Add generated file

This PR adds generated files under pkg/client and vendor folder.

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/BUILD

@@ -0,0 +1,108 @@
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "helper.go",
+        "set.go",
+        "set_env.go",
+        "set_image.go",
+        "set_resources.go",
+        "set_selector.go",
+        "set_serviceaccount.go",
+        "set_subject.go",
+    ],
+    importpath = "k8s.io/kubernetes/pkg/kubectl/cmd/set",
+    visibility = ["//build/visible_to:pkg_kubectl_cmd_set_CONSUMERS"],
+    deps = [
+        "//pkg/apis/rbac:go_default_library",
+        "//pkg/kubectl:go_default_library",
+        "//pkg/kubectl/cmd/set/env:go_default_library",
+        "//pkg/kubectl/cmd/templates:go_default_library",
+        "//pkg/kubectl/cmd/util:go_default_library",
+        "//pkg/kubectl/genericclioptions:go_default_library",
+        "//pkg/kubectl/genericclioptions/printers:go_default_library",
+        "//pkg/kubectl/genericclioptions/resource:go_default_library",
+        "//pkg/kubectl/polymorphichelpers:go_default_library",
+        "//pkg/kubectl/scheme:go_default_library",
+        "//pkg/kubectl/util/i18n:go_default_library",
+        "//vendor/github.com/golang/glog:go_default_library",
+        "//vendor/github.com/spf13/cobra:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/api/rbac/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/api/meta:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/types:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/errors:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/sets:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/strategicpatch:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/validation:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = [
+        "set_env_test.go",
+        "set_image_test.go",
+        "set_resources_test.go",
+        "set_selector_test.go",
+        "set_serviceaccount_test.go",
+        "set_subject_test.go",
+        "set_test.go",
+    ],
+    data = [
+        "//test/e2e/testing-manifests:all-srcs",
+        "//test/fixtures",
+    ],
+    embed = [":go_default_library"],
+    deps = [
+        "//pkg/api/testapi:go_default_library",
+        "//pkg/kubectl/cmd/testing:go_default_library",
+        "//pkg/kubectl/cmd/util:go_default_library",
+        "//pkg/kubectl/genericclioptions:go_default_library",
+        "//pkg/kubectl/genericclioptions/printers:go_default_library",
+        "//pkg/kubectl/genericclioptions/resource:go_default_library",
+        "//pkg/kubectl/scheme:go_default_library",
+        "//vendor/github.com/spf13/cobra:go_default_library",
+        "//vendor/github.com/stretchr/testify/assert:go_default_library",
+        "//vendor/k8s.io/api/apps/v1:go_default_library",
+        "//vendor/k8s.io/api/apps/v1beta1:go_default_library",
+        "//vendor/k8s.io/api/apps/v1beta2:go_default_library",
+        "//vendor/k8s.io/api/batch/v1:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/api/extensions/v1beta1:go_default_library",
+        "//vendor/k8s.io/api/rbac/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime/serializer:go_default_library",
+        "//vendor/k8s.io/client-go/rest:go_default_library",
+        "//vendor/k8s.io/client-go/rest/fake:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [
+        ":package-srcs",
+        "//pkg/kubectl/cmd/set/env:all-srcs",
+    ],
+    tags = ["automanaged"],
+    visibility = [
+        "//build/visible_to:pkg_kubectl_cmd_set_CONSUMERS",
+    ],
+)

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/env/BUILD

@@ -0,0 +1,41 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "doc.go",
+        "env_parse.go",
+        "env_resolve.go",
+    ],
+    importpath = "k8s.io/kubernetes/pkg/kubectl/cmd/set/env",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//pkg/api/v1/resource:go_default_library",
+        "//pkg/fieldpath:go_default_library",
+        "//vendor/k8s.io/api/core/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/sets:go_default_library",
+        "//vendor/k8s.io/client-go/kubernetes:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["env_parse_test.go"],
+    embed = [":go_default_library"],
+)

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/env/doc.go

@@ -0,0 +1,18 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package env provides functions to incorporate environment variables into set env.
+package env

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/env/env_parse.go

@@ -0,0 +1,137 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package env
+
+import (
+	"bufio"
+	"fmt"
+	"io"
+	"regexp"
+	"strings"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+var argumentEnvironment = regexp.MustCompile("(?ms)^(.+)\\=(.*)$")
+var validArgumentEnvironment = regexp.MustCompile("(?ms)^(\\w+)\\=(.*)$")
+
+// IsEnvironmentArgument checks whether a string is an environment argument, that is, whether it matches the "anycharacters=anycharacters" pattern.
+func IsEnvironmentArgument(s string) bool {
+	return argumentEnvironment.MatchString(s)
+}
+
+// IsValidEnvironmentArgument checks whether a string is a valid environment argument, that is, whether it matches the "wordcharacters=anycharacters" pattern. Word characters can be letters, numbers, and underscores.
+func IsValidEnvironmentArgument(s string) bool {
+	return validArgumentEnvironment.MatchString(s)
+}
+
+// SplitEnvironmentFromResources separates resources from environment arguments.
+// Resources must come first. Arguments may have the "DASH-" syntax.
+func SplitEnvironmentFromResources(args []string) (resources, envArgs []string, ok bool) {
+	first := true
+	for _, s := range args {
+		// this method also has to understand env removal syntax, i.e. KEY-
+		isEnv := IsEnvironmentArgument(s) || strings.HasSuffix(s, "-")
+		switch {
+		case first && isEnv:
+			first = false
+			fallthrough
+		case !first && isEnv:
+			envArgs = append(envArgs, s)
+		case first && !isEnv:
+			resources = append(resources, s)
+		case !first && !isEnv:
+			return nil, nil, false
+		}
+	}
+	return resources, envArgs, true
+}
+
+// parseIntoEnvVar parses the list of key-value pairs into kubernetes EnvVar.
+// envVarType is for making errors more specific to user intentions.
+func parseIntoEnvVar(spec []string, defaultReader io.Reader, envVarType string) ([]v1.EnvVar, []string, error) {
+	env := []v1.EnvVar{}
+	exists := sets.NewString()
+	var remove []string
+	for _, envSpec := range spec {
+		switch {
+		case !IsValidEnvironmentArgument(envSpec) && !strings.HasSuffix(envSpec, "-"):
+			return nil, nil, fmt.Errorf("%ss must be of the form key=value and can only contain letters, numbers, and underscores", envVarType)
+		case envSpec == "-":
+			if defaultReader == nil {
+				return nil, nil, fmt.Errorf("when '-' is used, STDIN must be open")
+			}
+			fileEnv, err := readEnv(defaultReader, envVarType)
+			if err != nil {
+				return nil, nil, err
+			}
+			env = append(env, fileEnv...)
+		case strings.Index(envSpec, "=") != -1:
+			parts := strings.SplitN(envSpec, "=", 2)
+			if len(parts) != 2 {
+				return nil, nil, fmt.Errorf("invalid %s: %v", envVarType, envSpec)
+			}
+			exists.Insert(parts[0])
+			env = append(env, v1.EnvVar{
+				Name:  parts[0],
+				Value: parts[1],
+			})
+		case strings.HasSuffix(envSpec, "-"):
+			remove = append(remove, envSpec[:len(envSpec)-1])
+		default:
+			return nil, nil, fmt.Errorf("unknown %s: %v", envVarType, envSpec)
+		}
+	}
+	for _, removeLabel := range remove {
+		if _, found := exists[removeLabel]; found {
+			return nil, nil, fmt.Errorf("can not both modify and remove the same %s in the same command", envVarType)
+		}
+	}
+	return env, remove, nil
+}
+
+// ParseEnv parses the elements of the first argument looking for environment variables in key=value form and, if one of those values is "-", it also scans the reader.
+// The same environment variable cannot be both modified and removed in the same command.
+func ParseEnv(spec []string, defaultReader io.Reader) ([]v1.EnvVar, []string, error) {
+	return parseIntoEnvVar(spec, defaultReader, "environment variable")
+}
+
+func readEnv(r io.Reader, envVarType string) ([]v1.EnvVar, error) {
+	env := []v1.EnvVar{}
+	scanner := bufio.NewScanner(r)
+	for scanner.Scan() {
+		envSpec := scanner.Text()
+		if pos := strings.Index(envSpec, "#"); pos != -1 {
+			envSpec = envSpec[:pos]
+		}
+		if strings.Index(envSpec, "=") != -1 {
+			parts := strings.SplitN(envSpec, "=", 2)
+			if len(parts) != 2 {
+				return nil, fmt.Errorf("invalid %s: %v", envVarType, envSpec)
+			}
+			env = append(env, v1.EnvVar{
+				Name:  parts[0],
+				Value: parts[1],
+			})
+		}
+	}
+	if err := scanner.Err(); err != nil && err != io.EOF {
+		return nil, err
+	}
+	return env, nil
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/env/env_parse_test.go

@@ -0,0 +1,69 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package env
+
+import (
+	"fmt"
+	"io"
+	"strings"
+)
+
+func ExampleIsEnvironmentArgument_true() {
+	test := "returns=true"
+	fmt.Println(IsEnvironmentArgument(test))
+	// Output: true
+}
+
+func ExampleIsEnvironmentArgument_false() {
+	test := "returnsfalse"
+	fmt.Println(IsEnvironmentArgument(test))
+	// Output: false
+}
+
+func ExampleIsValidEnvironmentArgument_true() {
+	test := "wordcharacters=true"
+	fmt.Println(IsValidEnvironmentArgument(test))
+	// Output: true
+}
+
+func ExampleIsValidEnvironmentArgument_false() {
+	test := "not$word^characters=test"
+	fmt.Println(IsValidEnvironmentArgument(test))
+	// Output: false
+}
+
+func ExampleSplitEnvironmentFromResources() {
+	args := []string{`resource`, "ENV\\=ARG", `ONE\=MORE`, `DASH-`}
+	fmt.Println(SplitEnvironmentFromResources(args))
+	// Output: [resource] [ENV\=ARG ONE\=MORE DASH-] true
+}
+
+func ExampleParseEnv_good() {
+	r := strings.NewReader("FROM=READER")
+	ss := []string{"ENV=VARIABLE", "AND=ANOTHER", "REMOVE-", "-"}
+	fmt.Println(ParseEnv(ss, r))
+	// Output:
+	// [{ENV VARIABLE nil} {AND ANOTHER nil} {FROM READER nil}] [REMOVE] <nil>
+}
+
+func ExampleParseEnv_bad() {
+	var r io.Reader
+	bad := []string{"This not in the key=value format."}
+	fmt.Println(ParseEnv(bad, r))
+	// Output:
+	// [] [] environment variables must be of the form key=value and can only contain letters, numbers, and underscores
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/env/env_resolve.go

@@ -0,0 +1,133 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package env
+
+import (
+	"fmt"
+
+	"k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/kubernetes/pkg/api/v1/resource"
+	"k8s.io/kubernetes/pkg/fieldpath"
+)
+
+// ResourceStore defines a new resource store data structure.
+type ResourceStore struct {
+	SecretStore    map[string]*v1.Secret
+	ConfigMapStore map[string]*v1.ConfigMap
+}
+
+// NewResourceStore returns a pointer to a new resource store data structure.
+func NewResourceStore() *ResourceStore {
+	return &ResourceStore{
+		SecretStore:    make(map[string]*v1.Secret),
+		ConfigMapStore: make(map[string]*v1.ConfigMap),
+	}
+}
+
+// getSecretRefValue returns the value of a secret in the supplied namespace
+func getSecretRefValue(client kubernetes.Interface, namespace string, store *ResourceStore, secretSelector *v1.SecretKeySelector) (string, error) {
+	secret, ok := store.SecretStore[secretSelector.Name]
+	if !ok {
+		var err error
+		secret, err = client.CoreV1().Secrets(namespace).Get(secretSelector.Name, metav1.GetOptions{})
+		if err != nil {
+			return "", err
+		}
+		store.SecretStore[secretSelector.Name] = secret
+	}
+	if data, ok := secret.Data[secretSelector.Key]; ok {
+		return string(data), nil
+	}
+	return "", fmt.Errorf("key %s not found in secret %s", secretSelector.Key, secretSelector.Name)
+
+}
+
+// getConfigMapRefValue returns the value of a configmap in the supplied namespace
+func getConfigMapRefValue(client kubernetes.Interface, namespace string, store *ResourceStore, configMapSelector *v1.ConfigMapKeySelector) (string, error) {
+	configMap, ok := store.ConfigMapStore[configMapSelector.Name]
+	if !ok {
+		var err error
+		configMap, err = client.CoreV1().ConfigMaps(namespace).Get(configMapSelector.Name, metav1.GetOptions{})
+		if err != nil {
+			return "", err
+		}
+		store.ConfigMapStore[configMapSelector.Name] = configMap
+	}
+	if data, ok := configMap.Data[configMapSelector.Key]; ok {
+		return string(data), nil
+	}
+	return "", fmt.Errorf("key %s not found in config map %s", configMapSelector.Key, configMapSelector.Name)
+}
+
+// getFieldRef returns the value of the supplied path in the given object
+func getFieldRef(obj runtime.Object, from *v1.EnvVarSource) (string, error) {
+	return fieldpath.ExtractFieldPathAsString(obj, from.FieldRef.FieldPath)
+}
+
+// getResourceFieldRef returns the value of a resource in the given container
+func getResourceFieldRef(from *v1.EnvVarSource, c *v1.Container) (string, error) {
+	return resource.ExtractContainerResourceValue(from.ResourceFieldRef, c)
+}
+
+// GetEnvVarRefValue returns the value referenced by the supplied EnvVarSource given the other supplied information.
+func GetEnvVarRefValue(kc kubernetes.Interface, ns string, store *ResourceStore, from *v1.EnvVarSource, obj runtime.Object, c *v1.Container) (string, error) {
+	if from.SecretKeyRef != nil {
+		return getSecretRefValue(kc, ns, store, from.SecretKeyRef)
+	}
+
+	if from.ConfigMapKeyRef != nil {
+		return getConfigMapRefValue(kc, ns, store, from.ConfigMapKeyRef)
+	}
+
+	if from.FieldRef != nil {
+		return getFieldRef(obj, from)
+	}
+
+	if from.ResourceFieldRef != nil {
+		return getResourceFieldRef(from, c)
+	}
+
+	return "", fmt.Errorf("invalid valueFrom")
+}
+
+// GetEnvVarRefString returns a text description of whichever field is set within the supplied EnvVarSource argument.
+func GetEnvVarRefString(from *v1.EnvVarSource) string {
+	if from.ConfigMapKeyRef != nil {
+		return fmt.Sprintf("configmap %s, key %s", from.ConfigMapKeyRef.Name, from.ConfigMapKeyRef.Key)
+	}
+
+	if from.SecretKeyRef != nil {
+		return fmt.Sprintf("secret %s, key %s", from.SecretKeyRef.Name, from.SecretKeyRef.Key)
+	}
+
+	if from.FieldRef != nil {
+		return fmt.Sprintf("field path %s", from.FieldRef.FieldPath)
+	}
+
+	if from.ResourceFieldRef != nil {
+		containerPrefix := ""
+		if from.ResourceFieldRef.ContainerName != "" {
+			containerPrefix = fmt.Sprintf("%s/", from.ResourceFieldRef.ContainerName)
+		}
+		return fmt.Sprintf("resource field %s%s", containerPrefix, from.ResourceFieldRef.Resource)
+	}
+
+	return "invalid valueFrom"
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/helper.go

@@ -0,0 +1,187 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"fmt"
+	"io"
+	"strings"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/strategicpatch"
+	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions/resource"
+)
+
+// selectContainers allows one or more containers to be matched against a string or wildcard
+func selectContainers(containers []v1.Container, spec string) ([]*v1.Container, []*v1.Container) {
+	out := []*v1.Container{}
+	skipped := []*v1.Container{}
+	for i, c := range containers {
+		if selectString(c.Name, spec) {
+			out = append(out, &containers[i])
+		} else {
+			skipped = append(skipped, &containers[i])
+		}
+	}
+	return out, skipped
+}
+
+// handlePodUpdateError prints a more useful error to the end user when mutating a pod.
+func handlePodUpdateError(out io.Writer, err error, resource string) {
+	if statusError, ok := err.(*errors.StatusError); ok && errors.IsInvalid(err) {
+		errorDetails := statusError.Status().Details
+		if errorDetails.Kind == "Pod" {
+			all, match := true, false
+			for _, cause := range errorDetails.Causes {
+				if cause.Field == "spec" && strings.Contains(cause.Message, "may not update fields other than") {
+					fmt.Fprintf(out, "error: may not update %s in pod %q directly\n", resource, errorDetails.Name)
+					match = true
+				} else {
+					all = false
+				}
+			}
+			if all && match {
+				return
+			}
+		} else {
+			if ok := cmdutil.PrintErrorWithCauses(err, out); ok {
+				return
+			}
+		}
+	}
+
+	fmt.Fprintf(out, "error: %v\n", err)
+}
+
+// selectString returns true if the provided string matches spec, where spec is a string with
+// a non-greedy '*' wildcard operator.
+// TODO: turn into a regex and handle greedy matches and backtracking.
+func selectString(s, spec string) bool {
+	if spec == "*" {
+		return true
+	}
+	if !strings.Contains(spec, "*") {
+		return s == spec
+	}
+
+	pos := 0
+	match := true
+	parts := strings.Split(spec, "*")
+	for i, part := range parts {
+		if len(part) == 0 {
+			continue
+		}
+		next := strings.Index(s[pos:], part)
+		switch {
+		// next part not in string
+		case next < pos:
+			fallthrough
+		// first part does not match start of string
+		case i == 0 && pos != 0:
+			fallthrough
+		// last part does not exactly match remaining part of string
+		case i == (len(parts)-1) && len(s) != (len(part)+next):
+			match = false
+			break
+		default:
+			pos = next
+		}
+	}
+	return match
+}
+
+// Patch represents the result of a mutation to an object.
+type Patch struct {
+	Info *resource.Info
+	Err  error
+
+	Before []byte
+	After  []byte
+	Patch  []byte
+}
+
+// PatchFn is a function type that accepts an info object and returns a byte slice.
+// Implementations of PatchFn should update the object and return it encoded.
+type PatchFn func(runtime.Object) ([]byte, error)
+
+// CalculatePatch calls the mutation function on the provided info object, and generates a strategic merge patch for
+// the changes in the object. Encoder must be able to encode the info into the appropriate destination type.
+// This function returns whether the mutation function made any change in the original object.
+func CalculatePatch(patch *Patch, encoder runtime.Encoder, mutateFn PatchFn) bool {
+	patch.Before, patch.Err = runtime.Encode(encoder, patch.Info.Object)
+	patch.After, patch.Err = mutateFn(patch.Info.Object)
+	if patch.Err != nil {
+		return true
+	}
+	if patch.After == nil {
+		return false
+	}
+
+	patch.Patch, patch.Err = strategicpatch.CreateTwoWayMergePatch(patch.Before, patch.After, patch.Info.Object)
+	return true
+}
+
+// CalculatePatches calculates patches on each provided info object. If the provided mutateFn
+// makes no change in an object, the object is not included in the final list of patches.
+func CalculatePatches(infos []*resource.Info, encoder runtime.Encoder, mutateFn PatchFn) []*Patch {
+	var patches []*Patch
+	for _, info := range infos {
+		patch := &Patch{Info: info}
+		if CalculatePatch(patch, encoder, mutateFn) {
+			patches = append(patches, patch)
+		}
+	}
+	return patches
+}
+
+func findEnv(env []v1.EnvVar, name string) (v1.EnvVar, bool) {
+	for _, e := range env {
+		if e.Name == name {
+			return e, true
+		}
+	}
+	return v1.EnvVar{}, false
+}
+
+func updateEnv(existing []v1.EnvVar, env []v1.EnvVar, remove []string) []v1.EnvVar {
+	out := []v1.EnvVar{}
+	covered := sets.NewString(remove...)
+	for _, e := range existing {
+		if covered.Has(e.Name) {
+			continue
+		}
+		newer, ok := findEnv(env, e.Name)
+		if ok {
+			covered.Insert(e.Name)
+			out = append(out, newer)
+			continue
+		}
+		out = append(out, e)
+	}
+	for _, e := range env {
+		if covered.Has(e.Name) {
+			continue
+		}
+		covered.Insert(e.Name)
+		out = append(out, e)
+	}
+	return out
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set.go

