feat: Update username impersonalization for creation projects and install resources index policies (#186)

This updates the impersonation username when creating a project and
prevents project creation if the user is not approved.

Additionally, it adds the installation for resource index policies.

Related to: datum-cloud/enhancements#524

Author: JoseSzycho

config/services/kustomization.yaml

@@ -12,3 +12,4 @@ components:
   - resourcemanager.miloapis.com/
   - iam.miloapis.com/
   - dns.networking.miloapis.com/
+  - search.miloapis.com/

config/services/search.miloapis.com/kustomization.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+resources:
+  - user-resourceindexpolicy.yaml
+
+# Use explicit sorting options so we can guarantee order in which resources are
+# applied.
+sortOptions:
+  order: fifo
+
+labels:
+  - includeSelectors: true
+    pairs:
+      app.kubernetes.io/component: search-miloapis-com
+      app.kubernetes.io/part-of: datum-cloud

config/services/search.miloapis.com/user-resourceindexpolicy.yaml

@@ -0,0 +1,21 @@
+apiVersion: search.miloapis.com/v1alpha1
+kind: ResourceIndexPolicy
+metadata:
+  name: user-resource-index-policy
+spec:
+  conditions:
+  - expression: has(metadata.name)
+    name: has-name
+  fields:
+  - path: .metadata.name
+    searchable: true
+  - path: .spec.email
+    searchable: true
+  - path: .spec.firstName
+    searchable: true
+  - path: .spec.lastName
+    searchable: true
+  targetResource:
+    group: iam.miloapis.com
+    kind: User
+    version: v1alpha1

internal/controller/resourcemanager/personal_organization_controller.go

@@ -7,6 +7,7 @@ import (
 	"encoding/hex"
 	"fmt"
 	"hash/fnv"
+	"time"
 
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -129,6 +130,13 @@ func (r *PersonalOrganizationController) Reconcile(ctx context.Context, req ctrl
 		return ctrl.Result{}, fmt.Errorf("failed to create or update organization membership: %w", err)
 	}
 
+	// If the user is not active, we should not create a personal project,
+	// as the impersonated client will not have the correct permissions.
+	if user.Status.RegistrationApproval != iamv1alpha1.RegistrationApprovalStateApproved {
+		logger.Info("User is not active, skipping personal project creation", "user", user.Name, "state", user.Status.State)
+		return ctrl.Result{RequeueAfter: 5 * time.Second}, nil
+	}
+
 	// Create a default personal project in the personal organization.
 	personalProjectID := hashPersonalOrgName(string(user.UID))
 	personalProject := &resourcemanagerv1alpha1.Project{
@@ -153,7 +161,7 @@ func (r *PersonalOrganizationController) Reconcile(ctx context.Context, req ctrl
 		// sees the correct identity and creates the right PolicyBinding.
 		impersonatedConfig := rest.CopyConfig(r.RestConfig)
 		impersonatedConfig.Impersonate = rest.ImpersonationConfig{
-			UserName: user.Name,
+			UserName: user.Spec.Email,
 			UID:      user.Name,
 			Groups:   []string{"system:authenticated"},
 			Extra: map[string][]string{