Fix backend scoping

mjudeikis · mjudeikis · commit be86cd95448f · 2025-09-15T17:39:53.000+03:00
diff --git a/backend/controllers/clusterbinding/clusterbinding_reconcile.go b/backend/controllers/clusterbinding/clusterbinding_reconcile.go
@@ -172,15 +172,18 @@ func (r *reconciler) ensureRBACClusterRole(ctx context.Context, client client.Cl
 					Resources: []string{schema.Spec.Names.Plural},
 					Verbs:     []string{"get", "list", "watch", "create", "update", "patch", "delete"},
 				},
-				rbacv1.PolicyRule{
-					APIGroups: []string{kubebindv1alpha2.GroupName},
-					Resources: []string{"boundschemas"},
-					Verbs:     []string{"get", "list", "watch"},
-				},
 			)
 		}
 	}
 
+	expected.Rules = append(expected.Rules,
+		rbacv1.PolicyRule{
+			APIGroups: []string{kubebindv1alpha2.GroupName},
+			Resources: []string{"boundschemas"},
+			Verbs:     []string{"get", "list", "watch"},
+		},
+	)
+
 	if role == nil {
 		if err := r.createClusterRole(ctx, client, expected); err != nil {
 			return fmt.Errorf("failed to create ClusterRole %s: %w", expected.Name, err)
@@ -202,7 +205,6 @@ func (r *reconciler) ensureRBACClusterRoleBinding(ctx context.Context, client cl
 	if err != nil && !errors.IsNotFound(err) {
 		return fmt.Errorf("failed to get ClusterRoleBinding %s: %w", name, err)
 	}
-
 	if r.scope != kubebindv1alpha2.ClusterScope {
 		if err := r.deleteClusterRoleBinding(ctx, client, name); err != nil && !errors.IsNotFound(err) {
 			return fmt.Errorf("failed to delete ClusterRoleBinding %s: %w", name, err)
diff --git a/backend/controllers/serviceexportrequest/serviceexportrequest_controller.go b/backend/controllers/serviceexportrequest/serviceexportrequest_controller.go
@@ -215,7 +215,17 @@ func (r *APIServiceExportRequestReconciler) Reconcile(ctx context.Context, req m
 	// Run the reconciliation logic
 	if err := r.reconciler.reconcile(ctx, client, cache, apiServiceExportRequest); err != nil {
 		logger.Error(err, "Failed to reconcile APIServiceExportRequest")
-		return ctrl.Result{}, err
+		// we still need to update status to reflect error conditions.
+		if !reflect.DeepEqual(original.Status, apiServiceExportRequest.Status) {
+			err := client.Status().Update(ctx, apiServiceExportRequest)
+			if err != nil {
+				logger.Error(err, "Failed to update APIServiceExportRequest status after reconciliation error")
+				return ctrl.Result{}, fmt.Errorf("failed to update APIServiceExportRequest status after reconciliation error: %w", err)
+			}
+		}
+		return ctrl.Result{
+			Requeue: false,
+		}, err
 	}
 
 	// Update status if it has changed
diff --git a/backend/controllers/serviceexportrequest/serviceexportrequest_reconcile.go b/backend/controllers/serviceexportrequest/serviceexportrequest_reconcile.go
@@ -54,10 +54,12 @@ type reconciler struct {
 
 func (r *reconciler) reconcile(ctx context.Context, cl client.Client, cache cache.Cache, req *kubebindv1alpha2.APIServiceExportRequest) error {
 	if err := r.ensureBoundSchemas(ctx, cl, cache, req); err != nil {
+		conditions.SetSummary(req)
 		return err
 	}
 
 	if err := r.ensureExports(ctx, cl, cache, req); err != nil {
+		conditions.SetSummary(req)
 		return err
 	}
 
@@ -119,7 +121,26 @@ func (r *reconciler) ensureBoundSchemas(ctx context.Context, cl client.Client, c
 				klog.FromContext(ctx).Error(nil, "Skipping invalid schema: missing group or names.plural", "ns", item.GetNamespace(), "name", item.GetName())
 				continue
 			}
+			scope := apiextensionsv1.ResourceScope(spec["scope"].(string))
+
 			if g == res.Group && p == res.Resource {
+				// Important: This checks if the resource are right-scoped. If consumer is namespaced, we can't allow this.
+				// We terminate early to prevent triggering other controllers.
+				if r.informerScope.String() != string(scope) && r.informerScope != kubebindv1alpha2.ClusterScope {
+					conditions.MarkFalse(
+						req,
+						kubebindv1alpha2.APIServiceExportRequestConditionExportsReady,
+						"APIServiceExportRequestInvalid",
+						conditionsapi.ConditionSeverityError,
+						"APIServiceExportRequest %s is invalid: resource %s/%s has scope %q which is incompatible with backend informer scope %q",
+						req.Name, g, p, scope, r.informerScope,
+					)
+					req.Status.Phase = kubebindv1alpha2.APIServiceExportRequestPhaseFailed
+					req.Status.TerminalMessage = conditions.GetMessage(req, kubebindv1alpha2.APIServiceExportRequestConditionExportsReady)
+					// We can't proceed with this request.
+					return nil
+				}
+
 				boundSchema, err := helpers.UnstructuredToBoundSchema(item)
 				if err != nil {
 					return err
diff --git a/backend/http/handler.go b/backend/http/handler.go
@@ -388,6 +388,11 @@ func (h *handler) handleResources(w http.ResponseWriter, r *http.Request) {
 			scope = "-"
 		}
 
