Merge pull request #426 from fluxcd/acl-api

Add ACL optional field to Source API

api/go.mod

@@ -3,11 +3,12 @@ module github.com/fluxcd/source-controller/api
 go 1.16
 
 require (
+	github.com/fluxcd/pkg/apis/acl v0.0.1
 	github.com/fluxcd/pkg/apis/meta v0.11.0-rc.1
 	// TODO(hidde): introduction of the runtime package is temporary, and the dependency should be removed as soon as
 	//  all APIs have been updated to the runtime standards (more specifically; have dropped their condition modifying
 	//  functions).
-	github.com/fluxcd/pkg/runtime v0.13.0-rc.2
+	github.com/fluxcd/pkg/runtime v0.13.0-rc.3
 	k8s.io/apimachinery v0.21.3
 	sigs.k8s.io/controller-runtime v0.9.3
 )

api/go.sum

@@ -91,10 +91,12 @@ github.com/evanphx/json-patch v4.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLi
 github.com/evanphx/json-patch v4.11.0+incompatible h1:glyUF9yIYtMHzn8xaKw5rMhdWcwsYV8dZHIq5567/xs=
 github.com/evanphx/json-patch v4.11.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/fluxcd/pkg/apis/acl v0.0.1 h1:biCgZMjpDSv3Q4mZPikUJILx3t2MuNXR4Oa5jRQxaNQ=
+github.com/fluxcd/pkg/apis/acl v0.0.1/go.mod h1:y3qOXUFObVWk7jzOjubMnr/u18j1kCeSi6olycnxr/E=
 github.com/fluxcd/pkg/apis/meta v0.11.0-rc.1 h1:RHHrztAFv9wmjM+Pk7Svt1UdD+1SdnQSp76MWFiM7Hg=
 github.com/fluxcd/pkg/apis/meta v0.11.0-rc.1/go.mod h1:yUblM2vg+X8TE3A2VvJfdhkGmg+uqBlSPkLk7dxi0UM=
-github.com/fluxcd/pkg/runtime v0.13.0-rc.2 h1:+4uTEg+CU++hlr7NpOP4KYp60MtHDOgYvpz/74tbATg=
-github.com/fluxcd/pkg/runtime v0.13.0-rc.2/go.mod h1:TmvE2cJl1QkgZNmmlr7XUKoWDQwUiM5/wTUxXsQVoc8=
+github.com/fluxcd/pkg/runtime v0.13.0-rc.3 h1:VxtmEL/m3/9wJBhhhWQ48fz8m93B7UiyVi5cXYbiy3E=
+github.com/fluxcd/pkg/runtime v0.13.0-rc.3/go.mod h1:5ioX9wb63+RUvHBdjRsFG4uYn6Ll/Yoa7Ema6XKIIuQ=
 github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=

api/v1beta1/bucket_types.go

@@ -19,6 +19,7 @@ package v1beta1
 import (
 	"time"
 
+	"github.com/fluxcd/pkg/apis/acl"
 	"github.com/fluxcd/pkg/apis/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
@@ -80,6 +81,10 @@ type BucketSpec struct {
 	// This flag tells the controller to suspend the reconciliation of this source.
 	// +optional
 	Suspend bool `json:"suspend,omitempty"`
+
+	// AccessFrom defines an Access Control List for allowing cross-namespace references to this object.
+	// +optional
+	AccessFrom *acl.AccessFrom `json:"accessFrom,omitempty"`
 }
 
 // BucketStatus defines the observed state of a bucket

api/v1beta1/gitrepository_types.go

@@ -19,6 +19,7 @@ package v1beta1
 import (
 	"time"
 
+	"github.com/fluxcd/pkg/apis/acl"
 	"github.com/fluxcd/pkg/apis/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
@@ -100,6 +101,10 @@ type GitRepositorySpec struct {
 	// Include defines a list of GitRepository resources which artifacts should be included in the artifact produced for
 	// this resource.
 	Include []GitRepositoryInclude `json:"include,omitempty"`
+
+	// AccessFrom defines an Access Control List for allowing cross-namespace references to this object.
+	// +optional
+	AccessFrom *acl.AccessFrom `json:"accessFrom,omitempty"`
 }
 
 func (in *GitRepositoryInclude) GetFromPath() string {

api/v1beta1/helmchart_types.go

@@ -19,6 +19,7 @@ package v1beta1
 import (
 	"time"
 
+	"github.com/fluxcd/pkg/apis/acl"
 	"github.com/fluxcd/pkg/apis/meta"
 	"github.com/fluxcd/pkg/runtime/conditions"
 	apimeta "k8s.io/apimachinery/pkg/api/meta"
@@ -66,6 +67,10 @@ type HelmChartSpec struct {
 	// This flag tells the controller to suspend the reconciliation of this source.
 	// +optional
 	Suspend bool `json:"suspend,omitempty"`
+
+	// AccessFrom defines an Access Control List for allowing cross-namespace references to this object.
+	// +optional
+	AccessFrom *acl.AccessFrom `json:"accessFrom,omitempty"`
 }
 
 // LocalHelmChartSourceReference contains enough information to let you locate

api/v1beta1/helmrepository_types.go

@@ -19,6 +19,7 @@ package v1beta1
 import (
 	"time"
 
+	"github.com/fluxcd/pkg/apis/acl"
 	"github.com/fluxcd/pkg/apis/meta"
 	"github.com/fluxcd/pkg/runtime/conditions"
 	apimeta "k8s.io/apimachinery/pkg/api/meta"
@@ -69,6 +70,10 @@ type HelmRepositorySpec struct {
 	// This flag tells the controller to suspend the reconciliation of this source.
 	// +optional
 	Suspend bool `json:"suspend,omitempty"`
+
+	// AccessFrom defines an Access Control List for allowing cross-namespace references to this object.
+	// +optional
+	AccessFrom *acl.AccessFrom `json:"accessFrom,omitempty"`
 }
 
