Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add role/clusterrole to describe.go #46326

Merged
merged 2 commits into from
Jun 2, 2017
Merged

add role/clusterrole to describe.go #46326

merged 2 commits into from
Jun 2, 2017

Conversation

xilabao
Copy link
Contributor

@xilabao xilabao commented May 24, 2017 •
edited

What this PR does / why we need it:

# ./cluster/kubectl.sh describe clusterrole system:kube-scheduler 
Name:		system:kube-scheduler
Labels:		kubernetes.io/bootstrapping=rbac-defaults
Annotations:	rbac.authorization.kubernetes.io/autoupdate=true
PolicyRule:
  Resources			Non-Resource URLs	Resource Names		Verbs
  ---------			-----------------	--------------		-----
  bindings			[]			[]			[create]
  endpoints			[]			[]			[create]
  endpoints			[]			[kube-scheduler]	[delete]
  endpoints			[]			[kube-scheduler]	[get]
  endpoints			[]			[kube-scheduler]	[patch]
  endpoints			[]			[kube-scheduler]	[update]
  events			[]			[]			[create patch update]
  nodes				[]			[]			[get list watch]
  persistentvolumeclaims	[]			[]			[get list watch]
  persistentvolumes		[]			[]			[get list watch]
  pods				[]			[]			[get list watch]
  pods/binding			[]			[]			[create]
  pods/status			[]			[]			[update]
  replicasets.extensions	[]			[]			[get list watch]
  replicationcontrollers	[]			[]			[get list watch]
  services			[]			[]			[get list watch]
  statefulsets.apps		[]			[]			[get list watch]

Which issue this PR fixes:

Special notes for your reviewer:

Release note:

NONE

@k8s-ci-robot
Copy link
Contributor

Hi @xilabao. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with @k8s-bot ok to test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@k8s-ci-robot k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels May 24, 2017
@k8s-github-robot k8s-github-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. release-note-none Denotes a PR that doesn't merit a release note. labels May 24, 2017
@eparis
Copy link
Contributor

eparis commented May 24, 2017

@k8s-bot ok to test
/release-note-none

@k8s-ci-robot k8s-ci-robot removed the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label May 24, 2017
@eparis
Copy link
Contributor

eparis commented May 24, 2017

/assign @liggitt
/assign @deads2k

@deads2k
Copy link
Contributor

deads2k commented May 24, 2017

I think we should present user readable names and categorize rules along resources. @liggitt got a link to the way we do it openshift so @xilabao can port it upstream?

@liggitt
Copy link
Member

liggitt commented May 24, 2017

  1. first we break down rules into simple rules (upstream version already in kubernetes at https://github.com/kubernetes/kubernetes/blob/master/pkg/registry/rbac/validation/policy_comparator.go#L58)

  2. then we compact those rules by combining rules differ only by verb: https://github.com/openshift/origin/blob/master/pkg/authorization/rulevalidation/compact_rules.go#L16

  3. then we print pretty versions of each of the resulting rules: https://github.com/openshift/origin/blob/master/pkg/authorization/api/helpers.go#L77

@xilabao xilabao force-pushed the add-role-to-describe-command branch from 2d81a39 to 5f57ea8 Compare May 25, 2017 06:45
@k8s-github-robot k8s-github-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels May 25, 2017
@xilabao xilabao force-pushed the add-role-to-describe-command branch from 5f57ea8 to 825424b Compare May 25, 2017 06:48
@xilabao
Copy link
Contributor Author

xilabao commented May 25, 2017

finished. @deads2k @liggitt PTAL

# ./cluster/kubectl.sh describe clusterrole view       
Name:		view
Labels:		kubernetes.io/bootstrapping=rbac-defaults
Annotations:	rbac.authorization.kubernetes.io/autoupdate=true
PolicyRule:
  Resources				Non-Resource URLs	Resource Names	API Groups	Verbs
  ---------				-----------------	--------------	----------	-----
  [bindings]				[]			[]		[]		[get list watch]
  [configmaps]				[]			[]		[]		[get list watch]
  [cronjobs]				[]			[]		[batch]		[get list watch]
  [daemonsets]				[]			[]		[extensions]	[get list watch]
  [deployments]				[]			[]		[apps]		[get list watch]
  [deployments]				[]			[]		[extensions]	[get list watch]
  [deployments/scale]			[]			[]		[apps]		[get list watch]
  [deployments/scale]			[]			[]		[extensions]	[get list watch]
  [endpoints]				[]			[]		[]		[get list watch]
  [events]				[]			[]		[]		[get list watch]
  [horizontalpodautoscalers]		[]			[]		[autoscaling]	[get list watch]
  [ingresses]				[]			[]		[extensions]	[get list watch]
  [jobs]				[]			[]		[batch]		[get list watch]
  [limitranges]				[]			[]		[]		[get list watch]
  [namespaces]				[]			[]		[]		[get list watch]
  [namespaces/status]			[]			[]		[]		[get list watch]
  [persistentvolumeclaims]		[]			[]		[]		[get list watch]
  [pods]				[]			[]		[]		[get list watch]
  [pods/log]				[]			[]		[]		[get list watch]
  [pods/status]				[]			[]		[]		[get list watch]
  [replicasets]				[]			[]		[extensions]	[get list watch]
  [replicasets/scale]			[]			[]		[extensions]	[get list watch]
  [replicationcontrollers]		[]			[]		[]		[get list watch]
  [replicationcontrollers/scale]	[]			[]		[]		[get list watch]
  [replicationcontrollers/scale]	[]			[]		[extensions]	[get list watch]
  [replicationcontrollers/status]	[]			[]		[]		[get list watch]
  [resourcequotas]			[]			[]		[]		[get list watch]
  [resourcequotas/status]		[]			[]		[]		[get list watch]
  [scheduledjobs]			[]			[]		[batch]		[get list watch]
  [serviceaccounts]			[]			[]		[]		[get list watch]
  [services]				[]			[]		[]		[get list watch]
  [statefulsets]			[]			[]		[apps]		[get list watch]