@@ -0,0 +1,52 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"github.com/spf13/cobra"
+	"k8s.io/kubernetes/pkg/kubectl/cmd/templates"
+	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions"
+	"k8s.io/kubernetes/pkg/kubectl/util/i18n"
+)
+
+var (
+	set_long = templates.LongDesc(`
+		Configure application resources
+
+		These commands help you make changes to existing application resources.`)
+)
+
+func NewCmdSet(f cmdutil.Factory, streams genericclioptions.IOStreams) *cobra.Command {
+	cmd := &cobra.Command{
+		Use: "set SUBCOMMAND",
+		DisableFlagsInUseLine: true,
+		Short: i18n.T("Set specific features on objects"),
+		Long:  set_long,
+		Run:   cmdutil.DefaultSubCommandRun(streams.ErrOut),
+	}
+
+	// add subcommands
+	cmd.AddCommand(NewCmdImage(f, streams))
+	cmd.AddCommand(NewCmdResources(f, streams))
+	cmd.AddCommand(NewCmdSelector(f, streams))
+	cmd.AddCommand(NewCmdSubject(f, streams))
+	cmd.AddCommand(NewCmdServiceAccount(f, streams))
+	cmd.AddCommand(NewCmdEnv(f, streams))
+
+	return cmd
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_env.go

@@ -0,0 +1,507 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"errors"
+	"fmt"
+	"regexp"
+	"sort"
+	"strings"
+
+	"github.com/spf13/cobra"
+
+	"k8s.io/api/core/v1"
+	meta "k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+	"k8s.io/client-go/kubernetes"
+	envutil "k8s.io/kubernetes/pkg/kubectl/cmd/set/env"
+	"k8s.io/kubernetes/pkg/kubectl/cmd/templates"
+	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions/printers"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions/resource"
+	"k8s.io/kubernetes/pkg/kubectl/polymorphichelpers"
+	"k8s.io/kubernetes/pkg/kubectl/scheme"
+)
+
+var (
+	validEnvNameRegexp = regexp.MustCompile("[^a-zA-Z0-9_]")
+	envResources       = `
+  	pod (po), replicationcontroller (rc), deployment (deploy), daemonset (ds), job, replicaset (rs)`
+
+	envLong = templates.LongDesc(`
+		Update environment variables on a pod template.
+
+		List environment variable definitions in one or more pods, pod templates.
+		Add, update, or remove container environment variable definitions in one or
+		more pod templates (within replication controllers or deployment configurations).
+		View or modify the environment variable definitions on all containers in the
+		specified pods or pod templates, or just those that match a wildcard.
+
+		If "--env -" is passed, environment variables can be read from STDIN using the standard env
+		syntax.
+
+		Possible resources include (case insensitive):
+		` + envResources)
+
+	envExample = templates.Examples(`
+          # Update deployment 'registry' with a new environment variable
+	  kubectl set env deployment/registry STORAGE_DIR=/local
+
+	  # List the environment variables defined on a deployments 'sample-build'
+	  kubectl set env deployment/sample-build --list
+
+	  # List the environment variables defined on all pods
+	  kubectl set env pods --all --list
+
+	  # Output modified deployment in YAML, and does not alter the object on the server
+	  kubectl set env deployment/sample-build STORAGE_DIR=/data -o yaml
+
+	  # Update all containers in all replication controllers in the project to have ENV=prod
+	  kubectl set env rc --all ENV=prod
+
+	  # Import environment from a secret
+	  kubectl set env --from=secret/mysecret deployment/myapp
+
+	  # Import environment from a config map with a prefix
+	  kubectl set env --from=configmap/myconfigmap --prefix=MYSQL_ deployment/myapp
+
+          # Import specific keys from a config map
+          kubectl set env --keys=my-example-key --from=configmap/myconfigmap deployment/myapp
+
+	  # Remove the environment variable ENV from container 'c1' in all deployment configs
+	  kubectl set env deployments --all --containers="c1" ENV-
+
+	  # Remove the environment variable ENV from a deployment definition on disk and
+	  # update the deployment config on the server
+	  kubectl set env -f deploy.json ENV-
+
+	  # Set some of the local shell environment into a deployment config on the server
+	  env | grep RAILS_ | kubectl set env -e - deployment/registry`)
+)
+
+type EnvOptions struct {
+	PrintFlags *genericclioptions.PrintFlags
+	resource.FilenameOptions
+
+	EnvParams         []string
+	All               bool
+	Resolve           bool
+	List              bool
+	Local             bool
+	Overwrite         bool
+	ContainerSelector string
+	Selector          string
+	From              string
+	Prefix            string
+	Keys              []string
+
+	PrintObj printers.ResourcePrinterFunc
+
+	envArgs                []string
+	resources              []string
+	output                 string
+	dryRun                 bool
+	builder                func() *resource.Builder
+	updatePodSpecForObject polymorphichelpers.UpdatePodSpecForObjectFunc
+	namespace              string
+	enforceNamespace       bool
+	clientset              *kubernetes.Clientset
+
+	genericclioptions.IOStreams
+}
+
+// NewEnvOptions returns an EnvOptions indicating all containers in the selected
+// pod templates are selected by default and allowing environment to be overwritten
+func NewEnvOptions(streams genericclioptions.IOStreams) *EnvOptions {
+	return &EnvOptions{
+		PrintFlags: genericclioptions.NewPrintFlags("env updated").WithTypeSetter(scheme.Scheme),
+
+		ContainerSelector: "*",
+		Overwrite:         true,
+
+		IOStreams: streams,
+	}
+}
+
+// NewCmdEnv implements the OpenShift cli env command
+func NewCmdEnv(f cmdutil.Factory, streams genericclioptions.IOStreams) *cobra.Command {
+	o := NewEnvOptions(streams)
+	cmd := &cobra.Command{
+		Use: "env RESOURCE/NAME KEY_1=VAL_1 ... KEY_N=VAL_N",
+		DisableFlagsInUseLine: true,
+		Short:   "Update environment variables on a pod template",
+		Long:    envLong,
+		Example: fmt.Sprintf(envExample),
+		Run: func(cmd *cobra.Command, args []string) {
+			cmdutil.CheckErr(o.Complete(f, cmd, args))
+			cmdutil.CheckErr(o.Validate())
+			cmdutil.CheckErr(o.RunEnv())
+		},
+	}
+	usage := "the resource to update the env"
+	cmdutil.AddFilenameOptionFlags(cmd, &o.FilenameOptions, usage)
+	cmd.Flags().StringVarP(&o.ContainerSelector, "containers", "c", o.ContainerSelector, "The names of containers in the selected pod templates to change - may use wildcards")
+	cmd.Flags().StringVarP(&o.From, "from", "", "", "The name of a resource from which to inject environment variables")
+	cmd.Flags().StringVarP(&o.Prefix, "prefix", "", "", "Prefix to append to variable names")
+	cmd.Flags().StringArrayVarP(&o.EnvParams, "env", "e", o.EnvParams, "Specify a key-value pair for an environment variable to set into each container.")
+	cmd.Flags().StringSliceVarP(&o.Keys, "keys", "", o.Keys, "Comma-separated list of keys to import from specified resource")
+	cmd.Flags().BoolVar(&o.List, "list", o.List, "If true, display the environment and any changes in the standard format. this flag will removed when we have kubectl view env.")
+	cmd.Flags().BoolVar(&o.Resolve, "resolve", o.Resolve, "If true, show secret or configmap references when listing variables")
+	cmd.Flags().StringVarP(&o.Selector, "selector", "l", o.Selector, "Selector (label query) to filter on")
+	cmd.Flags().BoolVar(&o.Local, "local", o.Local, "If true, set env will NOT contact api-server but run locally.")
+	cmd.Flags().BoolVar(&o.All, "all", o.All, "If true, select all resources in the namespace of the specified resource types")
+	cmd.Flags().BoolVar(&o.Overwrite, "overwrite", o.Overwrite, "If true, allow environment to be overwritten, otherwise reject updates that overwrite existing environment.")
+
+	o.PrintFlags.AddFlags(cmd)
+
+	cmdutil.AddDryRunFlag(cmd)
+	return cmd
+}
+
+func validateNoOverwrites(existing []v1.EnvVar, env []v1.EnvVar) error {
+	for _, e := range env {
+		if current, exists := findEnv(existing, e.Name); exists && current.Value != e.Value {
+			return fmt.Errorf("'%s' already has a value (%s), and --overwrite is false", current.Name, current.Value)
+		}
+	}
+	return nil
+}
+
+func keyToEnvName(key string) string {
+	return strings.ToUpper(validEnvNameRegexp.ReplaceAllString(key, "_"))
+}
+
+func contains(key string, keyList []string) bool {
+	if len(keyList) == 0 {
+		return true
+	}
+
+	for _, k := range keyList {
+		if k == key {
+			return true
+		}
+	}
+	return false
+}
+
+func (o *EnvOptions) Complete(f cmdutil.Factory, cmd *cobra.Command, args []string) error {
+	if o.All && len(o.Selector) > 0 {
+		return fmt.Errorf("cannot set --all and --selector at the same time")
+	}
+	ok := false
+	o.resources, o.envArgs, ok = envutil.SplitEnvironmentFromResources(args)
+	if !ok {
+		return fmt.Errorf("all resources must be specified before environment changes: %s", strings.Join(args, " "))
+	}
+
+	o.updatePodSpecForObject = polymorphichelpers.UpdatePodSpecForObjectFn
+	o.output = cmdutil.GetFlagString(cmd, "output")
+	o.dryRun = cmdutil.GetDryRunFlag(cmd)
+
+	if o.dryRun {
+		// TODO(juanvallejo): This can be cleaned up even further by creating
+		// a PrintFlags struct that binds the --dry-run flag, and whose
+		// ToPrinter method returns a printer that understands how to print
+		// this success message.
+		o.PrintFlags.Complete("%s (dry run)")
+	}
+	printer, err := o.PrintFlags.ToPrinter()
+	if err != nil {
+		return err
+	}
+	o.PrintObj = printer.PrintObj
+
+	o.clientset, err = f.KubernetesClientSet()
+	if err != nil {
+		return err
+	}
+	o.namespace, o.enforceNamespace, err = f.ToRawKubeConfigLoader().Namespace()
+	if err != nil {
+		return err
+	}
+	o.builder = f.NewBuilder
+
+	return nil
+}
+
+func (o *EnvOptions) Validate() error {
+	if len(o.Filenames) == 0 && len(o.resources) < 1 {
+		return fmt.Errorf("one or more resources must be specified as <resource> <name> or <resource>/<name>")
+	}
+	if o.List && len(o.output) > 0 {
+		return fmt.Errorf("--list and --output may not be specified together")
+	}
+	if len(o.Keys) > 0 && len(o.From) == 0 {
+		return fmt.Errorf("when specifying --keys, a configmap or secret must be provided with --from")
+	}
+	return nil
+}
+
+// RunEnv contains all the necessary functionality for the OpenShift cli env command
+func (o *EnvOptions) RunEnv() error {
+	env, remove, err := envutil.ParseEnv(append(o.EnvParams, o.envArgs...), o.In)
+	if err != nil {
+		return err
+	}
+
+	if len(o.From) != 0 {
+		b := o.builder().
+			WithScheme(scheme.Scheme, scheme.Scheme.PrioritizedVersionsAllGroups()...).
+			LocalParam(o.Local).
+			ContinueOnError().
+			NamespaceParam(o.namespace).DefaultNamespace().
+			FilenameParam(o.enforceNamespace, &o.FilenameOptions).
+			Flatten()
+
+		if !o.Local {
+			b = b.
+				LabelSelectorParam(o.Selector).
+				ResourceTypeOrNameArgs(o.All, o.From).
+				Latest()
+		}
+
+		infos, err := b.Do().Infos()
+		if err != nil {
+			return err
+		}
+
+		for _, info := range infos {
+			switch from := info.Object.(type) {
+			case *v1.Secret:
+				for key := range from.Data {
+					if contains(key, o.Keys) {
+						envVar := v1.EnvVar{
+							Name: keyToEnvName(key),
+							ValueFrom: &v1.EnvVarSource{
+								SecretKeyRef: &v1.SecretKeySelector{
+									LocalObjectReference: v1.LocalObjectReference{
+										Name: from.Name,
+									},
+									Key: key,
+								},
+							},
+						}
+						env = append(env, envVar)
+					}
+				}
+			case *v1.ConfigMap:
+				for key := range from.Data {
+					if contains(key, o.Keys) {
+						envVar := v1.EnvVar{
+							Name: keyToEnvName(key),
+							ValueFrom: &v1.EnvVarSource{
+								ConfigMapKeyRef: &v1.ConfigMapKeySelector{
+									LocalObjectReference: v1.LocalObjectReference{
+										Name: from.Name,
+									},
+									Key: key,
+								},
+							},
+						}
+						env = append(env, envVar)
+					}
+				}
+			default:
+				return fmt.Errorf("unsupported resource specified in --from")
+			}
+		}
+	}
+
+	if len(o.Prefix) != 0 {
+		for i := range env {
+			env[i].Name = fmt.Sprintf("%s%s", o.Prefix, env[i].Name)
+		}
+	}
+
+	b := o.builder().
+		WithScheme(scheme.Scheme, scheme.Scheme.PrioritizedVersionsAllGroups()...).
+		LocalParam(o.Local).
+		ContinueOnError().
+		NamespaceParam(o.namespace).DefaultNamespace().
+		FilenameParam(o.enforceNamespace, &o.FilenameOptions).
+		Flatten()
+
+	if !o.Local {
+		b.LabelSelectorParam(o.Selector).
+			ResourceTypeOrNameArgs(o.All, o.resources...).
+			Latest()
+	}
+
+	infos, err := b.Do().Infos()
+	if err != nil {
+		return err
+	}
+	patches := CalculatePatches(infos, scheme.DefaultJSONEncoder(), func(obj runtime.Object) ([]byte, error) {
+		_, err := o.updatePodSpecForObject(obj, func(spec *v1.PodSpec) error {
+			resolutionErrorsEncountered := false
+			containers, _ := selectContainers(spec.Containers, o.ContainerSelector)
+			objName, err := meta.NewAccessor().Name(obj)
+			if err != nil {
+				return err
+			}
+
+			gvks, _, err := scheme.Scheme.ObjectKinds(obj)
+			if err != nil {
+				return err
+			}
+			objKind := obj.GetObjectKind().GroupVersionKind().Kind
+			if len(objKind) == 0 {
+				for _, gvk := range gvks {
+					if len(gvk.Kind) == 0 {
+						continue
+					}
+					if len(gvk.Version) == 0 || gvk.Version == runtime.APIVersionInternal {
+						continue
+					}
+
+					objKind = gvk.Kind
+					break
+				}
+			}
+
+			if len(containers) == 0 {
+				if gvks, _, err := scheme.Scheme.ObjectKinds(obj); err == nil {
+					objKind := obj.GetObjectKind().GroupVersionKind().Kind
+					if len(objKind) == 0 {
+						for _, gvk := range gvks {
+							if len(gvk.Kind) == 0 {
+								continue
+							}
+							if len(gvk.Version) == 0 || gvk.Version == runtime.APIVersionInternal {
+								continue
+							}
+
+							objKind = gvk.Kind
+							break
+						}
+					}
+
+					fmt.Fprintf(o.ErrOut, "warning: %s/%s does not have any containers matching %q\n", objKind, objName, o.ContainerSelector)
+				}
+				return nil
+			}
+			for _, c := range containers {
+				if !o.Overwrite {
+					if err := validateNoOverwrites(c.Env, env); err != nil {
+						return err
+					}
+				}
+
+				c.Env = updateEnv(c.Env, env, remove)
+				if o.List {
+					resolveErrors := map[string][]string{}
+					store := envutil.NewResourceStore()
+
+					fmt.Fprintf(o.Out, "# %s %s, container %s\n", objKind, objName, c.Name)
+					for _, env := range c.Env {
+						// Print the simple value
+						if env.ValueFrom == nil {
+							fmt.Fprintf(o.Out, "%s=%s\n", env.Name, env.Value)
+							continue
+						}
+
+						// Print the reference version
+						if !o.Resolve {
+							fmt.Fprintf(o.Out, "# %s from %s\n", env.Name, envutil.GetEnvVarRefString(env.ValueFrom))
+							continue
+						}
+
+						value, err := envutil.GetEnvVarRefValue(o.clientset, o.namespace, store, env.ValueFrom, obj, c)
+						// Print the resolved value
+						if err == nil {
+							fmt.Fprintf(o.Out, "%s=%s\n", env.Name, value)
+							continue
+						}
+
+						// Print the reference version and save the resolve error
+						fmt.Fprintf(o.Out, "# %s from %s\n", env.Name, envutil.GetEnvVarRefString(env.ValueFrom))
+						errString := err.Error()
+						resolveErrors[errString] = append(resolveErrors[errString], env.Name)
+						resolutionErrorsEncountered = true
+					}
+
+					// Print any resolution errors
+					errs := []string{}
+					for err, vars := range resolveErrors {
+						sort.Strings(vars)
+						errs = append(errs, fmt.Sprintf("error retrieving reference for %s: %v", strings.Join(vars, ", "), err))
+					}
+					sort.Strings(errs)
+					for _, err := range errs {
+						fmt.Fprintln(o.ErrOut, err)
+					}
+				}
+			}
+			if resolutionErrorsEncountered {
+				return errors.New("failed to retrieve valueFrom references")
+			}
+			return nil
+		})
+
+		if err == nil {
+			return runtime.Encode(scheme.DefaultJSONEncoder(), obj)
+		}
+		return nil, err
+	})
+
+	if o.List {
+		return nil
+	}
+
+	allErrs := []error{}
+
+	for _, patch := range patches {
+		info := patch.Info
+		if patch.Err != nil {
+			allErrs = append(allErrs, fmt.Errorf("error: %s/%s %v\n", info.Mapping.Resource, info.Name, patch.Err))
+			continue
+		}
+
+		// no changes
+		if string(patch.Patch) == "{}" || len(patch.Patch) == 0 {
+			continue
+		}
+
+		if o.Local || o.dryRun {
+			if err := o.PrintObj(info.Object, o.Out); err != nil {
+				allErrs = append(allErrs, err)
+			}
+			continue
+		}
+
+		actual, err := resource.NewHelper(info.Client, info.Mapping).Patch(info.Namespace, info.Name, types.StrategicMergePatchType, patch.Patch)
+		if err != nil {
+			allErrs = append(allErrs, fmt.Errorf("failed to patch env update to pod template: %v\n", err))
+			continue
+		}
+
+		// make sure arguments to set or replace environment variables are set
+		// before returning a successful message
+		if len(env) == 0 && len(o.envArgs) == 0 {
+			return fmt.Errorf("at least one environment variable must be provided")
+		}
+
+		if err := o.PrintObj(actual, o.Out); err != nil {
+			allErrs = append(allErrs, err)
+		}
+	}
+	return utilerrors.NewAggregate(allErrs)
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_env_test.go

