prevent claim wrong scope @ backend

mjudeikis · mjudeikis · commit 3301e188a5de · 2025-09-16T09:34:26.000+03:00
diff --git a/backend/controllers/clusterbinding/clusterbinding_reconcile.go b/backend/controllers/clusterbinding/clusterbinding_reconcile.go
@@ -150,7 +150,15 @@ func (r *reconciler) ensureRBACClusterRole(ctx context.Context, client client.Cl
 				},
 			},
 		},
-	}
+		Rules: []rbacv1.PolicyRule{
+			// Always need to be able to get/list/watch the BoundSchemas
+			// to be able to figure out what to bind.
+			{
+				APIGroups: []string{kubebindv1alpha2.GroupName},
+				Resources: []string{"boundschemas"},
+				Verbs:     []string{"get", "list", "watch"},
+			},
+		}}
 	for _, export := range exports {
 		// Collect unique GroupResources and sort for stable rule ordering.
 		grSet := map[string]kubebindv1alpha2.GroupResource{}
@@ -172,11 +180,6 @@ func (r *reconciler) ensureRBACClusterRole(ctx context.Context, client client.Cl
 					Resources: []string{schema.Spec.Names.Plural},
 					Verbs:     []string{"get", "list", "watch", "create", "update", "patch", "delete"},
 				},
-				rbacv1.PolicyRule{
-					APIGroups: []string{kubebindv1alpha2.GroupName},
-					Resources: []string{"boundschemas"},
-					Verbs:     []string{"get", "list", "watch"},
-				},
 			)
 		}
 	}
@@ -202,7 +205,6 @@ func (r *reconciler) ensureRBACClusterRoleBinding(ctx context.Context, client cl
 	if err != nil && !errors.IsNotFound(err) {
 		return fmt.Errorf("failed to get ClusterRoleBinding %s: %w", name, err)
 	}
-
 	if r.scope != kubebindv1alpha2.ClusterScope {
 		if err := r.deleteClusterRoleBinding(ctx, client, name); err != nil && !errors.IsNotFound(err) {
 			return fmt.Errorf("failed to delete ClusterRoleBinding %s: %w", name, err)
diff --git a/backend/controllers/serviceexportrequest/serviceexportrequest_reconcile.go b/backend/controllers/serviceexportrequest/serviceexportrequest_reconcile.go
@@ -54,10 +54,12 @@ type reconciler struct {
 
 func (r *reconciler) reconcile(ctx context.Context, cl client.Client, cache cache.Cache, req *kubebindv1alpha2.APIServiceExportRequest) error {
 	if err := r.ensureBoundSchemas(ctx, cl, cache, req); err != nil {
+		conditions.SetSummary(req)
 		return err
 	}
 
 	if err := r.ensureExports(ctx, cl, cache, req); err != nil {
+		conditions.SetSummary(req)
 		return err
 	}
 
@@ -119,7 +121,26 @@ func (r *reconciler) ensureBoundSchemas(ctx context.Context, cl client.Client, c
 				klog.FromContext(ctx).Error(nil, "Skipping invalid schema: missing group or names.plural", "ns", item.GetNamespace(), "name", item.GetName())
 				continue
 			}
+			scope := apiextensionsv1.ResourceScope(spec["scope"].(string))
+
 			if g == res.Group && p == res.Resource {
+				// Important: This checks if the resource are right-scoped. If consumer is namespaced, we can't allow this.
+				// We terminate early to prevent triggering other controllers.
+				if r.informerScope.String() != string(scope) && r.informerScope != kubebindv1alpha2.ClusterScope {
+					conditions.MarkFalse(
+						req,
+						kubebindv1alpha2.APIServiceExportRequestConditionExportsReady,
+						"APIServiceExportRequestInvalid",
+						conditionsapi.ConditionSeverityError,
+						"APIServiceExportRequest %s is invalid: resource %s/%s has scope %q which is incompatible with backend informer scope %q",
+						req.Name, g, p, scope, r.informerScope,
+					)
+					req.Status.Phase = kubebindv1alpha2.APIServiceExportRequestPhaseFailed
+					req.Status.TerminalMessage = conditions.GetMessage(req, kubebindv1alpha2.APIServiceExportRequestConditionExportsReady)
+					// We can't proceed with this request.
+					return fmt.Errorf("resource %s/%s has scope %q which is incompatible with backend informer scope %q", g, p, scope, r.informerScope)
+				}
+
 				boundSchema, err := helpers.UnstructuredToBoundSchema(item)
 				if err != nil {
 					return err
diff --git a/backend/kubernetes/manager.go b/backend/kubernetes/manager.go
@@ -192,24 +192,3 @@ func (m *Manager) ListDynamicResources(ctx context.Context, cluster string, gvk
 
