Skip to content

Commit 8d90764

Browse files
estrozestroz
committed
pkg/scaffold/role.go: moved UpdateRoleForResource here
commands/.../add/*,new.go: update to 'internal/util' imports
1 parent df4aa3b commit 8d90764

File tree

6 files changed

+118
-120
lines changed

6 files changed

+118
-120
lines changed

‎commands/operator-sdk/cmd/add/api.go‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@ import (
1818
"log"
1919

2020
"github.com/operator-framework/operator-sdk/commands/operator-sdk/cmd/generate"
21-
"github.com/operator-framework/operator-sdk/internal/util/fileutil"
2221
"github.com/operator-framework/operator-sdk/internal/util/projutil"
2322
"github.com/operator-framework/operator-sdk/pkg/scaffold"
2423
"github.com/operator-framework/operator-sdk/pkg/scaffold/input"
@@ -92,7 +91,7 @@ func apiRun(cmd *cobra.Command, args []string) {
9291
}
9392

9493
// update deploy/role.yaml for the given resource r.
95-
if err := cmdutil.UpdateRoleForResource(r, absProjectPath); err != nil {
94+
if err := scaffold.UpdateRoleForResource(r, absProjectPath); err != nil {
9695
log.Fatalf("failed to update the RBAC manifest for the resource (%v, %v): %v", r.APIVersion, r.Kind, err)
9796
}
9897

‎commands/operator-sdk/cmd/add/crd.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ func crdFunc(cmd *cobra.Command, args []string) {
7878
}
7979

8080
// update deploy/role.yaml for the given resource r.
81-
if err := cmdutil.UpdateRoleForResource(resource, cfg.AbsProjectPath); err != nil {
81+
if err := scaffold.UpdateRoleForResource(resource, cfg.AbsProjectPath); err != nil {
8282
log.Fatalf("failed to update the RBAC manifest for the resource (%v, %v): %v", resource.APIVersion, resource.Kind, err)
8383
}
8484
}

‎commands/operator-sdk/cmd/build.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -146,7 +146,7 @@ func buildFunc(cmd *cobra.Command, args []string) {
146146

147147
// Don't need to buld go code if Ansible Operator
148148
if mainExists() {
149-
managerDir := filepath.Join(cmdutil.CheckAndGetCurrPkg(), scaffold.ManagerDir)
149+
managerDir := filepath.Join(projutil.CheckAndGetCurrPkg(), scaffold.ManagerDir)
150150
outputBinName := filepath.Join(wd, scaffold.BuildBinDir, filepath.Base(wd))
151151
buildCmd := exec.Command("go", "build", "-o", outputBinName, managerDir)
152152
buildCmd.Env = goBuildEnv

‎commands/operator-sdk/cmd/new.go‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@ import (
2323
"path/filepath"
2424
"strings"
2525

26-
"github.com/operator-framework/operator-sdk/internal/util/fileutil"
2726
"github.com/operator-framework/operator-sdk/internal/util/projutil"
2827
"github.com/operator-framework/operator-sdk/pkg/scaffold"
2928
"github.com/operator-framework/operator-sdk/pkg/scaffold/ansible"
@@ -217,7 +216,7 @@ func doAnsibleScaffold() {
217216
}
218217

219218
// update deploy/role.yaml for the given resource r.
220-
if err := cmdutil.UpdateRoleForResource(resource, cfg.AbsProjectPath); err != nil {
219+
if err := scaffold.UpdateRoleForResource(resource, cfg.AbsProjectPath); err != nil {
221220
log.Fatalf("failed to update the RBAC manifest for the resource (%v, %v): %v", resource.APIVersion, resource.Kind, err)
222221
}
223222
}

‎internal/util/projutil/project_util.go‎

Lines changed: 0 additions & 114 deletions
Original file line numberDiff line numberDiff line change
@@ -15,20 +15,10 @@
1515
package projutil
1616

1717
import (
18-
"encoding/json"
19-
"errors"
20-
"fmt"
21-
"io/ioutil"
2218
"log"
2319
"os"
2420
"path/filepath"
2521
"strings"
26-
27-
"github.com/operator-framework/operator-sdk/pkg/scaffold"
28-
29-
yaml "gopkg.in/yaml.v2"
30-
rbacv1 "k8s.io/api/rbac/v1"
31-
cgoscheme "k8s.io/client-go/kubernetes/scheme"
3222
)
3323

