Deprecate some policy commands #18102

simo5 · 2018-01-12T21:01:27Z

simo5 · 2018-01-12T21:01:44Z

bparees · 2018-01-12T21:14:19Z

fox is guarding the hen house on this one, but needs @openshift/cli-review

juanvallejo · 2018-01-12T21:49:32Z

pkg/oc/admin/policy/cani.go

@@ -71,6 +71,7 @@ func NewCmdCanI(name, fullName string, f *clientcmd.Factory, out io.Writer) *cob
 				os.Exit(2)
 			}
 		},
+		Deprecated: fmt.Sprintf("Use oc auth can-i"),


@simo5 Mind adding single quotes around the new oc command?

Can you also use the moved function where these commands are specifed, similarly to this. This way when you invoke oc policy these deprecated commands will be appropriately marked as well.

@simo5 Mind adding single quotes around the new oc command?

@juanvallejo why? I don't recall seeing oc in quotes anywhere

One more thing, use lowercase, since this gets appended to the following sentence Command xyz is deprecated, <here goes your string>

@soltysh

why? I don't recall seeing oc in quotes anywhere

Saw this being the pattern in a few places:

https://github.com/openshift/origin/blob/master/pkg/oc/admin/admin.go#L134

https://github.com/openshift/origin/blob/master/pkg/oc/admin/node/node.go#L98

https://github.com/openshift/origin/blob/master/pkg/oc/cli/cli.go#L281

I looked into cobra (see here) and that's why it does make sense to be it lowercase.

juanvallejo · 2018-01-12T21:50:14Z

One comment, but otherwise, merge at will after it's addressed

simo5 · 2018-01-12T22:15:58Z

/hold
@bparees @juanvallejo please take a look at the comments I added on the issue.

enj · 2018-01-13T02:07:43Z

pkg/oc/admin/policy/modify_roles.go

@@ -80,6 +80,7 @@ func NewCmdAddRoleToGroup(name, fullName string, f *clientcmd.Factory, out io.Wr
 				printSuccessForCommand(options.RoleName, true, "group", options.Targets, true, options.DryRun, out)
 			}
 		},
+		Deprecated: fmt.Sprintf("Use oc edit rolebinding"),


Why all the unnecessary calls to fmt.Sprintf?

soltysh · 2018-01-15T14:41:27Z

pkg/oc/admin/policy/cani.go

@@ -71,6 +71,7 @@ func NewCmdCanI(name, fullName string, f *clientcmd.Factory, out io.Writer) *cob
 				os.Exit(2)
 			}
 		},
+		Deprecated: fmt.Sprintf("Use oc auth can-i"),


Can you also use the moved function where these commands are specifed, similarly to this. This way when you invoke oc policy these deprecated commands will be appropriately marked as well.

soltysh · 2018-01-15T14:42:09Z

pkg/oc/admin/policy/cani.go

@@ -71,6 +71,7 @@ func NewCmdCanI(name, fullName string, f *clientcmd.Factory, out io.Writer) *cob
 				os.Exit(2)
 			}
 		},
+		Deprecated: fmt.Sprintf("Use oc auth can-i"),


@simo5 Mind adding single quotes around the new oc command?

@juanvallejo why? I don't recall seeing oc in quotes anywhere

simo5 · 2018-01-27T19:18:21Z

/retest

addressed

simo5 · 2018-01-30T22:50:23Z

/hold cancel
/retest
@enj @soltysh @juanvallejo PTAL

simo5 · 2018-01-31T16:34:59Z

/retest

soltysh

A few nits and one question.

soltysh · 2018-02-05T15:31:42Z

pkg/oc/admin/policy/cani.go

@@ -71,6 +71,7 @@ func NewCmdCanI(name, fullName string, f *clientcmd.Factory, out io.Writer) *cob
 				os.Exit(2)
 			}
 		},
+		Deprecated: fmt.Sprintf("use 'oc auth can-i'"),


No need for fmt.Sprintf

right, forgot, will rebase and fix this

soltysh · 2018-02-05T15:33:16Z

pkg/oc/admin/policy/reconcile_clusterrolebindings.go

@@ -104,6 +104,7 @@ func NewCmdReconcileClusterRoleBindings(name, fullName string, f *clientcmd.Fact
 				kcmdutil.CheckErr(err)
 			}
 		},
+		Deprecated: fmt.Sprintf("use 'oc auth reconcile'"),


soltysh · 2018-02-05T15:35:51Z

test/cmd/policy.sh

@@ -50,22 +50,21 @@ os::cmd::expect_failure_and_text 'oc policy add-role-to-user' 'you must specify
 os::cmd::expect_failure_and_text 'oc policy add-role-to-user -z NamespaceWithoutRole' 'you must specify a role'
 os::cmd::expect_failure_and_text 'oc policy add-role-to-user view' 'you must specify at least one user or service account'

-os::cmd::expect_success_and_text 'oc policy add-role-to-group cluster-admin system:unauthenticated' 'role "cluster-admin" added: "system:unauthenticated"'
-os::cmd::expect_success_and_text 'oc policy add-role-to-user cluster-admin system:no-user' 'role "cluster-admin" added: "system:no-user"'
+os::cmd::expect_success_and_text 'oc policy add-role-to-group cluster-admin --rolebinding-name cluster-admin system:unauthenticated' 'role "cluster-admin" added: "system:unauthenticated"'


Are there any backwards compatible implications in changing this, or this is just cosmetics for stability of tests?