 	return list, nil
 }
-
-/* func (m *Manager) CreateBoundSchema(ctx context.Context, cluster string, name string, u *unstructured.Unstructured) error {
-	cl, err := m.manager.GetCluster(ctx, cluster)
-	if err != nil {
-		return err
-	}
-	c := cl.GetClient()
-
-	boundSchema := &kubebindv1alpha2.BoundSchema{}
-	err = runtime.DefaultUnstructuredConverter.FromUnstructured(u.UnstructuredContent(), boundSchema)
-	if err != nil {
-		return err
-	}
-
-	boundSchema.ResourceVersion = ""
-	boundSchema.Name = name
-	boundSchema.Spec.InformerScope = m.scope
-
-	return c.Create(ctx, boundSchema)
-}
-*/
diff --git a/kcp/deploy/examples/apiexport.yaml b/kcp/deploy/examples/apiexport.yaml
@@ -7,5 +7,10 @@ spec:
   - group: wildwest.dev
     name: cowboys
     schema: today.cowboys.wildwest.dev
+    storage:
+      crd: {}
+  - group: wildwest.dev
+    name: sheriffs
+    schema: today.sheriffs.wildwest.dev
     storage:
       crd: {}
diff --git a/kcp/deploy/examples/apiresourceschema-cowboys.yaml b/kcp/deploy/examples/apiresourceschema-cowboys.yaml
@@ -0,0 +1,48 @@
+apiVersion: apis.kcp.io/v1alpha1
+kind: APIResourceSchema
+metadata:
+  name: today.cowboys.wildwest.dev
+  labels:
+    kube-bind.io/exported: "true"
+spec:
+  group: wildwest.dev
+  names:
+    kind: Cowboy
+    listKind: CowboyList
+    plural: cowboys
+    singular: cowboy
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      description: Cowboy is part of the wild west
+      properties:
+        apiVersion:
+          description: 'APIVersion defines the versioned schema of this representation
+            of an object. Servers should convert recognized schemas to the latest
+            internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+          type: string
+        kind:
+          description: 'Kind is a string value representing the REST resource this
+            object represents. Servers may infer this from the endpoint the client
+            submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+          type: string
+        metadata:
+          type: object
+        spec:
+          description: CowboySpec holds the desired state of the Cowboy.
+          properties:
+            intent:
+              type: string
+          type: object
+        status:
+          description: CowboyStatus communicates the observed state of the Cowboy.
+          properties:
+            result:
+              type: string
+          type: object
+      type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/kcp/deploy/examples/apiresourceschema-sheriffs.yaml b/kcp/deploy/examples/apiresourceschema-sheriffs.yaml
@@ -0,0 +1,48 @@
+apiVersion: apis.kcp.io/v1alpha1
+kind: APIResourceSchema
+metadata:
+  name: today.sheriffs.wildwest.dev
+  labels:
+    kube-bind.io/exported: "true"
+spec:
+  group: wildwest.dev
+  names:
+    kind: Sheriff
+    listKind: SheriffList
+    plural: sheriffs
+    singular: sheriff
+  scope: Cluster
+  versions:
+  - name: v1alpha1
+    schema:
+      description: Sheriff is part of the wild west
+      properties:
+        apiVersion:
+          description: 'APIVersion defines the versioned schema of this representation
+            of an object. Servers should convert recognized schemas to the latest
+            internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+          type: string
+        kind:
+          description: 'Kind is a string value representing the REST resource this
+            object represents. Servers may infer this from the endpoint the client
+            submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+          type: string
+        metadata:
+          type: object
+        spec:
+          description: SheriffSpec holds the desired state of the Sheriff.
+          properties:
+            intent:
+              type: string
+          type: object
+        status:
+          description: SheriffStatus communicates the observed state of the Sheriff.
+          properties:
+            result:
+              type: string
+          type: object
+      type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/kcp/deploy/examples/apiserviceexport-cluster.yaml b/kcp/deploy/examples/apiserviceexport-cluster.yaml
@@ -0,0 +1,11 @@
+apiVersion: kube-bind.io/v1alpha2
+kind: APIServiceExportRequest
+metadata:
+  name: sheriffs.wildwest.dev
+spec:
+  resources:
+  - group: wildwest.dev
+    resource: sheriffs
+    versions:
+    - v1alpha1
+status: {}
diff --git a/kcp/deploy/examples/apiserviceexport-namespaced.yaml b/kcp/deploy/examples/apiserviceexport-namespaced.yaml
@@ -0,0 +1,11 @@
+apiVersion: kube-bind.io/v1alpha2
+kind: APIServiceExportRequest
+metadata:
+  name: cowboys.wildwest.dev
+spec:
+  resources:
+  - group: wildwest.dev
+    resource: cowboys
+    versions:
+    - v1alpha1
+status: {}
diff --git a/kcp/deploy/examples/sheriff.yaml b/kcp/deploy/examples/sheriff.yaml
@@ -0,0 +1,8 @@
+apiVersion: wildwest.dev/v1alpha1
+kind: Sheriff
+metadata:
+  name: sheriff
+spec:
+  intent: "ride into the sunset"
+status:
+  result: "ready to ride"
diff --git a/pkg/konnector/controllers/cluster/cluster_controller.go b/pkg/konnector/controllers/cluster/cluster_controller.go
@@ -132,6 +132,7 @@ func NewController(
 		providerConfig,
 		serviceBindingInformer,
 		providerBindInformers.KubeBind().V1alpha2().APIServiceExports(),
+		providerBindInformers.KubeBind().V1alpha2().APIServiceExportRequests(),
 		crdInformer,
 	)
 	if err != nil {
diff --git a/pkg/konnector/controllers/cluster/servicebinding/servicebinding_controller.go b/pkg/konnector/controllers/cluster/servicebinding/servicebinding_controller.go
@@ -54,6 +54,7 @@ func NewController(
 	consumerConfig, providerConfig *rest.Config,
 	serviceBindingInformer dynamic.Informer[bindlisters.APIServiceBindingLister],
 	serviceExportInformer bindinformers.APIServiceExportInformer,
+	serviceExportRequestInformer bindinformers.APIServiceExportRequestInformer,
 	crdInformer dynamic.Informer[apiextensionslisters.CustomResourceDefinitionLister],
 ) (*controller, error) {
 	queue := workqueue.NewTypedRateLimitingQueueWithConfig(workqueue.DefaultTypedControllerRateLimiter[string](), workqueue.TypedRateLimitingQueueConfig[string]{Name: controllerName})
@@ -97,6 +98,9 @@ func NewController(
 			getServiceExport: func(name string) (*kubebindv1alpha2.APIServiceExport, error) {
 				return serviceExportInformer.Lister().APIServiceExports(providerNamespace).Get(name)
 			},
+			getServiceExportRequest: func(name string) (*kubebindv1alpha2.APIServiceExportRequest, error) {
+				return serviceExportRequestInformer.Lister().APIServiceExportRequests(providerNamespace).Get(name)
+			},
 			getServiceBinding: func(name string) (*kubebindv1alpha2.APIServiceBinding, error) {
 				return serviceBindingInformer.Lister().Get(name)
 			},
diff --git a/pkg/konnector/controllers/cluster/servicebinding/servicebinding_reconcile.go b/pkg/konnector/controllers/cluster/servicebinding/servicebinding_reconcile.go
@@ -37,6 +37,7 @@ type reconciler struct {
 
