migrate legacy API

Signed-off-by: hongming <talonwan@yunify.com>
2020-04-20 07:01:43 +08:00
parent 3f89eaef7e
commit 7db2ba662c
103 changed files with 5962 additions and 2363 deletions
--- a/pkg/apis/iam/v1alpha2/register.go
+++ b/pkg/apis/iam/v1alpha2/register.go
@@ -51,12 +51,14 @@ func addKnownTypes(scheme *runtime.Scheme) error {
 	scheme.AddKnownTypes(SchemeGroupVersion,
 		&User{},
 		&UserList{},
-		&Role{},
-		&RoleList{},
-		&RoleBinding{},
-		&RoleBindingList{},
-		&PolicyRule{},
-		&PolicyRuleList{},
+		&GlobalRole{},
+		&GlobalRoleList{},
+		&GlobalRoleBinding{},
+		&GlobalRoleBindingList{},
+		&WorkspaceRole{},
+		&WorkspaceRoleList{},
+		&WorkspaceRoleBinding{},
+		&WorkspaceRoleBindingList{},
 	)
 	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
 	return nil
--- a/pkg/apis/iam/v1alpha2/types.go
+++ b/pkg/apis/iam/v1alpha2/types.go
@@ -17,9 +17,33 @@ limitations under the License.
 package v1alpha2

 import (
+	rbacv1 "k8s.io/api/rbac/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )

+const (
+	ResourceKindUser                      = "User"
+	ResourcesSingularUser                 = "user"
+	ResourcesPluralUser                   = "users"
+	ResourceKindGlobalRoleBinding         = "GlobalRoleBinding"
+	ResourcesSingularGlobalRoleBinding    = "globalrolebinding"
+	ResourcesPluralGlobalRoleBinding      = "globalrolebindings"
+	ResourceKindGlobalRole                = "GlobalRole"
+	ResourcesSingularGlobalRole           = "globalrole"
+	ResourcesPluralGlobalRole             = "globalroles"
+	ResourceKindWorkspaceRoleBinding      = "WorkspaceRoleBinding"
+	ResourcesSingularWorkspaceRoleBinding = "workspacerolebinding"
+	ResourcesPluralWorkspaceRoleBinding   = "workspacerolebindings"
+	ResourceKindWorkspaceRole             = "WorkspaceRole"
+	ResourcesSingularWorkspaceRole        = "workspacerole"
+	ResourcesPluralWorkspaceRole          = "workspaceroles"
+	RegoOverrideAnnotation                = "iam.kubesphere.io/rego-override"
+	GlobalScope                           = "Global"
+	ClusterScope                          = "Cluster"
+	WorkspaceScope                        = "Workspace"
+	NamespaceScope                        = "Namespace"
+)
+
 // +genclient
 // +genclient:nonNamespaced
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
@@ -30,7 +54,9 @@ import (
 // +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.state"
 // +kubebuilder:resource:categories="iam",scope="Cluster"
 type User struct {
-	metav1.TypeMeta   `json:",inline"`
+	metav1.TypeMeta `json:",inline"`
+	// Standard object's metadata.
+	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty"`

 	Spec UserSpec `json:"spec"`
@@ -53,9 +79,9 @@ type UserSpec struct {
 	// +optional
 	DisplayName string `json:"displayName,omitempty"`
 	// +optional
-	Groups            []string `json:"groups,omitempty"`
-	EncryptedPassword string   `json:"password"`
-
+	Groups []string `json:"groups,omitempty"`
+	// password will be encrypted by mutating admission webhook
+	EncryptedPassword string `json:"password"`
 	// Finalizers is an opaque list of values that must be empty to permanently remove object from storage.
 	// +optional
 	Finalizers []FinalizerName `json:"finalizers,omitempty"`
@@ -102,7 +128,7 @@ type UserConditionType string
 // These are valid conditions of a user.
 const (
 	// UserLoginFailure contains information about user login.
-	UserLoginFailure UserConditionType = "UserLoginFailure"
+	LoginFailure UserConditionType = "LoginFailure"
 )

 type ConditionStatus string
@@ -121,6 +147,8 @@ const (
 // UserList contains a list of User
 type UserList struct {
 	metav1.TypeMeta `json:",inline"`
+	// Standard object's metadata.
+	// +optional
 	metav1.ListMeta `json:"metadata,omitempty"`
 	Items           []User `json:"items"`
 }
@@ -129,128 +157,131 @@ type UserList struct {
 // +genclient:nonNamespaced
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

