API improvments for custom UI (#483)

* Handle custom named secrets
* dont fail on hash images
* Add consumer secret reporting

Author: mjudeikis

cli/pkg/kubectl/base/kubeconfig.go

@@ -86,13 +86,17 @@ func FindRemoteKubeconfig(ctx context.Context, kubeClient *kubernetes.Clientset,
 // the binding session id and the kubeconfig of the service provider cluster. If it is pre-existing, the kubeconfig
 // is updated.
 //
+// If name is provided, the secret will be created with that name or updated if it already exists.
+// If name is empty, a new secret with a generated name (kubeconfig-<random>) will be created.
+//
 // It does special checking that only kubeconfigs with the same host and default namespace are updated.
 func EnsureKubeconfigSecret(ctx context.Context, kubeconfig, name string, client kubernetes.Interface) (*corev1.Secret, bool, error) {
 	remoteHost, remoteNamespace, err := ParseRemoteKubeconfig([]byte(kubeconfig))
 	if err != nil {
 		return nil, false, err
 	}
 
+	// If no name provided, create with generated name
 	if name == "" {
 		secret := &corev1.Secret{
 			ObjectMeta: v1.ObjectMeta{
@@ -114,7 +118,35 @@ func EnsureKubeconfigSecret(ctx context.Context, kubeconfig, name string, client
 		return secret, true, nil
 	}
 
-	// update existing secret
+	// Name provided - try to get existing secret
+	_, err = client.CoreV1().Secrets("kube-bind").Get(ctx, name, v1.GetOptions{})
+	if err != nil && !errors.IsNotFound(err) {
+		return nil, false, err
+	}
+
+	// Secret doesn't exist - create with the provided name
+	if errors.IsNotFound(err) {
+		secret := &corev1.Secret{
+			ObjectMeta: v1.ObjectMeta{
+				Namespace: "kube-bind",
+				Name:      name,
+				Labels: map[string]string{
+					kubebindv1alpha2.LabelProviderKubeconfig: "true",
+				},
+			},
+			Data: map[string][]byte{
+				"kubeconfig": []byte(kubeconfig),
+			},
+		}
+
+		secret, err := client.CoreV1().Secrets("kube-bind").Create(ctx, secret, v1.CreateOptions{})
+		if err != nil {
+			return nil, false, err
+		}
+		return secret, true, nil
+	}
+
+	// Secret exists - update it
 	var secret *corev1.Secret
 	if err := retry.RetryOnConflict(retry.DefaultRetry, func() error {
 		var err error

cli/pkg/kubectl/bind-apiservice/plugin/konnector.go

@@ -85,20 +85,20 @@ func (b *BindAPIServiceOptions) DeployKonnector(ctx context.Context, config *res
 				fmt.Fprintf(b.Options.ErrOut, "konnector of %s version already installed, skipping\n", konnectorVersion)
 				// fall through to CRD test
 			} else {
-				konnectorSemVer, err := semver.Parse(strings.TrimLeft(konnectorVersion, "v"))
-				if err != nil {
-					return fmt.Errorf("failed to parse konnector SemVer version %q: %w", konnectorVersion, err)
-				}
-				bindSemVer, err := semver.Parse(strings.TrimLeft(bindVersion, "v"))
-				if err != nil {
-					return fmt.Errorf("failed to parse kubectl-bind SemVer version %q: %w", bindVersion, err)
-				}
-				if bindSemVer.GT(konnectorSemVer) {
+				konnectorSemVer, konnectorErr := semver.Parse(strings.TrimLeft(konnectorVersion, "v"))
+				bindSemVer, bindErr := semver.Parse(strings.TrimLeft(bindVersion, "v"))
+
+				// If either version is not a valid SemVer (e.g., a git hash), skip version comparison
+				switch {
+				case konnectorErr != nil || bindErr != nil:
+					fmt.Fprintf(b.Options.ErrOut, "konnector version %s or bind version %s is not a valid SemVer, skipping version comparison\n", konnectorVersion, bindVersion)
+					// fall through to CRD test
+				case bindSemVer.GT(konnectorSemVer):
 					fmt.Fprintf(b.Options.ErrOut, "Updating konnector from %s to %s.\n", konnectorVersion, bindVersion)
 					if err := bootstrapKonnector(ctx, discoveryClient, dynamicClient, konnectorImage, b.KonnectorHostAliasParsed); err != nil {
 						return err
 					}
-				} else if bindSemVer.LT(konnectorSemVer) {
+				case bindSemVer.LT(konnectorSemVer):
 					fmt.Fprintf(b.Options.ErrOut, "Newer konnector %s installed. To downgrade to %s use --downgrade-konnector.\n", konnectorVersion, bindVersion)
 				}
 			}

