Skip to content

Commit d8c0d86

Browse files
google-oss-prow[bot]google-oss-prow[bot]
authored
Merge pull request #4026 from gemmahou/resource-bigtable-authorizedview
Add bigtable authorizedview types, mappers, CRD and fuzzer
2 parents bfa4cb3 + 27bb8a0 commit d8c0d86

17 files changed

+1307
-86
lines changed

‎apis/bigtable/v1alpha1/authorizedview_identity.go

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
// Copyright 2025 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
package v1alpha1
16+
17+
import (
18+
"context"
19+
"fmt"
20+
"strings"
21+
22+
bigtablev1beta1 "github.com/GoogleCloudPlatform/k8s-config-connector/apis/bigtable/v1beta1"
23+
"github.com/GoogleCloudPlatform/k8s-config-connector/apis/common/parent"
24+
25+
"github.com/GoogleCloudPlatform/k8s-config-connector/apis/common"
26+
"sigs.k8s.io/controller-runtime/pkg/client"
27+
)
28+
29+
// AuthorizedViewIdentity defines the resource reference to BigtableAuthorizedView, which "External" field
30+
// holds the GCP identifier for the KRM object.
31+
type AuthorizedViewIdentity struct {
32+
parent *bigtablev1beta1.TableIdentity
33+
id string
34+
}
35+
36+
func (i *AuthorizedViewIdentity) String() string {
37+
return i.parent.String() + "/authorizedViews/" + i.id
38+
}
39+
40+
func (i *AuthorizedViewIdentity) ID() string {
41+
return i.id
42+
}
43+
44+
// New builds a AuthorizedViewIdentity from the Config Connector AuthorizedView object.
45+
func NewAuthorizedViewIdentity(ctx context.Context, reader client.Reader, obj *BigtableAuthorizedView) (*AuthorizedViewIdentity, error) {
46+
47+
// Get Parent
48+
tableExternal, err := obj.Spec.TableRef.NormalizedExternal(ctx, reader, obj.GetNamespace())
49+
if err != nil {
50+
return nil, err
51+
}
52+
instanceIdentity, tableID, err := bigtablev1beta1.ParseTableExternal(tableExternal)
53+
if err != nil {
54+
return nil, err
55+
}
56+
57+
// Get desired ID
58+
resourceID := common.ValueOf(obj.Spec.ResourceID)
59+
if resourceID == "" {
60+
resourceID = obj.GetName()
61+
}
62+
if resourceID == "" {
63+
return nil, fmt.Errorf("cannot resolve resource ID")
64+
}
65+
66+
// Use approved External
67+
externalRef := common.ValueOf(obj.Status.ExternalRef)
68+
if externalRef != "" {
69+
// Validate desired with actual
70+
actualParent, actualResourceID, err := ParseAuthorizedViewExternal(externalRef)
71+
if err != nil {
72+
return nil, err
73+
}
74+
if actualParent.Id != tableID {
75+
return nil, fmt.Errorf("spec.groupRef changed, expect %s, got %s", actualParent.Id, tableID)
76+
}
77+
if actualResourceID != resourceID {
78+
return nil, fmt.Errorf("cannot reset `metadata.name` or `spec.resourceID` to %s, since it has already assigned to %s",
79+
resourceID, actualResourceID)
80+
}
81+
}
82+
return &AuthorizedViewIdentity{
83+
parent: &bigtablev1beta1.TableIdentity{
84+
Parent: instanceIdentity,
85+
Id: tableID,
86+
},
87+
id: resourceID,
88+
}, nil
89+
}
90+
91+
func ParseAuthorizedViewExternal(external string) (*bigtablev1beta1.TableIdentity, string, error) {
92+
tokens := strings.Split(external, "/")
93+
if len(tokens) != 8 || tokens[0] != "projects" || tokens[2] != "instances" || tokens[4] != "tables" || tokens[6] != "authorizedViews" {
94+
return nil, "", fmt.Errorf("format of BigtableAuthorizedView external=%q was not known (use projects/{{projectID}}/instances/{{instanceID}}/tables/{{tableID}}/authorizedViews/{{authorizedViewID}})", external)
95+
}
96+
p := &bigtablev1beta1.TableIdentity{
97+
Parent: &bigtablev1beta1.InstanceIdentity{
98+
Parent: &parent.ProjectParent{
99+
ProjectID: tokens[1],
100+
},
101+
Id: tokens[3],
102+
},
103+
Id: tokens[5],
104+
}
105+
resourceID := tokens[7]
106+
return p, resourceID, nil
107+
}

