Set defaults for templated roles. #916
Conversation
| if r.Metadata.Name == "" { | ||
| return trace.BadParameter("missing parameter Name") | ||
| } | ||
| if r.Metadata.Namespace == "" { |
There was a problem hiding this comment.
one thing that worries me a bit - it will be helpful to distinguish between "not specified" and left empty, e.g your pull request does not allow me to prohibit access to all nodes at all, it will allways override with wildcard.
There was a problem hiding this comment.
I changed r.Spec.Namespaces, r.Spec.NodeLabels, and r.Spec.Resources to only set defaults when nil.
I can't really do that here for Namespace without changing the underlying type for r.Metadata.Namespace since I can't distinguish not being set and being set to "" without making it a pointer.
What situation would we want to allow an empty namespace to restrict access to nodes? In your above example you can remove the User if you don't want them to have access any nodes?
There was a problem hiding this comment.
you can make it a pointer, why not
russjones
force-pushed
the
rjones/role-template-defaults
branch
from
47271d4
to
e3a9641
Compare
russjones
force-pushed
the
rjones/role-template-defaults
branch
from
e3a9641
to
f85bb0d
Compare
Purpose
As covered in #912, at the moment if you create a role from a template, you have to explicitly define the values for all fields. This PR changes this behavior by filling in the default value for missing or empty fields.
Implementation
CheckAndSetDefaultsto make sure the role is filled out.CheckAndSetDefaultsrequire that all fields have default values if unset or empty.Related Issues
Fixes #912