vendor files

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/auth/BUILD

@@ -0,0 +1,61 @@
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "auth.go",
+        "cani.go",
+        "reconcile.go",
+    ],
+    importpath = "k8s.io/kubernetes/pkg/kubectl/cmd/auth",
+    visibility = [
+        "//build/visible_to:pkg_kubectl_cmd_auth_CONSUMERS",
+    ],
+    deps = [
+        "//pkg/apis/authorization:go_default_library",
+        "//pkg/apis/rbac:go_default_library",
+        "//pkg/client/clientset_generated/internalclientset/typed/authorization/internalversion:go_default_library",
+        "//pkg/client/clientset_generated/internalclientset/typed/core/internalversion:go_default_library",
+        "//pkg/client/clientset_generated/internalclientset/typed/rbac/internalversion:go_default_library",
+        "//pkg/kubectl/cmd/templates:go_default_library",
+        "//pkg/kubectl/cmd/util:go_default_library",
+        "//pkg/kubectl/resource:go_default_library",
+        "//pkg/registry/rbac/reconciliation:go_default_library",
+        "//vendor/github.com/golang/glog:go_default_library",
+        "//vendor/github.com/spf13/cobra:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/meta:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = [
+        "//build/visible_to:pkg_kubectl_cmd_auth_CONSUMERS",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["cani_test.go"],
+    importpath = "k8s.io/kubernetes/pkg/kubectl/cmd/auth",
+    library = ":go_default_library",
+    deps = [
+        "//pkg/kubectl/cmd/testing:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+        "//vendor/k8s.io/client-go/rest/fake:go_default_library",
+    ],
+)

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/auth/auth.go

@@ -0,0 +1,40 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package auth
+
+import (
+	"io"
+
+	"github.com/spf13/cobra"
+
+	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+)
+
+func NewCmdAuth(f cmdutil.Factory, out, errOut io.Writer) *cobra.Command {
+	// Parent command to which all subcommands are added.
+	cmds := &cobra.Command{
+		Use:   "auth",
+		Short: "Inspect authorization",
+		Long:  `Inspect authorization`,
+		Run:   cmdutil.DefaultSubCommandRun(errOut),
+	}
+
+	cmds.AddCommand(NewCmdCanI(f, out, errOut))
+	cmds.AddCommand(NewCmdReconcile(f, out, errOut))
+
+	return cmds
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/auth/cani.go

@@ -0,0 +1,240 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package auth
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"strings"
+
+	"github.com/spf13/cobra"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	authorizationapi "k8s.io/kubernetes/pkg/apis/authorization"
+	internalauthorizationclient "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/typed/authorization/internalversion"
+	"k8s.io/kubernetes/pkg/kubectl/cmd/templates"
+	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+)
+
+// CanIOptions is the start of the data required to perform the operation.  As new fields are added, add them here instead of
+// referencing the cmd.Flags()
+type CanIOptions struct {
+	AllNamespaces bool
+	Quiet         bool
+	Namespace     string
+	SelfSARClient internalauthorizationclient.SelfSubjectAccessReviewsGetter
+
+	Verb           string
+	Resource       schema.GroupVersionResource
+	NonResourceURL string
+	Subresource    string
+	ResourceName   string
+
+	Out io.Writer
+	Err io.Writer
+}
+
+var (
+	canILong = templates.LongDesc(`
+		Check whether an action is allowed.
+
+		VERB is a logical Kubernetes API verb like 'get', 'list', 'watch', 'delete', etc.
+		TYPE is a Kubernetes resource. Shortcuts and groups will be resolved.
+		NONRESOURCEURL is a partial URL starts with "/".
