Merge pull request #52 from Kuadrant/developer-portal-rbac

Developer portal new APIs

Author: R-Lawton

.github/workflows/verify.yml

@@ -59,16 +59,3 @@ jobs:
       - name: Verify generate command
         run: |
           make verify-generate
-  verify-go-mod:
-    name: Verify go.mod
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v5
-      - name: Setup Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-      - name: Verify generate command
-        run: |
-          make verify-go-mod

AGENTS.md

@@ -8,7 +8,23 @@ This is a Kubernetes controller that reconciles Developer Portal capabilities ba
 
 **Domain**: kuadrant.io
 **API Group**: devportal.kuadrant.io
-**Primary Resource**: APIProduct (v1alpha1)
+**Resources (v1alpha1)**: 
+- `APIProduct`: Represents an API offering in the developer portal
+- `APIKey`: Represents a developer's request for API access (created in consumer namespace)
+- `APIKeyRequest`: Shadow resource for RBAC-based request review (created in owner namespace)
+- `APIKeyApproval`: API owner's decision to approve/deny access requests
+
+## Design Documents
+
+**RBAC Design**: The project implements namespace-based RBAC for API management. Read the full design at:
+https://github.com/Kuadrant/kuadrant-console-plugin/blob/main/docs/designs/2026-03-26-api-management-rbac-design.md
+
+Key concepts from the design:
+- **Namespace isolation**: Consumers create APIKeys in their namespace, owners review APIKeyRequests in their namespace
+- **Shadow resources**: APIKeyRequest mirrors APIKey in owner's namespace for RBAC-enforced discovery
+- **Cross-namespace references**: APIKey references APIProduct across namespaces; APIKeyApproval references APIKey across namespaces
+- **Secret projection**: API key values projected to status field, eliminating need for secret read permissions
+- **Conditions pattern**: Uses conditions array (Pending/Approved/Denied/Failed) following CertificateSigningRequest pattern
 