3424
const (
@@ -99,107 +89,3 @@ func GetOperatorType() OperatorType {
9989
}
10090
return OperatorTypeGo
10191
}
102-
103-
func UpdateRoleForResource(r *scaffold.Resource, absProjectPath string) error {
104-
// append rbac rule to deploy/role.yaml
105-
roleFilePath := filepath.Join(absProjectPath, "deploy", "role.yaml")
106-
roleYAML, err := ioutil.ReadFile(roleFilePath)
107-
if err != nil {
108-
return fmt.Errorf("failed to read role manifest %v: %v", roleFilePath, err)
109-
}
110-
obj, _, err := cgoscheme.Codecs.UniversalDeserializer().Decode(roleYAML, nil, nil)
111-
if err != nil {
112-
return fmt.Errorf("failed to decode role manifest %v: %v", roleFilePath, err)
113-
}
114-
switch role := obj.(type) {
115-
// TODO: use rbac/v1.
116-
case *rbacv1.Role:
117-
pr := &rbacv1.PolicyRule{}
118-
apiGroupFound := false
119-
for i := range role.Rules {
120-
if role.Rules[i].APIGroups[0] == r.FullGroup {
121-
apiGroupFound = true
122-
pr = &role.Rules[i]
123-
break
124-
}
125-
}
126-
// check if the resource already exists
127-
for _, resource := range pr.Resources {
128-
if resource == r.Resource {
129-
log.Printf("deploy/role.yaml RBAC rules already up to date for the resource (%v, %v)", r.APIVersion, r.Kind)
130-
return nil
131-
}
132-
}
133-
134-
pr.Resources = append(pr.Resources, r.Resource)
135-
// create a new apiGroup if not found.
136-
if !apiGroupFound {
137-
pr.APIGroups = []string{r.FullGroup}
138-
// Using "*" to allow access to the resource and all its subresources e.g "memcacheds" and "memcacheds/finalizers"
139-
// https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
140-
pr.Resources = []string{"*"}
141-
pr.Verbs = []string{"*"}
142-
role.Rules = append(role.Rules, *pr)
143-
}
144-
// update role.yaml
145-
d, err := json.Marshal(&role)
146-
if err != nil {
147-
return fmt.Errorf("failed to marshal role(%+v): %v", role, err)
148-
}
149-
m := &map[string]interface{}{}
150-
err = yaml.Unmarshal(d, m)
151-
data, err := yaml.Marshal(m)
152-
if err != nil {
153-
return fmt.Errorf("failed to marshal role(%+v): %v", role, err)
154-
}
155-
if err := ioutil.WriteFile(roleFilePath, data, DefaultFileMode); err != nil {
156-
return fmt.Errorf("failed to update %v: %v", roleFilePath, err)
157-
}
158-
case *rbacv1.ClusterRole:
159-
pr := &rbacv1.PolicyRule{}
160-
apiGroupFound := false
161-
for i := range role.Rules {
162-
if role.Rules[i].APIGroups[0] == r.FullGroup {
163-
apiGroupFound = true
164-
pr = &role.Rules[i]
165-
break
166-
}
167-
}
168-
// check if the resource already exists
169-
for _, resource := range pr.Resources {
170-
if resource == r.Resource {
171-
log.Printf("deploy/role.yaml RBAC rules already up to date for the resource (%v, %v)", r.APIVersion, r.Kind)
172-
return nil
173-
}
174-
}
175-
176-
pr.Resources = append(pr.Resources, r.Resource)
177-
// create a new apiGroup if not found.
178-
if !apiGroupFound {
179-
pr.APIGroups = []string{r.FullGroup}
180-
// Using "*" to allow access to the resource and all its subresources e.g "memcacheds" and "memcacheds/finalizers"
181-
// https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
182-
pr.Resources = []string{"*"}
183-
pr.Verbs = []string{"*"}
184-
role.Rules = append(role.Rules, *pr)
185-
}
186-
// update role.yaml
187-
d, err := json.Marshal(&role)
188-
if err != nil {
189-
return fmt.Errorf("failed to marshal role(%+v): %v", role, err)
190-
}
191-
m := &map[string]interface{}{}
192-
err = yaml.Unmarshal(d, m)
193-
data, err := yaml.Marshal(m)
194-
if err != nil {
195-
return fmt.Errorf("failed to marshal role(%+v): %v", role, err)
196-
}
197-
if err := ioutil.WriteFile(roleFilePath, data, DefaultFileMode); err != nil {
198-
return fmt.Errorf("failed to update %v: %v", roleFilePath, err)
199-
}
200-
default:
201-
return errors.New("failed to parse role.yaml as a role")
202-
}
203-
// not reachable
204-
return nil
205-
}

‎pkg/scaffold/role.go‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,19 @@
1515
package scaffold
1616

1717
import (
18+
"encoding/json"
19+
"errors"
20+
"fmt"
21+
"io/ioutil"
22+
"log"
1823
"path/filepath"
1924

25+
"github.com/operator-framework/operator-sdk/internal/util/fileutil"
2026
"github.com/operator-framework/operator-sdk/pkg/scaffold/input"
27+
28+
yaml "gopkg.in/yaml.v2"
29+
rbacv1 "k8s.io/api/rbac/v1"
30+
cgoscheme "k8s.io/client-go/kubernetes/scheme"
2131
)
2232

