forked from openshift/origin
-
Notifications
You must be signed in to change notification settings - Fork 0
/
remove_group.go
83 lines (67 loc) · 1.88 KB
/
remove_group.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
package policy
import (
"fmt"
"github.com/golang/glog"
"github.com/spf13/cobra"
"github.com/openshift/origin/pkg/client"
"github.com/openshift/origin/pkg/cmd/util/clientcmd"
)
type removeGroupOptions struct {
roleNamespace string
roleName string
bindingNamespace string
client client.Interface
groups []string
}
func NewCmdRemoveGroup(f *clientcmd.Factory) *cobra.Command {
options := &removeGroupOptions{}
cmd := &cobra.Command{
Use: "remove-group <role> <group> [group]...",
Short: "remove group from role",
Long: `remove group from role`,
Run: func(cmd *cobra.Command, args []string) {
if !options.complete(cmd) {
return
}
var err error
if options.client, _, err = f.Clients(cmd); err != nil {
glog.Fatalf("Error getting client: %v", err)
}
if options.bindingNamespace, err = f.DefaultNamespace(cmd); err != nil {
glog.Fatalf("Error getting client: %v", err)
}
if err := options.run(); err != nil {
glog.Fatal(err)
}
},
}
cmd.Flags().StringVar(&options.roleNamespace, "role-namespace", "master", "namespace where the role is located.")
return cmd
}
func (o *removeGroupOptions) complete(cmd *cobra.Command) bool {
args := cmd.Flags().Args()
if len(args) < 2 {
cmd.Help()
return false
}
o.roleName = args[0]
o.groups = args[1:]
return true
}
func (o *removeGroupOptions) run() error {
roleBindings, err := getExistingRoleBindingsForRole(o.roleNamespace, o.roleName, o.client.PolicyBindings(o.bindingNamespace))
if err != nil {
return err
}
if len(roleBindings) == 0 {
return fmt.Errorf("unable to locate RoleBinding for %v::%v in %v", o.roleNamespace, o.roleName, o.bindingNamespace)
}
for _, roleBinding := range roleBindings {
roleBinding.Groups.Delete(o.groups...)
_, err = o.client.RoleBindings(o.bindingNamespace).Update(roleBinding)
if err != nil {
return err
}
}
return nil
}