+		// TODO(mjudeikis): This parsing is very brittle. This is fixed in follow-up permissionClaims PR.
+		if !strings.EqualFold(h.scope.String(), scope.(string)) && h.scope != kubebindv1alpha2.ClusterScope {
+			continue
+		}
+
 		group := item.UnstructuredContent()["spec"].(map[string]interface{})["group"]
 		if group == nil {
 			group = "-"
diff --git a/backend/kubernetes/manager.go b/backend/kubernetes/manager.go
@@ -192,24 +192,3 @@ func (m *Manager) ListDynamicResources(ctx context.Context, cluster string, gvk
 
 	return list, nil
 }
-
-/* func (m *Manager) CreateBoundSchema(ctx context.Context, cluster string, name string, u *unstructured.Unstructured) error {
-	cl, err := m.manager.GetCluster(ctx, cluster)
-	if err != nil {
-		return err
-	}
-	c := cl.GetClient()
-
-	boundSchema := &kubebindv1alpha2.BoundSchema{}
-	err = runtime.DefaultUnstructuredConverter.FromUnstructured(u.UnstructuredContent(), boundSchema)
-	if err != nil {
-		return err
-	}
-
-	boundSchema.ResourceVersion = ""
-	boundSchema.Name = name
-	boundSchema.Spec.InformerScope = m.scope
-
-	return c.Create(ctx, boundSchema)
-}
-*/
diff --git a/kcp/README.md b/kcp/README.md
@@ -73,8 +73,9 @@ kubectl kcp bind apiexport root:kube-bind:kube-bind.io --accept-permission-claim
 
 7. Create CRD:
 ```bash
-kubectl create -f kcp/deploy/examples/apiexport.yaml  
-kubectl create -f kcp/deploy/examples/apiresourceschema.yaml
+kubectl apply -f kcp/deploy/examples/apiexport.yaml  
+kubectl create -f kcp/deploy/examples/apiresourceschema-cowboys.yaml
+kubectl create -f kcp/deploy/examples/apiresourceschema-sheriffs.yaml
 # recursive bind
 kubectl kcp bind apiexport root:provider:cowboys-stable
 ```
@@ -84,7 +85,7 @@ kubectl kcp bind apiexport root:provider:cowboys-stable
 ```bash
 kubectl get logicalcluster
 # NAME      PHASE   URL                                                    AGE
-# cluster   Ready   https://192.168.2.166:6443/clusters/2xh2v3gzjhn4tmve 
+# cluster   Ready   https://192.168.2.166:6443/clusters/2d0i12ky2qn7e4js 
 ```
 
 9. Now we gonna initiate consumer:
@@ -98,13 +99,13 @@ kubectl ws create consumer --enter
 10. Bind the thing:
 
 ```bash
-./bin/kubectl-bind http://127.0.0.1:8080/clusters/2vgrh380y0cq38du/exports --dry-run -o yaml > apiserviceexport.yaml
+./bin/kubectl-bind http://127.0.0.1:8080/clusters/2d0i12ky2qn7e4js/exports --dry-run -o yaml > apiserviceexport.yaml
 
 # Extract secret for binding process. Note that secret name is not the same as output from command above. Check secret
 # name by running `kubectl get secret -n kube-bind` 
-kubectl get secret kubeconfig-wvvsb -n kube-bind -o jsonpath='{.data.kubeconfig}' | base64 -d > remote.kubeconfig
+kubectl get secret kubeconfig-49z2s -n kube-bind -o jsonpath='{.data.kubeconfig}' | base64 -d > remote.kubeconfig
 
-./bin/kubectl-bind apiservice --remote-kubeconfig remote.kubeconfig -f apiserviceexport.yaml  --skip-konnector --remote-namespace kube-bind-m5zx4
+./bin/kubectl-bind apiservice --remote-kubeconfig remote.kubeconfig -f kcp/deploy/examples/apiserviceexport-cluster.yaml  --skip-konnector --remote-namespace kube-bind-jjgms
 
 export KUBECONFIG=.kcp/consumer.kubeconfig
 go run ./cmd/konnector/ --lease-namespace default
@@ -131,9 +132,9 @@ go run ./cmd/konnector/ --lease-namespace default --server-address :8091
 Create objects:
 ```
 kubectl apply -f kcp/deploy/examples/cowboy.yaml
+kubectl apply -f kcp/deploy/examples/sheriff.yaml
 ```
 
-
 ## Debug
 
