vendor files

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/BUILD

@@ -0,0 +1,99 @@
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "helper.go",
+        "set.go",
+        "set_env.go",
+        "set_image.go",
+        "set_resources.go",
+        "set_selector.go",
+        "set_serviceaccount.go",
+        "set_subject.go",
+    ],
+    importpath = "k8s.io/kubernetes/pkg/kubectl/cmd/set",
+    visibility = ["//build/visible_to:pkg_kubectl_cmd_set_CONSUMERS"],
+    deps = [
+        "//pkg/apis/rbac:go_default_library",
+        "//pkg/kubectl:go_default_library",
+        "//pkg/kubectl/cmd/templates:go_default_library",
+        "//pkg/kubectl/cmd/util:go_default_library",
+        "//pkg/kubectl/cmd/util/env:go_default_library",
+        "//pkg/kubectl/resource:go_default_library",
+        "//pkg/kubectl/util/i18n:go_default_library",
+        "//vendor/github.com/spf13/cobra:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/meta:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/types:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/errors:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/sets:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/strategicpatch:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/validation:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = [
+        "set_env_test.go",
+        "set_image_test.go",
+        "set_resources_test.go",
+        "set_selector_test.go",
+        "set_serviceaccount_test.go",
+        "set_subject_test.go",
+        "set_test.go",
+    ],
+    data = [
+        "//examples:config",
+        "//test/fixtures",
+    ],
+    importpath = "k8s.io/kubernetes/pkg/kubectl/cmd/set",
+    library = ":go_default_library",
+    deps = [
+        "//pkg/api/testapi:go_default_library",
+        "//pkg/apis/rbac:go_default_library",
+        "//pkg/kubectl/categories:go_default_library",
+        "//pkg/kubectl/cmd/testing:go_default_library",
+        "//pkg/kubectl/cmd/util:go_default_library",
+        "//pkg/kubectl/resource:go_default_library",
+        "//pkg/kubectl/scheme:go_default_library",
+        "//pkg/printers:go_default_library",
+        "//vendor/github.com/spf13/cobra:go_default_library",
+        "//vendor/github.com/stretchr/testify/assert:go_default_library",
+        "//vendor/k8s.io/api/apps/v1:go_default_library",
+        "//vendor/k8s.io/api/apps/v1beta1:go_default_library",
+        "//vendor/k8s.io/api/apps/v1beta2:go_default_library",
+        "//vendor/k8s.io/api/batch/v1:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/api/extensions/v1beta1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+        "//vendor/k8s.io/client-go/rest/fake:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = [
+        "//build/visible_to:pkg_kubectl_cmd_set_CONSUMERS",
+    ],
+)

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/helper.go

@@ -0,0 +1,187 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"fmt"
+	"io"
+	"strings"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/strategicpatch"
+	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+	"k8s.io/kubernetes/pkg/kubectl/resource"
+)
+
+// selectContainers allows one or more containers to be matched against a string or wildcard
+func selectContainers(containers []v1.Container, spec string) ([]*v1.Container, []*v1.Container) {
+	out := []*v1.Container{}
+	skipped := []*v1.Container{}
+	for i, c := range containers {
+		if selectString(c.Name, spec) {
+			out = append(out, &containers[i])
+		} else {
+			skipped = append(skipped, &containers[i])
+		}
+	}
+	return out, skipped
+}
+
+// handlePodUpdateError prints a more useful error to the end user when mutating a pod.
+func handlePodUpdateError(out io.Writer, err error, resource string) {
+	if statusError, ok := err.(*errors.StatusError); ok && errors.IsInvalid(err) {
+		errorDetails := statusError.Status().Details
+		if errorDetails.Kind == "Pod" {
+			all, match := true, false
+			for _, cause := range errorDetails.Causes {
+				if cause.Field == "spec" && strings.Contains(cause.Message, "may not update fields other than") {
+					fmt.Fprintf(out, "error: may not update %s in pod %q directly\n", resource, errorDetails.Name)
+					match = true
+				} else {
+					all = false
+				}
+			}
+			if all && match {
+				return
+			}
+		} else {
+			if ok := cmdutil.PrintErrorWithCauses(err, out); ok {
+				return
+			}
+		}
+	}
+
+	fmt.Fprintf(out, "error: %v\n", err)
+}
+
+// selectString returns true if the provided string matches spec, where spec is a string with
+// a non-greedy '*' wildcard operator.
+// TODO: turn into a regex and handle greedy matches and backtracking.
+func selectString(s, spec string) bool {
+	if spec == "*" {
+		return true
+	}
+	if !strings.Contains(spec, "*") {
+		return s == spec
+	}
+
+	pos := 0
+	match := true
+	parts := strings.Split(spec, "*")
+	for i, part := range parts {
+		if len(part) == 0 {
+			continue
+		}
+		next := strings.Index(s[pos:], part)
+		switch {
+		// next part not in string
+		case next < pos:
+			fallthrough
+		// first part does not match start of string
+		case i == 0 && pos != 0:
+			fallthrough
+		// last part does not exactly match remaining part of string
+		case i == (len(parts)-1) && len(s) != (len(part)+next):
+			match = false
+			break
+		default:
+			pos = next
+		}
+	}
+	return match
+}
+
+// Patch represents the result of a mutation to an object.
+type Patch struct {
+	Info *resource.Info
+	Err  error
+
+	Before []byte
+	After  []byte
+	Patch  []byte
+}
+
+// patchFn is a function type that accepts an info object and returns a byte slice.
+// Implementations of patchFn should update the object and return it encoded.
+type patchFn func(*resource.Info) ([]byte, error)
+
+// CalculatePatch calls the mutation function on the provided info object, and generates a strategic merge patch for
+// the changes in the object. Encoder must be able to encode the info into the appropriate destination type.
+// This function returns whether the mutation function made any change in the original object.
+func CalculatePatch(patch *Patch, encoder runtime.Encoder, mutateFn patchFn) bool {
+	patch.Before, patch.Err = runtime.Encode(encoder, patch.Info.Object)
+	patch.After, patch.Err = mutateFn(patch.Info)
+	if patch.Err != nil {
+		return true
+	}
+	if patch.After == nil {
+		return false
+	}
+
+	patch.Patch, patch.Err = strategicpatch.CreateTwoWayMergePatch(patch.Before, patch.After, patch.Info.Object)
+	return true
+}
+
+// CalculatePatches calculates patches on each provided info object. If the provided mutateFn
+// makes no change in an object, the object is not included in the final list of patches.
+func CalculatePatches(infos []*resource.Info, encoder runtime.Encoder, mutateFn patchFn) []*Patch {
+	var patches []*Patch
+	for _, info := range infos {
+		patch := &Patch{Info: info}
+		if CalculatePatch(patch, encoder, mutateFn) {
+			patches = append(patches, patch)
+		}
+	}
+	return patches
+}
+
+func findEnv(env []v1.EnvVar, name string) (v1.EnvVar, bool) {
+	for _, e := range env {
+		if e.Name == name {
+			return e, true
+		}
+	}
+	return v1.EnvVar{}, false
+}
+
+func updateEnv(existing []v1.EnvVar, env []v1.EnvVar, remove []string) []v1.EnvVar {
+	out := []v1.EnvVar{}
+	covered := sets.NewString(remove...)
+	for _, e := range existing {
+		if covered.Has(e.Name) {
+			continue
+		}
+		newer, ok := findEnv(env, e.Name)
+		if ok {
+			covered.Insert(e.Name)
+			out = append(out, newer)
+			continue
+		}
+		out = append(out, e)
+	}
+	for _, e := range env {
+		if covered.Has(e.Name) {
+			continue
+		}
+		covered.Insert(e.Name)
+		out = append(out, e)
+	}
+	return out
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set.go

@@ -0,0 +1,52 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"io"
+
+	"github.com/spf13/cobra"
+	"k8s.io/kubernetes/pkg/kubectl/cmd/templates"
+	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+	"k8s.io/kubernetes/pkg/kubectl/util/i18n"
+)
+
+var (
+	set_long = templates.LongDesc(`
+		Configure application resources
+
+		These commands help you make changes to existing application resources.`)
+)
+
+func NewCmdSet(f cmdutil.Factory, in io.Reader, out, err io.Writer) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "set SUBCOMMAND",
+		Short: i18n.T("Set specific features on objects"),
+		Long:  set_long,
+		Run:   cmdutil.DefaultSubCommandRun(err),
+	}
+
+	// add subcommands
+	cmd.AddCommand(NewCmdImage(f, out, err))
+	cmd.AddCommand(NewCmdResources(f, out, err))
+	cmd.AddCommand(NewCmdSelector(f, out))
+	cmd.AddCommand(NewCmdSubject(f, out, err))
+	cmd.AddCommand(NewCmdServiceAccount(f, out, err))
+	cmd.AddCommand(NewCmdEnv(f, in, out, err))
+
+	return cmd
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_env.go

@@ -0,0 +1,445 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"regexp"
+	"sort"
+	"strings"
+
+	"github.com/spf13/cobra"
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/kubernetes/pkg/kubectl/cmd/templates"
+	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+	envutil "k8s.io/kubernetes/pkg/kubectl/cmd/util/env"
+	"k8s.io/kubernetes/pkg/kubectl/resource"
+
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+)
+
+var (
+	validEnvNameRegexp = regexp.MustCompile("[^a-zA-Z0-9_]")
+	envResources       = `
+  	pod (po), replicationcontroller (rc), deployment (deploy), daemonset (ds), job, replicaset (rs)`
+
+	envLong = templates.LongDesc(`
+		Update environment variables on a pod template.
+
+		List environment variable definitions in one or more pods, pod templates.
+		Add, update, or remove container environment variable definitions in one or
+		more pod templates (within replication controllers or deployment configurations).
+		View or modify the environment variable definitions on all containers in the
+		specified pods or pod templates, or just those that match a wildcard.
+
+		If "--env -" is passed, environment variables can be read from STDIN using the standard env
+		syntax.
+
+		Possible resources include (case insensitive):
+		` + envResources)
+
+	envExample = templates.Examples(`
+		# Update deployment 'registry' with a new environment variable
+	  kubectl set env deployment/registry STORAGE_DIR=/local
+
+	  # List the environment variables defined on a deployments 'sample-build'
+	  kubectl set env deployment/sample-build --list
+
+	  # List the environment variables defined on all pods
+	  kubectl set env pods --all --list
+
+	  # Output modified deployment in YAML, and does not alter the object on the server
+	  kubectl set env deployment/sample-build STORAGE_DIR=/data -o yaml
+
+	  # Update all containers in all replication controllers in the project to have ENV=prod
+	  kubectl set env rc --all ENV=prod
+
+	  # Import environment from a secret
+	  kubectl set env --from=secret/mysecret deployment/myapp
+
+	  # Import environment from a config map with a prefix
+	  kubectl set env --from=configmap/myconfigmap --prefix=MYSQL_ deployment/myapp
+
+	  # Remove the environment variable ENV from container 'c1' in all deployment configs
+	  kubectl set env deployments --all --containers="c1" ENV-
+
+	  # Remove the environment variable ENV from a deployment definition on disk and
+	  # update the deployment config on the server
+	  kubectl set env -f deploy.json ENV-
+
+	  # Set some of the local shell environment into a deployment config on the server
+	  env | grep RAILS_ | kubectl set env -e - deployment/registry`)
+)
+
+type EnvOptions struct {
+	Out io.Writer
+	Err io.Writer
+	In  io.Reader
+
+	resource.FilenameOptions
+	EnvParams []string
+	EnvArgs   []string
+	Resources []string
+
+	All         bool
+	Resolve     bool
+	List        bool
+	ShortOutput bool
+	Local       bool
+	Overwrite   bool
+	DryRun      bool
+
+	ResourceVersion   string
+	ContainerSelector string
+	Selector          string
+	Output            string
+	From              string
+	Prefix            string
+
+	Mapper  meta.RESTMapper
+	Builder *resource.Builder
+	Infos   []*resource.Info
+	Encoder runtime.Encoder
+
+	Cmd *cobra.Command
+
+	UpdatePodSpecForObject func(obj runtime.Object, fn func(*v1.PodSpec) error) (bool, error)
+	PrintObject            func(cmd *cobra.Command, isLocal bool, mapper meta.RESTMapper, obj runtime.Object, out io.Writer) error
+}
+
+// NewCmdEnv implements the OpenShift cli env command
+func NewCmdEnv(f cmdutil.Factory, in io.Reader, out, errout io.Writer) *cobra.Command {
+	options := &EnvOptions{
+		Out: out,
+		Err: errout,
+		In:  in,
+	}
+	cmd := &cobra.Command{
+		Use:     "env RESOURCE/NAME KEY_1=VAL_1 ... KEY_N=VAL_N",
+		Short:   "Update environment variables on a pod template",
+		Long:    envLong,
+		Example: fmt.Sprintf(envExample),
+		Run: func(cmd *cobra.Command, args []string) {
+			cmdutil.CheckErr(options.Complete(f, cmd, args))
+			cmdutil.CheckErr(options.RunEnv(f))
+		},
+	}
+	usage := "the resource to update the env"
+	cmdutil.AddFilenameOptionFlags(cmd, &options.FilenameOptions, usage)
+	cmd.Flags().StringVarP(&options.ContainerSelector, "containers", "c", "*", "The names of containers in the selected pod templates to change - may use wildcards")
+	cmd.Flags().StringP("from", "", "", "The name of a resource from which to inject environment variables")
+	cmd.Flags().StringP("prefix", "", "", "Prefix to append to variable names")
+	cmd.Flags().StringArrayVarP(&options.EnvParams, "env", "e", options.EnvParams, "Specify a key-value pair for an environment variable to set into each container.")
+	cmd.Flags().BoolVar(&options.List, "list", options.List, "If true, display the environment and any changes in the standard format. this flag will removed when we have kubectl view env.")
+	cmd.Flags().BoolVar(&options.Resolve, "resolve", options.Resolve, "If true, show secret or configmap references when listing variables")
+	cmd.Flags().StringVarP(&options.Selector, "selector", "l", options.Selector, "Selector (label query) to filter on")
+	cmd.Flags().BoolVar(&options.Local, "local", false, "If true, set env will NOT contact api-server but run locally.")
+	cmd.Flags().BoolVar(&options.All, "all", options.All, "If true, select all resources in the namespace of the specified resource types")
+	cmd.Flags().BoolVar(&options.Overwrite, "overwrite", true, "If true, allow environment to be overwritten, otherwise reject updates that overwrite existing environment.")
+
+	cmdutil.AddDryRunFlag(cmd)
+	cmdutil.AddPrinterFlags(cmd)
+
+	return cmd
+}
+
+func validateNoOverwrites(existing []v1.EnvVar, env []v1.EnvVar) error {
+	for _, e := range env {
+		if current, exists := findEnv(existing, e.Name); exists && current.Value != e.Value {
+			return fmt.Errorf("'%s' already has a value (%s), and --overwrite is false", current.Name, current.Value)
+		}
+	}
+	return nil
+}
+
+func keyToEnvName(key string) string {
+	return strings.ToUpper(validEnvNameRegexp.ReplaceAllString(key, "_"))
+}
+
+func (o *EnvOptions) Complete(f cmdutil.Factory, cmd *cobra.Command, args []string) error {
+	resources, envArgs, ok := envutil.SplitEnvironmentFromResources(args)
+	if !ok {
+		return cmdutil.UsageErrorf(o.Cmd, "all resources must be specified before environment changes: %s", strings.Join(args, " "))
+	}
+	if len(o.Filenames) == 0 && len(resources) < 1 {
+		return cmdutil.UsageErrorf(cmd, "one or more resources must be specified as <resource> <name> or <resource>/<name>")
+	}
+
+	o.Mapper, _ = f.Object()
+	o.UpdatePodSpecForObject = f.UpdatePodSpecForObject
+	o.Encoder = f.JSONEncoder()
+	o.ContainerSelector = cmdutil.GetFlagString(cmd, "containers")
+	o.List = cmdutil.GetFlagBool(cmd, "list")
+	o.Resolve = cmdutil.GetFlagBool(cmd, "resolve")
+	o.Selector = cmdutil.GetFlagString(cmd, "selector")
+	o.All = cmdutil.GetFlagBool(cmd, "all")
+	o.Overwrite = cmdutil.GetFlagBool(cmd, "overwrite")
+	o.Output = cmdutil.GetFlagString(cmd, "output")
+	o.From = cmdutil.GetFlagString(cmd, "from")
+	o.Prefix = cmdutil.GetFlagString(cmd, "prefix")
+	o.DryRun = cmdutil.GetDryRunFlag(cmd)
+	o.PrintObject = f.PrintObject
+
+	o.EnvArgs = envArgs
+	o.Resources = resources
+	o.Cmd = cmd
+
+	o.ShortOutput = cmdutil.GetFlagString(cmd, "output") == "name"
+
+	if o.List && len(o.Output) > 0 {
+		return cmdutil.UsageErrorf(o.Cmd, "--list and --output may not be specified together")
+	}
+
+	return nil
+}
+
+// RunEnv contains all the necessary functionality for the OpenShift cli env command
+func (o *EnvOptions) RunEnv(f cmdutil.Factory) error {
+	var kubeClient *kubernetes.Clientset
+	if o.List {
+		client, err := f.KubernetesClientSet()
+		if err != nil {
+			return err
+		}
+		kubeClient = client
+	}
+
+	cmdNamespace, enforceNamespace, err := f.DefaultNamespace()
+	if err != nil {
+		return err
+	}
+
+	env, remove, err := envutil.ParseEnv(append(o.EnvParams, o.EnvArgs...), o.In)
+	if err != nil {
+		return err
+	}
+
+	if len(o.From) != 0 {
+		b := f.NewBuilder().
+			Internal().
+			LocalParam(o.Local).
+			ContinueOnError().
+			NamespaceParam(cmdNamespace).DefaultNamespace().
+			FilenameParam(enforceNamespace, &o.FilenameOptions).
+			Flatten()
+
+		if !o.Local {
+			b = b.
+				LabelSelectorParam(o.Selector).
+				ResourceTypeOrNameArgs(o.All, o.From).
+				Latest()
+		}
+
+		infos, err := b.Do().Infos()
+		if err != nil {
+			return err
+		}
+
+		for _, info := range infos {
+			versionedObject, err := info.Mapping.ConvertToVersion(info.Object, info.Mapping.GroupVersionKind.GroupVersion())
+			if err != nil {
+				return err
+			}
+			switch from := versionedObject.(type) {
+			case *v1.Secret:
+				for key := range from.Data {
+					envVar := v1.EnvVar{
+						Name: keyToEnvName(key),
+						ValueFrom: &v1.EnvVarSource{
+							SecretKeyRef: &v1.SecretKeySelector{
+								LocalObjectReference: v1.LocalObjectReference{
+									Name: from.Name,
+								},
+								Key: key,
+							},
+						},
+					}
+					env = append(env, envVar)
+				}
+			case *v1.ConfigMap:
+				for key := range from.Data {
+					envVar := v1.EnvVar{
+						Name: keyToEnvName(key),
+						ValueFrom: &v1.EnvVarSource{
+							ConfigMapKeyRef: &v1.ConfigMapKeySelector{
+								LocalObjectReference: v1.LocalObjectReference{
+									Name: from.Name,
+								},
+								Key: key,
+							},
+						},
+					}
+					env = append(env, envVar)
+				}
+			default:
+				return fmt.Errorf("unsupported resource specified in --from")
+			}
+		}
+	}
+
+	if len(o.Prefix) != 0 {
+		for i := range env {
+			env[i].Name = fmt.Sprintf("%s%s", o.Prefix, env[i].Name)
+		}
+	}
+
+	b := f.NewBuilder().
+		Internal().
+		LocalParam(o.Local).
+		ContinueOnError().
+		NamespaceParam(cmdNamespace).DefaultNamespace().
+		FilenameParam(enforceNamespace, &o.FilenameOptions).
+		Flatten()
+
+	if !o.Local {
+		b.LabelSelectorParam(o.Selector).
+			ResourceTypeOrNameArgs(o.All, o.Resources...).
+			Latest()
+	}
+
+	o.Infos, err = b.Do().Infos()
+	if err != nil {
+		return err
+	}
+	patches := CalculatePatches(o.Infos, o.Encoder, func(info *resource.Info) ([]byte, error) {
+		info.Object = info.AsVersioned()
+		_, err := o.UpdatePodSpecForObject(info.Object, func(spec *v1.PodSpec) error {
+			resolutionErrorsEncountered := false
+			containers, _ := selectContainers(spec.Containers, o.ContainerSelector)
+			if len(containers) == 0 {
+				fmt.Fprintf(o.Err, "warning: %s/%s does not have any containers matching %q\n", info.Mapping.Resource, info.Name, o.ContainerSelector)
+				return nil
+			}
+			for _, c := range containers {
+				if !o.Overwrite {
+					if err := validateNoOverwrites(c.Env, env); err != nil {
+						return err
+					}
+				}
+
+				c.Env = updateEnv(c.Env, env, remove)
+				if o.List {
+					resolveErrors := map[string][]string{}
+					store := envutil.NewResourceStore()
+
+					fmt.Fprintf(o.Out, "# %s %s, container %s\n", info.Mapping.Resource, info.Name, c.Name)
+					for _, env := range c.Env {
+						// Print the simple value
+						if env.ValueFrom == nil {
+							fmt.Fprintf(o.Out, "%s=%s\n", env.Name, env.Value)
+							continue
+						}
+
+						// Print the reference version
+						if !o.Resolve {
+							fmt.Fprintf(o.Out, "# %s from %s\n", env.Name, envutil.GetEnvVarRefString(env.ValueFrom))
+							continue
+						}
+
+						value, err := envutil.GetEnvVarRefValue(kubeClient, cmdNamespace, store, env.ValueFrom, info.Object, c)
+						// Print the resolved value
+						if err == nil {
+							fmt.Fprintf(o.Out, "%s=%s\n", env.Name, value)
+							continue
+						}
+
+						// Print the reference version and save the resolve error
+						fmt.Fprintf(o.Out, "# %s from %s\n", env.Name, envutil.GetEnvVarRefString(env.ValueFrom))
+						errString := err.Error()
+						resolveErrors[errString] = append(resolveErrors[errString], env.Name)
+						resolutionErrorsEncountered = true
+					}
+
+					// Print any resolution errors
+					errs := []string{}
+					for err, vars := range resolveErrors {
+						sort.Strings(vars)
+						errs = append(errs, fmt.Sprintf("error retrieving reference for %s: %v", strings.Join(vars, ", "), err))
+					}
+					sort.Strings(errs)
+					for _, err := range errs {
+						fmt.Fprintln(o.Err, err)
+					}
+				}
+			}
+			if resolutionErrorsEncountered {
+				return errors.New("failed to retrieve valueFrom references")
+			}
+			return nil
+		})
+
+		if err == nil {
+			return runtime.Encode(o.Encoder, info.Object)
+		}
+		return nil, err
+	})
+
+	if o.List {
+		return nil
+	}
+
+	allErrs := []error{}
+
+	for _, patch := range patches {
+		info := patch.Info
+		if patch.Err != nil {
+			allErrs = append(allErrs, fmt.Errorf("error: %s/%s %v\n", info.Mapping.Resource, info.Name, patch.Err))
+			continue
+		}
+
+		// no changes
+		if string(patch.Patch) == "{}" || len(patch.Patch) == 0 {
+			continue
+		}
+
+		if o.PrintObject != nil && (o.Local || o.DryRun) {
+			if err := o.PrintObject(o.Cmd, o.Local, o.Mapper, patch.Info.AsVersioned(), o.Out); err != nil {
+				return err
+			}
+			continue
+		}
+
+		obj, err := resource.NewHelper(info.Client, info.Mapping).Patch(info.Namespace, info.Name, types.StrategicMergePatchType, patch.Patch)
+		if err != nil {
+			allErrs = append(allErrs, fmt.Errorf("failed to patch env update to pod template: %v\n", err))
+			continue
+		}
+		info.Refresh(obj, true)
+
+		// make sure arguments to set or replace environment variables are set
+		// before returning a successful message
+		if len(env) == 0 && len(o.EnvArgs) == 0 {
+			return fmt.Errorf("at least one environment variable must be provided")
+		}
+
+		if len(o.Output) > 0 {
+			if err := o.PrintObject(o.Cmd, o.Local, o.Mapper, info.AsVersioned(), o.Out); err != nil {
+				return err
+			}
+			continue
+		}
+
+		f.PrintSuccess(o.Mapper, o.ShortOutput, o.Out, info.Mapping.Resource, info.Name, false, "env updated")
+	}
+	return utilerrors.NewAggregate(allErrs)
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_env_test.go

