feat:group authorizetion. Add group and groupbinding crds, generated clientset

Signed-off-by: Roland.Ma <rolandma@yunify.com>

config/crds/iam.kubesphere.io_groupbindings.yaml

@@ -0,0 +1,69 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: (devel)
+  creationTimestamp: null
+  name: groupbindings.iam.kubesphere.io
+spec:
+  additionalPrinterColumns:
+  - JSONPath: .groupRef.name
+    name: Group
+    type: string
+  - JSONPath: .users
+    name: Users
+    type: string
+  group: iam.kubesphere.io
+  names:
+    categories:
+    - group
+    kind: GroupBinding
+    listKind: GroupBindingList
+    plural: groupbindings
+    singular: groupbinding
+  scope: Cluster
+  subresources: {}
+  validation:
+    openAPIV3Schema:
+      description: GroupBinding is the Schema for the groupbindings API
+      properties:
+        apiVersion:
+          description: 'APIVersion defines the versioned schema of this representation
+            of an object. Servers should convert recognized schemas to the latest
+            internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+          type: string
+        groupRef:
+          description: Ref defines the desired relation of GroupBinding
+          properties:
+            apiGroup:
+              type: string
+            kind:
+              type: string
+            name:
+              type: string
+          type: object
+        kind:
+          description: 'Kind is a string value representing the REST resource this
+            object represents. Servers may infer this from the endpoint the client
+            submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+          type: string
+        metadata:
+          type: object
+        users:
+          items:
+            type: string
+          type: array
+      type: object
+  version: v1alpha2
+  versions:
+  - name: v1alpha2
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

config/crds/iam.kubesphere.io_groups.yaml

@@ -0,0 +1,58 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: (devel)
+  creationTimestamp: null
+  name: groups.iam.kubesphere.io
+spec:
+  additionalPrinterColumns:
+  - JSONPath: .metadata.labels.kubesphere\.io/workspace
+    name: Workspace
+    type: string
+  group: iam.kubesphere.io
+  names:
+    categories:
+    - group
+    kind: Group
+    listKind: GroupList
+    plural: groups
+    singular: group
+  scope: Cluster
+  subresources: {}
+  validation:
+    openAPIV3Schema:
+      description: Group is the Schema for the groups API
+      properties:
+        apiVersion:
+          description: 'APIVersion defines the versioned schema of this representation
+            of an object. Servers should convert recognized schemas to the latest
+            internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+          type: string
+        kind:
+          description: 'Kind is a string value representing the REST resource this
+            object represents. Servers may infer this from the endpoint the client
+            submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+          type: string
+        metadata:
+          type: object
+        spec:
+          description: GroupSpec defines the desired state of Group
+          type: object
+        status:
+          description: GroupStatus defines the observed state of Group
+          type: object
+      type: object
+  version: v1alpha2
+  versions:
+  - name: v1alpha2
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

config/samples/iam_v1alpha2_group.yaml

@@ -0,0 +1,4 @@
+apiVersion: iam.kubesphere.io/v1alpha2
+kind: Group
+metadata:
+  name: group2

config/samples/iam_v1alpha2_groupbinding.yaml

@@ -0,0 +1,12 @@
+apiVersion: iam.kubesphere.io/v1alpha2
+kind: GroupBinding
+metadata:
+  name: groupbinding-sample1
+groupRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Group
+  name: groupdemo
+users:
+- user1
+- user2
+

config/samples/iam_v1alpha2_rolebindings.yaml

@@ -0,0 +1,16 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    iam.kubesphere.io/group-ref: admin
+  name: group-group1-admin
+  namespace: proj2
+  
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: admin
+subjects:
+- apiGroup: rbac.authorization.k8s.io
+  kind: Group
+  name: group1