+		NAME is the name of a particular Kubernetes resource.`)
+
+	canIExample = templates.Examples(`
+		# Check to see if I can create pods in any namespace
+		kubectl auth can-i create pods --all-namespaces
+
+		# Check to see if I can list deployments in my current namespace
+		kubectl auth can-i list deployments.extensions
+
+		# Check to see if I can do everything in my current namespace ("*" means all)
+		kubectl auth can-i '*' '*'
+
+		# Check to see if I can get the job named "bar" in namespace "foo"
+		kubectl auth can-i list jobs.batch/bar -n foo
+
+		# Check to see if I can read pod logs
+		kubectl auth can-i get pods --subresource=log
+
+		# Check to see if I can access the URL /logs/
+		kubectl auth can-i get /logs/`)
+)
+
+func NewCmdCanI(f cmdutil.Factory, out, err io.Writer) *cobra.Command {
+	o := &CanIOptions{
+		Out: out,
+		Err: err,
+	}
+
+	cmd := &cobra.Command{
+		Use:     "can-i VERB [TYPE | TYPE/NAME | NONRESOURCEURL]",
+		Short:   "Check whether an action is allowed",
+		Long:    canILong,
+		Example: canIExample,
+		Run: func(cmd *cobra.Command, args []string) {
+			cmdutil.CheckErr(o.Complete(f, args))
+			cmdutil.CheckErr(o.Validate())
+
+			allowed, err := o.RunAccessCheck()
+			if err == nil {
+				if o.Quiet && !allowed {
+					os.Exit(1)
+				}
+			}
+
+			cmdutil.CheckErr(err)
+		},
+	}
+
+	cmd.Flags().BoolVar(&o.AllNamespaces, "all-namespaces", o.AllNamespaces, "If true, check the specified action in all namespaces.")
+	cmd.Flags().BoolVarP(&o.Quiet, "quiet", "q", o.Quiet, "If true, suppress output and just return the exit code.")
+	cmd.Flags().StringVar(&o.Subresource, "subresource", "", "SubResource such as pod/log or deployment/scale")
+	return cmd
+}
+
+func (o *CanIOptions) Complete(f cmdutil.Factory, args []string) error {
+	if o.Quiet {
+		o.Out = ioutil.Discard
+	}
+
+	switch len(args) {
+	case 2:
+		o.Verb = args[0]
+		if strings.HasPrefix(args[1], "/") {
+			o.NonResourceURL = args[1]
+			break
+		}
+		resourceTokens := strings.SplitN(args[1], "/", 2)
+		restMapper, _ := f.Object()
+		o.Resource = o.resourceFor(restMapper, resourceTokens[0])
+		if len(resourceTokens) > 1 {
+			o.ResourceName = resourceTokens[1]
+		}
+	default:
+		return errors.New("you must specify two or three arguments: verb, resource, and optional resourceName")
+	}
+
+	var err error
+	client, err := f.ClientSet()
+	if err != nil {
+		return err
+	}
+	o.SelfSARClient = client.Authorization()
+
+	o.Namespace = ""
+	if !o.AllNamespaces {
+		o.Namespace, _, err = f.DefaultNamespace()
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (o *CanIOptions) Validate() error {
+	if o.NonResourceURL != "" {
+		if o.Subresource != "" {
+			return fmt.Errorf("--subresource can not be used with NonResourceURL")
+		}
+		if o.Resource != (schema.GroupVersionResource{}) || o.ResourceName != "" {
+			return fmt.Errorf("NonResourceURL and ResourceName can not specified together")
+		}
+	}
+	return nil
+}
+
+func (o *CanIOptions) RunAccessCheck() (bool, error) {
+	var sar *authorizationapi.SelfSubjectAccessReview
+	if o.NonResourceURL == "" {
+		sar = &authorizationapi.SelfSubjectAccessReview{
+			Spec: authorizationapi.SelfSubjectAccessReviewSpec{
+				ResourceAttributes: &authorizationapi.ResourceAttributes{
+					Namespace:   o.Namespace,
+					Verb:        o.Verb,
+					Group:       o.Resource.Group,
+					Resource:    o.Resource.Resource,
+					Subresource: o.Subresource,
+					Name:        o.ResourceName,
+				},
+			},
+		}
+	} else {
+		sar = &authorizationapi.SelfSubjectAccessReview{
+			Spec: authorizationapi.SelfSubjectAccessReviewSpec{
+				NonResourceAttributes: &authorizationapi.NonResourceAttributes{
+					Verb: o.Verb,
+					Path: o.NonResourceURL,
