding.Subjects, rbacv1.Subject{ + Kind: rbacv1.GroupKind, + APIGroup: rbacv1.GroupName, + Name: group, + }) + } + + for _, sa := range o.ServiceAccounts { + tokens := strings.Split(sa, ":") + if len(tokens) != 2 || tokens[0] == "" || tokens[1] == "" { + return nil, fmt.Errorf("serviceaccount must be :") + } + roleBinding.Subjects = append(roleBinding.Subjects, rbacv1.Subject{ + Kind: rbacv1.ServiceAccountKind, + APIGroup: "", + Namespace: tokens[0], + Name: tokens[1], + }) + } + return roleBinding, nil } diff --git a/staging/src/k8s.io/kubectl/pkg/cmd/create/create_rolebinding_test.go b/staging/src/k8s.io/kubectl/pkg/cmd/create/create_rolebinding_test.go index a6a6aada4e2..d7cd79f6136 100644 --- a/staging/src/k8s.io/kubectl/pkg/cmd/create/create_rolebinding_test.go +++ b/staging/src/k8s.io/kubectl/pkg/cmd/create/create_rolebinding_test.go @@ -17,113 +17,71 @@ limitations under the License. package create import ( - "bytes" - "io/ioutil" - "net/http" - "reflect" "testing" rbac "k8s.io/api/rbac/v1" + apiequality "k8s.io/apimachinery/pkg/api/equality" "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/runtime" - "k8s.io/apimachinery/pkg/runtime/schema" - "k8s.io/cli-runtime/pkg/genericclioptions" - restclient "k8s.io/client-go/rest" - "k8s.io/client-go/rest/fake" - cmdtesting "k8s.io/kubectl/pkg/cmd/testing" - "k8s.io/kubectl/pkg/scheme" ) -var groupVersion = schema.GroupVersion{Group: "rbac.authorization.k8s.io", Version: "v1"} - func TestCreateRoleBinding(t *testing.T) { - expectBinding := &rbac.RoleBinding{ - TypeMeta: v1.TypeMeta{ - APIVersion: "rbac.authorization.k8s.io/v1", - Kind: "RoleBinding", - }, - ObjectMeta: v1.ObjectMeta{ - Name: "fake-binding", - }, - RoleRef: rbac.RoleRef{ - APIGroup: rbac.GroupName, - Kind: "Role", - Name: "fake-role", - }, - Subjects: []rbac.Subject{ - { - Kind: rbac.UserKind, - APIGroup: "rbac.authorization.k8s.io", - Name: "fake-user", + tests := []struct { + options *RoleBindingOptions + expected *rbac.RoleBinding + }{ + { + options: &RoleBindingOptions{ + Role: "fake-role", + Users: []string{"fake-user"}, + Groups: []string{"fake-group"}, + ServiceAccounts: []string{"fake-namespace:fake-account"}, + Name: "fake-binding", }, - { - Kind: rbac.GroupKind, - APIGroup: "rbac.authorization.k8s.io", - Name: "fake-group", - }, - { - Kind: rbac.ServiceAccountKind, - Namespace: "fake-namespace", - Name: "fake-account", + expected: &rbac.RoleBinding{ + TypeMeta: v1.TypeMeta{ + Kind: "RoleBinding", + APIVersion: "rbac.authorization.k8s.io/v1", + }, + ObjectMeta: v1.ObjectMeta{ + Name: "fake-binding", + }, + RoleRef: rbac.RoleRef{ + APIGroup: rbac.GroupName, + Kind: "Role", + Name: "fake-role", + }, + Subjects: []rbac.Subject{ + { + Kind: rbac.UserKind, + APIGroup: "rbac.authorization.k8s.io", + Name: "fake-user", + }, + { + Kind: rbac.GroupKind, + APIGroup: "rbac.authorization.k8s.io", + Name: "fake-group", + }, + { + Kind: rbac.ServiceAccountKind, + Namespace: "fake-namespace", + Name: "fake-account", + }, + }, }, }, } - tf := cmdtesting.NewTestFactory().WithNamespace("test") - defer tf.Cleanup() - - ns := scheme.Codecs.WithoutConversion() - - info, _ := runtime.SerializerInfoForMediaType(ns.SupportedMediaTypes(), runtime.ContentTypeJSON) - encoder := ns.EncoderForVersion(info.Serializer, groupVersion) - decoder := ns.DecoderToVersion(info.Serializer, groupVersion) - - tf.Client = &RoleBindingRESTClient{ - RESTClient: &fake.RESTClient{ - GroupVersion: groupVersion, - NegotiatedSerializer: ns, - Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) { - switch p, m := req.URL.Path, req.Method; { - case p == "/namespaces/test/rolebindings" && m == "POST": - bodyBits, err := ioutil.ReadAll(req.Body) - if err != nil { - t.Fatalf("TestCreateRoleBinding error: %v", err) - return nil, nil - } - - if obj, _, err := decoder.Decode(bodyBits, nil, &rbac.RoleBinding{}); err == nil { - if !reflect.DeepEqual(obj.(*rbac.RoleBinding), expectBinding) { - t.Fatalf("TestCreateRoleBinding: expected:\n%#v\nsaw:\n%#v", expectBinding, obj.(*rbac.RoleBinding)) - return nil, nil - } - } else { - t.Fatalf("TestCreateRoleBinding error, could not decode the request body into rbac.RoleBinding object: %v", err) - return nil, nil - } - - responseBinding := &rbac.RoleBinding{} - responseBinding.Name = "fake-binding" - return &http.Response{StatusCode: http.StatusCreated, Header: cmdtesting.DefaultHeader(), Body: ioutil.NopCloser(bytes.NewReader([]byte(runtime.EncodeOrDie(encoder, responseBinding))))}, nil - default: - t.Fatalf("unexpected request: %#v\n%#v", req.URL, req) - return nil, nil - } - }), - }, + for i, tc := range tests { + t.Run(string(i), func(t *testing.T) { + roleBinding, err := tc.options.createRoleBinding() + if err != nil { + t.Errorf("unexpected error:\n%#v\n", err) + return + } + if !apiequality.Semantic.DeepEqual(roleBinding, tc.expected) { + t.Errorf("expected:\n%#v\ngot:\n%#v", tc.expected, roleBinding) + } + }) } - cmd := NewCmdCreateRoleBinding(tf, genericclioptions.NewTestIOStreamsDiscard()) - cmd.Flags().Set("role", "fake-role") - cmd.Flags().Set("user", "fake-user") - cmd.Flags().Set("group", "fake-group") - cmd.Flags().Set("serviceaccount", "fake-namespace:fake-account") - cmd.Run(cmd, []string{"fake-binding"}) -} - -type RoleBindingRESTClient struct { - *fake.RESTClient -} - -func (c *RoleBindingRESTClient) Post() *restclient.Request { - return c.RESTClient.Verb("POST") }