‎apis/bigtable/v1alpha1/authorizedview_reference.go

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
// Copyright 2025 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
package v1alpha1
16+
17+
import (
18+
"context"
19+
"fmt"
20+
21+
refsv1beta1 "github.com/GoogleCloudPlatform/k8s-config-connector/apis/refs/v1beta1"
22+
"github.com/GoogleCloudPlatform/k8s-config-connector/pkg/k8s"
23+
apierrors "k8s.io/apimachinery/pkg/api/errors"
24+
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
25+
"k8s.io/apimachinery/pkg/types"
26+
"sigs.k8s.io/controller-runtime/pkg/client"
27+
)
28+
29+
var _ refsv1beta1.ExternalNormalizer = &AuthorizedViewRef{}
30+
31+
// AuthorizedViewRef defines the resource reference to BigtableAuthorizedView, which "External" field
32+
// holds the GCP identifier for the KRM object.
33+
type AuthorizedViewRef struct {
34+
// A reference to an externally managed BigtableAuthorizedView resource.
35+
// Should be in the format "projects/{{projectID}}/locations/{{location}}/authorizedviews/{{authorizedviewID}}".
36+
External string `json:"external,omitempty"`
37+
38+
// The name of a BigtableAuthorizedView resource.
39+
Name string `json:"name,omitempty"`
40+
41+
// The namespace of a BigtableAuthorizedView resource.
42+
Namespace string `json:"namespace,omitempty"`
43+
}
44+
45+
// NormalizedExternal provision the "External" value for other resource that depends on BigtableAuthorizedView.
46+
// If the "External" is given in the other resource's spec.BigtableAuthorizedViewRef, the given value will be used.
47+
// Otherwise, the "Name" and "Namespace" will be used to query the actual BigtableAuthorizedView object from the cluster.
48+
func (r *AuthorizedViewRef) NormalizedExternal(ctx context.Context, reader client.Reader, otherNamespace string) (string, error) {
49+
if r.External != "" && r.Name != "" {
50+
return "", fmt.Errorf("cannot specify both name and external on %s reference", BigtableAuthorizedViewGVK.Kind)
51+
}
52+
// From given External
53+
if r.External != "" {
54+
if _, _, err := ParseAuthorizedViewExternal(r.External); err != nil {
55+
return "", err
56+
}
57+
return r.External, nil
58+
}
59+
60+
// From the Config Connector object
61+
if r.Namespace == "" {
62+
r.Namespace = otherNamespace
63+
}
64+
key := types.NamespacedName{Name: r.Name, Namespace: r.Namespace}
65+
u := &unstructured.Unstructured{}
66+
u.SetGroupVersionKind(BigtableAuthorizedViewGVK)
67+
if err := reader.Get(ctx, key, u); err != nil {
68+
if apierrors.IsNotFound(err) {
69+
return "", k8s.NewReferenceNotFoundError(u.GroupVersionKind(), key)
70+
}
71+
return "", fmt.Errorf("reading referenced %s %s: %w", BigtableAuthorizedViewGVK, key, err)
72+
}
73+
// Get external from status.externalRef. This is the most trustworthy place.
74+
actualExternalRef, _, err := unstructured.NestedString(u.Object, "status", "externalRef")
75+
if err != nil {
76+
return "", fmt.Errorf("reading status.externalRef: %w", err)
77+
}
78+
if actualExternalRef == "" {
79+
return "", k8s.NewReferenceNotReadyError(u.GroupVersionKind(), key)
80+
}
81+
r.External = actualExternalRef
82+
return r.External, nil
83+
}

