Add minimal permissionClaims API

Author: mjudeikis

sdk/apis/kubebind/v1alpha2/apiservicebinding_types.go

@@ -88,6 +88,10 @@ type APIServiceBindingSpec struct {
 	// +kubebuilder:validation:Required
 	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="kubeconfigSecretRef is immutable"
 	KubeconfigSecretRef ClusterSecretKeyRef `json:"kubeconfigSecretRef"`
+
+	// PermissionClaims records decisions about permission claims requested by the service provider.
+	// Access is granted per GroupResource.
+	PermissionClaims []PermissionClaim `json:"permissionClaims,omitempty"`
 }
 
 type APIServiceBindingStatus struct {

sdk/apis/kubebind/v1alpha2/apiserviceexport_types.go

@@ -17,7 +17,6 @@ limitations under the License.
 package v1alpha2
 
 import (
-	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	conditionsapi "github.com/kube-bind/kube-bind/sdk/apis/third_party/conditions/apis/conditions/v1alpha1"
@@ -38,6 +37,9 @@ const (
 	// APIServiceExportConditionConsumerInSync is set to true when the APIServiceExport's
 	// schema is applied to the consumer cluster.
 	APIServiceExportConditionConsumerInSync conditionsapi.ConditionType = "ConsumerInSync"
+
+	// APIServiceExportConditionPermissionClaim describes status of the permission claim, requested in the APIServiceExport and APIServiceExportRequest.
+	APIServiceExportConditionPermissionClaim conditionsapi.ConditionType = "PermissionClaim"
 )
 
 // APIServiceExport specifies the resource to be exported. It is mostly a CRD:
@@ -86,6 +88,10 @@ type APIServiceExportSpec struct {
 	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="resources are immutable"
 	Resources []APIServiceExportResource `json:"resources"`
 
+	// PermissionClaims records decisions about permission claims requested by the service provider.
+	// Access is granted per GroupResource.
+	PermissionClaims []PermissionClaim `json:"permissionClaims,omitempty"`
+
 	// informerScope is the scope of the APIServiceExport. It can be either Cluster or Namespace.
 	//
 	// Cluster:    The konnector has permission to watch all namespaces at once and cluster-scoped resources.
@@ -122,20 +128,6 @@ const (
 // APIServiceExportStatus stores status information about a APIServiceExport. It
 // reflects the status of the CRD of the consumer cluster.
 type APIServiceExportStatus struct {
-	// acceptedNames are the names that are actually being used to serve discovery.
-	// They may be different than the names in spec.
-	// +optional
-	AcceptedNames apiextensionsv1.CustomResourceDefinitionNames `json:"acceptedNames"`
-
-	// storedVersions lists all versions of CustomResources that were ever persisted. Tracking these
-	// versions allows a migration path for stored versions in etcd. The field is mutable
-	// so a migration controller can finish a migration to another version (ensuring
-	// no old objects are left in storage), and then remove the rest of the
-	// versions from this list.
-	// Versions may not be removed from `spec.versions` while they exist in this list.
-	// +optional
-	StoredVersions []string `json:"storedVersions"`
-
 	// conditions is a list of conditions that apply to the APIServiceExport. It is
 	// updated by the konnector on the consumer cluster.
 	Conditions conditionsapi.Conditions `json:"conditions,omitempty"`

sdk/apis/kubebind/v1alpha2/apiserviceexportrequest_types.go

@@ -106,6 +106,10 @@ type APIServiceExportRequestSpec struct {
 	// +kubebuilder:validation:MinItems=1
 	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="resources are immutable"
 	Resources []APIServiceExportRequestResource `json:"resources"`
+
+	// PermissionClaims records decisions about permission claims requested by the service provider.
+	// Access is granted per GroupResource.
+	PermissionClaims []PermissionClaim `json:"permissionClaims,omitempty"`
 }
 
 type APIServiceExportRequestResource struct {
@@ -123,6 +127,20 @@ func (r APIServiceExportRequestResource) ResourceGroupName() string {
 	return fmt.Sprintf("%s.%s", r.Resource, r.Group)
 }
 
+// Selector is a resource selector that selects objects of a GVR.
+//
+// +kubebuilder:validation:XValidation:rule="(has(self.all) && self.all) != (has(self.labelSelector) && size(self.labelSelector) > 0)",message="either \"all\" or \"labelSelector\" must be set"
+type Selector struct {
+	// all claims all resources for the given group/resource.
+	// This is mutually exclusive with labelSelector.
+	// +optional
+	All bool `json:"all,omitempty"`
+
+	// LabelSelector is a label selector that selects objects of a GVR.
+	// +optional
+	LabelSelector *metav1.LabelSelector `json:"labelSelector,omitempty"`
+}
+
 // GroupResource identifies a resource.
 type GroupResource struct {
 	// group is the name of an API group.
@@ -142,6 +160,33 @@ type GroupResource struct {
 	Resource string `json:"resource"`
 }
 
