Add named resource selector

Author: mjudeikis

backend/controllers/serviceexportrequest/serviceexportrequest_reconcile.go

@@ -268,6 +268,9 @@ func (r *reconciler) ensureExports(ctx context.Context, cl client.Client, cache
 // Validate validates if the APIServiceExportRequest is in a valid state.
 // Currently it validates if all requested schemas are of the same scope and
 // if claimable apis are allowed and valid.
+//
+// TODO: Move this to validatingAdmissionWebhook as this is not really part of reconciliation.
+// https://github.com/kube-bind/kube-bind/issues/325
 func (r *reconciler) validate(ctx context.Context, cl client.Client, req *kubebindv1alpha2.APIServiceExportRequest) error {
 	exportedSchemas, err := r.getExportedSchemas(ctx, cl)
 	if err != nil {
@@ -326,10 +329,32 @@ func (r *reconciler) validate(ctx context.Context, cl client.Client, req *kubebi
 				"Resource %s is not a valid claimable API",
 				claim.GroupResource.String(),
 			)
+			req.Status.Phase = kubebindv1alpha2.APIServiceExportRequestPhaseFailed
+			req.Status.TerminalMessage = conditions.GetMessage(req, kubebindv1alpha2.APIServiceExportConditionPermissionClaim)
 			return fmt.Errorf("resource %s is not a valid claimable API", claim.GroupResource.String())
 		}
 	}
 
+	// Add validation for duplicate group/resource combinations
+	seenGroupResources := make(map[string]bool)
+	for _, claim := range req.Spec.PermissionClaims {
+		key := claim.Group + "/" + claim.Resource
+		if seenGroupResources[key] {
+			conditions.MarkFalse(
+				req,
+				kubebindv1alpha2.APIServiceExportConditionPermissionClaim,
+				"DuplicatePermissionClaim",
+				conditionsapi.ConditionSeverityError,
+				"Duplicate permission claim found for group/resource %s",
+				claim.GroupResource.String(),
+			)
+			req.Status.Phase = kubebindv1alpha2.APIServiceExportRequestPhaseFailed
+			req.Status.TerminalMessage = conditions.GetMessage(req, kubebindv1alpha2.APIServiceExportConditionPermissionClaim)
+			return fmt.Errorf("duplicate permission claim found for group/resource %s", claim.GroupResource.String())
+		}
+		seenGroupResources[key] = true
+	}
+
 	return nil
 }
 

contrib/kcp/README.md

@@ -51,7 +51,7 @@ k ws use :root:kube-bind
   --cookie-signing-key=bGMHz7SR9XcI9JdDB68VmjQErrjbrAR9JdVqjAOKHzE= \
   --cookie-encryption-key=wadqi4u+w0bqnSrVFtM38Pz2ykYVIeeadhzT34XlC1Y= \
   --schema-source apiresourceschemas \
-  --consumer-scope=namespaced
+  --consumer-scope=cluster
 ```
 
 
@@ -90,7 +90,7 @@ kubectl kcp bind apiexport root:provider:cowboys-stable
 ```bash
 kubectl get logicalcluster
 # NAME      PHASE   URL                                                    AGE
-# cluster   Ready   https://192.168.2.166:6443/clusters/xwhgz3kv8l67wx87    
+# cluster   Ready   https://192.168.2.166:6443/clusters/2es2zlav713acqlr    
 ```
 
 9. Now we gonna initiate consumer:
@@ -104,15 +104,15 @@ kubectl ws create consumer --enter
 10. Bind the thing:
 
 ```bash
-./bin/kubectl-bind http://127.0.0.1:8080/clusters/xwhgz3kv8l67wx87/exports --dry-run -o yaml > apiserviceexport.yaml
+./bin/kubectl-bind http://127.0.0.1:8080/clusters/2es2zlav713acqlr/exports --dry-run -o yaml > apiserviceexport.yaml
 
