✨ Add classNamespace to topology

[Danil-Grigorev]

What this PR does / why we need it:

Adding classNamespace variable to the cluster topology, which allows to point to a ClusterClass in a different namespace. This field is dormant, and is used for differentiation only.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Related to #5673

/area clusterclass

[salasberryfin]

Thanks @Danil-Grigorev! I added a small suggestion but I think this looks good.

[salasberryfin]

Thanks @Danil-Grigorev

/lgtm

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: c4b418743a4683ae623b3264aae7636c41ad5675

[salasberryfin]

/assign @chrischdi

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from chrischdi. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[enxebre]

besides the on admission check which is nice, do we have any rbac recommendation for this?

[Danil-Grigorev]

VAP supports secondary authz for added RBAC control, and VAP binding can be used with label selectors, which addresses #5673 (comment). From the proposal itself, it seems using the policy for added restriction on top of RBAC is within the scope.

Webhook allows to use paramRef of any kind, which can be potentially explored with specific CRD to further restrict access beyond admission, with a controller acting on that resource.

Currently, this is just an example of how an on top policy can be defined (if needed) in k8s 1.30+, where a user may decide to use different policy mechanisms to further restrict access, including a more granular RBAC. I’m thinking to showcase it as an option, but to not enforce any specific solution within this PR.

[Danil-Grigorev]

There is also an RBAC recommendation in https://kccncna2024.sched.com/event/1hoyX, if a talk considered to be one.

[neolit123]

@Danil-Grigorev did you attempt rebasing a non-namespaced CC to a namespaced CC?
does that work fine?

[Danil-Grigorev]

@neolit123 I tried rebase on the clusterClass in the same namespace, and it works fine. Cross-namespace rebases are not possible, as there is validation to prevent namespace change for templates. This seems like a larger change.

[neolit123]

@neolit123 I tried rebase on the clusterClass in the same namespace, and it works fine. Cross-namespace rebases are not possible, as there is validation to prevent namespace change for templates. This seems like a larger change.

if this larger change is not added then it's worth mentioning the limitation in the docs.

[Danil-Grigorev]

Maybe to address some comments from the last meeting - extension configs on the initial check seem to work as well, as long as the namespace selector matches.

[furkatgofurov7]

/lgtm

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: f7b15d982fdfb8730cff97c2900ccbd9c661e3d9