@@ -0,0 +1,479 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"os"
+	"path"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	appsv1 "k8s.io/api/apps/v1"
+	appsv1beta1 "k8s.io/api/apps/v1beta1"
+	appsv1beta2 "k8s.io/api/apps/v1beta2"
+	batchv1 "k8s.io/api/batch/v1"
+	"k8s.io/api/core/v1"
+	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/client-go/rest/fake"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	"k8s.io/kubernetes/pkg/kubectl/categories"
+	cmdtesting "k8s.io/kubernetes/pkg/kubectl/cmd/testing"
+	"k8s.io/kubernetes/pkg/kubectl/resource"
+	"k8s.io/kubernetes/pkg/kubectl/scheme"
+	"k8s.io/kubernetes/pkg/printers"
+)
+
+func TestSetEnvLocal(t *testing.T) {
+	f, tf, codec, ns := cmdtesting.NewAPIFactory()
+	tf.Client = &fake.RESTClient{
+		GroupVersion:         schema.GroupVersion{Version: ""},
+		NegotiatedSerializer: ns,
+		Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+			t.Fatalf("unexpected request: %s %#v\n%#v", req.Method, req.URL, req)
+			return nil, nil
+		}),
+	}
+	tf.Namespace = "test"
+	tf.ClientConfig = &restclient.Config{ContentConfig: restclient.ContentConfig{GroupVersion: &schema.GroupVersion{Version: ""}}}
+
+	buf := bytes.NewBuffer([]byte{})
+	cmd := NewCmdEnv(f, os.Stdin, buf, buf)
+	cmd.SetOutput(buf)
+	cmd.Flags().Set("output", "name")
+	cmd.Flags().Set("local", "true")
+	mapper, typer := f.Object()
+	tf.Printer = &printers.NamePrinter{Decoders: []runtime.Decoder{codec}, Typer: typer, Mapper: mapper}
+
+	opts := EnvOptions{FilenameOptions: resource.FilenameOptions{
+		Filenames: []string{"../../../../examples/storage/cassandra/cassandra-controller.yaml"}},
+		Out:   buf,
+		Local: true}
+	err := opts.Complete(f, cmd, []string{"env=prod"})
+	if err == nil {
+		err = opts.RunEnv(f)
+	}
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !strings.Contains(buf.String(), "replicationcontrollers/cassandra") {
+		t.Errorf("did not set env: %s", buf.String())
+	}
+}
+
+func TestSetMultiResourcesEnvLocal(t *testing.T) {
+	f, tf, codec, ns := cmdtesting.NewAPIFactory()
+	tf.Client = &fake.RESTClient{
+		GroupVersion:         schema.GroupVersion{Version: ""},
+		NegotiatedSerializer: ns,
+		Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+			t.Fatalf("unexpected request: %s %#v\n%#v", req.Method, req.URL, req)
+			return nil, nil
+		}),
+	}
+	tf.Namespace = "test"
+	tf.ClientConfig = &restclient.Config{ContentConfig: restclient.ContentConfig{GroupVersion: &schema.GroupVersion{Version: ""}}}
+
+	buf := bytes.NewBuffer([]byte{})
+	cmd := NewCmdEnv(f, os.Stdin, buf, buf)
+	cmd.SetOutput(buf)
+	cmd.Flags().Set("output", "name")
+	cmd.Flags().Set("local", "true")
+	mapper, typer := f.Object()
+	tf.Printer = &printers.NamePrinter{Decoders: []runtime.Decoder{codec}, Typer: typer, Mapper: mapper}
+
+	opts := EnvOptions{FilenameOptions: resource.FilenameOptions{
+		Filenames: []string{"../../../../test/fixtures/pkg/kubectl/cmd/set/multi-resource-yaml.yaml"}},
+		Out:   buf,
+		Local: true}
+	err := opts.Complete(f, cmd, []string{"env=prod"})
+	if err == nil {
+		err = opts.RunEnv(f)
+	}
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	expectedOut := "replicationcontrollers/first-rc\nreplicationcontrollers/second-rc\n"
+	if buf.String() != expectedOut {
+		t.Errorf("expected out:\n%s\nbut got:\n%s", expectedOut, buf.String())
+	}
+}
+
+func TestSetEnvRemote(t *testing.T) {
+	inputs := []struct {
+		object                          runtime.Object
+		apiPrefix, apiGroup, apiVersion string
+		testAPIGroup                    string
+		args                            []string
+	}{
+		{
+			object: &extensionsv1beta1.ReplicaSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: extensionsv1beta1.ReplicaSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "extensions", apiVersion: "v1beta1",
+			args: []string{"replicaset", "nginx", "env=prod"},
+		},
+		{
+			object: &appsv1beta2.ReplicaSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.ReplicaSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"replicaset", "nginx", "env=prod"},
+		},
+		{
+			object: &appsv1.ReplicaSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.ReplicaSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"replicaset", "nginx", "env=prod"},
+		},
+		{
+			object: &extensionsv1beta1.DaemonSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: extensionsv1beta1.DaemonSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "extensions", apiVersion: "v1beta1",
+			args: []string{"daemonset", "nginx", "env=prod"},
+		},
+		{
+			object: &appsv1beta2.DaemonSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.DaemonSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"daemonset", "nginx", "env=prod"},
+		},
+		{
+			object: &appsv1.DaemonSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.DaemonSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"daemonset", "nginx", "env=prod"},
+		},
+		{
+			object: &extensionsv1beta1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: extensionsv1beta1.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "extensions", apiVersion: "v1beta1",
+			args: []string{"deployment", "nginx", "env=prod"},
+		},
+		{
+			object: &appsv1beta1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta1.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta1",
+			args: []string{"deployment", "nginx", "env=prod"},
+		},
+		{
+			object: &appsv1beta2.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"deployment", "nginx", "env=prod"},
+		},
+		{
+			object: &appsv1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"deployment", "nginx", "env=prod"},
+		},
+		{
+			object: &appsv1beta1.StatefulSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta1.StatefulSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "apps",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta1",
+			args: []string{"statefulset", "nginx", "env=prod"},
+		},
+		{
+			object: &appsv1beta2.StatefulSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.StatefulSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "apps",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"statefulset", "nginx", "env=prod"},
+		},
+		{
+			object: &appsv1.StatefulSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.StatefulSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "apps",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"statefulset", "nginx", "env=prod"},
+		},
+		{
+			object: &batchv1.Job{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: batchv1.JobSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "batch",
+			apiPrefix:    "/apis", apiGroup: "batch", apiVersion: "v1",
+			args: []string{"job", "nginx", "env=prod"},
+		},
+		{
+			object: &v1.ReplicationController{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: v1.ReplicationControllerSpec{
+					Template: &v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "",
+			apiPrefix:    "/api", apiGroup: "", apiVersion: "v1",
+			args: []string{"replicationcontroller", "nginx", "env=prod"},
+		},
+	}
+	for _, input := range inputs {
+		groupVersion := schema.GroupVersion{Group: input.apiGroup, Version: input.apiVersion}
+		testapi.Default = testapi.Groups[input.testAPIGroup]
+		f, tf, _, ns := cmdtesting.NewAPIFactory()
+		codec := scheme.Codecs.CodecForVersions(scheme.Codecs.LegacyCodec(groupVersion), scheme.Codecs.UniversalDecoder(groupVersion), groupVersion, groupVersion)
+		tf.Printer = printers.NewVersionedPrinter(&printers.YAMLPrinter{}, testapi.Default.Converter(), *testapi.Default.GroupVersion())
+		tf.Namespace = "test"
+		tf.CategoryExpander = categories.LegacyCategoryExpander
+		tf.Client = &fake.RESTClient{
+			GroupVersion:         groupVersion,
+			NegotiatedSerializer: ns,
+			Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+				resourcePath := testapi.Default.ResourcePath(input.args[0]+"s", tf.Namespace, input.args[1])
+				switch p, m := req.URL.Path, req.Method; {
+				case p == resourcePath && m == http.MethodGet:
+					return &http.Response{StatusCode: http.StatusOK, Header: defaultHeader(), Body: objBody(codec, input.object)}, nil
+				case p == resourcePath && m == http.MethodPatch:
+					stream, err := req.GetBody()
+					if err != nil {
+						return nil, err
+					}
+					bytes, err := ioutil.ReadAll(stream)
+					if err != nil {
+						return nil, err
+					}
+					assert.Contains(t, string(bytes), `"value":`+`"`+"prod"+`"`, fmt.Sprintf("env not updated for %#v", input.object))
+					return &http.Response{StatusCode: http.StatusOK, Header: defaultHeader(), Body: objBody(codec, input.object)}, nil
+				default:
+					t.Errorf("%s: unexpected request: %s %#v\n%#v", "image", req.Method, req.URL, req)
+					return nil, fmt.Errorf("unexpected request")
+				}
+			}),
+			VersionedAPIPath: path.Join(input.apiPrefix, testapi.Default.GroupVersion().String()),
+		}
+		out := new(bytes.Buffer)
+		cmd := NewCmdEnv(f, out, out, out)
+		cmd.SetOutput(out)
+		cmd.Flags().Set("output", "yaml")
+		opts := EnvOptions{
+			Out:   out,
+			Local: false}
+		err := opts.Complete(f, cmd, input.args)
+		assert.NoError(t, err)
+		err = opts.RunEnv(f)
+		assert.NoError(t, err)
+	}
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_image.go

