Fix tests

Signed-off-by: Monis Khan <mkhan@redhat.com>

Author: enj

pkg/authorization/authorizer/scope/converter.go

@@ -7,6 +7,7 @@ import (
 	kapi "k8s.io/kubernetes/pkg/api"
 	kapierrors "k8s.io/kubernetes/pkg/api/errors"
 	"k8s.io/kubernetes/pkg/api/unversioned"
+	kauthorizationapi "k8s.io/kubernetes/pkg/apis/authorization"
 	"k8s.io/kubernetes/pkg/conversion"
 	kutilerrors "k8s.io/kubernetes/pkg/util/errors"
 	"k8s.io/kubernetes/pkg/util/sets"
@@ -174,6 +175,7 @@ func (userEvaluator) ResolveRules(scope, namespace string, clusterPolicyGetter c
 	case UserAccessCheck:
 		return []authorizationapi.PolicyRule{
 			{Verbs: sets.NewString("create"), APIGroups: []string{authorizationapi.GroupName}, Resources: sets.NewString("subjectaccessreviews", "localsubjectaccessreviews"), AttributeRestrictions: &authorizationapi.IsPersonalSubjectAccessReview{}},
+			authorizationapi.NewRule("create").Groups(kauthorizationapi.GroupName).Resources("selfsubjectaccessreviews").RuleOrDie(),
 			authorizationapi.NewRule("create").Groups(authorizationapi.GroupName).Resources("selfsubjectrulesreviews").RuleOrDie(),
 		}, nil
 	case UserListScopedProjects:

test/cmd/authentication.sh

@@ -74,7 +74,7 @@ os::cmd::expect_success_and_text "curl -k -XPOST -H 'Content-Type: application/j
 os::cmd::expect_success_and_text "oc policy can-i create pods --token='${accesstoken}' -n '${project}' --ignore-scopes" 'yes'
 os::cmd::expect_success_and_text "oc policy can-i create pods --token='${accesstoken}' -n '${project}'" 'no'
 os::cmd::expect_success_and_text "oc policy can-i create subjectaccessreviews --token='${accesstoken}' -n '${project}'" 'no'
-os::cmd::expect_success_and_text "oc policy can-i create subjectaccessreviews --token='${accesstoken}' -n '${project}' --ignore-scopes" 'yes'
+os::cmd::expect_success_and_text "oc policy can-i create subjectaccessreviews.v1. --token='${accesstoken}' -n '${project}' --ignore-scopes" 'yes'
 os::cmd::expect_success_and_text "oc policy can-i create pods --token='${accesstoken}' -n '${project}' --scopes='role:admin:*'" 'yes'
 os::cmd::expect_success_and_text "oc policy can-i --list --token='${accesstoken}' -n '${project}' --scopes='role:admin:*'" 'get.*pods'
 os::cmd::expect_success_and_not_text "oc policy can-i --list --token='${accesstoken}' -n '${project}'" 'get.*pods'

test/integration/authorization_test.go

@@ -672,7 +672,7 @@ func (test subjectAccessReviewTest) run(t *testing.T) {
 	if test.kubeAuthInterface != nil {
 		var testNS string
 		if test.localReview != nil {
-			if test.localReview != nil && len(test.localReview.Namespace) > 0 {
+			if len(test.localReview.Namespace) > 0 {
 				testNS = test.localReview.Namespace
 			} else if len(test.response.Namespace) > 0 {
 				testNS = test.response.Namespace

test/testdata/bootstrappolicy/bootstrap_cluster_roles.yaml

@@ -329,6 +329,15 @@ items:
     - subjectrulesreviews
     verbs:
     - create
+  - apiGroups:
+    - authorization.k8s.io
+    attributeRestrictions: null
+    resources:
+    - localsubjectaccessreviews
+    - selfsubjectaccessreviews
+    - subjectaccessreviews
+    verbs:
+    - create
   - apiGroups:
     - authentication.k8s.io
     attributeRestrictions: null
@@ -679,6 +688,13 @@ items:
     - subjectrulesreviews
     verbs:
     - create
+  - apiGroups:
+    - authorization.k8s.io
+    attributeRestrictions: null
+    resources:
+    - localsubjectaccessreviews
+    verbs:
+    - create
   - apiGroups:
     - ""
     attributeRestrictions: null
@@ -1549,6 +1565,13 @@ items:
     - subjectaccessreviews
     verbs:
     - create
+  - apiGroups:
+    - authorization.k8s.io
+    attributeRestrictions: null
+    resources:
+    - selfsubjectaccessreviews
+    verbs:
+    - create
 - apiVersion: v1
   kind: ClusterRole
   metadata:
@@ -1574,6 +1597,13 @@ items:
     - subjectaccessreviews
     verbs:
     - create
+  - apiGroups:
+    - authorization.k8s.io
+    attributeRestrictions: null
+    resources:
+    - selfsubjectaccessreviews
+    verbs:
+    - create
 - apiVersion: v1
   kind: ClusterRole
   metadata:
@@ -2089,6 +2119,14 @@ items:
     - subjectaccessreviews
     verbs:
     - create
+  - apiGroups:
+    - authorization.k8s.io
+    attributeRestrictions: null
+    resources:
+    - localsubjectaccessreviews
+    - subjectaccessreviews
+    verbs:
+    - create
   - apiGroups:
     - ""
     attributeRestrictions: null
@@ -2386,6 +2424,13 @@ items:
     - subjectrulesreviews
     verbs:
     - create
+  - apiGroups:
+    - authorization.k8s.io
+    attributeRestrictions: null
+    resources:
+    - localsubjectaccessreviews
+    verbs:
+    - create
   - apiGroups:
     - ""
     attributeRestrictions: null