Merge pull request #1 from mjudeikis/v1alpha2-apiserviceexport-patch

V1alpha2 apiserviceexport patch

Author: cnvergence

Makefile

@@ -255,6 +255,9 @@ $(KCP):
 	tar xz -C "$(TOOLS_DIR)" --strip-components="1" bin/kcp
 	mv $(TOOLS_DIR)/kcp $(KCP)
 
+run-kcp: $(KCP)
+	$(KCP) start
+
 .PHONY: test-e2e
 ifdef USE_GOTESTSUM
 test-e2e: $(GOTESTSUM)

README.md

@@ -60,6 +60,18 @@ All the actions shown between the clusters are done by the konnector, except: th
 
 ## Usage
 
+This section allows you to run local kube-bind backend and konnector.
+The main challenge when running it locally is to have multiple clusters available and accessible.
+
+For this we use [kcp](https://github.com/kcp-dev/kcp) to create a local clusters under single kcp instance.
+By having a single kcp instance, we can have multiple clusters available and accessible via same url.
+
+To run kcp, you need to have a kcp binary.
+
+```shell
+$ make run-kcp
+```
+
 To run the current backend, there must be an OIDC issuer installed in place to do the
 the oauth2 workflow.
 
@@ -83,8 +95,16 @@ accessible.
 ***Note: make sure before running the backend that you have the dex server up and running as mentioned above
 and that you have at least one k8s cluster. Take a look at the backend option in the cmd/main.go file***
 