@@ -0,0 +1,299 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/spf13/cobra"
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+	"k8s.io/kubernetes/pkg/kubectl/cmd/templates"
+	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+	"k8s.io/kubernetes/pkg/kubectl/resource"
+	"k8s.io/kubernetes/pkg/kubectl/util/i18n"
+)
+
+// ImageOptions is the start of the data required to perform the operation.  As new fields are added, add them here instead of
+// referencing the cmd.Flags()
+type ImageOptions struct {
+	resource.FilenameOptions
+
+	Mapper       meta.RESTMapper
+	Infos        []*resource.Info
+	Encoder      runtime.Encoder
+	Decoder      runtime.Decoder
+	Selector     string
+	Out          io.Writer
+	Err          io.Writer
+	DryRun       bool
+	ShortOutput  bool
+	All          bool
+	Record       bool
+	Output       string
+	ChangeCause  string
+	Local        bool
+	Cmd          *cobra.Command
+	ResolveImage func(in string) (string, error)
+
+	PrintSuccess           func(mapper meta.RESTMapper, shortOutput bool, out io.Writer, resource, name string, dryRun bool, operation string)
+	PrintObject            func(cmd *cobra.Command, isLocal bool, mapper meta.RESTMapper, obj runtime.Object, out io.Writer) error
+	UpdatePodSpecForObject func(obj runtime.Object, fn func(*v1.PodSpec) error) (bool, error)
+	Resources              []string
+	ContainerImages        map[string]string
+}
+
+var (
+	image_resources = `
+  	pod (po), replicationcontroller (rc), deployment (deploy), daemonset (ds), replicaset (rs)`
+
+	image_long = templates.LongDesc(`
+		Update existing container image(s) of resources.
+
+		Possible resources include (case insensitive):
+		` + image_resources)
+
+	image_example = templates.Examples(`
+		# Set a deployment's nginx container image to 'nginx:1.9.1', and its busybox container image to 'busybox'.
+		kubectl set image deployment/nginx busybox=busybox nginx=nginx:1.9.1
+
+		# Update all deployments' and rc's nginx container's image to 'nginx:1.9.1'
+		kubectl set image deployments,rc nginx=nginx:1.9.1 --all
+
+		# Update image of all containers of daemonset abc to 'nginx:1.9.1'
+		kubectl set image daemonset abc *=nginx:1.9.1
+
+		# Print result (in yaml format) of updating nginx container image from local file, without hitting the server
+		kubectl set image -f path/to/file.yaml nginx=nginx:1.9.1 --local -o yaml`)
+)
+
+func NewCmdImage(f cmdutil.Factory, out, err io.Writer) *cobra.Command {
+	options := &ImageOptions{
+		Out: out,
+		Err: err,
+	}
+
+	cmd := &cobra.Command{
+		Use:     "image (-f FILENAME | TYPE NAME) CONTAINER_NAME_1=CONTAINER_IMAGE_1 ... CONTAINER_NAME_N=CONTAINER_IMAGE_N",
+		Short:   i18n.T("Update image of a pod template"),
+		Long:    image_long,
+		Example: image_example,
+		Run: func(cmd *cobra.Command, args []string) {
+			cmdutil.CheckErr(options.Complete(f, cmd, args))
+			cmdutil.CheckErr(options.Validate())
+			cmdutil.CheckErr(options.Run())
+		},
+	}
+
+	cmdutil.AddPrinterFlags(cmd)
+	usage := "identifying the resource to get from a server."
+	cmdutil.AddFilenameOptionFlags(cmd, &options.FilenameOptions, usage)
+	cmd.Flags().BoolVar(&options.All, "all", false, "Select all resources, including uninitialized ones, in the namespace of the specified resource types")
+	cmd.Flags().StringVarP(&options.Selector, "selector", "l", "", "Selector (label query) to filter on, not including uninitialized ones, supports '=', '==', and '!='.(e.g. -l key1=value1,key2=value2)")
+	cmd.Flags().BoolVar(&options.Local, "local", false, "If true, set image will NOT contact api-server but run locally.")
+	cmdutil.AddRecordFlag(cmd)
+	cmdutil.AddDryRunFlag(cmd)
+	cmdutil.AddIncludeUninitializedFlag(cmd)
+	return cmd
+}
+
+func (o *ImageOptions) Complete(f cmdutil.Factory, cmd *cobra.Command, args []string) error {
+	o.Mapper, _ = f.Object()
+	o.PrintSuccess = f.PrintSuccess
+	o.UpdatePodSpecForObject = f.UpdatePodSpecForObject
+	o.Encoder = f.JSONEncoder()
+	o.Decoder = f.Decoder(true)
+	o.ShortOutput = cmdutil.GetFlagString(cmd, "output") == "name"
+	o.Record = cmdutil.GetRecordFlag(cmd)
+	o.ChangeCause = f.Command(cmd, false)
+	o.PrintObject = f.PrintObject
+	o.Local = cmdutil.GetFlagBool(cmd, "local")
+	o.DryRun = cmdutil.GetDryRunFlag(cmd)
+	o.Output = cmdutil.GetFlagString(cmd, "output")
+	o.ResolveImage = f.ResolveImage
+	o.Cmd = cmd
+
+	cmdNamespace, enforceNamespace, err := f.DefaultNamespace()
+	if err != nil {
+		return err
+	}
+
+	o.Resources, o.ContainerImages, err = getResourcesAndImages(args)
+	if err != nil {
+		return err
+	}
+
+	includeUninitialized := cmdutil.ShouldIncludeUninitialized(cmd, false)
+	builder := f.NewBuilder().
+		Internal().
+		LocalParam(o.Local).
+		ContinueOnError().
+		NamespaceParam(cmdNamespace).DefaultNamespace().
+		FilenameParam(enforceNamespace, &o.FilenameOptions).
+		IncludeUninitialized(includeUninitialized).
+		Flatten()
+
+	if !o.Local {
+		builder.LabelSelectorParam(o.Selector).
+			ResourceTypeOrNameArgs(o.All, o.Resources...).
+			Latest()
+	} else {
+		// if a --local flag was provided, and a resource was specified in the form
+		// <resource>/<name>, fail immediately as --local cannot query the api server
+		// for the specified resource.
+		if len(o.Resources) > 0 {
+			return resource.LocalResourceError
+		}
+	}
+
+	o.Infos, err = builder.Do().Infos()
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (o *ImageOptions) Validate() error {
+	errors := []error{}
+	if len(o.Resources) < 1 && cmdutil.IsFilenameSliceEmpty(o.Filenames) {
+		errors = append(errors, fmt.Errorf("one or more resources must be specified as <resource> <name> or <resource>/<name>"))
+	}
+	if len(o.ContainerImages) < 1 {
+		errors = append(errors, fmt.Errorf("at least one image update is required"))
+	} else if len(o.ContainerImages) > 1 && hasWildcardKey(o.ContainerImages) {
+		errors = append(errors, fmt.Errorf("all containers are already specified by *, but saw more than one container_name=container_image pairs"))
+	}
+	return utilerrors.NewAggregate(errors)
+}
+
+func (o *ImageOptions) Run() error {
+	allErrs := []error{}
+
+	patches := CalculatePatches(o.Infos, o.Encoder, func(info *resource.Info) ([]byte, error) {
+		transformed := false
+		info.Object = info.AsVersioned()
+		_, err := o.UpdatePodSpecForObject(info.Object, func(spec *v1.PodSpec) error {
+			for name, image := range o.ContainerImages {
+				var (
+					containerFound bool
+					err            error
+					resolved       string
+				)
+				// Find the container to update, and update its image
+				for i, c := range spec.Containers {
+					if c.Name == name || name == "*" {
+						containerFound = true
+						if len(resolved) == 0 {
+							if resolved, err = o.ResolveImage(image); err != nil {
+								allErrs = append(allErrs, fmt.Errorf("error: unable to resolve image %q for container %q: %v", image, name, err))
+								// Do not loop again if the image resolving failed for wildcard case as we
+								// will report the same error again for the next container.
+								if name == "*" {
+									break
+								}
+								continue
+							}
+						}
+						if spec.Containers[i].Image != resolved {
+							spec.Containers[i].Image = resolved
+							// Perform updates
+							transformed = true
+						}
+					}
+				}
+				// Add a new container if not found
+				if !containerFound {
+					allErrs = append(allErrs, fmt.Errorf("error: unable to find container named %q", name))
+				}
+			}
+			return nil
+		})
+		if transformed && err == nil {
+			return runtime.Encode(o.Encoder, info.Object)
+		}
+		return nil, err
+	})
+
+	for _, patch := range patches {
+		info := patch.Info
+		if patch.Err != nil {
+			allErrs = append(allErrs, fmt.Errorf("error: %s/%s %v\n", info.Mapping.Resource, info.Name, patch.Err))
+			continue
+		}
+
+		// no changes
+		if string(patch.Patch) == "{}" || len(patch.Patch) == 0 {
+			continue
+		}
+
+		if o.PrintObject != nil && (o.Local || o.DryRun) {
+			if err := o.PrintObject(o.Cmd, o.Local, o.Mapper, patch.Info.AsVersioned(), o.Out); err != nil {
+				return err
+			}
+			continue
+		}
+
+		// patch the change
+		obj, err := resource.NewHelper(info.Client, info.Mapping).Patch(info.Namespace, info.Name, types.StrategicMergePatchType, patch.Patch)
+		if err != nil {
+			allErrs = append(allErrs, fmt.Errorf("failed to patch image update to pod template: %v\n", err))
+			continue
+		}
+		info.Refresh(obj, true)
+
+		// record this change (for rollout history)
+		if o.Record || cmdutil.ContainsChangeCause(info) {
+			if patch, patchType, err := cmdutil.ChangeResourcePatch(info, o.ChangeCause); err == nil {
+				if obj, err = resource.NewHelper(info.Client, info.Mapping).Patch(info.Namespace, info.Name, patchType, patch); err != nil {
+					fmt.Fprintf(o.Err, "WARNING: changes to %s/%s can't be recorded: %v\n", info.Mapping.Resource, info.Name, err)
+				}
+			}
+		}
+
+		info.Refresh(obj, true)
+
+		if len(o.Output) > 0 {
+			if err := o.PrintObject(o.Cmd, o.Local, o.Mapper, info.AsVersioned(), o.Out); err != nil {
+				return err
+			}
+			continue
+		}
+		o.PrintSuccess(o.Mapper, o.ShortOutput, o.Out, info.Mapping.Resource, info.Name, o.DryRun, "image updated")
+	}
+	return utilerrors.NewAggregate(allErrs)
+}
+
+// getResourcesAndImages retrieves resources and container name:images pair from given args
+func getResourcesAndImages(args []string) (resources []string, containerImages map[string]string, err error) {
+	pairType := "image"
+	resources, imageArgs, err := cmdutil.GetResourcesAndPairs(args, pairType)
+	if err != nil {
+		return
+	}
+	containerImages, _, err = cmdutil.ParsePairs(imageArgs, pairType, false)
+	return
+}
+
+func hasWildcardKey(containerImages map[string]string) bool {
+	_, ok := containerImages["*"]
+	return ok
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_image_test.go

@@ -0,0 +1,546 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"path"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	appsv1 "k8s.io/api/apps/v1"
+	appsv1beta1 "k8s.io/api/apps/v1beta1"
+	appsv1beta2 "k8s.io/api/apps/v1beta2"
+	batchv1 "k8s.io/api/batch/v1"
+	"k8s.io/api/core/v1"
+	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/client-go/rest/fake"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	"k8s.io/kubernetes/pkg/kubectl/categories"
+	cmdtesting "k8s.io/kubernetes/pkg/kubectl/cmd/testing"
+	"k8s.io/kubernetes/pkg/kubectl/resource"
+	"k8s.io/kubernetes/pkg/kubectl/scheme"
+	"k8s.io/kubernetes/pkg/printers"
+)
+
+func TestImageLocal(t *testing.T) {
+	f, tf, codec, ns := cmdtesting.NewAPIFactory()
+	tf.Client = &fake.RESTClient{
+		GroupVersion:         schema.GroupVersion{Version: ""},
+		NegotiatedSerializer: ns,
+		Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+			t.Fatalf("unexpected request: %s %#v\n%#v", req.Method, req.URL, req)
+			return nil, nil
+		}),
+	}
+	tf.Namespace = "test"
+	tf.ClientConfig = &restclient.Config{ContentConfig: restclient.ContentConfig{GroupVersion: &schema.GroupVersion{Version: ""}}}
+
+	buf := bytes.NewBuffer([]byte{})
+	cmd := NewCmdImage(f, buf, buf)
+	cmd.SetOutput(buf)
+	cmd.Flags().Set("output", "name")
+	cmd.Flags().Set("local", "true")
+	mapper, typer := f.Object()
+	tf.Printer = &printers.NamePrinter{Decoders: []runtime.Decoder{codec}, Typer: typer, Mapper: mapper}
+
+	opts := ImageOptions{FilenameOptions: resource.FilenameOptions{
+		Filenames: []string{"../../../../examples/storage/cassandra/cassandra-controller.yaml"}},
+		Out:   buf,
+		Local: true}
+	err := opts.Complete(f, cmd, []string{"cassandra=thingy"})
+	if err == nil {
+		err = opts.Validate()
+	}
+	if err == nil {
+		err = opts.Run()
+	}
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !strings.Contains(buf.String(), "replicationcontrollers/cassandra") {
+		t.Errorf("did not set image: %s", buf.String())
+	}
+}
+
+func TestSetImageValidation(t *testing.T) {
+	testCases := []struct {
+		name         string
+		imageOptions *ImageOptions
+		expectErr    string
+	}{
+		{
+			name:         "test resource < 1 and filenames empty",
+			imageOptions: &ImageOptions{},
+			expectErr:    "[one or more resources must be specified as <resource> <name> or <resource>/<name>, at least one image update is required]",
+		},
+		{
+			name: "test containerImages < 1",
+			imageOptions: &ImageOptions{
+				Resources: []string{"a", "b", "c"},
+
+				FilenameOptions: resource.FilenameOptions{
+					Filenames: []string{"testFile"},
+				},
+			},
+			expectErr: "at least one image update is required",
+		},
+		{
+			name: "test containerImages > 1 and all containers are already specified by *",
+			imageOptions: &ImageOptions{
+				Resources: []string{"a", "b", "c"},
+				FilenameOptions: resource.FilenameOptions{
+					Filenames: []string{"testFile"},
+				},
+				ContainerImages: map[string]string{
+					"test": "test",
+					"*":    "test",
+				},
+			},
+			expectErr: "all containers are already specified by *, but saw more than one container_name=container_image pairs",
+		},
+		{
+			name: "sucess case",
+			imageOptions: &ImageOptions{
+				Resources: []string{"a", "b", "c"},
+				FilenameOptions: resource.FilenameOptions{
+					Filenames: []string{"testFile"},
+				},
+				ContainerImages: map[string]string{
+					"test": "test",
+				},
+			},
+			expectErr: "",
+		},
+	}
+	for _, testCase := range testCases {
+		err := testCase.imageOptions.Validate()
+		if err != nil {
+			if err.Error() != testCase.expectErr {
+				t.Errorf("[%s]:expect err:%s got err:%s", testCase.name, testCase.expectErr, err.Error())
+			}
+		}
+		if err == nil && (testCase.expectErr != "") {
+			t.Errorf("[%s]:expect err:%s got err:%v", testCase.name, testCase.expectErr, err)
+		}
+	}
+}
+
+func TestSetMultiResourcesImageLocal(t *testing.T) {
+	f, tf, codec, ns := cmdtesting.NewAPIFactory()
+	tf.Client = &fake.RESTClient{
+		GroupVersion:         schema.GroupVersion{Version: ""},
+		NegotiatedSerializer: ns,
+		Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+			t.Fatalf("unexpected request: %s %#v\n%#v", req.Method, req.URL, req)
+			return nil, nil
+		}),
+	}
+	tf.Namespace = "test"
+	tf.ClientConfig = &restclient.Config{ContentConfig: restclient.ContentConfig{GroupVersion: &schema.GroupVersion{Version: ""}}}
+
+	buf := bytes.NewBuffer([]byte{})
+	cmd := NewCmdImage(f, buf, buf)
+	cmd.SetOutput(buf)
+	cmd.Flags().Set("output", "name")
+	cmd.Flags().Set("local", "true")
+	mapper, typer := f.Object()
+	tf.Printer = &printers.NamePrinter{Decoders: []runtime.Decoder{codec}, Typer: typer, Mapper: mapper}
+
+	opts := ImageOptions{FilenameOptions: resource.FilenameOptions{
+		Filenames: []string{"../../../../test/fixtures/pkg/kubectl/cmd/set/multi-resource-yaml.yaml"}},
+		Out:   buf,
+		Local: true}
+	err := opts.Complete(f, cmd, []string{"*=thingy"})
+	if err == nil {
+		err = opts.Validate()
+	}
+	if err == nil {
+		err = opts.Run()
+	}
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	expectedOut := "replicationcontrollers/first-rc\nreplicationcontrollers/second-rc\n"
+	if buf.String() != expectedOut {
+		t.Errorf("expected out:\n%s\nbut got:\n%s", expectedOut, buf.String())
+	}
+}
+
+func TestSetImageRemote(t *testing.T) {
+	inputs := []struct {
+		object                          runtime.Object
+		apiPrefix, apiGroup, apiVersion string
+		testAPIGroup                    string
+		args                            []string
+	}{
+		{
+			object: &extensionsv1beta1.ReplicaSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: extensionsv1beta1.ReplicaSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "extensions", apiVersion: "v1beta1",
+			args: []string{"replicaset", "nginx", "*=thingy"},
+		},
+		{
+			object: &appsv1beta2.ReplicaSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.ReplicaSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"replicaset", "nginx", "*=thingy"},
+		},
+		{
+			object: &appsv1.ReplicaSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.ReplicaSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"replicaset", "nginx", "*=thingy"},
+		},
+		{
+			object: &extensionsv1beta1.DaemonSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: extensionsv1beta1.DaemonSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "extensions", apiVersion: "v1beta1",
+			args: []string{"daemonset", "nginx", "*=thingy"},
+		},
+		{
+			object: &appsv1beta2.DaemonSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.DaemonSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"daemonset", "nginx", "*=thingy"},
+		},
+		{
+			object: &appsv1.DaemonSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.DaemonSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"daemonset", "nginx", "*=thingy"},
+		},
+		{
+			object: &extensionsv1beta1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: extensionsv1beta1.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "extensions", apiVersion: "v1beta1",
+			args: []string{"deployment", "nginx", "*=thingy"},
+		},
+		{
+			object: &appsv1beta1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta1.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta1",
+			args: []string{"deployment", "nginx", "*=thingy"},
+		},
+		{
+			object: &appsv1beta2.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"deployment", "nginx", "*=thingy"},
+		},
+		{
+			object: &appsv1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"deployment", "nginx", "*=thingy"},
+		},
+		{
+			object: &appsv1beta1.StatefulSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta1.StatefulSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "apps",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta1",
+			args: []string{"statefulset", "nginx", "*=thingy"},
+		},
+		{
+			object: &appsv1beta2.StatefulSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.StatefulSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "apps",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"statefulset", "nginx", "*=thingy"},
+		},
+		{
+			object: &appsv1.StatefulSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.StatefulSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "apps",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"statefulset", "nginx", "*=thingy"},
+		},
+		{
+			object: &batchv1.Job{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: batchv1.JobSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "batch",
+			apiPrefix:    "/apis", apiGroup: "batch", apiVersion: "v1",
+			args: []string{"job", "nginx", "*=thingy"},
+		},
+		{
+			object: &v1.ReplicationController{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: v1.ReplicationControllerSpec{
+					Template: &v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "",
+			apiPrefix:    "/api", apiGroup: "", apiVersion: "v1",
+			args: []string{"replicationcontroller", "nginx", "*=thingy"},
+		},
+	}
+	for _, input := range inputs {
+		groupVersion := schema.GroupVersion{Group: input.apiGroup, Version: input.apiVersion}
+		testapi.Default = testapi.Groups[input.testAPIGroup]
+		f, tf, _, ns := cmdtesting.NewAPIFactory()
+		codec := scheme.Codecs.CodecForVersions(scheme.Codecs.LegacyCodec(groupVersion), scheme.Codecs.UniversalDecoder(groupVersion), groupVersion, groupVersion)
+		tf.Printer = printers.NewVersionedPrinter(&printers.YAMLPrinter{}, testapi.Default.Converter(), *testapi.Default.GroupVersion())
+		tf.Namespace = "test"
+		tf.CategoryExpander = categories.LegacyCategoryExpander
+		tf.Client = &fake.RESTClient{
+			GroupVersion:         groupVersion,
+			NegotiatedSerializer: ns,
+			Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+				resourcePath := testapi.Default.ResourcePath(input.args[0]+"s", tf.Namespace, input.args[1])
+				switch p, m := req.URL.Path, req.Method; {
+				case p == resourcePath && m == http.MethodGet:
+					return &http.Response{StatusCode: http.StatusOK, Header: defaultHeader(), Body: objBody(codec, input.object)}, nil
+				case p == resourcePath && m == http.MethodPatch:
+					stream, err := req.GetBody()
+					if err != nil {
+						return nil, err
+					}
+					bytes, err := ioutil.ReadAll(stream)
+					if err != nil {
+						return nil, err
+					}
+					assert.Contains(t, string(bytes), `"image":`+`"`+"thingy"+`"`, fmt.Sprintf("image not updated for %#v", input.object))
+					return &http.Response{StatusCode: http.StatusOK, Header: defaultHeader(), Body: objBody(codec, input.object)}, nil
+				default:
+					t.Errorf("%s: unexpected request: %s %#v\n%#v", "image", req.Method, req.URL, req)
+					return nil, fmt.Errorf("unexpected request")
+				}
+			}),
+			VersionedAPIPath: path.Join(input.apiPrefix, testapi.Default.GroupVersion().String()),
+		}
+		out := new(bytes.Buffer)
+		cmd := NewCmdImage(f, out, out)
+		cmd.SetOutput(out)
+		cmd.Flags().Set("output", "yaml")
+		opts := ImageOptions{
+			Out:   out,
+			Local: false}
+		err := opts.Complete(f, cmd, input.args)
+		assert.NoError(t, err)
+		err = opts.Run()
+		assert.NoError(t, err)
+	}
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_resources.go

