Add ability to use secret for oidc secret

Makefile

@@ -36,7 +36,7 @@ GOLANGCI_LINT_VERSION := 2.1.6
 GORELEASER_VERSION := 2.13.0
 GOTESTSUM_VERSION := 1.8.1
 HELM_VERSION := 3.18.6
-KCP_VERSION := 0.28.3
+KCP_VERSION := 0.29.0
 KUBE_APPLYCONFIGURATION_GEN_VERSION := v0.32.0
 KUBE_CLIENT_GEN_VERSION := v0.32.0
 KUBE_INFORMER_GEN_VERSION := v0.32.0

backend/controllers/bindableresourcesrequest/bindableresourcesrequest_controller.go

@@ -0,0 +1,390 @@
+/*
+Copyright 2025 The Kube Bind Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package bindableresourcesrequest
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"reflect"
+	"time"
+
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+	mcbuilder "sigs.k8s.io/multicluster-runtime/pkg/builder"
+	mcmanager "sigs.k8s.io/multicluster-runtime/pkg/manager"
+	mcreconcile "sigs.k8s.io/multicluster-runtime/pkg/reconcile"
+
+	"github.com/kube-bind/kube-bind/backend/kubernetes"
+	"github.com/kube-bind/kube-bind/pkg/indexers"
+	kubebindv1alpha2 "github.com/kube-bind/kube-bind/sdk/apis/kubebind/v1alpha2"
+)
+
+const (
+	controllerName = "kube-bind-backend-bindableresourcesrequest"
+)
+
+// BindableResourcesRequestReconciler reconciles a BindableResourcesRequest object.
+// This controller handles direct binding requests created as CRDs when the
+// backend is running without the HTTP API/OIDC flow (frontend disabled mode).
+//
+// The controller:
+// 1. Reads the kubeconfig from the referenced secret
+// 2. Creates a BindingResourceResponse secret with the kubeconfig
+// 3. Creates an APIServiceExportRequest based on the template
+type BindableResourcesRequestReconciler struct {
+	manager mcmanager.Manager
+	opts    controller.TypedOptions[mcreconcile.Request]
+
+	informerScope kubebindv1alpha2.InformerScope
+	isolation     kubebindv1alpha2.Isolation
+	reconciler    reconciler
+}
+
+// NewBindableResourcesRequestReconciler returns a new BindableResourcesRequestReconciler.
+func NewBindableResourcesRequestReconciler(
+	ctx context.Context,
+	mgr mcmanager.Manager,
+	opts controller.TypedOptions[mcreconcile.Request],
+	scope kubebindv1alpha2.InformerScope,
+	isolation kubebindv1alpha2.Isolation,
+	kubeManager *kubernetes.Manager,
+) (*BindableResourcesRequestReconciler, error) {
+	// Set up field indexers for BindableResourcesRequests
+	if err := mgr.GetFieldIndexer().IndexField(ctx, &kubebindv1alpha2.BindableResourcesRequest{}, indexers.BindableResourcesRequestByTemplate,
+		indexers.IndexBindableResourcesRequestByTemplate); err != nil {
+		return nil, fmt.Errorf("failed to setup BindableResourcesRequestByTemplate indexer: %w", err)
+	}
+
+	r := &BindableResourcesRequestReconciler{
+		manager:       mgr,
+		opts:          opts,
+		informerScope: scope,
+		isolation:     isolation,
+		reconciler: reconciler{
+			informerScope: scope,
+			isolation:     isolation,
+			kubeManager:   kubeManager,
+		},
+	}
+
+	return r, nil
+}
+
+//+kubebuilder:rbac:groups=kube-bind.io,resources=bindableresourcesrequests,verbs=get;list;watch;create;update;patch;delete
+//+kubebuilder:rbac:groups=kube-bind.io,resources=bindableresourcesrequests/status,verbs=get;update;patch
+//+kubebuilder:rbac:groups=kube-bind.io,resources=bindableresourcesrequests/finalizers,verbs=update
+//+kubebuilder:rbac:groups=kube-bind.io,resources=apiserviceexportrequests,verbs=get;list;watch;create
+//+kubebuilder:rbac:groups=kube-bind.io,resources=apiserviceexporttemplates,verbs=get;list;watch
+//+kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update
+
+// Reconcile is part of the main kubernetes reconciliation loop.
+func (r *BindableResourcesRequestReconciler) Reconcile(ctx context.Context, req mcreconcile.Request) (ctrl.Result, error) {
+	logger := log.FromContext(ctx)
+	logger.Info("Reconciling BindableResourcesRequest", "cluster", req.ClusterName, "namespace", req.Namespace, "name", req.Name)
+
+	cl, err := r.manager.GetCluster(ctx, req.ClusterName)
+	if err != nil {
+		return ctrl.Result{}, fmt.Errorf("failed to get client for cluster %q: %w", req.ClusterName, err)
+	}
+
+	client := cl.GetClient()
+
+	// Fetch the BindableResourcesRequest instance
+	bindableRequest := &kubebindv1alpha2.BindableResourcesRequest{}
+	if err := client.Get(ctx, req.NamespacedName, bindableRequest); err != nil {
+		if errors.IsNotFound(err) {
+			logger.Info("BindableResourcesRequest not found, ignoring")
+			return ctrl.Result{}, nil
+		}
+		return ctrl.Result{}, fmt.Errorf("failed to get BindableResourcesRequest: %w", err)
+	}
+
+	// Check TTL-based deletion for completed (ttl) requests
+	if bindableRequest.Status.Phase == kubebindv1alpha2.BindableResourcesRequestPhaseSucceeded ||
+		bindableRequest.Status.Phase == kubebindv1alpha2.BindableResourcesRequestPhaseFailed {
+		return r.handleTTL(ctx, client, bindableRequest)
+	}
+
+	// Create a copy to modify
+	original := bindableRequest.DeepCopy()
+
+	// Run the reconciliation logic
+	result, err := r.reconciler.reconcile(ctx, req.ClusterName, client, bindableRequest)
+	if err != nil {
+		logger.Error(err, "Failed to reconcile BindableResourcesRequest")
+		if !reflect.DeepEqual(original.Status, bindableRequest.Status) {
+			if updateErr := client.Status().Update(ctx, bindableRequest); updateErr != nil {
+				logger.Error(updateErr, "Failed to update BindableResourcesRequest status")
+				return ctrl.Result{}, fmt.Errorf("failed to update BindableResourcesRequest status: %w", updateErr)
+			}
+		}
+		return ctrl.Result{}, err
+	}
+
+	// Update status if it has changed
+	if !reflect.DeepEqual(original.Status, bindableRequest.Status) {
+		if err := client.Status().Update(ctx, bindableRequest); err != nil {
+			logger.Error(err, "Failed to update BindableResourcesRequest status")
+			return ctrl.Result{}, fmt.Errorf("failed to update BindableResourcesRequest status: %w", err)
+		}
+		logger.Info("BindableResourcesRequest status updated", "namespace", bindableRequest.Namespace, "name", bindableRequest.Name)
+	}
+
+	return result, nil
+}
+
+// handleTTL checks if the request should be deleted based on TTL settings.
+func (r *BindableResourcesRequestReconciler) handleTTL(ctx context.Context, cl client.Client, req *kubebindv1alpha2.BindableResourcesRequest) (ctrl.Result, error) {
+	logger := log.FromContext(ctx)
+
+	// If no TTL is set, don't delete
+	if req.Spec.TTLAfterFinished == nil {
+		return ctrl.Result{}, nil
+	}
+
+	// If no completion time is set, something is wrong - skip
+	if req.Status.CompletionTime == nil {
+		return ctrl.Result{}, nil
+	}
+
+	ttl := req.Spec.TTLAfterFinished.Duration
+	expireTime := req.Status.CompletionTime.Add(ttl)
+	now := time.Now()
+
+	if now.After(expireTime) {
+		logger.Info("TTL expired, deleting BindableResourcesRequest", "name", req.Name, "namespace", req.Namespace)
+		if err := cl.Delete(ctx, req); err != nil {
+			if errors.IsNotFound(err) {
+				return ctrl.Result{}, nil
+			}
+			return ctrl.Result{}, fmt.Errorf("failed to delete expired BindableResourcesRequest: %w", err)
+		}
+		return ctrl.Result{}, nil
+	}
+
+	// Requeue to check again when TTL expires
+	requeueAfter := expireTime.Sub(now)
+	return ctrl.Result{RequeueAfter: requeueAfter}, nil
+}
+
+// SetupWithManager sets up the controller with the Manager.