+Create copy of kcp kubeconfig and create provider cluster:
+
+```shell
+$ cp .kcp/admin.kubeconfig .kcp/provider.kubeconfig
+$ export KUBECONFIG=.kcp/provider.kubeconfig
+$ kubectl ws create provider --enter
+```
+
 * apply the CRDs: `kubectl apply -f deploy/crd`
-* In order to populate binding list on website, we need a CRD with label `kube-bind.io/exported: true`. Apply example CRD: `kubectl apply -f deploy/examples/crd-mangodb.yaml`
+* In order to populate binding list on website, we need a CRD with label `kube-bind.io/exported: true`. Apply example APIResourceSchema for the CRD: `kubectl apply -f deploy/examples/crd-mangodb.yaml`
 * start the backend binary with the right flags:
 ```shell
 $ make build
@@ -110,4 +130,30 @@ WQh88mNOY0Z3tLy1/WOud7qIEEBxz+POc4j8BsYenYo=
 The `--cookie-signing-key` option is required and supports 32 and 64 byte lengths.
 The `--cookie-encryption-key` option is optional and supports byte lengths of 16, 24, 32 for AES-128, AES-192, or AES-256.
 
-* with a KUBECONFIG against another cluster (a consumer cluster) bind a service: `kubectl bind http://127.0.0.1:8080/export`.
+### Consumer 
+Now create consumer cluster:
+
+```shell
+$ export KUBECONFIG=.kcp/admin.kubeconfig
+$ kubectl ws create consumer --enter
+```
+
+Now create the APIServiceExportRequest:
+
+```shell
+$ ./bin/kubectl-bind http://127.0.0.1:8080/export --dry-run -o yaml > apiserviceexport.yaml
+# This will wait for konnector to be ready. Once this gets running - start the konnector bellow
+$ ./bin/kubectl-bind apiservice --remote-namespace kube-bind-77wsg --remote-kubeconfig .kcp/provider.kubeconfig -f apiserviceexport.yaml  --skip-konnector
+# run konnector
+$ go run ./cmd/konnector/ --lease-namespace default
+```
+
+### Limitations
+
+These limitations are part of the roadmap and will be addressed in the future.
+
+* Currently we don't support related resources, like ConfigMaps, Secrets
+* Currently CRD resources MUST be installed in the provider cluster, even when APIResourceSchema is used.
+  This is to allow the konnector to sync instances of the CRD to the consumer cluster.
+  This should be removed once we introduce sync policies and object wrappers.
+* Currently we dont support granular permissions, like only allow to read/write certain named resources.

cli/pkg/kubectl/bind/plugin/authenticate.go

@@ -72,8 +72,9 @@ func getProvider(url string, insecure bool) (*kubebindv1alpha2.BindingProvider,
 	}
 	if bindSemVer, err := semver.Parse(strings.TrimLeft(bindVersion, "v")); err != nil {
 		return nil, fmt.Errorf("failed to parse bind version %q: %v", bindVersion, err)
-	} else if min := semver.MustParse("0.3.0"); bindSemVer.GE(min) {
-		// we added this in v0.3.0. Don't test before.
+	} else if min := semver.MustParse("0.5.0"); bindSemVer.GE(min) {
+		// At v0.5.0 we made breaking change for how APIExports looks like.
+		// So we need to test for v0.5.0+. If
 		if err := validateProviderVersion(provider.Version); err != nil {
 			return nil, err
 		}
@@ -84,7 +85,7 @@ func getProvider(url string, insecure bool) (*kubebindv1alpha2.BindingProvider,
 
 func validateProviderVersion(providerVersion string) error {
 	if providerVersion == "" {
-		return fmt.Errorf("provider version %q is empty, please update the backend to v0.3.0+", providerVersion)
+		return fmt.Errorf("provider version %q is empty, please update the backend to v0.5.0+", providerVersion)
 	} else if providerVersion == "v0.0.0" || providerVersion == "v0.0.0-master+$Format:%H$" {
 		// unversioned, development version
 		return nil
@@ -94,7 +95,8 @@ func validateProviderVersion(providerVersion string) error {
 	if err != nil {
 		return fmt.Errorf("provider version %q cannot be parsed", providerVersion)
 	}
-	if min := semver.MustParse("0.3.0"); providerSemVer.LT(min) {
+	// Check if provider is higher than 0.4.8, we need to have same version of kube-bind to use this provider.
+	if min := semver.MustParse("0.5.0"); providerSemVer.LT(min) {
 		return fmt.Errorf("provider version %s is not supported, must be at least v%s", providerVersion, min)
 	}
 

