fix: prevent dry-run from creating resources on consumer cluster

Signed-off-by: olalekan odukoya <odukoyaonline@gmail.com>

Author: olamilekan000

cli/pkg/kubectl/base/dryrun.go

@@ -0,0 +1,30 @@
+/*
+Copyright 2025 The Kube Bind Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package base
+
+import "time"
+
+// DryRunAssets represents the saved assets from a dry-run
+type DryRunAssets struct {
+	SessionID    string    `json:"sessionID"`
+	UserID       string    `json:"userID"`
+	ServerURL    string    `json:"serverURL"`
+	ClusterID    string    `json:"clusterID,omitempty"`
+	CreatedAt    time.Time `json:"createdAt"`
+	Kubeconfig   string    `json:"kubeconfig"`
+	RequestFiles []string  `json:"requestFiles"`
+}

cli/pkg/kubectl/bind-apiservice/plugin/bind.go

@@ -18,14 +18,20 @@ package plugin
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
+	"os"
+	"path/filepath"
 	"strings"
+	"time"
 
 	"github.com/spf13/cobra"
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/cli-runtime/pkg/genericclioptions"
 	"k8s.io/cli-runtime/pkg/printers"
@@ -35,6 +41,7 @@ import (
 	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
 	"k8s.io/component-base/logs"
 	logsv1 "k8s.io/component-base/logs/api/v1"
+	"sigs.k8s.io/yaml"
 
 	"github.com/kube-bind/kube-bind/cli/pkg/kubectl/base"
 	kubebindv1alpha2 "github.com/kube-bind/kube-bind/sdk/apis/kubebind/v1alpha2"
@@ -55,6 +62,7 @@ type BindAPIServiceOptions struct {
 	remoteKubeconfigName      string
 	remoteNamespace           string
 	file                      string
+	FromDryRun                string
 
 	// skipKonnector skips the deployment of the konnector.
 	SkipKonnector          bool
@@ -96,7 +104,8 @@ func (b *BindAPIServiceOptions) AddCmdFlags(cmd *cobra.Command) {
 	cmd.Flags().BoolVar(&b.SkipKonnector, "skip-konnector", b.SkipKonnector, "Skip the deployment of the konnector")
 	cmd.Flags().BoolVar(&b.DowngradeKonnector, "downgrade-konnector", b.DowngradeKonnector, "Downgrade the konnector to the version of the kubectl-bind-apiservice binary")
 	cmd.Flags().StringVar(&b.KonnectorImageOverride, "konnector-image", b.KonnectorImageOverride, "The konnector image to use")
-	cmd.Flags().BoolVarP(&b.DryRun, "dry-run", "d", b.DryRun, "If true, only print the requests that would be sent to the service provider after authentication, without actually binding.")
+	cmd.Flags().BoolVarP(&b.DryRun, "dry-run", "d", b.DryRun, "If true, only print the requests that would be sent to the service provider after authentication, without creating any resources on the consumer cluster.")
+	cmd.Flags().StringVar(&b.FromDryRun, "from-dry-run", b.FromDryRun, "Apply bindings from a previous dry-run session using the session ID)")
 	cmd.Flags().MarkHidden("konnector-image") //nolint:errcheck
 	cmd.Flags().BoolVar(&b.NoBanner, "no-banner", b.NoBanner, "Do not show the red banner")
 	cmd.Flags().MarkHidden("no-banner") //nolint:errcheck
@@ -134,15 +143,15 @@ func (b *BindAPIServiceOptions) Complete(args []string) error {
 
 // Validate validates the BindAPIServiceOptions are complete and usable.
 func (b *BindAPIServiceOptions) Validate() error {
-	if b.file == "" && b.Template == "" {
-		return errors.New("file, template-name or --file are required")
+	if b.file == "" && b.Template == "" && b.FromDryRun == "" {
+		return errors.New("file, template-name or --from-dry-run are required")
 	}
 
 	if allowed := sets.NewString(b.Print.AllowedFormats()...); *b.Print.OutputFormat != "" && !allowed.Has(*b.Print.OutputFormat) {
 		return fmt.Errorf("invalid output format %q (allowed: %s)", *b.Print.OutputFormat, strings.Join(allowed.List(), ", "))
 	}
 
-	if b.Template == "" {
+	if b.FromDryRun == "" && b.Template == "" {
 		if (b.remoteKubeconfigNamespace == "" && b.remoteKubeconfigName != "") ||
 			(b.remoteKubeconfigNamespace != "" && b.remoteKubeconfigName == "") {
 			return errors.New("remote-kubeconfig-namespace and remote-kubeconfig-name must be specified together")
@@ -151,8 +160,7 @@ func (b *BindAPIServiceOptions) Validate() error {
 			return errors.New("remote-kubeconfig or remote-kubeconfig-namespace and remote-kubeconfig-name are required")
 		}
 	}
-	// Name is required unless reading from file, where name will be read from the file.
-	if b.Name == "" && b.file == "" {
+	if b.Name == "" && b.file == "" && b.FromDryRun == "" && b.Template == "" {
 		return errors.New("name is required")
 	}
 
