-
Notifications
You must be signed in to change notification settings - Fork 4.7k
/
who_can.go
107 lines (85 loc) · 2.88 KB
/
who_can.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
package policy
import (
"errors"
"fmt"
"io"
"strings"
"github.com/spf13/cobra"
kapi "github.com/GoogleCloudPlatform/kubernetes/pkg/api"
kcmdutil "github.com/GoogleCloudPlatform/kubernetes/pkg/kubectl/cmd/util"
authorizationapi "github.com/openshift/origin/pkg/authorization/api"
"github.com/openshift/origin/pkg/client"
"github.com/openshift/origin/pkg/cmd/util/clientcmd"
)
const WhoCanRecommendedName = "who-can"
type whoCanOptions struct {
allNamespaces bool
bindingNamespace string
client client.Interface
verb string
resource string
}
// NewCmdWhoCan implements the OpenShift cli who-can command
func NewCmdWhoCan(name, fullName string, f *clientcmd.Factory, out io.Writer) *cobra.Command {
options := &whoCanOptions{}
cmd := &cobra.Command{
Use: "who-can VERB RESOURCE",
Short: "List who can perform the specified action on a resource",
Long: "List who can perform the specified action on a resource",
Run: func(cmd *cobra.Command, args []string) {
if err := options.complete(args); err != nil {
kcmdutil.CheckErr(kcmdutil.UsageError(cmd, err.Error()))
}
var err error
options.client, _, err = f.Clients()
kcmdutil.CheckErr(err)
options.bindingNamespace, err = f.DefaultNamespace()
kcmdutil.CheckErr(err)
err = options.run()
kcmdutil.CheckErr(err)
},
}
cmd.Flags().BoolVar(&options.allNamespaces, "all-namespaces", options.allNamespaces, "If present, list who can perform the specified action in all namespaces.")
return cmd
}
func (o *whoCanOptions) complete(args []string) error {
if len(args) != 2 {
return errors.New("You must specify two arguments: verb and resource")
}
o.verb = args[0]
o.resource = args[1]
return nil
}
func (o *whoCanOptions) run() error {
resourceAccessReview := &authorizationapi.ResourceAccessReview{}
resourceAccessReview.Resource = o.resource
resourceAccessReview.Verb = o.verb
var reviewInterface client.ResourceAccessReviewInterface
if o.allNamespaces {
reviewInterface = o.client.ClusterResourceAccessReviews()
} else {
reviewInterface = o.client.ResourceAccessReviews(o.bindingNamespace)
}
resourceAccessReviewResponse, err := reviewInterface.Create(resourceAccessReview)
if err != nil {
return err
}
if resourceAccessReviewResponse.Namespace == kapi.NamespaceAll {
fmt.Printf("Namespace: <all>\n")
} else {
fmt.Printf("Namespace: %s\n", resourceAccessReviewResponse.Namespace)
}
fmt.Printf("Verb: %s\n", o.verb)
fmt.Printf("Resource: %s\n\n", o.resource)
if len(resourceAccessReviewResponse.Users) == 0 {
fmt.Printf("Users: none\n\n")
} else {
fmt.Printf("Users: %s\n\n", strings.Join(resourceAccessReviewResponse.Users.List(), "\n "))
}
if len(resourceAccessReviewResponse.Groups) == 0 {
fmt.Printf("Groups: none\n\n")
} else {
fmt.Printf("Groups: %s\n\n", strings.Join(resourceAccessReviewResponse.Groups.List(), "\n "))
}
return nil
}