No real backwards incompatibility, just tests were making assumptions that are not true "in real life" about which rolebindings were going to be used by the test.

Because the commands was picking the first rolebinding it would find you can never be certain of what rolebinding was used. By changing the command to always pick a new rolebinding we may cause some incorrect expectations to "fail early", so that people will end up fixing latent bugs that were always there.

As you can see by tests being all green, luckily this faulty assumption seem to not have been relied upon anywhere in our code base except for the tests testing the feature itself.

Push people to use native RBAC commands where reasonable equivalents exist, or where the replacement command will lead to better practices. Signed-off-by: Simo Sorce <[email protected]>

Instead of deprecating add/remove-role commands, change them to behave better. On add: do not add to a random rolebinding, always create a new rolebinding if none was specified explicitly. On Remove: if a rolebinding name is specified remove only from it. Signed-off-by: Simo Sorce <[email protected]>

soltysh

/lgtm
/approve

openshift-ci-robot · 2018-02-05T16:23:23Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: simo5, soltysh

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

~~contrib/completions/OWNERS~~ [soltysh]
~~pkg/oc/OWNERS~~ [soltysh]
~~test/cmd/OWNERS~~ [soltysh]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

openshift-merge-robot · 2018-02-05T18:59:00Z

Automatic merge from submit-queue (batch tested with PRs 18415, 18419, 18268, 18102, 18440).

openshift-merge-robot · 2018-02-05T18:59:04Z

/test all [submit-queue is verifying that this PR is safe to merge]

Followup to openshift#18102 Signed-off-by: Simo Sorce <[email protected]>

enj · 2018-02-08T03:43:17Z

pkg/oc/admin/policy/modify_roles.go

+	var roleBindings []*authorizationapi.RoleBinding
+	var err error
+	if len(o.RoleBindingName) > 0 {
+		existingRoleBinding, err := o.RoleBindingAccessor.GetRoleBinding(o.RoleBindingName)


This is missing the role check like getUserSpecifiedBinding:

// Check that we update the rolebinding for the intended role. if roleBinding.RoleRef.Name != o.RoleName || roleBinding.RoleRef.Namespace != o.RoleNamespace { return nil, false, fmt.Errorf("rolebinding %s found for role %s, not %s", roleBinding.Name, roleBinding.RoleRef.Name, o.RoleName) }

This should error instead of doing the wrong thing:

$ oc new-project lol3 Now using project "lol3" on server "https://10.10.10.35:8443". You can add applications to this project with the 'new-app' command. For example, try: oc new-app centos/ruby-22-centos7~https://github.com/openshift/ruby-ex.git to build a new example application in Ruby. $ oc policy add-role-to-user edit foo role "edit" added: "foo" $ oc policy add-role-to-user admin foo role "admin" added: "foo" $ oc get rolebinding NAME ROLE USERS GROUPS SERVICE ACCOUNTS SUBJECTS admin /admin system:admin admin-0 /admin foo edit /edit foo system:deployers /system:deployer deployer system:image-builders /system:image-builder builder system:image-pullers /system:image-puller system:serviceaccounts:lol3 $ oc policy remove-role-from-user admin foo --rolebinding-name=edit role "admin" removed: "foo" $ oc get rolebinding NAME ROLE USERS GROUPS SERVICE ACCOUNTS SUBJECTS admin /admin system:admin admin-0 /admin foo system:deployers /system:deployer deployer system:image-builders /system:image-builder builder system:image-pullers /system:image-puller system:serviceaccounts:lol3

Followup to openshift#18102 Signed-off-by: Simo Sorce <[email protected]>

openshift-ci-robot requested review from juanvallejo and soltysh January 12, 2018 21:01

openshift-ci-robot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Jan 12, 2018

juanvallejo reviewed Jan 12, 2018

View reviewed changes

simo5 closed this Jan 12, 2018

openshift-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jan 12, 2018

simo5 reopened this Jan 12, 2018

enj reviewed Jan 13, 2018

View reviewed changes

soltysh previously requested changes Jan 15, 2018

View reviewed changes

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 20, 2018

simo5 force-pushed the deprecpol branch from d43e067 to 9f864f2 Compare January 26, 2018 19:54

