Dakydd/eno overlay configmap watch

api/v1/config/crd/eno.azure.io_compositions.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: compositions.eno.azure.io
 spec:
   group: eno.azure.io

api/v1/config/crd/eno.azure.io_inputmirrors.yaml

@@ -0,0 +1,183 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.0
+  name: inputmirrors.eno.azure.io
+spec:
+  group: eno.azure.io
+  names:
+    kind: InputMirror
+    listKind: InputMirrorList
+    plural: inputmirrors
+    singular: inputmirror
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .spec.sourceResource.name
+      name: Source
+      type: string
+    - jsonPath: .status.conditions[?(@.type=="Synced")].status
+      name: Synced
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1
+    schema:
+      openAPIV3Schema:
+        description: |-
+          InputMirror stores a copy of a resource from a remote cluster.
+          It is created and managed by the RemoteSyncController based on Symphony.spec.remoteResourceRefs.
+          Compositions can bind to InputMirrors just like any other resource.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              key:
+                description: Key matches the Symphony's overlayResourceRef key
+                type: string
+              sourceResource:
+                description: SourceResource describes what resource to sync from the
+                  remote cluster
+                properties:
+                  group:
+                    description: API Group of the resource (empty string for core
+                      API group)
+                    type: string
+                  kind:
+                    description: Kind of the resource (e.g., ConfigMap, Secret)
+                    type: string
+                  name:
+                    description: Name of the resource
+                    type: string
+                  namespace:
+                    description: Namespace of the resource (empty for cluster-scoped
+                      resources)
+                    type: string
+                  version:
+                    description: API Version of the resource
+                    type: string
+                required:
+                - kind
+                - name
+                - version
+                type: object
+              symphonyRef:
+                description: SymphonyRef points to the owning Symphony
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
+            required:
+            - key
+            - sourceResource
+            - symphonyRef
+            type: object
+          status:
+            properties:
+              conditions:
+                description: Conditions describe the sync state
+                items:
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              data:
+                description: |-
+                  Data contains the actual resource data from the overlay cluster.
+                  This is the full resource serialized as JSON.
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              lastSyncTime:
+                description: LastSyncTime records when the resource was last successfully
+                  synced
+                format: date-time
+                type: string
+              syncGeneration:
+                description: SyncGeneration tracks the source resource's resourceVersion
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

api/v1/config/crd/eno.azure.io_resourceslices.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: resourceslices.eno.azure.io
 spec:
   group: eno.azure.io

api/v1/config/crd/eno.azure.io_symphonies.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: symphonies.eno.azure.io
 spec:
   group: eno.azure.io
@@ -72,6 +72,62 @@ spec:
                   - resource
                   type: object
                 type: array
+              remoteResourceRefs:
+                description: |-
+                  RemoteResourceRefs specifies resources to sync from the remote cluster.
+                  Each ref results in an InputMirror being created that can be bound as an input.
+                  The remote cluster is accessed via the eno-reconciler's --remote-kubeconfig.
+                items:
+                  description: RemoteResourceRef defines a resource to sync from a
+                    remote cluster
+                  properties:
+                    key:
+                      description: |-
+                        Key that will be used to reference this input in Composition bindings.
+                        This key maps to an auto-created InputMirror resource.
+                      type: string
+                    optional:
+                      default: false
+                      description: Optional indicates that synthesis can proceed if
+                        this resource doesn't exist in the remote cluster.
+                      type: boolean
+                    resource:
+                      description: Resource specifies what to fetch from the remote
+                        cluster
+                      properties:
+                        group:
+                          description: API Group of the resource (empty string for
+                            core API group)
+                          type: string
+                        kind:
+                          description: Kind of the resource (e.g., ConfigMap, Secret)
+                          type: string
+                        name:
+                          description: Name of the resource
+                          type: string
+                        namespace:
+                          description: Namespace of the resource (empty for cluster-scoped
+                            resources)
+                          type: string
+                        version:
+                          description: API Version of the resource
+                          type: string
+                      required:
+                      - kind
+                      - name
+                      - version
+                      type: object
+                    syncInterval:
+                      default: 5m
+                      description: SyncInterval determines how often to re-sync the
+                        resource.
+                      type: string
+                  required:
+                  - key
+                  - resource
+                  type: object
+                maxItems: 20
+                type: array
               synthesisEnv:
                 description: |-
                   SynthesisEnv

