Skip to content

Use cluster role aggregation for service catalog RBAC #18251

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Jan 25, 2018
Merged

Use cluster role aggregation for service catalog RBAC #18251

merged 1 commit into from
Jan 25, 2018

Conversation

jboyd01
Copy link

@jboyd01 jboyd01 commented Jan 23, 2018

@openshift-ci-robot openshift-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Jan 23, 2018
@enj
Copy link
Contributor

enj commented Jan 23, 2018

/hold

SC stuff does not go in bootstrap. @jboyd01 ping me on IRC, I will explain further.

@openshift-ci-robot openshift-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jan 23, 2018
enj
enj reviewed Jan 23, 2018
View reviewed changes
pkg/oc/bootstrap/docker/openshift/rbac.go Outdated
return []rbac.ClusterRole{
{
ObjectMeta: v1.ObjectMeta{
Name: bootstrappolicy.AdminRoleName,
Copy link
Contributor

@enj enj Jan 23, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR should be a 6 line change delta where you add the appropriate label to each cluster role and give each cluster role a unique name. For example:

{
	ObjectMeta: v1.ObjectMeta{
		Name: "system:openshift:service-catalog:aggregate-to-admin",
		Labels: map[string]string{"rbac.authorization.k8s.io/aggregate-to-admin": "true"},
	},
...
}

@jboyd01 jboyd01 changed the title move Service Catalog RBAC to use cluster role aggregation [WIP] move Service Catalog RBAC to use cluster role aggregation Jan 23, 2018
@openshift-ci-robot openshift-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 23, 2018
@jboyd01 jboyd01 force-pushed the catalog-cluster-role-aggrigation branch from fb568b6 to 0521c2d Compare January 23, 2018 21:16
@openshift-ci-robot openshift-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jan 23, 2018
enj
enj suggested changes Jan 23, 2018
View reviewed changes
pkg/oc/bootstrap/docker/openshift/servicecatalog.go
@@ -39,18 +38,7 @@ func (h *Helper) InstallServiceCatalog(f *clientcmd.Factory, configDir, publicMa
return err
}

for _, role := range GetServiceCatalogRBACDelta() {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jboyd01 leave this as-is (there should be no changes to this file other than the GetServiceCatalogRBACDelta to GetServiceCatalogClusterRoles name change).

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, finally got it. Tests look good.

@jboyd01 jboyd01 force-pushed the catalog-cluster-role-aggrigation branch from 0521c2d to 47f3286 Compare January 23, 2018 21:55
@openshift-ci-robot openshift-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jan 23, 2018
@jboyd01 jboyd01 changed the title [WIP] move Service Catalog RBAC to use cluster role aggregation move Service Catalog RBAC to use cluster role aggregation Jan 23, 2018
@openshift-ci-robot openshift-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 23, 2018
@enj enj changed the title move Service Catalog RBAC to use cluster role aggregation Use cluster role aggregation for service catalog RBAC Jan 24, 2018
enj
enj reviewed Jan 24, 2018
View reviewed changes
pkg/oc/bootstrap/docker/openshift/servicecatalog.go Outdated
return errors.NewError("could not reconcile service catalog cluster role %s", role.Name).WithCause(err)
}
for _, role := range GetServiceCatalogClusterRoles() {

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: unnecessary newline

@enj
Copy link
Contributor

enj commented Jan 24, 2018

/hold cancel

LGTM though you need to run go fmt.

@openshift-ci-robot openshift-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jan 24, 2018
@jboyd01 jboyd01 force-pushed the catalog-cluster-role-aggrigation branch from 47f3286 to ed68d3a Compare January 24, 2018 03:24
@openshift-ci-robot openshift-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jan 24, 2018
@jboyd01
Copy link
Author

jboyd01 commented Jan 24, 2018

applied go fmt

@pmorie
Copy link
Contributor

pmorie commented Jan 24, 2018

/test service-catalog

@jboyd01
Copy link
Author

jboyd01 commented Jan 24, 2018

/test gcp

@enj
Copy link
Contributor

enj commented Jan 24, 2018

/lgtm

@openshift-ci-robot openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Jan 24, 2018
@openshift-ci-robot
Copy link

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: enj, jboyd01

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

@openshift-ci-robot openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 24, 2018
@openshift-merge-robot
Copy link
Contributor

Automatic merge from submit-queue (batch tested with PRs 18191, 18264, 18235, 18251, 18271).

@openshift-merge-robot openshift-merge-robot merged commit b7649fe into openshift:master Jan 25, 2018
@pmorie
Copy link
Contributor

pmorie commented Jan 25, 2018

Thanks for the fix, @jboyd01

@enj enj mentioned this pull request Mar 14, 2018
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@gabemontero gabemontero Awaiting requested review from gabemontero

@liggitt liggitt Awaiting requested review from liggitt

1 more reviewer

@enj enj enj approved these changes

Reviewers whose approvals may not affect merge requirements
Assignees

@enj enj

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@jboyd01 @enj @pmorie @openshift-ci-robot @openshift-merge-robot