@@ -0,0 +1,637 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"path"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	appsv1 "k8s.io/api/apps/v1"
+	appsv1beta1 "k8s.io/api/apps/v1beta1"
+	appsv1beta2 "k8s.io/api/apps/v1beta2"
+	batchv1 "k8s.io/api/batch/v1"
+	"k8s.io/api/core/v1"
+	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/client-go/rest/fake"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	cmdtesting "k8s.io/kubernetes/pkg/kubectl/cmd/testing"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions/resource"
+	"k8s.io/kubernetes/pkg/kubectl/scheme"
+)
+
+func TestSetEnvLocal(t *testing.T) {
+	tf := cmdtesting.NewTestFactory().WithNamespace("test")
+	defer tf.Cleanup()
+
+	tf.Client = &fake.RESTClient{
+		GroupVersion:         schema.GroupVersion{Version: ""},
+		NegotiatedSerializer: serializer.DirectCodecFactory{CodecFactory: scheme.Codecs},
+		Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+			t.Fatalf("unexpected request: %s %#v\n%#v", req.Method, req.URL, req)
+			return nil, nil
+		}),
+	}
+	tf.ClientConfigVal = &restclient.Config{ContentConfig: restclient.ContentConfig{GroupVersion: &schema.GroupVersion{Version: ""}}}
+	outputFormat := "name"
+
+	streams, _, buf, bufErr := genericclioptions.NewTestIOStreams()
+	opts := NewEnvOptions(streams)
+	opts.PrintFlags = genericclioptions.NewPrintFlags("").WithDefaultOutput(outputFormat).WithTypeSetter(scheme.Scheme)
+	opts.FilenameOptions = resource.FilenameOptions{
+		Filenames: []string{"../../../../test/e2e/testing-manifests/statefulset/cassandra/controller.yaml"},
+	}
+	opts.Local = true
+
+	err := opts.Complete(tf, NewCmdEnv(tf, streams), []string{"env=prod"})
+	assert.NoError(t, err)
+	err = opts.Validate()
+	assert.NoError(t, err)
+	err = opts.RunEnv()
+	assert.NoError(t, err)
+	if bufErr.Len() > 0 {
+		t.Errorf("unexpected error: %s", string(bufErr.String()))
+	}
+	if !strings.Contains(buf.String(), "replicationcontroller/cassandra") {
+		t.Errorf("did not set env: %s", buf.String())
+	}
+}
+
+func TestSetMultiResourcesEnvLocal(t *testing.T) {
+	tf := cmdtesting.NewTestFactory().WithNamespace("test")
+	defer tf.Cleanup()
+
+	tf.Client = &fake.RESTClient{
+		GroupVersion:         schema.GroupVersion{Version: ""},
+		NegotiatedSerializer: serializer.DirectCodecFactory{CodecFactory: scheme.Codecs},
+		Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+			t.Fatalf("unexpected request: %s %#v\n%#v", req.Method, req.URL, req)
+			return nil, nil
+		}),
+	}
+	tf.ClientConfigVal = &restclient.Config{ContentConfig: restclient.ContentConfig{GroupVersion: &schema.GroupVersion{Version: ""}}}
+
+	outputFormat := "name"
+	streams, _, buf, bufErr := genericclioptions.NewTestIOStreams()
+	opts := NewEnvOptions(streams)
+	opts.PrintFlags = genericclioptions.NewPrintFlags("").WithDefaultOutput(outputFormat).WithTypeSetter(scheme.Scheme)
+	opts.FilenameOptions = resource.FilenameOptions{
+		Filenames: []string{"../../../../test/fixtures/pkg/kubectl/cmd/set/multi-resource-yaml.yaml"},
+	}
+	opts.Local = true
+
+	err := opts.Complete(tf, NewCmdEnv(tf, streams), []string{"env=prod"})
+	assert.NoError(t, err)
+	err = opts.Validate()
+	assert.NoError(t, err)
+	err = opts.RunEnv()
+	assert.NoError(t, err)
+	if bufErr.Len() > 0 {
+		t.Errorf("unexpected error: %s", string(bufErr.String()))
+	}
+	expectedOut := "replicationcontroller/first-rc\nreplicationcontroller/second-rc\n"
+	if buf.String() != expectedOut {
+		t.Errorf("expected out:\n%s\nbut got:\n%s", expectedOut, buf.String())
+	}
+}
+
+func TestSetEnvRemote(t *testing.T) {
+	inputs := []struct {
+		name                            string
+		object                          runtime.Object
+		apiPrefix, apiGroup, apiVersion string
+		testAPIGroup                    string
+		args                            []string
+	}{
+		{
+			name: "test extensions.v1beta1 replicaset",
+			object: &extensionsv1beta1.ReplicaSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: extensionsv1beta1.ReplicaSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "extensions", apiVersion: "v1beta1",
+			args: []string{"replicaset", "nginx", "env=prod"},
+		},
+		{
+			name: "test apps.v1beta2 replicaset",
+			object: &appsv1beta2.ReplicaSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.ReplicaSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"replicaset", "nginx", "env=prod"},
+		},
+		{
+			name: "test appsv1 replicaset",
+			object: &appsv1.ReplicaSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.ReplicaSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"replicaset", "nginx", "env=prod"},
+		},
+		{
+			name: "test extensions.v1beta1 daemonset",
+			object: &extensionsv1beta1.DaemonSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: extensionsv1beta1.DaemonSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "extensions", apiVersion: "v1beta1",
+			args: []string{"daemonset", "nginx", "env=prod"},
+		},
+		{
+			name: "test appsv1beta2 daemonset",
+			object: &appsv1beta2.DaemonSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.DaemonSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"daemonset", "nginx", "env=prod"},
+		},
+		{
+			name: "test appsv1 daemonset",
+			object: &appsv1.DaemonSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.DaemonSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"daemonset", "nginx", "env=prod"},
+		},
+		{
+			name: "test extensions.v1beta1 deployment",
+			object: &extensionsv1beta1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: extensionsv1beta1.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "extensions", apiVersion: "v1beta1",
+			args: []string{"deployment", "nginx", "env=prod"},
+		},
+		{
+			name: "test appsv1bta1 deployment",
+			object: &appsv1beta1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta1.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta1",
+			args: []string{"deployment", "nginx", "env=prod"},
+		},
+		{
+			name: "test appsv1beta2n deployment",
+			object: &appsv1beta2.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"deployment", "nginx", "env=prod"},
+		},
+		{
+			name: "test appsv1 deployment",
+			object: &appsv1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"deployment", "nginx", "env=prod"},
+		},
+		{
+			name: "test appsv1beta1 statefulset",
+			object: &appsv1beta1.StatefulSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta1.StatefulSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "apps",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta1",
+			args: []string{"statefulset", "nginx", "env=prod"},
+		},
+		{
+			name: "test appsv1beta2 statefulset",
+			object: &appsv1beta2.StatefulSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.StatefulSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "apps",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"statefulset", "nginx", "env=prod"},
+		},
+		{
+			name: "test appsv1 statefulset",
+			object: &appsv1.StatefulSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.StatefulSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "apps",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"statefulset", "nginx", "env=prod"},
+		},
+		{
+			object: &batchv1.Job{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: batchv1.JobSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "batch",
+			apiPrefix:    "/apis", apiGroup: "batch", apiVersion: "v1",
+			args: []string{"job", "nginx", "env=prod"},
+		},
+		{
+			object: &v1.ReplicationController{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: v1.ReplicationControllerSpec{
+					Template: &v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "",
+			apiPrefix:    "/api", apiGroup: "", apiVersion: "v1",
+			args: []string{"replicationcontroller", "nginx", "env=prod"},
+		},
+	}
+	for _, input := range inputs {
+		t.Run(input.name, func(t *testing.T) {
+			groupVersion := schema.GroupVersion{Group: input.apiGroup, Version: input.apiVersion}
+			testapi.Default = testapi.Groups[input.testAPIGroup]
+			tf := cmdtesting.NewTestFactory().WithNamespace("test")
+			tf.ClientConfigVal = &restclient.Config{ContentConfig: restclient.ContentConfig{GroupVersion: &schema.GroupVersion{Version: ""}}}
+			defer tf.Cleanup()
+
+			tf.Client = &fake.RESTClient{
+				GroupVersion:         groupVersion,
+				NegotiatedSerializer: serializer.DirectCodecFactory{CodecFactory: scheme.Codecs},
+				Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+					resourcePath := testapi.Default.ResourcePath(input.args[0]+"s", "test", input.args[1])
+					switch p, m := req.URL.Path, req.Method; {
+					case p == resourcePath && m == http.MethodGet:
+						return &http.Response{StatusCode: http.StatusOK, Header: defaultHeader(), Body: objBody(input.object)}, nil
+					case p == resourcePath && m == http.MethodPatch:
+						stream, err := req.GetBody()
+						if err != nil {
+							return nil, err
+						}
+						bytes, err := ioutil.ReadAll(stream)
+						if err != nil {
+							return nil, err
+						}
+						assert.Contains(t, string(bytes), `"value":`+`"`+"prod"+`"`, fmt.Sprintf("env not updated for %#v", input.object))
+						return &http.Response{StatusCode: http.StatusOK, Header: defaultHeader(), Body: objBody(input.object)}, nil
+					default:
+						t.Errorf("%s: unexpected request: %s %#v\n%#v", "image", req.Method, req.URL, req)
+						return nil, fmt.Errorf("unexpected request")
+					}
+				}),
+				VersionedAPIPath: path.Join(input.apiPrefix, testapi.Default.GroupVersion().String()),
+			}
+
+			outputFormat := "yaml"
+			streams := genericclioptions.NewTestIOStreamsDiscard()
+			opts := NewEnvOptions(streams)
+			opts.PrintFlags = genericclioptions.NewPrintFlags("").WithDefaultOutput(outputFormat).WithTypeSetter(scheme.Scheme)
+			opts.Local = false
+			opts.IOStreams = streams
+			err := opts.Complete(tf, NewCmdEnv(tf, streams), input.args)
+			assert.NoError(t, err)
+			err = opts.RunEnv()
+			assert.NoError(t, err)
+		})
+	}
+}
+
+func TestSetEnvFromResource(t *testing.T) {
+	mockConfigMap := &v1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{Name: "testconfigmap"},
+		Data: map[string]string{
+			"env":          "prod",
+			"test-key":     "testValue",
+			"test-key-two": "testValueTwo",
+		},
+	}
+
+	mockSecret := &v1.Secret{
+		ObjectMeta: metav1.ObjectMeta{Name: "testsecret"},
+		Data: map[string][]byte{
+			"env":          []byte("prod"),
+			"test-key":     []byte("testValue"),
+			"test-key-two": []byte("testValueTwo"),
+		},
+	}
+
+	inputs := []struct {
+		name           string
+		args           []string
+		from           string
+		keys           []string
+		assertIncludes []string
+		assertExcludes []string
+	}{
+		{
+			name: "test from configmap",
+			args: []string{"deployment", "nginx"},
+			from: "configmap/testconfigmap",
+			keys: []string{},
+			assertIncludes: []string{
+				`{"name":"ENV","valueFrom":{"configMapKeyRef":{"key":"env","name":"testconfigmap"}}}`,
+				`{"name":"TEST_KEY","valueFrom":{"configMapKeyRef":{"key":"test-key","name":"testconfigmap"}}}`,
+				`{"name":"TEST_KEY_TWO","valueFrom":{"configMapKeyRef":{"key":"test-key-two","name":"testconfigmap"}}}`,
+			},
+			assertExcludes: []string{},
+		},
+		{
+			name: "test from secret",
+			args: []string{"deployment", "nginx"},
+			from: "secret/testsecret",
+			keys: []string{},
+			assertIncludes: []string{
+				`{"name":"ENV","valueFrom":{"secretKeyRef":{"key":"env","name":"testsecret"}}}`,
+				`{"name":"TEST_KEY","valueFrom":{"secretKeyRef":{"key":"test-key","name":"testsecret"}}}`,
+				`{"name":"TEST_KEY_TWO","valueFrom":{"secretKeyRef":{"key":"test-key-two","name":"testsecret"}}}`,
+			},
+			assertExcludes: []string{},
+		},
+		{
+			name: "test from configmap with keys",
+			args: []string{"deployment", "nginx"},
+			from: "configmap/testconfigmap",
+			keys: []string{"env", "test-key-two"},
+			assertIncludes: []string{
+				`{"name":"ENV","valueFrom":{"configMapKeyRef":{"key":"env","name":"testconfigmap"}}}`,
+				`{"name":"TEST_KEY_TWO","valueFrom":{"configMapKeyRef":{"key":"test-key-two","name":"testconfigmap"}}}`,
+			},
+			assertExcludes: []string{`{"name":"TEST_KEY","valueFrom":{"configMapKeyRef":{"key":"test-key","name":"testconfigmap"}}}`},
+		},
+		{
+			name: "test from secret with keys",
+			args: []string{"deployment", "nginx"},
+			from: "secret/testsecret",
+			keys: []string{"env", "test-key-two"},
+			assertIncludes: []string{
+				`{"name":"ENV","valueFrom":{"secretKeyRef":{"key":"env","name":"testsecret"}}}`,
+				`{"name":"TEST_KEY_TWO","valueFrom":{"secretKeyRef":{"key":"test-key-two","name":"testsecret"}}}`,
+			},
+			assertExcludes: []string{`{"name":"TEST_KEY","valueFrom":{"secretKeyRef":{"key":"test-key","name":"testsecret"}}}`},
+		},
+	}
+
+	for _, input := range inputs {
+		mockDeployment := &appsv1.Deployment{
+			ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+			Spec: appsv1.DeploymentSpec{
+				Template: v1.PodTemplateSpec{
+					Spec: v1.PodSpec{
+						Containers: []v1.Container{
+							{
+								Name:  "nginx",
+								Image: "nginx",
+							},
+						},
+					},
+				},
+			},
+		}
+		t.Run(input.name, func(t *testing.T) {
+			tf := cmdtesting.NewTestFactory().WithNamespace("test")
+			defer tf.Cleanup()
+
+			tf.ClientConfigVal = &restclient.Config{ContentConfig: restclient.ContentConfig{GroupVersion: &schema.GroupVersion{Version: ""}}}
+			tf.Client = &fake.RESTClient{
+				GroupVersion:         schema.GroupVersion{Group: "", Version: "v1"},
+				NegotiatedSerializer: serializer.DirectCodecFactory{CodecFactory: scheme.Codecs},
+				Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+					switch p, m := req.URL.Path, req.Method; {
+					case p == "/namespaces/test/configmaps/testconfigmap" && m == http.MethodGet:
+						return &http.Response{StatusCode: http.StatusOK, Header: defaultHeader(), Body: objBody(mockConfigMap)}, nil
+					case p == "/namespaces/test/secrets/testsecret" && m == http.MethodGet:
+						return &http.Response{StatusCode: http.StatusOK, Header: defaultHeader(), Body: objBody(mockSecret)}, nil
+					case p == "/namespaces/test/deployments/nginx" && m == http.MethodGet:
+						return &http.Response{StatusCode: http.StatusOK, Header: defaultHeader(), Body: objBody(mockDeployment)}, nil
+					case p == "/namespaces/test/deployments/nginx" && m == http.MethodPatch:
+						stream, err := req.GetBody()
+						if err != nil {
+							return nil, err
+						}
+						bytes, err := ioutil.ReadAll(stream)
+						if err != nil {
+							return nil, err
+						}
+						for _, include := range input.assertIncludes {
+							assert.Contains(t, string(bytes), include)
+						}
+						for _, exclude := range input.assertExcludes {
+							assert.NotContains(t, string(bytes), exclude)
+						}
+						return &http.Response{StatusCode: http.StatusOK, Header: defaultHeader(), Body: objBody(mockDeployment)}, nil
+					default:
+						t.Errorf("%s: unexpected request: %#v\n%#v", input.name, req.URL, req)
+						return nil, nil
+					}
+				}),
+			}
+
+			outputFormat := "yaml"
+			streams := genericclioptions.NewTestIOStreamsDiscard()
+			opts := NewEnvOptions(streams)
+			opts.From = input.from
+			opts.Keys = input.keys
+			opts.PrintFlags = genericclioptions.NewPrintFlags("").WithDefaultOutput(outputFormat).WithTypeSetter(scheme.Scheme)
+			opts.Local = false
+			opts.IOStreams = streams
+			err := opts.Complete(tf, NewCmdEnv(tf, streams), input.args)
+			assert.NoError(t, err)
+			err = opts.RunEnv()
+			assert.NoError(t, err)
+		})
+	}
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_image.go

