Nail/fission-src
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move RBAC v1beta1 to v1 (#2059)

Browse Source 
Signed-off-by: Harsh Thakur <harshthakur9030@gmail.com>

Co-authored-by: Sanket Sudake <sanketsudake@gmail.com>
This commit is contained in:
Harsh Thakur
2021-06-08 08:25:52 +05:30
committed by GitHub
co-authored by Sanket Sudake
parent 3055a3ada0
commit 7bf82c7ea9
2 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/executor/reaper/reaper.go
+1 -1
View File
@@ -187,7 +187,7 @@ func CleanupRoleBindings(logger *zap.Logger, client *kubernetes.Clientset, fissi
logger.Debug("starting cleanupRoleBindings cycle")
// get all rolebindings ( just to be efficient, one call to kubernetes )
rbList, err := client.RbacV1beta1().RoleBindings(meta_v1.NamespaceAll).List(context.TODO(), meta_v1.ListOptions{})
rbList, err := client.RbacV1().RoleBindings(meta_v1.NamespaceAll).List(context.TODO(), meta_v1.ListOptions{})
if err != nil {
// something wrong, but next iteration hopefully succeeds
logger.Error("error listing role bindings in all namespaces", zap.Error(err))
pkg/utils/rbacutils.go
+8 -8
View File
@@ -24,7 +24,7 @@ import (
"github.com/pkg/errors"
apiv1 "k8s.io/api/core/v1"
rbac "k8s.io/api/rbac/v1beta1"
rbac "k8s.io/api/rbac/v1"
k8serrors "k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/types"
@@ -121,7 +121,7 @@ func AddSaToRoleBindingWithRetries(logger *zap.Logger, k8sClient *kubernetes.Cli
}
for i := 0; i < maxRetries; i++ {
_, err = k8sClient.RbacV1beta1().RoleBindings(roleBindingNs).Patch(context.TODO(), roleBinding, types.JSONPatchType, patchJson, metav1.PatchOptions{})
_, err = k8sClient.RbacV1().RoleBindings(roleBindingNs).Patch(context.TODO(), roleBinding, types.JSONPatchType, patchJson, metav1.PatchOptions{})
if err == nil {
logger.Debug("patched rolebinding",
zap.String("role_binding", roleBinding),
@@ -137,7 +137,7 @@ func AddSaToRoleBindingWithRetries(logger *zap.Logger, k8sClient *kubernetes.Cli
// someone may have deleted the object between us checking if the object is present and deciding to patch
// so just create the object again
rbObj := makeRoleBindingObj(roleBinding, roleBindingNs, role, roleKind, sa, saNamespace)
_, err = k8sClient.RbacV1beta1().RoleBindings(roleBindingNs).Create(context.TODO(), rbObj, metav1.CreateOptions{})
_, err = k8sClient.RbacV1().RoleBindings(roleBindingNs).Create(context.TODO(), rbObj, metav1.CreateOptions{})
if err == nil {
logger.Debug("created rolebinding",
zap.String("role_binding", roleBinding),
@@ -178,7 +178,7 @@ func AddSaToRoleBindingWithRetries(logger *zap.Logger, k8sClient *kubernetes.Cli
// the rolebinding, then it deletes the rolebinding object.
func RemoveSAFromRoleBindingWithRetries(logger *zap.Logger, k8sClient *kubernetes.Clientset, roleBinding, roleBindingNs string, saToRemove map[string]bool) (err error) {
for i := 0; i < maxRetries; i++ {
rbObj, err := k8sClient.RbacV1beta1().RoleBindings(roleBindingNs).Get(
rbObj, err := k8sClient.RbacV1().RoleBindings(roleBindingNs).Get(
context.TODO(),
roleBinding, metav1.GetOptions{})
if err != nil {
@@ -212,7 +212,7 @@ func RemoveSAFromRoleBindingWithRetries(logger *zap.Logger, k8sClient *kubernete
rbObj.Subjects = newSubjects
// cant use patch for deletes, the results become in-deterministic, so using update.
_, err = k8sClient.RbacV1beta1().RoleBindings(rbObj.Namespace).Update(context.TODO(), rbObj, metav1.UpdateOptions{})
_, err = k8sClient.RbacV1().RoleBindings(rbObj.Namespace).Update(context.TODO(), rbObj, metav1.UpdateOptions{})
switch {
case err == nil:
logger.Debug("removed service accounts from rolebinding",
@@ -238,7 +238,7 @@ func RemoveSAFromRoleBindingWithRetries(logger *zap.Logger, k8sClient *kubernete
// if not, it creates a rolebinding object granting the role to the SA in the namespace.
func SetupRoleBinding(logger *zap.Logger, k8sClient *kubernetes.Clientset, roleBinding, roleBindingNs, role, roleKind, sa, saNamespace string) error {
// get the role binding object
rbObj, err := k8sClient.RbacV1beta1().RoleBindings(roleBindingNs).Get(
rbObj, err := k8sClient.RbacV1().RoleBindings(roleBindingNs).Get(
context.TODO(),
roleBinding, metav1.GetOptions{})
@@ -266,7 +266,7 @@ func SetupRoleBinding(logger *zap.Logger, k8sClient *kubernetes.Clientset, roleB
zap.String("role_binding", roleBinding),
zap.String("role_binding_namespace", roleBindingNs))
rbObj = makeRoleBindingObj(roleBinding, roleBindingNs, role, roleKind, sa, saNamespace)
_, err = k8sClient.RbacV1beta1().RoleBindings(roleBindingNs).Create(context.TODO(), rbObj, metav1.CreateOptions{})
_, err = k8sClient.RbacV1().RoleBindings(roleBindingNs).Create(context.TODO(), rbObj, metav1.CreateOptions{})
if k8serrors.IsAlreadyExists(err) {
logger.Debug("rolebinding already exists in namespace - adding service account to rolebinding",
zap.String("service_account_name", sa),
@@ -285,7 +285,7 @@ func SetupRoleBinding(logger *zap.Logger, k8sClient *kubernetes.Clientset, roleB
func DeleteRoleBinding(k8sClient *kubernetes.Clientset, roleBinding, roleBindingNs string) error {
// if deleteRoleBinding is invoked by 2 fission services at the same time for the same rolebinding,
// the first call will succeed while the 2nd will fail with isNotFound. but we dont want to error out then.
err := k8sClient.RbacV1beta1().RoleBindings(roleBindingNs).Delete(context.TODO(), roleBinding, metav1.DeleteOptions{})
err := k8sClient.RbacV1().RoleBindings(roleBindingNs).Delete(context.TODO(), roleBinding, metav1.DeleteOptions{})
if err == nil || k8serrors.IsNotFound(err) {
return nil
}