Skip to content

Conversation

@somtochiama
Copy link
Contributor

No description provided.

@k8s-ci-robot k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Jun 13, 2020
@k8s-ci-robot
Copy link
Contributor

Hi @somtochiama. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jun 13, 2020
@k8s-ci-robot k8s-ci-robot added the size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. label Jun 13, 2020
@somtochiama
Copy link
Contributor Author

/assign @justinsb


bytes, err := ioutil.ReadFile(*yamlFile)
if err != nil {
log.Fatalf("Error reading files: %v", err)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tip: I like to do this:

func main() {
  err := run()
  if err != nil {
    fmt.Fprintf(os.Stderr, "%v\n", err)
    os.Exit(1)
  }
}

func run() error {
... real work....
}

because then we can just return an error. Two advantages:

  • A little more compact
  • It makes it easier to refactor the code into functions; the top-level function is a special-case in terms of error handling, so I try to make that special-case as small as possible.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is nice. Reduce code for error handling

// generate Group and Kind
ctx := context.Background()
objs, err := manifest.ParseObjects(ctx, string(bytes))

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: it's clearer (IMO) without the line break between the thing which generates the error and which checks the error

a, err := foo()
if err != nil {

Verbs: []string{"create", "update", "delete", "get"},
}
roleInterface.Rules = append(roleInterface.Rules, &newRule)
m[obj.Kind] = ""
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Technically the key should include the api group, in case two kinds are named the same in two apigroups.

Two ways to do that:

  • Invent some delimiter that is "safe": m[obj.APIGroup + "::" + obj.Kind] = true
  • Use a struct:
struct key {
  APIGroup string
  Kind string
}

For cases like this where I'm not really reading the values back, I tend to just use the string trick. If I'm reading them back or parsing the keys I tend to use a struct.

}

// to deal with duplicates, we keep a map of all the kinds that has been addeed so far
m := make(map[string]string)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Alternatives:

  • map[string]bool lets you do if m[obj.Kind] { and I tend to use this
  • map[string]struct{} is the go way of writing that there are no values, so it is a little more memory efficient. You have to use the longer way of checking though (as you've done here), so if it's not verified as performance critical I tend to use the simpler boolean form.

if _, ok := m[obj.Kind]; !ok {
newRule := rule {
ApiGroups: []string{obj.Group},
// needs plural of kind
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There's a pluralize helper in kubebuilder I think, which I guess we should probably use. I agree this is annoying though :-)

It's technically the resource name, which might be completely different to the kind. In practice, it's the plural (and lower cased).

@justinsb
Copy link
Contributor

This looks great!

You pointed out the need to also embed ClusterRoles and Roles. We can do that in a follow on if that's easier. Just a few nits here :-)

@k8s-ci-robot k8s-ci-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Jun 20, 2020
@somtochiama somtochiama requested a review from justinsb June 23, 2020 12:06
@somtochiama somtochiama changed the title [WIP] Takes in manifest and generates role Takes in manifest and generates role Jun 26, 2020
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 26, 2020
saName = flag.String("sa-name", "", "name of service account the role should be binded to")
ns = flag.String("ns", "kube-system", "namespace of the role to be generated")
out = flag.String("out", "", "name of output file")
supervisory = flag.Bool("supervisory", false, "outputs role for operator in supervisory mode")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: we might want a string enum (as otherwise we tend to end up with lots of flags :-) )

@justinsb
Copy link
Contributor

/ok-to-test

I'm excited to start using this! We're already finding lots more uses for it (e.g. supervisor mode) so I think it's important to get a version merged and then we can iterate for those.

/approve
/lgtm

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jun 29, 2020
@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 29, 2020
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: justinsb, SomtochiAma

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 29, 2020
@k8s-ci-robot k8s-ci-robot merged commit 98e10a2 into kubernetes-sigs:master Jun 29, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants