@@ -17,8 +17,8 @@ kube-bind uses several specialized Kubernetes custom resources to orchestrate th
1717
1818** Purpose** : Defines a reusable template for exporting a group of related APIs and their permission requirements.
1919
20- ** Used by** : Service providers
21- ** Scope** : Cluster-scoped
20+ ** Used by** : Service providers
21+ ** Scope** : Cluster-scoped
2222** Lifecycle** : Long-lived template definition
2323
2424### Key Features
@@ -38,16 +38,16 @@ metadata:
3838spec :
3939 scope : Cluster # or Namespace
4040 description : " A comprehensive service template"
41-
41+
4242 # Core APIs being exported
4343 resources :
4444 - group : example.com
4545 resource : widgets
4646 versions : ["v1", "v1alpha1"]
47- - group : example.com
47+ - group : example.com
4848 resource : gadgets
4949 versions : ["v1"]
50-
50+
5151 # Additional resources the service needs access to
5252 permissionClaims :
5353 - group : " "
6262 jsonPath :
6363 name : spec.secretRef.name
6464 namespace : spec.secretRef.namespace
65-
65+
6666 # Pre-created namespaces for this service. These will be owned by provider (service owned).
6767 namespaces :
6868 - name : my-service-system
@@ -74,12 +74,12 @@ spec:
7474- **Template**: The definition (APIServiceExportTemplate) - shared and reusable
7575- **Instance**: The actual export (APIServiceExport) - created per binding
7676
77- ## APIServiceExport
77+ ## APIServiceExport
7878
7979**Purpose**: Represents an active, instantiated export of a specific set of CRD's and permission claims to consumer clusters.
8080
81- **Used by**: Automatically created by konnector agents
82- **Scope**: Namespaced
81+ **Used by**: Automatically created by konnector agents
82+ **Scope**: Namespaced
8383**Lifecycle**: Created when consumers bind to templates
8484
8585### Key Features
@@ -102,7 +102,7 @@ spec:
102102 - group : example.com
103103 resource : widgets
104104 versions : ["v1"]
105-
105+
106106 # Permission claims for this specific export
107107 permissionClaims :
108108 - group : " "
@@ -112,7 +112,7 @@ spec:
112112 matchLabels :
113113 component : widget-service
114114 consumer : consumer123
115-
115+
116116 # How isolation is done at the provider side
117117 clusterScopedIsolation : Prefixed
118118 # informerScope is the scope of the APIServiceExport. It can be either Cluster or Namespace.
@@ -122,7 +122,7 @@ spec:
122122 # Namespaced: The konnector has permission to watch only single namespaces.
123123 # This is more resource intensive. And it means cluster-scoped resources cannot be exported.
124124 informerScope : Cluster
125-
125+
126126status :
127127 conditions :
128128 - lastTransitionTime : " 2025-11-14T12:02:29Z"
@@ -152,22 +152,22 @@ APIServiceBinding (consumer side)
152152
153153** Purpose** : Represents a consumer's request to bind to a specific service template.
154154
155- ** Used by** : Service consumers (via CLI/UI)
156- ** Scope** : Namespaced (on consumer side)
155+ ** Used by** : Service consumers (via CLI/UI)
156+ ** Scope** : Namespaced (on consumer side)
157157** Lifecycle** : Created during binding process, short lived until APIServiceExport is established.
158158
159159### Key Features
160160
161161- ** Binding Initiation** : Starts the binding process between consumer and provider
162- - ** Authentication Context** : Contains OAuth2 flow details and credentials
162+ - ** Authentication Context** : Contains OAuth2 flow details and credentials
163163- ** Template Reference** : Points to the specific template being requested
164164- ** Status Tracking** : Reports binding progress and any errors
165165
166166### Structure
167167
168168``` yaml
169169apiVersion : kube-bind.io/v1alpha1
170- kind : APIServiceExportRequest
170+ kind : APIServiceExportRequest
171171metadata :
172172 name : my-widget-service-binding
173173 namespace : default
@@ -177,7 +177,7 @@ spec:
177177 - group : example.com
178178 resource : widgets
179179 versions : ["v1"]
180-
180+
181181 permissionClaims :
182182 - group : core
183183 resource : configmaps
@@ -193,10 +193,10 @@ spec:
193193 # resource:
194194 # versions: []
195195 # jsonPath:
196- # name:
197- # namespace:
198-
199-
196+ # name:
197+ # namespace:
198+
199+
200200status :
201201 conditions :
202202 - lastTransitionTime : " 2025-11-14T12:02:25Z"
@@ -212,8 +212,8 @@ status:
212212
213213**Purpose**: Represents the consumer-side binding to a provider service, containing the applied CRDs and managing the resource synchronization.
