Providers API v2 (#660)

Provider bootstrapping API updates

The changes mainly revolve around tightening the bootstrap workflow & RBACs.

  The Provider resource provisions a workspace + admin kubeconfig against
  that workspace. This is what the service provider receives, and it is
  the SERVICE PROVIDER's responsibility to populate this workspace with
  whatever is necessary to expose that service (e.g. APIExport,
  ContentConfiguration, ...); this can be for example an initContainer
  in the service operator or some other mechanism.

  The ManagedProvider is platform-owned "convenience" layer to onboard
  a platform-owned service. This triggers creating the Provider obj
  on kcp side, and passing the workspace admin kubeconfig to the specified
  deployments. The same principle about applies here as well: the deployment
  is expected to bring its own APIExport, ContentConfiguration, ...

On-behalf-of: @SAP robert.vasek@sap.com
Signed-off-by: Robert Vasek <rvasek01@gmail.com>

Author: gman0

README.md

@@ -638,6 +638,108 @@ The Resource subroutine (in `pkg/subroutines/resource/`) manages OCM Resource ob
 - For ArgoCD: updates Application objects with resolved OCI repository URLs from OCM Resources
 - Manages image version extraction and stores versions in the ImageVersionStore
 
+## Provider Bootstrap
+
+Provider bootstrapping spans two controllers and two CRDs:
+
+- **`Provider`** (reconciled by the Provider controller) — provisions a dedicated kcp workspace and issues a scoped kubeconfig for it. Owned by the service provider. Kcp-level only.
+- **`ManagedProvider`** (reconciled by the platform-mesh controller) — a convenience API for the platform-mesh admin to onboard a platform-owned service end-to-end: creates the `Provider`, waits for it to be Ready, copies the kubeconfig into Platform Mesh's runtime cluster, and deploys the service operator there.
+
+### Provider Resource
+
+`Provider` is a kcp-level resource, watched by the Provider controller. Creating one provisions a dedicated workspace and a scoped kubeconfig. Once `status.phase` is `Ready`, it is the provider's responsibility to bootstrap their workspace resources (APIExports, schemas, etc.) using that kubeconfig, and to wire the kubeconfig into their service controllers. Afterwards, the provider can then watch their APIExport virtual workspace to reconcile consumers of the service.
+
+```yaml
+apiVersion: providers.platform-mesh.io/v1alpha1
+kind: Provider
+metadata:
+  name: my-service
+spec:
+  # Optional — overrides the name, namespace, and key of the kubeconfig Secret.
+  # Defaults to name: <Provider.Name>-provider-kubeconfig, namespace: default, key: kubeconfig.
+  providerKubeconfigSecret:
+    name: my-service-provider-kubeconfig
+    namespace: default
+    key: kubeconfig
+  # Optional — override the kcp front-proxy host written into the kubeconfig.
+  hostOverride: "https://frontproxy.example.com:8443"
+status:
+  phase: Ready
+  providerKubeconfigSecretRef:
+    name: my-service-provider-kubeconfig
+    namespace: default
+```
+
+#### Provider Controller Subroutine Chain
+
+| # | Subroutine | Action |
+|---|-----------|--------|
+| 1 | `ProviderWorkspaceSubroutine` | Creates a dedicated workspace under `root:providers` (e.g. `root:providers:wildwest-2cyb4oxml4sv8o3r`) |
