@@ -10,7 +10,9 @@ import (
1010
1111 "github.com/spf13/cobra"
1212
13+ "k8s.io/apimachinery/pkg/util/sets"
1314 kapi "k8s.io/kubernetes/pkg/api"
15+ "k8s.io/kubernetes/pkg/apis/rbac"
1416 kcmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
1517 kprinters "k8s.io/kubernetes/pkg/printers"
1618
@@ -53,6 +55,7 @@ func NewCommandCreateBootstrapPolicyFile(commandName string, fullName string, ou
5355
5456 flags .StringVar (& options .File , "filename" , DefaultPolicyFile , "The policy template file that will be written with roles and bindings." )
5557 flags .StringVar (& options .OpenShiftSharedResourcesNamespace , "openshift-namespace" , "openshift" , "Namespace for shared resources." )
58+ flags .MarkDeprecated ("openshift-namespace" , "this field is no longer supported and using it can lead to undefined behavior" )
5659
5760 // autocompletion hints
5861 cmd .MarkFlagFilename ("filename" )
@@ -80,11 +83,11 @@ func (o CreateBootstrapPolicyFileOptions) CreateBootstrapPolicyFile() error {
8083 }
8184
8285 policyTemplate := & templateapi.Template {}
86+ policy := bootstrappolicy .Policy ()
8387
84- clusterRoles := bootstrappolicy .GetBootstrapClusterRoles ()
85- for i := range clusterRoles {
88+ for i := range policy .ClusterRoles {
8689 originObject := & authorizationapi.ClusterRole {}
87- if err := kapi .Scheme .Convert (& clusterRoles [i ], originObject , nil ); err != nil {
90+ if err := kapi .Scheme .Convert (& policy . ClusterRoles [i ], originObject , nil ); err != nil {
8891 return err
8992 }
9093 versionedObject , err := kapi .Scheme .ConvertToVersion (originObject , latest .Version )
@@ -94,10 +97,9 @@ func (o CreateBootstrapPolicyFileOptions) CreateBootstrapPolicyFile() error {
9497 policyTemplate .Objects = append (policyTemplate .Objects , versionedObject )
9598 }
9699
97- clusterRoleBindings := bootstrappolicy .GetBootstrapClusterRoleBindings ()
98- for i := range clusterRoleBindings {
100+ for i := range policy .ClusterRoleBindings {
99101 originObject := & authorizationapi.ClusterRoleBinding {}
100- if err := kapi .Scheme .Convert (& clusterRoleBindings [i ], originObject , nil ); err != nil {
102+ if err := kapi .Scheme .Convert (& policy . ClusterRoleBindings [i ], originObject , nil ); err != nil {
101103 return err
102104 }
103105 versionedObject , err := kapi .Scheme .ConvertToVersion (originObject , latest .Version )
@@ -107,30 +109,64 @@ func (o CreateBootstrapPolicyFileOptions) CreateBootstrapPolicyFile() error {
107109 policyTemplate .Objects = append (policyTemplate .Objects , versionedObject )
108110 }
109111
110- openshiftRoles := bootstrappolicy .GetBootstrapOpenshiftRoles (o .OpenShiftSharedResourcesNamespace )
111- for i := range openshiftRoles {
112- originObject := & authorizationapi.Role {}
113- if err := kapi .Scheme .Convert (& openshiftRoles [i ], originObject , nil ); err != nil {
114- return err
112+ openshiftRoles := map [string ][]rbac.Role {}
113+ for namespace , roles := range policy .Roles {
114+ if namespace == bootstrappolicy .DefaultOpenShiftSharedResourcesNamespace {
115+ r := make ([]rbac.Role , len (roles ))
116+ for i := range roles {
117+ r [i ] = roles [i ]
118+ r [i ].Namespace = o .OpenShiftSharedResourcesNamespace
119+ }
120+ openshiftRoles [o .OpenShiftSharedResourcesNamespace ] = r
121+ } else {
122+ openshiftRoles [namespace ] = roles
115123 }
116- versionedObject , err := kapi .Scheme .ConvertToVersion (originObject , latest .Version )
117- if err != nil {
118- return err
124+ }
125+
126+ // iterate in a defined order
127+ for _ , namespace := range sets .StringKeySet (openshiftRoles ).List () {
128+ roles := openshiftRoles [namespace ]
129+ for i := range roles {
130+ originObject := & authorizationapi.Role {}
131+ if err := kapi .Scheme .Convert (& roles [i ], originObject , nil ); err != nil {
132+ return err
133+ }
134+ versionedObject , err := kapi .Scheme .ConvertToVersion (originObject , latest .Version )
135+ if err != nil {
136+ return err
137+ }
138+ policyTemplate .Objects = append (policyTemplate .Objects , versionedObject )
119139 }
120- policyTemplate .Objects = append (policyTemplate .Objects , versionedObject )
121140 }
122141
123- openshiftRoleBindings := bootstrappolicy .GetBootstrapOpenshiftRoleBindings (o .OpenShiftSharedResourcesNamespace )
124- for i := range openshiftRoleBindings {
125- originObject := & authorizationapi.RoleBinding {}
126- if err := kapi .Scheme .Convert (& openshiftRoleBindings [i ], originObject , nil ); err != nil {
127- return err
142+ openshiftRoleBindings := map [string ][]rbac.RoleBinding {}
143+ for namespace , roleBindings := range policy .RoleBindings {
144+ if namespace == bootstrappolicy .DefaultOpenShiftSharedResourcesNamespace {
145+ rb := make ([]rbac.RoleBinding , len (roleBindings ))
146+ for i := range roleBindings {
147+ rb [i ] = roleBindings [i ]
148+ rb [i ].Namespace = o .OpenShiftSharedResourcesNamespace
149+ }
150+ openshiftRoleBindings [o .OpenShiftSharedResourcesNamespace ] = rb
151+ } else {
152+ openshiftRoleBindings [namespace ] = roleBindings
128153 }
129- versionedObject , err := kapi .Scheme .ConvertToVersion (originObject , latest .Version )
130- if err != nil {
131- return err
154+ }
155+
156+ // iterate in a defined order
157+ for _ , namespace := range sets .StringKeySet (openshiftRoleBindings ).List () {
158+ roleBindings := openshiftRoleBindings [namespace ]
159+ for i := range roleBindings {
160+ originObject := & authorizationapi.RoleBinding {}
161+ if err := kapi .Scheme .Convert (& roleBindings [i ], originObject , nil ); err != nil {
162+ return err
163+ }
164+ versionedObject , err := kapi .Scheme .ConvertToVersion (originObject , latest .Version )
165+ if err != nil {
166+ return err
167+ }
168+ policyTemplate .Objects = append (policyTemplate .Objects , versionedObject )
132169 }
133- policyTemplate .Objects = append (policyTemplate .Objects , versionedObject )
134170 }
135171
136172 versionedPolicyTemplate , err := kapi .Scheme .ConvertToVersion (policyTemplate , latest .Version )
0 commit comments