 # Extract secret for binding process. Note that secret name is not the same as output from command above. Check secret
 # name by running `kubectl get secret -n kube-bind` 
-kubectl get secret kubeconfig-ntgtl -n kube-bind -o jsonpath='{.data.kubeconfig}' | base64 -d > remote.kubeconfig
+kubectl get secret kubeconfig-pr2xk -n kube-bind -o jsonpath='{.data.kubeconfig}' | base64 -d > remote.kubeconfig
 
-./bin/kubectl-bind apiservice --remote-kubeconfig remote.kubeconfig -f contrib/kcp/deploy/examples/apiserviceexport-namespaced.yaml  --skip-konnector --remote-namespace kube-bind-wg2tb
+./bin/kubectl-bind apiservice --remote-kubeconfig remote.kubeconfig -f contrib/kcp/deploy/examples/apiserviceexport-namespaced.yaml  --skip-konnector --remote-namespace kube-bind-68mqq
 
-./bin/kubectl-bind apiservice --remote-kubeconfig remote.kubeconfig -f contrib/kcp/deploy/examples/apiserviceexport-cluster.yaml  --skip-konnector --remote-namespace kube-bind-wg2tb
+./bin/kubectl-bind apiservice --remote-kubeconfig remote.kubeconfig -f contrib/kcp/deploy/examples/apiserviceexport-cluster.yaml  --skip-konnector --remote-namespace kube-bind-68mqq
 
 
 export KUBECONFIG=.kcp/consumer.kubeconfig
@@ -142,3 +142,11 @@ kubectl label cm provider app=wildwest -n kube-bind-lxj5k-default
 
 kubectl create cm consumer -n default
 kubectl label cm consumer app=wildwest -n default
+
+kubectl create secret generic provider-secret 
+kubectl label secret provider-secret app=wildwest
+
+kubectl create namespace bob
+kubectl create secret generic wildwest-secrets1 -n bob
+kubectl label secret wildwest-secrets1 app=wildwest -n bob
+```

contrib/kcp/deploy/examples/apiserviceexport-namespaced.yaml

@@ -15,4 +15,13 @@ spec:
       labelSelector:
         matchLabels:
           app: wildwest
+  - apiGroup: ""
+    resource: secrets
+    selector:
+      labelSelector:
+        matchLabels:
+          app: wildwest
+      namedResource:
+      - name: wildwest-secrets
+        namespace: bob
 status: {}

contrib/kcp/deploy/resources/apiexport-kube-bind.io.yaml

@@ -54,7 +54,7 @@ spec:
       crd: {}
   - group: kube-bind.io
     name: apiserviceexportrequests
-    schema: v250926-b973783.apiserviceexportrequests.kube-bind.io
+    schema: v250926-8b1b3a8.apiserviceexportrequests.kube-bind.io
     storage:
       crd: {}
   - group: kube-bind.io

contrib/kcp/deploy/resources/apiresourceschema-apiserviceexportrequests.kube-bind.io.yaml

@@ -2,7 +2,7 @@ apiVersion: apis.kcp.io/v1alpha1
 kind: APIResourceSchema
 metadata:
   creationTimestamp: null
-  name: v250926-b973783.apiserviceexportrequests.kube-bind.io
+  name: v250926-8b1b3a8.apiserviceexportrequests.kube-bind.io
 spec:
   conversion:
     strategy: None

pkg/konnector/controllers/cluster/claimedresources/claimedresources_controller.go

@@ -39,6 +39,7 @@ import (
 	"github.com/kube-bind/kube-bind/pkg/indexers"
 	"github.com/kube-bind/kube-bind/pkg/konnector/controllers/cluster/serviceexport/multinsinformer"
 	"github.com/kube-bind/kube-bind/pkg/konnector/controllers/dynamic"
+	"github.com/kube-bind/kube-bind/pkg/resources"
 	kubebindv1alpha2 "github.com/kube-bind/kube-bind/sdk/apis/kubebind/v1alpha2"
 	bindclientset "github.com/kube-bind/kube-bind/sdk/client/clientset/versioned"
 	bindlisters "github.com/kube-bind/kube-bind/sdk/client/listers/kubebind/v1alpha2"
@@ -105,6 +106,8 @@ func NewController(
 
