func EnsureScaledownJobRBAC(kubeClient kubernetes.Interface, owner *metav1.OwnerReference, namespace string) error {
	// ensure roles
	meta := metav1.ObjectMeta{
		Name:      ScaledownJobRole,
		Namespace: namespace,
	}
	_, _, err := rbac_util.CreateOrPatchRole(kubeClient, meta, func(in *rbac.Role) *rbac.Role {
		core_util.EnsureOwnerReference(&in.ObjectMeta, owner)

		if in.Labels == nil {
			in.Labels = map[string]string{}
		}
		in.Labels[apis.LabelApp] = apis.AppLabelStash

		in.Rules = []rbac.PolicyRule{
			{
				APIGroups: []string{core.GroupName},
				Resources: []string{"pods"},
				Verbs:     []string{"get", "list", "delete", "deletecollection"},
			},
			{
				APIGroups: []string{apps.GroupName},
				Resources: []string{"deployments", "statefulsets"},
				Verbs:     []string{"get", "list", "patch"},
			},
			{
				APIGroups: []string{apps.GroupName},
				Resources: []string{"daemonsets", "replicasets"},
				Verbs:     []string{"get", "list", "patch"},
			},
			{
				APIGroups: []string{core.GroupName},
				Resources: []string{"replicationcontrollers"},
				Verbs:     []string{"get", "list", "patch"},
			},
		}
		return in
	})
	if err != nil {
		return err
	}

	// ensure service account
	meta = metav1.ObjectMeta{
		Name:      owner.Name,
		Namespace: namespace,
	}
	_, _, err = core_util.CreateOrPatchServiceAccount(kubeClient, meta, func(in *core.ServiceAccount) *core.ServiceAccount {
		core_util.EnsureOwnerReference(&in.ObjectMeta, owner)
		if in.Labels == nil {
			in.Labels = map[string]string{}
		}
		in.Labels[apis.LabelApp] = apis.AppLabelStash
		return in
	})
	if err != nil {
		return err
	}

	// ensure role binding
	_, _, err = rbac_util.CreateOrPatchRoleBinding(kubeClient, meta, func(in *rbac.RoleBinding) *rbac.RoleBinding {
		core_util.EnsureOwnerReference(&in.ObjectMeta, owner)

		if in.Labels == nil {
			in.Labels = map[string]string{}
		}
		in.Labels[apis.LabelApp] = apis.AppLabelStash