@@ -0,0 +1,322 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"fmt"
+
+	"github.com/golang/glog"
+	"github.com/spf13/cobra"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+	"k8s.io/kubernetes/pkg/kubectl/cmd/templates"
+	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions/printers"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions/resource"
+	"k8s.io/kubernetes/pkg/kubectl/polymorphichelpers"
+	"k8s.io/kubernetes/pkg/kubectl/scheme"
+	"k8s.io/kubernetes/pkg/kubectl/util/i18n"
+)
+
+// ImageOptions is the start of the data required to perform the operation.  As new fields are added, add them here instead of
+// referencing the cmd.Flags()
+type SetImageOptions struct {
+	resource.FilenameOptions
+
+	PrintFlags  *genericclioptions.PrintFlags
+	RecordFlags *genericclioptions.RecordFlags
+
+	Infos        []*resource.Info
+	Selector     string
+	DryRun       bool
+	All          bool
+	Output       string
+	Local        bool
+	ResolveImage ImageResolver
+
+	PrintObj printers.ResourcePrinterFunc
+	Recorder genericclioptions.Recorder
+
+	UpdatePodSpecForObject polymorphichelpers.UpdatePodSpecForObjectFunc
+	Resources              []string
+	ContainerImages        map[string]string
+
+	genericclioptions.IOStreams
+}
+
+var (
+	image_resources = `
+  	pod (po), replicationcontroller (rc), deployment (deploy), daemonset (ds), replicaset (rs)`
+
+	image_long = templates.LongDesc(`
+		Update existing container image(s) of resources.
+
+		Possible resources include (case insensitive):
+		` + image_resources)
+
+	image_example = templates.Examples(`
+		# Set a deployment's nginx container image to 'nginx:1.9.1', and its busybox container image to 'busybox'.
+		kubectl set image deployment/nginx busybox=busybox nginx=nginx:1.9.1
+
+		# Update all deployments' and rc's nginx container's image to 'nginx:1.9.1'
+		kubectl set image deployments,rc nginx=nginx:1.9.1 --all
+
+		# Update image of all containers of daemonset abc to 'nginx:1.9.1'
+		kubectl set image daemonset abc *=nginx:1.9.1
+
+		# Print result (in yaml format) of updating nginx container image from local file, without hitting the server
+		kubectl set image -f path/to/file.yaml nginx=nginx:1.9.1 --local -o yaml`)
+)
+
+func NewImageOptions(streams genericclioptions.IOStreams) *SetImageOptions {
+	return &SetImageOptions{
+		PrintFlags:  genericclioptions.NewPrintFlags("image updated").WithTypeSetter(scheme.Scheme),
+		RecordFlags: genericclioptions.NewRecordFlags(),
+
+		Recorder: genericclioptions.NoopRecorder{},
+
+		IOStreams: streams,
+	}
+}
+
+func NewCmdImage(f cmdutil.Factory, streams genericclioptions.IOStreams) *cobra.Command {
+	o := NewImageOptions(streams)
+
+	cmd := &cobra.Command{
+		Use: "image (-f FILENAME | TYPE NAME) CONTAINER_NAME_1=CONTAINER_IMAGE_1 ... CONTAINER_NAME_N=CONTAINER_IMAGE_N",
+		DisableFlagsInUseLine: true,
+		Short:   i18n.T("Update image of a pod template"),
+		Long:    image_long,
+		Example: image_example,
+		Run: func(cmd *cobra.Command, args []string) {
+			cmdutil.CheckErr(o.Complete(f, cmd, args))
+			cmdutil.CheckErr(o.Validate())
+			cmdutil.CheckErr(o.Run())
+		},
+	}
+
+	o.PrintFlags.AddFlags(cmd)
+	o.RecordFlags.AddFlags(cmd)
+
+	usage := "identifying the resource to get from a server."
+	cmdutil.AddFilenameOptionFlags(cmd, &o.FilenameOptions, usage)
+	cmd.Flags().BoolVar(&o.All, "all", o.All, "Select all resources, including uninitialized ones, in the namespace of the specified resource types")
+	cmd.Flags().StringVarP(&o.Selector, "selector", "l", o.Selector, "Selector (label query) to filter on, not including uninitialized ones, supports '=', '==', and '!='.(e.g. -l key1=value1,key2=value2)")
+	cmd.Flags().BoolVar(&o.Local, "local", o.Local, "If true, set image will NOT contact api-server but run locally.")
+	cmdutil.AddDryRunFlag(cmd)
+	cmdutil.AddIncludeUninitializedFlag(cmd)
+	return cmd
+}
+
+func (o *SetImageOptions) Complete(f cmdutil.Factory, cmd *cobra.Command, args []string) error {
+	var err error
+
+	o.RecordFlags.Complete(cmd)
+	o.Recorder, err = o.RecordFlags.ToRecorder()
+	if err != nil {
+		return err
+	}
+
+	o.UpdatePodSpecForObject = polymorphichelpers.UpdatePodSpecForObjectFn
+	o.DryRun = cmdutil.GetDryRunFlag(cmd)
+	o.Output = cmdutil.GetFlagString(cmd, "output")
+	o.ResolveImage = resolveImageFunc
+
+	if o.DryRun {
+		o.PrintFlags.Complete("%s (dry run)")
+	}
+	printer, err := o.PrintFlags.ToPrinter()
+	if err != nil {
+		return err
+	}
+
+	o.PrintObj = printer.PrintObj
+
+	cmdNamespace, enforceNamespace, err := f.ToRawKubeConfigLoader().Namespace()
+	if err != nil {
+		return err
+	}
+
+	o.Resources, o.ContainerImages, err = getResourcesAndImages(args)
+	if err != nil {
+		return err
+	}
+
+	includeUninitialized := cmdutil.ShouldIncludeUninitialized(cmd, false)
+	builder := f.NewBuilder().
+		WithScheme(scheme.Scheme, scheme.Scheme.PrioritizedVersionsAllGroups()...).
+		LocalParam(o.Local).
+		ContinueOnError().
+		NamespaceParam(cmdNamespace).DefaultNamespace().
+		FilenameParam(enforceNamespace, &o.FilenameOptions).
+		IncludeUninitialized(includeUninitialized).
+		Flatten()
+
+	if !o.Local {
+		builder.LabelSelectorParam(o.Selector).
+			ResourceTypeOrNameArgs(o.All, o.Resources...).
+			Latest()
+	} else {
+		// if a --local flag was provided, and a resource was specified in the form
+		// <resource>/<name>, fail immediately as --local cannot query the api server
+		// for the specified resource.
+		if len(o.Resources) > 0 {
+			return resource.LocalResourceError
+		}
+	}
+
+	o.Infos, err = builder.Do().Infos()
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (o *SetImageOptions) Validate() error {
+	errors := []error{}
+	if o.All && len(o.Selector) > 0 {
+		errors = append(errors, fmt.Errorf("cannot set --all and --selector at the same time"))
+	}
+	if len(o.Resources) < 1 && cmdutil.IsFilenameSliceEmpty(o.Filenames) {
+		errors = append(errors, fmt.Errorf("one or more resources must be specified as <resource> <name> or <resource>/<name>"))
+	}
+	if len(o.ContainerImages) < 1 {
+		errors = append(errors, fmt.Errorf("at least one image update is required"))
+	} else if len(o.ContainerImages) > 1 && hasWildcardKey(o.ContainerImages) {
+		errors = append(errors, fmt.Errorf("all containers are already specified by *, but saw more than one container_name=container_image pairs"))
+	}
+	return utilerrors.NewAggregate(errors)
+}
+
+func (o *SetImageOptions) Run() error {
+	allErrs := []error{}
+
+	patches := CalculatePatches(o.Infos, scheme.DefaultJSONEncoder(), func(obj runtime.Object) ([]byte, error) {
+		transformed := false
+		_, err := o.UpdatePodSpecForObject(obj, func(spec *v1.PodSpec) error {
+			for name, image := range o.ContainerImages {
+				var (
+					containerFound bool
+					err            error
+					resolved       string
+				)
+				// Find the container to update, and update its image
+				for i, c := range spec.Containers {
+					if c.Name == name || name == "*" {
+						containerFound = true
+						if len(resolved) == 0 {
+							if resolved, err = o.ResolveImage(image); err != nil {
+								allErrs = append(allErrs, fmt.Errorf("error: unable to resolve image %q for container %q: %v", image, name, err))
+								// Do not loop again if the image resolving failed for wildcard case as we
+								// will report the same error again for the next container.
+								if name == "*" {
+									break
+								}
+								continue
+							}
+						}
+						if spec.Containers[i].Image != resolved {
+							spec.Containers[i].Image = resolved
+							// Perform updates
+							transformed = true
+						}
+					}
+				}
+				// Add a new container if not found
+				if !containerFound {
+					allErrs = append(allErrs, fmt.Errorf("error: unable to find container named %q", name))
+				}
+			}
+			return nil
+		})
+		if err != nil {
+			return nil, err
+		}
+		if !transformed {
+			return nil, nil
+		}
+		// record this change (for rollout history)
+		if err := o.Recorder.Record(obj); err != nil {
+			glog.V(4).Infof("error recording current command: %v", err)
+		}
+
+		return runtime.Encode(scheme.DefaultJSONEncoder(), obj)
+	})
+
+	for _, patch := range patches {
+		info := patch.Info
+		if patch.Err != nil {
+			allErrs = append(allErrs, fmt.Errorf("error: %s/%s %v\n", info.Mapping.Resource, info.Name, patch.Err))
+			continue
+		}
+
+		// no changes
+		if string(patch.Patch) == "{}" || len(patch.Patch) == 0 {
+			continue
+		}
+
+		if o.Local || o.DryRun {
+			if err := o.PrintObj(info.Object, o.Out); err != nil {
+				allErrs = append(allErrs, err)
+			}
+			continue
+		}
+
+		// patch the change
+		actual, err := resource.NewHelper(info.Client, info.Mapping).Patch(info.Namespace, info.Name, types.StrategicMergePatchType, patch.Patch)
+		if err != nil {
+			allErrs = append(allErrs, fmt.Errorf("failed to patch image update to pod template: %v\n", err))
+			continue
+		}
+
+		if err := o.PrintObj(actual, o.Out); err != nil {
+			allErrs = append(allErrs, err)
+		}
+	}
+	return utilerrors.NewAggregate(allErrs)
+}
+
+// getResourcesAndImages retrieves resources and container name:images pair from given args
+func getResourcesAndImages(args []string) (resources []string, containerImages map[string]string, err error) {
+	pairType := "image"
+	resources, imageArgs, err := cmdutil.GetResourcesAndPairs(args, pairType)
+	if err != nil {
+		return
+	}
+	containerImages, _, err = cmdutil.ParsePairs(imageArgs, pairType, false)
+	return
+}
+
+func hasWildcardKey(containerImages map[string]string) bool {
+	_, ok := containerImages["*"]
+	return ok
+}
+
+// ImageResolver is a func that receives an image name, and
+// resolves it to an appropriate / compatible image name.
+// Adds flexibility for future image resolving methods.
+type ImageResolver func(in string) (string, error)
+
+// implements ImageResolver
+func resolveImageFunc(in string) (string, error) {
+	return in, nil
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_image_test.go

@@ -0,0 +1,580 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"path"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	appsv1 "k8s.io/api/apps/v1"
+	appsv1beta1 "k8s.io/api/apps/v1beta1"
+	appsv1beta2 "k8s.io/api/apps/v1beta2"
+	batchv1 "k8s.io/api/batch/v1"
+	"k8s.io/api/core/v1"
+	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/client-go/rest/fake"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	cmdtesting "k8s.io/kubernetes/pkg/kubectl/cmd/testing"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions/resource"
+	"k8s.io/kubernetes/pkg/kubectl/scheme"
+)
+
+func TestImageLocal(t *testing.T) {
+	tf := cmdtesting.NewTestFactory().WithNamespace("test")
+	defer tf.Cleanup()
+
+	tf.Client = &fake.RESTClient{
+		GroupVersion:         schema.GroupVersion{Version: ""},
+		NegotiatedSerializer: serializer.DirectCodecFactory{CodecFactory: scheme.Codecs},
+		Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+			t.Fatalf("unexpected request: %s %#v\n%#v", req.Method, req.URL, req)
+			return nil, nil
+		}),
+	}
+	tf.ClientConfigVal = &restclient.Config{ContentConfig: restclient.ContentConfig{GroupVersion: &schema.GroupVersion{Version: ""}}}
+
+	outputFormat := "name"
+
+	streams, _, buf, _ := genericclioptions.NewTestIOStreams()
+	cmd := NewCmdImage(tf, streams)
+	cmd.SetOutput(buf)
+	cmd.Flags().Set("output", outputFormat)
+	cmd.Flags().Set("local", "true")
+
+	opts := SetImageOptions{
+		PrintFlags: genericclioptions.NewPrintFlags("").WithDefaultOutput(outputFormat).WithTypeSetter(scheme.Scheme),
+		FilenameOptions: resource.FilenameOptions{
+			Filenames: []string{"../../../../test/e2e/testing-manifests/statefulset/cassandra/controller.yaml"}},
+		Local:     true,
+		IOStreams: streams,
+	}
+	err := opts.Complete(tf, cmd, []string{"cassandra=thingy"})
+	if err == nil {
+		err = opts.Validate()
+	}
+	if err == nil {
+		err = opts.Run()
+	}
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !strings.Contains(buf.String(), "replicationcontroller/cassandra") {
+		t.Errorf("did not set image: %s", buf.String())
+	}
+}
+
+func TestSetImageValidation(t *testing.T) {
+	printFlags := genericclioptions.NewPrintFlags("").WithTypeSetter(scheme.Scheme)
+
+	testCases := []struct {
+		name         string
+		imageOptions *SetImageOptions
+		expectErr    string
+	}{
+		{
+			name:         "test resource < 1 and filenames empty",
+			imageOptions: &SetImageOptions{PrintFlags: printFlags},
+			expectErr:    "[one or more resources must be specified as <resource> <name> or <resource>/<name>, at least one image update is required]",
+		},
+		{
+			name: "test containerImages < 1",
+			imageOptions: &SetImageOptions{
+				PrintFlags: printFlags,
+				Resources:  []string{"a", "b", "c"},
+
+				FilenameOptions: resource.FilenameOptions{
+					Filenames: []string{"testFile"},
+				},
+			},
+			expectErr: "at least one image update is required",
+		},
+		{
+			name: "test containerImages > 1 and all containers are already specified by *",
+			imageOptions: &SetImageOptions{
+				PrintFlags: printFlags,
+				Resources:  []string{"a", "b", "c"},
+				FilenameOptions: resource.FilenameOptions{
+					Filenames: []string{"testFile"},
+				},
+				ContainerImages: map[string]string{
+					"test": "test",
+					"*":    "test",
+				},
+			},
+			expectErr: "all containers are already specified by *, but saw more than one container_name=container_image pairs",
+		},
+		{
+			name: "success case",
+			imageOptions: &SetImageOptions{
+				PrintFlags: printFlags,
+				Resources:  []string{"a", "b", "c"},
+				FilenameOptions: resource.FilenameOptions{
+					Filenames: []string{"testFile"},
+				},
+				ContainerImages: map[string]string{
+					"test": "test",
+				},
+			},
+			expectErr: "",
+		},
+	}
+	for _, testCase := range testCases {
+		err := testCase.imageOptions.Validate()
+		if err != nil {
+			if err.Error() != testCase.expectErr {
+				t.Errorf("[%s]:expect err:%s got err:%s", testCase.name, testCase.expectErr, err.Error())
+			}
+		}
+		if err == nil && (testCase.expectErr != "") {
+			t.Errorf("[%s]:expect err:%s got err:%v", testCase.name, testCase.expectErr, err)
+		}
+	}
+}
+
+func TestSetMultiResourcesImageLocal(t *testing.T) {
+	tf := cmdtesting.NewTestFactory().WithNamespace("test")
+	defer tf.Cleanup()
+
+	tf.Client = &fake.RESTClient{
+		GroupVersion:         schema.GroupVersion{Version: ""},
+		NegotiatedSerializer: serializer.DirectCodecFactory{CodecFactory: scheme.Codecs},
+		Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+			t.Fatalf("unexpected request: %s %#v\n%#v", req.Method, req.URL, req)
+			return nil, nil
+		}),
+	}
+	tf.ClientConfigVal = &restclient.Config{ContentConfig: restclient.ContentConfig{GroupVersion: &schema.GroupVersion{Version: ""}}}
+
+	outputFormat := "name"
+
+	streams, _, buf, _ := genericclioptions.NewTestIOStreams()
+	cmd := NewCmdImage(tf, streams)
+	cmd.SetOutput(buf)
+	cmd.Flags().Set("output", outputFormat)
+	cmd.Flags().Set("local", "true")
+
+	opts := SetImageOptions{
+		PrintFlags: genericclioptions.NewPrintFlags("").WithDefaultOutput(outputFormat).WithTypeSetter(scheme.Scheme),
+		FilenameOptions: resource.FilenameOptions{
+			Filenames: []string{"../../../../test/fixtures/pkg/kubectl/cmd/set/multi-resource-yaml.yaml"}},
+		Local:     true,
+		IOStreams: streams,
+	}
+	err := opts.Complete(tf, cmd, []string{"*=thingy"})
+	if err == nil {
+		err = opts.Validate()
+	}
+	if err == nil {
+		err = opts.Run()
+	}
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	expectedOut := "replicationcontroller/first-rc\nreplicationcontroller/second-rc\n"
+	if buf.String() != expectedOut {
+		t.Errorf("expected out:\n%s\nbut got:\n%s", expectedOut, buf.String())
+	}
+}
+
+func TestSetImageRemote(t *testing.T) {
+	inputs := []struct {
+		name                            string
+		object                          runtime.Object
+		apiPrefix, apiGroup, apiVersion string
+		testAPIGroup                    string
+		args                            []string
+	}{
+		{
+			name: "set image extensionsv1beta1 ReplicaSet",
+			object: &extensionsv1beta1.ReplicaSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: extensionsv1beta1.ReplicaSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "extensions", apiVersion: "v1beta1",
+			args: []string{"replicaset", "nginx", "*=thingy"},
+		},
+		{
+			name: "set image appsv1beta2 ReplicaSet",
+			object: &appsv1beta2.ReplicaSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.ReplicaSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"replicaset", "nginx", "*=thingy"},
+		},
+		{
+			name: "set image appsv1 ReplicaSet",
+			object: &appsv1.ReplicaSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.ReplicaSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"replicaset", "nginx", "*=thingy"},
+		},
+		{
+			name: "set image extensionsv1beta1 DaemonSet",
+			object: &extensionsv1beta1.DaemonSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: extensionsv1beta1.DaemonSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "extensions", apiVersion: "v1beta1",
+			args: []string{"daemonset", "nginx", "*=thingy"},
+		},
+		{
+			name: "set image appsv1beta2 DaemonSet",
+			object: &appsv1beta2.DaemonSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.DaemonSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"daemonset", "nginx", "*=thingy"},
+		},
+		{
+			name: "set image appsv1 DaemonSet",
+			object: &appsv1.DaemonSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.DaemonSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"daemonset", "nginx", "*=thingy"},
+		},
+		{
+			name: "set image extensionsv1beta1 Deployment",
+			object: &extensionsv1beta1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: extensionsv1beta1.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "extensions", apiVersion: "v1beta1",
+			args: []string{"deployment", "nginx", "*=thingy"},
+		},
+		{
+			name: "set image appsv1beta1 Deployment",
+			object: &appsv1beta1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta1.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta1",
+			args: []string{"deployment", "nginx", "*=thingy"},
+		},
+		{
+			name: "set image appsv1beta2 Deployment",
+			object: &appsv1beta2.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"deployment", "nginx", "*=thingy"},
+		},
+		{
+			name: "set image appsv1 Deployment",
+			object: &appsv1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"deployment", "nginx", "*=thingy"},
+		},
+		{
+			name: "set image appsv1beta1 StatefulSet",
+			object: &appsv1beta1.StatefulSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta1.StatefulSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "apps",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta1",
+			args: []string{"statefulset", "nginx", "*=thingy"},
+		},
+		{
+			name: "set image appsv1beta2 StatefulSet",
+			object: &appsv1beta2.StatefulSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.StatefulSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "apps",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"statefulset", "nginx", "*=thingy"},
+		},
+		{
+			name: "set image appsv1 StatefulSet",
+			object: &appsv1.StatefulSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.StatefulSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "apps",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"statefulset", "nginx", "*=thingy"},
+		},
+		{
+			name: "set image batchv1 Job",
+			object: &batchv1.Job{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: batchv1.JobSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "batch",
+			apiPrefix:    "/apis", apiGroup: "batch", apiVersion: "v1",
+			args: []string{"job", "nginx", "*=thingy"},
+		},
+		{
+			name: "set image v1.ReplicationController",
+			object: &v1.ReplicationController{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: v1.ReplicationControllerSpec{
+					Template: &v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "",
+			apiPrefix:    "/api", apiGroup: "", apiVersion: "v1",
+			args: []string{"replicationcontroller", "nginx", "*=thingy"},
+		},
+	}
+	for _, input := range inputs {
+		t.Run(input.name, func(t *testing.T) {
+			groupVersion := schema.GroupVersion{Group: input.apiGroup, Version: input.apiVersion}
+			testapi.Default = testapi.Groups[input.testAPIGroup]
+			tf := cmdtesting.NewTestFactory().WithNamespace("test")
+			defer tf.Cleanup()
+
+			tf.Client = &fake.RESTClient{
+				GroupVersion:         groupVersion,
+				NegotiatedSerializer: serializer.DirectCodecFactory{CodecFactory: scheme.Codecs},
+				Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+					resourcePath := testapi.Default.ResourcePath(input.args[0]+"s", "test", input.args[1])
+					switch p, m := req.URL.Path, req.Method; {
+					case p == resourcePath && m == http.MethodGet:
+						return &http.Response{StatusCode: http.StatusOK, Header: defaultHeader(), Body: objBody(input.object)}, nil
+					case p == resourcePath && m == http.MethodPatch:
+						stream, err := req.GetBody()
+						if err != nil {
+							return nil, err
+						}
+						bytes, err := ioutil.ReadAll(stream)
+						if err != nil {
+							return nil, err
+						}
+						assert.Contains(t, string(bytes), `"image":`+`"`+"thingy"+`"`, fmt.Sprintf("image not updated for %#v", input.object))
+						return &http.Response{StatusCode: http.StatusOK, Header: defaultHeader(), Body: objBody(input.object)}, nil
+					default:
+						t.Errorf("%s: unexpected request: %s %#v\n%#v", "image", req.Method, req.URL, req)
+						return nil, fmt.Errorf("unexpected request")
+					}
+				}),
+				VersionedAPIPath: path.Join(input.apiPrefix, testapi.Default.GroupVersion().String()),
+			}
+
+			outputFormat := "yaml"
+
+			streams := genericclioptions.NewTestIOStreamsDiscard()
+			cmd := NewCmdImage(tf, streams)
+			cmd.Flags().Set("output", outputFormat)
+			opts := SetImageOptions{
+				PrintFlags: genericclioptions.NewPrintFlags("").WithDefaultOutput(outputFormat).WithTypeSetter(scheme.Scheme),
+
+				Local:     false,
+				IOStreams: streams,
+			}
+			err := opts.Complete(tf, cmd, input.args)
+			assert.NoError(t, err)
+			err = opts.Run()
+			assert.NoError(t, err)
+		})
+	}
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_resources.go