 		providerNamespace: providerNamespace,
 
+		namespaceCreationNotifyChan: namespaceCreationNotifyChan,
+
 		readReconciler: readReconciler{
 			getServiceNamespace: func(upstreamNamespace string) (*kubebindv1alpha2.APIServiceNamespace, error) {
 				sns, err := serviceNamespaceInformer.Informer().GetIndexer().ByIndex(indexers.ServiceNamespaceByNamespace, upstreamNamespace)
@@ -207,43 +210,7 @@ type controller struct {
 }
 
 func (c *controller) isClaimed(obj *unstructured.Unstructured) bool {
-	// Empty selector selects everything
-	if c.claim.Selector.LabelSelector == nil && len(c.claim.Selector.NamedResource) == 0 {
-		return true
-	}
-
-	// Both label selector and named resources must match if both are specified
-	labelSelectorMatches := true
-	namedResourceMatches := true
-
-	// Check label selector if specified
-	if c.claim.Selector.LabelSelector != nil {
-		selector, err := metav1.LabelSelectorAsSelector(c.claim.Selector.LabelSelector)
-		if err != nil {
-			return false
-		}
-		l := obj.GetLabels()
-		if l == nil {
-			l = make(map[string]string)
-		}
-		labelSelectorMatches = selector.Matches(labels.Set(l))
-	}
-
-	// Check named resources if specified
-	if len(c.claim.Selector.NamedResource) > 0 {
-		namedResourceMatches = false // Default to false, must match at least one
-		for _, nr := range c.claim.Selector.NamedResource {
-			if nr.Namespace != "" && nr.Namespace != obj.GetNamespace() {
-				continue
-			}
-			if nr.Name == obj.GetName() {
-				namedResourceMatches = true
-				break
-			}
-		}
-	}
-
-	return labelSelectorMatches && namedResourceMatches
+	return resources.IsClaimed(c.claim.Selector, obj)
 }
 
 func (c *controller) enqueueConsumer(logger klog.Logger, obj interface{}) {
@@ -306,6 +273,19 @@ func (c *controller) enqueueConsumerByKey(logger klog.Logger, key string) {
 }
 
 func (c *controller) enqueueProvider(logger klog.Logger, obj interface{}) {
+	// handle tombstones
+	if tombstone, ok := obj.(cache.DeletedFinalStateUnknown); ok {
+		obj = tombstone.Obj
+	}
+	o, ok := obj.(*unstructured.Unstructured)
+	if !ok {
+		runtime.HandleError(fmt.Errorf("unexpected type %T in enqueueProvider", obj))
+		return
+	}
+	if !c.isClaimed(o) {
+		return
+	}
+
 	providerKey, err := cache.DeletionHandlingMetaNamespaceKeyFunc(obj)
 	if err != nil {
 		runtime.HandleError(err)
@@ -372,6 +352,16 @@ func (c *controller) enqueueServiceNamespace(logger klog.Logger, obj interface{}
 		return
 	}
 	for _, obj := range objs {
+		unstructuredObj, ok := obj.(*unstructured.Unstructured)
+		if !ok {
+			continue
+		}
+
+		// Check if the provider object is actually claimed using the full selector logic.
+		if !c.isClaimed(unstructuredObj) {
+			continue
+		}
+
 		key, err := cache.MetaNamespaceKeyFunc(obj)
 		if err != nil {
 			runtime.HandleError(err)
@@ -402,7 +392,10 @@ func (c *controller) enqueueServiceNamespace(logger klog.Logger, obj interface{}
 		return
 	}
 	for _, obj := range objects {
-		logger.Info("enqueueing consumer object", "obj", obj)
+		// Check if the object is actually claimed using the full selector logic
+		if !c.isClaimed(obj) {
+			continue
+		}
 
 		key, err := cache.DeletionHandlingMetaNamespaceKeyFunc(obj)
 		if err != nil {

pkg/konnector/controllers/cluster/claimedresourcesnamespaces/claimedresourcesnamespaces_controller.go