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 26, 2018

openshift-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Jan 26, 2018

simo5 force-pushed the deprecpol branch from 9f864f2 to d0bab12 Compare January 26, 2018 20:19

openshift-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jan 26, 2018

simo5 force-pushed the deprecpol branch from d0bab12 to 1271dea Compare January 29, 2018 14:51

simo5 force-pushed the deprecpol branch 2 times, most recently from 197dcbf to c989199 Compare January 30, 2018 04:28

openshift-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jan 30, 2018

simo5 mentioned this pull request Jan 31, 2018

RBAC Migration Followup #25: Deprecate policy commands in favor of RBAC equivalents #18096

Open

soltysh approved these changes Feb 5, 2018

View reviewed changes

simo5 added 4 commits February 5, 2018 10:49

Deprecate a bunch of policy commands

73338c4

Push people to use native RBAC commands where reasonable equivalents exist, or where the replacement command will lead to better practices. Signed-off-by: Simo Sorce <[email protected]>

Remove empty role bindings when removing subjects

707c443

Generated files

728f170

simo5 force-pushed the deprecpol branch from c989199 to 728f170 Compare February 5, 2018 15:50

soltysh approved these changes Feb 5, 2018

View reviewed changes

openshift-ci-robot assigned soltysh Feb 5, 2018

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Feb 5, 2018

openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 5, 2018

openshift-merge-robot merged commit dc275c5 into openshift:master Feb 5, 2018

simo5 added a commit to simo5/origin that referenced this pull request Feb 9, 2018

Fix oc policy remove-user to remove rolebindings too

63d2cfd

Followup to openshift#18102 Signed-off-by: Simo Sorce <[email protected]>

simo5 mentioned this pull request Feb 9, 2018

Fix oc policy remove-user to remove rolebindings too #18550

Merged

simo5 added a commit to simo5/origin that referenced this pull request Feb 9, 2018

Fix oc policy remove-user to remove rolebindings too

86e8a92

Followup to openshift#18102 Signed-off-by: Simo Sorce <[email protected]>

simo5 added a commit to simo5/origin that referenced this pull request Feb 9, 2018

Fix oc policy remove-user to remove rolebindings too

d70e210

Followup to openshift#18102 Signed-off-by: Simo Sorce <[email protected]>

enj reviewed Feb 11, 2018

View reviewed changes

simo5 added a commit to simo5/origin that referenced this pull request Feb 12, 2018

Fix oc policy remove-user to remove rolebindings too

df98bdd

Followup to openshift#18102 Signed-off-by: Simo Sorce <[email protected]>

enj mentioned this pull request Feb 14, 2018

Add tests for remove-user with a rolebinding name #18602

Merged

luksa pushed a commit to luksa/openshift-origin that referenced this pull request Feb 14, 2018

Fix oc policy remove-user to remove rolebindings too

67f7fef

Followup to openshift#18102 Signed-off-by: Simo Sorce <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Deprecate some policy commands #18102

Deprecate some policy commands #18102

simo5 commented Jan 12, 2018

simo5 commented Jan 12, 2018

bparees commented Jan 12, 2018

juanvallejo Jan 12, 2018

soltysh Jan 15, 2018

soltysh Jan 15, 2018

soltysh Jan 15, 2018

juanvallejo Jan 15, 2018

soltysh Jan 16, 2018

juanvallejo commented Jan 12, 2018

simo5 commented Jan 12, 2018

enj Jan 13, 2018

soltysh Jan 15, 2018

soltysh Jan 15, 2018

simo5 commented Jan 27, 2018

simo5 commented Jan 30, 2018

simo5 commented Jan 31, 2018

soltysh left a comment

soltysh Feb 5, 2018

simo5 Feb 5, 2018

soltysh Feb 5, 2018

soltysh Feb 5, 2018

simo5 Feb 5, 2018

soltysh left a comment

openshift-ci-robot commented Feb 5, 2018

openshift-merge-robot commented Feb 5, 2018

openshift-merge-robot commented Feb 5, 2018

enj Feb 8, 2018

Deprecate some policy commands #18102

Deprecate some policy commands #18102

Conversation

simo5 commented Jan 12, 2018

simo5 commented Jan 12, 2018

bparees commented Jan 12, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

juanvallejo commented Jan 12, 2018

simo5 commented Jan 12, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

simo5 commented Jan 27, 2018

simo5 commented Jan 30, 2018

simo5 commented Jan 31, 2018

soltysh left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

soltysh left a comment

Choose a reason for hiding this comment

openshift-ci-robot commented Feb 5, 2018

openshift-merge-robot commented Feb 5, 2018

openshift-merge-robot commented Feb 5, 2018

Choose a reason for hiding this comment