wire in permission claim to apiServiceExport & binding

mjudeikis · mjudeikis · commit d9cca982c3a7 · 2025-09-11T11:13:19.000+03:00
diff --git a/apiserviceexport.yaml b/apiserviceexport.yaml
@@ -0,0 +1,11 @@
+apiVersion: kube-bind.io/v1alpha2
+kind: APIServiceExportRequest
+metadata:
+  name: sheriffs.wildwest.dev
+spec:
+  resources:
+  - group: wildwest.dev
+    resource: sheriffs
+    versions:
+    - v1alpha1
+status: {}
diff --git a/backend/controllers/serviceexportrequest/serviceexportrequest_reconcile.go b/backend/controllers/serviceexportrequest/serviceexportrequest_reconcile.go
@@ -228,6 +228,7 @@ func (r *reconciler) ensureExports(ctx context.Context, cl client.Client, cache
 				Versions: res.Versions,
 			})
 		}
+		export.Spec.PermissionClaims = req.Spec.PermissionClaims
 
 		logger.V(1).Info("Creating APIServiceExport", "name", export.Name, "namespace", export.Namespace)
 		if err := r.createServiceExport(ctx, cl, export); err != nil {
@@ -288,6 +289,7 @@ func (r *reconciler) validate(ctx context.Context, cl client.Client, req *kubebi
 		scopes = append(scopes, boundSchema.Spec.Scope)
 	}
 
+	// Check CRD scopes matches.
 	if len(scopes) > 1 {
 		first := scopes[0]
 		for _, scope := range scopes[1:] {
@@ -304,5 +306,30 @@ func (r *reconciler) validate(ctx context.Context, cl client.Client, req *kubebi
 		}
 	}
 
