bug: non-owned reference in permission claims

[mjudeikis]

Describe the bug

Currently, when using the permissionClaims api, one can't reference a non-owned object. Meaning:

apiVersion: kube-bind.io/v1alpha2
kind: APIServiceExport
metadata:
  name: mangodb
spec:
  namespaces:
  - name: mangodb-namespace
  permissionClaims:
  - resource: secrets
    selector:
     references:
     - group: secret.com
        resource: secrets
        versions: [ v1alpha1 ]
        jsonPath:
          name: spec.secret.name
          namespace: spec.secret.namespace
  resources:
  - group: mangodb.com
    resource: mangodbs
    versions:
    - v1alpha1

This was intentional but backfiring in usability very fast.

Steps To Reproduce

TBC

Expected Behaviour

1. If one uses this in prefix isolation mode - it should not allow reference objects, which are not part of the contract. Its basic security.

2. If backend runs in namespaced isolation mode, we do not require a namespace in JSONPath and inherit it from the object namespace. (we operate in namespaces)

3. When we operate in non-isolation, everything should be allowed. Because we basically "own both ends fully"

Component

kubectl-bind (plugin)

kubectl version

No response

Kubernetes version

No response

kube-bind version

No response

Additional Context

No response