Skip to content

add permission claims to APIServices apis #290

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
cnvergence wants to merge 1 commit into from
Closed

add permission claims to APIServices apis #290

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
223 changes: 223 additions & 0 deletions deploy/crd/kube-bind.io_apiservicebindings.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -227,6 +227,115 @@ spec:
x-kubernetes-validations:
- message: kubeconfigSecretRef is immutable
rule: self == oldSelf
permissionClaims:
description: PermissionClaims records decisions about permission claims
requested by the API service provider.
items:
description: |-
ScopedPermissionClaim embeds a PermissionClaim and adds a selector to
scope down access to objects of the claimed resource.
properties:
group:
default: ""
description: |-
group is the name of an API group.
For core groups this is the empty string '""'.
pattern: ^(|[a-z0-9]([-a-z0-9]*[a-z0-9](\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)?)$
type: string
identityHash:
default: ""
description: |-
This is the identity for a given APIExport that the APIResourceSchema belongs to.
The hash can be found on APIExport and APIResourceSchema's status.
It will be empty for core types.
Note that one must look this up for a particular KCP instance.
type: string
resource:
description: |-
resource is the name of the resource.
Note: it is worth noting that you can not ask for permissions for resource provided by a CRD
not provided by an service binding export.
pattern: ^[a-z][-a-z0-9]*[a-z0-9]$
type: string
selector:
description: |-
PermissionClaimSelector configures scoped access to objects
of a claimed resource.
properties:
matchAll:
description: matchAll grants access to all objects of the
claimed resource.
type: boolean
matchExpressions:
description: matchExpressions is a list of label selector
requirements. The requirements are ANDed.
items:
description: |-
A label selector requirement is a selector that contains values, a key, and an operator that
relates the key and values.
properties:
key:
description: key is the label key that the selector
applies to.
type: string
operator:
description: |-
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
type: string
values:
description: |-
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
items:
type: string
type: array
x-kubernetes-list-type: atomic
required:
- key
- operator
type: object
type: array
x-kubernetes-list-type: atomic
matchLabels:
additionalProperties:
type: string
description: |-
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
type: object
type: object
x-kubernetes-map-type: atomic
x-kubernetes-validations:
- message: Permission claim selector is immutable
rule: self == oldSelf
- message: a selector is required. Only "matchAll" is currently
implemented
rule: (has(self.matchAll) && self.matchAll)
verbs:
description: |-
verbs is a list of supported API operation types (this includes
but is not limited to get, list, watch, create, update, patch,
delete, deletecollection, and proxy).
items:
type: string
minItems: 1
type: array
x-kubernetes-list-type: set
required:
- resource
- selector
- verbs
type: object
type: array
x-kubernetes-list-map-keys:
- group
- resource
- identityHash
x-kubernetes-list-type: map
required:
- kubeconfigSecretRef
type: object
Expand Down Expand Up @@ -307,6 +416,120 @@ spec:
- type
type: object
type: array
permissionClaims:
description: permissionClaims tracks the status of permission claims
from the provider.
items:
description: AcceptablePermissionClaim is a PermissionClaim that
records if the user accepts or rejects it.
properties:
group:
default: ""
description: |-
group is the name of an API group.
For core groups this is the empty string '""'.
pattern: ^(|[a-z0-9]([-a-z0-9]*[a-z0-9](\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)?)$
type: string
identityHash:
default: ""
description: |-
This is the identity for a given APIExport that the APIResourceSchema belongs to.
The hash can be found on APIExport and APIResourceSchema's status.
It will be empty for core types.
Note that one must look this up for a particular KCP instance.
type: string
resource:
description: |-
resource is the name of the resource.
Note: it is worth noting that you can not ask for permissions for resource provided by a CRD
not provided by an service binding export.
pattern: ^[a-z][-a-z0-9]*[a-z0-9]$
type: string
selector:
description: |-
PermissionClaimSelector configures scoped access to objects
of a claimed resource.
properties:
matchAll:
description: matchAll grants access to all objects of the
claimed resource.
type: boolean
matchExpressions:
description: matchExpressions is a list of label selector
requirements. The requirements are ANDed.
items:
description: |-
A label selector requirement is a selector that contains values, a key, and an operator that
relates the key and values.
properties:
key:
description: key is the label key that the selector
applies to.
type: string
operator:
description: |-
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
type: string
values:
description: |-
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
items:
type: string
type: array
x-kubernetes-list-type: atomic
required:
- key
- operator
type: object
type: array
x-kubernetes-list-type: atomic
matchLabels:
additionalProperties:
type: string
description: |-
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
type: object
type: object
x-kubernetes-map-type: atomic
x-kubernetes-validations:
- message: Permission claim selector is immutable
rule: self == oldSelf
- message: a selector is required. Only "matchAll" is currently
implemented