pkg/apis/iam/v1alpha2/group_types.go

@@ -0,0 +1,63 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha2
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+const (
+	ResourcePluralGroup = "groups"
+	GroupReferenceLabel = "iam.kubesphere.io/group-ref"
+	GroupParent         = "iam.kubesphere.io/group-parent"
+)
+
+// GroupSpec defines the desired state of Group
+type GroupSpec struct {
+}
+
+// GroupStatus defines the observed state of Group
+type GroupStatus struct {
+	// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
+	// Important: Run "make" to regenerate code after modifying this file
+}
+
+// +genclient:nonNamespaced
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:openapi-gen=true
+// +kubebuilder:printcolumn:name="Workspace",type="string",JSONPath=".metadata.labels.kubesphere\\.io/workspace"
+// +kubebuilder:resource:categories="group",scope="Cluster"
+
+// Group is the Schema for the groups API
+type Group struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   GroupSpec   `json:"spec,omitempty"`
+	Status GroupStatus `json:"status,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +genclient:nonNamespaced
+
+// GroupList contains a list of Group
+type GroupList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []Group `json:"items"`
+}

pkg/apis/iam/v1alpha2/groupbinding_types.go

@@ -0,0 +1,55 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha2
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// GroupRef defines the desired relation of GroupBinding
+type GroupRef struct {
+	APIGroup string `json:"apiGroup,omitempty"`
+	Kind     string `json:"kind,omitempty"`
+	Name     string `json:"name,omitempty"`
+}
+
+// +genclient:nonNamespaced
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:openapi-gen=true
+// +kubebuilder:printcolumn:name="Group",type="string",JSONPath=".groupRef.name"
+// +kubebuilder:printcolumn:name="Users",type="string",JSONPath=".users"
+// +kubebuilder:resource:categories="group",scope="Cluster"
+
+// GroupBinding is the Schema for the groupbindings API
+type GroupBinding struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	GroupRef GroupRef `json:"groupRef,omitempty"`
+	Users    []string `json:"users,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +genclient:nonNamespaced
+
+// GroupBindingList contains a list of GroupBinding
+type GroupBindingList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []GroupBinding `json:"items"`
+}

pkg/apis/iam/v1alpha2/register.go

@@ -63,6 +63,10 @@ func addKnownTypes(scheme *runtime.Scheme) error {
 		&WorkspaceRoleBindingList{},
 		&RoleBase{},
 		&RoleBaseList{},
+		&Group{},
+		&GroupList{},
+		&GroupBinding{},
+		&GroupBindingList{},
 	)
 	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
 	return nil

pkg/apis/iam/v1alpha2/zz_generated.deepcopy.go

@@ -306,6 +306,180 @@ func (in *GlobalRoleList) DeepCopyObject() runtime.Object {
 	return nil
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Group) DeepCopyInto(out *Group) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.Spec = in.Spec
+	out.Status = in.Status
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Group.
+func (in *Group) DeepCopy() *Group {
+	if in == nil {
+		return nil
+	}
+	out := new(Group)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Group) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GroupBinding) DeepCopyInto(out *GroupBinding) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.GroupRef = in.GroupRef
+	if in.Users != nil {
+		in, out := &in.Users, &out.Users
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GroupBinding.
+func (in *GroupBinding) DeepCopy() *GroupBinding {
+	if in == nil {
+		return nil
+	}
+	out := new(GroupBinding)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *GroupBinding) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GroupBindingList) DeepCopyInto(out *GroupBindingList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]GroupBinding, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GroupBindingList.
+func (in *GroupBindingList) DeepCopy() *GroupBindingList {
+	if in == nil {
+		return nil
+	}
+	out := new(GroupBindingList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *GroupBindingList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GroupList) DeepCopyInto(out *GroupList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Group, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GroupList.
+func (in *GroupList) DeepCopy() *GroupList {
+	if in == nil {
+		return nil
+	}
+	out := new(GroupList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *GroupList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GroupRef) DeepCopyInto(out *GroupRef) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GroupRef.
+func (in *GroupRef) DeepCopy() *GroupRef {
+	if in == nil {
+		return nil
+	}
+	out := new(GroupRef)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GroupSpec) DeepCopyInto(out *GroupSpec) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GroupSpec.
+func (in *GroupSpec) DeepCopy() *GroupSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(GroupSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GroupStatus) DeepCopyInto(out *GroupStatus) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GroupStatus.
+func (in *GroupStatus) DeepCopy() *GroupStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(GroupStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *LoginRecord) DeepCopyInto(out *LoginRecord) {
 	*out = *in