‎apis/bigtable/v1alpha1/authorizedview_types.go

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
// Copyright 2025 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
package v1alpha1
16+
17+
import (
18+
bigtablev1beta1 "github.com/GoogleCloudPlatform/k8s-config-connector/apis/bigtable/v1beta1"
19+
refv1beta1 "github.com/GoogleCloudPlatform/k8s-config-connector/apis/refs/v1beta1"
20+
"github.com/GoogleCloudPlatform/k8s-config-connector/pkg/apis/k8s/v1alpha1"
21+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
22+
)
23+
24+
var BigtableAuthorizedViewGVK = GroupVersion.WithKind("BigtableAuthorizedView")
25+
26+
type BigtableAuthorizedViewParent struct {
27+
// +required
28+
ProjectRef *refv1beta1.ProjectRef `json:"projectRef"`
29+
30+
// +required
31+
InstanceRef bigtablev1beta1.InstanceRef `json:"instanceRef"`
32+
33+
// +required
34+
TableRef bigtablev1beta1.TableRef `json:"tableRef"`
35+
}
36+
37+
// BigtableAuthorizedViewSpec defines the desired state of BigtableAuthorizedView
38+
// +kcc:proto=google.bigtable.admin.v2.AuthorizedView
39+
type BigtableAuthorizedViewSpec struct {
40+
// The BigtableAuthorizedView name. If not given, the metadata.name will be used.
41+
ResourceID *string `json:"resourceID,omitempty"`
42+
43+
// +required
44+
BigtableAuthorizedViewParent `json:",inline"`
45+
46+
// An AuthorizedView permitting access to an explicit subset of a Table.
47+
// +kcc:proto:field=google.bigtable.admin.v2.AuthorizedView.subset_view
48+
SubsetView *AuthorizedView_SubsetView `json:"subsetView,omitempty"`
49+
50+
// The etag for this AuthorizedView.
51+
// If this is provided on update, it must match the server's etag. The server
52+
// returns ABORTED error on a mismatched etag.
53+
// +kcc:proto:field=google.bigtable.admin.v2.AuthorizedView.etag
54+
Etag *string `json:"etag,omitempty"`
55+
56+
// Set to true to make the AuthorizedView protected against deletion.
57+
// The parent Table and containing Instance cannot be deleted if an
58+
// AuthorizedView has this bit set.
59+
// +kcc:proto:field=google.bigtable.admin.v2.AuthorizedView.deletion_protection
60+
DeletionProtection *bool `json:"deletionProtection,omitempty"`
61+
}
62+
63+
// BigtableAuthorizedViewStatus defines the config connector machine state of BigtableAuthorizedView
64+
type BigtableAuthorizedViewStatus struct {
65+
/* Conditions represent the latest available observations of the
66+
object's current state. */
67+
Conditions []v1alpha1.Condition `json:"conditions,omitempty"`
68+
69+
// ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource.
70+
ObservedGeneration *int64 `json:"observedGeneration,omitempty"`
71+
72+
// A unique specifier for the BigtableAuthorizedView resource in GCP.
73+
ExternalRef *string `json:"externalRef,omitempty"`
74+
75+
// ObservedState is the state of the resource as most recently observed in GCP.
76+
ObservedState *BigtableAuthorizedViewObservedState `json:"observedState,omitempty"`
77+
}
78+
79+
// BigtableAuthorizedViewObservedState is the state of the BigtableAuthorizedView resource as most recently observed in GCP.
80+
// +kcc:proto=google.bigtable.admin.v2.AuthorizedView
81+
type BigtableAuthorizedViewObservedState struct {
82+
}
83+
84+
// +genclient
85+
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
86+
// +kubebuilder:resource:categories=gcp,shortName=gcpbigtableauthorizedview;gcpbigtableauthorizedviews
87+
// +kubebuilder:subresource:status
88+
// +kubebuilder:metadata:labels="cnrm.cloud.google.com/managed-by-kcc=true";"cnrm.cloud.google.com/system=true"
89+
// +kubebuilder:printcolumn:name="Age",JSONPath=".metadata.creationTimestamp",type="date"
90+
// +kubebuilder:printcolumn:name="Ready",JSONPath=".status.conditions[?(@.type=='Ready')].status",type="string",description="When 'True', the most recent reconcile of the resource succeeded"
91+
// +kubebuilder:printcolumn:name="Status",JSONPath=".status.conditions[?(@.type=='Ready')].reason",type="string",description="The reason for the value in 'Ready'"
92+
// +kubebuilder:printcolumn:name="Status Age",JSONPath=".status.conditions[?(@.type=='Ready')].lastTransitionTime",type="date",description="The last transition time for the value in 'Status'"
93+
94+
// BigtableAuthorizedView is the Schema for the BigtableAuthorizedView API
95+
// +k8s:openapi-gen=true
96+
type BigtableAuthorizedView struct {
97+
metav1.TypeMeta `json:",inline"`
98+
metav1.ObjectMeta `json:"metadata,omitempty"`
99+
100+
// +required
101+
Spec BigtableAuthorizedViewSpec `json:"spec,omitempty"`
102+
Status BigtableAuthorizedViewStatus `json:"status,omitempty"`
103+
}
104+
105+
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
106+
// BigtableAuthorizedViewList contains a list of BigtableAuthorizedView
107+
type BigtableAuthorizedViewList struct {
108+
metav1.TypeMeta `json:",inline"`
109+
metav1.ListMeta `json:"metadata,omitempty"`
110+
Items []BigtableAuthorizedView `json:"items"`
111+
}
112+
113+
func init() {
114+
SchemeBuilder.Register(&BigtableAuthorizedView{}, &BigtableAuthorizedViewList{})
115+
}

‎apis/bigtable/v1alpha1/cluster_types.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ import (
2525

2626
var BigtableClusterGVK = GroupVersion.WithKind("BigtableCluster")
2727

28-
type Parent struct {
28+
type BigtableClusterParent struct {
2929
// +required
3030
ProjectRef *refv1beta1.ProjectRef `json:"projectRef"`
3131
// +required
@@ -35,7 +35,7 @@ type Parent struct {
3535
// BigtableClusterSpec defines the desired state of BigtableCluster
3636
// +kcc:proto=google.bigtable.admin.v2.Cluster
3737
type BigtableClusterSpec struct {
38-
Parent `json:",inline"`
38+
BigtableClusterParent `json:",inline"`
3939

4040
// The BigtableCluster name. If not given, the metadata.name will be used.
4141
ResourceID *string `json:"resourceID,omitempty"`

‎apis/bigtable/v1alpha1/types.generated.go

Lines changed: 50 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)