Added `kubectl create clusterrole` command. #41538

xingzhou · 2017-02-16T07:23:44Z

Added kubectl create clusterrole command.

Fixed part of #39596

Special notes for your reviewer:
@deads2k, please help to review this patch, thanks

Release note:

   Added one new command `kubectl create clusterrole` to help user create a single ClusterRole from command line.

k8s-ci-robot · 2017-02-16T07:23:45Z

Hi @xingzhou. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with @k8s-bot ok to test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

k8s-reviewable · 2017-02-16T07:23:50Z

This change is

deads2k · 2017-02-16T14:22:22Z

pkg/kubectl/cmd/create_clusterrole.go

+
+	// Remove duplicate verbs.
+	verbs := []string{}
+	for _, v := range c.Verbs {


Can you factor out some of this duplicate logic from the two commands?

deads2k · 2017-02-16T14:23:02Z

pkg/kubectl/cmd/create_clusterrole.go

+
+	clusterRole := &rbac.ClusterRole{}
+
+	// Create separate rule for each of the api group.


Creating the resource policy rules should be common code between create role and create cluster role.

deads2k · 2017-02-16T14:23:35Z

pkg/kubectl/cmd/create_clusterrole.go

+	}
+
+	// Split verbs to resource verbs and non-resource verbs
+	resourceVerbs, nonResourceVerbs := []string{}, []string{}


you aren't going to be able to distinguish

deads2k · 2017-02-16T14:25:18Z

pkg/kubectl/cmd/create_clusterrole.go

+	cmd.Flags().StringSliceVar(&c.Verbs, "verb", []string{}, "verb that applies to the resources contained in the rule")
+	cmd.Flags().StringSlice("resource", []string{}, "resource that the rule applies to")
+	cmd.Flags().StringSliceVar(&c.ResourceNames, "resource-name", []string{}, "resource in the white list that the rule applies to")
+	cmd.Flags().StringSliceVar(&c.NonResourceURLs, "non-resource-url", []string{}, "non-resource URL is a partial URL that a user should have access to")


Thinking about this, I suspect we actually want to defer this option until later. We may even say its only on the set command. The vast majority of usage is interested in resource access.

deads2k · 2017-02-16T14:25:58Z

I think narrowing the scope and DRYing it out a little bit will make this work out nicely.

bgrant0607 · 2017-02-16T18:46:56Z

cc @kubernetes/sig-cli-pr-reviews

xingzhou · 2017-02-17T04:47:30Z

David, I understand that we want to keep kubectl create series command simple, but seems nonresourceurl is the only different options to role options that I can see. Do we plan to add it some day in the future or we just rely on set command to modify the existing cluster roles? Since if we remove nonresourceurl, in terms of options, there won't be much difference between cluster role and role, and most of the complete/validate/run code can be extract to a common place.

deads2k · 2017-02-17T13:17:24Z

Do we plan to add it some day in the future or we just rely on set command to modify the existing cluster roles?

Yes, I think we will want to add it, but we need to consider how it interacts with things like verbs. I think from a structure perspective, you could build the resource rules in a common fashion and then later add the non-resource rules, so we aren't boxed into a corner either way.

adohe-zz · 2017-02-17T15:37:31Z

pkg/kubectl/cmd/create_clusterrole.go

+}
+
+func (c *CreateClusterRoleOptions) RunCreateClusterRole(f cmdutil.Factory, cmdOut io.Writer, cmd *cobra.Command, args []string) error {
+	mapper, _ := f.Object()


actually I would not expect to depends on cobra on the run logical.

@adohe, any code patterns need to follow here? extract the arguments from cmd object and pass them in as parameters? wonder any examples in current commands

@adohe, any code patterns need to follow here? extract the arguments from cmd object and pass them in as parameters? wonder any examples in current commands

I missed this. Yeah, Complete should gather this and set it in the options.

xingzhou · 2017-02-20T08:59:28Z

Have removed non-resource-url option now. Keep CreateClusterRole struct in case we insert non-resource-url in the future, PTAL. thx

deads2k · 2017-02-20T16:08:11Z

/approve

deads2k · 2017-02-20T16:12:30Z

pkg/kubectl/cmd/create_clusterrole.go

+	return cmd
+}
+
+func (c *CreateClusterRoleOptions) RunCreateRole(f cmdutil.Factory, cmdOut io.Writer, cmd *cobra.Command, args []string) error {


As @adohe pointed out. Don't pass arguments here. Instead, use Complete to gather the bits you need and store the on your options.

Added `kubectl create clusterrole` command.

xingzhou · 2017-02-22T03:11:46Z

Have tried to move all the parameters from Run method to CreateRoleOptions, please take a look ,thanks.

deads2k · 2017-02-22T12:46:54Z

pkg/kubectl/cmd/create_role.go

@@ -50,20 +53,30 @@ type CreateRoleOptions struct {
 	Verbs         []string
 	Resources     []schema.GroupVersionResource
 	ResourceNames []string
+
+	DryRun       bool
+	OutputFormat string


At some point, I think we'll need to start wrapping this logic inside of the PrintObject function. You don't need to mess with it here.