pkg/client/clientset/versioned/typed/iam/v1alpha2/fake/fake_group.go

@@ -0,0 +1,131 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+	v1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
+)
+
+// FakeGroups implements GroupInterface
+type FakeGroups struct {
+	Fake *FakeIamV1alpha2
+}
+
+var groupsResource = schema.GroupVersionResource{Group: "iam.kubesphere.io", Version: "v1alpha2", Resource: "groups"}
+
+var groupsKind = schema.GroupVersionKind{Group: "iam.kubesphere.io", Version: "v1alpha2", Kind: "Group"}
+
+// Get takes name of the group, and returns the corresponding group object, and an error if there is any.
+func (c *FakeGroups) Get(name string, options v1.GetOptions) (result *v1alpha2.Group, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootGetAction(groupsResource, name), &v1alpha2.Group{})
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.Group), err
+}
+
+// List takes label and field selectors, and returns the list of Groups that match those selectors.
+func (c *FakeGroups) List(opts v1.ListOptions) (result *v1alpha2.GroupList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootListAction(groupsResource, groupsKind, opts), &v1alpha2.GroupList{})
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &v1alpha2.GroupList{ListMeta: obj.(*v1alpha2.GroupList).ListMeta}
+	for _, item := range obj.(*v1alpha2.GroupList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested groups.
+func (c *FakeGroups) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewRootWatchAction(groupsResource, opts))
+}
+
+// Create takes the representation of a group and creates it.  Returns the server's representation of the group, and an error, if there is any.
+func (c *FakeGroups) Create(group *v1alpha2.Group) (result *v1alpha2.Group, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootCreateAction(groupsResource, group), &v1alpha2.Group{})
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.Group), err
+}
+
+// Update takes the representation of a group and updates it. Returns the server's representation of the group, and an error, if there is any.
+func (c *FakeGroups) Update(group *v1alpha2.Group) (result *v1alpha2.Group, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootUpdateAction(groupsResource, group), &v1alpha2.Group{})
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.Group), err
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+func (c *FakeGroups) UpdateStatus(group *v1alpha2.Group) (*v1alpha2.Group, error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootUpdateSubresourceAction(groupsResource, "status", group), &v1alpha2.Group{})
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.Group), err
+}
+
+// Delete takes name of the group and deletes it. Returns an error if one occurs.
+func (c *FakeGroups) Delete(name string, options *v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewRootDeleteAction(groupsResource, name), &v1alpha2.Group{})
+	return err
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *FakeGroups) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	action := testing.NewRootDeleteCollectionAction(groupsResource, listOptions)
+
+	_, err := c.Fake.Invokes(action, &v1alpha2.GroupList{})
+	return err
+}
+
+// Patch applies the patch and returns the patched group.
+func (c *FakeGroups) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha2.Group, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootPatchSubresourceAction(groupsResource, name, pt, data, subresources...), &v1alpha2.Group{})
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.Group), err
+}

