Claimed resources api

deploy/crd/kube-bind.io_apiserviceexporttemplates.yaml

@@ -0,0 +1,186 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.10.0
+  creationTimestamp: null
+  name: apiserviceexporttemplates.kube-bind.io
+spec:
+  group: kube-bind.io
+  names:
+    categories:
+    - kube-bindings
+    kind: APIServiceExportTemplate
+    listKind: APIServiceExportTemplateList
+    plural: apiserviceexporttemplates
+    singular: apiserviceexporttemplate
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.conditions[?(@.type=="Established")].status
+      name: Established
+      priority: 5
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: APIServiceExportTemplate specifies the resource to be exported.
+          It references the CRD to be exported along with additional resources that
+          are synchronized from and to the consumer cluster.
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: spec specifies the resource.
+            properties:
+              APIServiceSelector:
+                properties:
+                  group:
+                    type: string
+                  resource:
+                    type: string
+                  versions:
+                    items:
+                      type: string
+                    type: array
+                type: object
+              permissionClaims:
+                items:
+                  description: "PermissionClaim selects objects of a GVR that a service
+                    provider may request and that a consumer may accept and allow
+                    the service provider access to. \n TODO fix validation +kubebuilder:validation:XValidation:rule=\"!(self.create.donate
+                    && self.adopt)\",message=\"donate and adopt are mutually exclusive\""
+                  properties:
+                    adopt:
+                      description: adopt set to true means that objects created by
+                        the consumer are adopted by the provider. i.e. the provider
+                        will become the owner.
+                      type: boolean
+                    create:
+                      description: "only for owner Provider \n create determines whether
+                        the kube-bind konnector will sync matching objects from the
+                        provider side down to the consumer cluster."
+                      properties:
+                        donate:
+                          description: donate set to true means that a newly created
+                            object by the provider is immediately owned by the consumer.
+                            If false, the object stays in ownership of the provider
+                          type: boolean
+                      type: object
+                    global:
+                      description: Global claims global resources for the given group/resource.
+                        This is mutually exclusive with resourceSelector.
+                      type: boolean
+                    group:
+                      default: ""
+                      description: group is the name of an API group. For core groups
+                        this is the empty string '""'.
+                      pattern: ^(|[a-z0-9]([-a-z0-9]*[a-z0-9](\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)?)$
+                      type: string
+                    onConflict:
+                      description: onConflict determines how the conflicts between
+                        objects on the consumer side will be resolved.
+                      properties:
+                        providerOverrides:
+                          description: providerOverrides will make the provider override
+                            any object that might already exist in the consumer cluster
+                            if it has the same namespaced name as a resource created
+                            by the provider, but is not the result of syncing.
+                          type: boolean
+                        recreateWhenConsumerSideDeleted:
+                          description: recreateWhenConsumerSideDeleted set to true
+                            means the provider will recreate the object in case the
+                            object is missing on the consumer side. Even if the consumer
+                            mistakenly or intentionally deletes the objet, the provider
+                            will recreate it. If the field is set as false, the provider
+                            will not recreate the object in case the object is deleted
+                            on the RecreateWhenConsumerSideDeleted side.
+                          type: boolean
+                      type: object
+                    required:
+                      description: required indicates whether the APIServiceBinding
+                        will work if this claim is not accepted.
+                      type: boolean
+                    resource:
+                      description: 'resource is the name of the resource. Note: it
+                        is worth noting that you can not ask for permissions for resource
+                        provided by a CRD not provided by an service binding export.'
+                      pattern: ^[a-z][-a-z0-9]*[a-z0-9]$
+                      type: string
+                    selector:
+                      description: selector selects which resources are affected by
+                        this claim.
+                      properties:
+                        name:
+                          description: name of an object within a claimed group/resource.
+                            It matches the metadata.name field of the underlying object.
+                            If name is unset, all objects in bound namespaces will
+                            be claimed.
+                          maxLength: 253
+                          minLength: 1
+                          pattern: ^([a-z0-9][-a-z0-9_.]*)?[a-z0-9]$
+                          type: string
+                        owner:
+                          enum:
+                          - Provider
+                          - Consumer
+                          type: string
+                      type: object
+                    update:
+                      description: update lists a number of claimed permissions for
+                        the provider. "field" and "preserving" are mutually exclusive.
+                      properties:
+                        alwaysRecreate:
+                          description: alwaysRecreate, when true will make the konnector
+                            delete the old object and create a new one instead of
+                            updating. Useful for immutable objects.
+                          type: boolean
+                        fields:
+                          description: fields are the fields owned by the owner of
+                            the claim. If the owner sets values of those fields, they
+                            will be synced to the other participant. Mutually exclusive
+                            with preservings.
+                          items:
+                            type: string
+                          type: array
+                        preservings:
+                          description: Preservings are the fields that are preserved
+                            by the konnector during synchronization. The owner is
+                            not able to set those fields. If the owner changes the
+                            value of these fields, their change will be overwritten.
+                          items:
+                            type: string
+                          type: array
+                      type: object
+                    version:
+                      type: string
+                  required:
+                  - resource
+                  - version
+                  type: object
+                type: array
+            type: object
+          status:
+            description: status contains reconciliation information for the resource.
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