cli/pkg/kubectl/bind-deploy/plugin/deploy.go

@@ -59,6 +59,9 @@ type BindDeployOptions struct {
 	secretKey string
 	// file is the path to a file containing the BindingResourceResponse
 	file string
+	// kubeconfigSecretName is the name to use for the kubeconfig secret in kube-bind namespace.
+	// If empty, a generated name (kubeconfig-<random>) will be used.
+	kubeconfigSecretName string
 
 	// skipKonnector skips the deployment of the konnector.
 	SkipKonnector          bool
@@ -93,6 +96,7 @@ func (b *BindDeployOptions) AddCmdFlags(cmd *cobra.Command) {
 	cmd.Flags().StringVar(&b.secretRef, "secret", b.secretRef, "Reference to a secret containing the BindingResourceResponse (format: namespace/name)")
 	cmd.Flags().StringVar(&b.secretKey, "secret-key", b.secretKey, "Key in the secret containing the BindingResourceResponse (default: kubeconfig)")
 	cmd.Flags().StringVarP(&b.file, "file", "f", b.file, "A file with a BindingResourceResponse manifest. Use - to read from stdin")
+	cmd.Flags().StringVar(&b.kubeconfigSecretName, "provider-kubeconfig-secret-name", b.kubeconfigSecretName, "Name for the kubeconfig secret in kube-bind namespace. If not specified, a generated name will be used")
 
 	// Konnector configuration
 	cmd.Flags().BoolVar(&b.SkipKonnector, "skip-konnector", b.SkipKonnector, "Skip the deployment of the konnector")
@@ -289,10 +293,14 @@ func (b *BindDeployOptions) bindFromKubeconfig(
 		return nil, fmt.Errorf("failed to create kube client: %w", err)
 	}
 
-	// Find or create the kubeconfig secret
-	secretName, err := base.FindRemoteKubeconfig(ctx, kubeClient, remoteNamespace, remoteHost)
-	if err != nil {
-		return nil, err
+	// Determine the secret name to use
+	secretName := b.kubeconfigSecretName
+	if secretName == "" {
+		// No name provided, try to find existing secret for this remote
+		secretName, err = base.FindRemoteKubeconfig(ctx, kubeClient, remoteNamespace, remoteHost)
+		if err != nil {
+			return nil, err
+		}
 	}
 
 	secret, created, err := base.EnsureKubeconfigSecret(ctx, string(response.Kubeconfig), secretName, kubeClient)

contrib/kcp/deploy/resources/apiexport-kube-bind.io.yaml

@@ -92,7 +92,7 @@ spec:
       crd: {}
   - group: kube-bind.io
     name: clusterbindings
-    schema: v260122-c9f0f376.clusterbindings.kube-bind.io
+    schema: v260226-fc494c6a.clusterbindings.kube-bind.io
     storage:
       crd: {}
   - group: kube-bind.io

contrib/kcp/deploy/resources/apiresourceschema-clusterbindings.kube-bind.io.yaml

@@ -1,7 +1,7 @@
 apiVersion: apis.kcp.io/v1alpha1
 kind: APIResourceSchema
 metadata:
-  name: v260122-c9f0f376.clusterbindings.kube-bind.io
+  name: v260226-fc494c6a.clusterbindings.kube-bind.io
 spec:
   conversion:
     strategy: None
@@ -295,6 +295,23 @@ spec:
                 - type
                 type: object
               type: array
+            consumerSecretRef:
+              description: |-
+                consumerSecretRef is the reference to the secret in the consumer cluster
+                that contains the kubeconfig for connecting to the service provider.
+              properties:
+                name:
+                  description: Name of the referent.
+                  minLength: 1
+                  type: string
+                namespace:
+                  description: Namespace of the referent.
+                  minLength: 1
+                  type: string
+              required:
+              - name
+              - namespace
+              type: object
             heartbeatInterval:
               description: |-
                 heartbeatInterval is the maximal interval between heartbeats that the