pkg/client/clientset/versioned/typed/iam/v1alpha2/fake/fake_groupbinding.go

@@ -0,0 +1,120 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+	v1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
+)
+
+// FakeGroupBindings implements GroupBindingInterface
+type FakeGroupBindings struct {
+	Fake *FakeIamV1alpha2
+}
+
+var groupbindingsResource = schema.GroupVersionResource{Group: "iam.kubesphere.io", Version: "v1alpha2", Resource: "groupbindings"}
+
+var groupbindingsKind = schema.GroupVersionKind{Group: "iam.kubesphere.io", Version: "v1alpha2", Kind: "GroupBinding"}
+
+// Get takes name of the groupBinding, and returns the corresponding groupBinding object, and an error if there is any.
+func (c *FakeGroupBindings) Get(name string, options v1.GetOptions) (result *v1alpha2.GroupBinding, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootGetAction(groupbindingsResource, name), &v1alpha2.GroupBinding{})
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.GroupBinding), err
+}
+
+// List takes label and field selectors, and returns the list of GroupBindings that match those selectors.
+func (c *FakeGroupBindings) List(opts v1.ListOptions) (result *v1alpha2.GroupBindingList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootListAction(groupbindingsResource, groupbindingsKind, opts), &v1alpha2.GroupBindingList{})
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &v1alpha2.GroupBindingList{ListMeta: obj.(*v1alpha2.GroupBindingList).ListMeta}
+	for _, item := range obj.(*v1alpha2.GroupBindingList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested groupBindings.
+func (c *FakeGroupBindings) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewRootWatchAction(groupbindingsResource, opts))
+}
+
+// Create takes the representation of a groupBinding and creates it.  Returns the server's representation of the groupBinding, and an error, if there is any.
+func (c *FakeGroupBindings) Create(groupBinding *v1alpha2.GroupBinding) (result *v1alpha2.GroupBinding, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootCreateAction(groupbindingsResource, groupBinding), &v1alpha2.GroupBinding{})
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.GroupBinding), err
+}
+
+// Update takes the representation of a groupBinding and updates it. Returns the server's representation of the groupBinding, and an error, if there is any.
+func (c *FakeGroupBindings) Update(groupBinding *v1alpha2.GroupBinding) (result *v1alpha2.GroupBinding, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootUpdateAction(groupbindingsResource, groupBinding), &v1alpha2.GroupBinding{})
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.GroupBinding), err
+}
+
+// Delete takes name of the groupBinding and deletes it. Returns an error if one occurs.
+func (c *FakeGroupBindings) Delete(name string, options *v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewRootDeleteAction(groupbindingsResource, name), &v1alpha2.GroupBinding{})
+	return err
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *FakeGroupBindings) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	action := testing.NewRootDeleteCollectionAction(groupbindingsResource, listOptions)
+
+	_, err := c.Fake.Invokes(action, &v1alpha2.GroupBindingList{})
+	return err
+}
+
+// Patch applies the patch and returns the patched groupBinding.
+func (c *FakeGroupBindings) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha2.GroupBinding, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootPatchSubresourceAction(groupbindingsResource, name, pt, data, subresources...), &v1alpha2.GroupBinding{})
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.GroupBinding), err
+}

pkg/client/clientset/versioned/typed/iam/v1alpha2/fake/fake_iam_client.go

@@ -36,6 +36,14 @@ func (c *FakeIamV1alpha2) GlobalRoleBindings() v1alpha2.GlobalRoleBindingInterfa
 	return &FakeGlobalRoleBindings{c}
 }
 
+func (c *FakeIamV1alpha2) Groups() v1alpha2.GroupInterface {
+	return &FakeGroups{c}
+}
+
+func (c *FakeIamV1alpha2) GroupBindings() v1alpha2.GroupBindingInterface {
+	return &FakeGroupBindings{c}
+}
+
 func (c *FakeIamV1alpha2) LoginRecords() v1alpha2.LoginRecordInterface {
 	return &FakeLoginRecords{c}
 }

pkg/client/clientset/versioned/typed/iam/v1alpha2/generated_expansion.go

@@ -22,6 +22,10 @@ type GlobalRoleExpansion interface{}
 
 type GlobalRoleBindingExpansion interface{}
 
+type GroupExpansion interface{}
+
+type GroupBindingExpansion interface{}
+
 type LoginRecordExpansion interface{}
 