@@ -0,0 +1,274 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/spf13/cobra"
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/meta"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+	"k8s.io/kubernetes/pkg/kubectl"
+	"k8s.io/kubernetes/pkg/kubectl/cmd/templates"
+	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+	"k8s.io/kubernetes/pkg/kubectl/resource"
+	"k8s.io/kubernetes/pkg/kubectl/util/i18n"
+)
+
+var (
+	resources_long = templates.LongDesc(`
+		Specify compute resource requirements (cpu, memory) for any resource that defines a pod template.  If a pod is successfully scheduled, it is guaranteed the amount of resource requested, but may burst up to its specified limits.
+
+		for each compute resource, if a limit is specified and a request is omitted, the request will default to the limit.
+
+		Possible resources include (case insensitive): %s.`)
+
+	resources_example = templates.Examples(`
+		# Set a deployments nginx container cpu limits to "200m" and memory to "512Mi"
+		kubectl set resources deployment nginx -c=nginx --limits=cpu=200m,memory=512Mi
+
+		# Set the resource request and limits for all containers in nginx
+		kubectl set resources deployment nginx --limits=cpu=200m,memory=512Mi --requests=cpu=100m,memory=256Mi
+
+		# Remove the resource requests for resources on containers in nginx
+		kubectl set resources deployment nginx --limits=cpu=0,memory=0 --requests=cpu=0,memory=0
+
+		# Print the result (in yaml format) of updating nginx container limits from a local, without hitting the server
+		kubectl set resources -f path/to/file.yaml --limits=cpu=200m,memory=512Mi --local -o yaml`)
+)
+
+// ResourcesOptions is the start of the data required to perform the operation. As new fields are added, add them here instead of
+// referencing the cmd.Flags
+type ResourcesOptions struct {
+	resource.FilenameOptions
+
+	Mapper            meta.RESTMapper
+	Infos             []*resource.Info
+	Encoder           runtime.Encoder
+	Out               io.Writer
+	Err               io.Writer
+	Selector          string
+	ContainerSelector string
+	Output            string
+	All               bool
+	Record            bool
+	ChangeCause       string
+	Local             bool
+	Cmd               *cobra.Command
+
+	Limits               string
+	Requests             string
+	ResourceRequirements v1.ResourceRequirements
+
+	PrintSuccess           func(mapper meta.RESTMapper, shortOutput bool, out io.Writer, resource, name string, dryRun bool, operation string)
+	PrintObject            func(cmd *cobra.Command, isLocal bool, mapper meta.RESTMapper, obj runtime.Object, out io.Writer) error
+	UpdatePodSpecForObject func(obj runtime.Object, fn func(*v1.PodSpec) error) (bool, error)
+	Resources              []string
+}
+
+func NewCmdResources(f cmdutil.Factory, out io.Writer, errOut io.Writer) *cobra.Command {
+	options := &ResourcesOptions{
+		Out: out,
+		Err: errOut,
+	}
+
+	resourceTypesWithPodTemplate := []string{}
+	for _, resource := range f.SuggestedPodTemplateResources() {
+		resourceTypesWithPodTemplate = append(resourceTypesWithPodTemplate, resource.Resource)
+	}
+
+	cmd := &cobra.Command{
+		Use:     "resources (-f FILENAME | TYPE NAME)  ([--limits=LIMITS & --requests=REQUESTS]",
+		Short:   i18n.T("Update resource requests/limits on objects with pod templates"),
+		Long:    fmt.Sprintf(resources_long, strings.Join(resourceTypesWithPodTemplate, ", ")),
+		Example: resources_example,
+		Run: func(cmd *cobra.Command, args []string) {
+			cmdutil.CheckErr(options.Complete(f, cmd, args))
+			cmdutil.CheckErr(options.Validate())
+			cmdutil.CheckErr(options.Run())
+		},
+	}
+
+	cmdutil.AddPrinterFlags(cmd)
+	//usage := "Filename, directory, or URL to a file identifying the resource to get from the server"
+	//kubectl.AddJsonFilenameFlag(cmd, &options.Filenames, usage)
+	usage := "identifying the resource to get from a server."
+	cmdutil.AddFilenameOptionFlags(cmd, &options.FilenameOptions, usage)
+	cmd.Flags().BoolVar(&options.All, "all", false, "Select all resources, including uninitialized ones, in the namespace of the specified resource types")
+	cmd.Flags().StringVarP(&options.Selector, "selector", "l", "", "Selector (label query) to filter on, not including uninitialized ones,supports '=', '==', and '!='.(e.g. -l key1=value1,key2=value2)")
+	cmd.Flags().StringVarP(&options.ContainerSelector, "containers", "c", "*", "The names of containers in the selected pod templates to change, all containers are selected by default - may use wildcards")
+	cmd.Flags().BoolVar(&options.Local, "local", false, "If true, set resources will NOT contact api-server but run locally.")
+	cmdutil.AddDryRunFlag(cmd)
+	cmdutil.AddRecordFlag(cmd)
+	cmdutil.AddIncludeUninitializedFlag(cmd)
+	cmd.Flags().StringVar(&options.Limits, "limits", options.Limits, "The resource requirement requests for this container.  For example, 'cpu=100m,memory=256Mi'.  Note that server side components may assign requests depending on the server configuration, such as limit ranges.")
+	cmd.Flags().StringVar(&options.Requests, "requests", options.Requests, "The resource requirement requests for this container.  For example, 'cpu=100m,memory=256Mi'.  Note that server side components may assign requests depending on the server configuration, such as limit ranges.")
+	return cmd
+}
+
+func (o *ResourcesOptions) Complete(f cmdutil.Factory, cmd *cobra.Command, args []string) error {
+	o.Mapper, _ = f.Object()
+	o.PrintSuccess = f.PrintSuccess
+	o.UpdatePodSpecForObject = f.UpdatePodSpecForObject
+	o.Encoder = f.JSONEncoder()
+	o.Output = cmdutil.GetFlagString(cmd, "output")
+	o.Record = cmdutil.GetRecordFlag(cmd)
+	o.Local = cmdutil.GetFlagBool(cmd, "local")
+	o.ChangeCause = f.Command(cmd, false)
+	o.PrintObject = f.PrintObject
+	o.Cmd = cmd
+
+	cmdNamespace, enforceNamespace, err := f.DefaultNamespace()
+	if err != nil {
+		return err
+	}
+
+	includeUninitialized := cmdutil.ShouldIncludeUninitialized(cmd, false)
+	builder := f.NewBuilder().
+		Internal().
+		LocalParam(o.Local).
+		ContinueOnError().
+		NamespaceParam(cmdNamespace).DefaultNamespace().
+		FilenameParam(enforceNamespace, &o.FilenameOptions).
+		IncludeUninitialized(includeUninitialized).
+		Flatten()
+
+	if !o.Local {
+		builder.LabelSelectorParam(o.Selector).
+			ResourceTypeOrNameArgs(o.All, args...).
+			Latest()
+	} else {
+		// if a --local flag was provided, and a resource was specified in the form
+		// <resource>/<name>, fail immediately as --local cannot query the api server
+		// for the specified resource.
+		// TODO: this should be in the builder - if someone specifies tuples, fail when
+		// local is true
+		if len(args) > 0 {
+			return resource.LocalResourceError
+		}
+	}
+
+	o.Infos, err = builder.Do().Infos()
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func (o *ResourcesOptions) Validate() error {
+	var err error
+	if len(o.Limits) == 0 && len(o.Requests) == 0 {
+		return fmt.Errorf("you must specify an update to requests or limits (in the form of --requests/--limits)")
+	}
+
+	o.ResourceRequirements, err = kubectl.HandleResourceRequirementsV1(map[string]string{"limits": o.Limits, "requests": o.Requests})
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (o *ResourcesOptions) Run() error {
+	allErrs := []error{}
+	patches := CalculatePatches(o.Infos, o.Encoder, func(info *resource.Info) ([]byte, error) {
+		transformed := false
+		info.Object = info.AsVersioned()
+		_, err := o.UpdatePodSpecForObject(info.Object, func(spec *v1.PodSpec) error {
+			containers, _ := selectContainers(spec.Containers, o.ContainerSelector)
+			if len(containers) != 0 {
+				for i := range containers {
+					if len(o.Limits) != 0 && len(containers[i].Resources.Limits) == 0 {
+						containers[i].Resources.Limits = make(v1.ResourceList)
+					}
+					for key, value := range o.ResourceRequirements.Limits {
+						containers[i].Resources.Limits[key] = value
+					}
+
+					if len(o.Requests) != 0 && len(containers[i].Resources.Requests) == 0 {
+						containers[i].Resources.Requests = make(v1.ResourceList)
+					}
+					for key, value := range o.ResourceRequirements.Requests {
+						containers[i].Resources.Requests[key] = value
+					}
+					transformed = true
+				}
+			} else {
+				allErrs = append(allErrs, fmt.Errorf("error: unable to find container named %s", o.ContainerSelector))
+			}
+			return nil
+		})
+		if transformed && err == nil {
+			return runtime.Encode(o.Encoder, info.Object)
+		}
+		return nil, err
+	})
+
+	for _, patch := range patches {
+		info := patch.Info
+		if patch.Err != nil {
+			allErrs = append(allErrs, fmt.Errorf("error: %s/%s %v\n", info.Mapping.Resource, info.Name, patch.Err))
+			continue
+		}
+
+		//no changes
+		if string(patch.Patch) == "{}" || len(patch.Patch) == 0 {
+			allErrs = append(allErrs, fmt.Errorf("info: %s %q was not changed\n", info.Mapping.Resource, info.Name))
+			continue
+		}
+
+		if o.Local || cmdutil.GetDryRunFlag(o.Cmd) {
+			if err := o.PrintObject(o.Cmd, o.Local, o.Mapper, patch.Info.AsVersioned(), o.Out); err != nil {
+				return err
+			}
+			continue
+		}
+
+		obj, err := resource.NewHelper(info.Client, info.Mapping).Patch(info.Namespace, info.Name, types.StrategicMergePatchType, patch.Patch)
+		if err != nil {
+			allErrs = append(allErrs, fmt.Errorf("failed to patch limit update to pod template %v\n", err))
+			continue
+		}
+		info.Refresh(obj, true)
+
+		//record this change (for rollout history)
+		if o.Record || cmdutil.ContainsChangeCause(info) {
+			if err := cmdutil.RecordChangeCause(obj, o.ChangeCause); err == nil {
+				if obj, err = resource.NewHelper(info.Client, info.Mapping).Replace(info.Namespace, info.Name, false, obj); err != nil {
+					allErrs = append(allErrs, fmt.Errorf("changes to %s/%s can't be recorded: %v\n", info.Mapping.Resource, info.Name, err))
+				}
+			}
+		}
+		info.Refresh(obj, true)
+
+		shortOutput := o.Output == "name"
+		if len(o.Output) > 0 && !shortOutput {
+			if err := o.PrintObject(o.Cmd, o.Local, o.Mapper, info.AsVersioned(), o.Out); err != nil {
+				return err
+			}
+			continue
+		}
+		o.PrintSuccess(o.Mapper, shortOutput, o.Out, info.Mapping.Resource, info.Name, false, "resource requirements updated")
+	}
+	return utilerrors.NewAggregate(allErrs)
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_resources_test.go

