Persist assigned namespace for easier crossmapping

backend/controllers/bindableresourcesrequest/bindableresourcesrequest_controller.go

@@ -251,7 +251,7 @@ func (r *reconciler) reconcile(ctx context.Context, clusterName string, cl clien
 	}
 
 	// Handle resources and get kubeconfig
-	kfg, err := r.kubeManager.HandleResources(ctx, req.Spec.Author, req.Spec.ClusterIdentity.Identity, clusterName)
+	result, err := r.kubeManager.HandleResources(ctx, req.Spec.Author, req.Spec.ClusterIdentity.Identity, clusterName)
 	if err != nil {
 		meta.SetStatusCondition(&req.Status.Conditions, metav1.Condition{
 			Type:               string(kubebindv1alpha2.BindableResourcesRequestConditionReady),
@@ -263,8 +263,11 @@ func (r *reconciler) reconcile(ctx context.Context, clusterName string, cl clien
 		return ctrl.Result{}, fmt.Errorf("failed to handle resources for cluster identity %q: %w", req.Spec.ClusterIdentity.Identity, err)
 	}
 
+	// Set the namespace in the status
+	req.Status.Namespace = result.Namespace
+
 	// Create or update the BindingResourceResponse secret
-	if err := r.ensureBindingResponseSecret(ctx, cl, req, kfg, secretName, secretKey); err != nil {
+	if err := r.ensureBindingResponseSecret(ctx, cl, req, result.Kubeconfig, secretName, secretKey); err != nil {
 		meta.SetStatusCondition(&req.Status.Conditions, metav1.Condition{
 			Type:               string(kubebindv1alpha2.BindableResourcesRequestConditionReady),
 			Status:             metav1.ConditionFalse,

backend/http/handler.go

@@ -367,7 +367,7 @@ func (h *handler) handleBind(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	kfg, err := h.kubeManager.HandleResources(r.Context(), state.Token.Subject, params.ConsumerID, params.ClusterID)
+	handleResult, err := h.kubeManager.HandleResources(r.Context(), state.Token.Subject, params.ConsumerID, params.ClusterID)
 	if err != nil {
 		logger.Error(err, "failed to handle resources")
 		statusCode, code, details := mapErrorToCode(err)
@@ -418,7 +418,7 @@ func (h *handler) handleBind(w http.ResponseWriter, r *http.Request) {
 				ID:        state.Token.Issuer + "/" + state.Token.Subject,
 			},
 		},
-		Kubeconfig: kfg,
+		Kubeconfig: handleResult.Kubeconfig,
 		Requests:   []runtime.RawExtension{{Raw: requestBytes}},
 	}
 

backend/kubernetes/manager.go

@@ -83,10 +83,18 @@ func NewKubernetesManager(
 	return m, nil
 }
 
+// HandleResourcesResult contains the result of HandleResources operation.
+type HandleResourcesResult struct {
+	// Kubeconfig is the kubeconfig data for accessing the service provider cluster.
+	Kubeconfig []byte
+	// Namespace is the namespace assigned to this binding on the service provider cluster.
+	Namespace string
+}
+
 func (m *Manager) HandleResources(
 	ctx context.Context,
 	author, identity, cluster string,
-) ([]byte, error) {
+) (*HandleResourcesResult, error) {
 	logger := klog.FromContext(ctx).WithValues("identity", identity)
 	ctx = klog.NewContext(ctx, logger)
 
@@ -159,7 +167,10 @@ func (m *Manager) HandleResources(
 		return nil, err
 	}
 
-	return kfgSecret.Data["kubeconfig"], nil
+	return &HandleResourcesResult{
+		Kubeconfig: kfgSecret.Data["kubeconfig"],
+		Namespace:  ns,
+	}, nil
 }
 
 func (m *Manager) ListCustomResourceDefinitions(ctx context.Context, cluster string, selector labels.Selector) (*apiextensionsv1.CustomResourceDefinitionList, error) {

contrib/kcp/deploy/resources/apiexport-kube-bind.io.yaml

@@ -82,7 +82,7 @@ spec:
       crd: {}
   - group: kube-bind.io
     name: bindableresourcesrequests
-    schema: v260122-c9f0f376.bindableresourcesrequests.kube-bind.io
+    schema: v260225-974c2a97.bindableresourcesrequests.kube-bind.io
     storage:
       crd: {}
   - group: kube-bind.io

contrib/kcp/deploy/resources/apiresourceschema-bindableresourcesrequests.kube-bind.io.yaml

@@ -1,7 +1,7 @@
 apiVersion: apis.kcp.io/v1alpha1
 kind: APIResourceSchema
 metadata:
-  name: v260122-c9f0f376.bindableresourcesrequests.kube-bind.io
+  name: v260225-974c2a97.bindableresourcesrequests.kube-bind.io
 spec:
   group: kube-bind.io
   names:
@@ -192,6 +192,11 @@ spec:
               - key
               - name
               type: object
+            namespace:
+              description: |-
+                namespace is the namespace assigned to this binding request on the service provider cluster.
+                This is where the resources for this binding are created and managed.
+              type: string
             phase:
               default: Pending
               description: phase is the current phase of the binding request.

deploy/charts/backend/crds/kube-bind.io_bindableresourcesrequests.yaml

@@ -196,6 +196,11 @@ spec:
                 - key
                 - name
                 type: object
+              namespace:
+                description: |-
+                  namespace is the namespace assigned to this binding request on the service provider cluster.
+                  This is where the resources for this binding are created and managed.
+                type: string
               phase:
                 default: Pending
                 description: phase is the current phase of the binding request.

deploy/crd/kube-bind.io_bindableresourcesrequests.yaml

@@ -196,6 +196,11 @@ spec:
                 - key
                 - name
                 type: object
+              namespace:
+                description: |-
+                  namespace is the namespace assigned to this binding request on the service provider cluster.
+                  This is where the resources for this binding are created and managed.
+                type: string
               phase:
                 default: Pending
                 description: phase is the current phase of the binding request.

sdk/apis/kubebind/v1alpha2/bindingresponse_types.go

@@ -178,6 +178,13 @@ type BindableResourcesRequestStatus struct {
 	// +kubebuilder:validation:Enum=Pending;Failed;Succeeded
 	Phase BindableResourcesRequestPhase `json:"phase,omitempty"`
 
+	// namespace is the namespace assigned to this binding request on the service provider cluster.
+	// This is where the resources for this binding are created and managed.
+	//
+	// +optional
+	// +kubebuilder:validation:Optional
+	Namespace string `json:"namespace,omitempty"`
+
 	// kubeconfigSecretRef is a reference to a secret containing the kubeconfig, used
 	// to be used by the konnector agent.
 	KubeconfigSecretRef *LocalSecretKeyRef `json:"kubeconfigSecretRef,omitempty"`