[v2] Add backend, cli and ui - #604
Open
mjudeikis wants to merge 15 commits into
Open
Conversation
mjudeikis
force-pushed
the
add.backend
branch
2 times, most recently
from
July 30, 2026 07:53
27b1922 to
23e792a
Compare
Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt>
kbind naming and root layout, stateless cookie sessions, one-time pickup via Grant annotations, per-grant Lease link, TokenReview authenticator, krew plugin name kept as 'bind'. Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt>
The catalog is presentation + defaults on top of the core's discovery; the Grant is the issuance record (identity x export, APIs resolved at bind time) and the anchor for revocation, audit and the reaper. Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt>
The Lease lands in the kubeconfig context's namespace when set (the issuer pins it to the per-consumer boundary), named per (connection, consumer cluster) and annotated with the Connection name — so a service-layer reaper gets per-grant staleness, and tenant RBAC for Leases stays namespace-scoped. Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt>
kubeapply applies YAML multi-docs with CRD-establishment retries; konnectorinstall embeds the konnector install (CRDs, RBAC, Deployment); servicecrds embeds the catalog/iam CRDs for the backend's self-install. Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt>
OIDC (code + PKCE) configured kube-apiserver-style, stateless encrypted cookie/bearer sessions (no session store; HA needs only shared keys), a TokenReview authenticator for in-platform callers, and an embedded mock issuer behind a dev flag. Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt>
Per-identity boundary namespace, ServiceAccount with RBAC enumerating exactly the granted APIs (Cluster or Namespace scope), long-lived SA token; Export validation against the exported-CRD labels; the bundle builder emits the core's one-apply file with the context namespace pinned to the boundary. Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt>
Catalog browsing, bind with a single-use short-TTL pickup URL (enforced via Grant annotations with optimistic concurrency — no gateway state), consumer-cluster inventory from heartbeat Leases, per-export synced instances, konnector install manifest, and flag-gated browser-apply. Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt>
Marks grants stale per their own connection's heartbeat (conservative fallback for renamed connections); revocation and boundary deletion are explicit opt-ins. Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt>
Dependency-free SPA: standalone login page, sidebar app with catalog (related-resource chips, synced instances), clusters view, one-time bundle ticket, connect-a-cluster flow. Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt>
--enable-gateway/issuer/reaper/apply, kube-style OIDC flags, cookie keys, CRD self-install, leader-elected controllers. Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt>
login (browser dance), connect (konnector install), catalog, clusters, instances, and binding an export via 'kubectl bind export <name>'. Shipped to krew as the 'bind' plugin (binary kubectl-bind). Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt>
Chart with module values and secret-backed OIDC/cookie config; a two-kind-cluster Tilt setup (provider backend, consumer konnector, seeded catalog with related resources); samples aligned with the seed. Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt>
The Dockerfile gains a backend target (konnector stays the default); image.yaml pushes both images on tags; the CLI releases via goreleaser on final tags only (RCs skip) and krew-release-bot updates the 'bind' plugin; make targets for backend, bind, tilt and cli-snapshot. Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt>
The full-loop test drives catalog -> bind -> pickup -> one apply -> sync through the issued RBAC-fenced credentials -> clusters/instances views -> reaper -> revocation. The Dex test boots the real backend binary against Dex in docker and logs in through its password form. Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add v2 extended implementation:
What Type of PR Is This?
/kind feature
Related Issue(s)
Fixes #
Release Notes