@@ -0,0 +1,290 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"fmt"
+
+	"github.com/golang/glog"
+	"github.com/spf13/cobra"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+	"k8s.io/kubernetes/pkg/kubectl"
+	"k8s.io/kubernetes/pkg/kubectl/cmd/templates"
+	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions/printers"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions/resource"
+	"k8s.io/kubernetes/pkg/kubectl/polymorphichelpers"
+	"k8s.io/kubernetes/pkg/kubectl/scheme"
+	"k8s.io/kubernetes/pkg/kubectl/util/i18n"
+)
+
+var (
+	resources_long = templates.LongDesc(`
+		Specify compute resource requirements (cpu, memory) for any resource that defines a pod template.  If a pod is successfully scheduled, it is guaranteed the amount of resource requested, but may burst up to its specified limits.
+
+		for each compute resource, if a limit is specified and a request is omitted, the request will default to the limit.
+
+		Possible resources include (case insensitive): %s.`)
+
+	resources_example = templates.Examples(`
+		# Set a deployments nginx container cpu limits to "200m" and memory to "512Mi"
+		kubectl set resources deployment nginx -c=nginx --limits=cpu=200m,memory=512Mi
+
+		# Set the resource request and limits for all containers in nginx
+		kubectl set resources deployment nginx --limits=cpu=200m,memory=512Mi --requests=cpu=100m,memory=256Mi
+
+		# Remove the resource requests for resources on containers in nginx
+		kubectl set resources deployment nginx --limits=cpu=0,memory=0 --requests=cpu=0,memory=0
+
+		# Print the result (in yaml format) of updating nginx container limits from a local, without hitting the server
+		kubectl set resources -f path/to/file.yaml --limits=cpu=200m,memory=512Mi --local -o yaml`)
+)
+
+// ResourcesOptions is the start of the data required to perform the operation. As new fields are added, add them here instead of
+// referencing the cmd.Flags
+type SetResourcesOptions struct {
+	resource.FilenameOptions
+
+	PrintFlags  *genericclioptions.PrintFlags
+	RecordFlags *genericclioptions.RecordFlags
+
+	Infos             []*resource.Info
+	Selector          string
+	ContainerSelector string
+	Output            string
+	All               bool
+	Local             bool
+
+	DryRun bool
+
+	PrintObj printers.ResourcePrinterFunc
+	Recorder genericclioptions.Recorder
+
+	Limits               string
+	Requests             string
+	ResourceRequirements v1.ResourceRequirements
+
+	UpdatePodSpecForObject polymorphichelpers.UpdatePodSpecForObjectFunc
+	Resources              []string
+
+	genericclioptions.IOStreams
+}
+
+// NewResourcesOptions returns a ResourcesOptions indicating all containers in the selected
+// pod templates are selected by default.
+func NewResourcesOptions(streams genericclioptions.IOStreams) *SetResourcesOptions {
+	return &SetResourcesOptions{
+		PrintFlags:  genericclioptions.NewPrintFlags("resource requirements updated").WithTypeSetter(scheme.Scheme),
+		RecordFlags: genericclioptions.NewRecordFlags(),
+
+		Recorder: genericclioptions.NoopRecorder{},
+
+		ContainerSelector: "*",
+
+		IOStreams: streams,
+	}
+}
+
+func NewCmdResources(f cmdutil.Factory, streams genericclioptions.IOStreams) *cobra.Command {
+	o := NewResourcesOptions(streams)
+
+	cmd := &cobra.Command{
+		Use: "resources (-f FILENAME | TYPE NAME)  ([--limits=LIMITS & --requests=REQUESTS]",
+		DisableFlagsInUseLine: true,
+		Short:   i18n.T("Update resource requests/limits on objects with pod templates"),
+		Long:    fmt.Sprintf(resources_long, cmdutil.SuggestApiResources("kubectl")),
+		Example: resources_example,
+		Run: func(cmd *cobra.Command, args []string) {
+			cmdutil.CheckErr(o.Complete(f, cmd, args))
+			cmdutil.CheckErr(o.Validate())
+			cmdutil.CheckErr(o.Run())
+		},
+	}
+
+	o.PrintFlags.AddFlags(cmd)
+	o.RecordFlags.AddFlags(cmd)
+
+	//usage := "Filename, directory, or URL to a file identifying the resource to get from the server"
+	//kubectl.AddJsonFilenameFlag(cmd, &options.Filenames, usage)
+	usage := "identifying the resource to get from a server."
+	cmdutil.AddFilenameOptionFlags(cmd, &o.FilenameOptions, usage)
+	cmd.Flags().BoolVar(&o.All, "all", o.All, "Select all resources, including uninitialized ones, in the namespace of the specified resource types")
+	cmd.Flags().StringVarP(&o.Selector, "selector", "l", o.Selector, "Selector (label query) to filter on, not including uninitialized ones,supports '=', '==', and '!='.(e.g. -l key1=value1,key2=value2)")
+	cmd.Flags().StringVarP(&o.ContainerSelector, "containers", "c", o.ContainerSelector, "The names of containers in the selected pod templates to change, all containers are selected by default - may use wildcards")
+	cmd.Flags().BoolVar(&o.Local, "local", o.Local, "If true, set resources will NOT contact api-server but run locally.")
+	cmdutil.AddDryRunFlag(cmd)
+	cmdutil.AddIncludeUninitializedFlag(cmd)
+	cmd.Flags().StringVar(&o.Limits, "limits", o.Limits, "The resource requirement requests for this container.  For example, 'cpu=100m,memory=256Mi'.  Note that server side components may assign requests depending on the server configuration, such as limit ranges.")
+	cmd.Flags().StringVar(&o.Requests, "requests", o.Requests, "The resource requirement requests for this container.  For example, 'cpu=100m,memory=256Mi'.  Note that server side components may assign requests depending on the server configuration, such as limit ranges.")
+	return cmd
+}
+
+func (o *SetResourcesOptions) Complete(f cmdutil.Factory, cmd *cobra.Command, args []string) error {
+	var err error
+
+	o.RecordFlags.Complete(cmd)
+	o.Recorder, err = o.RecordFlags.ToRecorder()
+	if err != nil {
+		return err
+	}
+
+	o.UpdatePodSpecForObject = polymorphichelpers.UpdatePodSpecForObjectFn
+	o.Output = cmdutil.GetFlagString(cmd, "output")
+	o.DryRun = cmdutil.GetDryRunFlag(cmd)
+
+	if o.DryRun {
+		o.PrintFlags.Complete("%s (dry run)")
+	}
+	printer, err := o.PrintFlags.ToPrinter()
+	if err != nil {
+		return err
+	}
+	o.PrintObj = printer.PrintObj
+
+	cmdNamespace, enforceNamespace, err := f.ToRawKubeConfigLoader().Namespace()
+	if err != nil {
+		return err
+	}
+
+	includeUninitialized := cmdutil.ShouldIncludeUninitialized(cmd, false)
+	builder := f.NewBuilder().
+		WithScheme(scheme.Scheme, scheme.Scheme.PrioritizedVersionsAllGroups()...).
+		LocalParam(o.Local).
+		ContinueOnError().
+		NamespaceParam(cmdNamespace).DefaultNamespace().
+		FilenameParam(enforceNamespace, &o.FilenameOptions).
+		IncludeUninitialized(includeUninitialized).
+		Flatten()
+
+	if !o.Local {
+		builder.LabelSelectorParam(o.Selector).
+			ResourceTypeOrNameArgs(o.All, args...).
+			Latest()
+	} else {
+		// if a --local flag was provided, and a resource was specified in the form
+		// <resource>/<name>, fail immediately as --local cannot query the api server
+		// for the specified resource.
+		// TODO: this should be in the builder - if someone specifies tuples, fail when
+		// local is true
+		if len(args) > 0 {
+			return resource.LocalResourceError
+		}
+	}
+
+	o.Infos, err = builder.Do().Infos()
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func (o *SetResourcesOptions) Validate() error {
+	var err error
+	if o.All && len(o.Selector) > 0 {
+		return fmt.Errorf("cannot set --all and --selector at the same time")
+	}
+	if len(o.Limits) == 0 && len(o.Requests) == 0 {
+		return fmt.Errorf("you must specify an update to requests or limits (in the form of --requests/--limits)")
+	}
+
+	o.ResourceRequirements, err = kubectl.HandleResourceRequirementsV1(map[string]string{"limits": o.Limits, "requests": o.Requests})
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (o *SetResourcesOptions) Run() error {
+	allErrs := []error{}
+	patches := CalculatePatches(o.Infos, scheme.DefaultJSONEncoder(), func(obj runtime.Object) ([]byte, error) {
+		transformed := false
+		_, err := o.UpdatePodSpecForObject(obj, func(spec *v1.PodSpec) error {
+			containers, _ := selectContainers(spec.Containers, o.ContainerSelector)
+			if len(containers) != 0 {
+				for i := range containers {
+					if len(o.Limits) != 0 && len(containers[i].Resources.Limits) == 0 {
+						containers[i].Resources.Limits = make(v1.ResourceList)
+					}
+					for key, value := range o.ResourceRequirements.Limits {
+						containers[i].Resources.Limits[key] = value
+					}
+
+					if len(o.Requests) != 0 && len(containers[i].Resources.Requests) == 0 {
+						containers[i].Resources.Requests = make(v1.ResourceList)
+					}
+					for key, value := range o.ResourceRequirements.Requests {
+						containers[i].Resources.Requests[key] = value
+					}
+					transformed = true
+				}
+			} else {
+				allErrs = append(allErrs, fmt.Errorf("error: unable to find container named %s", o.ContainerSelector))
+			}
+			return nil
+		})
+		if err != nil {
+			return nil, err
+		}
+		if !transformed {
+			return nil, nil
+		}
+		// record this change (for rollout history)
+		if err := o.Recorder.Record(obj); err != nil {
+			glog.V(4).Infof("error recording current command: %v", err)
+		}
+
+		return runtime.Encode(scheme.DefaultJSONEncoder(), obj)
+	})
+
+	for _, patch := range patches {
+		info := patch.Info
+		if patch.Err != nil {
+			allErrs = append(allErrs, fmt.Errorf("error: %s/%s %v\n", info.Mapping.Resource, info.Name, patch.Err))
+			continue
+		}
+
+		//no changes
+		if string(patch.Patch) == "{}" || len(patch.Patch) == 0 {
+			allErrs = append(allErrs, fmt.Errorf("info: %s %q was not changed\n", info.Mapping.Resource, info.Name))
+			continue
+		}
+
+		if o.Local || o.DryRun {
+			if err := o.PrintObj(info.Object, o.Out); err != nil {
+				allErrs = append(allErrs, err)
+			}
+			continue
+		}
+
+		actual, err := resource.NewHelper(info.Client, info.Mapping).Patch(info.Namespace, info.Name, types.StrategicMergePatchType, patch.Patch)
+		if err != nil {
+			allErrs = append(allErrs, fmt.Errorf("failed to patch limit update to pod template %v\n", err))
+			continue
+		}
+
+		if err := o.PrintObj(actual, o.Out); err != nil {
+			allErrs = append(allErrs, err)
+		}
+	}
+	return utilerrors.NewAggregate(allErrs)
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_resources_test.go

@@ -0,0 +1,508 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"path"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	appsv1 "k8s.io/api/apps/v1"
+	appsv1beta1 "k8s.io/api/apps/v1beta1"
+	appsv1beta2 "k8s.io/api/apps/v1beta2"
+	batchv1 "k8s.io/api/batch/v1"
+	"k8s.io/api/core/v1"
+	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/client-go/rest/fake"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	cmdtesting "k8s.io/kubernetes/pkg/kubectl/cmd/testing"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions/resource"
+	"k8s.io/kubernetes/pkg/kubectl/scheme"
+)
+
+func TestResourcesLocal(t *testing.T) {
+	tf := cmdtesting.NewTestFactory().WithNamespace("test")
+	defer tf.Cleanup()
+
+	tf.Client = &fake.RESTClient{
+		GroupVersion:         schema.GroupVersion{Version: ""},
+		NegotiatedSerializer: serializer.DirectCodecFactory{CodecFactory: scheme.Codecs},
+		Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+			t.Fatalf("unexpected request: %s %#v\n%#v", req.Method, req.URL, req)
+			return nil, nil
+		}),
+	}
+	tf.ClientConfigVal = &restclient.Config{ContentConfig: restclient.ContentConfig{GroupVersion: &schema.GroupVersion{Version: ""}}}
+
+	outputFormat := "name"
+
+	streams, _, buf, _ := genericclioptions.NewTestIOStreams()
+	cmd := NewCmdResources(tf, streams)
+	cmd.SetOutput(buf)
+	cmd.Flags().Set("output", outputFormat)
+	cmd.Flags().Set("local", "true")
+
+	opts := SetResourcesOptions{
+		PrintFlags: genericclioptions.NewPrintFlags("").WithDefaultOutput(outputFormat).WithTypeSetter(scheme.Scheme),
+		FilenameOptions: resource.FilenameOptions{
+			Filenames: []string{"../../../../test/e2e/testing-manifests/statefulset/cassandra/controller.yaml"}},
+		Local:             true,
+		Limits:            "cpu=200m,memory=512Mi",
+		Requests:          "cpu=200m,memory=512Mi",
+		ContainerSelector: "*",
+		IOStreams:         streams,
+	}
+
+	err := opts.Complete(tf, cmd, []string{})
+	if err == nil {
+		err = opts.Validate()
+	}
+	if err == nil {
+		err = opts.Run()
+	}
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !strings.Contains(buf.String(), "replicationcontroller/cassandra") {
+		t.Errorf("did not set resources: %s", buf.String())
+	}
+}
+
+func TestSetMultiResourcesLimitsLocal(t *testing.T) {
+	tf := cmdtesting.NewTestFactory().WithNamespace("test")
+	defer tf.Cleanup()
+
+	tf.Client = &fake.RESTClient{
+		GroupVersion:         schema.GroupVersion{Version: ""},
+		NegotiatedSerializer: serializer.DirectCodecFactory{CodecFactory: scheme.Codecs},
+		Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+			t.Fatalf("unexpected request: %s %#v\n%#v", req.Method, req.URL, req)
+			return nil, nil
+		}),
+	}
+	tf.ClientConfigVal = &restclient.Config{ContentConfig: restclient.ContentConfig{GroupVersion: &schema.GroupVersion{Version: ""}}}
+
+	outputFormat := "name"
+
+	streams, _, buf, _ := genericclioptions.NewTestIOStreams()
+	cmd := NewCmdResources(tf, streams)
+	cmd.SetOutput(buf)
+	cmd.Flags().Set("output", outputFormat)
+	cmd.Flags().Set("local", "true")
+
+	opts := SetResourcesOptions{
+		PrintFlags: genericclioptions.NewPrintFlags("").WithDefaultOutput(outputFormat).WithTypeSetter(scheme.Scheme),
+		FilenameOptions: resource.FilenameOptions{
+			Filenames: []string{"../../../../test/fixtures/pkg/kubectl/cmd/set/multi-resource-yaml.yaml"}},
+		Local:             true,
+		Limits:            "cpu=200m,memory=512Mi",
+		Requests:          "cpu=200m,memory=512Mi",
+		ContainerSelector: "*",
+		IOStreams:         streams,
+	}
+
+	err := opts.Complete(tf, cmd, []string{})
+	if err == nil {
+		err = opts.Validate()
+	}
+	if err == nil {
+		err = opts.Run()
+	}
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	expectedOut := "replicationcontroller/first-rc\nreplicationcontroller/second-rc\n"
+	if buf.String() != expectedOut {
+		t.Errorf("expected out:\n%s\nbut got:\n%s", expectedOut, buf.String())
+	}
+}
+
+func TestSetResourcesRemote(t *testing.T) {
+	inputs := []struct {
+		object                          runtime.Object
+		apiPrefix, apiGroup, apiVersion string
+		testAPIGroup                    string
+		args                            []string
+	}{
+		{
+			object: &extensionsv1beta1.ReplicaSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: extensionsv1beta1.ReplicaSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "extensions", apiVersion: "v1beta1",
+			args: []string{"replicaset", "nginx"},
+		},
+		{
+			object: &appsv1beta2.ReplicaSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.ReplicaSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"replicaset", "nginx"},
+		},
+		{
+			object: &appsv1.ReplicaSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.ReplicaSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"replicaset", "nginx"},
+		},
+		{
+			object: &extensionsv1beta1.DaemonSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: extensionsv1beta1.DaemonSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "extensions", apiVersion: "v1beta1",
+			args: []string{"daemonset", "nginx"},
+		},
+		{
+			object: &appsv1beta2.DaemonSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.DaemonSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"daemonset", "nginx"},
+		},
+		{
+			object: &appsv1.DaemonSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.DaemonSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"daemonset", "nginx"},
+		},
+		{
+			object: &extensionsv1beta1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: extensionsv1beta1.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "extensions", apiVersion: "v1beta1",
+			args: []string{"deployment", "nginx"},
+		},
+		{
+			object: &appsv1beta1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta1.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta1",
+			args: []string{"deployment", "nginx"},
+		},
+		{
+			object: &appsv1beta2.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"deployment", "nginx"},
+		},
+		{
+			object: &appsv1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"deployment", "nginx"},
+		},
+		{
+			object: &appsv1beta1.StatefulSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta1.StatefulSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "apps",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta1",
+			args: []string{"statefulset", "nginx"},
+		},
+		{
+			object: &appsv1beta2.StatefulSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.StatefulSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "apps",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"statefulset", "nginx"},
+		},
+		{
+			object: &appsv1.StatefulSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.StatefulSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "apps",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"statefulset", "nginx"},
+		},
+		{
+			object: &batchv1.Job{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: batchv1.JobSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "batch",
+			apiPrefix:    "/apis", apiGroup: "batch", apiVersion: "v1",
+			args: []string{"job", "nginx"},
+		},
+		{
+			object: &v1.ReplicationController{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: v1.ReplicationControllerSpec{
+					Template: &v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "",
+			apiPrefix:    "/api", apiGroup: "", apiVersion: "v1",
+			args: []string{"replicationcontroller", "nginx"},
+		},
+	}
+	for i, input := range inputs {
+		t.Run(fmt.Sprintf("%d", i), func(t *testing.T) {
+			groupVersion := schema.GroupVersion{Group: input.apiGroup, Version: input.apiVersion}
+			testapi.Default = testapi.Groups[input.testAPIGroup]
+			tf := cmdtesting.NewTestFactory().WithNamespace("test")
+			defer tf.Cleanup()
+
+			tf.Client = &fake.RESTClient{
+				GroupVersion:         groupVersion,
+				NegotiatedSerializer: serializer.DirectCodecFactory{CodecFactory: scheme.Codecs},
+				Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+					resourcePath := testapi.Default.ResourcePath(input.args[0]+"s", "test", input.args[1])
+					switch p, m := req.URL.Path, req.Method; {
+					case p == resourcePath && m == http.MethodGet:
+						return &http.Response{StatusCode: http.StatusOK, Header: defaultHeader(), Body: objBody(input.object)}, nil
+					case p == resourcePath && m == http.MethodPatch:
+						stream, err := req.GetBody()
+						if err != nil {
+							return nil, err
+						}
+						bytes, err := ioutil.ReadAll(stream)
+						if err != nil {
+							return nil, err
+						}
+						assert.Contains(t, string(bytes), "200m", fmt.Sprintf("resources not updated for %#v", input.object))
+						return &http.Response{StatusCode: http.StatusOK, Header: defaultHeader(), Body: objBody(input.object)}, nil
+					default:
+						t.Errorf("%s: unexpected request: %s %#v\n%#v", "resources", req.Method, req.URL, req)
+						return nil, fmt.Errorf("unexpected request")
+					}
+				}),
+				VersionedAPIPath: path.Join(input.apiPrefix, testapi.Default.GroupVersion().String()),
+			}
+
+			outputFormat := "yaml"
+
+			streams := genericclioptions.NewTestIOStreamsDiscard()
+			cmd := NewCmdResources(tf, streams)
+			cmd.Flags().Set("output", outputFormat)
+			opts := SetResourcesOptions{
+				PrintFlags: genericclioptions.NewPrintFlags("").WithDefaultOutput(outputFormat).WithTypeSetter(scheme.Scheme),
+
+				Limits:            "cpu=200m,memory=512Mi",
+				ContainerSelector: "*",
+				IOStreams:         streams,
+			}
+			err := opts.Complete(tf, cmd, input.args)
+			if err == nil {
+				err = opts.Validate()
+			}
+			if err == nil {
+				err = opts.Run()
+			}
+			assert.NoError(t, err)
+		})
+	}
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_selector.go

