Add provider side namespaces

mjudeikis · mjudeikis · commit 147a35bfd2ef · 2025-10-20T14:17:34.000+03:00
diff --git a/backend/controllers/serviceexport/serviceexport_controller.go b/backend/controllers/serviceexport/serviceexport_controller.go
@@ -55,6 +55,7 @@ type APIServiceExportReconciler struct {
 func NewAPIServiceExportReconciler(
 	ctx context.Context,
 	mgr mcmanager.Manager,
+	scope kubebindv1alpha2.InformerScope,
 	opts controller.TypedOptions[mcreconcile.Request],
 ) (*APIServiceExportReconciler, error) {
 	if err := mgr.GetFieldIndexer().IndexField(ctx, &kubebindv1alpha2.APIServiceExport{}, indexers.ServiceExportByBoundSchema,
@@ -66,6 +67,7 @@ func NewAPIServiceExportReconciler(
 		manager: mgr,
 		opts:    opts,
 		reconciler: reconciler{
+			scope: scope,
 			getBoundSchema: func(ctx context.Context, cache cache.Cache, namespace, name string) (*kubebindv1alpha2.BoundSchema, error) {
 				var schema kubebindv1alpha2.BoundSchema
 				key := types.NamespacedName{Namespace: namespace, Name: name}
diff --git a/backend/controllers/serviceexport/serviceexport_reconcile.go b/backend/controllers/serviceexport/serviceexport_reconcile.go
@@ -31,6 +31,7 @@ import (
 )
 
 type reconciler struct {
+	scope          kubebindv1alpha2.InformerScope
 	getBoundSchema func(ctx context.Context, cache cache.Cache, namespace, name string) (*kubebindv1alpha2.BoundSchema, error)
 }
 
@@ -41,6 +42,12 @@ func (r *reconciler) reconcile(ctx context.Context, cache cache.Cache, export *k
 		errs = append(errs, err)
 	}
 
+	if r.scope == kubebindv1alpha2.ClusterScope {
+		if err := r.ensureClusterPermissions(ctx, cache, export); err != nil {
+			errs = append(errs, err)
+		}
+	}
+
 	return utilerrors.NewAggregate(errs)
 }
 
@@ -86,3 +93,12 @@ func (r *reconciler) ensureSchema(ctx context.Context, cache cache.Cache, export
 
 	return nil
 }
+
+// ensureClusterPermissions ensures that the necessary cluster-wide permissions are in place for the exported APIs.
+// This runs only when backend is operating in ClusterScope. In this scenario, there might not yet be a namespace so
+// APIServiceNamespace reconciliation cannot be used.
+func (r *reconciler) ensureClusterPermissions(ctx context.Context, cache cache.Cache, export *kubebindv1alpha2.APIServiceExport) error {
+	// TODO(mjudeikis): implement this for cluster scoped resources.
+	// https://github.com/kube-bind/kube-bind/issues/344
+	return nil
+}
diff --git a/backend/controllers/serviceexportrequest/serviceexportrequest_reconcile.go b/backend/controllers/serviceexportrequest/serviceexportrequest_reconcile.go
@@ -70,6 +70,11 @@ func (r *reconciler) reconcile(ctx context.Context, cl client.Client, cache cach
 		return fmt.Errorf("failed to ensure exports: %w", err)
 	}
 