+	// Add validation if claimable apis are valid here
+	for _, claim := range req.Spec.PermissionClaims {
+		if !isClaimableAPI(claim) {
+			conditions.MarkFalse(
+				req,
+				kubebindv1alpha2.APIServiceExportConditionPermissionClaim,
+				"InvalidPermissionClaim",
+				conditionsapi.ConditionSeverityError,
+				"Resource %s is not a valid claimable API",
+				claim.GroupResource.String(),
+			)
+			return fmt.Errorf("resource %s is not a valid claimable API", claim.GroupResource.String())
+		}
+	}
+
 	return nil
 }
+
+// isClaimableAPI checks if a permission claim is for a claimable API.
+func isClaimableAPI(claim kubebindv1alpha2.PermissionClaim) bool {
+	for _, api := range kubebindv1alpha2.ClaimableAPIs {
+		if claim.Group == api.GroupVersion.Group && claim.Resource == api.Names.Plural {
+			return true
+		}
+	}
+	return false
+}
diff --git a/backend/kubernetes/resources/rbac.go b/backend/kubernetes/resources/rbac.go
@@ -109,7 +109,7 @@ func EnsureBinderClusterRole(ctx context.Context, client client.Client) error {
 			},
 			{
 				APIGroups: []string{"kube-bind.io"},
-				Resources: []string{"boundaschemas/status"},
+				Resources: []string{"boundschemas/status"},
 				Verbs:     []string{"get", "list", "patch", "update"},
 			},
 		},
diff --git a/cli/pkg/kubectl/bind-apiservice/plugin/servicebindings.go b/cli/pkg/kubectl/bind-apiservice/plugin/servicebindings.go
@@ -89,6 +89,7 @@ func (b *BindAPIServiceOptions) createAPIServiceBindings(ctx context.Context, co
 						},
 						Namespace: "kube-bind",
 					},
+					PermissionClaims: request.Spec.PermissionClaims,
 				},
 			}, metav1.CreateOptions{})
 			if err != nil {
diff --git a/deploy/crd/kube-bind.io_apiservicebindings.yaml b/deploy/crd/kube-bind.io_apiservicebindings.yaml
@@ -227,6 +227,118 @@ spec:
                 x-kubernetes-validations:
                 - message: kubeconfigSecretRef is immutable
                   rule: self == oldSelf
+              permissionClaims:
+                description: |-
+                  PermissionClaims records decisions about permission claims requested by the service provider.
+                  Access is granted per GroupResource.
+                items:
+                  description: |-
+                    permissionClaim selects objects of a GVR that a service provider may
+                    request and that a consumer may accept and allow the service provider access to.
+                  properties:
+                    group:
+                      default: ""
+                      description: |-
+                        group is the name of an API group.
+                        For core groups this is the empty string '""'.
+                      pattern: ^(|[a-z0-9]([-a-z0-9]*[a-z0-9](\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)?)$
+                      type: string
+                    resource:
+                      description: |-
+                        resource is the name of the resource.
+                        Note: it is worth noting that you can not ask for permissions for resource provided by a CRD
+                        not provided by an service binding export.
+                      pattern: ^[a-z][-a-z0-9]*[a-z0-9]$
+                      type: string
+                    selector:
+                      description: Selector is a resource selector that selects objects
+                        of a GVR.
+                      properties:
+                        all:
+                          description: |-
+                            all claims all resources for the given group/resource.
+                            This is mutually exclusive with resourceSelector.
+                          type: boolean
+                        labelSelector:
+                          description: LabelSelector is a label selector that selects
+                            objects of a GVR.
+                          properties:
+                            matchExpressions:
+                              description: matchExpressions is a list of label selector
+                                requirements. The requirements are ANDed.
+                              items:
+                                description: |-
+                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                  relates the key and values.
+                                properties:
+                                  key:
+                                    description: key is the label key that the selector
+                                      applies to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      operator represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                    type: string
+                                  values:
+                                    description: |-
+                                      values is an array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. This array is replaced during a strategic
+                                      merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                type: string
+                              description: |-
+                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        resourceNames:
+                          description: resourceNames is a list of resource names to
+                            select.
+                          items:
+                            description: |-
+                              SelectorResourceName identifies a specific resource by name.
+                              If backend operates at the namespace level isolation, namespace will be included.
+                            properties:
+                              name:
+                                description: Name is the name of the resource.
+                                type: string
+                            required:
+                            - name
+                            type: object
+                          type: array
+                      type: object
+                    verbs:
+                      description: Verbs is a list of verbs that are required by the
+                        provider to operate.
+                      items:
+                        type: string
+                      type: array
+                    versions:
+                      description: |-
+                        versions is a list of versions that should be exported. If this is empty
+                        a sensible default is chosen by the service provider.
+                      items:
+                        type: string
+                      type: array
+                  required:
+                  - resource
+                  type: object
+                type: array
             required:
             - kubeconfigSecretRef
             type: object
diff --git a/kcp/deploy/examples/apiserviceexport.yaml b/kcp/deploy/examples/apiserviceexport.yaml
@@ -1,15 +1,23 @@
 apiVersion: kube-bind.io/v1alpha2