I agree, those are just common command options, not specific to this one. Do we have plan now, please let me know if I can help, thanks!

deads2k · 2017-02-22T12:48:11Z

/lgtm
/approve

k8s-github-robot · 2017-02-22T12:48:25Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

The following people have approved this PR: deads2k, xingzhou

Needs approval from an approver in each of these OWNERS Files:

docs/OWNERS
~~hack/OWNERS~~ [deads2k]
~~pkg/kubectl/OWNERS~~ [deads2k]

We suggest the following people:
cc @pwittrock @eparis
You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

deads2k · 2017-02-22T13:43:54Z

@k8s-bot unit test this: issue #41885

deads2k · 2017-02-22T14:06:24Z

@k8s-bot gci gce e2e test this

deads2k · 2017-02-22T14:18:02Z

@k8s-bot non-cri e2e test this: issue #41889

k8s-github-robot · 2017-02-23T05:09:36Z

Automatic merge from submit-queue (batch tested with PRs 41146, 41486, 41482, 41538, 41784)

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Feb 16, 2017

k8s-github-robot assigned smarterclayton Feb 16, 2017

k8s-github-robot added kind/old-docs size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. release-note Denotes a PR that will be considered when it comes time to generate release notes. labels Feb 16, 2017

deads2k reviewed Feb 16, 2017

View reviewed changes

bgrant0607 assigned deads2k and unassigned smarterclayton Feb 16, 2017

adohe-zz reviewed Feb 17, 2017

View reviewed changes

k8s-github-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 20, 2017

xingzhou force-pushed the clusterrole branch from 50122a5 to adb298b Compare February 20, 2017 08:56

k8s-github-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Feb 20, 2017

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 20, 2017

deads2k removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 20, 2017

deads2k reviewed Feb 20, 2017

View reviewed changes

Added kubectl create clusterrole command.

433941f

Added `kubectl create clusterrole` command.

xingzhou force-pushed the clusterrole branch from adb298b to 433941f Compare February 22, 2017 03:09

deads2k reviewed Feb 22, 2017

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 22, 2017

deads2k added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 22, 2017

k8s-github-robot merged commit c99ae4b into kubernetes:master Feb 23, 2017

php-coder mentioned this pull request Mar 3, 2017

[WIP] oc create clusterrole: new command openshift/origin#11937

Closed

7 tasks

php-coder mentioned this pull request May 5, 2017

Auth CLI: Make it easier to create a role for a set of resources and actions openshift/origin#3804

Closed

mattnworb mentioned this pull request Feb 1, 2018

Support "kubectl create role" sub-command #39596

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added `kubectl create clusterrole` command. #41538

Added `kubectl create clusterrole` command. #41538

xingzhou commented Feb 16, 2017

k8s-ci-robot commented Feb 16, 2017

k8s-reviewable commented Feb 16, 2017

deads2k Feb 16, 2017

deads2k Feb 16, 2017

deads2k Feb 16, 2017

deads2k Feb 16, 2017

deads2k commented Feb 16, 2017

bgrant0607 commented Feb 16, 2017

xingzhou commented Feb 17, 2017

deads2k commented Feb 17, 2017

adohe-zz Feb 17, 2017

xingzhou Feb 20, 2017

deads2k Feb 20, 2017

xingzhou commented Feb 20, 2017

deads2k commented Feb 20, 2017 •

edited

Loading

deads2k Feb 20, 2017

xingzhou commented Feb 22, 2017

deads2k Feb 22, 2017

xingzhou Feb 23, 2017

deads2k commented Feb 22, 2017

k8s-github-robot commented Feb 22, 2017

deads2k commented Feb 22, 2017

deads2k commented Feb 22, 2017

deads2k commented Feb 22, 2017

k8s-github-robot commented Feb 23, 2017


		clusterRole := &rbac.ClusterRole{}

		// Create separate rule for each of the api group.

Added kubectl create clusterrole command. #41538

Added kubectl create clusterrole command. #41538

Conversation

xingzhou commented Feb 16, 2017

k8s-ci-robot commented Feb 16, 2017

k8s-reviewable commented Feb 16, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

deads2k commented Feb 16, 2017

bgrant0607 commented Feb 16, 2017

xingzhou commented Feb 17, 2017

deads2k commented Feb 17, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

xingzhou commented Feb 20, 2017

deads2k commented Feb 20, 2017 • edited Loading

Choose a reason for hiding this comment

xingzhou commented Feb 22, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

deads2k commented Feb 22, 2017

k8s-github-robot commented Feb 22, 2017

deads2k commented Feb 22, 2017

deads2k commented Feb 22, 2017

deads2k commented Feb 22, 2017

k8s-github-robot commented Feb 23, 2017

Added `kubectl create clusterrole` command. #41538

Added `kubectl create clusterrole` command. #41538

deads2k commented Feb 20, 2017 •

edited

Loading