-
Notifications
You must be signed in to change notification settings - Fork 0
/
group.go
76 lines (65 loc) · 2.2 KB
/
group.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
package reaper
import (
"time"
"github.com/golang/glog"
kapi "k8s.io/kubernetes/pkg/api"
kerrors "k8s.io/kubernetes/pkg/api/errors"
kclient "k8s.io/kubernetes/pkg/client/unversioned"
"k8s.io/kubernetes/pkg/kubectl"
"github.com/openshift/origin/pkg/client"
)
func NewGroupReaper(
groupClient client.GroupsInterface,
clusterBindingClient client.ClusterRoleBindingsInterface,
bindingClient client.RoleBindingsNamespacer,
sccClient kclient.SecurityContextConstraintsInterface,
) kubectl.Reaper {
return &GroupReaper{
groupClient: groupClient,
clusterBindingClient: clusterBindingClient,
bindingClient: bindingClient,
sccClient: sccClient,
}
}
type GroupReaper struct {
groupClient client.GroupsInterface
clusterBindingClient client.ClusterRoleBindingsInterface
bindingClient client.RoleBindingsNamespacer
sccClient kclient.SecurityContextConstraintsInterface
}
// Stop on a reaper is actually used for deletion. In this case, we'll delete referencing identities, clusterBindings, and bindings,
// then delete the group
func (r *GroupReaper) Stop(namespace, name string, timeout time.Duration, gracePeriod *kapi.DeleteOptions) error {
removedSubject := kapi.ObjectReference{Kind: "Group", Name: name}
if err := reapClusterBindings(removedSubject, r.clusterBindingClient); err != nil {
return err
}
if err := reapNamespacedBindings(removedSubject, r.bindingClient); err != nil {
return err
}
// Remove the group from sccs
sccs, err := r.sccClient.SecurityContextConstraints().List(kapi.ListOptions{})
if err != nil {
return err
}
for _, scc := range sccs.Items {
retainedGroups := []string{}
for _, group := range scc.Groups {
if group != name {
retainedGroups = append(retainedGroups, group)
}
}
if len(retainedGroups) != len(scc.Groups) {
updatedSCC := scc
updatedSCC.Groups = retainedGroups
if _, err := r.sccClient.SecurityContextConstraints().Update(&updatedSCC); err != nil && !kerrors.IsNotFound(err) {
glog.Infof("Cannot update scc/%s: %v", scc.Name, err)
}
}
}
// Remove the group
if err := r.groupClient.Groups().Delete(name); err != nil && !kerrors.IsNotFound(err) {
return err
}
return nil
}