deploy/charts/backend/crds/kube-bind.io_clusterbindings.yaml

@@ -298,6 +298,23 @@ spec:
                   - type
                   type: object
                 type: array
+              consumerSecretRef:
+                description: |-
+                  consumerSecretRef is the reference to the secret in the consumer cluster
+                  that contains the kubeconfig for connecting to the service provider.
+                properties:
+                  name:
+                    description: Name of the referent.
+                    minLength: 1
+                    type: string
+                  namespace:
+                    description: Namespace of the referent.
+                    minLength: 1
+                    type: string
+                required:
+                - name
+                - namespace
+                type: object
               heartbeatInterval:
                 description: |-
                   heartbeatInterval is the maximal interval between heartbeats that the

deploy/crd/kube-bind.io_clusterbindings.yaml

@@ -299,6 +299,23 @@ spec:
                   - type
                   type: object
                 type: array
+              consumerSecretRef:
+                description: |-
+                  consumerSecretRef is the reference to the secret in the consumer cluster
+                  that contains the kubeconfig for connecting to the service provider.
+                properties:
+                  name:
+                    description: Name of the referent.
+                    minLength: 1
+                    type: string
+                  namespace:
+                    description: Namespace of the referent.
+                    minLength: 1
+                    type: string
+                required:
+                - name
+                - namespace
+                type: object
               heartbeatInterval:
                 description: |-
                   heartbeatInterval is the maximal interval between heartbeats that the

pkg/konnector/controllers/cluster/clusterbinding/clusterbinding_reconcile.go

@@ -53,6 +53,11 @@ func (r *reconciler) reconcile(ctx context.Context, binding *kubebindv1alpha2.Cl
 		errs = append(errs, err)
 	}
 
+	// Must run after ensureConsumerSecret to update the condition based on the provider secret and to set the consumer secret ref in status.
+	if err := r.ensureConsumerSecretRef(ctx, binding); err != nil {
+		errs = append(errs, err)
+	}
+
 	if err := r.ensureHeartbeat(ctx, binding); err != nil {
 		errs = append(errs, err)
 	}
@@ -75,6 +80,22 @@ func (r *reconciler) ensureHeartbeat(_ context.Context, binding *kubebindv1alpha
 	return nil
 }
 
+func (r *reconciler) ensureConsumerSecretRef(_ context.Context, binding *kubebindv1alpha2.ClusterBinding) error {
+	consumerSecret, err := r.getConsumerSecret()
+	if err != nil && !errors.IsNotFound(err) {
+		return err
+	}
+
+	if consumerSecret != nil {
+		binding.Status.ConsumerSecretRef = &kubebindv1alpha2.LocalSecretRef{
+			Name:      consumerSecret.Name,
+			Namespace: consumerSecret.Namespace,
+		}
+	}
+
+	return nil
+}
+
 func (r *reconciler) ensureConsumerSecret(ctx context.Context, binding *kubebindv1alpha2.ClusterBinding) error {
 	logger := klog.FromContext(ctx)
 

sdk/apis/kubebind/v1alpha2/clusterbinding_types.go

@@ -108,11 +108,32 @@ type ClusterBindingStatus struct {
 	// consumer cluster.
 	KonnectorVersion string `json:"konnectorVersion,omitempty"`
 
+	// consumerSecretRef is the reference to the secret in the consumer cluster
+	// that contains the kubeconfig for connecting to the service provider.
+	ConsumerSecretRef *LocalSecretRef `json:"consumerSecretRef,omitempty"`
+
 	// conditions is a list of conditions that apply to the ClusterBinding. It is
 	// updated by the konnector and the service provider.
 	Conditions conditionsapi.Conditions `json:"conditions,omitempty"`
 }
 
+// LocalSecretRef is a reference to a secret in a specific namespace.
+type LocalSecretRef struct {
+	// Name of the referent.
+	//
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	Name string `json:"name"`
+
+	// Namespace of the referent.
+	//
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	Namespace string `json:"namespace"`
+}
+
 // ClusterBindingList is the objects list that represents the ClusterBinding.
 //
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object