Skip to content

Commit 04fcb6f

Browse files
maximiliantechmaximiliantech
committed
feat(draft): add AddAccessRequest API
1 parent cb6752c commit 04fcb6f

File tree

12 files changed

+725
-159
lines changed

12 files changed

+725
-159
lines changed

‎Taskfile.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@ version: 3
22

33
vars:
44
NESTED_MODULES: api
5-
API_DIRS: '{{.ROOT_DIR}}/api/v1alpha1/...'
5+
API_DIRS: '{{.ROOT_DIR}}/api/...'
66
MANIFEST_OUT: '{{.ROOT_DIR}}/config/crd/bases'
7-
CODE_DIRS: '{{.ROOT_DIR}}/cmd/... {{.ROOT_DIR}}/internal/... {{.ROOT_DIR}}/api/v1alpha1/...'
7+
CODE_DIRS: '{{.ROOT_DIR}}/cmd/... {{.ROOT_DIR}}/internal/... {{.ROOT_DIR}}/api/...'
88
COMPONENTS: 'cluster-provider-kind'
99
REPO_NAME: 'https://github.com/openmcp-project/cluster-provider-kind'
1010
GENERATE_DOCS_INDEX: "false"

‎api/clusters/v1alpha1/accessrequest_types.go‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
package v1alpha1
2+
3+
import (
4+
corev1 "k8s.io/api/core/v1"
5+
rbacv1 "k8s.io/api/rbac/v1"
6+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
7+
apimachinery "k8s.io/apimachinery/pkg/types"
8+
)
9+
10+
type RequestPhase string
11+
12+
const (
13+
// AccessRequestPending is the phase if the AccessRequest has not been scheduled yet.
14+
AccessRequestPending RequestPhase = "Pending"
15+
// AccessRequestGranted is the phase if the AccessRequest has been granted.
16+
AccessRequestGranted RequestPhase = "Granted"
17+
)
18+
19+
// +kubebuilder:validation:XValidation:rule="!has(oldSelf.clusterRef) || has(self.clusterRef)", message="clusterRef may not be removed once set"
20+
// +kubebuilder:validation:XValidation:rule="!has(oldSelf.requestRef) || has(self.requestRef)", message="requestRef may not be removed once set"
21+
type AccessRequestSpec struct {
22+
// ClusterRef is the reference to the Cluster for which access is requested.
23+
// If set, requestRef will be ignored.
24+
// This value is immutable.
25+
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="clusterRef is immutable"
26+
// +optional
27+
ClusterRef *ObjectReference `json:"clusterRef,omitempty"`
28+
29+
// RequestRef is the reference to the ClusterRequest for whose Cluster access is requested.
30+
// Is ignored if clusterRef is set.
31+
// This value is immutable.
32+
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="requestRef is immutable"
33+
// +optional
34+
RequestRef *ObjectReference `json:"requestRef,omitempty"`
35+
36+
// Permissions are the requested permissions.
37+
Permissions []PermissionsRequest `json:"permissions"`
38+
}
39+
40+
type PermissionsRequest struct {
41+
// Namespace is the namespace for which the permissions are requested.
42+
// If empty, this will result in a ClusterRole, otherwise in a Role in the respective namespace.
43+
// Note that for a Role, the namespace needs to either exist or a permission to create it must be included in the requested permissions (it will be created automatically then), otherwise the request will be rejected.
44+
// +optional
45+
Namespace string `json:"namespace,omitempty"`
46+
47+
// Rules are the requested RBAC rules.
48+
Rules []rbacv1.PolicyRule `json:"rules"`
49+
}
50+
51+
// AccessRequestStatus defines the observed state of AccessRequest
52+
type AccessRequestStatus struct {
53+
// Conditions contains the conditions.
54+
// +optional
55+
Conditions []metav1.Condition `json:"conditions,omitempty"`
56+
57+
// Phase is the current phase of the request.
58+
// +kubebuilder:default=Pending
59+
// +kubebuilder:validation:Enum=Pending;Granted;Denied
60+
Phase RequestPhase `json:"phase"`
61+
62+
// SecretRef holds the reference to the secret that contains the actual credentials.
63+
SecretRef *SecretReference `json:"secretRef,omitempty"`
64+
}
65+
66+
// +kubebuilder:object:root=true
67+
// +kubebuilder:subresource:status
68+
// +kubebuilder:resource:shortName=ar;areq
69+
// +kubebuilder:metadata:labels="openmcp.cloud/cluster=platform"
70+
// +kubebuilder:selectablefield:JSONPath=".status.phase"
71+
// +kubebuilder:printcolumn:JSONPath=".status.phase",name="Phase",type=string
72+
73+
// AccessRequest is the Schema for the accessrequests API
74+
type AccessRequest struct {
75+
metav1.TypeMeta `json:",inline"`
76+
metav1.ObjectMeta `json:"metadata,omitempty"`
77+
78+
Spec AccessRequestSpec `json:"spec,omitempty"`
79+
Status AccessRequestStatus `json:"status,omitempty"`
80+
}
81+
82+
// +kubebuilder:object:root=true
83+
84+
// AccessRequestList contains a list of AccessRequest
85+
type AccessRequestList struct {
86+
metav1.TypeMeta `json:",inline"`
87+
metav1.ListMeta `json:"metadata,omitempty"`
88+
Items []AccessRequest `json:"items"`
89+
}
90+
91+
func init() {
92+
SchemeBuilder.Register(&AccessRequest{}, &AccessRequestList{})
93+
}
94+
95+
// ObjectReference is a reference to an object in any namespace.
96+
type ObjectReference apimachinery.NamespacedName
97+
98+
// LocalObjectReference is a reference to an object in the same namespace as the resource referencing it.
99+
type LocalObjectReference corev1.LocalObjectReference
100+
101+
// SecretReference is a reference to a secret in any namespace with a key.
102+
type SecretReference struct {
103+
ObjectReference `json:",inline"`
104+
// Key is the key in the secret to use.
105+
Key string `json:"key"`
106+
}
107+
108+
// LocalSecretReference is a reference to a secret in the same namespace as the resource referencing it with a key.
109+
type LocalSecretReference struct {
110+
LocalObjectReference `json:",inline"`
111+
// Key is the key in the secret to use.
112+
Key string `json:"key"`
113+
}