@@ -0,0 +1,500 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"path"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	appsv1 "k8s.io/api/apps/v1"
+	appsv1beta1 "k8s.io/api/apps/v1beta1"
+	appsv1beta2 "k8s.io/api/apps/v1beta2"
+	batchv1 "k8s.io/api/batch/v1"
+	"k8s.io/api/core/v1"
+	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/client-go/rest/fake"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	"k8s.io/kubernetes/pkg/kubectl/categories"
+	cmdtesting "k8s.io/kubernetes/pkg/kubectl/cmd/testing"
+	"k8s.io/kubernetes/pkg/kubectl/resource"
+	"k8s.io/kubernetes/pkg/kubectl/scheme"
+	"k8s.io/kubernetes/pkg/printers"
+)
+
+func TestResourcesLocal(t *testing.T) {
+	f, tf, codec, ns := cmdtesting.NewAPIFactory()
+	tf.Client = &fake.RESTClient{
+		GroupVersion:         schema.GroupVersion{Version: ""},
+		NegotiatedSerializer: ns,
+		Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+			t.Fatalf("unexpected request: %s %#v\n%#v", req.Method, req.URL, req)
+			return nil, nil
+		}),
+	}
+	tf.Namespace = "test"
+	tf.ClientConfig = &restclient.Config{ContentConfig: restclient.ContentConfig{GroupVersion: &schema.GroupVersion{Version: ""}}}
+
+	buf := bytes.NewBuffer([]byte{})
+	cmd := NewCmdResources(f, buf, buf)
+	cmd.SetOutput(buf)
+	cmd.Flags().Set("output", "name")
+	cmd.Flags().Set("local", "true")
+	mapper, typer := f.Object()
+	tf.Printer = &printers.NamePrinter{Decoders: []runtime.Decoder{codec}, Typer: typer, Mapper: mapper}
+
+	opts := ResourcesOptions{FilenameOptions: resource.FilenameOptions{
+		Filenames: []string{"../../../../examples/storage/cassandra/cassandra-controller.yaml"}},
+		Out:               buf,
+		Local:             true,
+		Limits:            "cpu=200m,memory=512Mi",
+		Requests:          "cpu=200m,memory=512Mi",
+		ContainerSelector: "*"}
+
+	err := opts.Complete(f, cmd, []string{})
+	if err == nil {
+		err = opts.Validate()
+	}
+	if err == nil {
+		err = opts.Run()
+	}
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !strings.Contains(buf.String(), "replicationcontrollers/cassandra") {
+		t.Errorf("did not set resources: %s", buf.String())
+	}
+}
+
+func TestSetMultiResourcesLimitsLocal(t *testing.T) {
+	f, tf, codec, ns := cmdtesting.NewAPIFactory()
+	tf.Client = &fake.RESTClient{
+		GroupVersion:         schema.GroupVersion{Version: ""},
+		NegotiatedSerializer: ns,
+		Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+			t.Fatalf("unexpected request: %s %#v\n%#v", req.Method, req.URL, req)
+			return nil, nil
+		}),
+	}
+	tf.Namespace = "test"
+	tf.ClientConfig = &restclient.Config{ContentConfig: restclient.ContentConfig{GroupVersion: &schema.GroupVersion{Version: ""}}}
+
+	buf := bytes.NewBuffer([]byte{})
+	cmd := NewCmdResources(f, buf, buf)
+	cmd.SetOutput(buf)
+	cmd.Flags().Set("output", "name")
+	cmd.Flags().Set("local", "true")
+	mapper, typer := f.Object()
+	tf.Printer = &printers.NamePrinter{Decoders: []runtime.Decoder{codec}, Typer: typer, Mapper: mapper}
+
+	opts := ResourcesOptions{FilenameOptions: resource.FilenameOptions{
+		Filenames: []string{"../../../../test/fixtures/pkg/kubectl/cmd/set/multi-resource-yaml.yaml"}},
+		Out:               buf,
+		Local:             true,
+		Limits:            "cpu=200m,memory=512Mi",
+		Requests:          "cpu=200m,memory=512Mi",
+		ContainerSelector: "*"}
+
+	err := opts.Complete(f, cmd, []string{})
+	if err == nil {
+		err = opts.Validate()
+	}
+	if err == nil {
+		err = opts.Run()
+	}
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	expectedOut := "replicationcontrollers/first-rc\nreplicationcontrollers/second-rc\n"
+	if buf.String() != expectedOut {
+		t.Errorf("expected out:\n%s\nbut got:\n%s", expectedOut, buf.String())
+	}
+}
+
+func TestSetResourcesRemote(t *testing.T) {
+	inputs := []struct {
+		object                          runtime.Object
+		apiPrefix, apiGroup, apiVersion string
+		testAPIGroup                    string
+		args                            []string
+	}{
+		{
+			object: &extensionsv1beta1.ReplicaSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: extensionsv1beta1.ReplicaSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "extensions", apiVersion: "v1beta1",
+			args: []string{"replicaset", "nginx"},
+		},
+		{
+			object: &appsv1beta2.ReplicaSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.ReplicaSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"replicaset", "nginx"},
+		},
+		{
+			object: &appsv1.ReplicaSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.ReplicaSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"replicaset", "nginx"},
+		},
+		{
+			object: &extensionsv1beta1.DaemonSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: extensionsv1beta1.DaemonSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "extensions", apiVersion: "v1beta1",
+			args: []string{"daemonset", "nginx"},
+		},
+		{
+			object: &appsv1beta2.DaemonSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.DaemonSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"daemonset", "nginx"},
+		},
+		{
+			object: &appsv1.DaemonSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.DaemonSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"daemonset", "nginx"},
+		},
+		{
+			object: &extensionsv1beta1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: extensionsv1beta1.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "extensions", apiVersion: "v1beta1",
+			args: []string{"deployment", "nginx"},
+		},
+		{
+			object: &appsv1beta1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta1.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta1",
+			args: []string{"deployment", "nginx"},
+		},
+		{
+			object: &appsv1beta2.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"deployment", "nginx"},
+		},
+		{
+			object: &appsv1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"deployment", "nginx"},
+		},
+		{
+			object: &appsv1beta1.StatefulSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta1.StatefulSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "apps",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta1",
+			args: []string{"statefulset", "nginx"},
+		},
+		{
+			object: &appsv1beta2.StatefulSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.StatefulSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "apps",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"statefulset", "nginx"},
+		},
+		{
+			object: &appsv1.StatefulSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.StatefulSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "apps",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"statefulset", "nginx"},
+		},
+		{
+			object: &batchv1.Job{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: batchv1.JobSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "batch",
+			apiPrefix:    "/apis", apiGroup: "batch", apiVersion: "v1",
+			args: []string{"job", "nginx"},
+		},
+		{
+			object: &v1.ReplicationController{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: v1.ReplicationControllerSpec{
+					Template: &v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "",
+			apiPrefix:    "/api", apiGroup: "", apiVersion: "v1",
+			args: []string{"replicationcontroller", "nginx"},
+		},
+	}
+	for i, input := range inputs {
+		t.Run(fmt.Sprintf("%d", i), func(t *testing.T) {
+			groupVersion := schema.GroupVersion{Group: input.apiGroup, Version: input.apiVersion}
+			testapi.Default = testapi.Groups[input.testAPIGroup]
+			f, tf, _, ns := cmdtesting.NewAPIFactory()
+			codec := scheme.Codecs.CodecForVersions(scheme.Codecs.LegacyCodec(groupVersion), scheme.Codecs.UniversalDecoder(groupVersion), groupVersion, groupVersion)
+			mapper, typer := f.Object()
+			tf.Printer = &printers.NamePrinter{Decoders: []runtime.Decoder{testapi.Default.Codec()}, Typer: typer, Mapper: mapper}
+			tf.Namespace = "test"
+			tf.CategoryExpander = categories.LegacyCategoryExpander
+			tf.Client = &fake.RESTClient{
+				GroupVersion:         groupVersion,
+				NegotiatedSerializer: ns,
+				Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+					resourcePath := testapi.Default.ResourcePath(input.args[0]+"s", tf.Namespace, input.args[1])
+					switch p, m := req.URL.Path, req.Method; {
+					case p == resourcePath && m == http.MethodGet:
+						return &http.Response{StatusCode: http.StatusOK, Header: defaultHeader(), Body: objBody(codec, input.object)}, nil
+					case p == resourcePath && m == http.MethodPatch:
+						stream, err := req.GetBody()
+						if err != nil {
+							return nil, err
+						}
+						bytes, err := ioutil.ReadAll(stream)
+						if err != nil {
+							return nil, err
+						}
+						assert.Contains(t, string(bytes), "200m", fmt.Sprintf("resources not updated for %#v", input.object))
+						return &http.Response{StatusCode: http.StatusOK, Header: defaultHeader(), Body: objBody(codec, input.object)}, nil
+					default:
+						t.Errorf("%s: unexpected request: %s %#v\n%#v", "resources", req.Method, req.URL, req)
+						return nil, fmt.Errorf("unexpected request")
+					}
+				}),
+				VersionedAPIPath: path.Join(input.apiPrefix, testapi.Default.GroupVersion().String()),
+			}
+			buf := new(bytes.Buffer)
+			cmd := NewCmdResources(f, buf, buf)
+			cmd.SetOutput(buf)
+			cmd.Flags().Set("output", "yaml")
+			opts := ResourcesOptions{
+				Out:               buf,
+				Local:             true,
+				Limits:            "cpu=200m,memory=512Mi",
+				ContainerSelector: "*"}
+			err := opts.Complete(f, cmd, input.args)
+			if err == nil {
+				err = opts.Validate()
+			}
+			if err == nil {
+				err = opts.Run()
+			}
+			assert.NoError(t, err)
+		})
+	}
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_selector.go

@@ -0,0 +1,254 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/spf13/cobra"
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/validation"
+	"k8s.io/kubernetes/pkg/kubectl/cmd/templates"
+	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+	"k8s.io/kubernetes/pkg/kubectl/resource"
+	"k8s.io/kubernetes/pkg/kubectl/util/i18n"
+)
+
+// SelectorOptions is the start of the data required to perform the operation.  As new fields are added, add them here instead of
+// referencing the cmd.Flags()
+type SelectorOptions struct {
+	fileOptions resource.FilenameOptions
+
+	local       bool
+	dryrun      bool
+	all         bool
+	record      bool
+	changeCause string
+	output      string
+
+	resources []string
+	selector  *metav1.LabelSelector
+
+	out              io.Writer
+	PrintSuccess     func(mapper meta.RESTMapper, shortOutput bool, out io.Writer, resource, name string, dryRun bool, operation string)
+	PrintObject      func(obj runtime.Object) error
+	ClientForMapping func(mapping *meta.RESTMapping) (resource.RESTClient, error)
+
+	builder *resource.Builder
+	mapper  meta.RESTMapper
+	encoder runtime.Encoder
+}
+
+var (
+	selectorLong = templates.LongDesc(`
+		Set the selector on a resource. Note that the new selector will overwrite the old selector if the resource had one prior to the invocation
+		of 'set selector'.
+
+		A selector must begin with a letter or number, and may contain letters, numbers, hyphens, dots, and underscores, up to %[1]d characters.
+		If --resource-version is specified, then updates will use this resource version, otherwise the existing resource-version will be used.
+        Note: currently selectors can only be set on Service objects.`)
+	selectorExample = templates.Examples(`
+        # set the labels and selector before creating a deployment/service pair.
+        kubectl create service clusterip my-svc --clusterip="None" -o yaml --dry-run | kubectl set selector --local -f - 'environment=qa' -o yaml | kubectl create -f -
+        kubectl create deployment my-dep -o yaml --dry-run | kubectl label --local -f - environment=qa -o yaml | kubectl create -f -`)
+)
+
+// NewCmdSelector is the "set selector" command.
+func NewCmdSelector(f cmdutil.Factory, out io.Writer) *cobra.Command {
+	options := &SelectorOptions{
+		out: out,
+	}
+
+	cmd := &cobra.Command{
+		Use:     "selector (-f FILENAME | TYPE NAME) EXPRESSIONS [--resource-version=version]",
+		Short:   i18n.T("Set the selector on a resource"),
+		Long:    fmt.Sprintf(selectorLong, validation.LabelValueMaxLength),
+		Example: selectorExample,
+		Run: func(cmd *cobra.Command, args []string) {
+			cmdutil.CheckErr(options.Complete(f, cmd, args))
+			cmdutil.CheckErr(options.Validate())
+			cmdutil.CheckErr(options.RunSelector())
+		},
+	}
+	cmdutil.AddPrinterFlags(cmd)
+	cmd.Flags().Bool("all", false, "Select all resources, including uninitialized ones, in the namespace of the specified resource types")
+	cmd.Flags().Bool("local", false, "If true, set selector will NOT contact api-server but run locally.")
+	cmd.Flags().String("resource-version", "", "If non-empty, the selectors update will only succeed if this is the current resource-version for the object. Only valid when specifying a single resource.")
+	usage := "the resource to update the selectors"
+	cmdutil.AddFilenameOptionFlags(cmd, &options.fileOptions, usage)
+	cmdutil.AddDryRunFlag(cmd)
+	cmdutil.AddRecordFlag(cmd)
+	cmdutil.AddIncludeUninitializedFlag(cmd)
+
+	return cmd
+}
+
+// Complete assigns the SelectorOptions from args.
+func (o *SelectorOptions) Complete(f cmdutil.Factory, cmd *cobra.Command, args []string) error {
+	o.local = cmdutil.GetFlagBool(cmd, "local")
+	o.all = cmdutil.GetFlagBool(cmd, "all")
+	o.record = cmdutil.GetRecordFlag(cmd)
+	o.dryrun = cmdutil.GetDryRunFlag(cmd)
+	o.output = cmdutil.GetFlagString(cmd, "output")
+
+	cmdNamespace, enforceNamespace, err := f.DefaultNamespace()
+	if err != nil {
+		return err
+	}
+
+	o.PrintSuccess = f.PrintSuccess
+
+	o.changeCause = f.Command(cmd, false)
+	mapper, _ := f.Object()
+	o.mapper = mapper
+	o.encoder = f.JSONEncoder()
+
+	o.resources, o.selector, err = getResourcesAndSelector(args)
+	if err != nil {
+		return err
+	}
+
+	includeUninitialized := cmdutil.ShouldIncludeUninitialized(cmd, false)
+	o.builder = f.NewBuilder().
+		Internal().
+		LocalParam(o.local).
+		ContinueOnError().
+		NamespaceParam(cmdNamespace).DefaultNamespace().
+		FilenameParam(enforceNamespace, &o.fileOptions).
+		IncludeUninitialized(includeUninitialized).
+		Flatten()
+
+	if !o.local {
+		o.builder.
+			ResourceTypeOrNameArgs(o.all, o.resources...).
+			Latest()
+	} else {
+		// if a --local flag was provided, and a resource was specified in the form
+		// <resource>/<name>, fail immediately as --local cannot query the api server
+		// for the specified resource.
+		if len(o.resources) > 0 {
+			return resource.LocalResourceError
+		}
+	}
+
+	o.PrintObject = func(obj runtime.Object) error {
+		return f.PrintObject(cmd, o.local, mapper, obj, o.out)
+	}
+	o.ClientForMapping = func(mapping *meta.RESTMapping) (resource.RESTClient, error) {
+		return f.ClientForMapping(mapping)
+	}
+	return err
+}
+
+// Validate basic inputs
+func (o *SelectorOptions) Validate() error {
+	if len(o.resources) < 1 && cmdutil.IsFilenameSliceEmpty(o.fileOptions.Filenames) {
+		return fmt.Errorf("one or more resources must be specified as <resource> <name> or <resource>/<name>")
+	}
+	if o.selector == nil {
+		return fmt.Errorf("one selector is required")
+	}
+	return nil
+}
+
+// RunSelector executes the command.
+func (o *SelectorOptions) RunSelector() error {
+	r := o.builder.Do()
+	err := r.Err()
+	if err != nil {
+		return err
+	}
+
+	return r.Visit(func(info *resource.Info, err error) error {
+		patch := &Patch{Info: info}
+		CalculatePatch(patch, o.encoder, func(info *resource.Info) ([]byte, error) {
+			versioned := info.AsVersioned()
+			patch.Info.Object = versioned
+			selectErr := updateSelectorForObject(info.Object, *o.selector)
+
+			if selectErr == nil {
+				return runtime.Encode(o.encoder, info.Object)
+			}
+			return nil, selectErr
+		})
+
+		if patch.Err != nil {
+			return patch.Err
+		}
+		if o.local || o.dryrun {
+			return o.PrintObject(info.Object)
+		}
+
+		patched, err := resource.NewHelper(info.Client, info.Mapping).Patch(info.Namespace, info.Name, types.StrategicMergePatchType, patch.Patch)
+		if err != nil {
+			return err
+		}
+
+		if o.record || cmdutil.ContainsChangeCause(info) {
+			if err := cmdutil.RecordChangeCause(patched, o.changeCause); err == nil {
+				if patched, err = resource.NewHelper(info.Client, info.Mapping).Replace(info.Namespace, info.Name, false, patched); err != nil {
+					return fmt.Errorf("changes to %s/%s can't be recorded: %v\n", info.Mapping.Resource, info.Name, err)
+				}
+			}
+		}
+
+		info.Refresh(patched, true)
+
+		shortOutput := o.output == "name"
+		if len(o.output) > 0 && !shortOutput {
+			return o.PrintObject(patched)
+		}
+		o.PrintSuccess(o.mapper, shortOutput, o.out, info.Mapping.Resource, info.Name, o.dryrun, "selector updated")
+		return nil
+	})
+}
+
+func updateSelectorForObject(obj runtime.Object, selector metav1.LabelSelector) error {
+	copyOldSelector := func() (map[string]string, error) {
+		if len(selector.MatchExpressions) > 0 {
+			return nil, fmt.Errorf("match expression %v not supported on this object", selector.MatchExpressions)
+		}
+		dst := make(map[string]string)
+		for label, value := range selector.MatchLabels {
+			dst[label] = value
+		}
+		return dst, nil
+	}
+	var err error
+	switch t := obj.(type) {
+	case *v1.Service:
+		t.Spec.Selector, err = copyOldSelector()
+	default:
+		err = fmt.Errorf("setting a selector is only supported for Services")
+	}
+	return err
+}
+
+// getResourcesAndSelector retrieves resources and the selector expression from the given args (assuming selectors the last arg)
+func getResourcesAndSelector(args []string) (resources []string, selector *metav1.LabelSelector, err error) {
+	if len(args) == 0 {
+		return []string{}, nil, nil
+	}
+	resources = args[:len(args)-1]
+	selector, err = metav1.ParseToLabelSelector(args[len(args)-1])
+	return resources, selector, err
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_selector_test.go