-// +kubebuilder:printcolumn:name="Scope",type="string",JSONPath=".target.scope"
-// +kubebuilder:printcolumn:name="Target",type="string",JSONPath=".target.name"
 // +kubebuilder:resource:categories="iam",scope="Cluster"
-type Role struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Target Target    `json:"target"`
-	Rules  []RuleRef `json:"rules"`
-}
-
-type Target struct {
-	Scope Scope  `json:"scope"`
-	Name  string `json:"name"`
-}
-
-type Scope string
-
-const (
-	GlobalScope     Scope = "Global"
-	ClusterScope    Scope = "Cluster"
-	WorkspaceScope  Scope = "Workspace"
-	NamespaceScope  Scope = "Namespace"
-	UserKind              = "User"
-	PolicyRuleKind        = "PolicyRule"
-	RoleKind              = "Role"
-	RoleBindingKind       = "RoleBinding"
-)
-
-// RuleRef contains information that points to the role being used
-type RuleRef struct {
-	// APIGroup is the group for the resource being referenced
-	APIGroup string `json:"apiGroup"`
-	// Kind is the type of resource being referenced
-	Kind string `json:"kind"`
-	// Name is the name of resource being referenced
-	Name string `json:"name"`
-}
-
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-
-// RoleList contains a list of Role
-type RoleList struct {
+type GlobalRole struct {
 	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []Role `json:"items"`
-}
-
-// +genclient
-// +genclient:nonNamespaced
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-
-// +kubebuilder:printcolumn:name="Scope",type="string",JSONPath=".scope"
-// +kubebuilder:resource:categories="iam",scope="Cluster"
-type PolicyRule struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Scope Scope  `json:"scope"`
-	Rego  string `json:"rego"`
-}
-
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-
-// PolicyRuleList contains a list of PolicyRule
-type PolicyRuleList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []PolicyRule `json:"items"`
-}
-
-// +genclient
-// +genclient:nonNamespaced
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-
-// RoleBinding is the Schema for the rolebindings API
-// +kubebuilder:printcolumn:name="Scope",type="string",JSONPath=".scope"
-// +kubebuilder:printcolumn:name="RoleRef",type="string",JSONPath=".roleRef.name"
-// +kubebuilder:printcolumn:name="Subjects",type="string",JSONPath=".subjects[*].name"
-// +kubebuilder:resource:categories="iam",scope="Cluster"
-type RoleBinding struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Scope   Scope   `json:"scope"`
-	RoleRef RoleRef `json:"roleRef"`
-	// Subjects holds references to the users the role applies to.
+	// Standard object's metadata.
 	// +optional
-	Subjects []Subject `json:"subjects,omitempty"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// Rules holds all the PolicyRules for this ClusterRole
+	Rules []rbacv1.PolicyRule `json:"rules" protobuf:"bytes,2,rep,name=rules"`
+
+	// AggregationRule is an optional field that describes how to build the Rules for this GlobalRole.
+	// If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be
+	// stomped by the controller.
+	AggregationRule *AggregationRule `json:"aggregationRule,omitempty" protobuf:"bytes,3,opt,name=aggregationRule"`
 }

-// RoleRef contains information that points to the role being used
-type RoleRef struct {
-	// APIGroup is the group for the resource being referenced
-	APIGroup string `json:"apiGroup"`
-	// Kind is the type of resource being referenced
-	Kind string `json:"kind"`
-	// Name is the name of resource being referenced
-	Name string `json:"name"`
-}
-
-// or a value for non-objects such as user and group names.
-type Subject struct {
-	// Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
-	// If the Authorizer does not recognized the kind value, the Authorizer should report an error.
-	Kind string `json:"kind"`
-	// APIGroup holds the API group of the referenced subject.
-	APIGroup string `json:"apiGroup"`
-	// Name of the object being referenced.
-	Name string `json:"name"`
+// AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole
+type AggregationRule struct {
+	// ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
+	// If any of the selectors match, then the ClusterRole's permissions will be added
+	// +optional
+	RoleSelectors []metav1.LabelSelector `json:"roleSelectors,omitempty" protobuf:"bytes,1,rep,name=roleSelectors"`
 }

