@@ -10,7 +10,6 @@ import (

 	"github.com/GoogleCloudPlatform/kubernetes/pkg/util"

 	authorizationapi "github.com/openshift/origin/pkg/authorization/api"

-	"github.com/openshift/origin/pkg/client"

 	"github.com/openshift/origin/pkg/cmd/util/clientcmd"

 )

@@ -19,13 +18,17 @@ const (

 	AddRoleToUserRecommendedName       = "add-role-to-user"

 	RemoveRoleFromGroupRecommendedName = "remove-role-from-group"

 	RemoveRoleFromUserRecommendedName  = "remove-role-from-user"

+

+	AddClusterRoleToGroupRecommendedName      = "add-cluster-role-to-group"

+	AddClusterRoleToUserRecommendedName       = "add-cluster-role-to-user"

+	RemoveClusterRoleFromGroupRecommendedName = "remove-cluster-role-from-group"

+	RemoveClusterRoleFromUserRecommendedName  = "remove-cluster-role-from-user"

 )

 type RoleModificationOptions struct {

-	RoleNamespace    string

-	RoleName         string

-	BindingNamespace string

-	Client           client.Interface

+	RoleNamespace       string

+	RoleName            string

+	RoleBindingAccessor RoleBindingAccessor

 	Users  []string

 	Groups []string

@@ -39,7 +42,7 @@ func NewCmdAddRoleToGroup(name, fullName string, f *clientcmd.Factory, out io.Wr

 		Short: "Add groups to a role in the current project",

 		Long:  `Add groups to a role in the current project`,

 		Run: func(cmd *cobra.Command, args []string) {

-			if err := options.Complete(f, args, &options.Groups, "group"); err != nil {

+			if err := options.Complete(f, args, &options.Groups, "group", true); err != nil {

 				kcmdutil.CheckErr(kcmdutil.UsageError(cmd, err.Error()))

 			}

@@ -49,7 +52,7 @@ func NewCmdAddRoleToGroup(name, fullName string, f *clientcmd.Factory, out io.Wr

 		},

 	}

-	cmd.Flags().StringVar(&options.RoleNamespace, "role-namespace", "", "namespace where the role is located.")

+	cmd.Flags().StringVar(&options.RoleNamespace, "role-namespace", "", "namespace where the role is located: empty means 'ClusterRole'")

 	return cmd

 }

@@ -62,7 +65,7 @@ func NewCmdAddRoleToUser(name, fullName string, f *clientcmd.Factory, out io.Wri

 		Short: "Add users to a role in the current project",

 		Long:  `Add users to a role in the current project`,

 		Run: func(cmd *cobra.Command, args []string) {

-			if err := options.Complete(f, args, &options.Users, "user"); err != nil {

+			if err := options.Complete(f, args, &options.Users, "user", true); err != nil {

 				kcmdutil.CheckErr(kcmdutil.UsageError(cmd, err.Error()))

 			}

@@ -72,7 +75,7 @@ func NewCmdAddRoleToUser(name, fullName string, f *clientcmd.Factory, out io.Wri

 		},

 	}

-	cmd.Flags().StringVar(&options.RoleNamespace, "role-namespace", "", "namespace where the role is located.")

+	cmd.Flags().StringVar(&options.RoleNamespace, "role-namespace", "", "namespace where the role is located: empty means 'ClusterRole'")

 	return cmd

 }

@@ -85,7 +88,7 @@ func NewCmdRemoveRoleFromGroup(name, fullName string, f *clientcmd.Factory, out

 		Short: "Remove group from role in the current project",

 		Long:  `Remove group from role in the current project`,

 		Run: func(cmd *cobra.Command, args []string) {

-			if err := options.Complete(f, args, &options.Groups, "group"); err != nil {

+			if err := options.Complete(f, args, &options.Groups, "group", true); err != nil {

 				kcmdutil.CheckErr(kcmdutil.UsageError(cmd, err.Error()))

 			}

@@ -95,7 +98,7 @@ func NewCmdRemoveRoleFromGroup(name, fullName string, f *clientcmd.Factory, out

 		},

 	}

-	cmd.Flags().StringVar(&options.RoleNamespace, "role-namespace", "", "namespace where the role is located.")