@@ -0,0 +1,345 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"bytes"
+	"net/http"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	batchv1 "k8s.io/api/batch/v1"
+	"k8s.io/api/core/v1"
+	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/client-go/rest/fake"
+	cmdtesting "k8s.io/kubernetes/pkg/kubectl/cmd/testing"
+	"k8s.io/kubernetes/pkg/printers"
+)
+
+func TestUpdateSelectorForObjectTypes(t *testing.T) {
+	before := metav1.LabelSelector{MatchLabels: map[string]string{"fee": "true"},
+		MatchExpressions: []metav1.LabelSelectorRequirement{
+			{
+				Key:      "foo",
+				Operator: metav1.LabelSelectorOpIn,
+				Values:   []string{"on", "yes"},
+			},
+		}}
+
+	rc := v1.ReplicationController{}
+	ser := v1.Service{}
+	dep := extensionsv1beta1.Deployment{Spec: extensionsv1beta1.DeploymentSpec{Selector: &before}}
+	ds := extensionsv1beta1.DaemonSet{Spec: extensionsv1beta1.DaemonSetSpec{Selector: &before}}
+	rs := extensionsv1beta1.ReplicaSet{Spec: extensionsv1beta1.ReplicaSetSpec{Selector: &before}}
+	job := batchv1.Job{Spec: batchv1.JobSpec{Selector: &before}}
+	pvc := v1.PersistentVolumeClaim{Spec: v1.PersistentVolumeClaimSpec{Selector: &before}}
+	sa := v1.ServiceAccount{}
+	type args struct {
+		obj      runtime.Object
+		selector metav1.LabelSelector
+	}
+	tests := []struct {
+		name    string
+		args    args
+		wantErr bool
+	}{
+		{name: "rc",
+			args: args{
+				obj:      &rc,
+				selector: metav1.LabelSelector{},
+			},
+			wantErr: true,
+		},
+		{name: "ser",
+			args: args{
+				obj:      &ser,
+				selector: metav1.LabelSelector{},
+			},
+			wantErr: false,
+		},
+		{name: "dep",
+			args: args{
+				obj:      &dep,
+				selector: metav1.LabelSelector{},
+			},
+			wantErr: true,
+		},
+		{name: "ds",
+			args: args{
+				obj:      &ds,
+				selector: metav1.LabelSelector{},
+			},
+			wantErr: true,
+		},
+		{name: "rs",
+			args: args{
+				obj:      &rs,
+				selector: metav1.LabelSelector{},
+			},
+			wantErr: true,
+		},
+		{name: "job",
+			args: args{
+				obj:      &job,
+				selector: metav1.LabelSelector{},
+			},
+			wantErr: true,
+		},
+		{name: "pvc - no updates",
+			args: args{
+				obj:      &pvc,
+				selector: metav1.LabelSelector{},
+			},
+			wantErr: true,
+		},
+		{name: "sa - no selector",
+			args: args{
+				obj:      &sa,
+				selector: metav1.LabelSelector{},
+			},
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		if err := updateSelectorForObject(tt.args.obj, tt.args.selector); (err != nil) != tt.wantErr {
+			t.Errorf("%q. updateSelectorForObject() error = %v, wantErr %v", tt.name, err, tt.wantErr)
+		}
+	}
+}
+
+func TestUpdateNewSelectorValuesForObject(t *testing.T) {
+	ser := v1.Service{}
+	type args struct {
+		obj      runtime.Object
+		selector metav1.LabelSelector
+	}
+	tests := []struct {
+		name    string
+		args    args
+		wantErr bool
+	}{
+		{name: "empty",
+			args: args{
+				obj: &ser,
+				selector: metav1.LabelSelector{
+					MatchLabels:      map[string]string{},
+					MatchExpressions: []metav1.LabelSelectorRequirement{},
+				},
+			},
+			wantErr: false,
+		},
+		{name: "label-only",
+			args: args{
+				obj: &ser,
+				selector: metav1.LabelSelector{
+					MatchLabels:      map[string]string{"b": "u"},
+					MatchExpressions: []metav1.LabelSelectorRequirement{},
+				},
+			},
+			wantErr: false,
+		},
+	}
+	for _, tt := range tests {
+		if err := updateSelectorForObject(tt.args.obj, tt.args.selector); (err != nil) != tt.wantErr {
+			t.Errorf("%q. updateSelectorForObject() error = %v, wantErr %v", tt.name, err, tt.wantErr)
+		}
+
+		assert.EqualValues(t, tt.args.selector.MatchLabels, ser.Spec.Selector, tt.name)
+
+	}
+}
+
+func TestUpdateOldSelectorValuesForObject(t *testing.T) {
+	ser := v1.Service{Spec: v1.ServiceSpec{Selector: map[string]string{"fee": "true"}}}
+	type args struct {
+		obj      runtime.Object
+		selector metav1.LabelSelector
+	}
+	tests := []struct {
+		name    string
+		args    args
+		wantErr bool
+	}{
+		{name: "empty",
+			args: args{
+				obj: &ser,
+				selector: metav1.LabelSelector{
+					MatchLabels:      map[string]string{},
+					MatchExpressions: []metav1.LabelSelectorRequirement{},
+				},
+			},
+			wantErr: false,
+		},
+		{name: "label-only",
+			args: args{
+				obj: &ser,
+				selector: metav1.LabelSelector{
+					MatchLabels:      map[string]string{"fee": "false", "x": "y"},
+					MatchExpressions: []metav1.LabelSelectorRequirement{},
+				},
+			},
+			wantErr: false,
+		},
+		{name: "expr-only - err",
+			args: args{
+				obj: &ser,
+				selector: metav1.LabelSelector{
+					MatchLabels: map[string]string{},
+					MatchExpressions: []metav1.LabelSelectorRequirement{
+						{
+							Key:      "a",
+							Operator: "In",
+							Values:   []string{"x", "y"},
+						},
+					},
+				},
+			},
+			wantErr: true,
+		},
+		{name: "both - err",
+			args: args{
+				obj: &ser,
+				selector: metav1.LabelSelector{
+					MatchLabels: map[string]string{"b": "u"},
+					MatchExpressions: []metav1.LabelSelectorRequirement{
+						{
+							Key:      "a",
+							Operator: "In",
+							Values:   []string{"x", "y"},
+						},
+					},
+				},
+			},
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		err := updateSelectorForObject(tt.args.obj, tt.args.selector)
+		if (err != nil) != tt.wantErr {
+			t.Errorf("%q. updateSelectorForObject() error = %v, wantErr %v", tt.name, err, tt.wantErr)
+		} else if !tt.wantErr {
+			assert.EqualValues(t, tt.args.selector.MatchLabels, ser.Spec.Selector, tt.name)
+		}
+	}
+}
+
+func TestGetResourcesAndSelector(t *testing.T) {
+	type args struct {
+		args []string
+	}
+	tests := []struct {
+		name          string
+		args          args
+		wantResources []string
+		wantSelector  *metav1.LabelSelector
+		wantErr       bool
+	}{
+		{
+			name:          "basic match",
+			args:          args{args: []string{"rc/foo", "healthy=true"}},
+			wantResources: []string{"rc/foo"},
+			wantErr:       false,
+			wantSelector: &metav1.LabelSelector{
+				MatchLabels:      map[string]string{"healthy": "true"},
+				MatchExpressions: []metav1.LabelSelectorRequirement{},
+			},
+		},
+		{
+			name:          "basic expression",
+			args:          args{args: []string{"rc/foo", "buildType notin (debug, test)"}},
+			wantResources: []string{"rc/foo"},
+			wantErr:       false,
+			wantSelector: &metav1.LabelSelector{
+				MatchLabels: map[string]string{},
+				MatchExpressions: []metav1.LabelSelectorRequirement{
+					{
+						Key:      "buildType",
+						Operator: "NotIn",
+						Values:   []string{"debug", "test"},
+					},
+				},
+			},
+		},
+		{
+			name:          "selector error",
+			args:          args{args: []string{"rc/foo", "buildType notthis (debug, test)"}},
+			wantResources: []string{"rc/foo"},
+			wantErr:       true,
+			wantSelector: &metav1.LabelSelector{
+				MatchLabels:      map[string]string{},
+				MatchExpressions: []metav1.LabelSelectorRequirement{},
+			},
+		},
+		{
+			name:          "no resource and selector",
+			args:          args{args: []string{}},
+			wantResources: []string{},
+			wantErr:       false,
+			wantSelector:  nil,
+		},
+	}
+	for _, tt := range tests {
+		gotResources, gotSelector, err := getResourcesAndSelector(tt.args.args)
+		if err != nil {
+			if !tt.wantErr {
+				t.Errorf("%q. getResourcesAndSelector() error = %v, wantErr %v", tt.name, err, tt.wantErr)
+			}
+			continue
+		}
+		if !reflect.DeepEqual(gotResources, tt.wantResources) {
+			t.Errorf("%q. getResourcesAndSelector() gotResources = %v, want %v", tt.name, gotResources, tt.wantResources)
+		}
+		if !reflect.DeepEqual(gotSelector, tt.wantSelector) {
+			t.Errorf("%q. getResourcesAndSelector() gotSelector = %v, want %v", tt.name, gotSelector, tt.wantSelector)
+		}
+	}
+}
+
+func TestSelectorTest(t *testing.T) {
+	f, tf, codec, ns := cmdtesting.NewAPIFactory()
+	tf.Client = &fake.RESTClient{
+		GroupVersion:         schema.GroupVersion{Version: ""},
+		NegotiatedSerializer: ns,
+		Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+			t.Fatalf("unexpected request: %s %#v\n%#v", req.Method, req.URL, req)
+			return nil, nil
+		}),
+	}
+	tf.Namespace = "test"
+	tf.ClientConfig = &restclient.Config{ContentConfig: restclient.ContentConfig{GroupVersion: &schema.GroupVersion{Version: ""}}}
+
+	buf := bytes.NewBuffer([]byte{})
+	cmd := NewCmdSelector(f, buf)
+	cmd.SetOutput(buf)
+	cmd.Flags().Set("output", "name")
+	cmd.Flags().Set("local", "true")
+	cmd.Flags().Set("filename", "../../../../examples/storage/cassandra/cassandra-service.yaml")
+
+	mapper, typer := f.Object()
+	tf.Printer = &printers.NamePrinter{Decoders: []runtime.Decoder{codec}, Typer: typer, Mapper: mapper}
+	cmd.Run(cmd, []string{"environment=qa"})
+
+	if !strings.Contains(buf.String(), "services/cassandra") {
+		t.Errorf("did not set selector: %s", buf.String())
+	}
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_serviceaccount.go

@@ -0,0 +1,197 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"errors"
+	"fmt"
+	"io"
+
+	"github.com/spf13/cobra"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+	"k8s.io/kubernetes/pkg/kubectl/cmd/templates"
+	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+	"k8s.io/kubernetes/pkg/kubectl/resource"
+	"k8s.io/kubernetes/pkg/kubectl/util/i18n"
+)
+
+var (
+	serviceaccountResources = `
+	replicationcontroller (rc), deployment (deploy), daemonset (ds), job, replicaset (rs), statefulset`
+
+	serviceaccountLong = templates.LongDesc(i18n.T(`
+	Update ServiceAccount of pod template resources.
+
+	Possible resources (case insensitive) can be: 
+	` + serviceaccountResources))
+
+	serviceaccountExample = templates.Examples(i18n.T(`
+	# Set Deployment nginx-deployment's ServiceAccount to serviceaccount1
+	kubectl set serviceaccount deployment nginx-deployment serviceaccount1
+
+	# Print the result (in yaml format) of updated nginx deployment with serviceaccount from local file, without hitting apiserver
+	kubectl set sa -f nginx-deployment.yaml serviceaccount1 --local --dry-run -o yaml
+	`))
+)
+
+// serviceAccountConfig encapsulates the data required to perform the operation.
+type serviceAccountConfig struct {
+	fileNameOptions        resource.FilenameOptions
+	mapper                 meta.RESTMapper
+	encoder                runtime.Encoder
+	out                    io.Writer
+	err                    io.Writer
+	dryRun                 bool
+	cmd                    *cobra.Command
+	shortOutput            bool
+	all                    bool
+	record                 bool
+	output                 string
+	changeCause            string
+	local                  bool
+	PrintObject            func(cmd *cobra.Command, isLocal bool, mapper meta.RESTMapper, obj runtime.Object, out io.Writer) error
+	updatePodSpecForObject func(runtime.Object, func(*v1.PodSpec) error) (bool, error)
+	printSuccess           func(mapper meta.RESTMapper, shortOutput bool, out io.Writer, resource, name string, dryRun bool, operation string)
+	infos                  []*resource.Info
+	serviceAccountName     string
+}
+
+// NewCmdServiceAccount returns the "set serviceaccount" command.
+func NewCmdServiceAccount(f cmdutil.Factory, out, err io.Writer) *cobra.Command {
+	saConfig := &serviceAccountConfig{
+		out: out,
+		err: err,
+	}
+
+	cmd := &cobra.Command{
+		Use:     "serviceaccount (-f FILENAME | TYPE NAME) SERVICE_ACCOUNT",
+		Aliases: []string{"sa"},
+		Short:   i18n.T("Update ServiceAccount of a resource"),
+		Long:    serviceaccountLong,
+		Example: serviceaccountExample,
+		Run: func(cmd *cobra.Command, args []string) {
+			cmdutil.CheckErr(saConfig.Complete(f, cmd, args))
+			cmdutil.CheckErr(saConfig.Run())
+		},
+	}
+	cmdutil.AddPrinterFlags(cmd)
+
+	usage := "identifying the resource to get from a server."
+	cmdutil.AddFilenameOptionFlags(cmd, &saConfig.fileNameOptions, usage)
+	cmd.Flags().BoolVar(&saConfig.all, "all", false, "Select all resources, including uninitialized ones, in the namespace of the specified resource types")
+	cmd.Flags().BoolVar(&saConfig.local, "local", false, "If true, set serviceaccount will NOT contact api-server but run locally.")
+	cmdutil.AddRecordFlag(cmd)
+	cmdutil.AddDryRunFlag(cmd)
+	cmdutil.AddIncludeUninitializedFlag(cmd)
+	return cmd
+}
+
+// Complete configures serviceAccountConfig from command line args.
+func (saConfig *serviceAccountConfig) Complete(f cmdutil.Factory, cmd *cobra.Command, args []string) error {
+	saConfig.mapper, _ = f.Object()
+	saConfig.encoder = f.JSONEncoder()
+	saConfig.shortOutput = cmdutil.GetFlagString(cmd, "output") == "name"
+	saConfig.record = cmdutil.GetRecordFlag(cmd)
+	saConfig.changeCause = f.Command(cmd, false)
+	saConfig.dryRun = cmdutil.GetDryRunFlag(cmd)
+	saConfig.output = cmdutil.GetFlagString(cmd, "output")
+	saConfig.updatePodSpecForObject = f.UpdatePodSpecForObject
+	saConfig.PrintObject = f.PrintObject
+	saConfig.cmd = cmd
+
+	saConfig.printSuccess = f.PrintSuccess
+	cmdNamespace, enforceNamespace, err := f.DefaultNamespace()
+	if err != nil {
+		return err
+	}
+	if len(args) == 0 {
+		return errors.New("serviceaccount is required")
+	}
+	saConfig.serviceAccountName = args[len(args)-1]
+	resources := args[:len(args)-1]
+	includeUninitialized := cmdutil.ShouldIncludeUninitialized(cmd, false)
+	builder := f.NewBuilder().
+		Internal().
+		LocalParam(saConfig.local).
+		ContinueOnError().
+		NamespaceParam(cmdNamespace).DefaultNamespace().
+		FilenameParam(enforceNamespace, &saConfig.fileNameOptions).
+		IncludeUninitialized(includeUninitialized).
+		Flatten()
+	if !saConfig.local {
+		builder.ResourceTypeOrNameArgs(saConfig.all, resources...).
+			Latest()
+	}
+	saConfig.infos, err = builder.Do().Infos()
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// Run creates and applies the patch either locally or calling apiserver.
+func (saConfig *serviceAccountConfig) Run() error {
+	patchErrs := []error{}
+	patchFn := func(info *resource.Info) ([]byte, error) {
+		info.Object = info.AsVersioned()
+		saConfig.updatePodSpecForObject(info.Object, func(podSpec *v1.PodSpec) error {
+			podSpec.ServiceAccountName = saConfig.serviceAccountName
+			return nil
+		})
+		return runtime.Encode(saConfig.encoder, info.Object)
+	}
+	patches := CalculatePatches(saConfig.infos, saConfig.encoder, patchFn)
+	for _, patch := range patches {
+		info := patch.Info
+		if patch.Err != nil {
+			patchErrs = append(patchErrs, fmt.Errorf("error: %s/%s %v\n", info.Mapping.Resource, info.Name, patch.Err))
+			continue
+		}
+		if saConfig.local || saConfig.dryRun {
+			if err := saConfig.PrintObject(saConfig.cmd, saConfig.local, saConfig.mapper, patch.Info.AsVersioned(), saConfig.out); err != nil {
+				return err
+			}
+			continue
+		}
+		patched, err := resource.NewHelper(info.Client, info.Mapping).Patch(info.Namespace, info.Name, types.StrategicMergePatchType, patch.Patch)
+		if err != nil {
+			patchErrs = append(patchErrs, fmt.Errorf("failed to patch ServiceAccountName %v", err))
+			continue
+		}
+		info.Refresh(patched, true)
+		if saConfig.record || cmdutil.ContainsChangeCause(info) {
+			if patch, patchType, err := cmdutil.ChangeResourcePatch(info, saConfig.changeCause); err == nil {
+				if patched, err = resource.NewHelper(info.Client, info.Mapping).Patch(info.Namespace, info.Name, patchType, patch); err != nil {
+					fmt.Fprintf(saConfig.err, "WARNING: changes to %s/%s can't be recorded: %v\n", info.Mapping.Resource, info.Name, err)
+				}
+			}
+		}
+		if len(saConfig.output) > 0 {
+			if err := saConfig.PrintObject(saConfig.cmd, saConfig.local, saConfig.mapper, info.AsVersioned(), saConfig.out); err != nil {
+				return err
+			}
+			continue
+		}
+		saConfig.printSuccess(saConfig.mapper, saConfig.shortOutput, saConfig.out, info.Mapping.Resource, info.Name, saConfig.dryRun, "serviceaccount updated")
+	}
+	return utilerrors.NewAggregate(patchErrs)
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_serviceaccount_test.go

