Skip to content

Commit 2b72402

Browse files
author
Matt Rogers
committed
Add --rolebinding-name to policy commands
Add the --rolebinding-name option to the rolebinding and clusterrolebinding add commands for specifying the name of the rolebinding to modify. Signed-off-by: Matt Rogers <[email protected]>
1 parent 2617823 commit 2b72402

File tree

4 files changed

+367
-11
lines changed

4 files changed

+367
-11
lines changed

‎pkg/cmd/admin/policy/modify_roles_test.go

+289
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,289 @@
1+
package policy
2+
3+
import (
4+
"reflect"
5+
"testing"
6+
7+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
8+
kapi "k8s.io/kubernetes/pkg/api"
9+
10+
authorizationapi "github.com/openshift/origin/pkg/authorization/apis/authorization"
11+
"github.com/openshift/origin/pkg/client/testclient"
12+
"github.com/openshift/origin/pkg/oc/admin/policy"
13+
)
14+
15+
func TestModifyNamedClusterRoleBinding(t *testing.T) {
16+
tests := map[string]struct {
17+
inputRole string
18+
inputRoleBindingName string
19+
inputSubjects []string
20+
expectedRoleBindingName string
21+
expectedSubjects []string
22+
existingClusterRoleBindings *authorizationapi.ClusterRoleBindingList
23+
}{
24+
// no name provided - create "edit" for role "edit"
25+
"create-clusterrolebinding": {
26+
inputRole: "edit",
27+
inputSubjects: []string{
28+
"foo",
29+
},
30+
expectedRoleBindingName: "edit",
31+
expectedSubjects: []string{
32+
"foo",
33+
},
34+
existingClusterRoleBindings: &authorizationapi.ClusterRoleBindingList{
35+
Items: []authorizationapi.ClusterRoleBinding{},
36+
},
37+
},
38+
// name provided - create "custom" for role "edit"
39+
"create-named-clusterrolebinding": {
40+
inputRole: "edit",
41+
inputRoleBindingName: "custom",
42+
inputSubjects: []string{
43+
"foo",
44+
},
45+
expectedRoleBindingName: "custom",
46+
expectedSubjects: []string{
47+
"foo",
48+
},
49+
existingClusterRoleBindings: &authorizationapi.ClusterRoleBindingList{
50+
Items: []authorizationapi.ClusterRoleBinding{},
51+
},
52+
},
53+
// name provided - modify "custom"
54+
"update-named-clusterrolebinding": {
55+
inputRole: "edit",
56+
inputRoleBindingName: "custom",
57+
inputSubjects: []string{
58+
"baz",
59+
},
60+
expectedRoleBindingName: "custom",
61+
expectedSubjects: []string{
62+
"bar",
63+
"baz",
64+
},
65+
existingClusterRoleBindings: &authorizationapi.ClusterRoleBindingList{
66+
Items: []authorizationapi.ClusterRoleBinding{{
67+
ObjectMeta: metav1.ObjectMeta{
68+
Name: "edit",
69+
},
70+
Subjects: []kapi.ObjectReference{{
71+
Name: "foo",
72+
Kind: authorizationapi.UserKind,
73+
}},
74+
RoleRef: kapi.ObjectReference{
75+
Name: "edit",
76+
}}, {
77+
ObjectMeta: metav1.ObjectMeta{
78+
Name: "custom",
79+
},
80+
Subjects: []kapi.ObjectReference{{
81+
Name: "bar",
82+
Kind: authorizationapi.UserKind,
83+
}},
84+
RoleRef: kapi.ObjectReference{
85+
Name: "edit",
86+
}},
87+
},
88+
},
89+
},
90+
// no name provided - modify "edit"
91+
"update-default-clusterrolebinding": {
92+
inputRole: "edit",
93+
inputSubjects: []string{
94+
"baz",
95+
},
96+
expectedRoleBindingName: "edit",
97+
expectedSubjects: []string{
98+
"foo",
99+
"baz",
100+
},
101+
existingClusterRoleBindings: &authorizationapi.ClusterRoleBindingList{
102+
Items: []authorizationapi.ClusterRoleBinding{{
103+
ObjectMeta: metav1.ObjectMeta{
104+
Name: "edit",
105+
},
106+
Subjects: []kapi.ObjectReference{{
107+
Name: "foo",
108+
Kind: authorizationapi.UserKind,
109+
}},
110+
RoleRef: kapi.ObjectReference{
111+
Name: "edit",
112+
}}, {
113+
ObjectMeta: metav1.ObjectMeta{
114+
Name: "custom",
115+
},
116+
Subjects: []kapi.ObjectReference{{
117+
Name: "bar",
118+
Kind: authorizationapi.UserKind,
119+
}},
120+
RoleRef: kapi.ObjectReference{
121+
Name: "edit",
122+
}},
123+
},
124+
},
125+
},
126+
}
127+
for tcName, tc := range tests {
128+
// Set up modifier options and run AddRole()
129+
o := &policy.RoleModificationOptions{
130+
RoleName: tc.inputRole,
131+
RoleBindingName: tc.inputRoleBindingName,
132+
Users: tc.inputSubjects,
133+
RoleBindingAccessor: policy.NewClusterRoleBindingAccessor(testclient.NewSimpleFake(tc.existingClusterRoleBindings)),
134+
}
135+
136+
addRoleAndCheck(t, o, tcName, tc.expectedRoleBindingName, tc.expectedSubjects)
137+
}
138+
}
139+
140+
func TestModifyNamedLocalRoleBinding(t *testing.T) {
141+
