-
Notifications
You must be signed in to change notification settings - Fork 0
/
strategy.go
113 lines (92 loc) · 4 KB
/
strategy.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
package policybinding
import (
"fmt"
kapi "k8s.io/kubernetes/pkg/api"
"k8s.io/kubernetes/pkg/api/unversioned"
"k8s.io/kubernetes/pkg/fields"
"k8s.io/kubernetes/pkg/labels"
"k8s.io/kubernetes/pkg/registry/generic"
"k8s.io/kubernetes/pkg/runtime"
"k8s.io/kubernetes/pkg/util/fielderrors"
authorizationapi "github.com/openshift/origin/pkg/authorization/api"
"github.com/openshift/origin/pkg/authorization/api/validation"
)
// strategy implements behavior for nodes
type strategy struct {
runtime.ObjectTyper
}
var Strategy = strategy{kapi.Scheme}
// NamespaceScoped is true for policybindings.
func (strategy) NamespaceScoped() bool {
return true
}
// AllowCreateOnUpdate is false for policybindings.
func (strategy) AllowCreateOnUpdate() bool {
return false
}
func (strategy) AllowUnconditionalUpdate() bool {
return false
}
func (strategy) GenerateName(base string) string {
return base
}
// PrepareForCreate clears fields that are not allowed to be set by end users on creation.
func (s strategy) PrepareForCreate(obj runtime.Object) {
binding := obj.(*authorizationapi.PolicyBinding)
s.scrubBindingRefs(binding)
// force a delimited name, just in case we someday allow a reference to a global object that won't have a namespace. We'll end up with a name like ":default".
// ":" is not in the value space of namespaces, so no escaping is necessary
binding.Name = authorizationapi.GetPolicyBindingName(binding.PolicyRef.Namespace)
}
// scrubBindingRefs discards pieces of the object references that we don't respect to avoid confusion.
func (s strategy) scrubBindingRefs(binding *authorizationapi.PolicyBinding) {
binding.PolicyRef = kapi.ObjectReference{Namespace: binding.PolicyRef.Namespace, Name: authorizationapi.PolicyName}
for roleBindingKey, roleBinding := range binding.RoleBindings {
roleBinding.RoleRef = kapi.ObjectReference{Namespace: binding.PolicyRef.Namespace, Name: roleBinding.RoleRef.Name}
binding.RoleBindings[roleBindingKey] = roleBinding
}
}
// PrepareForUpdate clears fields that are not allowed to be set by end users on update.
func (s strategy) PrepareForUpdate(obj, old runtime.Object) {
binding := obj.(*authorizationapi.PolicyBinding)
s.scrubBindingRefs(binding)
}
// Validate validates a new policyBinding.
func (strategy) Validate(ctx kapi.Context, obj runtime.Object) fielderrors.ValidationErrorList {
return validation.ValidateLocalPolicyBinding(obj.(*authorizationapi.PolicyBinding))
}
// ValidateUpdate is the default update validation for an end user.
func (strategy) ValidateUpdate(ctx kapi.Context, obj, old runtime.Object) fielderrors.ValidationErrorList {
return validation.ValidateLocalPolicyBindingUpdate(obj.(*authorizationapi.PolicyBinding), old.(*authorizationapi.PolicyBinding))
}
// Matcher returns a generic matcher for a given label and field selector.
func Matcher(label labels.Selector, field fields.Selector) generic.Matcher {
return &generic.SelectionPredicate{
Label: label,
Field: field,
GetAttrs: func(obj runtime.Object) (labels.Set, fields.Set, error) {
policyBinding, ok := obj.(*authorizationapi.PolicyBinding)
if !ok {
return nil, nil, fmt.Errorf("not a policyBinding")
}
return labels.Set(policyBinding.ObjectMeta.Labels), SelectableFields(policyBinding), nil
},
}
}
// SelectableFields returns a label set that represents the object
func SelectableFields(policyBinding *authorizationapi.PolicyBinding) fields.Set {
return fields.Set{
"name": policyBinding.Name,
"policyRef.namespace": policyBinding.PolicyRef.Namespace,
}
}
func NewEmptyPolicyBinding(namespace, policyNamespace, policyBindingName string) *authorizationapi.PolicyBinding {
binding := &authorizationapi.PolicyBinding{}
binding.Name = policyBindingName
binding.Namespace = namespace
binding.CreationTimestamp = unversioned.Now()
binding.LastModified = unversioned.Now()
binding.PolicyRef = kapi.ObjectReference{Name: authorizationapi.PolicyName, Namespace: policyNamespace}
binding.RoleBindings = make(map[string]*authorizationapi.RoleBinding)
return binding
}