opendefensecloud / solution-arsenal / 38372390612

80%

Build Type

push

github

Committed by web-flow

Commit Message

feat(controller): collect cross-namespace RegistryBindings (#854)

## What
Target controller collects RegistryBindings from other namespaces when a
ReferenceGrant in the Target's ns allows it (ADR-012 Pattern 4).

- `collectRegistryBindings`: own ns + granted ns, only bindings whose
effective `targetRef` is this Target
- grants with `from: RegistryBinding` requeue the Targets in their ns
- grant helpers shared with ReleaseBindings (separate refactor commit)
- ReferenceGrant subjects with empty `namespace` are ignored
- missing Registry behind a binding -> `RegistryNotFound` (was
`RegistryBindingConflict`)

Part of #565.

## Why
Docs already promised Pattern 4, the controller ignored those bindings
-> provider pull secrets never reached the user's Target.

Semantics as settled in #845: identical pull secrets per host merged,
differing ones -> `RegistryBindingConflict` (errors name `ns/name`).
Registry always resolved in the binding's own ns. A `ReleaseBinding`
grant never authorizes `RegistryBinding`s.

Side fix: `from.namespace: ""` was taken as is ->
`List(InNamespace(""))` spans all namespaces. The apiserver doesn't
enforce `Required` there. Now skipped for both binding kinds,
fail-closed, only affects malformed grants. Worth a line in the release
notes.

## Testing
envtest suite for cross-ns RegistryBindings (granted, no grant,
ReleaseBinding-only grant, conflict, merge, self-grant, grant
add/remove, empty-ns grant) + direct `mapReferenceGrantToTargets` spec,
verified to fail without the mapping change. Full `make test` green
(controller 156/156), `make lint` clean. Smoke-tested on `make
dev-cluster` with #852, all green.

## Notes for reviewers
- Follow-up: `Granted` condition on RegistryBinding status (separate
PR), ReleaseBindings in #855
- #852 touches the same files, trial merge is clean

## Checklist
- [x] Tests added/updated
- [x] No breaking changes (or upgrade path documented above)
- [x] Readable commit history (squashed and cleaned up as... (continued)

Coverage Stats

71 of 79 new or added lines in 1 file covered. (89.87%)

5 existing lines in 1 file now uncovered.

5107 of 6490 relevant lines covered (78.69%)

43.09 hits per line