 ```bash
diff --git a/kcp/deploy/examples/apiexport.yaml b/kcp/deploy/examples/apiexport.yaml
@@ -7,5 +7,10 @@ spec:
   - group: wildwest.dev
     name: cowboys
     schema: today.cowboys.wildwest.dev
+    storage:
+      crd: {}
+  - group: wildwest.dev
+    name: sheriffs
+    schema: today.sheriffs.wildwest.dev
     storage:
       crd: {}
diff --git a/kcp/deploy/examples/apiresourceschema-cowboys.yaml b/kcp/deploy/examples/apiresourceschema-cowboys.yaml
@@ -0,0 +1,48 @@
+apiVersion: apis.kcp.io/v1alpha1
+kind: APIResourceSchema
+metadata:
+  name: today.cowboys.wildwest.dev
+  labels:
+    kube-bind.io/exported: "true"
+spec:
+  group: wildwest.dev
+  names:
+    kind: Cowboy
+    listKind: CowboyList
+    plural: cowboys
+    singular: cowboy
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      description: Cowboy is part of the wild west
+      properties:
+        apiVersion:
+          description: 'APIVersion defines the versioned schema of this representation
+            of an object. Servers should convert recognized schemas to the latest
+            internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+          type: string
+        kind:
+          description: 'Kind is a string value representing the REST resource this
+            object represents. Servers may infer this from the endpoint the client
+            submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+          type: string
+        metadata:
+          type: object
+        spec:
+          description: CowboySpec holds the desired state of the Cowboy.
+          properties:
+            intent:
+              type: string
+          type: object
+        status:
+          description: CowboyStatus communicates the observed state of the Cowboy.
+          properties:
+            result:
+              type: string
+          type: object
+      type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/kcp/deploy/examples/apiresourceschema-sheriffs.yaml b/kcp/deploy/examples/apiresourceschema-sheriffs.yaml
@@ -0,0 +1,48 @@
+apiVersion: apis.kcp.io/v1alpha1
+kind: APIResourceSchema
+metadata:
+  name: today.sheriffs.wildwest.dev
+  labels:
+    kube-bind.io/exported: "true"
+spec:
+  group: wildwest.dev
+  names:
+    kind: Sheriff
+    listKind: SheriffList
+    plural: sheriffs
+    singular: sheriff
+  scope: Cluster
+  versions:
+  - name: v1alpha1
+    schema:
+      description: Sheriff is part of the wild west
+      properties:
+        apiVersion:
+          description: 'APIVersion defines the versioned schema of this representation
+            of an object. Servers should convert recognized schemas to the latest
+            internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+          type: string
+        kind:
+          description: 'Kind is a string value representing the REST resource this
+            object represents. Servers may infer this from the endpoint the client
+            submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+          type: string
+        metadata:
+          type: object
+        spec:
+          description: SheriffSpec holds the desired state of the Sheriff.
+          properties:
+            intent:
+              type: string
+          type: object
+        status:
+          description: SheriffStatus communicates the observed state of the Sheriff.
+          properties:
+            result:
+              type: string
+          type: object
+      type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/kcp/deploy/examples/apiserviceexport-cluster.yaml b/kcp/deploy/examples/apiserviceexport-cluster.yaml
@@ -0,0 +1,11 @@
+apiVersion: kube-bind.io/v1alpha2
+kind: APIServiceExportRequest
+metadata:
+  name: sheriffs.wildwest.dev
+spec:
+  resources:
+  - group: wildwest.dev
+    resource: sheriffs
+    versions:
+    - v1alpha1
+status: {}
diff --git a/kcp/deploy/examples/apiserviceexport-namespaced.yaml b/kcp/deploy/examples/apiserviceexport-namespaced.yaml
@@ -0,0 +1,11 @@
+apiVersion: kube-bind.io/v1alpha2
+kind: APIServiceExportRequest
+metadata:
+  name: cowboys.wildwest.dev
+spec:
+  resources:
+  - group: wildwest.dev
+    resource: cowboys
+    versions:
+    - v1alpha1
+status: {}
diff --git a/kcp/deploy/examples/sheriff.yaml b/kcp/deploy/examples/sheriff.yaml
@@ -0,0 +1,8 @@
+apiVersion: wildwest.dev/v1alpha1
+kind: Sheriff
+metadata:
+  name: sheriff
+spec:
+  intent: "ride into the sunset"
+status:
+  result: "ready to ride"
diff --git a/pkg/konnector/controllers/cluster/cluster_controller.go b/pkg/konnector/controllers/cluster/cluster_controller.go
@@ -132,6 +132,7 @@ func NewController(
 		providerConfig,
 		serviceBindingInformer,
 		providerBindInformers.KubeBind().V1alpha2().APIServiceExports(),
+		providerBindInformers.KubeBind().V1alpha2().APIServiceExportRequests(),
 		crdInformer,
 	)
 	if err != nil {
diff --git a/pkg/konnector/controllers/cluster/servicebinding/servicebinding_controller.go b/pkg/konnector/controllers/cluster/servicebinding/servicebinding_controller.go
@@ -54,6 +54,7 @@ func NewController(
 	consumerConfig, providerConfig *rest.Config,
 	serviceBindingInformer dynamic.Informer[bindlisters.APIServiceBindingLister],
 	serviceExportInformer bindinformers.APIServiceExportInformer,
+	serviceExportRequestInformer bindinformers.APIServiceExportRequestInformer,
 	crdInformer dynamic.Informer[apiextensionslisters.CustomResourceDefinitionLister],
 ) (*controller, error) {
 	queue := workqueue.NewTypedRateLimitingQueueWithConfig(workqueue.DefaultTypedControllerRateLimiter[string](), workqueue.TypedRateLimitingQueueConfig[string]{Name: controllerName})
@@ -97,6 +98,9 @@ func NewController(
 			getServiceExport: func(name string) (*kubebindv1alpha2.APIServiceExport, error) {
 				return serviceExportInformer.Lister().APIServiceExports(providerNamespace).Get(name)
 			},
+			getServiceExportRequest: func(name string) (*kubebindv1alpha2.APIServiceExportRequest, error) {
+				return serviceExportRequestInformer.Lister().APIServiceExportRequests(providerNamespace).Get(name)
+			},
 			getServiceBinding: func(name string) (*kubebindv1alpha2.APIServiceBinding, error) {
 				return serviceBindingInformer.Lister().Get(name)
 			},
diff --git a/pkg/konnector/controllers/cluster/servicebinding/servicebinding_reconcile.go b/pkg/konnector/controllers/cluster/servicebinding/servicebinding_reconcile.go
@@ -37,6 +37,7 @@ type reconciler struct {
 