contrib/example-backend/controllers/clusterbinding/clusterbinding_reconcile.go

@@ -154,11 +154,18 @@ func (r *reconciler) ensureRBACClusterRole(ctx context.Context, clusterBinding *
 				return fmt.Errorf("failed to get APIResourceSchema %w", err)
 			}
 
-			expected.Rules = append(expected.Rules, rbacv1.PolicyRule{
-				APIGroups: []string{schema.Spec.APIResourceSchemaCRDSpec.Group},
-				Resources: []string{schema.Spec.APIResourceSchemaCRDSpec.Names.Plural},
-				Verbs:     []string{"get", "list", "watch", "update", "patch", "delete", "create"},
-			})
+			expected.Rules = append(expected.Rules,
+				rbacv1.PolicyRule{
+					APIGroups: []string{schema.Spec.APIResourceSchemaCRDSpec.Group},
+					Resources: []string{schema.Spec.APIResourceSchemaCRDSpec.Names.Plural},
+					Verbs:     []string{"get", "list", "watch", "update", "patch", "delete", "create"},
+				},
+				rbacv1.PolicyRule{
+					APIGroups: []string{kubebindv1alpha2.GroupName},
+					Resources: []string{"apiresourceschemas"},
+					Verbs:     []string{"get", "list", "watch"},
+				},
+			)
 		}
 	}
 

contrib/example-backend/controllers/serviceexport/serviceexport_controller.go

@@ -79,7 +79,7 @@ func NewController(
 			getCRD: func(name string) (*apiextensionsv1.CustomResourceDefinition, error) {
 				return crdInformer.Lister().Get(name)
 			},
-			getAPIResourceSchema: func(ctx context.Context, ns, name string) (*kubebindv1alpha2.APIResourceSchema, error) {
+			getAPIResourceSchema: func(ctx context.Context, name string) (*kubebindv1alpha2.APIResourceSchema, error) {
 				return bindClient.KubeBindV1alpha2().APIResourceSchemas().Get(ctx, name, metav1.GetOptions{})
 			},
 			deleteServiceExport: func(ctx context.Context, ns, name string) error {

contrib/example-backend/controllers/serviceexport/serviceexport_reconcile.go

@@ -18,6 +18,9 @@ package serviceexport
 
 import (
 	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"sort"
 
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
@@ -26,13 +29,12 @@ import (
 
 	kubebindv1alpha2 "github.com/kube-bind/kube-bind/sdk/apis/kubebind/v1alpha2"
 	kubebindhelpers "github.com/kube-bind/kube-bind/sdk/apis/kubebind/v1alpha2/helpers"
-	conditionsapi "github.com/kube-bind/kube-bind/sdk/apis/third_party/conditions/apis/conditions/v1alpha1"
 	"github.com/kube-bind/kube-bind/sdk/apis/third_party/conditions/util/conditions"
 )
 
 type reconciler struct {
 	getCRD               func(name string) (*apiextensionsv1.CustomResourceDefinition, error)
-	getAPIResourceSchema func(ctx context.Context, ns, name string) (*kubebindv1alpha2.APIResourceSchema, error)
+	getAPIResourceSchema func(ctx context.Context, name string) (*kubebindv1alpha2.APIResourceSchema, error)
 	deleteServiceExport  func(ctx context.Context, namespace, name string) error
 
 	requeue func(export *kubebindv1alpha2.APIServiceExport)
@@ -44,7 +46,9 @@ func (r *reconciler) reconcile(ctx context.Context, export *kubebindv1alpha2.API
 	if specChanged, err := r.ensureSchema(ctx, export); err != nil {
 		errs = append(errs, err)
 	} else if specChanged {
-		r.requeue(export)
+		// TODO: This should be separate controller for apiresourceschemas.
+		// This is wrong place now.
+		//	r.requeue(export)
 		return nil
 	}
 
@@ -54,56 +58,50 @@ func (r *reconciler) reconcile(ctx context.Context, export *kubebindv1alpha2.API
 func (r *reconciler) ensureSchema(ctx context.Context, export *kubebindv1alpha2.APIServiceExport) (specChanged bool, err error) {
 	logger := klog.FromContext(ctx)
 
+	var leafHashes []string
 	for _, resourceRef := range export.Spec.Resources {
 		if resourceRef.Type != "APIResourceSchema" {
 			logger.V(1).Info("Skipping unsupported resource type", "type", resourceRef.Type)
 			continue
 		}
 
-		schema, err := r.getAPIResourceSchema(ctx, export.Namespace, resourceRef.Name)
+		schema, err := r.getAPIResourceSchema(ctx, resourceRef.Name)
 		if err != nil {
 			if errors.IsNotFound(err) {
 				continue
 			}
 			return false, err
 		}
-		crd, err := r.getCRD(schema.Name)
-		if err != nil && !errors.IsNotFound(err) {
-			return false, err
-		}
 