+	cmd.Flags().StringVar(&options.RoleNamespace, "role-namespace", "", "namespace where the role is located: empty means 'ClusterRole'")

 	return cmd

 }

@@ -108,7 +111,72 @@ func NewCmdRemoveRoleFromUser(name, fullName string, f *clientcmd.Factory, out i

 		Short: "Remove user from role in the current project",

 		Long:  `Remove user from role in the current project`,

 		Run: func(cmd *cobra.Command, args []string) {

-			if err := options.Complete(f, args, &options.Users, "user"); err != nil {

+			if err := options.Complete(f, args, &options.Users, "user", true); err != nil {

+				kcmdutil.CheckErr(kcmdutil.UsageError(cmd, err.Error()))

+			}

+

+			if err := options.RemoveRole(); err != nil {

+				kcmdutil.CheckErr(err)

+			}

+		},

+	}

+

+	cmd.Flags().StringVar(&options.RoleNamespace, "role-namespace", "", "namespace where the role is located: empty means 'ClusterRole'")

+

+	return cmd

+}

+

+func NewCmdAddClusterRoleToGroup(name, fullName string, f *clientcmd.Factory, out io.Writer) *cobra.Command {

+	options := &RoleModificationOptions{}

+

+	cmd := &cobra.Command{

+		Use:   name + " <role> <group> [group]...",

+		Short: "add groups to a role for all projects in the cluster",

+		Long:  `add groups to a role for all projects in the cluster`,

+		Run: func(cmd *cobra.Command, args []string) {

+			if err := options.Complete(f, args, &options.Groups, "group", false); err != nil {

+				kcmdutil.CheckErr(kcmdutil.UsageError(cmd, err.Error()))

+			}

+

+			if err := options.AddRole(); err != nil {

+				kcmdutil.CheckErr(err)

+			}

+		},

+	}

+

+	return cmd

+}

+

+func NewCmdAddClusterRoleToUser(name, fullName string, f *clientcmd.Factory, out io.Writer) *cobra.Command {

+	options := &RoleModificationOptions{}

+

+	cmd := &cobra.Command{

+		Use:   name + " <role> <user> [user]...",

+		Short: "add users to a role for all projects in the cluster",

+		Long:  `add users to a role for all projects in the cluster`,

+		Run: func(cmd *cobra.Command, args []string) {

+			if err := options.Complete(f, args, &options.Users, "user", false); err != nil {

+				kcmdutil.CheckErr(kcmdutil.UsageError(cmd, err.Error()))

+			}

+

+			if err := options.AddRole(); err != nil {

+				kcmdutil.CheckErr(err)

+			}

+		},

+	}

+

+	return cmd

+}

+

+func NewCmdRemoveClusterRoleFromGroup(name, fullName string, f *clientcmd.Factory, out io.Writer) *cobra.Command {

+	options := &RoleModificationOptions{}

+

+	cmd := &cobra.Command{

+		Use:   name + " <role> <group> [group]...",

+		Short: "remove group from role for all projects in the cluster",

+		Long:  `remove group from role for all projects in the cluster`,

+		Run: func(cmd *cobra.Command, args []string) {

+			if err := options.Complete(f, args, &options.Groups, "group", false); err != nil {

 				kcmdutil.CheckErr(kcmdutil.UsageError(cmd, err.Error()))

 			}

@@ -118,12 +186,31 @@ func NewCmdRemoveRoleFromUser(name, fullName string, f *clientcmd.Factory, out i

 		},

 	}

-	cmd.Flags().StringVar(&options.RoleNamespace, "role-namespace", "", "namespace where the role is located.")

+	return cmd

+}

+

+func NewCmdRemoveClusterRoleFromUser(name, fullName string, f *clientcmd.Factory, out io.Writer) *cobra.Command {

+	options := &RoleModificationOptions{}

+

+	cmd := &cobra.Command{

+		Use:   name + " <role> <user> [user]...",

+		Short: "remove user from role for all projects in the cluster",

+		Long:  `remove user from role for all projects in the cluster`,

+		Run: func(cmd *cobra.Command, args []string) {

+			if err := options.Complete(f, args, &options.Users, "user", false); err != nil {

+				kcmdutil.CheckErr(kcmdutil.UsageError(cmd, err.Error()))

+			}

+

+			if err := options.RemoveRole(); err != nil {

+				kcmdutil.CheckErr(err)

+			}

+		},

+	}

 	return cmd

 }

-func (o *RoleModificationOptions) Complete(f *clientcmd.Factory, args []string, target *[]string, targetName string) error {

+func (o *RoleModificationOptions) Complete(f *clientcmd.Factory, args []string, target *[]string, targetName string, isNamespaced bool) error {

 	if len(args) < 2 {

 		return fmt.Errorf("You must specify at least two arguments: <role> <%s> [%s]...", targetName, targetName)

 	}

@@ -131,23 +218,32 @@ func (o *RoleModificationOptions) Complete(f *clientcmd.Factory, args []string,

 	o.RoleName = args[0]

 	*target = append(*target, args[1:]...)