+func (r *BindableResourcesRequestReconciler) SetupWithManager(mgr mcmanager.Manager) error {
+	return mcbuilder.ControllerManagedBy(mgr).
+		For(&kubebindv1alpha2.BindableResourcesRequest{}).
+		Owns(&corev1.Secret{}).
+		WithOptions(r.opts).
+		Named(controllerName).
+		Complete(r)
+}
+
+type reconciler struct {
+	informerScope kubebindv1alpha2.InformerScope
+	isolation     kubebindv1alpha2.Isolation
+	kubeManager   *kubernetes.Manager
+}
+
+func (r *reconciler) reconcile(ctx context.Context, clusterName string, cl client.Client, req *kubebindv1alpha2.BindableResourcesRequest) (ctrl.Result, error) {
+	logger := log.FromContext(ctx)
+
+	// Determine the secret name and key to use for the binding response
+	var secretName, secretKey string
+	if req.Spec.KubeconfigSecretRef != nil {
+		// Use the specified secret reference
+		secretName = req.Spec.KubeconfigSecretRef.Name
+		secretKey = req.Spec.KubeconfigSecretRef.Key
+		if secretKey == "" {
+			secretKey = "kubeconfig"
+		}
+	} else {
+		// Create a new secret with default naming
+		secretName = req.Name + "-binding-response"
+		secretKey = "binding-response"
+	}
+
+	// Update status with the secret reference
+	req.Status.KubeconfigSecretRef = &kubebindv1alpha2.LocalSecretKeyRef{
+		Name: secretName,
+		Key:  secretKey,
+	}
+
+	// Get the template if specified
+	var template kubebindv1alpha2.APIServiceExportTemplate
+	if req.Spec.TemplateRef.Name != "" {
+		if err := cl.Get(ctx, types.NamespacedName{Name: req.Spec.TemplateRef.Name}, &template); err != nil {
+			if errors.IsNotFound(err) {
+				req.Status.Phase = kubebindv1alpha2.BindableResourcesRequestPhaseFailed
+				now := metav1.Now()
+				req.Status.CompletionTime = &now
+				meta.SetStatusCondition(&req.Status.Conditions, metav1.Condition{
+					Type:               string(kubebindv1alpha2.BindableResourcesRequestConditionReady),
+					Status:             metav1.ConditionFalse,
+					Reason:             "TemplateNotFound",
+					Message:            fmt.Sprintf("APIServiceExportTemplate %q not found", req.Spec.TemplateRef.Name),
+					LastTransitionTime: now,
+				})
+				return ctrl.Result{}, nil // Don't retry - template doesn't exist
+			}
+			return ctrl.Result{}, fmt.Errorf("failed to get template %q: %w", req.Spec.TemplateRef.Name, err)
+		}
+	}
+
+	// Handle resources and get kubeconfig
+	kfg, err := r.kubeManager.HandleResources(ctx, req.Spec.Author, req.Spec.ClusterIdentity.Identity, clusterName)
+	if err != nil {
+		meta.SetStatusCondition(&req.Status.Conditions, metav1.Condition{
+			Type:               string(kubebindv1alpha2.BindableResourcesRequestConditionReady),
+			Status:             metav1.ConditionFalse,
+			Reason:             "HandleResourcesFailed",
+			Message:            fmt.Sprintf("Failed to handle resources: %v", err),
+			LastTransitionTime: metav1.Now(),
+		})
+		return ctrl.Result{}, fmt.Errorf("failed to handle resources for cluster identity %q: %w", req.Spec.ClusterIdentity.Identity, err)
+	}
+
+	// Create or update the BindingResourceResponse secret
+	if err := r.ensureBindingResponseSecret(ctx, cl, req, kfg, secretName, secretKey); err != nil {
+		meta.SetStatusCondition(&req.Status.Conditions, metav1.Condition{
+			Type:               string(kubebindv1alpha2.BindableResourcesRequestConditionReady),
+			Status:             metav1.ConditionFalse,
+			Reason:             "SecretCreationFailed",
+			Message:            fmt.Sprintf("Failed to create/update secret: %v", err),
+			LastTransitionTime: metav1.Now(),
+		})
+		return ctrl.Result{}, fmt.Errorf("failed to ensure binding response secret: %w", err)
+	}
+
+	// Set success status
+	now := metav1.Now()
+	req.Status.Phase = kubebindv1alpha2.BindableResourcesRequestPhaseSucceeded
+	req.Status.CompletionTime = &now
+	meta.SetStatusCondition(&req.Status.Conditions, metav1.Condition{
+		Type:               string(kubebindv1alpha2.BindableResourcesRequestConditionReady),
+		Status:             metav1.ConditionTrue,
+		Reason:             "SecretReady",
+		Message:            fmt.Sprintf("Binding response secret %q is ready", secretName),
+		LastTransitionTime: now,
+	})
+
+	logger.Info("BindableResourcesRequest succeeded", "name", req.Name, "namespace", req.Namespace, "secret", secretName)
+
+	// If TTL is set, requeue for deletion
+	if req.Spec.TTLAfterFinished != nil {
+		return ctrl.Result{RequeueAfter: req.Spec.TTLAfterFinished.Duration}, nil
+	}
+
+	return ctrl.Result{}, nil
+}
+
+// ensureBindingResponseSecret creates or updates a secret containing the BindingResourceResponse
+// with only the kubeconfig set (no authentication or requests).