 type RoleBaseExpansion interface{}

pkg/client/clientset/versioned/typed/iam/v1alpha2/group.go

@@ -0,0 +1,180 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha2
+
+import (
+	"time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+	v1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
+	scheme "kubesphere.io/kubesphere/pkg/client/clientset/versioned/scheme"
+)
+
+// GroupsGetter has a method to return a GroupInterface.
+// A group's client should implement this interface.
+type GroupsGetter interface {
+	Groups() GroupInterface
+}
+
+// GroupInterface has methods to work with Group resources.
+type GroupInterface interface {
+	Create(*v1alpha2.Group) (*v1alpha2.Group, error)
+	Update(*v1alpha2.Group) (*v1alpha2.Group, error)
+	UpdateStatus(*v1alpha2.Group) (*v1alpha2.Group, error)
+	Delete(name string, options *v1.DeleteOptions) error
+	DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error
+	Get(name string, options v1.GetOptions) (*v1alpha2.Group, error)
+	List(opts v1.ListOptions) (*v1alpha2.GroupList, error)
+	Watch(opts v1.ListOptions) (watch.Interface, error)
+	Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha2.Group, err error)
+	GroupExpansion
+}
+
+// groups implements GroupInterface
+type groups struct {
+	client rest.Interface
+}
+
+// newGroups returns a Groups
+func newGroups(c *IamV1alpha2Client) *groups {
+	return &groups{
+		client: c.RESTClient(),
+	}
+}
+
+// Get takes name of the group, and returns the corresponding group object, and an error if there is any.
+func (c *groups) Get(name string, options v1.GetOptions) (result *v1alpha2.Group, err error) {
+	result = &v1alpha2.Group{}
+	err = c.client.Get().
+		Resource("groups").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of Groups that match those selectors.
+func (c *groups) List(opts v1.ListOptions) (result *v1alpha2.GroupList, err error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	result = &v1alpha2.GroupList{}
+	err = c.client.Get().
+		Resource("groups").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Do().
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested groups.
+func (c *groups) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	opts.Watch = true
+	return c.client.Get().
+		Resource("groups").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Watch()
+}
+
+// Create takes the representation of a group and creates it.  Returns the server's representation of the group, and an error, if there is any.
+func (c *groups) Create(group *v1alpha2.Group) (result *v1alpha2.Group, err error) {
+	result = &v1alpha2.Group{}
+	err = c.client.Post().
+		Resource("groups").
+		Body(group).
+		Do().
+		Into(result)
+	return
+}
+
+// Update takes the representation of a group and updates it. Returns the server's representation of the group, and an error, if there is any.
+func (c *groups) Update(group *v1alpha2.Group) (result *v1alpha2.Group, err error) {
+	result = &v1alpha2.Group{}
+	err = c.client.Put().
+		Resource("groups").
+		Name(group.Name).
+		Body(group).
+		Do().
+		Into(result)
+	return
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+
+func (c *groups) UpdateStatus(group *v1alpha2.Group) (result *v1alpha2.Group, err error) {
+	result = &v1alpha2.Group{}
+	err = c.client.Put().
+		Resource("groups").
+		Name(group.Name).
+		SubResource("status").
+		Body(group).
+		Do().
+		Into(result)
+	return
+}
+
+// Delete takes name of the group and deletes it. Returns an error if one occurs.
+func (c *groups) Delete(name string, options *v1.DeleteOptions) error {
+	return c.client.Delete().
+		Resource("groups").
+		Name(name).
+		Body(options).
+		Do().
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *groups) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	var timeout time.Duration
+	if listOptions.TimeoutSeconds != nil {
+		timeout = time.Duration(*listOptions.TimeoutSeconds) * time.Second
+	}
+	return c.client.Delete().
+		Resource("groups").
+		VersionedParams(&listOptions, scheme.ParameterCodec).
+		Timeout(timeout).
+		Body(options).
+		Do().
+		Error()
+}
+
+// Patch applies the patch and returns the patched group.
+func (c *groups) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha2.Group, err error) {
+	result = &v1alpha2.Group{}
+	err = c.client.Patch(pt).
+		Resource("groups").
+		SubResource(subresources...).
+		Name(name).
+		Body(data).
+		Do().
+		Into(result)
+	return
+}