@@ -0,0 +1,225 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"fmt"
+
+	"github.com/golang/glog"
+	"github.com/spf13/cobra"
+
+	"k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/validation"
+	"k8s.io/kubernetes/pkg/kubectl/cmd/templates"
+	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions/printers"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions/resource"
+	"k8s.io/kubernetes/pkg/kubectl/scheme"
+	"k8s.io/kubernetes/pkg/kubectl/util/i18n"
+)
+
+// SelectorOptions is the start of the data required to perform the operation.  As new fields are added, add them here instead of
+// referencing the cmd.Flags()
+type SetSelectorOptions struct {
+	// Bound
+	ResourceBuilderFlags *genericclioptions.ResourceBuilderFlags
+	PrintFlags           *genericclioptions.PrintFlags
+	RecordFlags          *genericclioptions.RecordFlags
+	dryrun               bool
+
+	// set by args
+	resources []string
+	selector  *metav1.LabelSelector
+
+	// computed
+	WriteToServer  bool
+	PrintObj       printers.ResourcePrinterFunc
+	Recorder       genericclioptions.Recorder
+	ResourceFinder genericclioptions.ResourceFinder
+
+	// set at initialization
+	genericclioptions.IOStreams
+}
+
+var (
+	selectorLong = templates.LongDesc(`
+		Set the selector on a resource. Note that the new selector will overwrite the old selector if the resource had one prior to the invocation
+		of 'set selector'.
+
+		A selector must begin with a letter or number, and may contain letters, numbers, hyphens, dots, and underscores, up to %[1]d characters.
+		If --resource-version is specified, then updates will use this resource version, otherwise the existing resource-version will be used.
+        Note: currently selectors can only be set on Service objects.`)
+	selectorExample = templates.Examples(`
+        # set the labels and selector before creating a deployment/service pair.
+        kubectl create service clusterip my-svc --clusterip="None" -o yaml --dry-run | kubectl set selector --local -f - 'environment=qa' -o yaml | kubectl create -f -
+        kubectl create deployment my-dep -o yaml --dry-run | kubectl label --local -f - environment=qa -o yaml | kubectl create -f -`)
+)
+
+func NewSelectorOptions(streams genericclioptions.IOStreams) *SetSelectorOptions {
+	return &SetSelectorOptions{
+		ResourceBuilderFlags: genericclioptions.NewResourceBuilderFlags().
+			WithScheme(scheme.Scheme).
+			WithAll(false).
+			WithLocal(false).
+			WithUninitialized(false).
+			WithLatest(),
+		PrintFlags:  genericclioptions.NewPrintFlags("selector updated").WithTypeSetter(scheme.Scheme),
+		RecordFlags: genericclioptions.NewRecordFlags(),
+
+		Recorder: genericclioptions.NoopRecorder{},
+
+		IOStreams: streams,
+	}
+}
+
+// NewCmdSelector is the "set selector" command.
+func NewCmdSelector(f cmdutil.Factory, streams genericclioptions.IOStreams) *cobra.Command {
+	o := NewSelectorOptions(streams)
+
+	cmd := &cobra.Command{
+		Use: "selector (-f FILENAME | TYPE NAME) EXPRESSIONS [--resource-version=version]",
+		DisableFlagsInUseLine: true,
+		Short:   i18n.T("Set the selector on a resource"),
+		Long:    fmt.Sprintf(selectorLong, validation.LabelValueMaxLength),
+		Example: selectorExample,
+		Run: func(cmd *cobra.Command, args []string) {
+			cmdutil.CheckErr(o.Complete(f, cmd, args))
+			cmdutil.CheckErr(o.Validate())
+			cmdutil.CheckErr(o.RunSelector())
+		},
+	}
+
+	o.ResourceBuilderFlags.AddFlags(cmd.Flags())
+	o.PrintFlags.AddFlags(cmd)
+	o.RecordFlags.AddFlags(cmd)
+
+	cmd.Flags().String("resource-version", "", "If non-empty, the selectors update will only succeed if this is the current resource-version for the object. Only valid when specifying a single resource.")
+	cmdutil.AddDryRunFlag(cmd)
+
+	return cmd
+}
+
+// Complete assigns the SelectorOptions from args.
+func (o *SetSelectorOptions) Complete(f cmdutil.Factory, cmd *cobra.Command, args []string) error {
+	var err error
+
+	o.RecordFlags.Complete(cmd)
+	o.Recorder, err = o.RecordFlags.ToRecorder()
+	if err != nil {
+		return err
+	}
+
+	o.dryrun = cmdutil.GetDryRunFlag(cmd)
+
+	o.resources, o.selector, err = getResourcesAndSelector(args)
+	if err != nil {
+		return err
+	}
+
+	o.ResourceFinder = o.ResourceBuilderFlags.ToBuilder(f, o.resources)
+	o.WriteToServer = !(*o.ResourceBuilderFlags.Local || o.dryrun)
+
+	if o.dryrun {
+		o.PrintFlags.Complete("%s (dry run)")
+	}
+	printer, err := o.PrintFlags.ToPrinter()
+	if err != nil {
+		return err
+	}
+	o.PrintObj = printer.PrintObj
+
+	return err
+}
+
+// Validate basic inputs
+func (o *SetSelectorOptions) Validate() error {
+	if o.selector == nil {
+		return fmt.Errorf("one selector is required")
+	}
+	return nil
+}
+
+// RunSelector executes the command.
+func (o *SetSelectorOptions) RunSelector() error {
+	r := o.ResourceFinder.Do()
+
+	return r.Visit(func(info *resource.Info, err error) error {
+		patch := &Patch{Info: info}
+		CalculatePatch(patch, scheme.DefaultJSONEncoder(), func(obj runtime.Object) ([]byte, error) {
+			selectErr := updateSelectorForObject(info.Object, *o.selector)
+			if selectErr != nil {
+				return nil, selectErr
+			}
+
+			// record this change (for rollout history)
+			if err := o.Recorder.Record(patch.Info.Object); err != nil {
+				glog.V(4).Infof("error recording current command: %v", err)
+			}
+
+			return runtime.Encode(scheme.DefaultJSONEncoder(), info.Object)
+		})
+
+		if patch.Err != nil {
+			return patch.Err
+		}
+		if !o.WriteToServer {
+			return o.PrintObj(info.Object, o.Out)
+		}
+
+		actual, err := resource.NewHelper(info.Client, info.Mapping).Patch(info.Namespace, info.Name, types.StrategicMergePatchType, patch.Patch)
+		if err != nil {
+			return err
+		}
+
+		return o.PrintObj(actual, o.Out)
+	})
+}
+
+func updateSelectorForObject(obj runtime.Object, selector metav1.LabelSelector) error {
+	copyOldSelector := func() (map[string]string, error) {
+		if len(selector.MatchExpressions) > 0 {
+			return nil, fmt.Errorf("match expression %v not supported on this object", selector.MatchExpressions)
+		}
+		dst := make(map[string]string)
+		for label, value := range selector.MatchLabels {
+			dst[label] = value
+		}
+		return dst, nil
+	}
+	var err error
+	switch t := obj.(type) {
+	case *v1.Service:
+		t.Spec.Selector, err = copyOldSelector()
+	default:
+		err = fmt.Errorf("setting a selector is only supported for Services")
+	}
+	return err
+}
+
+// getResourcesAndSelector retrieves resources and the selector expression from the given args (assuming selectors the last arg)
+func getResourcesAndSelector(args []string) (resources []string, selector *metav1.LabelSelector, err error) {
+	if len(args) == 0 {
+		return []string{}, nil, nil
+	}
+	resources = args[:len(args)-1]
+	selector, err = metav1.ParseToLabelSelector(args[len(args)-1])
+	return resources, selector, err
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_selector_test.go

@@ -0,0 +1,342 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	batchv1 "k8s.io/api/batch/v1"
+	"k8s.io/api/core/v1"
+	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions/printers"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions/resource"
+)
+
+func TestUpdateSelectorForObjectTypes(t *testing.T) {
+	before := metav1.LabelSelector{MatchLabels: map[string]string{"fee": "true"},
+		MatchExpressions: []metav1.LabelSelectorRequirement{
+			{
+				Key:      "foo",
+				Operator: metav1.LabelSelectorOpIn,
+				Values:   []string{"on", "yes"},
+			},
+		}}
+
+	rc := v1.ReplicationController{}
+	ser := v1.Service{}
+	dep := extensionsv1beta1.Deployment{Spec: extensionsv1beta1.DeploymentSpec{Selector: &before}}
+	ds := extensionsv1beta1.DaemonSet{Spec: extensionsv1beta1.DaemonSetSpec{Selector: &before}}
+	rs := extensionsv1beta1.ReplicaSet{Spec: extensionsv1beta1.ReplicaSetSpec{Selector: &before}}
+	job := batchv1.Job{Spec: batchv1.JobSpec{Selector: &before}}
+	pvc := v1.PersistentVolumeClaim{Spec: v1.PersistentVolumeClaimSpec{Selector: &before}}
+	sa := v1.ServiceAccount{}
+	type args struct {
+		obj      runtime.Object
+		selector metav1.LabelSelector
+	}
+	tests := []struct {
+		name    string
+		args    args
+		wantErr bool
+	}{
+		{name: "rc",
+			args: args{
+				obj:      &rc,
+				selector: metav1.LabelSelector{},
+			},
+			wantErr: true,
+		},
+		{name: "ser",
+			args: args{
+				obj:      &ser,
+				selector: metav1.LabelSelector{},
+			},
+			wantErr: false,
+		},
+		{name: "dep",
+			args: args{
+				obj:      &dep,
+				selector: metav1.LabelSelector{},
+			},
+			wantErr: true,
+		},
+		{name: "ds",
+			args: args{
+				obj:      &ds,
+				selector: metav1.LabelSelector{},
+			},
+			wantErr: true,
+		},
+		{name: "rs",
+			args: args{
+				obj:      &rs,
+				selector: metav1.LabelSelector{},
+			},
+			wantErr: true,
+		},
+		{name: "job",
+			args: args{
+				obj:      &job,
+				selector: metav1.LabelSelector{},
+			},
+			wantErr: true,
+		},
+		{name: "pvc - no updates",
+			args: args{
+				obj:      &pvc,
+				selector: metav1.LabelSelector{},
+			},
+			wantErr: true,
+		},
+		{name: "sa - no selector",
+			args: args{
+				obj:      &sa,
+				selector: metav1.LabelSelector{},
+			},
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		if err := updateSelectorForObject(tt.args.obj, tt.args.selector); (err != nil) != tt.wantErr {
+			t.Errorf("%q. updateSelectorForObject() error = %v, wantErr %v", tt.name, err, tt.wantErr)
+		}
+	}
+}
+
+func TestUpdateNewSelectorValuesForObject(t *testing.T) {
+	ser := v1.Service{}
+	type args struct {
+		obj      runtime.Object
+		selector metav1.LabelSelector
+	}
+	tests := []struct {
+		name    string
+		args    args
+		wantErr bool
+	}{
+		{name: "empty",
+			args: args{
+				obj: &ser,
+				selector: metav1.LabelSelector{
+					MatchLabels:      map[string]string{},
+					MatchExpressions: []metav1.LabelSelectorRequirement{},
+				},
+			},
+			wantErr: false,
+		},
+		{name: "label-only",
+			args: args{
+				obj: &ser,
+				selector: metav1.LabelSelector{
+					MatchLabels:      map[string]string{"b": "u"},
+					MatchExpressions: []metav1.LabelSelectorRequirement{},
+				},
+			},
+			wantErr: false,
+		},
+	}
+	for _, tt := range tests {
+		if err := updateSelectorForObject(tt.args.obj, tt.args.selector); (err != nil) != tt.wantErr {
+			t.Errorf("%q. updateSelectorForObject() error = %v, wantErr %v", tt.name, err, tt.wantErr)
+		}
+
+		assert.EqualValues(t, tt.args.selector.MatchLabels, ser.Spec.Selector, tt.name)
+
+	}
+}
+
+func TestUpdateOldSelectorValuesForObject(t *testing.T) {
+	ser := v1.Service{Spec: v1.ServiceSpec{Selector: map[string]string{"fee": "true"}}}
+	type args struct {
+		obj      runtime.Object
+		selector metav1.LabelSelector
+	}
+	tests := []struct {
+		name    string
+		args    args
+		wantErr bool
+	}{
+		{name: "empty",
+			args: args{
+				obj: &ser,
+				selector: metav1.LabelSelector{
+					MatchLabels:      map[string]string{},
+					MatchExpressions: []metav1.LabelSelectorRequirement{},
+				},
+			},
+			wantErr: false,
+		},
+		{name: "label-only",
+			args: args{
+				obj: &ser,
+				selector: metav1.LabelSelector{
+					MatchLabels:      map[string]string{"fee": "false", "x": "y"},
+					MatchExpressions: []metav1.LabelSelectorRequirement{},
+				},
+			},
+			wantErr: false,
+		},
+		{name: "expr-only - err",
+			args: args{
+				obj: &ser,
+				selector: metav1.LabelSelector{
+					MatchLabels: map[string]string{},
+					MatchExpressions: []metav1.LabelSelectorRequirement{
+						{
+							Key:      "a",
+							Operator: "In",
+							Values:   []string{"x", "y"},
+						},
+					},
+				},
+			},
+			wantErr: true,
+		},
+		{name: "both - err",
+			args: args{
+				obj: &ser,
+				selector: metav1.LabelSelector{
+					MatchLabels: map[string]string{"b": "u"},
+					MatchExpressions: []metav1.LabelSelectorRequirement{
+						{
+							Key:      "a",
+							Operator: "In",
+							Values:   []string{"x", "y"},
+						},
+					},
+				},
+			},
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		err := updateSelectorForObject(tt.args.obj, tt.args.selector)
+		if (err != nil) != tt.wantErr {
+			t.Errorf("%q. updateSelectorForObject() error = %v, wantErr %v", tt.name, err, tt.wantErr)
+		} else if !tt.wantErr {
+			assert.EqualValues(t, tt.args.selector.MatchLabels, ser.Spec.Selector, tt.name)
+		}
+	}
+}
+
+func TestGetResourcesAndSelector(t *testing.T) {
+	type args struct {
+		args []string
+	}
+	tests := []struct {
+		name          string
+		args          args
+		wantResources []string
+		wantSelector  *metav1.LabelSelector
+		wantErr       bool
+	}{
+		{
+			name:          "basic match",
+			args:          args{args: []string{"rc/foo", "healthy=true"}},
+			wantResources: []string{"rc/foo"},
+			wantErr:       false,
+			wantSelector: &metav1.LabelSelector{
+				MatchLabels:      map[string]string{"healthy": "true"},
+				MatchExpressions: []metav1.LabelSelectorRequirement{},
+			},
+		},
+		{
+			name:          "basic expression",
+			args:          args{args: []string{"rc/foo", "buildType notin (debug, test)"}},
+			wantResources: []string{"rc/foo"},
+			wantErr:       false,
+			wantSelector: &metav1.LabelSelector{
+				MatchLabels: map[string]string{},
+				MatchExpressions: []metav1.LabelSelectorRequirement{
+					{
+						Key:      "buildType",
+						Operator: "NotIn",
+						Values:   []string{"debug", "test"},
+					},
+				},
+			},
+		},
+		{
+			name:          "selector error",
+			args:          args{args: []string{"rc/foo", "buildType notthis (debug, test)"}},
+			wantResources: []string{"rc/foo"},
+			wantErr:       true,
+			wantSelector: &metav1.LabelSelector{
+				MatchLabels:      map[string]string{},
+				MatchExpressions: []metav1.LabelSelectorRequirement{},
+			},
+		},
+		{
+			name:          "no resource and selector",
+			args:          args{args: []string{}},
+			wantResources: []string{},
+			wantErr:       false,
+			wantSelector:  nil,
+		},
+	}
+	for _, tt := range tests {
+		gotResources, gotSelector, err := getResourcesAndSelector(tt.args.args)
+		if err != nil {
+			if !tt.wantErr {
+				t.Errorf("%q. getResourcesAndSelector() error = %v, wantErr %v", tt.name, err, tt.wantErr)
+			}
+			continue
+		}
+		if !reflect.DeepEqual(gotResources, tt.wantResources) {
+			t.Errorf("%q. getResourcesAndSelector() gotResources = %v, want %v", tt.name, gotResources, tt.wantResources)
+		}
+		if !reflect.DeepEqual(gotSelector, tt.wantSelector) {
+			t.Errorf("%q. getResourcesAndSelector() gotSelector = %v, want %v", tt.name, gotSelector, tt.wantSelector)
+		}
+	}
+}
+
+func TestSelectorTest(t *testing.T) {
+	info := &resource.Info{
+		Object: &v1.Service{
+			TypeMeta:   metav1.TypeMeta{APIVersion: "v1", Kind: "Service"},
+			ObjectMeta: metav1.ObjectMeta{Namespace: "some-ns", Name: "cassandra"},
+		},
+	}
+
+	labelToSet, err := metav1.ParseToLabelSelector("environment=qa")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	iostreams, _, buf, _ := genericclioptions.NewTestIOStreams()
+	o := &SetSelectorOptions{
+		selector:       labelToSet,
+		ResourceFinder: genericclioptions.NewSimpleFakeResourceFinder(info),
+		Recorder:       genericclioptions.NoopRecorder{},
+		PrintObj:       (&printers.NamePrinter{}).PrintObj,
+		IOStreams:      iostreams,
+	}
+
+	if err := o.RunSelector(); err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(buf.String(), "service/cassandra") {
+		t.Errorf("did not set selector: %s", buf.String())
+	}
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_serviceaccount.go

