Skip to content

Commit fd805cb

Browse files
pmalekpmalek
committed
feat(crd): add WatchNamespaceGrant CRD
1 parent 9a4e025 commit fd805cb

14 files changed

+560
-1
lines changed

‎CHANGELOG.md

+2
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ Adding a new version? You'll need three changes:
2828
[#401](https://github.com/Kong/kubernetes-configuration/pull/401)
2929
- Added `scale` subresource to `DataPlane` CRD.
3030
[#402](https://github.com/Kong/kubernetes-configuration/pull/402)
31+
- Added `WatchNamespaceGrant` CRD.
32+
[#403](https://github.com/Kong/kubernetes-configuration/pull/403)
3133

3234
### Changes
3335

‎api/gateway-operator/v1alpha1/watchnamespacegrant_types.go

+73
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
package v1alpha1
2+
3+
import (
4+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
5+
)
6+
7+
func init() {
8+
SchemeBuilder.Register(&WatchNamespaceGrant{}, &WatchNamespaceGrantList{})
9+
}
10+
11+
// WatchNamespaceGrant is a grant that allows a trusted namespace to watch
12+
// resources in the namespace this grant exists in.
13+
//
14+
// +genclient
15+
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
16+
// +kubebuilder:object:root=true
17+
// +apireference:kgo:include
18+
// +kong:channels=gateway-operator
19+
type WatchNamespaceGrant struct {
20+
metav1.TypeMeta `json:",inline"`
21+
metav1.ObjectMeta `json:"metadata,omitempty"`
22+
23+
// Spec is the desired state of the WatchNamespaceGrant.
24+
Spec WatchNamespaceGrantSpec `json:"spec,omitempty"`
25+
26+
// Status is not specified for WatchNamespaceGrant but it may be added in the future.
27+
}
28+
29+
// WatchNamespaceGrantSpec defines the desired state of an WatchNamespaceGrant.
30+
//
31+
// +apireference:kgo:include
32+
type WatchNamespaceGrantSpec struct {
33+
// From describes the trusted namespaces and kinds that can reference the
34+
// namespace this grant exists in.
35+
//
36+
// Support: Core
37+
//
38+
// +kubebuilder:validation:MinItems=1
39+
// +kubebuilder:validation:MaxItems=16
40+
From []WatchNamespaceGrantFrom `json:"from"`
41+
}
42+
43+
// WatchNamespaceGrantFrom describes trusted namespaces.
44+
type WatchNamespaceGrantFrom struct {
45+
// Group is the group of the referent.
46+
//
47+
// +kubebuilder:validation:Enum=gateway-operator.konghq.com
48+
// +kubebuilder:validation:Required
49+
Group string `json:"group"`
50+
51+
// Kind is the kind of the referent.
52+
//
53+
// +kubebuilder:validation:Enum=ControlPlane
54+
// +kubebuilder:validation:Required
55+
Kind string `json:"kind"`
56+
57+
// Namespace is the namespace of the referent.
58+
//
59+
// +kubebuilder:validation:Required
60+
Namespace string `json:"namespace"`
61+
}
62+
63+
// WatchNamespaceGrantList contains a list of WatchNamespaceGrants.
64+
//
65+
// +kubebuilder:object:root=true
66+
// +apireference:kgo:include
67+
type WatchNamespaceGrantList struct {
68+
metav1.TypeMeta `json:",inline"`
69+
metav1.ListMeta `json:"metadata,omitempty"`
70+
71+
// Items is the list of WatchNamespaceGrants.
72+
Items []WatchNamespaceGrant `json:"items"`
73+
}

‎api/gateway-operator/v1alpha1/zz_generated.deepcopy.go

+93
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/gateway-operator/gateway-operator.konghq.com_watchnamespacegrants.yaml