@xilabao xilabao force-pushed the add-role-to-describe-command branch 2 times, most recently from ada6769 to 9344379 Compare May 26, 2017 01:36
@xilabao
Copy link
Contributor Author

xilabao commented May 26, 2017

@k8s-bot pull-kubernetes-verify test this

@xilabao xilabao force-pushed the add-role-to-describe-command branch from 9344379 to a49e4f2 Compare May 26, 2017 05:29
@deads2k
Copy link
Contributor

deads2k commented May 31, 2017

I'd like to see the resource column include the kubectl-style resource.group, but this is strictly better than what we have now. A followup would be welcome.

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 31, 2017
@xilabao
Copy link
Contributor Author

xilabao commented Jun 1, 2017

@k8s-bot pull-kubernetes-unit test this
@k8s-bot pull-kubernetes-e2e-gce-etcd3 test this

@xilabao xilabao force-pushed the add-role-to-describe-command branch from a49e4f2 to bfd1842 Compare June 1, 2017 06:20
@k8s-github-robot k8s-github-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 1, 2017
@xilabao
Copy link
Contributor Author

xilabao commented Jun 1, 2017

change the resource column. @deads2k PTAL.
BTW, @smarterclayton could you approve the pr? thx.

# ./cluster/kubectl.sh describe clusterrole view   
Name:		view
Labels:		kubernetes.io/bootstrapping=rbac-defaults
Annotations:	rbac.authorization.kubernetes.io/autoupdate=true
PolicyRule:
  Resources					Non-Resource URLs	Resource Names	Verbs
  ---------					-----------------	--------------	-----
  bindings					[]			[]		[get list watch]
  configmaps					[]			[]		[get list watch]
  cronjobs.batch				[]			[]		[get list watch]
  daemonsets.extensions				[]			[]		[get list watch]
  deployments.apps				[]			[]		[get list watch]
  deployments.extensions			[]			[]		[get list watch]
  deployments.apps/scale			[]			[]		[get list watch]
  deployments.extensions/scale			[]			[]		[get list watch]
  endpoints					[]			[]		[get list watch]
  events					[]			[]		[get list watch]
  horizontalpodautoscalers.autoscaling		[]			[]		[get list watch]
  ingresses.extensions				[]			[]		[get list watch]
  jobs.batch					[]			[]		[get list watch]
  limitranges					[]			[]		[get list watch]
  namespaces					[]			[]		[get list watch]
  namespaces/status				[]			[]		[get list watch]
  persistentvolumeclaims			[]			[]		[get list watch]
  pods						[]			[]		[get list watch]
  pods/log					[]			[]		[get list watch]
  pods/status					[]			[]		[get list watch]
  replicasets.extensions			[]			[]		[get list watch]
  replicasets.extensions/scale			[]			[]		[get list watch]
  replicationcontrollers			[]			[]		[get list watch]
  replicationcontrollers/scale			[]			[]		[get list watch]
  replicationcontrollers.extensions/scale	[]			[]		[get list watch]
  replicationcontrollers/status			[]			[]		[get list watch]
  resourcequotas				[]			[]		[get list watch]
  resourcequotas/status				[]			[]		[get list watch]
  scheduledjobs.batch				[]			[]		[get list watch]
  serviceaccounts				[]			[]		[get list watch]
  services					[]			[]		[get list watch]
  statefulsets.apps				[]			[]		[get list watch]

@deads2k
Copy link
Contributor

deads2k commented Jun 1, 2017

/lgtm

change to helpers, not the api, approving.

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 1, 2017
@deads2k deads2k added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 1, 2017
@k8s-github-robot
Copy link

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: deads2k, xilabao
We suggest the following additional approver: smarterclayton

Assign the PR to them by writing /assign @smarterclayton in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

@deads2k deads2k added this to the v1.7 milestone Jun 1, 2017
@k8s-github-robot
Copy link

Automatic merge from submit-queue (batch tested with PRs 46432, 46701, 46326, 40848, 46396)

@k8s-github-robot k8s-github-robot merged commit f5bcd98 into kubernetes:master Jun 2, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@fabianofranz fabianofranz

@liggitt liggitt

@dshulyak dshulyak

@eparis eparis

@deads2k deads2k

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. release-note-none Denotes a PR that doesn't merit a release note. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Milestone
v1.7
Development

Successfully merging this pull request may close these issues.

None yet
8 participants
@xilabao @k8s-ci-robot @eparis @deads2k @liggitt @k8s-github-robot @fabianofranz @dshulyak