 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

-// RoleBindingList contains a list of RoleBinding
-type RoleBindingList struct {
+// GlobalRoleList contains a list of GlobalRole
+type GlobalRoleList struct {
 	metav1.TypeMeta `json:",inline"`
 	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []RoleBinding `json:"items"`
+	Items           []GlobalRole `json:"items"`
+}
+
+// +genclient
+// +genclient:nonNamespaced
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// GlobalRoleBinding is the Schema for the globalrolebindings API
+// +kubebuilder:resource:categories="iam",scope="Cluster"
+type GlobalRoleBinding struct {
+	metav1.TypeMeta `json:",inline"`
+	// Standard object's metadata.
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// Subjects holds references to the objects the role applies to.
+	// +optional
+	Subjects []rbacv1.Subject `json:"subjects,omitempty" protobuf:"bytes,2,rep,name=subjects"`
+
+	// RoleRef can only reference a ClusterRole in the global namespace.
+	// If the RoleRef cannot be resolved, the Authorizer must return an error.
+	RoleRef rbacv1.RoleRef `json:"roleRef" protobuf:"bytes,3,opt,name=roleRef"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// GlobalRoleBindingList contains a list of GlobalRoleBinding
+type GlobalRoleBindingList struct {
+	metav1.TypeMeta `json:",inline"`
+	// Standard object's metadata.
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []GlobalRoleBinding `json:"items"`
+}
+
+// +genclient
+// +genclient:nonNamespaced
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// +kubebuilder:printcolumn:name="Workspace",type="string",JSONPath=".metadata.labels.kubesphere\\.io/workspace"
+// +kubebuilder:printcolumn:name="Alias",type="string",JSONPath=".metadata.labels.kubesphere\\.io/alias-name"
+// +kubebuilder:resource:categories="iam",scope="Cluster"
+type WorkspaceRole struct {
+	metav1.TypeMeta `json:",inline"`
+	// Standard object's metadata.
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// Rules holds all the PolicyRules for this ClusterRole
+	Rules []rbacv1.PolicyRule `json:"rules" protobuf:"bytes,2,rep,name=rules"`
+	// AggregationRule is an optional field that describes how to build the Rules for this WorkspaceRole.
+	// If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be
+	// stomped by the controller.
+	AggregationRule *AggregationRule `json:"aggregationRule,omitempty" protobuf:"bytes,3,opt,name=aggregationRule"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// WorkspaceRoleList contains a list of WorkspaceRole
+type WorkspaceRoleList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []WorkspaceRole `json:"items"`
+}
+
+// +genclient
+// +genclient:nonNamespaced
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// WorkspaceRoleBinding is the Schema for the workspacerolebindings API
+// +kubebuilder:printcolumn:name="Workspace",type="string",JSONPath=".metadata.labels.kubesphere\\.io/workspace"
+// +kubebuilder:resource:categories="iam",scope="Cluster"
+type WorkspaceRoleBinding struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// Subjects holds references to the objects the role applies to.
+	// +optional
+	Subjects []rbacv1.Subject `json:"subjects,omitempty" protobuf:"bytes,2,rep,name=subjects"`
+
+	// RoleRef can only reference a ClusterRole in the global namespace.
+	// If the RoleRef cannot be resolved, the Authorizer must return an error.
+	RoleRef rbacv1.RoleRef `json:"roleRef" protobuf:"bytes,3,opt,name=roleRef"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// WorkspaceRoleBindingList contains a list of WorkspaceRoleBinding
+type WorkspaceRoleBindingList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []WorkspaceRoleBinding `json:"items"`
 }

 type UserDetail struct {
 	*User
-	GlobalRole *Role `json:"globalRole"`
+	GlobalRole *GlobalRole `json:"globalRole"`
 }
--- a/pkg/apis/iam/v1alpha2/zz_generated.deepcopy.go
+++ b/pkg/apis/iam/v1alpha2/zz_generated.deepcopy.go
@@ -16,96 +16,69 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-// Code generated by deepcopy-gen. DO NOT EDIT.
+// Code generated by controller-gen. DO NOT EDIT.

 package v1alpha2

 import (
+	"k8s.io/api/rbac/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 )

 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PolicyRule) DeepCopyInto(out *PolicyRule) {
+func (in *AggregationRule) DeepCopyInto(out *AggregationRule) {
 	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyRule.
-func (in *PolicyRule) DeepCopy() *PolicyRule {
-	if in == nil {
-		return nil
-	}
-	out := new(PolicyRule)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *PolicyRule) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PolicyRuleList) DeepCopyInto(out *PolicyRuleList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]PolicyRule, len(*in))
+	if in.RoleSelectors != nil {
+		in, out := &in.RoleSelectors, &out.RoleSelectors
+		*out = make([]metav1.LabelSelector, len(*in))
 		for i := range *in {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
 }

-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyRuleList.
-func (in *PolicyRuleList) DeepCopy() *PolicyRuleList {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AggregationRule.
+func (in *AggregationRule) DeepCopy() *AggregationRule {
 	if in == nil {
 		return nil
 	}
-	out := new(PolicyRuleList)
+	out := new(AggregationRule)
 	in.DeepCopyInto(out)
 	return out
 }