 	reconcileServiceBinding func(binding *kubebindv1alpha2.APIServiceBinding) bool
 	getServiceExport        func(name string) (*kubebindv1alpha2.APIServiceExport, error)
+	getServiceExportRequest func(name string) (*kubebindv1alpha2.APIServiceExportRequest, error)
 	getServiceBinding       func(name string) (*kubebindv1alpha2.APIServiceBinding, error)
 	getClusterBinding       func(ctx context.Context) (*kubebindv1alpha2.ClusterBinding, error)
 	getBoundSchema          func(ctx context.Context, name string) (*kubebindv1alpha2.BoundSchema, error)
@@ -78,6 +79,21 @@ func (r *reconciler) ensureValidServiceExport(_ context.Context, binding *kubebi
 	if _, err := r.getServiceExport(binding.Name); err != nil && !errors.IsNotFound(err) {
 		return err
 	} else if errors.IsNotFound(err) {
+		// If serviceexport is not found, check if request is not in failed state already:
+		request, errRequest := r.getServiceExportRequest(binding.Name)
+		if errRequest == nil && request.Status.Phase == kubebindv1alpha2.APIServiceExportRequestPhaseFailed {
+			// If request is in failed state, propagate the message to binding status and mark as failed
+			conditions.MarkFalse(
+				binding,
+				kubebindv1alpha2.APIServiceBindingConditionConnected,
+				"APIServiceExportFailed",
+				conditionsapi.ConditionSeverityError,
+				request.Status.TerminalMessage,
+				binding.Name,
+			)
+			return fmt.Errorf("APIServiceExportRequest %s is in failed state: %s", binding.Name, request.Status.TerminalMessage)
+		}
+
 		conditions.MarkFalse(
 			binding,
 			kubebindv1alpha2.APIServiceBindingConditionConnected,

Original file line number	Diff line number	Diff line change
`@@ -132,6 +132,7 @@ func NewController(`
`132`	`132`	`providerConfig,`
`133`	`133`	`serviceBindingInformer,`
`134`	`134`	`providerBindInformers.KubeBind().V1alpha2().APIServiceExports(),`
	`135`	`+ providerBindInformers.KubeBind().V1alpha2().APIServiceExportRequests(),`
`135`	`136`	`crdInformer,`
`136`	`137`	`)`
`137`	`138`	`if err != nil {`