@@ -0,0 +1,216 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/golang/glog"
+	"github.com/spf13/cobra"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+	"k8s.io/kubernetes/pkg/kubectl/cmd/templates"
+	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions/printers"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions/resource"
+	"k8s.io/kubernetes/pkg/kubectl/polymorphichelpers"
+	"k8s.io/kubernetes/pkg/kubectl/scheme"
+	"k8s.io/kubernetes/pkg/kubectl/util/i18n"
+)
+
+var (
+	serviceaccountResources = `
+	replicationcontroller (rc), deployment (deploy), daemonset (ds), job, replicaset (rs), statefulset`
+
+	serviceaccountLong = templates.LongDesc(i18n.T(`
+	Update ServiceAccount of pod template resources.
+
+	Possible resources (case insensitive) can be: 
+	` + serviceaccountResources))
+
+	serviceaccountExample = templates.Examples(i18n.T(`
+	# Set Deployment nginx-deployment's ServiceAccount to serviceaccount1
+	kubectl set serviceaccount deployment nginx-deployment serviceaccount1
+
+	# Print the result (in yaml format) of updated nginx deployment with serviceaccount from local file, without hitting apiserver
+	kubectl set sa -f nginx-deployment.yaml serviceaccount1 --local --dry-run -o yaml
+	`))
+)
+
+// serviceAccountConfig encapsulates the data required to perform the operation.
+type SetServiceAccountOptions struct {
+	PrintFlags  *genericclioptions.PrintFlags
+	RecordFlags *genericclioptions.RecordFlags
+
+	fileNameOptions        resource.FilenameOptions
+	dryRun                 bool
+	shortOutput            bool
+	all                    bool
+	output                 string
+	local                  bool
+	updatePodSpecForObject polymorphichelpers.UpdatePodSpecForObjectFunc
+	infos                  []*resource.Info
+	serviceAccountName     string
+
+	PrintObj printers.ResourcePrinterFunc
+	Recorder genericclioptions.Recorder
+
+	genericclioptions.IOStreams
+}
+
+func NewSetServiceAccountOptions(streams genericclioptions.IOStreams) *SetServiceAccountOptions {
+	return &SetServiceAccountOptions{
+		PrintFlags:  genericclioptions.NewPrintFlags("serviceaccount updated").WithTypeSetter(scheme.Scheme),
+		RecordFlags: genericclioptions.NewRecordFlags(),
+
+		Recorder: genericclioptions.NoopRecorder{},
+
+		IOStreams: streams,
+	}
+}
+
+// NewCmdServiceAccount returns the "set serviceaccount" command.
+func NewCmdServiceAccount(f cmdutil.Factory, streams genericclioptions.IOStreams) *cobra.Command {
+	o := NewSetServiceAccountOptions(streams)
+
+	cmd := &cobra.Command{
+		Use: "serviceaccount (-f FILENAME | TYPE NAME) SERVICE_ACCOUNT",
+		DisableFlagsInUseLine: true,
+		Aliases:               []string{"sa"},
+		Short:                 i18n.T("Update ServiceAccount of a resource"),
+		Long:                  serviceaccountLong,
+		Example:               serviceaccountExample,
+		Run: func(cmd *cobra.Command, args []string) {
+			cmdutil.CheckErr(o.Complete(f, cmd, args))
+			cmdutil.CheckErr(o.Run())
+		},
+	}
+
+	o.PrintFlags.AddFlags(cmd)
+	o.RecordFlags.AddFlags(cmd)
+
+	usage := "identifying the resource to get from a server."
+	cmdutil.AddFilenameOptionFlags(cmd, &o.fileNameOptions, usage)
+	cmd.Flags().BoolVar(&o.all, "all", o.all, "Select all resources, including uninitialized ones, in the namespace of the specified resource types")
+	cmd.Flags().BoolVar(&o.local, "local", o.local, "If true, set serviceaccount will NOT contact api-server but run locally.")
+	cmdutil.AddDryRunFlag(cmd)
+	cmdutil.AddIncludeUninitializedFlag(cmd)
+	return cmd
+}
+
+// Complete configures serviceAccountConfig from command line args.
+func (o *SetServiceAccountOptions) Complete(f cmdutil.Factory, cmd *cobra.Command, args []string) error {
+	var err error
+
+	o.RecordFlags.Complete(cmd)
+	o.Recorder, err = o.RecordFlags.ToRecorder()
+	if err != nil {
+		return err
+	}
+
+	o.shortOutput = cmdutil.GetFlagString(cmd, "output") == "name"
+	o.dryRun = cmdutil.GetDryRunFlag(cmd)
+	o.output = cmdutil.GetFlagString(cmd, "output")
+	o.updatePodSpecForObject = polymorphichelpers.UpdatePodSpecForObjectFn
+
+	if o.dryRun {
+		o.PrintFlags.Complete("%s (dry run)")
+	}
+	printer, err := o.PrintFlags.ToPrinter()
+	if err != nil {
+		return err
+	}
+	o.PrintObj = printer.PrintObj
+
+	cmdNamespace, enforceNamespace, err := f.ToRawKubeConfigLoader().Namespace()
+	if err != nil {
+		return err
+	}
+	if len(args) == 0 {
+		return errors.New("serviceaccount is required")
+	}
+	o.serviceAccountName = args[len(args)-1]
+	resources := args[:len(args)-1]
+	includeUninitialized := cmdutil.ShouldIncludeUninitialized(cmd, false)
+	builder := f.NewBuilder().
+		WithScheme(scheme.Scheme, scheme.Scheme.PrioritizedVersionsAllGroups()...).
+		LocalParam(o.local).
+		ContinueOnError().
+		NamespaceParam(cmdNamespace).DefaultNamespace().
+		FilenameParam(enforceNamespace, &o.fileNameOptions).
+		IncludeUninitialized(includeUninitialized).
+		Flatten()
+	if !o.local {
+		builder.ResourceTypeOrNameArgs(o.all, resources...).
+			Latest()
+	}
+	o.infos, err = builder.Do().Infos()
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// Run creates and applies the patch either locally or calling apiserver.
+func (o *SetServiceAccountOptions) Run() error {
+	patchErrs := []error{}
+	patchFn := func(obj runtime.Object) ([]byte, error) {
+		_, err := o.updatePodSpecForObject(obj, func(podSpec *v1.PodSpec) error {
+			podSpec.ServiceAccountName = o.serviceAccountName
+			return nil
+		})
+		if err != nil {
+			return nil, err
+		}
+		// record this change (for rollout history)
+		if err := o.Recorder.Record(obj); err != nil {
+			glog.V(4).Infof("error recording current command: %v", err)
+		}
+
+		return runtime.Encode(scheme.DefaultJSONEncoder(), obj)
+	}
+
+	patches := CalculatePatches(o.infos, scheme.DefaultJSONEncoder(), patchFn)
+	for _, patch := range patches {
+		info := patch.Info
+		if patch.Err != nil {
+			patchErrs = append(patchErrs, fmt.Errorf("error: %s/%s %v\n", info.Mapping.Resource, info.Name, patch.Err))
+			continue
+		}
+		if o.local || o.dryRun {
+			if err := o.PrintObj(info.Object, o.Out); err != nil {
+				patchErrs = append(patchErrs, err)
+			}
+			continue
+		}
+		actual, err := resource.NewHelper(info.Client, info.Mapping).Patch(info.Namespace, info.Name, types.StrategicMergePatchType, patch.Patch)
+		if err != nil {
+			patchErrs = append(patchErrs, fmt.Errorf("failed to patch ServiceAccountName %v", err))
+			continue
+		}
+
+		if err := o.PrintObj(actual, o.Out); err != nil {
+			patchErrs = append(patchErrs, err)
+		}
+	}
+	return utilerrors.NewAggregate(patchErrs)
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_serviceaccount_test.go

@@ -0,0 +1,425 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"net/http"
+	"path"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	appsv1 "k8s.io/api/apps/v1"
+	appsv1beta1 "k8s.io/api/apps/v1beta1"
+	appsv1beta2 "k8s.io/api/apps/v1beta2"
+	batchv1 "k8s.io/api/batch/v1"
+	"k8s.io/api/core/v1"
+	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/client-go/rest/fake"
+	"k8s.io/kubernetes/pkg/api/testapi"
+	cmdtesting "k8s.io/kubernetes/pkg/kubectl/cmd/testing"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions/resource"
+	"k8s.io/kubernetes/pkg/kubectl/scheme"
+)
+
+const serviceAccount = "serviceaccount1"
+const serviceAccountMissingErrString = "serviceaccount is required"
+const resourceMissingErrString = `You must provide one or more resources by argument or filename.
+Example resource specifications include:
+   '-f rsrc.yaml'
+   '--filename=rsrc.json'
+   '<resource> <name>'
+   '<resource>'`
+
+func TestSetServiceAccountLocal(t *testing.T) {
+	inputs := []struct {
+		yaml     string
+		apiGroup string
+	}{
+		{yaml: "../../../../test/fixtures/doc-yaml/user-guide/replication.yaml", apiGroup: ""},
+		{yaml: "../../../../test/fixtures/doc-yaml/admin/daemon.yaml", apiGroup: "extensions"},
+		{yaml: "../../../../test/fixtures/doc-yaml/user-guide/replicaset/redis-slave.yaml", apiGroup: "extensions"},
+		{yaml: "../../../../test/fixtures/doc-yaml/user-guide/job.yaml", apiGroup: "batch"},
+		{yaml: "../../../../test/fixtures/doc-yaml/user-guide/deployment.yaml", apiGroup: "extensions"},
+	}
+
+	for i, input := range inputs {
+		t.Run(fmt.Sprintf("%d", i), func(t *testing.T) {
+			tf := cmdtesting.NewTestFactory().WithNamespace("test")
+			defer tf.Cleanup()
+
+			tf.Client = &fake.RESTClient{
+				GroupVersion: schema.GroupVersion{Version: "v1"},
+				Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+					t.Fatalf("unexpected request: %s %#v\n%#v", req.Method, req.URL, req)
+					return nil, nil
+				}),
+			}
+
+			outputFormat := "yaml"
+
+			streams, _, buf, _ := genericclioptions.NewTestIOStreams()
+			cmd := NewCmdServiceAccount(tf, streams)
+			cmd.Flags().Set("output", outputFormat)
+			cmd.Flags().Set("local", "true")
+			testapi.Default = testapi.Groups[input.apiGroup]
+			saConfig := SetServiceAccountOptions{
+				PrintFlags: genericclioptions.NewPrintFlags("").WithDefaultOutput(outputFormat).WithTypeSetter(scheme.Scheme),
+				fileNameOptions: resource.FilenameOptions{
+					Filenames: []string{input.yaml}},
+				local:     true,
+				IOStreams: streams,
+			}
+			err := saConfig.Complete(tf, cmd, []string{serviceAccount})
+			assert.NoError(t, err)
+			err = saConfig.Run()
+			assert.NoError(t, err)
+			assert.Contains(t, buf.String(), "serviceAccountName: "+serviceAccount, fmt.Sprintf("serviceaccount not updated for %s", input.yaml))
+		})
+	}
+}
+
+func TestSetServiceAccountMultiLocal(t *testing.T) {
+	testapi.Default = testapi.Groups[""]
+	tf := cmdtesting.NewTestFactory().WithNamespace("test")
+	defer tf.Cleanup()
+
+	tf.Client = &fake.RESTClient{
+		GroupVersion:         schema.GroupVersion{Version: ""},
+		NegotiatedSerializer: serializer.DirectCodecFactory{CodecFactory: scheme.Codecs},
+		Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+			t.Fatalf("unexpected request: %s %#v\n%#v", req.Method, req.URL, req)
+			return nil, nil
+		}),
+	}
+	tf.ClientConfigVal = &restclient.Config{ContentConfig: restclient.ContentConfig{GroupVersion: &schema.GroupVersion{Version: ""}}}
+
+	outputFormat := "name"
+
+	streams, _, buf, _ := genericclioptions.NewTestIOStreams()
+	cmd := NewCmdServiceAccount(tf, streams)
+	cmd.Flags().Set("output", outputFormat)
+	cmd.Flags().Set("local", "true")
+	opts := SetServiceAccountOptions{
+		PrintFlags: genericclioptions.NewPrintFlags("").WithDefaultOutput(outputFormat).WithTypeSetter(scheme.Scheme),
+		fileNameOptions: resource.FilenameOptions{
+			Filenames: []string{"../../../../test/fixtures/pkg/kubectl/cmd/set/multi-resource-yaml.yaml"}},
+		local:     true,
+		IOStreams: streams,
+	}
+
+	err := opts.Complete(tf, cmd, []string{serviceAccount})
+	if err == nil {
+		err = opts.Run()
+	}
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	expectedOut := "replicationcontroller/first-rc\nreplicationcontroller/second-rc\n"
+	if buf.String() != expectedOut {
+		t.Errorf("expected out:\n%s\nbut got:\n%s", expectedOut, buf.String())
+	}
+}
+
+func TestSetServiceAccountRemote(t *testing.T) {
+	inputs := []struct {
+		object                          runtime.Object
+		apiPrefix, apiGroup, apiVersion string
+		testAPIGroup                    string
+		args                            []string
+	}{
+		{
+			object: &extensionsv1beta1.ReplicaSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "extensions", apiVersion: "v1beta1",
+			args: []string{"replicaset", "nginx", serviceAccount},
+		},
+		{
+			object: &appsv1beta2.ReplicaSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1beta2.ReplicaSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"replicaset", "nginx", serviceAccount},
+		},
+		{
+			object: &appsv1.ReplicaSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.ReplicaSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"replicaset", "nginx", serviceAccount},
+		},
+		{
+			object: &extensionsv1beta1.DaemonSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "extensions", apiVersion: "v1beta1",
+			args: []string{"daemonset", "nginx", serviceAccount},
+		},
+		{
+			object: &appsv1beta2.DaemonSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"daemonset", "nginx", serviceAccount},
+		},
+		{
+			object: &appsv1.DaemonSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"daemonset", "nginx", serviceAccount},
+		},
+		{
+			object: &extensionsv1beta1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "extensions", apiVersion: "v1beta1",
+			args: []string{"deployment", "nginx", serviceAccount},
+		},
+		{
+			object: &appsv1beta1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta1",
+			args: []string{"deployment", "nginx", serviceAccount},
+		},
+		{
+			object: &appsv1beta2.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"deployment", "nginx", serviceAccount},
+		},
+		{
+			object: &appsv1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.DeploymentSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "extensions",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"deployment", "nginx", serviceAccount},
+		},
+		{
+			object: &appsv1beta1.StatefulSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+			},
+			testAPIGroup: "apps",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta1",
+			args: []string{"statefulset", "nginx", serviceAccount},
+		},
+		{
+			object: &appsv1beta2.StatefulSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+			},
+			testAPIGroup: "apps",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1beta2",
+			args: []string{"statefulset", "nginx", serviceAccount},
+		},
+		{
+			object: &appsv1.StatefulSet{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+				Spec: appsv1.StatefulSetSpec{
+					Template: v1.PodTemplateSpec{
+						Spec: v1.PodSpec{
+							Containers: []v1.Container{
+								{
+									Name:  "nginx",
+									Image: "nginx",
+								},
+							},
+						},
+					},
+				},
+			},
+			testAPIGroup: "apps",
+			apiPrefix:    "/apis", apiGroup: "apps", apiVersion: "v1",
+			args: []string{"statefulset", "nginx", serviceAccount},
+		},
+		{
+			object: &batchv1.Job{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+			},
+			testAPIGroup: "batch",
+			apiPrefix:    "/apis", apiGroup: "batch", apiVersion: "v1",
+			args: []string{"job", "nginx", serviceAccount},
+		},
+		{
+			object: &v1.ReplicationController{
+				ObjectMeta: metav1.ObjectMeta{Name: "nginx"},
+			},
+			testAPIGroup: "",
+			apiPrefix:    "/api", apiGroup: "", apiVersion: "v1",
+			args: []string{"replicationcontroller", "nginx", serviceAccount},
+		},
+	}
+	for _, input := range inputs {
+		t.Run(input.apiPrefix, func(t *testing.T) {
+			groupVersion := schema.GroupVersion{Group: input.apiGroup, Version: input.apiVersion}
+			testapi.Default = testapi.Groups[input.testAPIGroup]
+			tf := cmdtesting.NewTestFactory().WithNamespace("test")
+			defer tf.Cleanup()
+
+			tf.Client = &fake.RESTClient{
+				GroupVersion:         groupVersion,
+				NegotiatedSerializer: serializer.DirectCodecFactory{CodecFactory: scheme.Codecs},
+				Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+					resourcePath := testapi.Default.ResourcePath(input.args[0]+"s", "test", input.args[1])
+					switch p, m := req.URL.Path, req.Method; {
+					case p == resourcePath && m == http.MethodGet:
+						return &http.Response{StatusCode: http.StatusOK, Header: defaultHeader(), Body: objBody(input.object)}, nil
+					case p == resourcePath && m == http.MethodPatch:
+						stream, err := req.GetBody()
+						if err != nil {
+							return nil, err
+						}
+						bytes, err := ioutil.ReadAll(stream)
+						if err != nil {
+							return nil, err
+						}
+						assert.Contains(t, string(bytes), `"serviceAccountName":`+`"`+serviceAccount+`"`, fmt.Sprintf("serviceaccount not updated for %#v", input.object))
+						return &http.Response{StatusCode: http.StatusOK, Header: defaultHeader(), Body: objBody(input.object)}, nil
+					default:
+						t.Errorf("%s: unexpected request: %s %#v\n%#v", "serviceaccount", req.Method, req.URL, req)
+						return nil, fmt.Errorf("unexpected request")
+					}
+				}),
+				VersionedAPIPath: path.Join(input.apiPrefix, testapi.Default.GroupVersion().String()),
+			}
+
+			outputFormat := "yaml"
+
+			streams := genericclioptions.NewTestIOStreamsDiscard()
+			cmd := NewCmdServiceAccount(tf, streams)
+			cmd.Flags().Set("output", outputFormat)
+			saConfig := SetServiceAccountOptions{
+				PrintFlags: genericclioptions.NewPrintFlags("").WithDefaultOutput(outputFormat).WithTypeSetter(scheme.Scheme),
+
+				local:     false,
+				IOStreams: streams,
+			}
+			err := saConfig.Complete(tf, cmd, input.args)
+			assert.NoError(t, err)
+			err = saConfig.Run()
+			assert.NoError(t, err)
+		})
+	}
+}
+
+func TestServiceAccountValidation(t *testing.T) {
+	inputs := []struct {
+		name        string
+		args        []string
+		errorString string
+	}{
+		{name: "test service account missing", args: []string{}, errorString: serviceAccountMissingErrString},
+		{name: "test service account resource missing", args: []string{serviceAccount}, errorString: resourceMissingErrString},
+	}
+	for _, input := range inputs {
+		t.Run(input.name, func(t *testing.T) {
+			tf := cmdtesting.NewTestFactory().WithNamespace("test")
+			defer tf.Cleanup()
+
+			tf.Client = &fake.RESTClient{
+				GroupVersion: schema.GroupVersion{Version: "v1"},
+				Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
+					t.Fatalf("unexpected request: %s %#v\n%#v", req.Method, req.URL, req)
+					return nil, nil
+				}),
+			}
+
+			outputFormat := ""
+
+			streams := genericclioptions.NewTestIOStreamsDiscard()
+			cmd := NewCmdServiceAccount(tf, streams)
+
+			saConfig := &SetServiceAccountOptions{
+				PrintFlags: genericclioptions.NewPrintFlags("").WithDefaultOutput(outputFormat).WithTypeSetter(scheme.Scheme),
+				IOStreams:  streams,
+			}
+			err := saConfig.Complete(tf, cmd, input.args)
+			assert.EqualError(t, err, input.errorString)
+		})
+	}
+}
+
+func objBody(obj runtime.Object) io.ReadCloser {
+	return bytesBody([]byte(runtime.EncodeOrDie(scheme.DefaultJSONEncoder(), obj)))
+}
+
+func defaultHeader() http.Header {
+	header := http.Header{}
+	header.Set("Content-Type", runtime.ContentTypeJSON)
+	return header
+}
+
+func bytesBody(bodyBytes []byte) io.ReadCloser {
+	return ioutil.NopCloser(bytes.NewReader(bodyBytes))
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_subject.go