		in.RoleRef = rbac.RoleRef{
			APIGroup: rbac.GroupName,
			Kind:     apis.KindRole,
			Name:     ScaledownJobRole,
		}
		in.Subjects = []rbac.Subject{
			{
				Kind:      rbac.ServiceAccountKind,
				Name:      meta.Name,
				Namespace: meta.Namespace,
			},
		}
		return in
	})
	return err
}
// use scaledownjob-role, service-account and role-binding name same as job name
// set job as owner of role, service-account and role-binding
use scaledownjob-role, service-account and role-binding name same as job name
set job as owner of role, service-account and role-binding
// use scaledownjob - role service - account and role - binding name same as job name // set job as owner of role service - account and role - binding
func EnsureScaledownJobRBAC(kubeClient kubernetes.Interface, owner *metav1.OwnerReference, namespace string) error {
	meta := metav1.ObjectMeta{
		Name:      ScaledownJobRole,
		Namespace: namespace,
	}
	_, _, err := rbac_util.CreateOrPatchRole(kubeClient, meta, func(in *rbac.Role) *rbac.Role {
		core_util.EnsureOwnerReference(&in.ObjectMeta, owner)
		if in.Labels == nil {
			in.Labels = map[string]string{}
		}
		in.Labels[apis.LabelApp] = apis.AppLabelStash
		in.Rules = []rbac.PolicyRule{
			{
				APIGroups: []string{core.GroupName},
				Resources: []string{"pods"},
				Verbs:     []string{"get", "list", "delete", "deletecollection"},
			},
			{
				APIGroups: []string{apps.GroupName},
				Resources: []string{"deployments", "statefulsets"},
				Verbs:     []string{"get", "list", "patch"},
			},
			{
				APIGroups: []string{apps.GroupName},
				Resources: []string{"daemonsets", "replicasets"},
				Verbs:     []string{"get", "list", "patch"},
			},
			{
				APIGroups: []string{core.GroupName},
				Resources: []string{"replicationcontrollers"},
				Verbs:     []string{"get", "list", "patch"},
			},
		}
		return in
	})
	if err != nil {
		return err
	}
	meta = metav1.ObjectMeta{
		Name:      owner.Name,
		Namespace: namespace,
	}
	_, _, err = core_util.CreateOrPatchServiceAccount(kubeClient, meta, func(in *core.ServiceAccount) *core.ServiceAccount {
		core_util.EnsureOwnerReference(&in.ObjectMeta, owner)
		if in.Labels == nil {
			in.Labels = map[string]string{}
		}
		in.Labels[apis.LabelApp] = apis.AppLabelStash
		return in
	})
	if err != nil {
		return err
	}
	_, _, err = rbac_util.CreateOrPatchRoleBinding(kubeClient, meta, func(in *rbac.RoleBinding) *rbac.RoleBinding {
		core_util.EnsureOwnerReference(&in.ObjectMeta, owner)
		if in.Labels == nil {
			in.Labels = map[string]string{}
		}
		in.Labels[apis.LabelApp] = apis.AppLabelStash
		in.RoleRef = rbac.RoleRef{
			APIGroup: rbac.GroupName,
			Kind:     apis.KindRole,
			Name:     ScaledownJobRole,
		}
		in.Subjects = []rbac.Subject{
			{
				Kind:      rbac.ServiceAccountKind,
				Name:      meta.Name,
				Namespace: meta.Namespace,
			},
		}
		return in
	})
	return err
}
func EnsureScaledownJobRBAC ( kubeClient kubernetes . Interface , owner * metav1 . OwnerReference , namespace string ) error { meta := metav1 . ObjectMeta { Name : ScaledownJobRole , Namespace : namespace , } _ , _ , err := rbac_util . CreateOrPatchRole ( kubeClient , meta , func ( in * rbac . Role ) * rbac . Role { core_util . EnsureOwnerReference ( & in . ObjectMeta , owner ) if in . Labels == nil { in . Labels = map [ string ] string { } } in . Labels [ apis . LabelApp ] = apis . AppLabelStash in . Rules = [ ] rbac . PolicyRule { { APIGroups : [ ] string { core . GroupName } , Resources : [ ] string { " " } , Verbs : [ ] string { " " , " " , " " , " " } , } , { APIGroups : [ ] string { apps . GroupName } , Resources : [ ] string { " " , " " } , Verbs : [ ] string { " " , " " , " " } , } , { APIGroups : [ ] string { apps . GroupName } , Resources : [ ] string { " " , " " } , Verbs : [ ] string { " " , " " , " " } , } , { APIGroups : [ ] string { core . GroupName } , Resources : [ ] string { " " } , Verbs : [ ] string { " " , " " , " " } , } , } return in } ) if err != nil { return err } meta = metav1 . ObjectMeta { Name : owner . Name , Namespace : namespace , } _ , _ , err = core_util . CreateOrPatchServiceAccount ( kubeClient , meta , func ( in * core . ServiceAccount ) * core . ServiceAccount { core_util . EnsureOwnerReference ( & in . ObjectMeta , owner ) if in . Labels == nil { in . Labels = map [ string ] string { } } in . Labels [ apis . LabelApp ] = apis . AppLabelStash return in } ) if err != nil { return err } _ , _ , err = rbac_util . CreateOrPatchRoleBinding ( kubeClient , meta , func ( in * rbac . RoleBinding ) * rbac . RoleBinding { core_util . EnsureOwnerReference ( & in . ObjectMeta , owner ) if in . Labels == nil { in . Labels = map [ string ] string { } } in . Labels [ apis . LabelApp ] = apis . AppLabelStash in . RoleRef = rbac . RoleRef { APIGroup : rbac . GroupName , Kind : apis . KindRole , Name : ScaledownJobRole , } in . Subjects = [ ] rbac . Subject { { Kind : rbac . ServiceAccountKind , Name : meta . Name , Namespace : meta . Namespace , } , } return in } ) return err }
use scaledownjob-role, service-account and role-binding name same as job name
set job as owner of role, service-account and role-binding
use scaledownjob - role service - account and role - binding name same as job name set job as owner of role service - account and role - binding
// ensure roles // ensure service account // ensure role binding