self-subject access reviews (IsPersonalSubjectAccessReview) doesn't work

[nak3]

Please see following output.

$ _output/local/go/bin/osc --v=4 get IsPersonalSubjectAccessReview
I0517 21:23:47.755036    6852 selector.go:53] Unable to list "ispersonalsubjectaccessreviews": the server could not find the requested resource

Even though printIsPersonalSubjectAccessReview() is implemented in pkg/cmd/cli/describe/printer.go, its rest API is not implemented and master.go doesn't register the API during the start.

However, according to this discussion pull/139, it is not clear if IsPersonalSubjectAccessReview will be obsolete.

I open here as a new issue to track.

[smarterclayton]

Personal subject access review is called by other methods. The printer may still need to be called, but it's possibly not wired up correctly.

[liggitt]

Rereading, this isn't a bug. IsPersonalSubjectAccessReview isn't an API resource... it's a possible attribute restriction on a role. You can see it in use in the default policy with osc describe clusterpolicy default

[nak3]

I understand.

So, the below column is not used?

origin/pkg/cmd/cli/describe/printer.go

Lines 52 to 53 in cdd1903

	// known custom role extensions
	IsPersonalSubjectAccessReviewColumns = []string{"NAME"}

Actually I hope that the resource which can't get by osc get <RESOURCE> isn't included in NewHumanReadablePrinter()
Because bash-completion is created by the resources which are included in NewHumanReadablePrinter(). So osc get TAB TAB will show ispersonalsubjectaccessreview.

@liggitt is it possible to change the implementation of ispersonalsubjectaccessreview? I know bash-completion is not high priority, but if you can.

[deads2k]

The human readable printer is used to print AttributeRestrictions from

origin/pkg/cmd/cli/describe/describer.go

Line 739 in cdd1903

printer := NewHumanReadablePrinter(true)

and provides a somewhat discoverable way to print them.

I could see other envision other factorings, but changing the factorization for bash completion seems weak. Bash completion lists should be built from the RESTMappings, intersected with the additional restrictions of what you're trying to do (as a for instance, not all resources can be updated or deleted).

[nak3]

No, I mean the column headar below is not used anywhere.

origin/pkg/cmd/cli/describe/printer.go

Lines 52 to 53 in cdd1903

	// known custom role extensions
	IsPersonalSubjectAccessReviewColumns = []string{"NAME"}

    // known custom role extensions
    IsPersonalSubjectAccessReviewColumns = []string{"NAME"}

But please ignore if I misunderstand. I will understand it by myself.

As you said, it looks like RESTMappings should be used for resources lists.