+				},
+			},
+		}
+
+	}
+
+	response, err := o.SelfSARClient.SelfSubjectAccessReviews().Create(sar)
+	if err != nil {
+		return false, err
+	}
+
+	if response.Status.Allowed {
+		fmt.Fprintln(o.Out, "yes")
+	} else {
+		fmt.Fprint(o.Out, "no")
+		if len(response.Status.Reason) > 0 {
+			fmt.Fprintf(o.Out, " - %v", response.Status.Reason)
+		}
+		if len(response.Status.EvaluationError) > 0 {
+			fmt.Fprintf(o.Out, " - %v", response.Status.EvaluationError)
+		}
+		fmt.Fprintln(o.Out)
+	}
+
+	return response.Status.Allowed, nil
+}
+
+func (o *CanIOptions) resourceFor(mapper meta.RESTMapper, resourceArg string) schema.GroupVersionResource {
+	if resourceArg == "*" {
+		return schema.GroupVersionResource{Resource: resourceArg}
+	}
+
+	fullySpecifiedGVR, groupResource := schema.ParseResourceArg(strings.ToLower(resourceArg))
+	gvr := schema.GroupVersionResource{}
+	if fullySpecifiedGVR != nil {
+		gvr, _ = mapper.ResourceFor(*fullySpecifiedGVR)
+	}
+	if gvr.Empty() {
+		var err error
+		gvr, err = mapper.ResourceFor(groupResource.WithVersion(""))
+		if err != nil {
+			if len(groupResource.Group) == 0 {
+				fmt.Fprintf(o.Err, "Warning: the server doesn't have a resource type '%s'\n", groupResource.Resource)
+			} else {
+				fmt.Fprintf(o.Err, "Warning: the server doesn't have a resource type '%s' in group '%s'\n", groupResource.Resource, groupResource.Group)
+			}
+			return schema.GroupVersionResource{Resource: resourceArg}
+		}
+	}
+
+	return gvr
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/auth/cani_test.go

@@ -0,0 +1,177 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package auth
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"strings"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/client-go/rest/fake"
+	cmdtesting "k8s.io/kubernetes/pkg/kubectl/cmd/testing"
+)
+
+func TestRunAccessCheck(t *testing.T) {
+	tests := []struct {
+		name      string
+		o         *CanIOptions
+		args      []string
+		allowed   bool
+		serverErr error
+
+		expectedBodyStrings []string
+	}{
+		{
+			name:    "restmapping for args",
+			o:       &CanIOptions{},
+			args:    []string{"get", "replicaset"},
+			allowed: true,
+			expectedBodyStrings: []string{
+				`{"resourceAttributes":{"namespace":"test","verb":"get","group":"extensions","resource":"replicasets"}}`,
+			},
+		},
+		{
+			name:    "simple success",
+			o:       &CanIOptions{},
+			args:    []string{"get", "deployments.extensions/foo"},
+			allowed: true,
+			expectedBodyStrings: []string{
+				`{"resourceAttributes":{"namespace":"test","verb":"get","group":"extensions","resource":"deployments","name":"foo"}}`,
+			},
+		},
+		{
+			name: "all namespaces",
+			o: &CanIOptions{
+				AllNamespaces: true,
+			},
+			args:    []string{"get", "deployments.extensions/foo"},
+			allowed: true,
+			expectedBodyStrings: []string{
+				`{"resourceAttributes":{"verb":"get","group":"extensions","resource":"deployments","name":"foo"}}`,
+			},
+		},
+		{
+			name: "disallowed",
+			o: &CanIOptions{
+				AllNamespaces: true,
+			},
+			args:    []string{"get", "deployments.extensions/foo"},
+			allowed: false,
+			expectedBodyStrings: []string{
+				`{"resourceAttributes":{"verb":"get","group":"extensions","resource":"deployments","name":"foo"}}`,
+			},
+		},
+		{
+			name: "forcedError",
+			o: &CanIOptions{
+				AllNamespaces: true,
+			},
+			args:      []string{"get", "deployments.extensions/foo"},
+			allowed:   false,
+			serverErr: fmt.Errorf("forcedError"),
+			expectedBodyStrings: []string{
+				`{"resourceAttributes":{"verb":"get","group":"extensions","resource":"deployments","name":"foo"}}`,
+			},
+		},
+		{
+			name: "sub resource",
+			o: &CanIOptions{
+				AllNamespaces: true,