@@ -195,20 +203,37 @@ func (b *BindAPIServiceOptions) Run(ctx context.Context) error {
 		RemoteKubeconfigName:      b.remoteKubeconfigName,
 		RemoteNamespace:           b.remoteNamespace,
 		File:                      b.file,
+		DryRun:                    b.DryRun,
 	}
 	binder := NewBinder(config, binderOpts)
 
 	var bindings []*kubebindv1alpha2.APIServiceBinding
-	if b.Template != "" {
+
+	switch {
+	case b.FromDryRun != "":
+		bindings, err = binder.BindFromDryRun(ctx, b.FromDryRun)
+		if err != nil {
+			return fmt.Errorf("failed to apply dry-run assets: %w", err)
+		}
+	case b.Template != "":
 		r, err := b.bindTemplate(ctx)
 		if err != nil {
 			return err
 		}
+
+		if b.DryRun {
+			return b.handleTemplateDryRun(r.response)
+		}
+
 		bindings, err = binder.BindFromResponse(ctx, r.response)
 		if err != nil {
 			return fmt.Errorf("failed to create bindings: %w", err)
 		}
-	} else if b.file != "" {
+	case b.file != "":
+		if b.DryRun {
+			return b.handleFileDryRun()
+		}
+
 		bindings, err = binder.BindFromFile(ctx)
 		if err != nil {
 			return fmt.Errorf("failed to create bindings: %w", err)
@@ -320,9 +345,14 @@ func (b *BindAPIServiceOptions) bindTemplate(ctx context.Context) (*bindTemplate
 		return nil, fmt.Errorf("failed to create authenticated client: %w", err)
 	}
 
+	name := b.Name
+	if name == "" {
+		name = b.Template
+	}
+
 	bindRequest := &kubebindv1alpha2.BindableResourcesRequest{
 		ObjectMeta: metav1.ObjectMeta{
-			Name: b.Name,
+			Name: name,
 		},
 		TemplateRef: kubebindv1alpha2.APIServiceExportTemplateRef{
 			Name: b.Template,
@@ -338,6 +368,14 @@ func (b *BindAPIServiceOptions) bindTemplate(ctx context.Context) (*bindTemplate
 		return nil, fmt.Errorf("unexpected response: authentication.oauth2CodeGrant is nil")
 	}
 