@@ -0,0 +1,403 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"net/http"
+	"path"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	appsv1 "k8s.io/api/apps/v1"
+	appsv1beta1 "k8s.io/api/apps/v1beta1"
+	appsv1beta2 "k8s.io/api/apps/v1beta2"
+	batchv1 "k8s.io/api/batch/v1"
+	"k8s.io/api/core/v1"
+	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/client-go/rest/fake"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	"k8s.io/kubernetes/pkg/kubectl/categories"
+	cmdtesting "k8s.io/kubernetes/pkg/kubectl/cmd/testing"
+	"k8s.io/kubernetes/pkg/kubectl/resource"
+	"k8s.io/kubernetes/pkg/kubectl/scheme"
+	"k8s.io/kubernetes/pkg/printers"
+)
+
+const serviceAccount = "serviceaccount1"
+const serviceAccountMissingErrString = "serviceaccount is required"
+const resourceMissingErrString = `You must provide one or more resources by argument or filename.
+Example resource specifications include:
+   '-f rsrc.yaml'
+   '--filename=rsrc.json'
+   '<resource> <name>'
+   '<resource>'`
+
+func TestSetServiceAccountLocal(t *testing.T) {
+	inputs := []struct {
+		yaml     string
+		apiGroup string
+	}{
+		{yaml: "../../../../test/fixtures/doc-yaml/user-guide/replication.yaml", apiGroup: ""},
+		{yaml: "../../../../test/fixtures/doc-yaml/admin/daemon.yaml", apiGroup: "extensions"},
+		{yaml: "../../../../test/fixtures/doc-yaml/user-guide/replicaset/redis-slave.yaml", apiGroup: "extensions"},
+		{yaml: "../../../../test/fixtures/doc-yaml/user-guide/job.yaml", apiGroup: "batch"},
+		{yaml: "../../../../test/fixtures/doc-yaml/user-guide/deployment.yaml", apiGroup: "extensions"},
+	}
+
+	for i, input := range inputs {
+		t.Run(fmt.Sprintf("%d", i), func(t *testing.T) {
+			f, tf, _, _ := cmdtesting.NewAPIFactory()
+			tf.Client = &fake.RESTClient{
+				GroupVersion: schema.GroupVersion{Version: "v1"},
+				Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+					t.Fatalf("unexpected request: %s %#v\n%#v", req.Method, req.URL, req)
+					return nil, nil
+				}),
+			}
+			tf.Namespace = "test"
+			out := new(bytes.Buffer)
+			cmd := NewCmdServiceAccount(f, out, out)
+			cmd.SetOutput(out)
+			cmd.Flags().Set("output", "yaml")
+			cmd.Flags().Set("local", "true")
+			testapi.Default = testapi.Groups[input.apiGroup]
+			tf.Printer = printers.NewVersionedPrinter(&printers.YAMLPrinter{}, testapi.Default.Converter(), *testapi.Default.GroupVersion())
+			saConfig := serviceAccountConfig{fileNameOptions: resource.FilenameOptions{
+				Filenames: []string{input.yaml}},
+				out:   out,
+				local: true}
+			err := saConfig.Complete(f, cmd, []string{serviceAccount})
+			assert.NoError(t, err)
+			err = saConfig.Run()
+			assert.NoError(t, err)
+			assert.Contains(t, out.String(), "serviceAccountName: "+serviceAccount, fmt.Sprintf("serviceaccount not updated for %s", input.yaml))
+		})
+	}
+}
+
+func TestSetServiceAccountMultiLocal(t *testing.T) {
+	testapi.Default = testapi.Groups[""]
+	f, tf, codec, ns := cmdtesting.NewAPIFactory()
+	tf.Client = &fake.RESTClient{
+		GroupVersion:         schema.GroupVersion{Version: ""},
+		NegotiatedSerializer: ns,
+		Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+			t.Fatalf("unexpected request: %s %#v\n%#v", req.Method, req.URL, req)
+			return nil, nil
+		}),
+	}
+	tf.Namespace = "test"
+	tf.ClientConfig = &restclient.Config{ContentConfig: restclient.ContentConfig{GroupVersion: &schema.GroupVersion{Version: ""}}}
+
+	buf := bytes.NewBuffer([]byte{})
+	cmd := NewCmdServiceAccount(f, buf, buf)
+	cmd.SetOutput(buf)
+	cmd.Flags().Set("output", "name")
+	cmd.Flags().Set("local", "true")
+	mapper, typer := f.Object()
+	tf.Printer = &printers.NamePrinter{Decoders: []runtime.Decoder{codec}, Typer: typer, Mapper: mapper}
+	opts := serviceAccountConfig{fileNameOptions: resource.FilenameOptions{
+		Filenames: []string{"../../../../test/fixtures/pkg/kubectl/cmd/set/multi-resource-yaml.yaml"}},
+		out:   buf,
+		local: true}
+
+	err := opts.Complete(f, cmd, []string{serviceAccount})
+	if err == nil {
+		err = opts.Run()
+	}
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	expectedOut := "replicationcontrollers/first-rc\nreplicationcontrollers/second-rc\n"
+	if buf.String() != expectedOut {
+		t.Errorf("expected out:\n%s\nbut got:\n%s", expectedOut, buf.String())
+	}
+}
+
+func TestSetServiceAccountRemote(t *testing.T) {
+	inputs := []struct {
+		object                          runtime.Object
+		apiPrefix, apiGroup, apiVersion string
+		testAPIGroup                    string
+		args                            []string
+	}{
+		{
+			object: &extensionsv1beta1.ReplicaSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "extensions", apiVersion: "v1beta1",
+			args: []string{"replicaset", "nginx", serviceAccount},
+		},
+		{
+			object: &appsv1beta2.ReplicaSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.ReplicaSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"replicaset", "nginx", serviceAccount},
+		},
+		{
+			object: &appsv1.ReplicaSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.ReplicaSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"replicaset", "nginx", serviceAccount},
+		},
+		{
+			object: &extensionsv1beta1.DaemonSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "extensions", apiVersion: "v1beta1",
+			args: []string{"daemonset", "nginx", serviceAccount},
+		},
+		{
+			object: &appsv1beta2.DaemonSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"daemonset", "nginx", serviceAccount},
+		},
+		{
+			object: &appsv1.DaemonSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"daemonset", "nginx", serviceAccount},
+		},
+		{
+			object: &extensionsv1beta1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "extensions", apiVersion: "v1beta1",
+			args: []string{"deployment", "nginx", serviceAccount},
+		},
+		{
+			object: &appsv1beta1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta1",
+			args: []string{"deployment", "nginx", serviceAccount},
+		},
+		{
+			object: &appsv1beta2.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"deployment", "nginx", serviceAccount},
+		},
+		{
+			object: &appsv1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"deployment", "nginx", serviceAccount},
+		},
+		{
+			object: &appsv1beta1.StatefulSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+			},
+			testAPIGroup: "apps",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta1",
+			args: []string{"statefulset", "nginx", serviceAccount},
+		},
+		{
+			object: &appsv1beta2.StatefulSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+			},
+			testAPIGroup: "apps",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"statefulset", "nginx", serviceAccount},
+		},
+		{
+			object: &appsv1.StatefulSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.StatefulSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "apps",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"statefulset", "nginx", serviceAccount},
+		},
+		{
+			object: &batchv1.Job{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+			},
+			testAPIGroup: "batch",
+			apiPrefix:    "/apis", apiGroup: "batch", apiVersion: "v1",
+			args: []string{"job", "nginx", serviceAccount},
+		},
+		{
+			object: &v1.ReplicationController{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+			},
+			testAPIGroup: "",
+			apiPrefix:    "/api", apiGroup: "", apiVersion: "v1",
+			args: []string{"replicationcontroller", "nginx", serviceAccount},
+		},
+	}
+	for _, input := range inputs {
+		groupVersion := schema.GroupVersion{Group: input.apiGroup, Version: input.apiVersion}
+		testapi.Default = testapi.Groups[input.testAPIGroup]
+		f, tf, _, ns := cmdtesting.NewAPIFactory()
+		codec := scheme.Codecs.CodecForVersions(scheme.Codecs.LegacyCodec(groupVersion), scheme.Codecs.UniversalDecoder(groupVersion), groupVersion, groupVersion)
+		tf.Printer = printers.NewVersionedPrinter(&printers.YAMLPrinter{}, testapi.Default.Converter(), *testapi.Default.GroupVersion())
+		tf.Namespace = "test"
+		tf.CategoryExpander = categories.LegacyCategoryExpander
+		tf.Client = &fake.RESTClient{
+			GroupVersion:         groupVersion,
+			NegotiatedSerializer: ns,
+			Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+				resourcePath := testapi.Default.ResourcePath(input.args[0]+"s", tf.Namespace, input.args[1])
+				switch p, m := req.URL.Path, req.Method; {
+				case p == resourcePath && m == http.MethodGet:
+					return &http.Response{StatusCode: http.StatusOK, Header: defaultHeader(), Body: objBody(codec, input.object)}, nil
+				case p == resourcePath && m == http.MethodPatch:
+					stream, err := req.GetBody()
+					if err != nil {
+						return nil, err
+					}
+					bytes, err := ioutil.ReadAll(stream)
+					if err != nil {
+						return nil, err
+					}
+					assert.Contains(t, string(bytes), `"serviceAccountName":`+`"`+serviceAccount+`"`, fmt.Sprintf("serviceaccount not updated for %#v", input.object))
+					return &http.Response{StatusCode: http.StatusOK, Header: defaultHeader(), Body: objBody(codec, input.object)}, nil
+				default:
+					t.Errorf("%s: unexpected request: %s %#v\n%#v", "serviceaccount", req.Method, req.URL, req)
+					return nil, fmt.Errorf("unexpected request")
+				}
+			}),
+			VersionedAPIPath: path.Join(input.apiPrefix, testapi.Default.GroupVersion().String()),
+		}
+		out := new(bytes.Buffer)
+		cmd := NewCmdServiceAccount(f, out, out)
+		cmd.SetOutput(out)
+		cmd.Flags().Set("output", "yaml")
+		saConfig := serviceAccountConfig{
+			out:   out,
+			local: false}
+		err := saConfig.Complete(f, cmd, input.args)
+		assert.NoError(t, err)
+		err = saConfig.Run()
+		assert.NoError(t, err)
+	}
+}
+
+func TestServiceAccountValidation(t *testing.T) {
+	inputs := []struct {
+		args        []string
+		errorString string
+	}{
+		{args: []string{}, errorString: serviceAccountMissingErrString},
+		{args: []string{serviceAccount}, errorString: resourceMissingErrString},
+	}
+	for _, input := range inputs {
+		f, tf, _, _ := cmdtesting.NewAPIFactory()
+		tf.Client = &fake.RESTClient{
+			GroupVersion: schema.GroupVersion{Version: "v1"},
+			Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+				t.Fatalf("unexpected request: %s %#v\n%#v", req.Method, req.URL, req)
+				return nil, nil
+			}),
+		}
+		tf.Namespace = "test"
+		out := bytes.NewBuffer([]byte{})
+		cmd := NewCmdServiceAccount(f, out, out)
+		cmd.SetOutput(out)
+
+		saConfig := &serviceAccountConfig{}
+		err := saConfig.Complete(f, cmd, input.args)
+		assert.EqualError(t, err, input.errorString)
+	}
+}
+
+func objBody(codec runtime.Codec, obj runtime.Object) io.ReadCloser {
+	return bytesBody([]byte(runtime.EncodeOrDie(codec, obj)))
+}
+
+func defaultHeader() http.Header {
+	header := http.Header{}
+	header.Set("Content-Type", runtime.ContentTypeJSON)
+	return header
+}
+
+func bytesBody(bodyBytes []byte) io.ReadCloser {
+	return ioutil.NopCloser(bytes.NewReader(bodyBytes))
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_subject.go