 kind: APIServiceExportRequest
 metadata:
-  name: wildwest.dev
+  name: cowboys.wildwest.dev
 spec:
   resources:
-  - group: wildwest.dev
-    resource: sheriffs
-    versions:
-    - v1alpha1
   - group: wildwest.dev
     resource: cowboys
     versions:
     - v1alpha1
+  permissionClaims:
+  - apiGroup: ""
+    resource: configmaps
+    verbs:
+    - get
+    - list
+    - watch
+    - create
+    selector:
+      labelSelector:
+        matchLabels:
+          app: wildwest
 status: {}
diff --git a/kcp/deploy/resources/apiexport-kube-bind.io.yaml b/kcp/deploy/resources/apiexport-kube-bind.io.yaml
@@ -49,7 +49,7 @@ spec:
       crd: {}
   - group: kube-bind.io
     name: apiservicebindings
-    schema: v250809-5ed76a1.apiservicebindings.kube-bind.io
+    schema: v250911-7cffdae.apiservicebindings.kube-bind.io
     storage:
       crd: {}
   - group: kube-bind.io
diff --git a/kcp/deploy/resources/apiresourceschema-apiservicebindings.kube-bind.io.yaml b/kcp/deploy/resources/apiresourceschema-apiservicebindings.kube-bind.io.yaml
@@ -2,7 +2,7 @@ apiVersion: apis.kcp.io/v1alpha1
 kind: APIResourceSchema
 metadata:
   creationTimestamp: null
-  name: v250809-5ed76a1.apiservicebindings.kube-bind.io
+  name: v250911-7cffdae.apiservicebindings.kube-bind.io
 spec:
   conversion:
     strategy: None
@@ -222,6 +222,118 @@ spec:
               x-kubernetes-validations:
               - message: kubeconfigSecretRef is immutable
                 rule: self == oldSelf
+            permissionClaims:
+              description: |-
+                PermissionClaims records decisions about permission claims requested by the service provider.
+                Access is granted per GroupResource.
+              items:
+                description: |-
+                  permissionClaim selects objects of a GVR that a service provider may
+                  request and that a consumer may accept and allow the service provider access to.
+                properties:
+                  group:
+                    default: ""
+                    description: |-
+                      group is the name of an API group.
+                      For core groups this is the empty string '""'.
+                    pattern: ^(|[a-z0-9]([-a-z0-9]*[a-z0-9](\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)?)$
+                    type: string
+                  resource:
+                    description: |-
+                      resource is the name of the resource.
+                      Note: it is worth noting that you can not ask for permissions for resource provided by a CRD
+                      not provided by an service binding export.
+                    pattern: ^[a-z][-a-z0-9]*[a-z0-9]$
+                    type: string
+                  selector:
+                    description: Selector is a resource selector that selects objects
+                      of a GVR.
+                    properties:
+                      all:
+                        description: |-
+                          all claims all resources for the given group/resource.
+                          This is mutually exclusive with resourceSelector.
+                        type: boolean
+                      labelSelector:
+                        description: LabelSelector is a label selector that selects
+                          objects of a GVR.
+                        properties:
+                          matchExpressions:
+                            description: matchExpressions is a list of label selector
+                              requirements. The requirements are ANDed.
+                            items:
+                              description: |-
+                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                relates the key and values.
+                              properties:
+                                key:
+                                  description: key is the label key that the selector
+                                    applies to.
+                                  type: string
+                                operator:
+                                  description: |-
+                                    operator represents a key's relationship to a set of values.
+                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                  type: string
+                                values:
+                                  description: |-
+                                    values is an array of string values. If the operator is In or NotIn,
+                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                    the values array must be empty. This array is replaced during a strategic
+                                    merge patch.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              required:
+                              - key
+                              - operator
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          matchLabels:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                            type: object
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      resourceNames:
+                        description: resourceNames is a list of resource names to
+                          select.
+                        items:
+                          description: |-
+                            SelectorResourceName identifies a specific resource by name.
+                            If backend operates at the namespace level isolation, namespace will be included.
+                          properties:
+                            name:
+                              description: Name is the name of the resource.
+                              type: string
+                          required:
+                          - name
+                          type: object
+                        type: array
+                    type: object
+                  verbs:
+                    description: Verbs is a list of verbs that are required by the
+                      provider to operate.
+                    items:
+                      type: string
+                    type: array
+                  versions:
+                    description: |-
+                      versions is a list of versions that should be exported. If this is empty
+                      a sensible default is chosen by the service provider.
+                    items:
+                      type: string
+                    type: array
+                required:
+                - resource
+                type: object
+              type: array
           required:
           - kubeconfigSecretRef
           type: object
diff --git a/pkg/konnector/controllers/cluster/serviceexport/serviceexport_reconcile.go b/pkg/konnector/controllers/cluster/serviceexport/serviceexport_reconcile.go
@@ -372,11 +372,11 @@ func (r *reconciler) ensureCRDConditionsCopiedToBoundSchema(ctx context.Context,
 
