Add permissionClaims machinery

Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt>
On-behalf-of: @SAP mangirdas.judeikis@sap.com

Author: mjudeikis

backend/controllers/clusterbinding/clusterbinding_reconcile.go

@@ -158,6 +158,11 @@ func (r *reconciler) ensureRBACClusterRole(ctx context.Context, client client.Cl
 				Resources: []string{"boundschemas"},
 				Verbs:     []string{"get", "list", "watch"},
 			},
+			{
+				APIGroups: []string{kubebindv1alpha2.GroupName},
+				Resources: []string{"boundschemas/status"},
+				Verbs:     []string{"get", "update", "patch"},
+			},
 		}}
 	for _, export := range exports {
 		// Collect unique GroupResources and sort for stable rule ordering.

backend/controllers/serviceexportrequest/serviceexportrequest_reconcile.go

@@ -53,11 +53,18 @@ type reconciler struct {
 }
 
 func (r *reconciler) reconcile(ctx context.Context, cl client.Client, cache cache.Cache, req *kubebindv1alpha2.APIServiceExportRequest) error {
+	// We must ensure schemas are created in form of boundSchemas first for the validation.
+	// Worst case scenario if validation fails, we will reuse schemas for same consumer once issues are fixed.
 	if err := r.ensureBoundSchemas(ctx, cl, cache, req); err != nil {
 		conditions.SetSummary(req)
 		return err
 	}
 
+	if err := r.validate(ctx, cl, req); err != nil {
+		conditions.SetSummary(req)
+		return err
+	}
+
 	if err := r.ensureExports(ctx, cl, cache, req); err != nil {
 		conditions.SetSummary(req)
 		return err
@@ -72,97 +79,70 @@ func (r *reconciler) reconcile(ctx context.Context, cl client.Client, cache cach
 	return nil
 }
 
-func (r *reconciler) ensureBoundSchemas(ctx context.Context, cl client.Client, cache cache.Cache, req *kubebindv1alpha2.APIServiceExportRequest) error {
-	// Ensure all bound schemas exist
-	for _, res := range req.Spec.Resources {
-		parts := strings.SplitN(r.schemaSource, ".", 3)
-		if len(parts) != 3 { // We check this in validation, but just in case.
-			return fmt.Errorf("malformed schema source: %q", r.schemaSource)
-		}
+// getExportedSchemas will list all schemas, exported by current backend.
+// Important: getExportedSchemas is using client.Client to list resources, not cache.
+// This is due to fact we use dynamic client and unstructured.Unstructured to get schemas and it
+// does not quite work with dynamic cache informers:
+// failed to get informer for *unstructured.UnstructuredList apis.kcp.io/v1alpha1, Kind=APIResourceSchemaList: failed to find newly started informer for apis.kcp.io/v1alpha1, Kind=APIResourceSchema"}.
+func (r *reconciler) getExportedSchemas(ctx context.Context, cl client.Client) (kubebindv1alpha2.ExportedSchemas, error) {
+	parts := strings.SplitN(r.schemaSource, ".", 3)
+	if len(parts) != 3 { // We check this in validation, but just in case.
+		return nil, fmt.Errorf("malformed schema source: %q", r.schemaSource)
+	}
 
-		gvk := schema.GroupVersionKind{
-			Kind:    parts[0],
-			Version: parts[1],
-			Group:   parts[2],
-		}
+	gvk := schema.GroupVersionKind{
+		Kind:    parts[0],
+		Version: parts[1],
+		Group:   parts[2],
+	}
 
-		// Ensure we have the List kind
-		listGVK := gvk
-		if !strings.HasSuffix(listGVK.Kind, "List") {
-			listGVK.Kind += "List"
-		}
+	// Ensure we have the List kind
+	listGVK := gvk
+	if !strings.HasSuffix(listGVK.Kind, "List") {
+		listGVK.Kind += "List"
+	}
 
-		list := &unstructured.UnstructuredList{}
-		list.SetGroupVersionKind(listGVK)
+	list := &unstructured.UnstructuredList{}
+	list.SetGroupVersionKind(listGVK)
 
-		// TODO(mjudeikis): This is hardcoded here and in handlers.go for now.
-		labelSelector := labels.Set{
-			resources.ExportedCRDsLabel: "true",
-		}
+	// TODO(mjudeikis): This is hardcoded here and in handlers.go for now.
+	labelSelector := labels.Set{
+		resources.ExportedCRDsLabel: "true",
+	}
 
