forked from openshift/origin
-
Notifications
You must be signed in to change notification settings - Fork 0
/
strategy.go
94 lines (76 loc) · 3.06 KB
/
strategy.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
package rolebinding
import (
"fmt"
"k8s.io/apimachinery/pkg/fields"
"k8s.io/apimachinery/pkg/labels"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/util/validation/field"
apirequest "k8s.io/apiserver/pkg/endpoints/request"
kstorage "k8s.io/apiserver/pkg/storage"
kapi "k8s.io/kubernetes/pkg/api"
authorizationapi "github.com/openshift/origin/pkg/authorization/apis/authorization"
"github.com/openshift/origin/pkg/authorization/apis/authorization/validation"
)
// strategy implements behavior for nodes
type strategy struct {
namespaced bool
runtime.ObjectTyper
}
var ClusterStrategy = strategy{false, kapi.Scheme}
var LocalStrategy = strategy{true, kapi.Scheme}
// NamespaceScoped is false for rolebindings.
func (s strategy) NamespaceScoped() bool {
return s.namespaced
}
// AllowCreateOnUpdate is false for rolebindings.
func (s strategy) AllowCreateOnUpdate() bool {
return false
}
func (strategy) AllowUnconditionalUpdate() bool {
return true
}
func (s strategy) GenerateName(base string) string {
return base
}
// PrepareForCreate clears fields that are not allowed to be set by end users on creation.
func (s strategy) PrepareForCreate(ctx apirequest.Context, obj runtime.Object) {
_ = obj.(*authorizationapi.RoleBinding)
}
// PrepareForUpdate clears fields that are not allowed to be set by end users on update.
func (s strategy) PrepareForUpdate(ctx apirequest.Context, obj, old runtime.Object) {
_ = obj.(*authorizationapi.RoleBinding)
}
// Canonicalize normalizes the object after validation.
func (strategy) Canonicalize(obj runtime.Object) {
}
// Validate validates a new role.
func (s strategy) Validate(ctx apirequest.Context, obj runtime.Object) field.ErrorList {
return validation.ValidateRoleBinding(obj.(*authorizationapi.RoleBinding), s.namespaced)
}
// ValidateUpdate is the default update validation for an end user.
func (s strategy) ValidateUpdate(ctx apirequest.Context, obj, old runtime.Object) field.ErrorList {
return validation.ValidateRoleBindingUpdate(obj.(*authorizationapi.RoleBinding), old.(*authorizationapi.RoleBinding), s.namespaced)
}
func GetAttrs(obj runtime.Object) (labels.Set, fields.Set, bool, error) {
roleBinding, ok := obj.(*authorizationapi.RoleBinding)
if !ok {
return nil, nil, false, fmt.Errorf("not a rolebinding")
}
return labels.Set(roleBinding.ObjectMeta.Labels), RoleBindingToSelectableFields(roleBinding), roleBinding.Initializers != nil, nil
}
// Matcher returns a generic matcher for a given label and field selector.
func Matcher(label labels.Selector, field fields.Selector) kstorage.SelectionPredicate {
return kstorage.SelectionPredicate{
Label: label,
Field: field,
GetAttrs: GetAttrs,
}
}
// RoleBindingToSelectableFields returns a label set that represents the object
// changes to the returned keys require registering conversions for existing versions using Scheme.AddFieldLabelConversionFunc
func RoleBindingToSelectableFields(roleBinding *authorizationapi.RoleBinding) fields.Set {
return fields.Set{
"metadata.name": roleBinding.Name,
"metadata.namespace": roleBinding.Namespace,
}
}