@@ -0,0 +1,307 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/spf13/cobra"
+
+	rbacv1 "k8s.io/api/rbac/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/kubernetes/pkg/apis/rbac"
+	"k8s.io/kubernetes/pkg/kubectl/cmd/templates"
+	cmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions/printers"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions/resource"
+	"k8s.io/kubernetes/pkg/kubectl/scheme"
+	"k8s.io/kubernetes/pkg/kubectl/util/i18n"
+)
+
+var (
+	subject_long = templates.LongDesc(`
+	Update User, Group or ServiceAccount in a RoleBinding/ClusterRoleBinding.`)
+
+	subject_example = templates.Examples(`
+	# Update a ClusterRoleBinding for serviceaccount1
+	kubectl set subject clusterrolebinding admin --serviceaccount=namespace:serviceaccount1
+
+	# Update a RoleBinding for user1, user2, and group1
+	kubectl set subject rolebinding admin --user=user1 --user=user2 --group=group1
+
+	# Print the result (in yaml format) of updating rolebinding subjects from a local, without hitting the server
+	kubectl create rolebinding admin --role=admin --user=admin -o yaml --dry-run | kubectl set subject --local -f - --user=foo -o yaml`)
+)
+
+type updateSubjects func(existings []rbacv1.Subject, targets []rbacv1.Subject) (bool, []rbacv1.Subject)
+
+// SubjectOptions is the start of the data required to perform the operation. As new fields are added, add them here instead of
+// referencing the cmd.Flags
+type SubjectOptions struct {
+	PrintFlags *genericclioptions.PrintFlags
+
+	resource.FilenameOptions
+
+	Infos             []*resource.Info
+	Selector          string
+	ContainerSelector string
+	Output            string
+	All               bool
+	DryRun            bool
+	Local             bool
+
+	Users           []string
+	Groups          []string
+	ServiceAccounts []string
+
+	namespace string
+
+	PrintObj printers.ResourcePrinterFunc
+
+	genericclioptions.IOStreams
+}
+
+func NewSubjectOptions(streams genericclioptions.IOStreams) *SubjectOptions {
+	return &SubjectOptions{
+		PrintFlags: genericclioptions.NewPrintFlags("subjects updated").WithTypeSetter(scheme.Scheme),
+
+		IOStreams: streams,
+	}
+}
+
+func NewCmdSubject(f cmdutil.Factory, streams genericclioptions.IOStreams) *cobra.Command {
+	o := NewSubjectOptions(streams)
+	cmd := &cobra.Command{
+		Use: "subject (-f FILENAME | TYPE NAME) [--user=username] [--group=groupname] [--serviceaccount=namespace:serviceaccountname] [--dry-run]",
+		DisableFlagsInUseLine: true,
+		Short:   i18n.T("Update User, Group or ServiceAccount in a RoleBinding/ClusterRoleBinding"),
+		Long:    subject_long,
+		Example: subject_example,
+		Run: func(cmd *cobra.Command, args []string) {
+			cmdutil.CheckErr(o.Complete(f, cmd, args))
+			cmdutil.CheckErr(o.Validate())
+			cmdutil.CheckErr(o.Run(addSubjects))
+		},
+	}
+
+	o.PrintFlags.AddFlags(cmd)
+
+	cmdutil.AddFilenameOptionFlags(cmd, &o.FilenameOptions, "the resource to update the subjects")
+	cmd.Flags().BoolVar(&o.All, "all", o.All, "Select all resources, including uninitialized ones, in the namespace of the specified resource types")
+	cmd.Flags().StringVarP(&o.Selector, "selector", "l", o.Selector, "Selector (label query) to filter on, not including uninitialized ones, supports '=', '==', and '!='.(e.g. -l key1=value1,key2=value2)")
+	cmd.Flags().BoolVar(&o.Local, "local", o.Local, "If true, set subject will NOT contact api-server but run locally.")
+	cmdutil.AddDryRunFlag(cmd)
+	cmd.Flags().StringArrayVar(&o.Users, "user", o.Users, "Usernames to bind to the role")
+	cmd.Flags().StringArrayVar(&o.Groups, "group", o.Groups, "Groups to bind to the role")
+	cmd.Flags().StringArrayVar(&o.ServiceAccounts, "serviceaccount", o.ServiceAccounts, "Service accounts to bind to the role")
+	cmdutil.AddIncludeUninitializedFlag(cmd)
+	return cmd
+}
+
+func (o *SubjectOptions) Complete(f cmdutil.Factory, cmd *cobra.Command, args []string) error {
+	o.Output = cmdutil.GetFlagString(cmd, "output")
+	o.DryRun = cmdutil.GetDryRunFlag(cmd)
+
+	if o.DryRun {
+		o.PrintFlags.Complete("%s (dry run)")
+	}
+	printer, err := o.PrintFlags.ToPrinter()
+	if err != nil {
+		return err
+	}
+	o.PrintObj = printer.PrintObj
+
+	var enforceNamespace bool
+	o.namespace, enforceNamespace, err = f.ToRawKubeConfigLoader().Namespace()
+	if err != nil {
+		return err
+	}
+
+	includeUninitialized := cmdutil.ShouldIncludeUninitialized(cmd, false)
+	builder := f.NewBuilder().
+		WithScheme(scheme.Scheme, scheme.Scheme.PrioritizedVersionsAllGroups()...).
+		LocalParam(o.Local).
+		ContinueOnError().
+		NamespaceParam(o.namespace).DefaultNamespace().
+		FilenameParam(enforceNamespace, &o.FilenameOptions).
+		IncludeUninitialized(includeUninitialized).
+		Flatten()
+
+	if o.Local {
+		// if a --local flag was provided, and a resource was specified in the form
+		// <resource>/<name>, fail immediately as --local cannot query the api server
+		// for the specified resource.
+		if len(args) > 0 {
+			return resource.LocalResourceError
+		}
+	} else {
+		builder = builder.
+			LabelSelectorParam(o.Selector).
+			ResourceTypeOrNameArgs(o.All, args...).
+			Latest()
+	}
+
+	o.Infos, err = builder.Do().Infos()
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (o *SubjectOptions) Validate() error {
+	if o.All && len(o.Selector) > 0 {
+		return fmt.Errorf("cannot set --all and --selector at the same time")
+	}
+	if len(o.Users) == 0 && len(o.Groups) == 0 && len(o.ServiceAccounts) == 0 {
+		return fmt.Errorf("you must specify at least one value of user, group or serviceaccount")
+	}
+
+	for _, sa := range o.ServiceAccounts {
+		tokens := strings.Split(sa, ":")
+		if len(tokens) != 2 || tokens[1] == "" {
+			return fmt.Errorf("serviceaccount must be <namespace>:<name>")
+		}
+
+		for _, info := range o.Infos {
+			_, ok := info.Object.(*rbac.ClusterRoleBinding)
+			if ok && tokens[0] == "" {
+				return fmt.Errorf("serviceaccount must be <namespace>:<name>, namespace must be specified")
+			}
+		}
+	}
+
+	return nil
+}
+
+func (o *SubjectOptions) Run(fn updateSubjects) error {
+	patches := CalculatePatches(o.Infos, scheme.DefaultJSONEncoder(), func(obj runtime.Object) ([]byte, error) {
+		subjects := []rbacv1.Subject{}
+		for _, user := range sets.NewString(o.Users...).List() {
+			subject := rbacv1.Subject{
+				Kind:     rbac.UserKind,
+				APIGroup: rbac.GroupName,
+				Name:     user,
+			}
+			subjects = append(subjects, subject)
+		}
+		for _, group := range sets.NewString(o.Groups...).List() {
+			subject := rbacv1.Subject{
+				Kind:     rbac.GroupKind,
+				APIGroup: rbac.GroupName,
+				Name:     group,
+			}
+			subjects = append(subjects, subject)
+		}
+		for _, sa := range sets.NewString(o.ServiceAccounts...).List() {
+			tokens := strings.Split(sa, ":")
+			namespace := tokens[0]
+			name := tokens[1]
+			if len(namespace) == 0 {
+				namespace = o.namespace
+			}
+			subject := rbacv1.Subject{
+				Kind:      rbac.ServiceAccountKind,
+				Namespace: namespace,
+				Name:      name,
+			}
+			subjects = append(subjects, subject)
+		}
+
+		transformed, err := updateSubjectForObject(obj, subjects, fn)
+		if transformed && err == nil {
+			// TODO: switch UpdatePodSpecForObject to work on v1.PodSpec
+			return runtime.Encode(scheme.DefaultJSONEncoder(), obj)
+		}
+		return nil, err
+	})
+
+	allErrs := []error{}
+	for _, patch := range patches {
+		info := patch.Info
+		if patch.Err != nil {
+			allErrs = append(allErrs, fmt.Errorf("error: %s/%s %v\n", info.Mapping.Resource, info.Name, patch.Err))
+			continue
+		}
+
+		//no changes
+		if string(patch.Patch) == "{}" || len(patch.Patch) == 0 {
+			allErrs = append(allErrs, fmt.Errorf("info: %s %q was not changed\n", info.Mapping.Resource, info.Name))
+			continue
+		}
+
+		if o.Local || o.DryRun {
+			if err := o.PrintObj(info.Object, o.Out); err != nil {
+				allErrs = append(allErrs, err)
+			}
+			continue
+		}
+
+		actual, err := resource.NewHelper(info.Client, info.Mapping).Patch(info.Namespace, info.Name, types.StrategicMergePatchType, patch.Patch)
+		if err != nil {
+			allErrs = append(allErrs, fmt.Errorf("failed to patch subjects to rolebinding: %v\n", err))
+			continue
+		}
+
+		if err := o.PrintObj(actual, o.Out); err != nil {
+			allErrs = append(allErrs, err)
+		}
+	}
+	return utilerrors.NewAggregate(allErrs)
+}
+
+//Note: the obj mutates in the function
+func updateSubjectForObject(obj runtime.Object, subjects []rbacv1.Subject, fn updateSubjects) (bool, error) {
+	switch t := obj.(type) {
+	case *rbacv1.RoleBinding:
+		transformed, result := fn(t.Subjects, subjects)
+		t.Subjects = result
+		return transformed, nil
+	case *rbacv1.ClusterRoleBinding:
+		transformed, result := fn(t.Subjects, subjects)
+		t.Subjects = result
+		return transformed, nil
+	default:
+		return false, fmt.Errorf("setting subjects is only supported for RoleBinding/ClusterRoleBinding")
+	}
+}
+
+func addSubjects(existings []rbacv1.Subject, targets []rbacv1.Subject) (bool, []rbacv1.Subject) {
+	transformed := false
+	updated := existings
+	for _, item := range targets {
+		if !contain(existings, item) {
+			updated = append(updated, item)
+			transformed = true
+		}
+	}
+	return transformed, updated
+}
+
+func contain(slice []rbacv1.Subject, item rbacv1.Subject) bool {
+	for _, v := range slice {
+		if v == item {
+			return true
+		}
+	}
+	return false
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_subject_test.go

@@ -0,0 +1,426 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"reflect"
+	"testing"
+
+	rbacv1 "k8s.io/api/rbac/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	cmdtesting "k8s.io/kubernetes/pkg/kubectl/cmd/testing"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions/resource"
+)
+
+func TestValidate(t *testing.T) {
+	tf := cmdtesting.NewTestFactory().WithNamespace("test")
+	defer tf.Cleanup()
+
+	tests := map[string]struct {
+		options   *SubjectOptions
+		expectErr bool
+	}{
+		"test-missing-subjects": {
+			options: &SubjectOptions{
+				Users:           []string{},
+				Groups:          []string{},
+				ServiceAccounts: []string{},
+			},
+			expectErr: true,
+		},
+		"test-invalid-serviceaccounts": {
+			options: &SubjectOptions{
+				Users:           []string{},
+				Groups:          []string{},
+				ServiceAccounts: []string{"foo"},
+			},
+			expectErr: true,
+		},
+		"test-missing-serviceaccounts-name": {
+			options: &SubjectOptions{
+				Users:           []string{},
+				Groups:          []string{},
+				ServiceAccounts: []string{"foo:"},
+			},
+			expectErr: true,
+		},
+		"test-missing-serviceaccounts-namespace": {
+			options: &SubjectOptions{
+				Infos: []*resource.Info{
+					{
+						Object: &rbacv1.ClusterRoleBinding{
+							ObjectMeta: metav1.ObjectMeta{
+								Name: "clusterrolebinding",
+							},
+							RoleRef: rbacv1.RoleRef{
+								APIGroup: "rbac.authorization.k8s.io",
+								Kind:     "ClusterRole",
+								Name:     "role",
+							},
+						},
+					},
+				},
+				Users:           []string{},
+				Groups:          []string{},
+				ServiceAccounts: []string{":foo"},
+			},
+			expectErr: true,
+		},
+		"test-valid-case": {
+			options: &SubjectOptions{
+				Infos: []*resource.Info{
+					{
+						Object: &rbacv1.RoleBinding{
+							ObjectMeta: metav1.ObjectMeta{
+								Name:      "rolebinding",
+								Namespace: "one",
+							},
+							RoleRef: rbacv1.RoleRef{
+								APIGroup: "rbac.authorization.k8s.io",
+								Kind:     "ClusterRole",
+								Name:     "role",
+							},
+						},
+					},
+				},
+				Users:           []string{"foo"},
+				Groups:          []string{"foo"},
+				ServiceAccounts: []string{"ns:foo"},
+			},
+			expectErr: false,
+		},
+	}
+
+	for name, test := range tests {
+		err := test.options.Validate()
+		if test.expectErr && err != nil {
+			continue
+		}
+		if !test.expectErr && err != nil {
+			t.Errorf("%s: unexpected error: %v", name, err)
+		}
+	}
+}
+
+func TestUpdateSubjectForObject(t *testing.T) {
+	tests := []struct {
+		Name     string
+		obj      runtime.Object
+		subjects []rbacv1.Subject
+		expected []rbacv1.Subject
+		wantErr  bool
+	}{
+		{
+			Name: "invalid object type",
+			obj: &rbacv1.Role{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "role",
+					Namespace: "one",
+				},
+			},
+			wantErr: true,
+		},
+		{
+			Name: "add resource with users in rolebinding",
+			obj: &rbacv1.RoleBinding{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "rolebinding",
+					Namespace: "one",
+				},
+				Subjects: []rbacv1.Subject{
+					{
+						APIGroup: "rbac.authorization.k8s.io",
+						Kind:     "User",
+						Name:     "a",
+					},
+				},
+			},
+			subjects: []rbacv1.Subject{
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "User",
+					Name:     "a",
+				},
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "User",
+					Name:     "b",
+				},
+			},
+			expected: []rbacv1.Subject{
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "User",
+					Name:     "a",
+				},
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "User",
+					Name:     "b",
+				},
+			},
+			wantErr: false,
+		},
+		{
+			Name: "add resource with groups in rolebinding",
+			obj: &rbacv1.RoleBinding{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "rolebinding",
+					Namespace: "one",
+				},
+				Subjects: []rbacv1.Subject{
+					{
+						APIGroup: "rbac.authorization.k8s.io",
+						Kind:     "Group",
+						Name:     "a",
+					},
+				},
+			},
+			subjects: []rbacv1.Subject{
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "Group",
+					Name:     "a",
+				},
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "Group",
+					Name:     "b",
+				},
+			},
+			expected: []rbacv1.Subject{
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "Group",
+					Name:     "a",
+				},
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "Group",
+					Name:     "b",
+				},
+			},
+			wantErr: false,
+		},
+		{
+			Name: "add resource with serviceaccounts in rolebinding",
+			obj: &rbacv1.RoleBinding{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "rolebinding",
+					Namespace: "one",
+				},
+				Subjects: []rbacv1.Subject{
+					{
+						Kind:      "ServiceAccount",
+						Namespace: "one",
+						Name:      "a",
+					},
+				},
+			},
+			subjects: []rbacv1.Subject{
+				{
+					Kind:      "ServiceAccount",
+					Namespace: "one",
+					Name:      "a",
+				},
+				{
+					Kind:      "ServiceAccount",
+					Namespace: "one",
+					Name:      "b",
+				},
+			},
+			expected: []rbacv1.Subject{
+				{
+					Kind:      "ServiceAccount",
+					Namespace: "one",
+					Name:      "a",
+				},
+				{
+					Kind:      "ServiceAccount",
+					Namespace: "one",
+					Name:      "b",
+				},
+			},
+			wantErr: false,
+		},
+		{
+			Name: "add resource with serviceaccounts in clusterrolebinding",
+			obj: &rbacv1.ClusterRoleBinding{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "clusterrolebinding",
+				},
+				Subjects: []rbacv1.Subject{
+					{
+						APIGroup: "rbac.authorization.k8s.io",
+						Kind:     "User",
+						Name:     "a",
+					},
+					{
+						APIGroup: "rbac.authorization.k8s.io",
+						Kind:     "Group",
+						Name:     "a",
+					},
+				},
+			},
+			subjects: []rbacv1.Subject{
+				{
+					Kind:      "ServiceAccount",
+					Namespace: "one",
+					Name:      "a",
+				},
+			},
+			expected: []rbacv1.Subject{
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "User",
+					Name:     "a",
+				},
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "Group",
+					Name:     "a",
+				},
+				{
+					Kind:      "ServiceAccount",
+					Namespace: "one",
+					Name:      "a",
+				},
+			},
+			wantErr: false,
+		},
+	}
+	for _, tt := range tests {
+		if _, err := updateSubjectForObject(tt.obj, tt.subjects, addSubjects); (err != nil) != tt.wantErr {
+			t.Errorf("%q. updateSubjectForObject() error = %v, wantErr %v", tt.Name, err, tt.wantErr)
+		}
+
+		want := tt.expected
+		var got []rbacv1.Subject
+		switch t := tt.obj.(type) {
+		case *rbacv1.RoleBinding:
+			got = t.Subjects
+		case *rbacv1.ClusterRoleBinding:
+			got = t.Subjects
+		}
+		if !reflect.DeepEqual(got, want) {
+			t.Errorf("%q. updateSubjectForObject() failed", tt.Name)
+			t.Errorf("Got: %v", got)
+			t.Errorf("Want: %v", want)
+		}
+	}
+}
+
+func TestAddSubject(t *testing.T) {
+	tests := []struct {
+		Name       string
+		existing   []rbacv1.Subject
+		subjects   []rbacv1.Subject
+		expected   []rbacv1.Subject
+		wantChange bool
+	}{
+		{
+			Name: "add resource with users",
+			existing: []rbacv1.Subject{
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "User",
+					Name:     "a",
+				},
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "User",
+					Name:     "b",
+				},
+			},
+			subjects: []rbacv1.Subject{
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "User",
+					Name:     "a",
+				},
+			},
+			expected: []rbacv1.Subject{
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "User",
+					Name:     "a",
+				},
+				{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "User",
+					Name:     "b",
+				},
+			},
+			wantChange: false,
+		},
+		{
+			Name: "add resource with serviceaccounts",
+			existing: []rbacv1.Subject{
+				{
+					Kind:      "ServiceAccount",
+					Namespace: "one",
+					Name:      "a",
+				},
+				{
+					Kind:      "ServiceAccount",
+					Namespace: "one",
+					Name:      "b",
+				},
+			},
+			subjects: []rbacv1.Subject{
+				{
+					Kind:      "ServiceAccount",
+					Namespace: "two",
+					Name:      "a",
+				},
+			},
+			expected: []rbacv1.Subject{
+				{
+					Kind:      "ServiceAccount",
+					Namespace: "one",
+					Name:      "a",
+				},
+				{
+					Kind:      "ServiceAccount",
+					Namespace: "one",
+					Name:      "b",
+				},
+				{
+					Kind:      "ServiceAccount",
+					Namespace: "two",
+					Name:      "a",
+				},
+			},
+			wantChange: true,
+		},
+	}
+	for _, tt := range tests {
+		changed := false
+		got := []rbacv1.Subject{}
+		if changed, got = addSubjects(tt.existing, tt.subjects); (changed != false) != tt.wantChange {
+			t.Errorf("%q. addSubjects() changed = %v, wantChange = %v", tt.Name, changed, tt.wantChange)
+		}
+
+		want := tt.expected
+		if !reflect.DeepEqual(got, want) {
+			t.Errorf("%q. addSubjects() failed", tt.Name)
+			t.Errorf("Got: %v", got)
+			t.Errorf("Want: %v", want)
+		}
+	}
+}

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/set/set_test.go

@@ -0,0 +1,45 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+import (
+	"testing"
+
+	"github.com/spf13/cobra"
+
+	clientcmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"
+	"k8s.io/kubernetes/pkg/kubectl/genericclioptions"
+)
+
+func TestLocalAndDryRunFlags(t *testing.T) {
+	f := clientcmdutil.NewFactory(genericclioptions.NewTestConfigFlags())
+	setCmd := NewCmdSet(f, genericclioptions.NewTestIOStreamsDiscard())
+	ensureLocalAndDryRunFlagsOnChildren(t, setCmd, "")
+}
+
+func ensureLocalAndDryRunFlagsOnChildren(t *testing.T, c *cobra.Command, prefix string) {
+	for _, cmd := range c.Commands() {
+		name := prefix + cmd.Name()
+		if localFlag := cmd.Flag("local"); localFlag == nil {
+			t.Errorf("Command %s does not implement the --local flag", name)
+		}
+		if dryRunFlag := cmd.Flag("dry-run"); dryRunFlag == nil {
+			t.Errorf("Command %s does not implement the --dry-run flag", name)
+		}
+		ensureLocalAndDryRunFlagsOnChildren(t, cmd, name+".")
+	}
+}