+func (r GroupResource) String() string {
+	return fmt.Sprintf("%s.%s", r.Resource, r.Group)
+}
+
+// PermissionClaim selects objects of a GVR that a service provider may
+// request and that a consumer may accept and allow the service provider access to.
+type PermissionClaim struct {
+	GroupResource `json:",inline"`
+
+	// Selector is a resource selector that selects objects of a GVR.
+	Selector Selector `json:"selector,omitempty"`
+}
+
+// Owner is the owner of the resource.
+type Owner string
+
+const (
+	// OwnerProvider indicates that the resource is owned by the provider.
+	OwnerProvider Owner = "provider"
+	// OwnerConsumer indicates that the resource is owned by the consumer.
+	OwnerConsumer Owner = "consumer"
+)
+
+func (o Owner) String() string {
+	return string(o)
+}
+
 // APIServiceExportRequestPhase describes the phase of a binding request.
 type APIServiceExportRequestPhase string
 

sdk/apis/kubebind/v1alpha2/boundchema_types.go

@@ -18,6 +18,7 @@ package v1alpha2
 
 import (
 	"encoding/json"
+	"fmt"
 
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -41,6 +42,13 @@ type BoundSchema struct {
 	Status BoundSchemaStatus `json:"status,omitempty"`
 }
 
+// ResourceGroupName returns the group name of the resource.
+//
+// Important: If you change this, change one for APIServiceExportRequestResource too.
+func (b *BoundSchema) ResourceGroupName() string {
+	return fmt.Sprintf("%s.%s", b.Spec.Names.Plural, b.Spec.Group)
+}
+
 // InformerScope is the scope of the Api.
 //
 // +kubebuilder:validation:Enum=Cluster;Namespaced

sdk/apis/kubebind/v1alpha2/claimable_apis.go

@@ -0,0 +1,90 @@
+/*
+Copyright 2025 The Kube Bind Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha2
+
+import (
+	"fmt"
+
+	corev1 "k8s.io/api/core/v1"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// InternalAPI describes an API to be imported from some schemes and generated OpenAPI V2 definitions.
+type InternalAPI struct {
+	Names                apiextensionsv1.CustomResourceDefinitionNames
+	GroupVersionResource schema.GroupVersionResource
+	Instance             runtime.Object
+	ResourceScope        apiextensionsv1.ResourceScope
+	HasStatus            bool
+}
+
+// ClaimableAPIs is a list of APIs that can be claimed by a user.
+var ClaimableAPIs = []InternalAPI{
+	{
+		Names: apiextensionsv1.CustomResourceDefinitionNames{
+			Plural:   "configmaps",
+			Singular: "configmap",
+			Kind:     "ConfigMap",
+		},
+		GroupVersionResource: schema.GroupVersionResource{
+			Group:    "",
+			Version:  "v1",
+			Resource: "configmaps",
+		},
+		Instance:      &corev1.ConfigMap{},
+		ResourceScope: apiextensionsv1.NamespaceScoped,
+	},
+	{
+		Names: apiextensionsv1.CustomResourceDefinitionNames{
+			Plural:   "secrets",
+			Singular: "secret",
+			Kind:     "Secret",
+		},
+		GroupVersionResource: schema.GroupVersionResource{
+			Group:    "",
+			Version:  "v1",
+			Resource: "secrets",
+		},
+		Instance:      &corev1.Secret{},
+		ResourceScope: apiextensionsv1.NamespaceScoped,
+	},
+	{
+		Names: apiextensionsv1.CustomResourceDefinitionNames{
+			Plural:   "serviceaccounts",
+			Singular: "serviceaccount",
+			Kind:     "ServiceAccount",
+		},
+		GroupVersionResource: schema.GroupVersionResource{
+			Group:    "",
+			Version:  "v1",
+			Resource: "serviceaccounts",
+		},
+		Instance:      &corev1.ServiceAccount{},
+		ResourceScope: apiextensionsv1.NamespaceScoped,
+	},
+}
+
+func ResolveClaimableAPI(claim PermissionClaim) (schema.GroupVersionResource, error) {
+	for _, api := range ClaimableAPIs {
+		if api.Names.Plural == claim.Resource && api.GroupVersionResource.Group == claim.Group {
+			return api.GroupVersionResource, nil
+		}
+	}
+	return schema.GroupVersionResource{}, fmt.Errorf("no matching API found")
+}