+				Subresource:   "log",
+			},
+			args:    []string{"get", "pods"},
+			allowed: true,
+			expectedBodyStrings: []string{
+				`{"resourceAttributes":{"verb":"get","resource":"pods","subresource":"log"}}`,
+			},
+		},
+		{
+			name:    "nonResourceURL",
+			o:       &CanIOptions{},
+			args:    []string{"get", "/logs"},
+			allowed: true,
+			expectedBodyStrings: []string{
+				`{"nonResourceAttributes":{"path":"/logs","verb":"get"}}`,
+			},
+		},
+	}
+
+	for _, test := range tests {
+		test.o.Out = ioutil.Discard
+		test.o.Err = ioutil.Discard
+
+		f, tf, _, ns := cmdtesting.NewAPIFactory()
+		tf.Client = &fake.RESTClient{
+			GroupVersion:         schema.GroupVersion{Group: "", Version: "v1"},
+			NegotiatedSerializer: ns,
+			Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+				expectPath := "/apis/authorization.k8s.io/v1/selfsubjectaccessreviews"
+				if req.URL.Path != expectPath {
+					t.Errorf("%s: expected %v, got %v", test.name, expectPath, req.URL.Path)
+					return nil, nil
+				}
+				bodyBits, err := ioutil.ReadAll(req.Body)
+				if err != nil {
+					t.Errorf("%s: %v", test.name, err)
+					return nil, nil
+				}
+				body := string(bodyBits)
+
+				for _, expectedBody := range test.expectedBodyStrings {
+					if !strings.Contains(body, expectedBody) {
+						t.Errorf("%s expecting %s in %s", test.name, expectedBody, body)
+					}
+				}
+
+				return &http.Response{
+						StatusCode: http.StatusOK,
+						Body: ioutil.NopCloser(bytes.NewBufferString(
+							fmt.Sprintf(`{"kind":"SelfSubjectAccessReview","apiVersion":"authorization.k8s.io/v1","status":{"allowed":%v}}`, test.allowed),
+						)),
+					},
+					test.serverErr
+			}),
+		}
+		tf.Namespace = "test"
+		tf.ClientConfig = &restclient.Config{ContentConfig: restclient.ContentConfig{GroupVersion: &schema.GroupVersion{Group: "", Version: "v1"}}}
+
+		if err := test.o.Complete(f, test.args); err != nil {
+			t.Errorf("%s: %v", test.name, err)
+			continue
+		}
+
+		actualAllowed, err := test.o.RunAccessCheck()
+		switch {
+		case test.serverErr == nil && err == nil:
+			// pass
+		case err != nil && test.serverErr != nil && strings.Contains(err.Error(), test.serverErr.Error()):
+			// pass
+		default:
+			t.Errorf("%s: expected %v, got %v", test.name, test.serverErr, err)
+			continue
+		}
+		if actualAllowed != test.allowed {
+			t.Errorf("%s: expected %v, got %v", test.name, test.allowed, actualAllowed)
+			continue
+		}
+	}
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/auth/reconcile.go

@@ -0,0 +1,237 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package auth
+
+import (
+	"errors"
+	"io"
+
+	"github.com/golang/glog"
+	"github.com/spf13/cobra"
+
+	"k8s.io/kubernetes/pkg/apis/rbac"
+	internalcoreclient "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/typed/core/internalversion"
+	internalrbacclient "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset/typed/rbac/internalversion"
+	"k8s.io/kubernetes/pkg/kubectl/cmd/templates"
+	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+	"k8s.io/kubernetes/pkg/kubectl/resource"
+	"k8s.io/kubernetes/pkg/registry/rbac/reconciliation"
+)
+
+// ReconcileOptions is the start of the data required to perform the operation.  As new fields are added, add them here instead of
+// referencing the cmd.Flags()
+type ReconcileOptions struct {
+	Visitor         resource.Visitor
+	RBACClient      internalrbacclient.RbacInterface
+	NamespaceClient internalcoreclient.NamespaceInterface
+
+	Print func(*resource.Info) error
+
+	Out io.Writer
+	Err io.Writer
+}
+
+var (
+	reconcileLong = templates.LongDesc(`
+		Reconciles rules for RBAC Role, RoleBinding, ClusterRole, and ClusterRole binding objects.