-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *PolicyRuleList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Role) DeepCopyInto(out *Role) {
+func (in *GlobalRole) DeepCopyInto(out *GlobalRole) {
 	*out = *in
 	out.TypeMeta = in.TypeMeta
 	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	out.Target = in.Target
 	if in.Rules != nil {
 		in, out := &in.Rules, &out.Rules
-		*out = make([]RuleRef, len(*in))
-		copy(*out, *in)
+		*out = make([]v1.PolicyRule, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.AggregationRule != nil {
+		in, out := &in.AggregationRule, &out.AggregationRule
+		*out = new(AggregationRule)
+		(*in).DeepCopyInto(*out)
 	}
 }

-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Role.
-func (in *Role) DeepCopy() *Role {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalRole.
+func (in *GlobalRole) DeepCopy() *GlobalRole {
 	if in == nil {
 		return nil
 	}
-	out := new(Role)
+	out := new(GlobalRole)
 	in.DeepCopyInto(out)
 	return out
 }

 // DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Role) DeepCopyObject() runtime.Object {
+func (in *GlobalRole) DeepCopyObject() runtime.Object {
 	if c := in.DeepCopy(); c != nil {
 		return c
 	}
@@ -113,30 +86,30 @@ func (in *Role) DeepCopyObject() runtime.Object {
 }

 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RoleBinding) DeepCopyInto(out *RoleBinding) {
+func (in *GlobalRoleBinding) DeepCopyInto(out *GlobalRoleBinding) {
 	*out = *in
 	out.TypeMeta = in.TypeMeta
 	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	out.RoleRef = in.RoleRef
 	if in.Subjects != nil {
 		in, out := &in.Subjects, &out.Subjects
-		*out = make([]Subject, len(*in))
+		*out = make([]v1.Subject, len(*in))
 		copy(*out, *in)
 	}
+	out.RoleRef = in.RoleRef
 }

-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RoleBinding.
-func (in *RoleBinding) DeepCopy() *RoleBinding {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalRoleBinding.
+func (in *GlobalRoleBinding) DeepCopy() *GlobalRoleBinding {
 	if in == nil {
 		return nil
 	}
-	out := new(RoleBinding)
+	out := new(GlobalRoleBinding)
 	in.DeepCopyInto(out)
 	return out
 }

 // DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *RoleBinding) DeepCopyObject() runtime.Object {
+func (in *GlobalRoleBinding) DeepCopyObject() runtime.Object {
 	if c := in.DeepCopy(); c != nil {
 		return c
 	}
@@ -144,31 +117,31 @@ func (in *RoleBinding) DeepCopyObject() runtime.Object {
 }

 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RoleBindingList) DeepCopyInto(out *RoleBindingList) {
+func (in *GlobalRoleBindingList) DeepCopyInto(out *GlobalRoleBindingList) {
 	*out = *in
 	out.TypeMeta = in.TypeMeta
 	in.ListMeta.DeepCopyInto(&out.ListMeta)
 	if in.Items != nil {
 		in, out := &in.Items, &out.Items
-		*out = make([]RoleBinding, len(*in))
+		*out = make([]GlobalRoleBinding, len(*in))
 		for i := range *in {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
 }

-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RoleBindingList.
-func (in *RoleBindingList) DeepCopy() *RoleBindingList {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalRoleBindingList.
+func (in *GlobalRoleBindingList) DeepCopy() *GlobalRoleBindingList {
 	if in == nil {
 		return nil
 	}
-	out := new(RoleBindingList)
+	out := new(GlobalRoleBindingList)
 	in.DeepCopyInto(out)
 	return out
 }

 // DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *RoleBindingList) DeepCopyObject() runtime.Object {
+func (in *GlobalRoleBindingList) DeepCopyObject() runtime.Object {
 	if c := in.DeepCopy(); c != nil {
 		return c
 	}
@@ -176,97 +149,37 @@ func (in *RoleBindingList) DeepCopyObject() runtime.Object {
 }

 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RoleList) DeepCopyInto(out *RoleList) {
+func (in *GlobalRoleList) DeepCopyInto(out *GlobalRoleList) {
 	*out = *in
 	out.TypeMeta = in.TypeMeta
 	in.ListMeta.DeepCopyInto(&out.ListMeta)
 	if in.Items != nil {
 		in, out := &in.Items, &out.Items
-		*out = make([]Role, len(*in))
+		*out = make([]GlobalRole, len(*in))
 		for i := range *in {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
 }