rule: (has(self.matchAll) && self.matchAll)
state:
enum:
- Accepted
- Rejected
type: string
verbs:
description: |-
verbs is a list of supported API operation types (this includes
but is not limited to get, list, watch, create, update, patch,
delete, deletecollection, and proxy).
items:
type: string
minItems: 1
type: array
x-kubernetes-list-type: set
required:
- resource
- selector
- state
- verbs
type: object
type: array
x-kubernetes-list-map-keys:
- group
- resource
- identityHash
x-kubernetes-list-type: map
providerPrettyName:
description: |-
providerPrettyName is the pretty name of the service provider cluster. This
Expand Down
47 changes: 47 additions & 0 deletions deploy/crd/kube-bind.io_apiserviceexportrequests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -221,6 +221,53 @@ spec:
x-kubernetes-validations:
- message: parameters are immutable
rule: self == oldSelf
permissionClaims:
items:
description: |-
PermissionClaim defines a permission that the consumer cluster requests from the provider.
This is compatible with KCP's PermissionClaim structure.
properties:
group:
default: ""
description: |-
group is the name of an API group.
For core groups this is the empty string '""'.
pattern: ^(|[a-z0-9]([-a-z0-9]*[a-z0-9](\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)?)$
type: string
identityHash:
default: ""
description: |-
This is the identity for a given APIExport that the APIResourceSchema belongs to.
The hash can be found on APIExport and APIResourceSchema's status.
It will be empty for core types.
Note that one must look this up for a particular KCP instance.
type: string
resource:
description: |-
resource is the name of the resource.
Note: it is worth noting that you can not ask for permissions for resource provided by a CRD
not provided by an service binding export.
pattern: ^[a-z][-a-z0-9]*[a-z0-9]$
type: string
verbs:
description: |-
verbs is a list of supported API operation types (this includes
but is not limited to get, list, watch, create, update, patch,
delete, deletecollection, and proxy).
items:
type: string
minItems: 1
type: array
x-kubernetes-list-type: set
required:
- resource
- verbs
type: object
type: array
x-kubernetes-list-map-keys:
- group
- resource
x-kubernetes-list-type: map
resources:
description: resources is a list of resources that should be exported.
items:
Expand Down
69 changes: 63 additions & 6 deletions deploy/crd/kube-bind.io_apiserviceexports.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -467,13 +467,23 @@ spec:
description: spec specifies the resource.
properties:
clusterScopedIsolation:
allOf:
- enum:
- Prefixed
- Namespaced
- None
- Cluster
- enum:
- Prefixed
- Namespaced
- None
- Cluster
description: |-
ClusterScopedIsolation specifies how cluster scoped service objects are isolated between multiple consumers on the provider side.
It can be "Prefixed", "Namespaced", or "None".
enum:
- Prefixed
- Namespaced
- None
ClusterScopedIsolation defines how objects are isolated at the provider side.
If any of the spec.resources are cluster-scoped, they will automatically be cluster-scoped.
In future releases, if policies are implemented, APIServiceExportObject are used
(policy.provider.sync = object) to abstract objects coming from the consumer side -
isolation can be increased, even for cluster-scoped CRDs.
type: string
informerScope:
description: |-
Expand All @@ -490,6 +500,53 @@ spec:
x-kubernetes-validations:
- message: informerScope is immutable
rule: self == oldSelf
permissionClaims:
items:
description: |-
PermissionClaim defines a permission that the consumer cluster requests from the provider.
This is compatible with KCP's PermissionClaim structure.
properties:
group:
default: ""
description: |-
group is the name of an API group.
For core groups this is the empty string '""'.
pattern: ^(|[a-z0-9]([-a-z0-9]*[a-z0-9](\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)?)$
type: string
identityHash:
default: ""
description: |-
This is the identity for a given APIExport that the APIResourceSchema belongs to.
The hash can be found on APIExport and APIResourceSchema's status.
It will be empty for core types.
Note that one must look this up for a particular KCP instance.
type: string
resource:
description: |-
resource is the name of the resource.
Note: it is worth noting that you can not ask for permissions for resource provided by a CRD
not provided by an service binding export.
pattern: ^[a-z][-a-z0-9]*[a-z0-9]$
type: string
verbs:
description: |-
verbs is a list of supported API operation types (this includes
but is not limited to get, list, watch, create, update, patch,
delete, deletecollection, and proxy).
items:
type: string
minItems: 1
type: array
x-kubernetes-list-type: set
required:
- resource
- verbs
type: object
type: array
x-kubernetes-list-map-keys:
- group
- resource
x-kubernetes-list-type: map
resources:
description: resources specifies the API resources to export
items:
Expand Down
6 changes: 3 additions & 3 deletions kcp/deploy/resources/apiexport-kube-bind.io.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,17 +50,17 @@ spec:
crd: {}
- group: kube-bind.io
name: apiservicebindings
schema: v250809-5ed76a1.apiservicebindings.kube-bind.io
schema: v250820-3baf1a4.apiservicebindings.kube-bind.io
storage:
crd: {}
- group: kube-bind.io
name: apiserviceexportrequests
schema: v250809-5ed76a1.apiserviceexportrequests.kube-bind.io
schema: v250820-3baf1a4.apiserviceexportrequests.kube-bind.io
storage:
crd: {}
- group: kube-bind.io
name: apiserviceexports
schema: v250809-5ed76a1.apiserviceexports.kube-bind.io
schema: v250820-3baf1a4.apiserviceexports.kube-bind.io
storage:
crd: {}
- group: kube-bind.io
Expand Down
Loading