+	if err := r.ensureAPIServiceNamespaces(ctx, cl, cache, req); err != nil {
+		conditions.SetSummary(req)
+		return fmt.Errorf("failed to ensure APIServiceNamespaces: %w", err)
+	}
+
 	// TODO(mjudeikis): we could potentially add finallizer to APIServiceExport above or "adopt" boundschemas
 	// with owner references once export is created.
 	// https://github.com/kube-bind/kube-bind/issues/297
@@ -367,3 +372,34 @@ func isClaimableAPI(claim kubebindv1alpha2.PermissionClaim) bool {
 	}
 	return false
 }
+
+func (r *reconciler) ensureAPIServiceNamespaces(ctx context.Context, cl client.Client, cache cache.Cache, req *kubebindv1alpha2.APIServiceExportRequest) error {
+	logger := klog.FromContext(ctx)
+
+	// TODO(mjudeikis): We have this object above already, pass it down to avoid extra get.
+	export := &kubebindv1alpha2.APIServiceExport{}
+	if err := cl.Get(ctx, client.ObjectKey{Namespace: req.Namespace, Name: req.Name}, export); err != nil {
+		return fmt.Errorf("failed to get APIServiceExport %s/%s: %w", req.Namespace, req.Name, err)
+	}
+
+	for _, ns := range req.Spec.Namespaces {
+		apiServiceNamespace := helpers.APIServiceNamespaceFromExport(export, ns.Name)
+		currentAPIServiceNamespace := &kubebindv1alpha2.APIServiceNamespace{}
+		err := cache.Get(ctx, client.ObjectKey{Namespace: apiServiceNamespace.Namespace, Name: apiServiceNamespace.Name}, currentAPIServiceNamespace)
+		if err != nil {
+			if apierrors.IsNotFound(err) {
+				logger.V(1).Info("Creating APIServiceNamespace", "name", apiServiceNamespace.Name, "namespace", apiServiceNamespace.Namespace)
+				if err := cl.Create(ctx, apiServiceNamespace); err != nil {
+					if apierrors.IsAlreadyExists(err) {
+						continue
+					}
+					return err
+				}
+			} else {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
diff --git a/backend/controllers/servicenamespace/servicenamespace_reconcile.go b/backend/controllers/servicenamespace/servicenamespace_reconcile.go
@@ -106,7 +106,7 @@ func (c *reconciler) reconcile(ctx context.Context, client client.Client, cache
 					Rules: permissions,
 				}
 				// Create new ClusterRole
-				if err := client.Create(ctx, role); err != nil {
+				if err := client.Create(ctx, role); !errors.IsAlreadyExists(err) {
 					return fmt.Errorf("failed to create ClusterRole %s: %w", name, err)
 				}
 			} else {
diff --git a/backend/server.go b/backend/server.go
@@ -147,6 +147,7 @@ func NewServer(ctx context.Context, c *Config) (*Server, error) {
 	s.ServiceExport, err = serviceexport.NewAPIServiceExportReconciler(
 		ctx,
 		s.Config.Manager,
+		kubebindv1alpha2.InformerScope(c.Options.ConsumerScope),
 		opts,
 	)
 	if err != nil {
diff --git a/contrib/kcp/README.md b/contrib/kcp/README.md
@@ -170,6 +170,8 @@ kubectl apply -f contrib/kcp/deploy/examples/sheriff.yaml
 ```
 
 
+
+
 ## Debug
 
 ```bash
diff --git a/contrib/kcp/deploy/resources/apiresourceschema-apiserviceexportrequests.kube-bind.io.yaml b/contrib/kcp/deploy/resources/apiresourceschema-apiserviceexportrequests.kube-bind.io.yaml
@@ -208,6 +208,25 @@ spec:
             spec specifies how an API service from a service provider should be bound in the
             local consumer cluster.
           properties:
+            namespaces:
+              description: |-
+                namespaces specifies the namespaces, we should bootstrap as part of this request.
+                When objects originate from provider side, consumer does not always know the nessesary details.
+                This field allows provider to pre-heat the necessary namespaces on provider side by creating
+                APIServiceNamespace objects attached to the APISericeExport. More namespaces can be created later by the consumer.
+              items:
+                properties:
+                  name:
+                    description: name is the name of the namespace to create on provider
+                      side.
+                    type: string
+                required:
+                - name
+                type: object
+              type: array
+              x-kubernetes-validations:
+              - message: namespaces are immutable
+                rule: self == oldSelf
             parameters:
               description: |-
                 parameters holds service provider specific parameters for this binding
diff --git a/deploy/crd/kube-bind.io_apiserviceexportrequests.yaml b/deploy/crd/kube-bind.io_apiserviceexportrequests.yaml
@@ -212,6 +212,25 @@ spec:
               spec specifies how an API service from a service provider should be bound in the
               local consumer cluster.
             properties:
+              namespaces:
+                description: |-
+                  namespaces specifies the namespaces, we should bootstrap as part of this request.
+                  When objects originate from provider side, consumer does not always know the nessesary details.
+                  This field allows provider to pre-heat the necessary namespaces on provider side by creating
+                  APIServiceNamespace objects attached to the APISericeExport. More namespaces can be created later by the consumer.
+                items:
+                  properties:
+                    name:
+                      description: name is the name of the namespace to create on
+                        provider side.
+                      type: string
+                  required:
+                  - name
+                  type: object
+                type: array
+                x-kubernetes-validations:
+                - message: namespaces are immutable
+                  rule: self == oldSelf
               parameters:
                 description: |-
                   parameters holds service provider specific parameters for this binding
diff --git a/pkg/konnector/controllers/cluster/claimedresources/claimedresources_reconciler.go b/pkg/konnector/controllers/cluster/claimedresources/claimedresources_reconciler.go
@@ -31,8 +31,6 @@ import (
 	kubebindv1alpha2 "github.com/kube-bind/kube-bind/sdk/apis/kubebind/v1alpha2"
 )
 