-		listOpts := []client.ListOption{}
-		listOpts = append(listOpts, client.MatchingLabelsSelector{Selector: labelSelector.AsSelector()})
+	listOpts := []client.ListOption{}
+	listOpts = append(listOpts, client.MatchingLabelsSelector{Selector: labelSelector.AsSelector()})
 
-		if err := cl.List(ctx, list, listOpts...); err != nil {
-			return err
-		}
+	if err := cl.List(ctx, list, listOpts...); err != nil {
+		return nil, err
+	}
 
-		for _, item := range list.Items {
-			var schemaFailed bool
-			obj := item.UnstructuredContent()
-			group, ok, err := unstructured.NestedString(obj, "spec", "group")
-			if !ok || err != nil || group == "" {
-				klog.FromContext(ctx).Error(err, "Skipping invalid schema: missing group", "ns", item.GetNamespace(), "name", item.GetName())
-				schemaFailed = true
-			}
-			plural, ok, err := unstructured.NestedString(obj, "spec", "names", "plural")
-			if !ok || err != nil || plural == "" {
-				klog.FromContext(ctx).Error(err, "Skipping invalid schema: missing names.plural", "ns", item.GetNamespace(), "name", item.GetName())
-				schemaFailed = true
-			}
+	var boundSchemas kubebindv1alpha2.ExportedSchemas = make(map[string]*kubebindv1alpha2.BoundSchema, len(list.Items))
+	for _, item := range list.Items {
+		boundSchema, err := helpers.UnstructuredToBoundSchema(item)
+		if err != nil {
+			return nil, err
+		}
+		boundSchemas[boundSchema.ResourceGroupName()] = boundSchema
+	}
 
-			scope, ok, err := unstructured.NestedString(obj, "spec", "scope")
-			if !ok || err != nil || scope == "" {
-				klog.FromContext(ctx).Error(err, "Skipping invalid schema: missing scope", "ns", item.GetNamespace(), "name", item.GetName())
-				schemaFailed = true
-			}
+	return boundSchemas, nil
+}
 
-			if schemaFailed {
-				conditions.MarkFalse(
-					req,
-					kubebindv1alpha2.APIServiceExportRequestConditionExportsReady,
-					"APIServiceExportRequestInvalid",
-					conditionsapi.ConditionSeverityError,
-					"APIServiceExportRequest %s is invalid: resource %s/%s has invalid schema",
-					req.Name, group, plural,
-				)
-				req.Status.Phase = kubebindv1alpha2.APIServiceExportRequestPhaseFailed
-				return fmt.Errorf("resource %s/%s is invalid", group, plural)
-			}
+func (r *reconciler) ensureBoundSchemas(ctx context.Context, cl client.Client, cache cache.Cache, req *kubebindv1alpha2.APIServiceExportRequest) error {
+	exportedSchemas, err := r.getExportedSchemas(ctx, cl)
+	if err != nil {
+		return err
+	}
 
-			if group == res.Group && plural == res.Resource {
-				// Important: This checks if the resource are correctly scoped. If consumer is namespaced, we can't allow this.
-				// We terminate early to prevent triggering other controllers.
-				if r.informerScope.String() != scope && r.informerScope != kubebindv1alpha2.ClusterScope {
-					conditions.MarkFalse(
-						req,
-						kubebindv1alpha2.APIServiceExportRequestConditionExportsReady,
-						"APIServiceExportRequestInvalid",
-						conditionsapi.ConditionSeverityError,
-						"APIServiceExportRequest %s is invalid: resource %s/%s has scope %q which is incompatible with backend informer scope %q",
-						req.Name, group, plural, scope, r.informerScope,
-					)
-					req.Status.Phase = kubebindv1alpha2.APIServiceExportRequestPhaseFailed
-					req.Status.TerminalMessage = conditions.GetMessage(req, kubebindv1alpha2.APIServiceExportRequestConditionExportsReady)
-					// We can't proceed with this request.
-					return fmt.Errorf("resource %s/%s has scope %q which is incompatible with backend informer scope %q", group, plural, scope, r.informerScope)
-				}
+	// Ensure all bound schemas exist
+	for _, res := range req.Spec.Resources {
+		if len(res.Versions) == 0 {
+			continue
+		}
 