-	var err error

-	if o.Client, _, err = f.Clients(); err != nil {

+	osClient, _, err := f.Clients()

+	if err != nil {

 		return err

 	}

-	if o.BindingNamespace, err = f.DefaultNamespace(); err != nil {

-		return err

+

+	if isNamespaced {

+		roleBindingNamespace, err := f.DefaultNamespace()

+		if err != nil {

+			return err

+		}

+		o.RoleBindingAccessor = NewLocalRoleBindingAccessor(roleBindingNamespace, osClient)

+

+	} else {

+		o.RoleBindingAccessor = NewClusterRoleBindingAccessor(osClient)

+

 	}

 	return nil

 }

 func (o *RoleModificationOptions) AddRole() error {

-	roleBindings, err := getExistingRoleBindingsForRole(o.RoleNamespace, o.RoleName, o.Client.PolicyBindings(o.BindingNamespace))

+	roleBindings, err := o.RoleBindingAccessor.GetExistingRoleBindingsForRole(o.RoleNamespace, o.RoleName)

 	if err != nil {

 		return err

 	}

-	roleBindingNames, err := getExistingRoleBindingNames(o.Client.PolicyBindings(o.BindingNamespace))

+	roleBindingNames, err := o.RoleBindingAccessor.GetExistingRoleBindingNames()

 	if err != nil {

 		return err

 	}

@@ -169,10 +265,10 @@ func (o *RoleModificationOptions) AddRole() error {

 	roleBinding.Groups.Insert(o.Groups...)

 	if isUpdate {

-		_, err = o.Client.RoleBindings(o.BindingNamespace).Update(roleBinding)

+		err = o.RoleBindingAccessor.UpdateRoleBinding(roleBinding)

 	} else {

 		roleBinding.Name = getUniqueName(o.RoleName, roleBindingNames)

-		_, err = o.Client.RoleBindings(o.BindingNamespace).Create(roleBinding)

+		err = o.RoleBindingAccessor.CreateRoleBinding(roleBinding)

 	}

 	if err != nil {

 		return err

@@ -182,19 +278,19 @@ func (o *RoleModificationOptions) AddRole() error {

 }

 func (o *RoleModificationOptions) RemoveRole() error {

-	roleBindings, err := getExistingRoleBindingsForRole(o.RoleNamespace, o.RoleName, o.Client.PolicyBindings(o.BindingNamespace))

+	roleBindings, err := o.RoleBindingAccessor.GetExistingRoleBindingsForRole(o.RoleNamespace, o.RoleName)

 	if err != nil {

 		return err

 	}

 	if len(roleBindings) == 0 {

-		return fmt.Errorf("unable to locate RoleBinding for %v::%v in %v", o.RoleNamespace, o.RoleName, o.BindingNamespace)

+		return fmt.Errorf("unable to locate RoleBinding for %v/%v", o.RoleNamespace, o.RoleName)

 	}

 	for _, roleBinding := range roleBindings {

 		roleBinding.Groups.Delete(o.Groups...)

 		roleBinding.Users.Delete(o.Users...)

-		_, err = o.Client.RoleBindings(o.BindingNamespace).Update(roleBinding)

+		err = o.RoleBindingAccessor.UpdateRoleBinding(roleBinding)

 		if err != nil {

 			return err

 		}

@@ -3,8 +3,8 @@ package policy

 import (

 	"fmt"

 	"io"

-	"strings"

+	kapierrors "github.com/GoogleCloudPlatform/kubernetes/pkg/api/errors"

 	"github.com/GoogleCloudPlatform/kubernetes/pkg/fields"

 	"github.com/GoogleCloudPlatform/kubernetes/pkg/labels"

 	"github.com/GoogleCloudPlatform/kubernetes/pkg/util"

@@ -28,13 +28,19 @@ func NewCommandPolicy(name, fullName string, f *clientcmd.Factory, out io.Writer

 		Run:   runHelp,

 	}

+	cmds.AddCommand(NewCmdWhoCan(WhoCanRecommendedName, fullName+" "+WhoCanRecommendedName, f, out))