-const label = "kube-bind.io/owner"
-
 type readReconciler struct {
 	getServiceNamespace  func(upstreamNamespace string) (*kubebindv1alpha2.APIServiceNamespace, error)
 	getProviderObject    func(ns, name string) (*unstructured.Unstructured, error)
@@ -185,7 +183,7 @@ func (r readReconciler) makeConsumerOwner(obj *unstructured.Unstructured) {
 	if a == nil {
 		a = map[string]string{}
 	}
-	a[label] = string(kubebindv1alpha2.OwnerConsumer)
+	a[kubebindv1alpha2.ObjectOwnerLabel] = string(kubebindv1alpha2.OwnerConsumer)
 	obj.SetLabels(a)
 }
 
@@ -194,7 +192,7 @@ func (r readReconciler) makeProviderOwner(obj *unstructured.Unstructured) {
 	if a == nil {
 		a = map[string]string{}
 	}
-	a[label] = string(kubebindv1alpha2.OwnerProvider)
+	a[kubebindv1alpha2.ObjectOwnerLabel] = string(kubebindv1alpha2.OwnerProvider)
 	obj.SetLabels(a)
 }
 
@@ -237,7 +235,7 @@ func candidateFromOwnerObj(downstreamNS string, obj *unstructured.Unstructured)
 // consumer or provider side.
 func determineOwner(providerObj, consumerObj *unstructured.Unstructured) (kubebindv1alpha2.Owner, error) {
 	if providerObj != nil {
-		ownerLabel := providerObj.GetLabels()[label]
+		ownerLabel := providerObj.GetLabels()[kubebindv1alpha2.ObjectOwnerLabel]
 		switch ownerLabel {
 		case kubebindv1alpha2.OwnerProvider.String():
 			return kubebindv1alpha2.OwnerProvider, nil
@@ -250,7 +248,7 @@ func determineOwner(providerObj, consumerObj *unstructured.Unstructured) (kubebi
 	}
 
 	if consumerObj != nil {
-		ownerLabel := consumerObj.GetLabels()[label]
+		ownerLabel := consumerObj.GetLabels()[kubebindv1alpha2.ObjectOwnerLabel]
 		switch ownerLabel {
 		case kubebindv1alpha2.OwnerProvider.String():
 			return kubebindv1alpha2.OwnerProvider, nil
diff --git a/pkg/konnector/controllers/cluster/cluster_controller.go b/pkg/konnector/controllers/cluster/cluster_controller.go
@@ -35,7 +35,7 @@ import (
 
 	"github.com/kube-bind/kube-bind/pkg/indexers"
 	"github.com/kube-bind/kube-bind/pkg/konnector/controllers/cluster/clusterbinding"
-	"github.com/kube-bind/kube-bind/pkg/konnector/controllers/cluster/namespacedeletion"
+	"github.com/kube-bind/kube-bind/pkg/konnector/controllers/cluster/namespacelifecycle"
 	"github.com/kube-bind/kube-bind/pkg/konnector/controllers/cluster/servicebinding"
 	"github.com/kube-bind/kube-bind/pkg/konnector/controllers/cluster/serviceexport"
 	"github.com/kube-bind/kube-bind/pkg/konnector/controllers/dynamic"
@@ -115,8 +115,9 @@ func NewController(
 	if err != nil {
 		return nil, err
 	}
-	namespacedeletionCtrl, err := namespacedeletion.NewController(
+	namespacelifecycleCtrl, err := namespacelifecycle.NewController(
 		providerConfig,
+		consumerConfig,
 		providerNamespace,
 		providerBindInformers.KubeBind().V1alpha2().APIServiceNamespaces(),
 		namespaceInformer,
@@ -167,7 +168,7 @@ func NewController(
 		serviceBindingIndexer: serviceBindingInformer.Informer().GetIndexer(),
 
 		clusterbindingCtrl:         clusterbindingCtrl,
-		namespacedeletionCtrl:      namespacedeletionCtrl,
+		namespacelifecycleCtrl:     namespacelifecycleCtrl,
 		servicebindingCtrl:         servicebindingCtrl,
 		serviceresourcebindingCtrl: serviceexportCtrl,
 	}, nil
@@ -194,7 +195,7 @@ type controller struct {
 	factories []SharedInformerFactory
 
 	clusterbindingCtrl         GenericController
-	namespacedeletionCtrl      GenericController
+	namespacelifecycleCtrl     GenericController
 	servicebindingCtrl         GenericController
 	serviceresourcebindingCtrl GenericController
 }
@@ -248,7 +249,7 @@ func (c *controller) Start(ctx context.Context) {
 	})
 