-				// https://github.com/kube-bind/kube-bind/issues/297 to fix.
-				boundSchema, err := helpers.UnstructuredToBoundSchema(item)
-				if err != nil {
-					return err
-				}
+		for _, boundSchema := range exportedSchemas {
+			if boundSchema.Spec.Group == res.Group && boundSchema.Spec.Names.Plural == res.Resource {
 				boundSchema.Name = res.ResourceGroupName()
 				boundSchema.Namespace = req.Namespace
 				boundSchema.Spec.InformerScope = r.informerScope
@@ -258,6 +238,7 @@ func (r *reconciler) ensureExports(ctx context.Context, cl client.Client, cache
 				Versions: res.Versions,
 			})
 		}
+		export.Spec.PermissionClaims = req.Spec.PermissionClaims
 
 		logger.V(1).Info("Creating APIServiceExport", "name", export.Name, "namespace", export.Namespace)
 		if err := r.createServiceExport(ctx, cl, export); err != nil {
@@ -283,3 +264,85 @@ func (r *reconciler) ensureExports(ctx context.Context, cl client.Client, cache
 
 	return nil
 }
+
+// Validate validates if the APIServiceExportRequest is in a valid state.
+// Currently it validates if all requested schemas are of the same scope and
+// if claimable apis are allowed and valid.
+func (r *reconciler) validate(ctx context.Context, cl client.Client, req *kubebindv1alpha2.APIServiceExportRequest) error {
+	exportedSchemas, err := r.getExportedSchemas(ctx, cl)
+	if err != nil {
+		return err
+	}
+
+	if len(exportedSchemas) == 0 {
+		conditions.MarkFalse(
+			req,
+			kubebindv1alpha2.APIServiceExportRequestConditionExportsReady,
+			"SchemaNotFound",
+			conditionsapi.ConditionSeverityError,
+			"SchemaNotFound not found",
+		)
+		return fmt.Errorf("no exported schemas found")
+	}
+
+	scopes := make([]apiextensionsv1.ResourceScope, 0, len(exportedSchemas))
+	for _, res := range req.Spec.Resources {
+		boundSchema, ok := exportedSchemas[res.ResourceGroupName()]
+		if !ok {
+			conditions.MarkFalse(
+				req,
+				kubebindv1alpha2.APIServiceExportRequestConditionExportsReady,
+				"SchemaNotFound",
+				conditionsapi.ConditionSeverityError,
+				"Schema %s not found",
+				res.ResourceGroupName(),
+			)
+			return fmt.Errorf("schema %s not found", res.ResourceGroupName())
+		}
+		scopes = append(scopes, boundSchema.Spec.Scope)
+	}
+
+	// Check CRD scopes matches.
+	if len(scopes) > 1 {
+		first := scopes[0]
+		for _, scope := range scopes[1:] {
+			if scope != first {
+				conditions.MarkFalse(req,
+					kubebindv1alpha2.APIServiceExportRequestConditionExportsReady,
+					"DifferentScopes",
+					conditionsapi.ConditionSeverityError,
+					"Different scopes found: %v",
+					scopes,
+				)
+				return fmt.Errorf("different scopes found for claimed resources: %v", scopes)
+			}
+		}
+	}
+
+	// Add validation if claimable apis are valid here
+	for _, claim := range req.Spec.PermissionClaims {
+		if !isClaimableAPI(claim) {
+			conditions.MarkFalse(
+				req,
+				kubebindv1alpha2.APIServiceExportConditionPermissionClaim,
+				"InvalidPermissionClaim",
+				conditionsapi.ConditionSeverityError,
+				"Resource %s is not a valid claimable API",
+				claim.GroupResource.String(),
+			)
+			return fmt.Errorf("resource %s is not a valid claimable API", claim.GroupResource.String())
+		}
+	}
+
+	return nil
+}
+
+// isClaimableAPI checks if a permission claim is for a claimable API.
+func isClaimableAPI(claim kubebindv1alpha2.PermissionClaim) bool {
+	for _, api := range kubebindv1alpha2.ClaimableAPIs {
+		if claim.Group == api.GroupVersionResource.Group && claim.Resource == api.Names.Plural {
+			return true
+		}
+	}
+	return false
+}

backend/controllers/servicenamespace/servicenamespace_controller.go

@@ -230,7 +230,7 @@ func (r *APIServiceNamespaceReconciler) Reconcile(ctx context.Context, req mcrec
 
 	// Fetch the APIServiceNamespace instance
 	apiServiceNamespace := &kubebindv1alpha2.APIServiceNamespace{}
-	if err := client.Get(ctx, req.NamespacedName, apiServiceNamespace); err != nil {
+	if err := cache.Get(ctx, req.NamespacedName, apiServiceNamespace); err != nil {
 		if errors.IsNotFound(err) {
 			// Request object not found, could have been deleted after reconcile request.
 			// Handle deletion logic here