pkg/apis/kubebind/v1alpha1/apiservicebinding_types.go

@@ -87,8 +87,35 @@ type APIServiceBindingSpec struct {
 	// +kubebuilder:validation:Required
 	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="kubeconfigSecretRef is immutable"
 	KubeconfigSecretRef ClusterSecretKeyRef `json:"kubeconfigSecretRef"`
+
+	// permissionClaims records decisions about permission claims requested by the API service provider.
+	// Individual claims can be accepted or rejected. If accepted, the API service provider gets the
+	// requested access to the specified resources in this workspace. Access is granted per
+	// GroupResource and other properties like selectors.
+	//
+	// +optional
+	PermissionClaims []AcceptablePermissionClaim `json:"permissionClaims,omitempty"`
+}
+
+// AcceptablePermissionClaim is a permission claim that stores the users acceptance in the field state. Only accepted permission claims are reconciled.
+type AcceptablePermissionClaim struct {
+	PermissionClaim `json:",inline"`
+
+	// state indicates if the claim is accepted or rejected.
+	//
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Enum=Accepted;Rejected
+	State AcceptablePermissionClaimState `json:"state"`
 }
 
+type AcceptablePermissionClaimState string
+
+const (
+	ClaimAccepted AcceptablePermissionClaimState = "Accepted"
+	ClaimRejected AcceptablePermissionClaimState = "Rejected"
+)
+
 type APIServiceBindingStatus struct {
 	// providerPrettyName is the pretty name of the service provider cluster. This
 	// can be shared among different APIServiceBindings.

pkg/apis/kubebind/v1alpha1/apiserviceexport_types.go

@@ -79,6 +79,17 @@ func (in *APIServiceExport) SetConditions(conditions conditionsapi.Conditions) {
 type APIServiceExportSpec struct {
 	APIServiceExportCRDSpec `json:",inline"`
 
+	// permissionClaims is a list of permission claims that the service provider
+	// asks the consumer to accept in the consumer cluster binding to this export.
+	// The consumer can accept or deny each claim. Some claims are required and
+	// with that a successful binding is not possible. Others are optional.
+	//
+	// Note that a claim added at a later point is not guaranteed to be seen and
+	// processed (accepted or rejected) by the consumer.
+	//
+	// +optional
+	PermissionClaims []ExportPermissionClaim `json:"permissionClaims,omitempty"`
+
 	// informerScope is the scope of the APIServiceExport. It can be either Cluster or Namespace.
 	//
 	// Cluster:    The konnector has permission to watch all namespaces at once and cluster-scoped resources.
@@ -92,6 +103,14 @@ type APIServiceExportSpec struct {
 	InformerScope Scope `json:"informerScope"`
 }
 
+type ExportPermissionClaim struct {
+	PermissionClaim `json:",inline"`
+
+	// required indicates whether the APIServiceBinding will work if this claim
+	// is not accepted. If a required claim is denied, the binding is aborted.
+	Required bool `json:"required"`
+}
+
 type APIServiceExportCRDSpec struct {
 	// group is the API group of the defined custom resource. Empty string means the
 	// core API group. 	The resources are served under `/apis/<group>/...` or `/api` for the core group.

pkg/apis/kubebind/v1alpha1/apiserviceexportrequest_types.go

@@ -110,6 +110,12 @@ type APIServiceExportRequestResource struct {
 	// versions is a list of versions that should be exported. If this is empty
 	// a sensible default is chosen by the service provider.
 	Versions []string `json:"versions,omitempty"`
+
+	// permissionClaims records decisions about permission claims requested by the service provider.
+	// Individual claims can be accepted or rejected. If accepted, the API service provider gets the
+	// requested access to the specified resources in this workspace. Access is granted per
+	// GroupResource, identity, and other properties.
+	PermissionClaims []PermissionClaim `json:"permissionClaims,omitempty"`
 }
 
 // GroupResource identifies a resource.