 	go c.clusterbindingCtrl.Start(ctx, 2)
-	go c.namespacedeletionCtrl.Start(ctx, 2)
+	go c.namespacelifecycleCtrl.Start(ctx, 2)
 	go c.servicebindingCtrl.Start(ctx, 2)
 	go c.serviceresourcebindingCtrl.Start(ctx, 2)
 
diff --git a/pkg/konnector/controllers/cluster/namespacelifecycle/namespacelifecycle_controller.go b/pkg/konnector/controllers/cluster/namespacelifecycle/namespacelifecycle_controller.go
diff --git a/sdk/apis/kubebind/v1alpha2/apiserviceexport_types.go b/sdk/apis/kubebind/v1alpha2/apiserviceexport_types.go
diff --git a/sdk/apis/kubebind/v1alpha2/apiserviceexportrequest_types.go b/sdk/apis/kubebind/v1alpha2/apiserviceexportrequest_types.go
diff --git a/sdk/apis/kubebind/v1alpha2/helpers/namespaces.go b/sdk/apis/kubebind/v1alpha2/helpers/namespaces.go
diff --git a/sdk/apis/kubebind/v1alpha2/zz_generated.deepcopy.go b/sdk/apis/kubebind/v1alpha2/zz_generated.deepcopy.go

Original file line number	Diff line number	Diff line change
`@@ -31,6 +31,7 @@ import (`
`31`	`31`	`)`
`32`	`32`
`33`	`33`	`type reconciler struct {`
	`34`	`+ scope kubebindv1alpha2.InformerScope`
`34`	`35`	`getBoundSchema func(ctx context.Context, cache cache.Cache, namespace, name string) (*kubebindv1alpha2.BoundSchema, error)`
`35`	`36`	`}`
`36`	`37`
`@@ -41,6 +42,12 @@ func (r reconciler) reconcile(ctx context.Context, cache cache.Cache, export k`
`41`	`42`	`errs = append(errs, err)`
`42`	`43`	`}`
`43`	`44`
	`45`	`+ if r.scope == kubebindv1alpha2.ClusterScope {`
	`46`	`+ if err := r.ensureClusterPermissions(ctx, cache, export); err != nil {`
	`47`	`+ errs = append(errs, err)`
	`48`	`+ }`
	`49`	`+ }`
	`50`	`+`
`44`	`51`	`return utilerrors.NewAggregate(errs)`
`45`	`52`	`}`
`46`	`53`
`@@ -86,3 +93,12 @@ func (r *reconciler) ensureSchema(ctx context.Context, cache cache.Cache, export`
`86`	`93`
`87`	`94`	`return nil`
`88`	`95`	`}`
	`96`	`+`
	`97`	`+// ensureClusterPermissions ensures that the necessary cluster-wide permissions are in place for the exported APIs.`
	`98`	`+// This runs only when backend is operating in ClusterScope. In this scenario, there might not yet be a namespace so`
	`99`	`+// APIServiceNamespace reconciliation cannot be used.`
	`100`	`+func (r reconciler) ensureClusterPermissions(ctx context.Context, cache cache.Cache, export kubebindv1alpha2.APIServiceExport) error {`
	`101`	`+ // TODO(mjudeikis): implement this for cluster scoped resources.`
	`102`	`+ // https://github.com/kube-bind/kube-bind/issues/344`
	`103`	`+ return nil`
	`104`	`+}`
Original file line number	Diff line number	Diff line change
`@@ -106,7 +106,7 @@ func (c *reconciler) reconcile(ctx context.Context, client client.Client, cache`
`106`	`106`	`Rules: permissions,`
`107`	`107`	`}`
`108`	`108`	`// Create new ClusterRole`
`109`		`- if err := client.Create(ctx, role); err != nil {`
	`109`	`+ if err := client.Create(ctx, role); !errors.IsAlreadyExists(err) {`
`110`	`110`	`return fmt.Errorf("failed to create ClusterRole %s: %w", name, err)`
`111`	`111`	`}`
`112`	`112`	`} else {`
Original file line number	Diff line number	Diff line change
`@@ -147,6 +147,7 @@ func NewServer(ctx context.Context, c Config) (Server, error) {`
`147`	`147`	`s.ServiceExport, err = serviceexport.NewAPIServiceExportReconciler(`
`148`	`148`	`ctx,`
`149`	`149`	`s.Config.Manager,`
	`150`	`+ kubebindv1alpha2.InformerScope(c.Options.ConsumerScope),`
`150`	`151`	`opts,`
`151`	`152`	`)`
`152`	`153`	`if err != nil {`
-Original file line number
+Diff line change
 ```
++
++
 ## Debug
 ```bash