214214
215- **Used by**: Automatically created by consumer konnector agents
216- **Scope**: Namespaced (on consumer side)
215+ **Used by**: Automatically created by consumer konnector agents
216+ **Scope**: Namespaced (on consumer side)
217217**Lifecycle**: Created when APIServiceExportRequest is processed, long-lived
218218
219219### Key Features
@@ -280,8 +280,8 @@ status:
280280
281281**Purpose**: Contains the actual CRD definitions and schema information for resources bound from a provider.
282282
283- **Used by**: Created alongside APIServiceExport on provider side
284- **Scope**: Namespaced (on provider side)
283+ **Used by**: Created alongside APIServiceExport on provider side
284+ **Scope**: Namespaced (on provider side)
285285**Lifecycle**: Mirrors APIServiceExport lifecycle
286286
287287### Key Features
@@ -321,7 +321,7 @@ spec:
321321 subresources :
322322 status : {}
323323 # Complete OpenAPI schema definition
324-
324+
325325status :
326326 acceptedNames :
327327 kind : Sheriff
@@ -348,14 +348,14 @@ status:
348348
349349**Purpose**: Manages namespace mapping and isolation between provider and consumer clusters.
350350
351- **Used by**: Automatically managed by konnector agents
352- **Scope**: Namespaced (on provider side)
351+ **Used by**: Automatically managed by konnector agents
352+ **Scope**: Namespaced (on provider side)
353353**Lifecycle**: Created as needed during resource synchronization or by provider, when namespace is desired on consumer side.
354354
355355### Key Features
356356
357357- **Namespace Isolation**: Ensures consumer resources don't conflict
358- - **Mapping Logic**: Handles namespace translation between clusters
358+ - **Mapping Logic**: Handles namespace translation between clusters
359359- **Resource Organization**: Groups related resources per consumer
360360- **Automatic Management**: Created/deleted as bindings change
361361
@@ -373,13 +373,13 @@ APIServiceExportTemplate → defines service contract
373373APIServiceExportRequest → consumer requests binding
374374```
375375
376- ### 3. Provider Processing
376+ ### 3. Provider Processing
377377``` yaml
378378APIServiceExport + BoundSchema → provider creates export with schema
379379```
380380
381381### 4. Consumer Binding
382- ``` yaml
382+ ``` yaml
383383APIServiceBinding → consumer applies CRDs and establishes sync
384384```
385385
@@ -416,7 +416,7 @@ status:
416416kube-bind supports different isolation strategies:
417417
418418- **Prefixed**: Consumer namespace becomes ` {consumer-id}-{original-name}`
419- - **Namespaced**: Consumer resources go into dedicated provider namespaces
419+ - **Namespaced**: Consumer resources go into dedicated provider namespaces
420420- **None**: For dedicated provider clusters where isolation isn't needed
421421
422422# # API Relationships and Data Flow
@@ -436,7 +436,7 @@ kube-bind supports different isolation strategies:
436436 │ │
437437 [ Secure Connection] │
438438 │ │
439- ┌─────────▼───────────────────▼───────┐ Consumer Cluster
439+ ┌─────────▼───────────────────▼───────┐ Consumer Cluster
440440│ │
441441│ APIServiceExportRequest │
442442│ │ │
@@ -463,21 +463,21 @@ Select resources based on labels:
463463```yaml
464464permissionClaims:
465465- group: ""
466- resource: secrets
466+ resource: secrets
467467 selector:
468468 labelSelector:
469469 matchLabels:
470470 component: my-service
471471 environment: production
472472```
473473
474- #### Named Resource Claims
474+ #### Named Resource Claims
475475Select specific resources by name:
476476``` yaml
477477permissionClaims :
478478- group : " "
479479 resource : configmaps
480- selector :
480+ selector :
481481 namedResources :
482482 - name : service-config
483483 namespace : kube-system
@@ -494,7 +494,7 @@ permissionClaims:
494494 selector :
495495 references :
496496 - resource : widgets
497- group : example.com
497+ group : example.com
498498 jsonPath :
499499 name : spec.secretRef.name
500500 namespace : spec.secretRef.namespace
@@ -503,11 +503,14 @@ permissionClaims:
503503### Claim Evaluation
504504
505505Permission claims are evaluated when:
506+
5065071. **Template binding occurs** - Initial claim evaluation
508+
5075092. **Reference sources change** - Dynamic re-evaluation for reference claims
510+
5085113. **Resource labels change** - Re-evaluation for label selector claims
509512
510513## Related Documentation
511514
512- - [CRD Reference](../../reference/crd/kube-bind.io/) - Complete API specifications
513- - [CLI Reference](../../reference/) - Command-line tool documentation
515+ - [CRD Reference](../../reference/crd/kube-bind.io/) - Complete API specifications
516+ - [CLI Reference](../../reference/) - Command-line tool documentation
0 commit comments