From 6cb70749ad96c517d66145ddd4553a4fab77af23 Mon Sep 17 00:00:00 2001 From: Mangirdas Judeikis Date: Wed, 25 Feb 2026 14:55:51 +0200 Subject: [PATCH] Persist assigned namespace for easier crossmapping Signed-off-by: Mangirdas Judeikis On-behalf-of: @SAP mangirdas.judeikis@sap.com --- .../bindableresourcesrequest_controller.go | 7 +++++-- backend/http/handler.go | 4 ++-- backend/kubernetes/manager.go | 15 +++++++++++++-- .../deploy/resources/apiexport-kube-bind.io.yaml | 2 +- ...ma-bindableresourcesrequests.kube-bind.io.yaml | 7 ++++++- .../kube-bind.io_bindableresourcesrequests.yaml | 5 +++++ .../kube-bind.io_bindableresourcesrequests.yaml | 5 +++++ .../kubebind/v1alpha2/bindingresponse_types.go | 7 +++++++ 8 files changed, 44 insertions(+), 8 deletions(-) diff --git a/backend/controllers/bindableresourcesrequest/bindableresourcesrequest_controller.go b/backend/controllers/bindableresourcesrequest/bindableresourcesrequest_controller.go index 43c9a27f2..05169d6a2 100644 --- a/backend/controllers/bindableresourcesrequest/bindableresourcesrequest_controller.go +++ b/backend/controllers/bindableresourcesrequest/bindableresourcesrequest_controller.go @@ -251,7 +251,7 @@ func (r *reconciler) reconcile(ctx context.Context, clusterName string, cl clien } // Handle resources and get kubeconfig - kfg, err := r.kubeManager.HandleResources(ctx, req.Spec.Author, req.Spec.ClusterIdentity.Identity, clusterName) + result, err := r.kubeManager.HandleResources(ctx, req.Spec.Author, req.Spec.ClusterIdentity.Identity, clusterName) if err != nil { meta.SetStatusCondition(&req.Status.Conditions, metav1.Condition{ Type: string(kubebindv1alpha2.BindableResourcesRequestConditionReady), @@ -263,8 +263,11 @@ func (r *reconciler) reconcile(ctx context.Context, clusterName string, cl clien return ctrl.Result{}, fmt.Errorf("failed to handle resources for cluster identity %q: %w", req.Spec.ClusterIdentity.Identity, err) } + // Set the namespace in the status + req.Status.Namespace = result.Namespace + // Create or update the BindingResourceResponse secret - if err := r.ensureBindingResponseSecret(ctx, cl, req, kfg, secretName, secretKey); err != nil { + if err := r.ensureBindingResponseSecret(ctx, cl, req, result.Kubeconfig, secretName, secretKey); err != nil { meta.SetStatusCondition(&req.Status.Conditions, metav1.Condition{ Type: string(kubebindv1alpha2.BindableResourcesRequestConditionReady), Status: metav1.ConditionFalse, diff --git a/backend/http/handler.go b/backend/http/handler.go index 3a9ea5d37..c0d3003df 100644 --- a/backend/http/handler.go +++ b/backend/http/handler.go @@ -367,7 +367,7 @@ func (h *handler) handleBind(w http.ResponseWriter, r *http.Request) { return } - kfg, err := h.kubeManager.HandleResources(r.Context(), state.Token.Subject, params.ConsumerID, params.ClusterID) + handleResult, err := h.kubeManager.HandleResources(r.Context(), state.Token.Subject, params.ConsumerID, params.ClusterID) if err != nil { logger.Error(err, "failed to handle resources") statusCode, code, details := mapErrorToCode(err) @@ -418,7 +418,7 @@ func (h *handler) handleBind(w http.ResponseWriter, r *http.Request) { ID: state.Token.Issuer + "/" + state.Token.Subject, }, }, - Kubeconfig: kfg, + Kubeconfig: handleResult.Kubeconfig, Requests: []runtime.RawExtension{{Raw: requestBytes}}, } diff --git a/backend/kubernetes/manager.go b/backend/kubernetes/manager.go index 5a4e79770..743ea8e84 100644 --- a/backend/kubernetes/manager.go +++ b/backend/kubernetes/manager.go @@ -83,10 +83,18 @@ func NewKubernetesManager( return m, nil } +// HandleResourcesResult contains the result of HandleResources operation. +type HandleResourcesResult struct { + // Kubeconfig is the kubeconfig data for accessing the service provider cluster. + Kubeconfig []byte + // Namespace is the namespace assigned to this binding on the service provider cluster. + Namespace string +} + func (m *Manager) HandleResources( ctx context.Context, author, identity, cluster string, -) ([]byte, error) { +) (*HandleResourcesResult, error) { logger := klog.FromContext(ctx).WithValues("identity", identity) ctx = klog.NewContext(ctx, logger) @@ -159,7 +167,10 @@ func (m *Manager) HandleResources( return nil, err } - return kfgSecret.Data["kubeconfig"], nil + return &HandleResourcesResult{ + Kubeconfig: kfgSecret.Data["kubeconfig"], + Namespace: ns, + }, nil } func (m *Manager) ListCustomResourceDefinitions(ctx context.Context, cluster string, selector labels.Selector) (*apiextensionsv1.CustomResourceDefinitionList, error) { diff --git a/contrib/kcp/deploy/resources/apiexport-kube-bind.io.yaml b/contrib/kcp/deploy/resources/apiexport-kube-bind.io.yaml index c7dc24a21..b50b6400f 100644 --- a/contrib/kcp/deploy/resources/apiexport-kube-bind.io.yaml +++ b/contrib/kcp/deploy/resources/apiexport-kube-bind.io.yaml @@ -82,7 +82,7 @@ spec: crd: {} - group: kube-bind.io name: bindableresourcesrequests - schema: v260122-c9f0f376.bindableresourcesrequests.kube-bind.io + schema: v260225-974c2a97.bindableresourcesrequests.kube-bind.io storage: crd: {} - group: kube-bind.io diff --git a/contrib/kcp/deploy/resources/apiresourceschema-bindableresourcesrequests.kube-bind.io.yaml b/contrib/kcp/deploy/resources/apiresourceschema-bindableresourcesrequests.kube-bind.io.yaml index 6a79d0a96..0d237b04d 100644 --- a/contrib/kcp/deploy/resources/apiresourceschema-bindableresourcesrequests.kube-bind.io.yaml +++ b/contrib/kcp/deploy/resources/apiresourceschema-bindableresourcesrequests.kube-bind.io.yaml @@ -1,7 +1,7 @@ apiVersion: apis.kcp.io/v1alpha1 kind: APIResourceSchema metadata: - name: v260122-c9f0f376.bindableresourcesrequests.kube-bind.io + name: v260225-974c2a97.bindableresourcesrequests.kube-bind.io spec: group: kube-bind.io names: @@ -192,6 +192,11 @@ spec: - key - name type: object + namespace: + description: |- + namespace is the namespace assigned to this binding request on the service provider cluster. + This is where the resources for this binding are created and managed. + type: string phase: default: Pending description: phase is the current phase of the binding request. diff --git a/deploy/charts/backend/crds/kube-bind.io_bindableresourcesrequests.yaml b/deploy/charts/backend/crds/kube-bind.io_bindableresourcesrequests.yaml index 411178bbd..8d01ca822 100644 --- a/deploy/charts/backend/crds/kube-bind.io_bindableresourcesrequests.yaml +++ b/deploy/charts/backend/crds/kube-bind.io_bindableresourcesrequests.yaml @@ -196,6 +196,11 @@ spec: - key - name type: object + namespace: + description: |- + namespace is the namespace assigned to this binding request on the service provider cluster. + This is where the resources for this binding are created and managed. + type: string phase: default: Pending description: phase is the current phase of the binding request. diff --git a/deploy/crd/kube-bind.io_bindableresourcesrequests.yaml b/deploy/crd/kube-bind.io_bindableresourcesrequests.yaml index 411178bbd..8d01ca822 100644 --- a/deploy/crd/kube-bind.io_bindableresourcesrequests.yaml +++ b/deploy/crd/kube-bind.io_bindableresourcesrequests.yaml @@ -196,6 +196,11 @@ spec: - key - name type: object + namespace: + description: |- + namespace is the namespace assigned to this binding request on the service provider cluster. + This is where the resources for this binding are created and managed. + type: string phase: default: Pending description: phase is the current phase of the binding request. diff --git a/sdk/apis/kubebind/v1alpha2/bindingresponse_types.go b/sdk/apis/kubebind/v1alpha2/bindingresponse_types.go index b3d1afe8e..54c2e2323 100644 --- a/sdk/apis/kubebind/v1alpha2/bindingresponse_types.go +++ b/sdk/apis/kubebind/v1alpha2/bindingresponse_types.go @@ -178,6 +178,13 @@ type BindableResourcesRequestStatus struct { // +kubebuilder:validation:Enum=Pending;Failed;Succeeded Phase BindableResourcesRequestPhase `json:"phase,omitempty"` + // namespace is the namespace assigned to this binding request on the service provider cluster. + // This is where the resources for this binding are created and managed. + // + // +optional + // +kubebuilder:validation:Optional + Namespace string `json:"namespace,omitempty"` + // kubeconfigSecretRef is a reference to a secret containing the kubeconfig, used // to be used by the konnector agent. KubeconfigSecretRef *LocalSecretKeyRef `json:"kubeconfigSecretRef,omitempty"`