+| 2 | `ScopedKubeconfigSubroutine` | Inside the provider workspace, creates a ServiceAccount, cluster-admin ClusterRoleBinding, and a static token Secret; generates a kubeconfig from those credentials and writes a kubeconfig Secret into the workspace where the Provider lives |
+
+### ManagedProvider Resource
+
+`ManagedProvider` is a resource created by the platform-mesh admin. It is a convenience API for onboarding a platform-owned service. On the kcp side, it creates a `Provider` object in `root:providers:system` (overridable via `spec.provider`) and waits for it to reach `Ready`. On the runtime side, it copies the kubeconfig into Platform Mesh's runtime cluster so that service operators can reach their provider workspace, and finally deploys those operators.
+
+```yaml
+apiVersion: providers.platform-mesh.io/v1alpha1
+kind: ManagedProvider
+metadata:
+  name: wildwest
+  namespace: platform-mesh-system
+spec:
+  # Which PlatformMesh instance this ManagedProvider belongs to.
+  platformMeshRef:
+    name: platform-mesh
+
+  # Service operators to deploy in Platform Mesh's runtime cluster.
+  # Each OCM component is resolved and deployed as a Helm chart via FluxCD.
+  runtimeDeployments:
+  - ocm:
+      componentName: wildwest-controller
+      registry: ghcr.io/platform-mesh/helm-charts
+      version: "0.1.0"
+      values:
+        kubeconfig:
+          secretName: wildwest-provider-kubeconfig  # scoped kubeconfig copied by KubeconfigCopySubroutine
+  - ocm:
+      componentName: wildwest-portal
+      registry: ghcr.io/platform-mesh/helm-charts
+      version: "0.1.0"
+
+  # If true, also deletes the Provider on the kcp side when ManagedProvider is deleted,
+  # which cascades to delete the provider workspace and generated kubeconfig.
+  cleanupOnDelete: false
+
+  # Optional — where to store the provider kubeconfig Secret in Platform Mesh's runtime cluster.
+  # Defaults to name: <ManagedProvider.Name>-provider-kubeconfig, key: kubeconfig.
+  # providerKubeconfigSecret:
+  #   name: wildwest-provider-kubeconfig
+  #   key: kubeconfig
+
+  # Optional — target a specific Platform Mesh runtime cluster. Defaults to the hosting cluster.
+  # runtimeKubeconfigSecretName: platform-runtime-wildwest-kubeconfig
+
+  # Optional — override the kcp front-proxy host in the generated kubeconfig.
+  # providerHostOverride: https://root.kcp.localhost:31000
+
+  # Optional — create the Provider in a different workspace (default: root:providers:system),
+  # or adopt an already-existing Provider at the given path and name.
+  # provider:
+  #   path: root:orgs:org-a:demo-acc
+  #   name: wildwest-platform
+```
+
+#### ManagedProvider Controller Subroutine Chain
+
+| # | Subroutine | Action |
+|---|-----------|--------|
+| 1 | `WaitPlatformMeshSubroutine` | Waits for the referenced `PlatformMesh` to have its `Ready` condition `True` |
+| 2 | `ProviderResourceSubroutine` | Creates (or adopts) the `Provider` resource at the specified kcp path (default: `root:providers:system`) |
+| 3 | `WaitProviderSubroutine` | Polls the `Provider` until `status.phase == "Ready"` |
+| 4 | `KubeconfigCopySubroutine` | Copies the kubeconfig Secret from the Provider's kcp workspace into Platform Mesh's runtime cluster; sets `status.providerKubeconfigSecretRef` |
+| 5 | `DeploySubroutine` | Deploys each `spec.runtimeDeployments` entry into the target cluster (OCM components resolved and installed via FluxCD) |
+
 ## Releasing
 
 The release is performed automatically through a GitHub Actions Workflow.