api/v1alpha1/cluster_types.go renamed to api/clusters/v1alpha1/cluster_types.go

Lines changed: 1 addition & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -21,29 +21,6 @@ import (
2121
runtime "k8s.io/apimachinery/pkg/runtime"
2222
)
2323

24-
// Phase is a custom type representing the phase of a cluster.
25-
type Phase string
26-
27-
// Constants representing the phases of an instance lifecycle.
28-
const (
29-
Pending Phase = "Pending"
30-
Progressing Phase = "Progressing"
31-
Ready Phase = "Ready"
32-
Failed Phase = "Failed"
33-
Terminating Phase = "Terminating"
34-
Unknown Phase = "Unknown"
35-
)
36-
37-
// ClusterConditionType is a custom type representing the condition type of a cluster.
38-
type ClusterConditionType string
39-
40-
// Constants representing the conditions of a cluster.
41-
const (
42-
ClusterReady ClusterConditionType = "Ready"
43-
KindReady ClusterConditionType = "KindReady"
44-
MetalLBReady ClusterConditionType = "MetalLBReady"
45-
)
46-
4724
// ClusterSpec defines the desired state of Cluster.
4825
type ClusterSpec struct{}
4926

@@ -65,7 +42,7 @@ type ClusterStatus struct {
6542
ObservedGeneration int64 `json:"observedGeneration"`
6643

6744
// +kubebuilder:default=Unknown
68-
Phase Phase `json:"phase"`
45+
Phase string `json:"phase"`
6946

7047
// APIServer is the API server endpoint of the cluster.
7148
// +optional

‎api/clusters/v1alpha1/groupversion_info.go‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
/*
2+
Copyright 2025.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
// Package v1alpha1 contains API Schema definitions for the v1alpha1 API group.
18+
// +kubebuilder:object:generate=true
19+
// +groupName=clusters.openmcp.cloud
20+
package v1alpha1
21+
22+
import (
23+
"k8s.io/apimachinery/pkg/runtime/schema"
24+
"sigs.k8s.io/controller-runtime/pkg/scheme"
25+
)
26+
27+
var (
28+
// GroupVersion is group version used to register these objects.
29+
GroupVersion = schema.GroupVersion{Group: "clusters.openmcp.cloud", Version: "v1alpha1"}
30+
31+
// SchemeBuilder is used to add go types to the GroupVersionKind scheme.
32+
SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}
33+
34+
// AddToScheme adds the types in this group-version to the given scheme.
35+
AddToScheme = SchemeBuilder.AddToScheme
36+
)

0 commit comments

Comments
 (0)