 		if err := r.updateRemoteBoundSchema(ctx, boundSchema); err != nil {
 			errs = append(errs, err)
-			allValid = false // at least one BoundAPIResourceSchema is not valid
+			allValid = false // at least one BoundSchemas is not valid
 		}
 	}
 
-	// Set APIServiceExport Ready condition based on all BoundAPIResourceSchemas
+	// Set APIServiceExport Ready condition based on all BoundSchemas
 	if allValid {
 		conditions.MarkTrue(
 			export,
@@ -386,9 +386,9 @@ func (r *reconciler) ensureCRDConditionsCopiedToBoundSchema(ctx context.Context,
 		conditions.MarkFalse(
 			export,
 			kubebindv1alpha2.APIServiceExportConditionConnected,
-			"BoundAPIResourceSchemasNotValid",
+			"BoundSchemasNotValid",
 			conditionsapi.ConditionSeverityWarning,
-			"One or more BoundAPIResourceSchemas are not valid",
+			"One or more BoundSchemas are not valid",
 		)
 	}
 
diff --git a/sdk/apis/kubebind/v1alpha2/apiservicebinding_types.go b/sdk/apis/kubebind/v1alpha2/apiservicebinding_types.go
@@ -88,6 +88,10 @@ type APIServiceBindingSpec struct {
 	// +kubebuilder:validation:Required
 	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="kubeconfigSecretRef is immutable"
 	KubeconfigSecretRef ClusterSecretKeyRef `json:"kubeconfigSecretRef"`
+
+	// PermissionClaims records decisions about permission claims requested by the service provider.
+	// Access is granted per GroupResource.
+	PermissionClaims []PermissionClaim `json:"permissionClaims,omitempty"`
 }
 
 type APIServiceBindingStatus struct {
diff --git a/sdk/apis/kubebind/v1alpha2/apiserviceexportrequest_types.go b/sdk/apis/kubebind/v1alpha2/apiserviceexportrequest_types.go
diff --git a/sdk/apis/kubebind/v1alpha2/zz_generated.deepcopy.go b/sdk/apis/kubebind/v1alpha2/zz_generated.deepcopy.go

Original file line number	Diff line number	Diff line change
`@@ -109,7 +109,7 @@ func EnsureBinderClusterRole(ctx context.Context, client client.Client) error {`
`109`	`109`	`},`
`110`	`110`	`{`
`111`	`111`	`APIGroups: []string{"kube-bind.io"},`
`112`		`- Resources: []string{"boundaschemas/status"},`
	`112`	`+ Resources: []string{"boundschemas/status"},`
`113`	`113`	`Verbs: []string{"get", "list", "patch", "update"},`
`114`	`114`	`},`
`115`	`115`	`},`
Original file line number	Diff line number	Diff line change
`@@ -372,11 +372,11 @@ func (r *reconciler) ensureCRDConditionsCopiedToBoundSchema(ctx context.Context,`
`372`	`372`
`373`	`373`	`if err := r.updateRemoteBoundSchema(ctx, boundSchema); err != nil {`
`374`	`374`	`errs = append(errs, err)`
`375`		`- allValid = false // at least one BoundAPIResourceSchema is not valid`
	`375`	`+ allValid = false // at least one BoundSchemas is not valid`
`376`	`376`	`}`
`377`	`377`	`}`
`378`	`378`
`379`		`- // Set APIServiceExport Ready condition based on all BoundAPIResourceSchemas`
	`379`	`+ // Set APIServiceExport Ready condition based on all BoundSchemas`
`380`	`380`	`if allValid {`
`381`	`381`	`conditions.MarkTrue(`
`382`	`382`	`export,`
`@@ -386,9 +386,9 @@ func (r *reconciler) ensureCRDConditionsCopiedToBoundSchema(ctx context.Context,`
`386`	`386`	`conditions.MarkFalse(`
`387`	`387`	`export,`
`388`	`388`	`kubebindv1alpha2.APIServiceExportConditionConnected,`
`389`		`- "BoundAPIResourceSchemasNotValid",`
	`389`	`+ "BoundSchemasNotValid",`
`390`	`390`	`conditionsapi.ConditionSeverityWarning,`
`391`		`- "One or more BoundAPIResourceSchemas are not valid",`
	`391`	`+ "One or more BoundSchemas are not valid",`
`392`	`392`	`)`
`393`	`393`	`}`
`394`	`394`