@@ -0,0 +1,299 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/spf13/cobra"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/kubernetes/pkg/apis/rbac"
+	"k8s.io/kubernetes/pkg/kubectl/cmd/templates"
+	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+	"k8s.io/kubernetes/pkg/kubectl/resource"
+	"k8s.io/kubernetes/pkg/kubectl/util/i18n"
+)
+
+var (
+	subject_long = templates.LongDesc(`
+	Update User, Group or ServiceAccount in a RoleBinding/ClusterRoleBinding.`)
+
+	subject_example = templates.Examples(`
+	# Update a ClusterRoleBinding for serviceaccount1
+	kubectl set subject clusterrolebinding admin --serviceaccount=namespace:serviceaccount1
+
+	# Update a RoleBinding for user1, user2, and group1
+	kubectl set subject rolebinding admin --user=user1 --user=user2 --group=group1
+
+	# Print the result (in yaml format) of updating rolebinding subjects from a local, without hitting the server
+	kubectl create rolebinding admin --role=admin --user=admin -o yaml --dry-run | kubectl set subject --local -f - --user=foo -o yaml`)
+)
+
+type updateSubjects func(existings []rbac.Subject, targets []rbac.Subject) (bool, []rbac.Subject)
+
+// SubjectOptions is the start of the data required to perform the operation. As new fields are added, add them here instead of
+// referencing the cmd.Flags
+type SubjectOptions struct {
+	resource.FilenameOptions
+
+	Mapper            meta.RESTMapper
+	Typer             runtime.ObjectTyper
+	Infos             []*resource.Info
+	Encoder           runtime.Encoder
+	Out               io.Writer
+	Err               io.Writer
+	Selector          string
+	ContainerSelector string
+	Output            string
+	All               bool
+	DryRun            bool
+	Local             bool
+
+	Users           []string
+	Groups          []string
+	ServiceAccounts []string
+
+	PrintObject func(mapper meta.RESTMapper, obj runtime.Object, out io.Writer) error
+}
+
+func NewCmdSubject(f cmdutil.Factory, out io.Writer, errOut io.Writer) *cobra.Command {
+	options := &SubjectOptions{
+		Out: out,
+		Err: errOut,
+	}
+
+	cmd := &cobra.Command{
+		Use:     "subject (-f FILENAME | TYPE NAME) [--user=username] [--group=groupname] [--serviceaccount=namespace:serviceaccountname] [--dry-run]",
+		Short:   i18n.T("Update User, Group or ServiceAccount in a RoleBinding/ClusterRoleBinding"),
+		Long:    subject_long,
+		Example: subject_example,
+		Run: func(cmd *cobra.Command, args []string) {
+			cmdutil.CheckErr(options.Complete(f, cmd, args))
+			cmdutil.CheckErr(options.Validate())
+			cmdutil.CheckErr(options.Run(f, addSubjects))
+		},
+	}
+
+	cmdutil.AddPrinterFlags(cmd)
+	usage := "the resource to update the subjects"
+	cmdutil.AddFilenameOptionFlags(cmd, &options.FilenameOptions, usage)
+	cmd.Flags().BoolVar(&options.All, "all", false, "Select all resources, including uninitialized ones, in the namespace of the specified resource types")
+	cmd.Flags().StringVarP(&options.Selector, "selector", "l", "", "Selector (label query) to filter on, not including uninitialized ones, supports '=', '==', and '!='.(e.g. -l key1=value1,key2=value2)")
+	cmd.Flags().BoolVar(&options.Local, "local", false, "If true, set subject will NOT contact api-server but run locally.")
+	cmdutil.AddDryRunFlag(cmd)
+	cmd.Flags().StringArrayVar(&options.Users, "user", []string{}, "Usernames to bind to the role")
+	cmd.Flags().StringArrayVar(&options.Groups, "group", []string{}, "Groups to bind to the role")
+	cmd.Flags().StringArrayVar(&options.ServiceAccounts, "serviceaccount", []string{}, "Service accounts to bind to the role")
+	cmdutil.AddIncludeUninitializedFlag(cmd)
+	return cmd
+}
+
+func (o *SubjectOptions) Complete(f cmdutil.Factory, cmd *cobra.Command, args []string) error {
+	o.Local = cmdutil.GetFlagBool(cmd, "local")
+	o.Mapper, o.Typer = f.Object()
+	o.Encoder = f.JSONEncoder()
+	o.Output = cmdutil.GetFlagString(cmd, "output")
+	o.DryRun = cmdutil.GetDryRunFlag(cmd)
+	o.PrintObject = func(mapper meta.RESTMapper, obj runtime.Object, out io.Writer) error {
+		return f.PrintObject(cmd, o.Local, mapper, obj, out)
+	}
+
+	cmdNamespace, enforceNamespace, err := f.DefaultNamespace()
+	if err != nil {
+		return err
+	}
+
+	includeUninitialized := cmdutil.ShouldIncludeUninitialized(cmd, false)
+	builder := f.NewBuilder().
+		Internal().
+		LocalParam(o.Local).
+		ContinueOnError().
+		NamespaceParam(cmdNamespace).DefaultNamespace().
+		FilenameParam(enforceNamespace, &o.FilenameOptions).
+		IncludeUninitialized(includeUninitialized).
+		Flatten()
+
+	if o.Local {
+		// if a --local flag was provided, and a resource was specified in the form
+		// <resource>/<name>, fail immediately as --local cannot query the api server
+		// for the specified resource.
+		if len(args) > 0 {
+			return resource.LocalResourceError
+		}
+	} else {
+		builder = builder.
+			LabelSelectorParam(o.Selector).
+			ResourceTypeOrNameArgs(o.All, args...).
+			Latest()
+	}
+
+	o.Infos, err = builder.Do().Infos()
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (o *SubjectOptions) Validate() error {
+	if len(o.Users) == 0 && len(o.Groups) == 0 && len(o.ServiceAccounts) == 0 {
+		return fmt.Errorf("you must specify at least one value of user, group or serviceaccount")
+	}
+
+	for _, sa := range o.ServiceAccounts {
+		tokens := strings.Split(sa, ":")
+		if len(tokens) != 2 || tokens[1] == "" {
+			return fmt.Errorf("serviceaccount must be <namespace>:<name>")
+		}
+
+		for _, info := range o.Infos {
+			_, ok := info.Object.(*rbac.ClusterRoleBinding)
+			if ok && tokens[0] == "" {
+				return fmt.Errorf("serviceaccount must be <namespace>:<name>, namespace must be specified")
+			}
+		}
+	}
+
+	return nil
+}
+
+func (o *SubjectOptions) Run(f cmdutil.Factory, fn updateSubjects) error {
+	var err error
+	patches := CalculatePatches(o.Infos, o.Encoder, func(info *resource.Info) ([]byte, error) {
+		subjects := []rbac.Subject{}
+		for _, user := range sets.NewString(o.Users...).List() {
+			subject := rbac.Subject{
+				Kind:     rbac.UserKind,
+				APIGroup: rbac.GroupName,
+				Name:     user,
+			}
+			subjects = append(subjects, subject)
+		}
+		for _, group := range sets.NewString(o.Groups...).List() {
+			subject := rbac.Subject{
+				Kind:     rbac.GroupKind,
+				APIGroup: rbac.GroupName,
+				Name:     group,
+			}
+			subjects = append(subjects, subject)
+		}
+		for _, sa := range sets.NewString(o.ServiceAccounts...).List() {
+			tokens := strings.Split(sa, ":")
+			namespace := tokens[0]
+			name := tokens[1]
+			if len(namespace) == 0 {
+				namespace, _, err = f.DefaultNamespace()
+				if err != nil {
+					return nil, err
+				}
+			}
+			subject := rbac.Subject{
+				Kind:      rbac.ServiceAccountKind,
+				Namespace: namespace,
+				Name:      name,
+			}
+			subjects = append(subjects, subject)
+		}
+
+		transformed, err := updateSubjectForObject(info.Object, subjects, fn)
+		if transformed && err == nil {
+			// TODO: switch UpdatePodSpecForObject to work on v1.PodSpec
+			return runtime.Encode(o.Encoder, info.AsVersioned())
+		}
+		return nil, err
+	})
+
+	allErrs := []error{}
+	for _, patch := range patches {
+		info := patch.Info
+		if patch.Err != nil {
+			allErrs = append(allErrs, fmt.Errorf("error: %s/%s %v\n", info.Mapping.Resource, info.Name, patch.Err))
+			continue
+		}
+
+		//no changes
+		if string(patch.Patch) == "{}" || len(patch.Patch) == 0 {
+			allErrs = append(allErrs, fmt.Errorf("info: %s %q was not changed\n", info.Mapping.Resource, info.Name))
+			continue
+		}
+
+		if o.Local || o.DryRun {
+			if err := o.PrintObject(o.Mapper, info.Object, o.Out); err != nil {
+				return err
+			}
+			continue
+		}
+
+		obj, err := resource.NewHelper(info.Client, info.Mapping).Patch(info.Namespace, info.Name, types.StrategicMergePatchType, patch.Patch)
+		if err != nil {
+			allErrs = append(allErrs, fmt.Errorf("failed to patch subjects to rolebinding: %v\n", err))
+			continue
+		}
+		info.Refresh(obj, true)
+
+		shortOutput := o.Output == "name"
+		if len(o.Output) > 0 && !shortOutput {
+			return o.PrintObject(o.Mapper, info.AsVersioned(), o.Out)
+		}
+		f.PrintSuccess(o.Mapper, shortOutput, o.Out, info.Mapping.Resource, info.Name, false, "subjects updated")
+	}
+	return utilerrors.NewAggregate(allErrs)
+}
+
+//Note: the obj mutates in the function
+func updateSubjectForObject(obj runtime.Object, subjects []rbac.Subject, fn updateSubjects) (bool, error) {
+	switch t := obj.(type) {
+	case *rbac.RoleBinding:
+		transformed, result := fn(t.Subjects, subjects)
+		t.Subjects = result
+		return transformed, nil
+	case *rbac.ClusterRoleBinding:
+		transformed, result := fn(t.Subjects, subjects)
+		t.Subjects = result
+		return transformed, nil
+	default:
+		return false, fmt.Errorf("setting subjects is only supported for RoleBinding/ClusterRoleBinding")
+	}
+}
+
+func addSubjects(existings []rbac.Subject, targets []rbac.Subject) (bool, []rbac.Subject) {
+	transformed := false
+	updated := existings
+	for _, item := range targets {
+		if !contain(existings, item) {
+			updated = append(updated, item)
+			transformed = true
+		}
+	}
+	return transformed, updated
+}
+
+func contain(slice []rbac.Subject, item rbac.Subject) bool {
+	for _, v := range slice {
+		if v == item {
+			return true
+		}
+	}
+	return false
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_subject_test.go

@@ -0,0 +1,427 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"reflect"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/kubernetes/pkg/apis/rbac"
+	cmdtesting "k8s.io/kubernetes/pkg/kubectl/cmd/testing"
+	"k8s.io/kubernetes/pkg/kubectl/resource"
+)
+
+func TestValidate(t *testing.T) {
+	f, tf, _, _ := cmdtesting.NewAPIFactory()
+	tf.Namespace = "test"
+
+	tests := map[string]struct {
+		options   *SubjectOptions
+		expectErr bool
+	}{
+		"test-missing-subjects": {
+			options: &SubjectOptions{
+				Users:           []string{},
+				Groups:          []string{},
+				ServiceAccounts: []string{},
+			},
+			expectErr: true,
+		},
+		"test-invalid-serviceaccounts": {
+			options: &SubjectOptions{
+				Users:           []string{},
+				Groups:          []string{},
+				ServiceAccounts: []string{"foo"},
+			},
+			expectErr: true,
+		},
+		"test-missing-serviceaccounts-name": {
+			options: &SubjectOptions{
+				Users:           []string{},
+				Groups:          []string{},
+				ServiceAccounts: []string{"foo:"},
+			},
+			expectErr: true,
+		},
+		"test-missing-serviceaccounts-namespace": {
+			options: &SubjectOptions{
+				Infos: []*resource.Info{
+					{
+						Object: &rbac.ClusterRoleBinding{
+							ObjectMeta: metav1.ObjectMeta{
+								Name: "clusterrolebinding",
+							},
+							RoleRef: rbac.RoleRef{
+								APIGroup: "rbac.authorization.k8s.io",
+								Kind:     "ClusterRole",
+								Name:     "role",
+							},
+						},
+					},
+				},
+				Users:           []string{},
+				Groups:          []string{},
+				ServiceAccounts: []string{":foo"},
+			},
+			expectErr: true,
+		},
+		"test-valid-case": {
+			options: &SubjectOptions{
+				Infos: []*resource.Info{
+					{
+						Object: &rbac.RoleBinding{
+							ObjectMeta: metav1.ObjectMeta{
+								Name:      "rolebinding",
+								Namespace: "one",
+							},
+							RoleRef: rbac.RoleRef{
+								APIGroup: "rbac.authorization.k8s.io",
+								Kind:     "ClusterRole",
+								Name:     "role",
+							},
+						},
+					},
+				},
+				Users:           []string{"foo"},
+				Groups:          []string{"foo"},
+				ServiceAccounts: []string{"ns:foo"},
+			},
+			expectErr: false,
+		},
+	}
+
+	for name, test := range tests {
+		test.options.Mapper, _ = f.Object()
+		err := test.options.Validate()
+		if test.expectErr && err != nil {
+			continue
+		}
+		if !test.expectErr && err != nil {
+			t.Errorf("%s: unexpected error: %v", name, err)
+		}
+	}
+}
+
+func TestUpdateSubjectForObject(t *testing.T) {
+	tests := []struct {
+		Name     string
+		obj      runtime.Object
+		subjects []rbac.Subject
+		expected []rbac.Subject
+		wantErr  bool
+	}{
+		{
+			Name: "invalid object type",
+			obj: &rbac.Role{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "role",
+					Namespace: "one",
+				},
+			},
+			wantErr: true,
+		},
+		{
+			Name: "add resource with users in rolebinding",
+			obj: &rbac.RoleBinding{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "rolebinding",
+					Namespace: "one",
+				},
+				Subjects: []rbac.Subject{
+					{
+						APIGroup: "rbac.authorization.k8s.io",
+						Kind:     "User",
+						Name:     "a",
+					},
+				},
+			},
+			subjects: []rbac.Subject{
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "User",
+					Name:     "a",
+				},
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "User",
+					Name:     "b",
+				},
+			},
+			expected: []rbac.Subject{
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "User",
+					Name:     "a",
+				},
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "User",
+					Name:     "b",
+				},
+			},
+			wantErr: false,
+		},
+		{
+			Name: "add resource with groups in rolebinding",
+			obj: &rbac.RoleBinding{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "rolebinding",
+					Namespace: "one",
+				},
+				Subjects: []rbac.Subject{
+					{
+						APIGroup: "rbac.authorization.k8s.io",
+						Kind:     "Group",
+						Name:     "a",
+					},
+				},
+			},
+			subjects: []rbac.Subject{
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "Group",
+					Name:     "a",
+				},
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "Group",
+					Name:     "b",
+				},
+			},
+			expected: []rbac.Subject{
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "Group",
+					Name:     "a",
+				},
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "Group",
+					Name:     "b",
+				},
+			},
+			wantErr: false,
+		},
+		{
+			Name: "add resource with serviceaccounts in rolebinding",
+			obj: &rbac.RoleBinding{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "rolebinding",
+					Namespace: "one",
+				},
+				Subjects: []rbac.Subject{
+					{
+						Kind:      "ServiceAccount",
+						Namespace: "one",
+						Name:      "a",
+					},
+				},
+			},
+			subjects: []rbac.Subject{
+				{
+					Kind:      "ServiceAccount",
+					Namespace: "one",
+					Name:      "a",
+				},
+				{
+					Kind:      "ServiceAccount",
+					Namespace: "one",
+					Name:      "b",
+				},
+			},
+			expected: []rbac.Subject{
+				{
+					Kind:      "ServiceAccount",
+					Namespace: "one",
+					Name:      "a",
+				},
+				{
+					Kind:      "ServiceAccount",
+					Namespace: "one",
+					Name:      "b",
+				},
+			},
+			wantErr: false,
+		},
+		{
+			Name: "add resource with serviceaccounts in clusterrolebinding",
+			obj: &rbac.ClusterRoleBinding{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "clusterrolebinding",
+				},
+				Subjects: []rbac.Subject{
+					{
+						APIGroup: "rbac.authorization.k8s.io",
+						Kind:     "User",
+						Name:     "a",
+					},
+					{
+						APIGroup: "rbac.authorization.k8s.io",
+						Kind:     "Group",
+						Name:     "a",
+					},
+				},
+			},
+			subjects: []rbac.Subject{
+				{
+					Kind:      "ServiceAccount",
+					Namespace: "one",
+					Name:      "a",
+				},
+			},
+			expected: []rbac.Subject{
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "User",
+					Name:     "a",
+				},
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "Group",
+					Name:     "a",
+				},
+				{
+					Kind:      "ServiceAccount",
+					Namespace: "one",
+					Name:      "a",
+				},
+			},
+			wantErr: false,
+		},
+	}
+	for _, tt := range tests {
+		if _, err := updateSubjectForObject(tt.obj, tt.subjects, addSubjects); (err != nil) != tt.wantErr {
+			t.Errorf("%q. updateSubjectForObject() error = %v, wantErr %v", tt.Name, err, tt.wantErr)
+		}
+
+		want := tt.expected
+		var got []rbac.Subject
+		switch t := tt.obj.(type) {
+		case *rbac.RoleBinding:
+			got = t.Subjects
+		case *rbac.ClusterRoleBinding:
+			got = t.Subjects
+		}
+		if !reflect.DeepEqual(got, want) {
+			t.Errorf("%q. updateSubjectForObject() failed", tt.Name)
+			t.Errorf("Got: %v", got)
+			t.Errorf("Want: %v", want)
+		}
+	}
+}
+
+func TestAddSubject(t *testing.T) {
+	tests := []struct {
+		Name       string
+		existing   []rbac.Subject
+		subjects   []rbac.Subject
+		expected   []rbac.Subject
+		wantChange bool
+	}{
+		{
+			Name: "add resource with users",
+			existing: []rbac.Subject{
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "User",
+					Name:     "a",
+				},
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "User",
+					Name:     "b",
+				},
+			},
+			subjects: []rbac.Subject{
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "User",
+					Name:     "a",
+				},
+			},
+			expected: []rbac.Subject{
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "User",
+					Name:     "a",
+				},
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "User",
+					Name:     "b",
+				},
+			},
+			wantChange: false,
+		},
+		{
+			Name: "add resource with serviceaccounts",
+			existing: []rbac.Subject{
+				{
+					Kind:      "ServiceAccount",
+					Namespace: "one",
+					Name:      "a",
+				},
+				{
+					Kind:      "ServiceAccount",
+					Namespace: "one",
+					Name:      "b",
+				},
+			},
+			subjects: []rbac.Subject{
+				{
+					Kind:      "ServiceAccount",
+					Namespace: "two",
+					Name:      "a",
+				},
+			},
+			expected: []rbac.Subject{
+				{
+					Kind:      "ServiceAccount",
+					Namespace: "one",
+					Name:      "a",
+				},
+				{
+					Kind:      "ServiceAccount",
+					Namespace: "one",
+					Name:      "b",
+				},
+				{
+					Kind:      "ServiceAccount",
+					Namespace: "two",
+					Name:      "a",
+				},
+			},
+			wantChange: true,
+		},
+	}
+	for _, tt := range tests {
+		changed := false
+		got := []rbac.Subject{}
+		if changed, got = addSubjects(tt.existing, tt.subjects); (changed != false) != tt.wantChange {
+			t.Errorf("%q. addSubjects() changed = %v, wantChange = %v", tt.Name, changed, tt.wantChange)
+		}
+
+		want := tt.expected
+		if !reflect.DeepEqual(got, want) {
+			t.Errorf("%q. addSubjects() failed", tt.Name)
+			t.Errorf("Got: %v", got)
+			t.Errorf("Want: %v", want)
+		}
+	}
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_test.go

@@ -0,0 +1,48 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/spf13/cobra"
+
+	clientcmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+	"os"
+)
+
+func TestLocalAndDryRunFlags(t *testing.T) {
+	out := &bytes.Buffer{}
+	errout := &bytes.Buffer{}
+	f := clientcmdutil.NewFactory(nil)
+	setCmd := NewCmdSet(f, os.Stdin, out, errout)
+	ensureLocalAndDryRunFlagsOnChildren(t, setCmd, "")
+}
+
+func ensureLocalAndDryRunFlagsOnChildren(t *testing.T, c *cobra.Command, prefix string) {
+	for _, cmd := range c.Commands() {
+		name := prefix + cmd.Name()
+		if localFlag := cmd.Flag("local"); localFlag == nil {
+			t.Errorf("Command %s does not implement the --local flag", name)
+		}
+		if dryRunFlag := cmd.Flag("dry-run"); dryRunFlag == nil {
+			t.Errorf("Command %s does not implement the --dry-run flag", name)
+		}
+		ensureLocalAndDryRunFlagsOnChildren(t, cmd, name+".")
+	}
+}