2333
const RoleYamlFile = "role.yaml"
@@ -34,6 +44,110 @@ func (s *Role) GetInput() (input.Input, error) {
3444
return s.Input, nil
3545
}
3646

47+
func UpdateRoleForResource(r *Resource, absProjectPath string) error {
48+
// append rbac rule to deploy/role.yaml
49+
roleFilePath := filepath.Join(absProjectPath, DeployDir, RoleYamlFile)
50+
roleYAML, err := ioutil.ReadFile(roleFilePath)
51+
if err != nil {
52+
return fmt.Errorf("failed to read role manifest %v: %v", roleFilePath, err)
53+
}
54+
obj, _, err := cgoscheme.Codecs.UniversalDeserializer().Decode(roleYAML, nil, nil)
55+
if err != nil {
56+
return fmt.Errorf("failed to decode role manifest %v: %v", roleFilePath, err)
57+
}
58+
switch role := obj.(type) {
59+
// TODO: use rbac/v1.
60+
case *rbacv1.Role:
61+
pr := &rbacv1.PolicyRule{}
62+
apiGroupFound := false
63+
for i := range role.Rules {
64+
if role.Rules[i].APIGroups[0] == r.FullGroup {
65+
apiGroupFound = true
66+
pr = &role.Rules[i]
67+
break
68+
}
69+
}
70+
// check if the resource already exists
71+
for _, resource := range pr.Resources {
72+
if resource == r.Resource {
73+
log.Printf("deploy/role.yaml RBAC rules already up to date for the resource (%v, %v)", r.APIVersion, r.Kind)
74+
return nil
75+
}
76+
}
77+
78+
pr.Resources = append(pr.Resources, r.Resource)
79+
// create a new apiGroup if not found.
80+
if !apiGroupFound {
81+
pr.APIGroups = []string{r.FullGroup}
82+
// Using "*" to allow access to the resource and all its subresources e.g "memcacheds" and "memcacheds/finalizers"
83+
// https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
84+
pr.Resources = []string{"*"}
85+
pr.Verbs = []string{"*"}
86+
role.Rules = append(role.Rules, *pr)
87+
}
88+
// update role.yaml
89+
d, err := json.Marshal(&role)
90+
if err != nil {
91+
return fmt.Errorf("failed to marshal role(%+v): %v", role, err)
92+
}
93+
m := &map[string]interface{}{}
94+
err = yaml.Unmarshal(d, m)
95+
data, err := yaml.Marshal(m)
96+
if err != nil {
97+
return fmt.Errorf("failed to marshal role(%+v): %v", role, err)
98+
}
99+
if err := ioutil.WriteFile(roleFilePath, data, fileutil.DefaultFileMode); err != nil {
100+
return fmt.Errorf("failed to update %v: %v", roleFilePath, err)
101+
}
102+
case *rbacv1.ClusterRole:
103+
pr := &rbacv1.PolicyRule{}
104+
apiGroupFound := false
105+
for i := range role.Rules {
106+
if role.Rules[i].APIGroups[0] == r.FullGroup {
107+
apiGroupFound = true
108+
pr = &role.Rules[i]
109+
break
110+
}
111+
}
112+
// check if the resource already exists
113+
for _, resource := range pr.Resources {
114+
if resource == r.Resource {
115+
log.Printf("deploy/role.yaml RBAC rules already up to date for the resource (%v, %v)", r.APIVersion, r.Kind)
116+
return nil
117+
}
118+
}
119+
120+
pr.Resources = append(pr.Resources, r.Resource)
121+
// create a new apiGroup if not found.
122+
if !apiGroupFound {
123+
pr.APIGroups = []string{r.FullGroup}
124+
// Using "*" to allow access to the resource and all its subresources e.g "memcacheds" and "memcacheds/finalizers"
125+
// https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
126+
pr.Resources = []string{"*"}
127+
pr.Verbs = []string{"*"}
128+
role.Rules = append(role.Rules, *pr)
129+
}
130+
// update role.yaml
131+
d, err := json.Marshal(&role)
132+
if err != nil {
133+
return fmt.Errorf("failed to marshal role(%+v): %v", role, err)
134+
}
135+
m := &map[string]interface{}{}
136+
err = yaml.Unmarshal(d, m)
137+
data, err := yaml.Marshal(m)
138+
if err != nil {
139+
return fmt.Errorf("failed to marshal role(%+v): %v", role, err)
140+
}
141+
if err := ioutil.WriteFile(roleFilePath, data, fileutil.DefaultFileMode); err != nil {
142+
return fmt.Errorf("failed to update %v: %v", roleFilePath, err)
143+
}
144+
default:
145+
return errors.New("failed to parse role.yaml as a role")
146+
}
147+
// not reachable
148+
return nil
149+
}
150+
37151
const roleTemplate = `kind: Role
38152
apiVersion: rbac.authorization.k8s.io/v1
39153
metadata:

0 commit comments

Comments
 (0)