+func (r *reconciler) ensureBindingResponseSecret(
+	ctx context.Context,
+	cl client.Client,
+	req *kubebindv1alpha2.BindableResourcesRequest,
+	kubeconfig []byte,
+	secretName string,
+	secretKey string,
+) error {
+	logger := log.FromContext(ctx)
+
+	// Create the BindingResourceResponse with only kubeconfig
+	response := kubebindv1alpha2.BindingResourceResponse{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: kubebindv1alpha2.SchemeGroupVersion.String(),
+			Kind:       kubebindv1alpha2.KindBindingResourceResponse,
+		},
+		Kubeconfig: kubeconfig,
+	}
+
+	responseBytes, err := json.Marshal(&response)
+	if err != nil {
+		return fmt.Errorf("failed to marshal BindingResourceResponse: %w", err)
+	}
+
+	// Check if secret already exists
+	existingSecret := &corev1.Secret{}
+	err = cl.Get(ctx, types.NamespacedName{Namespace: req.Namespace, Name: secretName}, existingSecret)
+	if err != nil && !errors.IsNotFound(err) {
+		return fmt.Errorf("failed to get existing secret: %w", err)
+	}
+
+	// Build owner reference - the secret is owned by the BindableResourcesRequest
+	ownerRef := metav1.OwnerReference{
+		APIVersion: kubebindv1alpha2.SchemeGroupVersion.String(),
+		Kind:       kubebindv1alpha2.KindBindableResourcesRequest,
+		Name:       req.Name,
+		UID:        req.UID,
+		Controller: func() *bool { b := true; return &b }(),
+	}
+
+	if errors.IsNotFound(err) {
+		// Create new secret
+		secret := &corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:            secretName,
+				Namespace:       req.Namespace,
+				OwnerReferences: []metav1.OwnerReference{ownerRef},
+			},
+			Type: corev1.SecretTypeOpaque,
+			Data: map[string][]byte{
+				secretKey: responseBytes,
+			},
+		}
+		logger.Info("Creating BindingResourceResponse secret", "name", secretName, "namespace", req.Namespace, "key", secretKey)
+		if err := cl.Create(ctx, secret); err != nil {
+			if errors.IsAlreadyExists(err) {
+				return nil // Race condition, secret was created
+			}
+			return fmt.Errorf("failed to create secret: %w", err)
+		}
+	} else {
+		// Update existing secret
+		// Ensure owner reference is set
+		hasOwnerRef := false
+		for _, ref := range existingSecret.OwnerReferences {
+			if ref.UID == req.UID {
+				hasOwnerRef = true
+				break
+			}
+		}
+		if !hasOwnerRef {
+			existingSecret.OwnerReferences = append(existingSecret.OwnerReferences, ownerRef)
+		}
+
+		// Update data if changed
+		if existingSecret.Data == nil {
+			existingSecret.Data = make(map[string][]byte)
+		}
+		if string(existingSecret.Data[secretKey]) != string(responseBytes) {
+			existingSecret.Data[secretKey] = responseBytes
+			logger.Info("Updating BindingResourceResponse secret", "name", secretName, "namespace", req.Namespace, "key", secretKey)
+			if err := cl.Update(ctx, existingSecret); err != nil {
+				return fmt.Errorf("failed to update secret: %w", err)
+			}
+		}
+	}
+
+	return nil
+}