+

 	cmds.AddCommand(NewCmdAddRoleToUser(AddRoleToUserRecommendedName, fullName+" "+AddRoleToUserRecommendedName, f, out))

 	cmds.AddCommand(NewCmdRemoveRoleFromUser(RemoveRoleFromUserRecommendedName, fullName+" "+RemoveRoleFromUserRecommendedName, f, out))

 	cmds.AddCommand(NewCmdRemoveUserFromProject(RemoveUserRecommendedName, fullName+" "+RemoveUserRecommendedName, f, out))

 	cmds.AddCommand(NewCmdAddRoleToGroup(AddRoleToGroupRecommendedName, fullName+" "+AddRoleToGroupRecommendedName, f, out))

 	cmds.AddCommand(NewCmdRemoveRoleFromGroup(RemoveRoleFromGroupRecommendedName, fullName+" "+RemoveRoleFromGroupRecommendedName, f, out))

 	cmds.AddCommand(NewCmdRemoveGroupFromProject(RemoveGroupRecommendedName, fullName+" "+RemoveGroupRecommendedName, f, out))

-	cmds.AddCommand(NewCmdWhoCan(WhoCanRecommendedName, fullName+" "+WhoCanRecommendedName, f, out))

+

+	cmds.AddCommand(NewCmdAddClusterRoleToUser(AddClusterRoleToUserRecommendedName, fullName+" "+AddClusterRoleToUserRecommendedName, f, out))

+	cmds.AddCommand(NewCmdRemoveClusterRoleFromUser(RemoveClusterRoleFromUserRecommendedName, fullName+" "+RemoveClusterRoleFromUserRecommendedName, f, out))

+	cmds.AddCommand(NewCmdAddClusterRoleToGroup(AddClusterRoleToGroupRecommendedName, fullName+" "+AddClusterRoleToGroupRecommendedName, f, out))

+	cmds.AddCommand(NewCmdRemoveClusterRoleFromGroup(RemoveClusterRoleFromGroupRecommendedName, fullName+" "+RemoveClusterRoleFromGroupRecommendedName, f, out))

 	return cmds

 }

@@ -66,9 +72,27 @@ func getUniqueName(basename string, existingNames *util.StringSet) string {

 	return string(util.NewUUID())

 }

-func getExistingRoleBindingsForRole(roleNamespace, role string, bindingInterface client.PolicyBindingInterface) ([]*authorizationapi.RoleBinding, error) {

-	existingBindings, err := bindingInterface.Get(authorizationapi.GetPolicyBindingName(roleNamespace))

-	if err != nil && !strings.Contains(err.Error(), " not found") {

+// RoleBindingAccessor is used by role modification commands to access and modify roles

+type RoleBindingAccessor interface {

+	GetExistingRoleBindingsForRole(roleNamespace, role string) ([]*authorizationapi.RoleBinding, error)

+	GetExistingRoleBindingNames() (*util.StringSet, error)

+	UpdateRoleBinding(binding *authorizationapi.RoleBinding) error

+	CreateRoleBinding(binding *authorizationapi.RoleBinding) error

+}

+

+// LocalRoleBindingAccessor operates against role bindings in namespace

+type LocalRoleBindingAccessor struct {

+	BindingNamespace string

+	Client           client.Interface

+}

+

+func NewLocalRoleBindingAccessor(bindingNamespace string, client client.Interface) LocalRoleBindingAccessor {

+	return LocalRoleBindingAccessor{bindingNamespace, client}

+}

+

+func (a LocalRoleBindingAccessor) GetExistingRoleBindingsForRole(roleNamespace, role string) ([]*authorizationapi.RoleBinding, error) {

+	existingBindings, err := a.Client.PolicyBindings(a.BindingNamespace).Get(authorizationapi.GetPolicyBindingName(roleNamespace))

+	if err != nil && !kapierrors.IsNotFound(err) {

 		return nil, err

 	}

@@ -84,8 +108,8 @@ func getExistingRoleBindingsForRole(roleNamespace, role string, bindingInterface

 	return ret, nil

 }

-func getExistingRoleBindingNames(bindingInterface client.PolicyBindingInterface) (*util.StringSet, error) {

-	policyBindings, err := bindingInterface.List(labels.Everything(), fields.Everything())

+func (a LocalRoleBindingAccessor) GetExistingRoleBindingNames() (*util.StringSet, error) {

+	policyBindings, err := a.Client.PolicyBindings(a.BindingNamespace).List(labels.Everything(), fields.Everything())

 	if err != nil {

 		return nil, err

 	}

@@ -99,3 +123,72 @@ func getExistingRoleBindingNames(bindingInterface client.PolicyBindingInterface)

 	return ret, nil

 }

+

+func (a LocalRoleBindingAccessor) UpdateRoleBinding(binding *authorizationapi.RoleBinding) error {

