Fix oc policy remove-user to remove rolebindings too

Followup to openshift#18102 Signed-off-by: Simo Sorce <[email protected]>
simo5 · Feb 9, 2018 · d70e210 · d70e210
1 parent 073bb37
commit d70e210
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 2 deletions.
diff --git a/pkg/oc/admin/policy/remove_from_project.go b/pkg/oc/admin/policy/remove_from_project.go
@@ -176,7 +176,11 @@ func (o *RemoveFromProjectOptions) Run() error {
 		}
 
 		if !o.DryRun {
-			_, err = o.Client.RoleBindings(o.BindingNamespace).Update(&currBinding)
+			if len(currBinding.Subjects) > 0 {
+				_, err = o.Client.RoleBindings(o.BindingNamespace).Update(&currBinding)
+			} else {
+				err = o.Client.RoleBindings(o.BindingNamespace).Delete(currBinding.Name, &metav1.DeleteOptions{})
+			}
 			if err != nil {
 				return err
 			}

diff --git a/test/integration/policy_commands_test.go b/test/integration/policy_commands_test.go
@@ -4,6 +4,7 @@ import (
 	"io/ioutil"
 	"testing"
 
+	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	authorizationclient "github.com/openshift/origin/pkg/authorization/generated/internalclientset"
@@ -90,7 +91,7 @@ func TestPolicyCommands(t *testing.T) {
 	}
 
 	viewers, err = haroldAuthorizationClient.RoleBindings(projectName).Get("view", metav1.GetOptions{})
-	if err != nil {
+	if !errors.IsNotFound(err) {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	binding = authorizationinterfaces.NewLocalRoleBindingAdapter(viewers)