 	reconcileServiceBinding func(binding *kubebindv1alpha2.APIServiceBinding) bool
 	getServiceExport        func(name string) (*kubebindv1alpha2.APIServiceExport, error)
+	getServiceExportRequest func(name string) (*kubebindv1alpha2.APIServiceExportRequest, error)
 	getServiceBinding       func(name string) (*kubebindv1alpha2.APIServiceBinding, error)
 	getClusterBinding       func(ctx context.Context) (*kubebindv1alpha2.ClusterBinding, error)
 	getBoundSchema          func(ctx context.Context, name string) (*kubebindv1alpha2.BoundSchema, error)
@@ -78,6 +79,21 @@ func (r *reconciler) ensureValidServiceExport(_ context.Context, binding *kubebi
 	if _, err := r.getServiceExport(binding.Name); err != nil && !errors.IsNotFound(err) {
 		return err
 	} else if errors.IsNotFound(err) {
+		// If serviceexport is not found, check if request is not in failed state already:
+		request, errRequest := r.getServiceExportRequest(binding.Name)
+		if errRequest == nil && request.Status.Phase == kubebindv1alpha2.APIServiceExportRequestPhaseFailed {
+			// If request is in failed state, propagate the message to binding status and mark as failed
+			conditions.MarkFalse(
+				binding,
+				kubebindv1alpha2.APIServiceBindingConditionConnected,
+				"APIServiceExportFailed",
+				conditionsapi.ConditionSeverityError,
+				request.Status.TerminalMessage,
+				binding.Name,
+			)
+			return fmt.Errorf("APIServiceExportRequest %s is in failed state: %s", binding.Name, request.Status.TerminalMessage)
+		}
+
 		conditions.MarkFalse(
 			binding,
 			kubebindv1alpha2.APIServiceBindingConditionConnected,
diff --git a/sdk/apis/kubebind/v1alpha2/boundchema_types.go b/sdk/apis/kubebind/v1alpha2/boundchema_types.go
@@ -51,6 +51,10 @@ const (
 	NamespacedScope InformerScope = "Namespaced"
 )
 
+func (in InformerScope) String() string {
+	return string(in)
+}
+
 // BoundSchemaSpec defines the desired state of the BoundSchema.
 type BoundSchemaSpec struct {
 	// InformerScope indicates whether the informer for defined custom resource is cluster- or namespace-scoped.