+	_, err := a.Client.RoleBindings(a.BindingNamespace).Update(binding)

+	return err

+}

+

+func (a LocalRoleBindingAccessor) CreateRoleBinding(binding *authorizationapi.RoleBinding) error {

+	binding.Namespace = a.BindingNamespace

+	_, err := a.Client.RoleBindings(a.BindingNamespace).Create(binding)

+	return err

+}

+

+// ClusterRoleBindingAccessor operates against cluster scoped role bindings

+type ClusterRoleBindingAccessor struct {

+	Client client.Interface

+}

+

+func NewClusterRoleBindingAccessor(client client.Interface) ClusterRoleBindingAccessor {

+	// the master namespace value doesn't matter because we're round tripping all the values, so the namespace gets stripped out

+	return ClusterRoleBindingAccessor{client}

+}

+

+func (a ClusterRoleBindingAccessor) GetExistingRoleBindingsForRole(roleNamespace, role string) ([]*authorizationapi.RoleBinding, error) {

+	uncast, err := a.Client.ClusterPolicyBindings().Get(authorizationapi.GetPolicyBindingName(roleNamespace))

+	if err != nil && !kapierrors.IsNotFound(err) {

+		return nil, err

+	}

+	existingBindings := authorizationapi.ToPolicyBinding(uncast)

+

+	ret := make([]*authorizationapi.RoleBinding, 0)

+	// see if we can find an existing binding that points to the role in question.

+	for _, currBinding := range existingBindings.RoleBindings {

+		if currBinding.RoleRef.Name == role {

+			t := currBinding

+			ret = append(ret, &t)

+		}

+	}

+

+	return ret, nil

+}

+

+func (a ClusterRoleBindingAccessor) GetExistingRoleBindingNames() (*util.StringSet, error) {

+	uncast, err := a.Client.ClusterPolicyBindings().List(labels.Everything(), fields.Everything())

+	if err != nil {

+		return nil, err

+	}

+	policyBindings := authorizationapi.ToPolicyBindingList(uncast)

+

+	ret := &util.StringSet{}

+	for _, existingBindings := range policyBindings.Items {

+		for _, currBinding := range existingBindings.RoleBindings {

+			ret.Insert(currBinding.Name)

+		}

+	}

+

+	return ret, nil

+}

+

+func (a ClusterRoleBindingAccessor) UpdateRoleBinding(binding *authorizationapi.RoleBinding) error {

+	clusterBinding := authorizationapi.ToClusterRoleBinding(binding)

+	_, err := a.Client.ClusterRoleBindings().Update(clusterBinding)

+	return err

+}

+

+func (a ClusterRoleBindingAccessor) CreateRoleBinding(binding *authorizationapi.RoleBinding) error {

+	clusterBinding := authorizationapi.ToClusterRoleBinding(binding)

+	_, err := a.Client.ClusterRoleBindings().Create(clusterBinding)

+	return err

+}

@@ -26,9 +26,8 @@ type NewProjectOptions struct {

 	Client client.Interface

-	AdminRole             string

-	MasterPolicyNamespace string

-	AdminUser             string

+	AdminRole string

+	AdminUser string

 }

 func NewCmdNewProject(name, fullName string, f *clientcmd.Factory, out io.Writer) *cobra.Command {

@@ -92,16 +91,14 @@ func (o *NewProjectOptions) Run() error {

 	if len(o.AdminUser) != 0 {

 		adduser := &policy.RoleModificationOptions{

-			RoleNamespace:    o.MasterPolicyNamespace,

-			RoleName:         o.AdminRole,

-			BindingNamespace: project.Name,

-			Client:           o.Client,

-			Users:            []string{o.AdminUser},

+			RoleName:            o.AdminRole,

+			RoleBindingAccessor: policy.NewLocalRoleBindingAccessor(project.Name, o.Client),

+			Users:               []string{o.AdminUser},

 		}

 		if err := adduser.AddRole(); err != nil {

 			fmt.Printf("The project %v was created, but %v could not be added to the %v role.\n", o.ProjectName, o.AdminUser, o.AdminRole)

-			fmt.Printf("To add the user to the existing project, run\n\n\topenshift ex policy add-role-to-user --namespace=%v --role-namespace=%v %v %v\n", o.ProjectName, o.MasterPolicyNamespace, o.AdminRole, o.AdminUser)

+			fmt.Printf("To add the user to the existing project, run\n\n\topenshift ex policy add-role-to-user --namespace=%v %v %v\n", o.ProjectName, o.AdminRole, o.AdminUser)

 			return err

 		}

 	}