pkg/client/clientset/versioned/typed/iam/v1alpha2/groupbinding.go

@@ -0,0 +1,164 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha2
+
+import (
+	"time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+	v1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
+	scheme "kubesphere.io/kubesphere/pkg/client/clientset/versioned/scheme"
+)
+
+// GroupBindingsGetter has a method to return a GroupBindingInterface.
+// A group's client should implement this interface.
+type GroupBindingsGetter interface {
+	GroupBindings() GroupBindingInterface
+}
+
+// GroupBindingInterface has methods to work with GroupBinding resources.
+type GroupBindingInterface interface {
+	Create(*v1alpha2.GroupBinding) (*v1alpha2.GroupBinding, error)
+	Update(*v1alpha2.GroupBinding) (*v1alpha2.GroupBinding, error)
+	Delete(name string, options *v1.DeleteOptions) error
+	DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error
+	Get(name string, options v1.GetOptions) (*v1alpha2.GroupBinding, error)
+	List(opts v1.ListOptions) (*v1alpha2.GroupBindingList, error)
+	Watch(opts v1.ListOptions) (watch.Interface, error)
+	Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha2.GroupBinding, err error)
+	GroupBindingExpansion
+}
+
+// groupBindings implements GroupBindingInterface
+type groupBindings struct {
+	client rest.Interface
+}
+
+// newGroupBindings returns a GroupBindings
+func newGroupBindings(c *IamV1alpha2Client) *groupBindings {
+	return &groupBindings{
+		client: c.RESTClient(),
+	}
+}
+
+// Get takes name of the groupBinding, and returns the corresponding groupBinding object, and an error if there is any.
+func (c *groupBindings) Get(name string, options v1.GetOptions) (result *v1alpha2.GroupBinding, err error) {
+	result = &v1alpha2.GroupBinding{}
+	err = c.client.Get().
+		Resource("groupbindings").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do().
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of GroupBindings that match those selectors.
+func (c *groupBindings) List(opts v1.ListOptions) (result *v1alpha2.GroupBindingList, err error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	result = &v1alpha2.GroupBindingList{}
+	err = c.client.Get().
+		Resource("groupbindings").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Do().
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested groupBindings.
+func (c *groupBindings) Watch(opts v1.ListOptions) (watch.Interface, error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	opts.Watch = true
+	return c.client.Get().
+		Resource("groupbindings").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Watch()
+}
+
+// Create takes the representation of a groupBinding and creates it.  Returns the server's representation of the groupBinding, and an error, if there is any.
+func (c *groupBindings) Create(groupBinding *v1alpha2.GroupBinding) (result *v1alpha2.GroupBinding, err error) {
+	result = &v1alpha2.GroupBinding{}
+	err = c.client.Post().
+		Resource("groupbindings").
+		Body(groupBinding).
+		Do().
+		Into(result)
+	return
+}
+
+// Update takes the representation of a groupBinding and updates it. Returns the server's representation of the groupBinding, and an error, if there is any.
+func (c *groupBindings) Update(groupBinding *v1alpha2.GroupBinding) (result *v1alpha2.GroupBinding, err error) {
+	result = &v1alpha2.GroupBinding{}
+	err = c.client.Put().
+		Resource("groupbindings").
+		Name(groupBinding.Name).
+		Body(groupBinding).
+		Do().
+		Into(result)
+	return
+}
+
+// Delete takes name of the groupBinding and deletes it. Returns an error if one occurs.
+func (c *groupBindings) Delete(name string, options *v1.DeleteOptions) error {
+	return c.client.Delete().
+		Resource("groupbindings").
+		Name(name).
+		Body(options).
+		Do().
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *groupBindings) DeleteCollection(options *v1.DeleteOptions, listOptions v1.ListOptions) error {
+	var timeout time.Duration
+	if listOptions.TimeoutSeconds != nil {
+		timeout = time.Duration(*listOptions.TimeoutSeconds) * time.Second
+	}
+	return c.client.Delete().
+		Resource("groupbindings").
+		VersionedParams(&listOptions, scheme.ParameterCodec).
+		Timeout(timeout).
+		Body(options).
+		Do().
+		Error()
+}
+
+// Patch applies the patch and returns the patched groupBinding.
+func (c *groupBindings) Patch(name string, pt types.PatchType, data []byte, subresources ...string) (result *v1alpha2.GroupBinding, err error) {
+	result = &v1alpha2.GroupBinding{}
+	err = c.client.Patch(pt).
+		Resource("groupbindings").
+		SubResource(subresources...).
+		Name(name).
+		Body(data).
+		Do().
+		Into(result)
+	return
+}

pkg/client/clientset/versioned/typed/iam/v1alpha2/iam_client.go

@@ -28,6 +28,8 @@ type IamV1alpha2Interface interface {
 	RESTClient() rest.Interface
 	GlobalRolesGetter
 	GlobalRoleBindingsGetter
+	GroupsGetter
+	GroupBindingsGetter
 	LoginRecordsGetter
 	RoleBasesGetter
 	UsersGetter
@@ -48,6 +50,14 @@ func (c *IamV1alpha2Client) GlobalRoleBindings() GlobalRoleBindingInterface {
 	return newGlobalRoleBindings(c)
 }
 