+80
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
---
2+
apiVersion: apiextensions.k8s.io/v1
3+
kind: CustomResourceDefinition
4+
metadata:
5+
annotations:
6+
kubernetes-configuration.konghq.com/channels: gateway-operator
7+
kubernetes-configuration.konghq.com/version: v1.3.1
8+
name: watchnamespacegrants.gateway-operator.konghq.com
9+
spec:
10+
group: gateway-operator.konghq.com
11+
names:
12+
kind: WatchNamespaceGrant
13+
listKind: WatchNamespaceGrantList
14+
plural: watchnamespacegrants
15+
singular: watchnamespacegrant
16+
scope: Namespaced
17+
versions:
18+
- name: v1alpha1
19+
schema:
20+
openAPIV3Schema:
21+
description: |-
22+
WatchNamespaceGrant is a grant that allows a trusted namespace to watch
23+
resources in the namespace this grant exists in.
24+
properties:
25+
apiVersion:
26+
description: |-
27+
APIVersion defines the versioned schema of this representation of an object.
28+
Servers should convert recognized schemas to the latest internal value, and
29+
may reject unrecognized values.
30+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
31+
type: string
32+
kind:
33+
description: |-
34+
Kind is a string value representing the REST resource this object represents.
35+
Servers may infer this from the endpoint the client submits requests to.
36+
Cannot be updated.
37+
In CamelCase.
38+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
39+
type: string
40+
metadata:
41+
type: object
42+
spec:
43+
description: Spec is the desired state of the WatchNamespaceGrant.
44+
properties:
45+
from:
46+
description: |-
47+
From describes the trusted namespaces and kinds that can reference the
48+
namespace this grant exists in.
49+
50+
Support: Core
51+
items:
52+
description: WatchNamespaceGrantFrom describes trusted namespaces.
53+
properties:
54+
group:
55+
description: Group is the group of the referent.
56+
enum:
57+
- gateway-operator.konghq.com
58+
type: string
59+
kind:
60+
description: Kind is the kind of the referent.
61+
enum:
62+
- ControlPlane
63+
type: string
64+
namespace:
65+
description: Namespace is the namespace of the referent.
66+
type: string
67+
required:
68+
- group
69+
- kind
70+
- namespace
71+
type: object
72+
maxItems: 16
73+
minItems: 1
74+
type: array
75+
required:
76+
- from
77+
type: object
78+
type: object
79+
served: true
80+
storage: true

‎config/crd/gateway-operator/kustomization.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ resources:
3030
- gateway-operator.konghq.com_gatewayconfigurations.yaml
3131
- gateway-operator.konghq.com_kongplugininstallations.yaml
3232
- gateway-operator.konghq.com_konnectextensions.yaml
33+
- gateway-operator.konghq.com_watchnamespacegrants.yaml
3334
- konnect.konghq.com_konnectapiauthconfigurations.yaml
3435
- konnect.konghq.com_konnectcloudgatewaydataplanegroupconfigurations.yaml
3536
- konnect.konghq.com_konnectcloudgatewaynetworks.yaml

‎docs/all-api-reference.md

+50
Original file line numberDiff line numberDiff line change
@@ -2069,6 +2069,7 @@ Package v1alpha1 contains API Schema definitions for the operator v1alpha1 API g
20692069
- [DataPlaneMetricsExtension](#dataplanemetricsextension)
20702070
- [KongPluginInstallation](#kongplugininstallation)
20712071
- [KonnectExtension](#konnectextension)
2072+
- [WatchNamespaceGrant](#watchnamespacegrant)
20722073
### AIGateway
20732074

20742075

@@ -2173,6 +2174,23 @@ deployment spec gets customized to include the konnect-related configuration.
21732174

21742175

21752176

2177+
### WatchNamespaceGrant
2178+
2179+
2180+
WatchNamespaceGrant is a grant that allows a trusted namespace to watch
2181+
resources in the namespace this grant exists in.
2182+
2183+
<!-- watch_namespace_grant description placeholder -->
2184+
2185+
| Field | Description |
2186+
| --- | --- |
2187+
| `apiVersion` _string_ | `gateway-operator.konghq.com/v1alpha1`
2188+
| `kind` _string_ | `WatchNamespaceGrant`
2189+
| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |
2190+
| `spec` _[WatchNamespaceGrantSpec](#watchnamespacegrantspec)_ | Spec is the desired state of the WatchNamespaceGrant. |
2191+
2192+
2193+
21762194
### Types
21772195

21782196
In this section you will find types that the CRDs rely on.
@@ -2537,6 +2555,38 @@ ServiceSelectorEntry holds the name of a service to match.
25372555
_Appears in:_
25382556
- [ServiceSelector](#serviceselector)
25392557

2558+
#### WatchNamespaceGrantFrom
2559+
2560+
2561+
WatchNamespaceGrantFrom describes trusted namespaces.
2562+
2563+
2564+
2565+
| Field | Description |
2566+
| --- | --- |
2567+
| `group` _string_ | Group is the group of the referent. |
2568+
| `kind` _string_ | Kind is the kind of the referent. |
2569+
| `namespace` _string_ | Namespace is the namespace of the referent. |
2570+
2571+
2572+
_Appears in:_
2573+
- [WatchNamespaceGrantSpec](#watchnamespacegrantspec)
2574+
2575+
#### WatchNamespaceGrantSpec
2576+
2577+
2578+
WatchNamespaceGrantSpec defines the desired state of an WatchNamespaceGrant.
2579+
2580+
2581+
2582+
| Field | Description |
2583+
| --- | --- |
2584+
| `from` _[WatchNamespaceGrantFrom](#watchnamespacegrantfrom) array_ | From describes the trusted namespaces and kinds that can reference the namespace this grant exists in.<br /><br /> Support: Core |
2585+
2586+
2587+
_Appears in:_
2588+
- [WatchNamespaceGrant](#watchnamespacegrant)
2589+
25402590

25412591
## gateway-operator.konghq.com/v1beta1
25422592

0 commit comments

Comments
 (0)