Upgrade OpenShift and its dependencies.

OpenShift version 1.4.0-alpha.0
2016-10-18 12:04:00 +02:00
parent 5e1a5cbb3b
commit 1f8a0e06c9
1786 changed files with 424709 additions and 33395 deletions
@@ -0,0 +1,57 @@
+package reaper
+
+import (
+	"github.com/golang/glog"
+	kapi "k8s.io/kubernetes/pkg/api"
+	kerrors "k8s.io/kubernetes/pkg/api/errors"
+
+	"github.com/openshift/origin/pkg/client"
+)
+
+// reapClusterBindings removes the subject from cluster-level role bindings
+func reapClusterBindings(removedSubject kapi.ObjectReference, c client.ClusterRoleBindingsInterface) error {
+	clusterBindings, err := c.ClusterRoleBindings().List(kapi.ListOptions{})
+	if err != nil {
+		return err
+	}
+	for _, binding := range clusterBindings.Items {
+		retainedSubjects := []kapi.ObjectReference{}
+		for _, subject := range binding.Subjects {
+			if subject != removedSubject {
+				retainedSubjects = append(retainedSubjects, subject)
+			}
+		}
+		if len(retainedSubjects) != len(binding.Subjects) {
+			updatedBinding := binding
+			updatedBinding.Subjects = retainedSubjects
+			if _, err := c.ClusterRoleBindings().Update(&updatedBinding); err != nil && !kerrors.IsNotFound(err) {
+				glog.Infof("Cannot update clusterrolebinding/%s: %v", binding.Name, err)
+			}
+		}
+	}
+	return nil
+}
+
+// reapNamespacedBindings removes the subject from namespaced role bindings
+func reapNamespacedBindings(removedSubject kapi.ObjectReference, c client.RoleBindingsNamespacer) error {
+	namespacedBindings, err := c.RoleBindings(kapi.NamespaceAll).List(kapi.ListOptions{})
+	if err != nil {
+		return err
+	}
+	for _, binding := range namespacedBindings.Items {
+		retainedSubjects := []kapi.ObjectReference{}
+		for _, subject := range binding.Subjects {
+			if subject != removedSubject {
+				retainedSubjects = append(retainedSubjects, subject)
+			}
+		}
+		if len(retainedSubjects) != len(binding.Subjects) {
+			updatedBinding := binding
+			updatedBinding.Subjects = retainedSubjects
+			if _, err := c.RoleBindings(binding.Namespace).Update(&updatedBinding); err != nil && !kerrors.IsNotFound(err) {
+				glog.Infof("Cannot update rolebinding/%s in %s: %v", binding.Name, binding.Namespace, err)
+			}
+		}
+	}
+	return nil
+}
@@ -0,0 +1,76 @@
+package reaper
+
+import (
+	"time"
+
+	"github.com/golang/glog"
+	kapi "k8s.io/kubernetes/pkg/api"
+	kerrors "k8s.io/kubernetes/pkg/api/errors"
+	kclient "k8s.io/kubernetes/pkg/client/unversioned"
+	"k8s.io/kubernetes/pkg/kubectl"
+
+	"github.com/openshift/origin/pkg/client"
+)
+
+func NewGroupReaper(
+	groupClient client.GroupsInterface,
+	clusterBindingClient client.ClusterRoleBindingsInterface,
+	bindingClient client.RoleBindingsNamespacer,
+	sccClient kclient.SecurityContextConstraintsInterface,
+) kubectl.Reaper {
+	return &GroupReaper{
+		groupClient:          groupClient,
+		clusterBindingClient: clusterBindingClient,
+		bindingClient:        bindingClient,
+		sccClient:            sccClient,
+	}
+}
+
+type GroupReaper struct {
+	groupClient          client.GroupsInterface
+	clusterBindingClient client.ClusterRoleBindingsInterface
+	bindingClient        client.RoleBindingsNamespacer
+	sccClient            kclient.SecurityContextConstraintsInterface
+}
+
+// Stop on a reaper is actually used for deletion.  In this case, we'll delete referencing identities, clusterBindings, and bindings,
+// then delete the group
+func (r *GroupReaper) Stop(namespace, name string, timeout time.Duration, gracePeriod *kapi.DeleteOptions) error {
+	removedSubject := kapi.ObjectReference{Kind: "Group", Name: name}
+
+	if err := reapClusterBindings(removedSubject, r.clusterBindingClient); err != nil {
+		return err
+	}
+
+	if err := reapNamespacedBindings(removedSubject, r.bindingClient); err != nil {
+		return err
+	}
+
+	// Remove the group from sccs
+	sccs, err := r.sccClient.SecurityContextConstraints().List(kapi.ListOptions{})
+	if err != nil {