api/v1/config/crd/eno.azure.io_synthesizers.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: synthesizers.eno.azure.io
 spec:
   group: eno.azure.io

api/v1/inputmirror.go

@@ -0,0 +1,100 @@
+package v1
+
+import (
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// +kubebuilder:object:root=true
+type InputMirrorList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []InputMirror `json:"items"`
+}
+
+// InputMirror stores a copy of a resource from a remote cluster.
+// It is created and managed by the RemoteSyncController based on Symphony.spec.remoteResourceRefs.
+// Compositions can bind to InputMirrors just like any other resource.
+//
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+// +kubebuilder:printcolumn:name="Source",type=string,JSONPath=`.spec.sourceResource.name`
+// +kubebuilder:printcolumn:name="Synced",type=string,JSONPath=`.status.conditions[?(@.type=="Synced")].status`
+// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
+type InputMirror struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   InputMirrorSpec   `json:"spec,omitempty"`
+	Status InputMirrorStatus `json:"status,omitempty"`
+}
+
+type InputMirrorSpec struct {
+	// Key matches the Symphony's overlayResourceRef key
+	Key string `json:"key"`
+
+	// SymphonyRef points to the owning Symphony
+	SymphonyRef corev1.LocalObjectReference `json:"symphonyRef"`
+
+	// SourceResource describes what resource to sync from the remote cluster
+	SourceResource RemoteResourceSelector `json:"sourceResource"`
+}
+
+type InputMirrorStatus struct {
+	// Data contains the actual resource data from the overlay cluster.
+	// This is the full resource serialized as JSON.
+	// +kubebuilder:pruning:PreserveUnknownFields
+	Data *runtime.RawExtension `json:"data,omitempty"`
+
+	// LastSyncTime records when the resource was last successfully synced
+	LastSyncTime *metav1.Time `json:"lastSyncTime,omitempty"`
+
+	// SyncGeneration tracks the source resource's resourceVersion
+	SyncGeneration string `json:"syncGeneration,omitempty"`
+
+	// Conditions describe the sync state
+	// +listType=map
+	// +listMapKey=type
+	Conditions []metav1.Condition `json:"conditions,omitempty"`
+}
+
+// RemoteResourceSelector describes a resource to sync from a remote cluster
+type RemoteResourceSelector struct {
+	// API Group of the resource (empty string for core API group)
+	// +optional
+	Group string `json:"group,omitempty"`
+
+	// API Version of the resource
+	Version string `json:"version"`
+
+	// Kind of the resource (e.g., ConfigMap, Secret)
+	Kind string `json:"kind"`
+
+	// Name of the resource
+	Name string `json:"name"`
+
+	// Namespace of the resource (empty for cluster-scoped resources)
+	// +optional
+	Namespace string `json:"namespace,omitempty"`
+}
+
+// RemoteResourceRef defines a resource to sync from a remote cluster
+type RemoteResourceRef struct {
+	// Key that will be used to reference this input in Composition bindings.
+	// This key maps to an auto-created InputMirror resource.
+	Key string `json:"key"`
+
+	// Resource specifies what to fetch from the remote cluster
+	Resource RemoteResourceSelector `json:"resource"`
+
+	// SyncInterval determines how often to re-sync the resource.
+	// +kubebuilder:default="5m"
+	// +optional
+	SyncInterval *metav1.Duration `json:"syncInterval,omitempty"`
+
+	// Optional indicates that synthesis can proceed if this resource doesn't exist in the remote cluster.
+	// +kubebuilder:default=false
+	// +optional
+	Optional bool `json:"optional,omitempty"`
+}

api/v1/symphony.go

@@ -39,6 +39,13 @@ type SymphonySpec struct {
 	// Copied opaquely into the compositions managed by this symphony.
 	// +kubebuilder:validation:MaxItems:=50
 	SynthesisEnv []EnvVar `json:"synthesisEnv,omitempty"` // deprecated synthesis env should always be variation scoped.
+
+	// RemoteResourceRefs specifies resources to sync from the remote cluster.
+	// Each ref results in an InputMirror being created that can be bound as an input.
+	// The remote cluster is accessed via the eno-reconciler's --remote-kubeconfig.
+	// +optional
+	// +kubebuilder:validation:MaxItems:=20
+	RemoteResourceRefs []RemoteResourceRef `json:"remoteResourceRefs,omitempty"`
 }
 
 type SymphonyStatus struct {