From 3155ee3f727d93132bcbd765cb9d1c843ae13b2a Mon Sep 17 00:00:00 2001
From: Kenny Woodson <kwoodson@redhat.com>
Date: Wed, 8 Mar 2017 16:27:07 -0500
Subject: Fixing the way policies are found.  The old method was unreliable. 
 This method searches all and matches on properties.

---
 .../lib_openshift/src/class/oc_adm_policy_group.py | 44 ++++++++++++++++++----
 1 file changed, 36 insertions(+), 8 deletions(-)

(limited to 'roles/lib_openshift/src/class/oc_adm_policy_group.py')

diff --git a/roles/lib_openshift/src/class/oc_adm_policy_group.py b/roles/lib_openshift/src/class/oc_adm_policy_group.py
index afb066c77..1e51913e0 100644
--- a/roles/lib_openshift/src/class/oc_adm_policy_group.py
+++ b/roles/lib_openshift/src/class/oc_adm_policy_group.py
@@ -41,6 +41,28 @@ class PolicyGroup(OpenShiftCLI):
         self.verbose = verbose
         self._rolebinding = None
         self._scc = None
+        self._cluster_policy_bindings = None
+        self._policy_bindings = None
+
+    @property
+    def policybindings(self):
+        if self._policy_bindings is None:
+            results = self._get('clusterpolicybindings', None)
+            if results['returncode'] != 0:
+                raise OpenShiftCLIError('Could not retrieve policybindings')
+            self._policy_bindings = results['results'][0]['items'][0]
+
+        return self._policy_bindings
+
+    @property
+    def clusterpolicybindings(self):
+        if self._cluster_policy_bindings is None:
+            results = self._get('clusterpolicybindings', None)
+            if results['returncode'] != 0:
+                raise OpenShiftCLIError('Could not retrieve clusterpolicybindings')
+            self._cluster_policy_bindings = results['results'][0]['items'][0]
+
+        return self._cluster_policy_bindings
 
     @property
     def role_binding(self):
@@ -81,18 +103,24 @@ class PolicyGroup(OpenShiftCLI):
 
     def exists_role_binding(self):
         ''' return whether role_binding exists '''
-        results = self.get()
-        if results['returncode'] == 0:
-            self.role_binding = RoleBinding(results['results'][0])
-            if self.role_binding.find_group_name(self.config.config_options['group']['value']) != None:
-                return True
+        bindings = None
+        if self.config.config_options['resource_kind']['value'] == 'cluster-role':
+            bindings = self.clusterpolicybindings
+        else:
+            bindings = self.policybindings
 
+        if bindings is None:
             return False
 
-        elif self.config.config_options['name']['value'] in results['stderr'] and '" not found' in results['stderr']:
-            return False
+        for binding in bindings['roleBindings']:
+            _rb = binding['roleBinding']
+            if _rb['roleRef']['name'] == self.config.config_options['name']['value'] and \
+                    _rb['groupNames'] is not None and \
+                    self.config.config_options['group']['value'] in _rb['groupNames']:
+                self.role_binding = binding
+                return True
 
-        return results
+        return False
 
     def exists_scc(self):
         ''' return whether scc exists '''
-- 
cgit v1.2.3