+
+		This is preferred to 'apply' for RBAC resources so that proper rule coverage checks are done.`)
+
+	reconcileExample = templates.Examples(`
+		# Reconcile rbac resources from a file
+		kubectl auth reconcile -f my-rbac-rules.yaml`)
+)
+
+func NewCmdReconcile(f cmdutil.Factory, out, err io.Writer) *cobra.Command {
+	fileOptions := &resource.FilenameOptions{}
+	o := &ReconcileOptions{
+		Out: out,
+		Err: err,
+	}
+
+	cmd := &cobra.Command{
+		Use:     "reconcile -f FILENAME",
+		Short:   "Reconciles rules for RBAC Role, RoleBinding, ClusterRole, and ClusterRole binding objects",
+		Long:    reconcileLong,
+		Example: reconcileExample,
+		Run: func(cmd *cobra.Command, args []string) {
+			cmdutil.CheckErr(o.Complete(cmd, f, args, fileOptions))
+			cmdutil.CheckErr(o.Validate())
+			cmdutil.CheckErr(o.RunReconcile())
+		},
+	}
+
+	cmdutil.AddPrinterFlags(cmd)
+	usage := "identifying the resource to reconcile."
+	cmdutil.AddFilenameOptionFlags(cmd, fileOptions, usage)
+	cmd.MarkFlagRequired("filename")
+
+	return cmd
+}
+
+func (o *ReconcileOptions) Complete(cmd *cobra.Command, f cmdutil.Factory, args []string, options *resource.FilenameOptions) error {
+	if len(args) > 0 {
+		return errors.New("no arguments are allowed")
+	}
+
+	namespace, enforceNamespace, err := f.DefaultNamespace()
+	if err != nil {
+		return err
+	}
+
+	r := f.NewBuilder().
+		Internal().
+		ContinueOnError().
+		NamespaceParam(namespace).DefaultNamespace().
+		FilenameParam(enforceNamespace, options).
+		Flatten().