+	if b.DryRun {
+		return &bindTemplateResult{
+			response:  bindResponse,
+			namespace: "",
+			name:      "",
+		}, nil
+	}
+
 	err = b.ensureClientSideNamespaceExists(ctx, config)
 	if err != nil {
 		return nil, fmt.Errorf("failed to ensure kube-bind namespace exists: %w", err)
@@ -367,3 +405,157 @@ func (b *BindAPIServiceOptions) bindTemplate(ctx context.Context) (*bindTemplate
 		name:      secret.Name,
 	}, nil
 }
+
+// handleTemplateDryRun prints the requests and saves assets locally without touching the consumer cluster
+func (b *BindAPIServiceOptions) handleTemplateDryRun(response *kubebindv1alpha2.BindingResourceResponse) error {
+	fmt.Fprintf(b.Options.IOStreams.ErrOut, "Dry-run mode: outputting APIServiceExport requests\n\n")
+
+	if response.Authentication.OAuth2CodeGrant == nil {
+		return fmt.Errorf("authentication data missing in response")
+	}
+	sessionID := response.Authentication.OAuth2CodeGrant.SessionID
+
+	if err := b.printRequests(response.Requests); err != nil {
+		return err
+	}
+
+	if err := b.saveBindingAssets(response, sessionID); err != nil {
+		return fmt.Errorf("failed to save binding assets: %w", err)
+	}
+
+	fmt.Fprintf(b.Options.IOStreams.ErrOut, "\n✅ Dry-run complete. No changes made to consumer cluster.\n")
+	return nil
+}
+
+// saveBindingAssets saves the binding response to local storage for later use
+func (b *BindAPIServiceOptions) saveBindingAssets(response *kubebindv1alpha2.BindingResourceResponse, sessionID string) error {
+	if response.Authentication.OAuth2CodeGrant == nil {
+		return fmt.Errorf("authentication data missing")
+	}
+
+	userID := response.Authentication.OAuth2CodeGrant.ID
+
+	homeDir, err := os.UserHomeDir()
+	if err != nil {
+		return fmt.Errorf("failed to get home directory: %w", err)
+	}
+
+	dryRunDir := filepath.Join(homeDir, ".kube-bind", "dry-run", sessionID)
+	if err := os.MkdirAll(dryRunDir, 0700); err != nil {
+		return fmt.Errorf("failed to create dry-run directory: %w", err)
+	}
+
+	kubeconfigPath := filepath.Join(dryRunDir, "kubeconfig.yaml")
+	if err := os.WriteFile(kubeconfigPath, response.Kubeconfig, 0600); err != nil {
+		return fmt.Errorf("failed to save kubeconfig: %w", err)
+	}
+
+	requestFiles := make([]string, 0, len(response.Requests))
+	for i, request := range response.Requests {
+		requestPath := filepath.Join(dryRunDir, fmt.Sprintf("request-%d.yaml", i))
+
+		var obj map[string]interface{}
+		if err := json.Unmarshal(request.Raw, &obj); err != nil {
+			return fmt.Errorf("failed to unmarshal request %d: %w", i, err)
+		}
+
+		yamlData, err := yaml.Marshal(obj)
+		if err != nil {
+			return fmt.Errorf("failed to marshal request %d to YAML: %w", i, err)
+		}
+
+		if err := os.WriteFile(requestPath, yamlData, 0600); err != nil {
+			return fmt.Errorf("failed to save request %d: %w", i, err)
+		}
+
+		requestFiles = append(requestFiles, requestPath)
+	}
+
+	assets := &base.DryRunAssets{
+		SessionID:    sessionID,
+		UserID:       userID,
+		ServerURL:    b.ServerName,
+		ClusterID:    b.ClusterName,
+		CreatedAt:    time.Now(),
+		Kubeconfig:   kubeconfigPath,
+		RequestFiles: requestFiles,
+	}
+
+	metadataPath := filepath.Join(dryRunDir, "metadata.json")
+	metadataData, err := json.MarshalIndent(assets, "", "  ")
+	if err != nil {
+		return fmt.Errorf("failed to marshal metadata: %w", err)
+	}
+
+	if err := os.WriteFile(metadataPath, metadataData, 0600); err != nil {
+		return fmt.Errorf("failed to save metadata: %w", err)
+	}
+
+	fmt.Fprintf(b.Options.IOStreams.ErrOut, "\n💾 Dry-run assets saved to: %s\n", dryRunDir)
+	fmt.Fprintf(b.Options.IOStreams.ErrOut, "   Session ID: %s\n", sessionID)
+	fmt.Fprintf(b.Options.IOStreams.ErrOut, "   To apply later: kubectl bind apiservice --from-dry-run %s\n", sessionID)
+
+	return nil
+}
+
+// handleFileDryRun prints the request from file without touching the consumer cluster
+func (b *BindAPIServiceOptions) handleFileDryRun() error {
+	fmt.Fprintf(b.Options.IOStreams.ErrOut, "Dry-run mode: outputting APIServiceExport request from file\n\n")
+
+	var data []byte
+	var err error
+	if b.file == "-" {
+		data, err = io.ReadAll(b.Options.IOStreams.In)
+		if err != nil {
+			return fmt.Errorf("failed to read from stdin: %w", err)
+		}
+	} else {
+		data, err = os.ReadFile(b.file)
+		if err != nil {
+			return fmt.Errorf("failed to read file %s: %w", b.file, err)
+		}
+	}
+
+	var request kubebindv1alpha2.APIServiceExportRequest
+	if err := yaml.Unmarshal(data, &request); err != nil {
+		return fmt.Errorf("failed to unmarshal request: %w", err)
+	}
+
+	if err := b.printRequest(&request, data); err != nil {
+		return err
+	}
+
+	fmt.Fprintf(b.Options.IOStreams.ErrOut, "\n✅ Dry-run complete. No changes made to consumer cluster.\n")
+	return nil
+}
+
+// printRequest prints a single APIServiceExportRequest using the configured printer
+func (b *BindAPIServiceOptions) printRequest(request *kubebindv1alpha2.APIServiceExportRequest, rawData []byte) error {
+	if b.printer != nil {
+		if err := b.printer.PrintObj(request, b.Options.IOStreams.Out); err != nil {
+			return fmt.Errorf("failed to print request: %w", err)
+		}
+	} else {
+		fmt.Fprintf(b.Options.IOStreams.Out, "%s", rawData)
+	}
+	return nil
+}
+
+// printRequests prints multiple requests from a response, handling YAML separators
+func (b *BindAPIServiceOptions) printRequests(requests []runtime.RawExtension) error {
+	for i, request := range requests {
+		if i > 0 && b.Print.OutputFormat != nil && *b.Print.OutputFormat == "yaml" {
+			fmt.Fprintf(b.Options.IOStreams.Out, "---\n")
+		}
+
+		var apiRequest kubebindv1alpha2.APIServiceExportRequest
+		if err := json.Unmarshal(request.Raw, &apiRequest); err != nil {
+			return fmt.Errorf("failed to unmarshal request %d: %w", i, err)
+		}
+
+		if err := b.printRequest(&apiRequest, request.Raw); err != nil {
+			return fmt.Errorf("failed to print request %d: %w", i, err)
+		}
+	}
+	return nil
+}