 ## Development Commands
 
@@ -47,25 +63,33 @@ make install           # Install CRDs to cluster
 make deploy            # Deploy controller to cluster
 make uninstall         # Remove CRDs from cluster
 make undeploy          # Remove controller from cluster
+make local-deploy      # Deploy controller from current code
 ```
 
-### Bundle Operations (Operator Lifecycle Manager)
+### Build Utilities
 ```bash
-make bundle            # Generate bundle manifests
-make bundle-build      # Build bundle image
+make build-installer   # Generate consolidated YAML with CRDs and deployment
+make gateway-api-crds  # Download Gateway API CRDs for testing
+make setup-test-e2e    # Set up Kind cluster for e2e tests if it doesn't exist
+make cleanup-test-e2e  # Tear down the Kind cluster used for e2e tests
 ```
 
 ## Architecture
 
 ### Project Structure
 - **api/v1alpha1/**: Kubernetes API definitions
     - `apiproduct_types.go`: APIProduct CRD schema (Spec, Status, and List types)
+    - `apikey_types.go`: APIKey CRD schema for consumer access requests
+    - `apikeyrequest_types.go`: APIKeyRequest CRD schema for owner-side request review
+    - `apikeyapproval_types.go`: APIKeyApproval CRD schema for approval decisions
     - `groupversion_info.go`: API group registration
     - `zz_generated.deepcopy.go`: Auto-generated DeepCopy methods
 
 - **internal/controller/**: Reconciliation logic
-    - `apiproduct_controller.go`: APIProductReconciler with Reconcile loop
-    - Controller uses client.Client for K8s API access
+    - `apiproduct_controller.go`: APIProductReconciler for API product lifecycle
+    - `apikey_controller.go`: APIKeyReconciler for consumer API key requests
+    - `apikeyrequest_controller.go`: APIKeyRequestReconciler for request processing
+    - Controllers use client.Client for K8s API access
     - RBAC permissions defined via kubebuilder markers (`+kubebuilder:rbac`)
 
 - **cmd/main.go**: Operator entry point
@@ -84,12 +108,30 @@ make bundle-build      # Build bundle image
     - `config/prometheus/`: Prometheus ServiceMonitor
 
 ### Controller Pattern
-The operator follows the standard Kubernetes controller pattern:
-1. Watch APIProduct resources
-2. Reconcile loop called on create/update/delete events
-3. Compare desired state (Spec) vs actual state
-4. Take actions to converge actual state to desired state
-5. Update Status to reflect observed state
+The operator follows the standard Kubernetes controller pattern with multiple reconcilers:
+
+**APIProductReconciler**:
+1. Watches APIProduct resources
+2. Discovers associated PlanPolicy and AuthPolicy from HTTPRoute
+3. Fetches and stores OpenAPI spec
+4. Updates status with discovered plans and auth scheme
+
+**APIKeyReconciler**:
+1. Watches APIKey resources (consumer namespace)
+2. Creates APIKeyRequest shadow resource in owner namespace
+3. Processes APIKeyApproval decisions
+4. Creates API key secrets and projects values to status
+5. Updates conditions (Pending/Approved/Denied)
+
+**APIKeyRequestReconciler**:
+1. Watches APIKeyRequest resources (owner namespace)
+2. Handles automatic approval mode
+3. Syncs status with related APIKey
+
+All controllers:
+- Compare desired state (Spec) vs actual state
+- Take actions to converge actual state to desired state
+- Update Status to reflect observed state
 
 ### Key Dependencies
 - **controller-runtime v0.21.0**: Core controller framework
@@ -100,12 +142,22 @@ The operator follows the standard Kubernetes controller pattern:
 ## Important Notes
 
 ### Modifying APIs
-1. Edit types in `api/v1alpha1/apiproduct_types.go`
+1. Edit types in `api/v1alpha1/*_types.go`
 2. Run `make manifests generate` to regenerate code and CRDs
-3. The APIProduct CRD currently has a placeholder `Foo` field - this should be replaced with actual fields
-
-### Controller Implementation
-The reconciler in `internal/controller/apiproduct_controller.go` is scaffolded but not implemented. The Reconcile function needs business logic added.
+3. Update RBAC role definitions in `config/rbac/` if new permissions are needed
+4. Update sample manifests in `config/samples/` to reflect new fields
+
+### RBAC Architecture
+The project implements namespace-based RBAC with three personas:
+- **API Consumer**: Creates APIKey in their namespace, can read their own APIKey status
+- **API Owner**: Views APIKeyRequest in their namespace, creates APIKeyApproval decisions
+- **API Admin**: Manages APIProduct resources and overall API catalog
+
+Critical security invariants:
+- Consumers CANNOT see other consumers' APIKeys (namespace isolation)
+- Owners CANNOT see APIKey secrets (shadow resource pattern)
+- APIKeyApproval namespace MUST match APIProduct namespace (validated by controller)
+- API key values projected to status field (no secret read permissions required)
 
 ### Testing Environment
 - E2e tests use Kind cluster named `developer-portal-controller-test-e2e`

CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

CLAUDE.md

@@ -93,31 +93,44 @@ test: manifests generate fmt vet setup-envtest gateway-api-crds kuadrant-crds ##
 	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" go test $$(go list ./... | grep -v /e2e) -coverprofile cover.out
 
 # TODO(user): To use a different vendor for e2e tests, modify the setup under 'tests/e2e'.
-# CertManager is installed by default; skip with:
-# - CERT_MANAGER_INSTALL_SKIP=true
+# CertManager is installed by default; skip with: CERT_MANAGER_INSTALL_SKIP=true
+CERT_MANAGER_INSTALL_SKIP ?= true
 KIND_CLUSTER ?= developer-portal-controller-test-e2e
 
 .PHONY: setup-test-e2e
-setup-test-e2e: ## Set up a Kind cluster for e2e tests if it does not exist
-	@command -v $(KIND) >/dev/null 2>&1 || { \
-		echo "Kind is not installed. Please install Kind manually."; \
-		exit 1; \
-	}
+setup-test-e2e: kind ## Set up a Kind cluster for e2e tests if it does not exist
 	@case "$$($(KIND) get clusters)" in \
 		*"$(KIND_CLUSTER)"*) \
 			echo "Kind cluster '$(KIND_CLUSTER)' already exists. Skipping creation." ;; \
 		*) \
 			echo "Creating Kind cluster '$(KIND_CLUSTER)'..."; \
 			$(KIND) create cluster --name $(KIND_CLUSTER) ;; \
 	esac
+	@echo ""
+	@echo "installing developer portal controller APIs..."
+	@$(MAKE) install
+	@echo ""
+	@echo "installing Gateway API APIs..."
+	@$(MAKE) gateway-api-install
+	@echo ""
+	@echo "installing kuadrant core APIs..."
+	@$(MAKE) kuadrant-core-install
+	@echo ""
+	@echo "cluster ready! Kuadrant and Gateway API APIs installed."
+	@echo ""
 
 .PHONY: test-e2e
 test-e2e: setup-test-e2e manifests generate fmt vet ## Run the e2e tests. Expected an isolated environment using Kind.
-	KIND_CLUSTER=$(KIND_CLUSTER) go test ./test/e2e/ -v -ginkgo.v
-	$(MAKE) cleanup-test-e2e
+	@set +e; \
+	PATH="$(LOCALBIN):$$PATH" \
+	KIND_CLUSTER=$(KIND_CLUSTER) \
+	CERT_MANAGER_INSTALL_SKIP=$(CERT_MANAGER_INSTALL_SKIP) \
+	go test ./test/e2e/ -v -ginkgo.v; status=$$?; \
+	$(MAKE) cleanup-test-e2e; \
+	exit $$status
 
 .PHONY: cleanup-test-e2e
-cleanup-test-e2e: ## Tear down the Kind cluster used for e2e tests
+cleanup-test-e2e: kind ## Tear down the Kind cluster used for e2e tests
 	@$(KIND) delete cluster --name $(KIND_CLUSTER)
 
 .PHONY: lint
@@ -208,7 +221,9 @@ undeploy: kustomize ## Undeploy controller from the K8s cluster specified in ~/.
 	$(KUSTOMIZE) build config/default | $(KUBECTL) delete --ignore-not-found=$(ignore-not-found) -f -
 
 .PHONY: local-deploy
-local-deploy: ## Deploy Kuadrant Operator from the current code
+local-deploy: ## Deploy Developer Portal controller from the current code
+	@echo ""
+	@echo "Deploy Developer Portal controller from the current code..."
 	$(MAKE) docker-build IMG=$(IMAGE_TAG_BASE):dev
 	$(MAKE) kind-load-image IMG=$(IMAGE_TAG_BASE):dev
 	$(MAKE) deploy IMG=$(IMAGE_TAG_BASE):dev

Makefile

@@ -29,4 +29,21 @@ resources:
   kind: APIKey
   path: github.com/kuadrant/developer-portal-controller/api/v1alpha1
   version: v1alpha1
+- api:
+    crdVersion: v1
+    namespaced: true
+  domain: kuadrant.io
+  group: devportal
+  kind: APIKeyRequest
+  path: github.com/kuadrant/developer-portal-controller/api/v1alpha1
+  version: v1alpha1
+- api:
+    crdVersion: v1
+    namespaced: true
+  controller: true
+  domain: kuadrant.io
+  group: devportal
+  kind: APIKeyApproval
+  path: github.com/kuadrant/developer-portal-controller/api/v1alpha1
+  version: v1alpha1
 version: "3"