refactored controllers

pkg/authorization/defaultrolebindings/defaultrolebindings.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"time"
 
-	rbacv1 "k8s.io/api/rbac/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -33,8 +32,9 @@ type RoleBindingController struct {
 	namespaceLister   corelisters.NamespaceLister
 	namespaceSynced   cache.InformerSynced
 
-	syncHandler func(namespace string) error
-	queue       workqueue.RateLimitingInterface
+	syncHandler      func(namespace string) error
+	queue            workqueue.RateLimitingInterface
+	roleBindingsFunc projectRoleBindings
 }
 
 // NewRoleBinding creates a new controller
@@ -51,14 +51,17 @@ func NewRoleBindingsController(roleBindingInformer rbacinformers.RoleBindingInfo
 		queue: workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), controllerName),
 	}
 	c.syncHandler = c.syncNamespace
+	c.roleBindingsFunc = GetRoleBindingsForController(controllerName)
+
+	roleBindingNames := GetBootstrapServiceAccountProjectRoleBindingNames(c.roleBindingsFunc)
 
 	roleBindingInformer.Informer().AddEventHandler(cache.FilteringResourceEventHandler{
 		FilterFunc: func(obj interface{}) bool {
-			_, err := meta.Accessor(obj)
+			metadata, err := meta.Accessor(obj)
 			if err != nil {
 				return false
 			}
-			return len(GetBootstrapServiceAccountProjectRoleBindingNames(controllerName)) != 0
+			return roleBindingNames.Has(metadata.GetName())
 		},
 		Handler: cache.ResourceEventHandlerFuncs{
 			DeleteFunc: func(uncast interface{}) {
@@ -113,25 +116,22 @@ func (c *RoleBindingController) syncNamespace(namespaceName string) error {
 	}
 
 	errs := []error{}
-	var desiredRoleBinding rbacv1.RoleBinding
-	if c.name == "BuilderRoleBindingController" {
-		desiredRoleBinding = GetBuilderServiceAccountProjectRoleBindings(namespaceName)
-	} else if c.name == "DeployerRoleBindingController" {
-		desiredRoleBinding = GetDeployerServiceAccountProjectRoleBindings(namespaceName)
-	} else {
-		desiredRoleBinding = GetBootstrapServiceAccountProjectRoleBindings(namespaceName)
-	}
-
-	found := false
-	for _, existingRoleBinding := range roleBindings {
-		if existingRoleBinding.Name == desiredRoleBinding.Name {
-			found = true
-			break
+	desiredRoleBindings := c.roleBindingsFunc(namespaceName)
+
+	for i := range desiredRoleBindings {
+		desiredRoleBinding := desiredRoleBindings[i]
+		found := false
+		for _, existingRoleBinding := range roleBindings {
+			if existingRoleBinding.Name == desiredRoleBinding.Name {
+				found = true
+				break
+			}
+		}
+		if found {
+			continue
 		}
-	}
 
-	if !found {
-		_, err = c.roleBindingClient.RoleBindings(namespaceName).Create(context.TODO(), &desiredRoleBinding, metav1.CreateOptions{})
+		_, err := c.roleBindingClient.RoleBindings(namespaceName).Create(context.TODO(), &desiredRoleBinding, metav1.CreateOptions{})
 		if err != nil && !errors.IsAlreadyExists(err) {
 			errs = append(errs, err)
 		}

pkg/authorization/defaultrolebindings/project_policy.go

@@ -4,6 +4,7 @@ import (
 	"github.com/openshift/api/annotations"
 	rbacv1 "k8s.io/api/rbac/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/apiserver/pkg/authentication/serviceaccount"
 )
 
@@ -22,6 +23,9 @@ const (
 	DeployerServiceAccountName = "deployer"
 )
 
+type projectRoleBindings func(namespace string) []rbacv1.RoleBinding
+type serviceAccountRoleBinding func(namespace string) rbacv1.RoleBinding
+
 func GetBootstrapServiceAccountProjectRoleBindings(namespace string) rbacv1.RoleBinding {
 	imagePuller := newOriginRoleBindingForClusterRoleWithGroup(ImagePullerRoleBindingName, ImagePullerRoleName, namespace, serviceaccount.MakeNamespaceGroupName(namespace))
 	imagePuller.Annotations[openShiftDescription] = "Allows all pods in this namespace to pull images from this namespace.  It is auto-managed by a controller; remove subjects to disable."
@@ -43,16 +47,39 @@ func GetDeployerServiceAccountProjectRoleBindings(namespace string) rbacv1.RoleB
 	return deployer
 }
 
-func GetBootstrapServiceAccountProjectRoleBindingNames(controller string) string {
-	namespace := "default"
+func composeRoleBindings(roleBindings ...serviceAccountRoleBinding) projectRoleBindings {
+	return func(namespace string) []rbacv1.RoleBinding {
+		bindings := []rbacv1.RoleBinding{}
+		for _, rbfunc := range roleBindings {
+			bindings = append(bindings, rbfunc(namespace))
+		}
+		return bindings
+	}
+}
+
+func GetRoleBindingsForController(controller string) projectRoleBindings {
+	switch controller {
+	case "BuilderRoleBindingController":
+		return composeRoleBindings(GetBuilderServiceAccountProjectRoleBindings)
+	case "DeployerRoleBindingController":
+		return composeRoleBindings(GetDeployerServiceAccountProjectRoleBindings)
+	default:
+		return composeRoleBindings(GetBootstrapServiceAccountProjectRoleBindings,
+			GetBuilderServiceAccountProjectRoleBindings,
+			GetDeployerServiceAccountProjectRoleBindings,
+		)
+	}
+}
+
+func GetBootstrapServiceAccountProjectRoleBindingNames(roleBindings projectRoleBindings) sets.Set[string] {
+	names := sets.Set[string]{}
 
-	if controller == "BuilderRoleBindingController" {
-		return GetBuilderServiceAccountProjectRoleBindings(namespace).Name
-	} else if controller == "DeployerRoleBindingController" {
-		return GetDeployerServiceAccountProjectRoleBindings(namespace).Name
+	// Gets the roleBinding Names in the "default" namespace
+	for _, roleBinding := range roleBindings("default") {
+		names.Insert(roleBinding.Name)
 	}
 
-	return GetBootstrapServiceAccountProjectRoleBindings(namespace).Name
+	return names
 }
 
 func newOriginRoleBindingForClusterRoleWithGroup(bindingName, roleName, namespace, group string) rbacv1.RoleBinding {