api/providers/v1alpha1/managedprovider_types.go

@@ -22,31 +22,60 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+const (
+	ManagedProviderPhasePending                 = "Pending"
+	ManagedProviderPhaseWaitingForPlatformMesh  = "WaitingForPlatformMesh"
+	ManagedProviderPhaseWaitingForProvider      = "WaitingForProvider"
+	ManagedProviderPhaseCopyingKubeconfig       = "CopyingKubeconfig"
+	ManagedProviderPhaseCopyingKubeconfigFailed = "CopyingKubeconfigFailed"
+	ManagedProviderPhaseDeploying               = "Deploying"
+	ManagedProviderPhaseReady                   = "Ready"
+	ManagedProviderPhaseDeleting                = "Deleting"
+)
+
 // ManagedProviderSpec defines the desired state of ManagedProvider.
 // ManagedProvider is a runtime-cluster resource that orchestrates the full
 // provider lifecycle: workspace creation, Provider bootstrap, secret copy,
 // and workload deployment.
 type ManagedProviderSpec struct {
-	// workspacePath is the full kcp logical path for the provider workspace.
-	// Defaults to root:providers:<name> when omitted.
-	// When set, must be of the form root:providers:<name>
+	// provider references the Provider resource.
+	// If not provided, a corresponding Provider is created in root:providers:system by default.
+	// If corresponding Provider doesn't exist, it is created.
+	// If specified, the workspace ProviderReference.Path must exist.
+	//
+	// +optional
+	ProviderReference *ProviderReferenceSpec `json:"provider,omitempty"`
+
+	// providerHostOverride overrides the kcp front-proxy host written into the
+	// generated kubeconfig Secret. Optional; defaults to the operator-configured
+	// front-proxy URL.
+	// +optional
+	ProviderHostOverride string `json:"providerHostOverride,omitempty"`
+
+	// runtimeKubeconfigSecretName is the name of the Secret that contains
+	// data.kubeconfig key, with kubeconfig referencing the runtime cluster
+	// where the provider components are to be deployed.
+	// If not provided, the hosting platform-mesh cluster is used.
 	//
 	// +optional
-	// +kubebuilder:validation:XValidation:rule="self == '' || self.matches('^root:providers:[a-z][a-z0-9]*$')",message="workspacePath must be of the form root:providers:<Workspace name>"
-	WorkspacePath string `json:"workspacePath,omitempty"`
+	RuntimeKubeconfigSecretName string `json:"runtimeKubeconfigSecretName,omitempty"`
+
+	// providerKubeconfigSecret is a Secret specification used to store
+	// the provider's kubeconfig in the runtime cluster. This is the admin kubeconfig
+	// that provider controllers can use to access the workspace in :root:providers:<WS name>.
+	// If not provided, a default of Name:<ManagedProvider.Name>-provider-kubeconfig,
+	// Key:kubeconfig is used.
+	//
+	// +optional
+	ProviderKubeconfigSecret *LocalKubeconfigSecretSpec `json:"providerKubeconfigSecret,omitempty"`
 
 	// platformMeshRef is a reference to the PlatformMesh object.
 	// It must refer to the PlatformMesh instance this ManagedProvider
 	// is associated with.
 	PlatformMeshReference PlatformMeshReferenceSpec `json:"platformMeshRef"`
 
-	// controller defines the OCM component to deploy as the provider controller.
-	// +required
-	Controller ProviderComponentSpec `json:"controller"`
-
-	// portal defines the OCM component to deploy as the provider portal.
-	// +optional
-	Portal *ProviderComponentSpec `json:"portal,omitempty"`
+	// runtimeDeployments is a list of components to be deployed in the runtime cluster.
+	RuntimeDeployments []ProviderComponentSpec `json:"runtimeDeployments"`
 
 	// cleanupOnDelete removes the kcp workspace when the ManagedProvider is deleted.
 	// +optional
@@ -60,11 +89,36 @@ type PlatformMeshReferenceSpec struct {
 	Name string `json:"name"`
 }
 
+// ProviderReferenceSpec is a reference to a Provider object.
+type ProviderReferenceSpec struct {
+	// path is a logical cluster path where the Provider is defined.
+	//
+	// +required
+	// +kubebuilder:validation:Pattern:="^[a-z0-9]([-a-z0-9]*[a-z0-9])?(:[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
+	Path string `json:"path"`
+
+	// name is the name of the referenced Provider.
+	//
+	// +required
+	// +kubebuilder:validation:Required
+	// +kube:validation:MinLength=1
+	Name string `json:"name"`
+}
+
+// LocalKubeconfigSecretSpec describes a Secret and the key with kubeconfig YAML content.
+type LocalKubeconfigSecretSpec struct {
+	// name is the name of the Secret.
+	Name string `json:"name"`
+
+	// key is the key in data map where the kubeconfig YAML content is stored.
+	Key string `json:"key"`
+}
+
 // ProviderComponentSpec references an OCM component to deploy.
 type ProviderComponentSpec struct {
 	// ocm identifies the component in an OCM registry.
-	// +required
-	OCM OCMComponentSpec `json:"ocm"`
+	// +optional
+	OCM *OCMComponentSpec `json:"ocm,omitempty"`
 }
 
