Add path annotation to apibindings

Signed-off-by: Mangirdas Judeikis <[email protected]>
On-behalf-of: @SAP [email protected]

Author: mjudeikis

pkg/admission/apibinding/apibinding_interface.go

@@ -30,6 +30,7 @@ type apiBinding interface {
 	Validate() field.ErrorList
 	ValidateUpdate(oldBinding apiBinding) field.ErrorList
 	ToUnstructured() (map[string]interface{}, error)
+	GetAnnotations() map[string]string
 }
 
 type bindingReference interface {

pkg/admission/apibinding/apibinding_v1alpha1.go

@@ -52,6 +52,10 @@ func (b *apiBindingV1alpha1) SetLabels(labels map[string]string) {
 	b.binding.Labels = labels
 }
 
+func (b apiBindingV1alpha1) GetAnnotations() map[string]string {
+	return b.binding.Annotations
+}
+
 func (b *apiBindingV1alpha1) Validate() field.ErrorList {
 	return apisv1alpha1.ValidateAPIBinding(b.binding)
 }

pkg/admission/apibinding/apibinding_v1alpha2.go

@@ -52,6 +52,10 @@ func (b *apiBindingV1alpha2) SetLabels(labels map[string]string) {
 	b.binding.Labels = labels
 }
 
+func (b apiBindingV1alpha2) GetAnnotations() map[string]string {
+	return b.binding.Annotations
+}
+
 func (b apiBindingV1alpha2) Validate() field.ErrorList {
 	return apisv1alpha2.ValidateAPIBinding(b.binding)
 }

pkg/admission/pathannotation/pathannotation_admission.go

@@ -69,6 +69,7 @@ type pathAnnotationPlugin struct {
 
 var pathAnnotationResources = sets.New[string](
 	apisv1alpha2.Resource("apiexports").String(),
+	apisv1alpha2.Resource("apibindings").String(),
 	tenancyv1alpha1.Resource("workspacetypes").String(),
 )
 
@@ -105,6 +106,10 @@ func (p *pathAnnotationPlugin) Admit(ctx context.Context, a admission.Attributes
 
 	logicalCluster, err := p.getLogicalCluster(clusterName, corev1alpha1.LogicalClusterName)
 	if err != nil {
+		// We skip adding annotation for system bindings if the logical cluster is not found during creation. This is racy during workspace bootstrap.
+		if apierrors.IsNotFound(err) && a.GetResource().GroupResource() == apisv1alpha2.Resource("apibindings") {
+			return nil
+		}
 		return admission.NewForbidden(a, fmt.Errorf("cannot get this workspace: %w", err))
 	}
 	thisPath := logicalCluster.Annotations[core.LogicalClusterPathAnnotationKey]
@@ -146,6 +151,10 @@ func (p *pathAnnotationPlugin) Validate(ctx context.Context, a admission.Attribu
 	if pathAnnotationResources.Has(a.GetResource().GroupResource().String()) || found {
 		logicalCluster, err := p.getLogicalCluster(clusterName, corev1alpha1.LogicalClusterName)
 		if err != nil {
+			// We skip adding annotation for system bindings if the logical cluster is not found during creation. This is racy during workspace bootstrap.
+			if apierrors.IsNotFound(err) && a.GetResource().GroupResource() == apisv1alpha2.Resource("apibindings") {
+				return nil
+			}
 			return admission.NewForbidden(a, fmt.Errorf("cannot get this workspace: %w", err))
 		}
 		thisPath := logicalCluster.Annotations[core.LogicalClusterPathAnnotationKey]