Auth CLI: Make it easier to create a role for a set of resources and actions

[csrwng]

Ideally provide a command that takes in a list of resources, a list of actions and creates a new role

[csrwng]

@deads2k fyi

[deads2k]

Ideally provide a command that takes in a list of resources, a list of actions and creates a new role

Resources and actions are simply strings, but I think we might want to make this command enforce only known resources and actions. It would still be possible to do more complicated things using json, but this is about the 90% case.

Also, do you have suggestions for names? We probably want a full set of crud, right?

[liggitt]

+1 on enforcing (possibly with --force override, I guess). It's too easy to mix up pluralization or typos otherwise

[csrwng]

Also, do you have suggestions for names? We probably want a full set of crud, right?

create-role ? :-) The create role is the hard part... editing roles is much easier. So not sure that a full set of crud would be needed (at least not right away), and it actually might make the command unnecessarily complex.

[php-coder]

oc create clusterrrole now is available as it was implemented in kubernetes (kubernetes/kubernetes#41538).

@csrwng please, close the issue if a new command fulfill your needs.

[liggitt]

unfortunately, this creates a kube rbac.authorization.k8s.io clusterrole, not an origin clusterrole :-/

we'll collapse the storage for the two types eventually (probably around 3.7-3.8 timeframe), but it'll be confusing until then

[php-coder]

unfortunately, this creates a kube rbac.authorization.k8s.io clusterrole, not an origin clusterrole :-/

Does it mean that we should alter its behavior to create origin cluster roles instead? Or do we have a use case when openshift user needs k8s cluster role?

[deads2k]

Does it mean that we should alter its behavior to create origin cluster roles instead? Or do we have a use case when openshift user needs k8s cluster role?

Switching it and then switching it back will be really confusing. It's annoying now, but I'd say we either leave it alone or hide it entirely, not change it.

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[0xmichalis]

I guess this is fixed now.