+func (c *IamV1alpha2Client) Groups() GroupInterface {
+	return newGroups(c)
+}
+
+func (c *IamV1alpha2Client) GroupBindings() GroupBindingInterface {
+	return newGroupBindings(c)
+}
+
 func (c *IamV1alpha2Client) LoginRecords() LoginRecordInterface {
 	return newLoginRecords(c)
 }

pkg/client/informers/externalversions/generic.go

@@ -93,6 +93,10 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Iam().V1alpha2().GlobalRoles().Informer()}, nil
 	case v1alpha2.SchemeGroupVersion.WithResource("globalrolebindings"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Iam().V1alpha2().GlobalRoleBindings().Informer()}, nil
+	case v1alpha2.SchemeGroupVersion.WithResource("groups"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Iam().V1alpha2().Groups().Informer()}, nil
+	case v1alpha2.SchemeGroupVersion.WithResource("groupbindings"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Iam().V1alpha2().GroupBindings().Informer()}, nil
 	case v1alpha2.SchemeGroupVersion.WithResource("loginrecords"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Iam().V1alpha2().LoginRecords().Informer()}, nil
 	case v1alpha2.SchemeGroupVersion.WithResource("rolebases"):

pkg/client/informers/externalversions/iam/v1alpha2/group.go

@@ -0,0 +1,88 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha2
+
+import (
+	time "time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
+	versioned "kubesphere.io/kubesphere/pkg/client/clientset/versioned"
+	internalinterfaces "kubesphere.io/kubesphere/pkg/client/informers/externalversions/internalinterfaces"
+	v1alpha2 "kubesphere.io/kubesphere/pkg/client/listers/iam/v1alpha2"
+)
+
+// GroupInformer provides access to a shared informer and lister for
+// Groups.
+type GroupInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() v1alpha2.GroupLister
+}
+
+type groupInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// NewGroupInformer constructs a new informer for Group type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewGroupInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredGroupInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredGroupInformer constructs a new informer for Group type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredGroupInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.IamV1alpha2().Groups().List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.IamV1alpha2().Groups().Watch(options)
+			},
+		},
+		&iamv1alpha2.Group{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (f *groupInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredGroupInformer(client, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+}
+
+func (f *groupInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&iamv1alpha2.Group{}, f.defaultInformer)
+}
+
+func (f *groupInformer) Lister() v1alpha2.GroupLister {
+	return v1alpha2.NewGroupLister(f.Informer().GetIndexer())
+}

pkg/client/informers/externalversions/iam/v1alpha2/groupbinding.go

@@ -0,0 +1,88 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha2
+
+import (
+	time "time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
+	versioned "kubesphere.io/kubesphere/pkg/client/clientset/versioned"
+	internalinterfaces "kubesphere.io/kubesphere/pkg/client/informers/externalversions/internalinterfaces"
+	v1alpha2 "kubesphere.io/kubesphere/pkg/client/listers/iam/v1alpha2"
+)
+
+// GroupBindingInformer provides access to a shared informer and lister for
+// GroupBindings.
+type GroupBindingInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() v1alpha2.GroupBindingLister
+}
+
+type groupBindingInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// NewGroupBindingInformer constructs a new informer for GroupBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewGroupBindingInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredGroupBindingInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredGroupBindingInformer constructs a new informer for GroupBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredGroupBindingInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.IamV1alpha2().GroupBindings().List(options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.IamV1alpha2().GroupBindings().Watch(options)
+			},
+		},
+		&iamv1alpha2.GroupBinding{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (f *groupBindingInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredGroupBindingInformer(client, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+}
+
+func (f *groupBindingInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&iamv1alpha2.GroupBinding{}, f.defaultInformer)
+}
+
+func (f *groupBindingInformer) Lister() v1alpha2.GroupBindingLister {
+	return v1alpha2.NewGroupBindingLister(f.Informer().GetIndexer())
+}

