GET requests for a single Tenant by name are not handled by the Tenant proxy module.

[enot237]

Bug description

A Tenant owner can list their Tenants through Capsule-Proxy, but cannot get a single Tenant by name.

How to reproduce

1. Create a Tenant with a user as an owner:

apiVersion: capsule.clastix.io/v1beta2
kind: Tenant
metadata:
  name: "1234"
spec:
  owners:
  - kind: User
    name: bob

2. Verify that the user is reconciled as an owner:
   kubectl get tenant 1234 -o jsonpath='{range .status.owners[*]}{.kind}{":"}{.name}{"\n"}{end}'

3. Use Capsule-Proxy as the Kubernetes API endpoint and run as that user
   kubectl get tenants
   This succeeds and returns the Tenant.

4. Try to get the same Tenant by name:
   kubectl get tenant 1234

This fails with 403 Forbidden.

Expected behavior

A Tenant owner should be able to get their own Tenant by name through Capsule-Proxy.

If kubectl get tenants includes Tenant 1234 for user bob, then this should also work:

Logs

Example Capsule-Proxy logs show the list request being handled by the Tenant filter:

Proxy tenant list owner=User name=bob tenants=["1234"] labelSelector added selector="kubernetes.io/metadata.name in (1234)" debugging request uri="/apis/capsule.clastix.io/v1beta2/tenants" method="GET"

But the get-by-name request falls through to impersonation/reverse proxy:

impersonating for the current request username="bob" groups=["*****"] uri="/apis/capsule.clastix.io/v1beta2/tenants/1234" debugging request uri="/apis/capsule.clastix.io/v1beta2/tenants/1234" method="GET"
The response from the API server is:

tenants.capsule.clastix.io "1234" is forbidden: User "bob" cannot get resource "tenants" in API group "capsule.clastix.io" at the cluster scope

Additional context

• Capsule-Proxy version: v0.10.0
• Helm Chart version: capsule-proxy-0.10.0
• Capsule version: 0.12.4
• Kubernetes version: 1.32.8

[oliverbaehler]

Implemented by #1047