UPSTREAM: 64541: Add more kubectl auth reconcile flags
@@ -41,6 +41,8 @@ type ReconcileOptions struct {
PrintFlags *genericclioptions.PrintFlags
FilenameOptions *resource.FilenameOptions
DryRun bool
+ RemoveExtraPermissions bool
+ RemoveExtraSubjects bool
Visitor resource.Visitor
RBACClient rbacv1client.RbacV1Interface
@@ -90,6 +92,8 @@ func NewCmdReconcile(f cmdutil.Factory, streams genericclioptions.IOStreams) *co
cmdutil.AddFilenameOptionFlags(cmd, o.FilenameOptions, "identifying the resource to reconcile.")
cmd.Flags().BoolVar(&o.DryRun, "dry-run", o.DryRun, "If true, display results but do not submit changes")
+ cmd.Flags().BoolVar(&o.RemoveExtraPermissions, "remove-extra-permissions", o.RemoveExtraPermissions, "If true, removes extra permissions added to roles")
+ cmd.Flags().BoolVar(&o.RemoveExtraSubjects, "remove-extra-subjects", o.RemoveExtraSubjects, "If true, removes extra subjects added to rolebindings")
cmd.MarkFlagRequired("filename")
return cmd
@@ -182,7 +186,7 @@ func (o *ReconcileOptions) RunReconcile() error {
case *rbacv1.Role:
reconcileOptions := reconciliation.ReconcileRoleOptions{
Confirm: !o.DryRun,
- RemoveExtraPermissions: false,
+ RemoveExtraPermissions: o.RemoveExtraPermissions,
Role: reconciliation.RoleRuleOwner{Role: t},
Client: reconciliation.RoleModifier{
NamespaceClient: o.NamespaceClient.Namespaces(),
@@ -198,7 +202,7 @@ func (o *ReconcileOptions) RunReconcile() error {
case *rbacv1.ClusterRole:
reconcileOptions := reconciliation.ReconcileRoleOptions{
Confirm: !o.DryRun,
- RemoveExtraPermissions: false,
+ RemoveExtraPermissions: o.RemoveExtraPermissions,
Role: reconciliation.ClusterRoleRuleOwner{ClusterRole: t},
Client: reconciliation.ClusterRoleModifier{
Client: o.RBACClient.ClusterRoles(),
@@ -213,7 +217,7 @@ func (o *ReconcileOptions) RunReconcile() error {
case *rbacv1.RoleBinding:
reconcileOptions := reconciliation.ReconcileRoleBindingOptions{
Confirm: !o.DryRun,
- RemoveExtraSubjects: false,
+ RemoveExtraSubjects: o.RemoveExtraSubjects,
RoleBinding: reconciliation.RoleBindingAdapter{RoleBinding: t},
Client: reconciliation.RoleBindingClientAdapter{
Client: o.RBACClient,
@@ -229,7 +233,7 @@ func (o *ReconcileOptions) RunReconcile() error {
case *rbacv1.ClusterRoleBinding:
reconcileOptions := reconciliation.ReconcileRoleBindingOptions{
Confirm: !o.DryRun,
- RemoveExtraSubjects: false,
+ RemoveExtraSubjects: o.RemoveExtraSubjects,
RoleBinding: reconciliation.ClusterRoleBindingAdapter{ClusterRoleBinding: t},
Client: reconciliation.ClusterRoleBindingClientAdapter{
Client: o.RBACClient.ClusterRoleBindings(),