pkg/client/informers/externalversions/iam/v1alpha2/interface.go

@@ -28,6 +28,10 @@ type Interface interface {
 	GlobalRoles() GlobalRoleInformer
 	// GlobalRoleBindings returns a GlobalRoleBindingInformer.
 	GlobalRoleBindings() GlobalRoleBindingInformer
+	// Groups returns a GroupInformer.
+	Groups() GroupInformer
+	// GroupBindings returns a GroupBindingInformer.
+	GroupBindings() GroupBindingInformer
 	// LoginRecords returns a LoginRecordInformer.
 	LoginRecords() LoginRecordInformer
 	// RoleBases returns a RoleBaseInformer.
@@ -61,6 +65,16 @@ func (v *version) GlobalRoleBindings() GlobalRoleBindingInformer {
 	return &globalRoleBindingInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
+// Groups returns a GroupInformer.
+func (v *version) Groups() GroupInformer {
+	return &groupInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// GroupBindings returns a GroupBindingInformer.
+func (v *version) GroupBindings() GroupBindingInformer {
+	return &groupBindingInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
 // LoginRecords returns a LoginRecordInformer.
 func (v *version) LoginRecords() LoginRecordInformer {
 	return &loginRecordInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}

pkg/client/listers/iam/v1alpha2/expansion_generated.go

@@ -26,6 +26,14 @@ type GlobalRoleListerExpansion interface{}
 // GlobalRoleBindingLister.
 type GlobalRoleBindingListerExpansion interface{}
 
+// GroupListerExpansion allows custom methods to be added to
+// GroupLister.
+type GroupListerExpansion interface{}
+
+// GroupBindingListerExpansion allows custom methods to be added to
+// GroupBindingLister.
+type GroupBindingListerExpansion interface{}
+
 // LoginRecordListerExpansion allows custom methods to be added to
 // LoginRecordLister.
 type LoginRecordListerExpansion interface{}

pkg/client/listers/iam/v1alpha2/group.go

@@ -0,0 +1,65 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha2
+
+import (
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/tools/cache"
+	v1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
+)
+
+// GroupLister helps list Groups.
+type GroupLister interface {
+	// List lists all Groups in the indexer.
+	List(selector labels.Selector) (ret []*v1alpha2.Group, err error)
+	// Get retrieves the Group from the index for a given name.
+	Get(name string) (*v1alpha2.Group, error)
+	GroupListerExpansion
+}
+
+// groupLister implements the GroupLister interface.
+type groupLister struct {
+	indexer cache.Indexer
+}
+
+// NewGroupLister returns a new GroupLister.
+func NewGroupLister(indexer cache.Indexer) GroupLister {
+	return &groupLister{indexer: indexer}
+}
+
+// List lists all Groups in the indexer.
+func (s *groupLister) List(selector labels.Selector) (ret []*v1alpha2.Group, err error) {
+	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha2.Group))
+	})
+	return ret, err
+}
+
+// Get retrieves the Group from the index for a given name.
+func (s *groupLister) Get(name string) (*v1alpha2.Group, error) {
+	obj, exists, err := s.indexer.GetByKey(name)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, errors.NewNotFound(v1alpha2.Resource("group"), name)
+	}
+	return obj.(*v1alpha2.Group), nil
+}

pkg/client/listers/iam/v1alpha2/groupbinding.go

@@ -0,0 +1,65 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha2
+
+import (
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/tools/cache"
+	v1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
+)
+
+// GroupBindingLister helps list GroupBindings.
+type GroupBindingLister interface {
+	// List lists all GroupBindings in the indexer.
+	List(selector labels.Selector) (ret []*v1alpha2.GroupBinding, err error)
+	// Get retrieves the GroupBinding from the index for a given name.
+	Get(name string) (*v1alpha2.GroupBinding, error)
+	GroupBindingListerExpansion
+}
+
+// groupBindingLister implements the GroupBindingLister interface.
+type groupBindingLister struct {
+	indexer cache.Indexer
+}
+
+// NewGroupBindingLister returns a new GroupBindingLister.
+func NewGroupBindingLister(indexer cache.Indexer) GroupBindingLister {
+	return &groupBindingLister{indexer: indexer}
+}
+
+// List lists all GroupBindings in the indexer.
+func (s *groupBindingLister) List(selector labels.Selector) (ret []*v1alpha2.GroupBinding, err error) {
+	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha2.GroupBinding))
+	})
+	return ret, err
+}
+
+// Get retrieves the GroupBinding from the index for a given name.
+func (s *groupBindingLister) Get(name string) (*v1alpha2.GroupBinding, error) {
+	obj, exists, err := s.indexer.GetByKey(name)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, errors.NewNotFound(v1alpha2.Resource("groupbinding"), name)
+	}
+	return obj.(*v1alpha2.GroupBinding), nil
+}