[WIP] oc create clusterrole: new command #11937

php-coder · 2016-11-16T18:10:33Z

Add a new command oc create clusterrole that takes role name, list of actions, list of resources and creates a new cluster role.

Example:

$ oc create clusterrole dockerbuilder --verbs create --resources builds/docker
clusterrole "dockerbuilder" created
$ oc get clusterrole dockerbuilder -o yaml
apiVersion: v1
kind: ClusterRole
metadata:
  creationTimestamp: 2016-11-16T18:06:28Z
  name: dockerbuilder
  resourceVersion: "42371"
  selfLink: /oapi/v1/clusterroles/dockerbuilder4
  uid: 65470a15-ac27-11e6-8811-080027242396
rules:
- apiGroups:
  - ""
  attributeRestrictions: null
  resources:
  - builds/docker
  verbs:
  - create

Fixes #3804

TODO:

php-coder · 2016-11-16T18:12:54Z

@csrwng @deads2k Cesar, David, is this what you had in mind?

liggitt · 2016-11-16T18:13:40Z

pkg/cmd/admin/policy/create.go

+
+	Name      string
+	Resources []string
+	Actions   []string


name the options and flags to match the API object fields? (verbs, resources, api-groups, etc)?

Fixed. I named it "actions" because such name were used in the original issue.

liggitt · 2016-11-16T18:14:13Z

pkg/cmd/admin/policy/create.go

+	}
+
+	cmd.Flags().StringSliceVarP(&options.Resources, "resources", "", options.Resources, "list of resources (separated by comma)")
+	cmd.Flags().StringSliceVarP(&options.Actions, "actions", "", options.Actions, "list of actions (separated by comma)")


are we happy not ever allowing commas in verbs or resources?

are we happy not ever allowing commas in verbs or resources?

I'm fine with that.

liggitt · 2016-11-16T18:14:30Z

pkg/cmd/admin/policy/create.go

+}
+
+func (o *NewClusterRoleOptions) CreateRole() error {
+	rule, err := authapi.NewRule(o.Actions...).Resources(o.Resources...).Groups("").Rule()


don't assume "" api group

we'll likely need to express distinct verb/resource pairings ("create a role that lets me get,list,watch pods and create,update,delete,list,watch replicasets")

we'll likely need to express distinct verb/resource pairings ("create a role that lets me get,list,watch pods and create,update,delete,list,watch replicasets")

I'd like to have set commands to handle that sort of thing as well. That would make the need to handle distinct tuples in a single command less important.

I'm not understand yet for what this field is used and which values it accepts. Will investigate it..

liggitt · 2016-11-16T18:16:21Z

pkg/cmd/admin/policy/policy.go

 			Commands: []*cobra.Command{
+				NewCmdCreateClusterRole(CreateClusterRoleRecommendedName, fullName+" "+CreateClusterRoleRecommendedName, f, out),


this should go under the create subtree, not the policy subtree

this should go under the create subtree, not the policy subtree

I agree. I'd also like to see a pull with the equivalent command upstream for rbac clusterroles.

I don't see "create" subtree in oadm command. I see only commands with prefix "create-" in the "Configuration" subtree. Did you mean this section?

it's under oc create

I don't see "create" subtree in oadm command. I see only commands with prefix "create-" in the "Configuration" subtree. Did you mean this section?

oc create clusterrole is appropriate since its an API resource.

csrwng · 2016-11-16T18:30:37Z

Based on comments in the original issue, it's also desirable to validate the actions and resources passed in. @deads2k is that possible?

deads2k · 2016-11-16T18:31:56Z

Based on comments in the original issue, it's also desirable to validate the actions and resources passed in. @deads2k is that possible?

I'd like to see them linted, possibly with a --force for "I know what I'm doing, just make it!". All lowercase, known verbs, maybe matches discovery for some resource plus a whitelist. We want to avoid dumb typos.

csrwng · 2016-11-16T18:33:58Z

Is there a place that we can get a list of known verbs or resources from?

deads2k · 2016-11-16T18:37:08Z

Is there a place that we can get a list of known verbs or resources from?

For resources you can see the discovery doc. For verbs, you could start a "well-known" set upstream.

liggitt · 2016-11-16T18:37:57Z

resources from discovery, if the server's up (though that won't include virtual resources like builds/jenkinspipeline or imagestreams/layers)

nothing in discovery for verbs yet (and even if there is eventually, it won't include verbs like impersonate and use)

…ocs.sh

openshift-bot · 2017-03-02T23:37:22Z

Origin Action Required: Pull request cannot be automatically merged, please rebase your branch from latest HEAD and push again

php-coder · 2017-03-03T09:51:03Z

I'm closing this in favor of kubernetes/kubernetes#41538 that will be available after next rebase to the next version of Kubernetes.

liggitt suggested changes Nov 16, 2016

View reviewed changes

php-coder changed the title ~~[WIP] oadm policy create-cluster-role: new command~~ [WIP] oc create clusterrole: new command Nov 23, 2016

php-coder force-pushed the gh3804_add_cluster_role_cmd branch from 89dbf78 to 8b7d749 Compare November 23, 2016 18:23

php-coder added 2 commits December 1, 2016 18:18

oc create clusterrole: implement command for creating new cluster role.

b15bcaa

Run hack/update-generated-completions.sh and hack/update-generated-d…

6b3cf5b

…ocs.sh

php-coder force-pushed the gh3804_add_cluster_role_cmd branch from 8b7d749 to 6b3cf5b Compare December 1, 2016 17:19

openshift-bot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Feb 26, 2017

openshift-bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 2, 2017

php-coder closed this Mar 3, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[WIP] oc create clusterrole: new command #11937

[WIP] oc create clusterrole: new command #11937

php-coder commented Nov 16, 2016 •

edited

Loading

php-coder commented Nov 16, 2016 •

edited

Loading

liggitt Nov 16, 2016

php-coder Nov 16, 2016

liggitt Nov 16, 2016

deads2k Nov 16, 2016

liggitt Nov 16, 2016

liggitt Nov 16, 2016

deads2k Nov 16, 2016

php-coder Nov 16, 2016

liggitt Nov 16, 2016

deads2k Nov 16, 2016

php-coder Nov 16, 2016

liggitt Nov 16, 2016

deads2k Nov 16, 2016

csrwng commented Nov 16, 2016

deads2k commented Nov 16, 2016

csrwng commented Nov 16, 2016

deads2k commented Nov 16, 2016

liggitt commented Nov 16, 2016

openshift-bot commented Mar 2, 2017

php-coder commented Mar 3, 2017

		Commands: []*cobra.Command{
		NewCmdCreateClusterRole(CreateClusterRoleRecommendedName, fullName+" "+CreateClusterRoleRecommendedName, f, out),

[WIP] oc create clusterrole: new command #11937

[WIP] oc create clusterrole: new command #11937

Conversation

php-coder commented Nov 16, 2016 • edited Loading

php-coder commented Nov 16, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

csrwng commented Nov 16, 2016

deads2k commented Nov 16, 2016

csrwng commented Nov 16, 2016

deads2k commented Nov 16, 2016

liggitt commented Nov 16, 2016

openshift-bot commented Mar 2, 2017

php-coder commented Mar 3, 2017

php-coder commented Nov 16, 2016 •

edited

Loading

php-coder commented Nov 16, 2016 •

edited

Loading