This repository has been archived by the owner on Jul 18, 2019. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 2
/
resourceaccessreview.go
61 lines (48 loc) · 2.22 KB
/
resourceaccessreview.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
package client
import (
kapierrors "k8s.io/kubernetes/pkg/api/errors"
authorizationapi "github.com/openshift/origin/pkg/authorization/api"
)
// ResourceAccessReviews has methods to work with ResourceAccessReview resources in the cluster scope
type ResourceAccessReviews interface {
ResourceAccessReviews() ResourceAccessReviewInterface
}
// ResourceAccessReviewInterface exposes methods on ResourceAccessReview resources.
type ResourceAccessReviewInterface interface {
Create(policy *authorizationapi.ResourceAccessReview) (*authorizationapi.ResourceAccessReviewResponse, error)
}
// resourceAccessReviews implements ResourceAccessReviews interface
type resourceAccessReviews struct {
r *Client
}
// newResourceAccessReviews returns a resourceAccessReviews
func newResourceAccessReviews(c *Client) *resourceAccessReviews {
return &resourceAccessReviews{
r: c,
}
}
func (c *resourceAccessReviews) Create(rar *authorizationapi.ResourceAccessReview) (result *authorizationapi.ResourceAccessReviewResponse, err error) {
result = &authorizationapi.ResourceAccessReviewResponse{}
// if this a cluster RAR, then no special handling
if len(rar.Action.Namespace) == 0 {
err = c.r.Post().Resource("resourceAccessReviews").Body(rar).Do().Into(result)
return
}
err = c.r.Post().Resource("resourceAccessReviews").Body(rar).Do().Into(result)
// if the namespace values don't match then we definitely hit an old server. If we got a forbidden, then we might have hit an old server
// and should try the old endpoint
if (rar.Action.Namespace != result.Namespace) || kapierrors.IsForbidden(err) {
deprecatedResponse := &authorizationapi.ResourceAccessReviewResponse{}
deprecatedAttemptErr := c.r.Post().Namespace(rar.Action.Namespace).Resource("resourceAccessReviews").Body(rar).Do().Into(deprecatedResponse)
// if we definitely hit an old server, then return the error and result you get from the older server.
if rar.Action.Namespace != result.Namespace {
return deprecatedResponse, deprecatedAttemptErr
}
// if we're not certain it was an old server, success overwrites the previous error, but failure doesn't overwrite the previous error
if deprecatedAttemptErr == nil {
err = nil
result = deprecatedResponse
}
}
return
}