-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RoleList.
-func (in *RoleList) DeepCopy() *RoleList {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalRoleList.
+func (in *GlobalRoleList) DeepCopy() *GlobalRoleList {
 	if in == nil {
 		return nil
 	}
-	out := new(RoleList)
+	out := new(GlobalRoleList)
 	in.DeepCopyInto(out)
 	return out
 }

 // DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *RoleList) DeepCopyObject() runtime.Object {
+func (in *GlobalRoleList) DeepCopyObject() runtime.Object {
 	if c := in.DeepCopy(); c != nil {
 		return c
 	}
 	return nil
 }

-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RoleRef) DeepCopyInto(out *RoleRef) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RoleRef.
-func (in *RoleRef) DeepCopy() *RoleRef {
-	if in == nil {
-		return nil
-	}
-	out := new(RoleRef)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RuleRef) DeepCopyInto(out *RuleRef) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RuleRef.
-func (in *RuleRef) DeepCopy() *RuleRef {
-	if in == nil {
-		return nil
-	}
-	out := new(RuleRef)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Subject) DeepCopyInto(out *Subject) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Subject.
-func (in *Subject) DeepCopy() *Subject {
-	if in == nil {
-		return nil
-	}
-	out := new(Subject)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Target) DeepCopyInto(out *Target) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Target.
-func (in *Target) DeepCopy() *Target {
-	if in == nil {
-		return nil
-	}
-	out := new(Target)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *User) DeepCopyInto(out *User) {
 	*out = *in
@@ -274,7 +187,6 @@ func (in *User) DeepCopyInto(out *User) {
 	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
 	in.Spec.DeepCopyInto(&out.Spec)
 	in.Status.DeepCopyInto(&out.Status)
-	return
 }

 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User.
@@ -299,7 +211,6 @@ func (in *User) DeepCopyObject() runtime.Object {
 func (in *UserCondition) DeepCopyInto(out *UserCondition) {
 	*out = *in
 	in.LastTransitionTime.DeepCopyInto(&out.LastTransitionTime)
-	return
 }

 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UserCondition.
@@ -322,7 +233,7 @@ func (in *UserDetail) DeepCopyInto(out *UserDetail) {
 	}
 	if in.GlobalRole != nil {
 		in, out := &in.GlobalRole, &out.GlobalRole
-		*out = new(Role)
+		*out = new(GlobalRole)
 		(*in).DeepCopyInto(*out)
 	}
 }
@@ -349,7 +260,6 @@ func (in *UserList) DeepCopyInto(out *UserList) {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
-	return
 }

 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UserList.
@@ -383,7 +293,6 @@ func (in *UserSpec) DeepCopyInto(out *UserSpec) {
 		*out = make([]FinalizerName, len(*in))
 		copy(*out, *in)
 	}
-	return
 }

 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UserSpec.
@@ -406,7 +315,6 @@ func (in *UserStatus) DeepCopyInto(out *UserStatus) {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
-	return
 }

 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UserStatus.
@@ -418,3 +326,135 @@ func (in *UserStatus) DeepCopy() *UserStatus {
 	in.DeepCopyInto(out)
 	return out
 }
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkspaceRole) DeepCopyInto(out *WorkspaceRole) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	if in.Rules != nil {
+		in, out := &in.Rules, &out.Rules
+		*out = make([]v1.PolicyRule, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.AggregationRule != nil {
+		in, out := &in.AggregationRule, &out.AggregationRule
+		*out = new(AggregationRule)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkspaceRole.
+func (in *WorkspaceRole) DeepCopy() *WorkspaceRole {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkspaceRole)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *WorkspaceRole) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkspaceRoleBinding) DeepCopyInto(out *WorkspaceRoleBinding) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	if in.Subjects != nil {
+		in, out := &in.Subjects, &out.Subjects
+		*out = make([]v1.Subject, len(*in))
+		copy(*out, *in)
+	}
+	out.RoleRef = in.RoleRef
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkspaceRoleBinding.
+func (in *WorkspaceRoleBinding) DeepCopy() *WorkspaceRoleBinding {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkspaceRoleBinding)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *WorkspaceRoleBinding) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkspaceRoleBindingList) DeepCopyInto(out *WorkspaceRoleBindingList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]WorkspaceRoleBinding, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkspaceRoleBindingList.
+func (in *WorkspaceRoleBindingList) DeepCopy() *WorkspaceRoleBindingList {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkspaceRoleBindingList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *WorkspaceRoleBindingList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkspaceRoleList) DeepCopyInto(out *WorkspaceRoleList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]WorkspaceRole, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkspaceRoleList.
+func (in *WorkspaceRoleList) DeepCopy() *WorkspaceRoleList {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkspaceRoleList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *WorkspaceRoleList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}