 // OCMComponentSpec identifies a component in an OCM registry.
@@ -84,6 +138,11 @@ type OCMComponentSpec struct {
 	// values are Helm values passed to the deployed chart.
 	// +optional
 	Values apiextensionsv1.JSON `json:"values,omitempty"`
+
+	// insecure allows HTTP (insecure) connection to the OCI repository.
+	// Disabled by default.
+	// +optional
+	Insecure bool `json:"insecure,omitempty"`
 }
 
 // ManagedProviderStatus defines the observed state of ManagedProvider.
@@ -92,10 +151,10 @@ type ManagedProviderStatus struct {
 	// +optional
 	Phase string `json:"phase,omitempty"`
 
-	// kubeconfigSecretRef points to the Secret in the runtime namespace that
+	// providerKubeconfigSecretRef points to the Secret in the runtime namespace that
 	// contains the scoped kubeconfig copied from the provider kcp workspace.
 	// +optional
-	KubeconfigSecretRef *corev1.SecretReference `json:"kubeconfigSecretRef,omitempty"`
+	ProviderKubeconfigSecretRef *corev1.SecretReference `json:"providerKubeconfigSecretRef,omitempty"`
 
 	// conditions represent the current state of the ManagedProvider resource.
 	// +listType=map

api/providers/v1alpha1/provider_types.go

@@ -21,27 +21,56 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+const (
+	ProviderPhasePending                = "Pending"
+	ProviderPhaseProvisioningWorkspace  = "ProvisioningWorkspace"
+	ProviderPhaseProvisioningKubeconfig = "ProvisioningKubeconfig"
+	ProviderPhaseReady                  = "Ready"
+	ProviderPhaseDeleting               = "Deleting"
+)
+
 // ProviderSpec defines the desired state of Provider.
 // Provider is a kcp-level resource that handles kcp-side bootstrap only
-// (ServiceAccount, RBAC, kubeconfig Secret). It has no runtime-side effects.
+// (Workspace, ServiceAccount, RBAC, kubeconfig Secret). It has no runtime-side effects.
 type ProviderSpec struct {
+	// providerKubeconfigSecret is a Secret specification used to store
+	// the provider's kubeconfig. This is the admin kubeconfig that provider controllers
+	// can use to access the workspace in :root:providers:<WS name>.
+	// If not provided, a default of Namespace:default, Name:<Provider.Name>-provider-kubeconfig,
+	// Key:kubeconfig is used.
+	//
+	// +optional
+	ProviderKubeconfigSecret *KubeconfigSecretSpec `json:"providerKubeconfigSecret,omitempty"`
+
 	// hostOverride overrides the kcp front-proxy host written into the
 	// generated kubeconfig Secret. Optional; defaults to the operator-configured
 	// front-proxy URL.
 	// +optional
 	HostOverride string `json:"hostOverride,omitempty"`
 }
 
+// KubeconfigSecretSpec describes a Secret and the key with kubeconfig YAML content.
+type KubeconfigSecretSpec struct {
+	// name is the name of the Secret.
+	Name string `json:"name"`
+
+	// namespace is the namespace of the Secret.
+	Namespace string `json:"namespace"`
+
+	// key is the key in data map where the kubeconfig YAML content is stored.
+	Key string `json:"key"`
+}
+
 // ProviderStatus defines the observed state of Provider.
 type ProviderStatus struct {
 	// phase summarises the bootstrap state of the Provider (e.g. "Pending", "Ready").
 	// +optional
 	Phase string `json:"phase,omitempty"`
 
-	// kubeconfigSecretRef points to the Secret created in the provider workspace
-	// that contains the scoped kubeconfig.
+	// providerKubeconfigSecretRef points to the Secret that contains
+	// the scoped kubeconfig for the provider workspace.
 	// +optional
-	KubeconfigSecretRef *corev1.SecretReference `json:"kubeconfigSecretRef,omitempty"`
+	ProviderKubeconfigSecretRef *corev1.SecretReference `json:"providerKubeconfigSecretRef,omitempty"`
 
 	// conditions represent the current state of the Provider resource.
 	// +listType=map