+		Do()
+
+	if err := r.Err(); err != nil {
+		return err
+	}
+	o.Visitor = r
+
+	client, err := f.ClientSet()
+	if err != nil {
+		return err
+	}
+	o.RBACClient = client.Rbac()
+	o.NamespaceClient = client.Core().Namespaces()
+
+	mapper, _ := f.Object()
+	dryRun := false
+	output := cmdutil.GetFlagString(cmd, "output")
+	shortOutput := output == "name"
+	o.Print = func(info *resource.Info) error {
+		if len(output) > 0 && !shortOutput {
+			return f.PrintResourceInfoForCommand(cmd, info, o.Out)
+		}
+		f.PrintSuccess(mapper, shortOutput, o.Out, info.Mapping.Resource, info.Name, dryRun, "reconciled")
+		return nil
+	}
+
+	return nil
+}
+
+func (o *ReconcileOptions) Validate() error {
+	if o.Visitor == nil {
+		return errors.New("ReconcileOptions.Visitor must be set")
+	}
+	if o.RBACClient == nil {
+		return errors.New("ReconcileOptions.RBACClient must be set")
+	}
+	if o.NamespaceClient == nil {
+		return errors.New("ReconcileOptions.NamespaceClient must be set")
+	}
+	if o.Print == nil {
+		return errors.New("ReconcileOptions.Print must be set")
+	}
+	if o.Out == nil {
+		return errors.New("ReconcileOptions.Out must be set")
+	}
+	if o.Err == nil {
+		return errors.New("ReconcileOptions.Err must be set")
+	}
+	return nil
+}
+
+func (o *ReconcileOptions) RunReconcile() error {
+	return o.Visitor.Visit(func(info *resource.Info, err error) error {
+		if err != nil {
+			return err
+		}
+
+		// shallowInfoCopy this is used to later twiddle the Object for printing
+		// we really need more straightforward printing options
+		shallowInfoCopy := *info
+
+		switch t := info.Object.(type) {
+		case *rbac.Role:
+			reconcileOptions := reconciliation.ReconcileRoleOptions{
+				Confirm:                true,
+				RemoveExtraPermissions: false,
+				Role: reconciliation.RoleRuleOwner{Role: t},
+				Client: reconciliation.RoleModifier{
+					NamespaceClient: o.NamespaceClient,
+					Client:          o.RBACClient,
+				},
+			}
+			result, err := reconcileOptions.Run()
+			if err != nil {
+				return err
+			}
+			shallowInfoCopy.Object = result.Role.GetObject()
+			o.Print(&shallowInfoCopy)
+
+		case *rbac.ClusterRole:
+			reconcileOptions := reconciliation.ReconcileRoleOptions{
+				Confirm:                true,
+				RemoveExtraPermissions: false,
+				Role: reconciliation.ClusterRoleRuleOwner{ClusterRole: t},
+				Client: reconciliation.ClusterRoleModifier{
+					Client: o.RBACClient.ClusterRoles(),
+				},
+			}
+			result, err := reconcileOptions.Run()
+			if err != nil {
+				return err
+			}
+			shallowInfoCopy.Object = result.Role.GetObject()
+			o.Print(&shallowInfoCopy)
+
+		case *rbac.RoleBinding:
+			reconcileOptions := reconciliation.ReconcileRoleBindingOptions{
+				Confirm:             true,
+				RemoveExtraSubjects: false,
+				RoleBinding:         reconciliation.RoleBindingAdapter{RoleBinding: t},
+				Client: reconciliation.RoleBindingClientAdapter{
+					Client:          o.RBACClient,
+					NamespaceClient: o.NamespaceClient,
+				},
+			}
+			result, err := reconcileOptions.Run()
+			if err != nil {
+				return err
+			}
+			shallowInfoCopy.Object = result.RoleBinding.GetObject()
+			o.Print(&shallowInfoCopy)
+
+		case *rbac.ClusterRoleBinding:
+			reconcileOptions := reconciliation.ReconcileRoleBindingOptions{
+				Confirm:             true,
+				RemoveExtraSubjects: false,
+				RoleBinding:         reconciliation.ClusterRoleBindingAdapter{ClusterRoleBinding: t},
+				Client: reconciliation.ClusterRoleBindingClientAdapter{
+					Client: o.RBACClient.ClusterRoleBindings(),
+				},
+			}
+			result, err := reconcileOptions.Run()
+			if err != nil {
+				return err
+			}
+			shallowInfoCopy.Object = result.RoleBinding.GetObject()
+			o.Print(&shallowInfoCopy)
+
+		default:
+			glog.V(1).Infof("skipping %#v", info.Object.GetObjectKind())
+			// skip ignored resources
+		}
+
+		return nil
+	})
+}