+		return err
+	}
+	for _, scc := range sccs.Items {
+		retainedGroups := []string{}
+		for _, group := range scc.Groups {
+			if group != name {
+				retainedGroups = append(retainedGroups, group)
+			}
+		}
+		if len(retainedGroups) != len(scc.Groups) {
+			updatedSCC := scc
+			updatedSCC.Groups = retainedGroups
+			if _, err := r.sccClient.SecurityContextConstraints().Update(&updatedSCC); err != nil && !kerrors.IsNotFound(err) {
+				glog.Infof("Cannot update scc/%s: %v", scc.Name, err)
+			}
+		}
+	}
+
+	// Remove the group
+	if err := r.groupClient.Groups().Delete(name); err != nil && !kerrors.IsNotFound(err) {
+		return err
+	}
+
+	return nil
+}
@@ -0,0 +1,104 @@
+package reaper
+
+import (
+	"time"
+
+	"github.com/golang/glog"
+	kapi "k8s.io/kubernetes/pkg/api"
+	kerrors "k8s.io/kubernetes/pkg/api/errors"
+	kclient "k8s.io/kubernetes/pkg/client/unversioned"
+	"k8s.io/kubernetes/pkg/kubectl"
+
+	"github.com/openshift/origin/pkg/client"
+)
+
+func NewUserReaper(
+	userClient client.UsersInterface,
+	groupClient client.GroupsInterface,
+	clusterBindingClient client.ClusterRoleBindingsInterface,
+	bindingClient client.RoleBindingsNamespacer,
+	sccClient kclient.SecurityContextConstraintsInterface,
+) kubectl.Reaper {
+	return &UserReaper{
+		userClient:           userClient,
+		groupClient:          groupClient,
+		clusterBindingClient: clusterBindingClient,
+		bindingClient:        bindingClient,
+		sccClient:            sccClient,
+	}
+}
+
+type UserReaper struct {
+	userClient           client.UsersInterface
+	groupClient          client.GroupsInterface
+	clusterBindingClient client.ClusterRoleBindingsInterface
+	bindingClient        client.RoleBindingsNamespacer
+	sccClient            kclient.SecurityContextConstraintsInterface
+}
+
+// Stop on a reaper is actually used for deletion.  In this case, we'll delete referencing identities, clusterBindings, and bindings,
+// then delete the user
+func (r *UserReaper) Stop(namespace, name string, timeout time.Duration, gracePeriod *kapi.DeleteOptions) error {
+	removedSubject := kapi.ObjectReference{Kind: "User", Name: name}
+
+	if err := reapClusterBindings(removedSubject, r.clusterBindingClient); err != nil {
+		return err
+	}
+
+	if err := reapNamespacedBindings(removedSubject, r.bindingClient); err != nil {
+		return err
+	}
+
+	// Remove the user from sccs
+	sccs, err := r.sccClient.SecurityContextConstraints().List(kapi.ListOptions{})
+	if err != nil {
+		return err
+	}
+	for _, scc := range sccs.Items {
+		retainedUsers := []string{}
+		for _, user := range scc.Users {
+			if user != name {
+				retainedUsers = append(retainedUsers, user)
+			}
+		}
+		if len(retainedUsers) != len(scc.Users) {
+			updatedSCC := scc
+			updatedSCC.Users = retainedUsers
+			if _, err := r.sccClient.SecurityContextConstraints().Update(&updatedSCC); err != nil && !kerrors.IsNotFound(err) {
+				glog.Infof("Cannot update scc/%s: %v", scc.Name, err)
+			}
+		}
+	}
+
+	// Remove the user from groups
+	groups, err := r.groupClient.Groups().List(kapi.ListOptions{})
+	if err != nil {
+		return err
+	}
+	for _, group := range groups.Items {
+		retainedUsers := []string{}
+		for _, user := range group.Users {
+			if user != name {
+				retainedUsers = append(retainedUsers, user)
+			}
+		}
+		if len(retainedUsers) != len(group.Users) {
+			updatedGroup := group
+			updatedGroup.Users = retainedUsers
+			if _, err := r.groupClient.Groups().Update(&updatedGroup); err != nil && !kerrors.IsNotFound(err) {
+				glog.Infof("Cannot update groups/%s: %v", group.Name, err)
+			}
+		}
+	}
+
+	// Intentionally leave identities that reference the user
+	// The user does not "own" the identities
+	// If the admin wants to remove the identities, that is a distinct operation
+
+	// Remove the user
+	if err := r.userClient.Users().Delete(name); err != nil && !kerrors.IsNotFound(err) {
+		return err
+	}
+
+	return nil
+}