@@ -24,7 +24,6 @@ import (
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/util/runtime"
 	"k8s.io/apimachinery/pkg/util/wait"
@@ -35,6 +34,7 @@ import (
 	"k8s.io/klog/v2"
 
 	"github.com/kube-bind/kube-bind/pkg/konnector/controllers/dynamic"
+	"github.com/kube-bind/kube-bind/pkg/resources"
 	kubebindv1alpha2 "github.com/kube-bind/kube-bind/sdk/apis/kubebind/v1alpha2"
 	bindclientset "github.com/kube-bind/kube-bind/sdk/client/clientset/versioned"
 	bindlisters "github.com/kube-bind/kube-bind/sdk/client/listers/kubebind/v1alpha2"
@@ -115,21 +115,7 @@ type controller struct {
 }
 
 func (c *controller) isClaimed(obj *unstructured.Unstructured) bool {
-	// Check if obj is selected by label selector
-	if c.claim.Selector.LabelSelector != nil {
-		selector, err := metav1.LabelSelectorAsSelector(c.claim.Selector.LabelSelector)
-		if err != nil {
-			return false
-		}
-		l := obj.GetLabels()
-		if l == nil {
-			l = make(map[string]string)
-		}
-
-		return selector.Matches(labels.Set(l))
-	}
-
-	return false
+	return resources.IsClaimed(c.claim.Selector, obj)
 }
 
 func (c *controller) enqueueConsumer(logger klog.Logger, obj interface{}) {
@@ -278,6 +264,25 @@ func (c *controller) ensureServiceNamespace(ctx context.Context, ns string) (cre
 		return false, fmt.Errorf("failed to create APIServiceNamespace %q: %w", ns, err)
 	}
 
+	// Wait until the servicenamespace status has been updated.
+	// As this controller does not do anything else, we are ok to block here.
+	err = wait.PollUntilContextCancel(ctx, 500*time.Millisecond, true, func(ctx context.Context) (done bool, err error) {
+		sns, err := c.serviceNamespaceInformer.Lister().APIServiceNamespaces(c.providerNamespace).Get(ns)
+		if err != nil {
+			if errors.IsNotFound(err) {
+				return false, nil // keep polling
+			}
+			return false, err
+		}
+		if sns.Status.Namespace != "" {
+			return true, nil
+		}
+		return false, nil
+	})
+	if err != nil {
+		return false, fmt.Errorf("failed to wait for APIServiceNamespace %q to be ready: %w", ns, err)
+	}
+
 	logger.Info("APIServiceNamespace created successfully")
 	return true, nil
 }

pkg/resources/resources.go

@@ -0,0 +1,50 @@
+package resources
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/labels"
+
+	kubebindv1alpha2 "github.com/kube-bind/kube-bind/sdk/apis/kubebind/v1alpha2"
+)
+
+// IsClaimed returns true if the given object matches the given selector and named resources.
+func IsClaimed(selector kubebindv1alpha2.Selector, obj *unstructured.Unstructured) bool {
+	// Empty selector selects everything
+	if selector.LabelSelector == nil && len(selector.NamedResource) == 0 {
+		return true
+	}
+
+	// Both label selector and named resources must match if both are specified
+	labelSelectorMatches := true
+	namedResourceMatches := true
+
+	// Check label selector if specified
+	if selector.LabelSelector != nil {
+		selector, err := metav1.LabelSelectorAsSelector(selector.LabelSelector)
+		if err != nil {
+			return false
+		}
+		l := obj.GetLabels()
+		if l == nil {
+			l = make(map[string]string)
+		}
+		labelSelectorMatches = selector.Matches(labels.Set(l))
+	}
+
+	// Check named resources if specified
+	if len(selector.NamedResource) > 0 {
+		namedResourceMatches = false // Default to false, must match at least one
+		for _, nr := range selector.NamedResource {
+			if nr.Namespace != "" && nr.Namespace != obj.GetNamespace() {
+				continue
+			}
+			if nr.Name == obj.GetName() {
+				namedResourceMatches = true
+				break
+			}
+		}
+	}
+
+	return labelSelectorMatches && namedResourceMatches
+}