tests := map[string]struct {
142+
inputRole string
143+
inputRoleBindingName string
144+
inputSubjects []string
145+
expectedRoleBindingName string
146+
expectedSubjects []string
147+
existingRoleBindings *authorizationapi.RoleBindingList
148+
}{
149+
// no name provided - create "edit" for role "edit"
150+
"create-rolebinding": {
151+
inputRole: "edit",
152+
inputSubjects: []string{
153+
"foo",
154+
},
155+
expectedRoleBindingName: "edit",
156+
expectedSubjects: []string{
157+
"foo",
158+
},
159+
existingRoleBindings: &authorizationapi.RoleBindingList{
160+
Items: []authorizationapi.RoleBinding{},
161+
},
162+
},
163+
// name provided - create "custom" for role "edit"
164+
"create-named-binding": {
165+
inputRole: "edit",
166+
inputRoleBindingName: "custom",
167+
inputSubjects: []string{
168+
"foo",
169+
},
170+
expectedRoleBindingName: "custom",
171+
expectedSubjects: []string{
172+
"foo",
173+
},
174+
existingRoleBindings: &authorizationapi.RoleBindingList{
175+
Items: []authorizationapi.RoleBinding{},
176+
},
177+
},
178+
// no name provided - modify "edit"
179+
"update-default-binding": {
180+
inputRole: "edit",
181+
inputSubjects: []string{
182+
"baz",
183+
},
184+
expectedRoleBindingName: "edit",
185+
expectedSubjects: []string{
186+
"foo",
187+
"baz",
188+
},
189+
existingRoleBindings: &authorizationapi.RoleBindingList{
190+
Items: []authorizationapi.RoleBinding{{
191+
ObjectMeta: metav1.ObjectMeta{
192+
Name: "edit",
193+
Namespace: metav1.NamespaceDefault,
194+
},
195+
Subjects: []kapi.ObjectReference{{
196+
Name: "foo",
197+
Kind: authorizationapi.UserKind,
198+
}},
199+
RoleRef: kapi.ObjectReference{
200+
Name: "edit",
201+
Namespace: metav1.NamespaceDefault,
202+
}}, {
203+
ObjectMeta: metav1.ObjectMeta{
204+
Name: "custom",
205+
Namespace: metav1.NamespaceDefault,
206+
},
207+
Subjects: []kapi.ObjectReference{{
208+
Name: "bar",
209+
Kind: authorizationapi.UserKind,
210+
}},
211+
RoleRef: kapi.ObjectReference{
212+
Name: "edit",
213+
Namespace: metav1.NamespaceDefault,
214+
}},
215+
},
216+
},
217+
},
218+
// name provided - modify "custom"
219+
"update-named-binding": {
220+
inputRole: "edit",
221+
inputRoleBindingName: "custom",
222+
inputSubjects: []string{
223+
"baz",
224+
},
225+
expectedRoleBindingName: "custom",
226+
expectedSubjects: []string{
227+
"bar",
228+
"baz",
229+
},
230+
existingRoleBindings: &authorizationapi.RoleBindingList{
231+
Items: []authorizationapi.RoleBinding{{
232+
ObjectMeta: metav1.ObjectMeta{
233+
Name: "edit",
234+
Namespace: metav1.NamespaceDefault,
235+
},
236+
Subjects: []kapi.ObjectReference{{
237+
Name: "foo",
238+
Kind: authorizationapi.UserKind,
239+
}},
240+
RoleRef: kapi.ObjectReference{
241+
Name: "edit",
242+
Namespace: metav1.NamespaceDefault,
243+
}}, {
244+
ObjectMeta: metav1.ObjectMeta{
245+
Name: "custom",
246+
Namespace: metav1.NamespaceDefault,
247+
},
248+
Subjects: []kapi.ObjectReference{{
249+
Name: "bar",
250+
Kind: authorizationapi.UserKind,
251+
}},
252+
RoleRef: kapi.ObjectReference{
253+
Name: "edit",
254+
Namespace: metav1.NamespaceDefault,
255+
}},
256+
},
257+
},
258+
},
259+
}
260+
for tcName, tc := range tests {
261+
// Set up modifier options and run AddRole()
262+
o := &policy.RoleModificationOptions{
263+
RoleName: tc.inputRole,
264+
RoleBindingName: tc.inputRoleBindingName,
265+
Users: tc.inputSubjects,
266+
RoleNamespace: metav1.NamespaceDefault,
267+
RoleBindingAccessor: policy.NewLocalRoleBindingAccessor(metav1.NamespaceDefault, testclient.NewSimpleFake(tc.existingRoleBindings)),
268+
}
269+
270+
addRoleAndCheck(t, o, tcName, tc.expectedRoleBindingName, tc.expectedSubjects)
271+
}
272+
}
273+
274+
func addRoleAndCheck(t *testing.T, o *policy.RoleModificationOptions, tcName, expectedName string, expectedSubjects []string) {
275+
err := o.AddRole()
276+
if err != nil {
277+
t.Errorf("%s: unexpected err %v", tcName, err)
278+
}
279+
280+
roleBinding, err := o.RoleBindingAccessor.GetRoleBinding(expectedName)
281+
if err != nil {
282+
t.Errorf("%s: err fetching roleBinding %s, %s", tcName, expectedName, err)
283+
}
284+
285+
subjects, _ := authorizationapi.StringSubjectsFor(roleBinding.Namespace, roleBinding.Subjects)
286+
if !reflect.DeepEqual(expectedSubjects, subjects) {
287+
t.Errorf("%s: err expected users: %v, actual: %v", tcName, expectedSubjects, subjects)
288+
}
289+
}

0 commit comments

Comments
 (0)