-		if crd == nil {
-			// CRD missing => delete SER too
-			logger.V(1).Info("Deleting APIServiceExport because CRD is missing")
-			return false, r.deleteServiceExport(ctx, export.Namespace, export.Name)
-		}
+		hash := kubebindhelpers.APIResourceSchemaCRDSpecHash(&schema.Spec.APIResourceSchemaCRDSpec)
+		leafHashes = append(leafHashes, hash)
+	}
 
-		expected, err := kubebindhelpers.CRDToAPIResourceSchema(crd, "")
-		if err != nil {
-			conditions.MarkFalse(
-				export,
-				kubebindv1alpha2.APIServiceExportConditionProviderInSync,
-				"CustomResourceDefinitionUpdateFailed",
-				conditionsapi.ConditionSeverityError,
-				"CustomResourceDefinition %s cannot be converted into a APIServiceExport: %s",
-				export.Name, err,
-			)
-			return false, nil // nothing we can do
-		}
+	hashOfHashes := hashOfHashes(leafHashes)
 
-		if hash := kubebindhelpers.APIResourceSchemaCRDSpecHash(&expected.Spec.APIResourceSchemaCRDSpec); export.Annotations[kubebindv1alpha2.SourceSpecHashAnnotationKey] != hash {
-			// both exist, update APIServiceExport
-			logger.V(1).Info("Updating APIServiceExport")
-			schema.Spec.APIResourceSchemaCRDSpec = expected.Spec.APIResourceSchemaCRDSpec
-			if schema.Annotations == nil {
-				schema.Annotations = map[string]string{}
-			}
-			schema.Annotations[kubebindv1alpha2.SourceSpecHashAnnotationKey] = hash
-			return true, nil
+	if export.Annotations[kubebindv1alpha2.SourceSpecHashAnnotationKey] != hashOfHashes {
+		// both exist, update APIServiceExport
+		logger.V(1).Info("Updating APIServiceExport. Hash mismatch", "hash", hashOfHashes, "expected", export.Annotations[kubebindv1alpha2.SourceSpecHashAnnotationKey])
+		if export.Annotations == nil {
+			export.Annotations = map[string]string{}
 		}
-
-		conditions.MarkTrue(export, kubebindv1alpha2.APIServiceExportConditionProviderInSync)
+		export.Annotations[kubebindv1alpha2.SourceSpecHashAnnotationKey] = hashOfHashes
+		return true, nil
 	}
 
+	conditions.MarkTrue(export, kubebindv1alpha2.APIServiceExportConditionProviderInSync)
+
 	return false, nil
 }
+
+func hashOfHashes(hashes []string) string {
+	hexHashes := append([]string{}, hashes...)
+
+	sort.Strings(hexHashes)
+
+	rootHasher := sha256.New()
+	for _, h := range hexHashes {
+		rootHasher.Write([]byte(h))
+	}
+	return hex.EncodeToString(rootHasher.Sum(nil))
+}

contrib/example-backend/controllers/serviceexportrequest/serviceexportrequest_controller.go

@@ -56,6 +56,7 @@ func NewController(
 	serviceExportRequestInformer bindinformers.APIServiceExportRequestInformer,
 	serviceExportInformer bindinformers.APIServiceExportInformer,
 	crdInformer apiextensionsinformers.CustomResourceDefinitionInformer,
+	apiResourceSchemaInformer bindinformers.APIResourceSchemaInformer,
 ) (*Controller, error) {
 	queue := workqueue.NewTypedRateLimitingQueueWithConfig(workqueue.DefaultTypedControllerRateLimiter[string](), workqueue.TypedRateLimitingQueueConfig[string]{Name: controllerName})
 
@@ -88,12 +89,18 @@ func NewController(
 		crdLister:  crdInformer.Lister(),
 		crdIndexer: crdInformer.Informer().GetIndexer(),
 
+		apiResourceSchemaLister:  apiResourceSchemaInformer.Lister(),
+		apiResourceSchemaIndexer: apiResourceSchemaInformer.Informer().GetIndexer(),
+
 		reconciler: reconciler{
 			informerScope:          scope,
 			clusterScopedIsolation: isolation,
 			getCRD: func(name string) (*apiextensionsv1.CustomResourceDefinition, error) {
 				return crdInformer.Lister().Get(name)
 			},
+			getAPIResourceSchema: func(ctx context.Context, name string) (*kubebindv1alpha2.APIResourceSchema, error) {
+				return apiResourceSchemaInformer.Lister().Get(name)
+			},
 			getServiceExport: func(ns, name string) (*kubebindv1alpha2.APIServiceExport, error) {
 				return serviceExportInformer.Lister().APIServiceExports(ns).Get(name)
 			},
@@ -186,6 +193,9 @@ type Controller struct {
 	crdLister  apiextensionslisters.CustomResourceDefinitionLister
 	crdIndexer cache.Indexer
 
+	apiResourceSchemaLister  bindlisters.APIResourceSchemaLister
+	apiResourceSchemaIndexer cache.Indexer
+
 	reconciler
 
 	commit CommitFunc