add oc create policybinding

[deads2k]

Adds

Usage:
  oc create policybinding TARGET_POLICY_NAMESPACE [options]

Examples:
  # Create a policy binding in namespace "foo" that references the policy in namespace "bar"
  $ oc create policybinding bar -n foo

This will allow a cluster-admin to easily create a policybinding object to allow a project admin to bind roles that are not clusterroles.

@pweil- @miheer @nhr Each of you asked about this in the past 24 hours. This makes it easier to follow the directions here https://docs.openshift.com/enterprise/3.1/architecture/additional_concepts/authorization.html#roles that describe the policybinding interplay, "If you find that these roles do not suit you, a cluster-admin user can create a policyBinding object named <projectname>:default with the CLI using a JSON file. This allows the project admin to bind users to roles that are defined only in the <projectname> local policy."

[deads2k]

For those not wanting to run with --loglevel=8, the json looks like:

{  
    "kind":"PolicyBinding",
    "apiVersion":"v1",
    "metadata":{  
        "name":"foo:default",
        "creationTimestamp":null
    },
    "lastModified":null,
    "policyRef":{  
        "namespace":"foo",
        "name":"default"
    },
    "roleBindings":[  

    ]
}

[deads2k]

[test]

[deads2k]

@pweil- @miheer do you think this is worth having?

[pweil-]

yes, I think it would help bypass some of the confusion of creating a binding with pure json and trying to figure out the naming quirks.

[deads2k]

@stevekuznetsov ptal.

[stevekuznetsov]

I see this is idiomatic to Kubernetes, but man does it take a while to parse.

[deads2k]

@stevekuznetsov anything else?

[stevekuznetsov]

@deads2k, no, looks pretty straightforward. Seems like a lot of boilerplate, but I'm not sure we want to invent something to do a generic oc create

[soltysh]

We should follow k8s guidelines in all oc commands, especially the new ones, so please Complete, Validate and Run :)

[deads2k]

We should follow k8s guidelines in all oc commands, especially the new ones, so please Complete, Validate and Run :)

I should've known that pattern would bite me some day.

[soltysh]

We all ❤️ patterns

[deads2k]

We should follow k8s guidelines in all oc commands, especially the new ones, so please Complete, Validate and Run :)

Done.

[deads2k]

marking based on @stevekuznetsov's ok.

[soltysh]

That's still not quite what should be here: Complete, Validate are ok, but the 3rd is Run. 😍

[stevekuznetsov]

For what it's worth, I almost like the non-Run function names, at least Run<thing> as when they're all named Run and I want to tell where it's called, I have no way of doing that (go-oracle nonwithstanding). At least with Run<thing> it's grep-able

[soltysh]

@stevekuznetsov Run<thing> is the suggested approach in the guidelines ;)

[stevekuznetsov]

@soltysh ah. lol.

I'm amazed they do:

      if err := opts.Complete(f, cmd, args, out); err != nil {
        cmdutil.CheckErr(err)
      }

since cmdutil.CheckErr handles the nil case itself.

[soltysh]

@stevekuznetsov yeah, they have still a lot learn from us 😉

[soltysh]

@deads2k thank you!

[deads2k]

@soltysh I like the pattern. First instance of it in the kube or origin repo in a 2014 commit: https://github.com/kubernetes/kubernetes/pull/3275/files#diff-ac0b208737cc45e7d98468252e3097d5R103 . (note the author) :)

I have come around to unique names.

[stevekuznetsov]

@deads2k did we ever come to some consensus on "foo-bar" naming in examples? The rest of the oc create stubs use my-<thing>:

  oc create secret generic my-secret
  oc create namespace my-namespace
  oc create serviceaccount my-service-account

[deads2k]

@deads2k did we ever come to some consensus on "foo-bar" naming in examples? The rest of the oc create stubs use my-:

this one is special. You aren't allow to choose a name of a policybinding.

[stevekuznetsov]

@deads2k right, but you can chose the name of a namespace, as in your example:

  # Create a policy binding in namespace "foo" that references the policy in namespace "bar"
  $ oc create policybinding bar -n foo

Could be more read-able with something like:

  # Create a policy binding in namespace "my-namespace" that references the policy in namespace "donor-namespace"
  $ oc create policybinding donor-namespace -n my-namespace

[deads2k]

re[test]

[stevekuznetsov]

re[test]

[deads2k]

[merge]

[openshift-bot]

continuous-integration/openshift-jenkins/merge SUCCESS (https://ci.openshift.redhat.com/jenkins/job/test_pr_origin/3306/) (Image: devenv-rhel7_4047)

[openshift-bot]

Evaluated for origin merge up to 222bff8

[smarterclayton]

[test]

[openshift-bot]

Evaluated for origin test up to 222bff8

[openshift-bot]

continuous-integration/openshift-jenkins/test SUCCESS (https://ci.openshift.redhat.com/jenkins/job/test_pr_origin/3306/)