 // HelmRepositoryStatus defines the observed state of the HelmRepository.

api/v1beta1/zz_generated.deepcopy.go

@@ -21,6 +21,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"github.com/fluxcd/pkg/apis/acl"
 	"github.com/fluxcd/pkg/apis/meta"
 	"k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
@@ -120,6 +121,11 @@ func (in *BucketSpec) DeepCopyInto(out *BucketSpec) {
 		*out = new(string)
 		**out = **in
 	}
+	if in.AccessFrom != nil {
+		in, out := &in.AccessFrom, &out.AccessFrom
+		*out = new(acl.AccessFrom)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BucketSpec.
@@ -284,6 +290,11 @@ func (in *GitRepositorySpec) DeepCopyInto(out *GitRepositorySpec) {
 		*out = make([]GitRepositoryInclude, len(*in))
 		copy(*out, *in)
 	}
+	if in.AccessFrom != nil {
+		in, out := &in.AccessFrom, &out.AccessFrom
+		*out = new(acl.AccessFrom)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GitRepositorySpec.
@@ -420,6 +431,11 @@ func (in *HelmChartSpec) DeepCopyInto(out *HelmChartSpec) {
 		*out = make([]string, len(*in))
 		copy(*out, *in)
 	}
+	if in.AccessFrom != nil {
+		in, out := &in.AccessFrom, &out.AccessFrom
+		*out = new(acl.AccessFrom)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HelmChartSpec.
@@ -533,6 +549,11 @@ func (in *HelmRepositorySpec) DeepCopyInto(out *HelmRepositorySpec) {
 		*out = new(v1.Duration)
 		**out = **in
 	}
+	if in.AccessFrom != nil {
+		in, out := &in.AccessFrom, &out.AccessFrom
+		*out = new(acl.AccessFrom)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HelmRepositorySpec.

config/crd/bases/source.toolkit.fluxcd.io_buckets.yaml

@@ -45,6 +45,24 @@ spec:
           spec:
             description: BucketSpec defines the desired state of an S3 compatible bucket
             properties:
+              accessFrom:
+                description: AccessFrom defines an Access Control List for allowing cross-namespace references to this object.
+                properties:
+                  namespaceSelectors:
+                    description: NamespaceSelectors is the list of namespace selectors to which this ACL applies. Items in this list are evaluated using a logical OR operation.
+                    items:
+                      description: NamespaceSelector selects the namespaces to which this ACL applies. An empty map of MatchLabels matches all namespaces in a cluster.
+                      properties:
+                        matchLabels:
+                          additionalProperties:
+                            type: string
+                          description: MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+                          type: object
+                      type: object
+                    type: array
+                required:
+                - namespaceSelectors
+                type: object
               bucketName:
                 description: The bucket name.
                 type: string

config/crd/bases/source.toolkit.fluxcd.io_gitrepositories.yaml

@@ -47,6 +47,24 @@ spec:
           spec:
             description: GitRepositorySpec defines the desired state of a Git repository.
             properties:
+              accessFrom:
+                description: AccessFrom defines an Access Control List for allowing cross-namespace references to this object.
+                properties:
+                  namespaceSelectors:
+                    description: NamespaceSelectors is the list of namespace selectors to which this ACL applies. Items in this list are evaluated using a logical OR operation.
+                    items:
+                      description: NamespaceSelector selects the namespaces to which this ACL applies. An empty map of MatchLabels matches all namespaces in a cluster.
+                      properties:
+                        matchLabels:
+                          additionalProperties:
+                            type: string
+                          description: MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+                          type: object
+                      type: object
+                    type: array
+                required:
+                - namespaceSelectors
+                type: object
               gitImplementation:
                 default: go-git
                 description: Determines which git client library to use. Defaults to go-git, valid values are ('go-git', 'libgit2').

config/crd/bases/source.toolkit.fluxcd.io_helmcharts.yaml

@@ -56,6 +56,24 @@ spec:
           spec:
             description: HelmChartSpec defines the desired state of a Helm chart.
             properties:
+              accessFrom:
+                description: AccessFrom defines an Access Control List for allowing cross-namespace references to this object.
+                properties:
+                  namespaceSelectors:
+                    description: NamespaceSelectors is the list of namespace selectors to which this ACL applies. Items in this list are evaluated using a logical OR operation.
+                    items:
+                      description: NamespaceSelector selects the namespaces to which this ACL applies. An empty map of MatchLabels matches all namespaces in a cluster.
+                      properties:
+                        matchLabels:
+                          additionalProperties:
+                            type: string
+                          description: MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+                          type: object
+                      type: object
+                    type: array
+                required:
+                - namespaceSelectors
+                type: object
               chart:
                 description: The name or path the Helm chart is available at in the SourceRef.
                 type: string

config/crd/bases/source.toolkit.fluxcd.io_helmrepositories.yaml

@@ -47,6 +47,24 @@ spec:
           spec:
             description: HelmRepositorySpec defines the reference to a Helm repository.
             properties:
+              accessFrom:
+                description: AccessFrom defines an Access Control List for allowing cross-namespace references to this object.
+                properties:
+                  namespaceSelectors:
+                    description: NamespaceSelectors is the list of namespace selectors to which this ACL applies. Items in this list are evaluated using a logical OR operation.
+                    items:
+                      description: NamespaceSelector selects the namespaces to which this ACL applies. An empty map of MatchLabels matches all namespaces in a cluster.
+                      properties:
+                        matchLabels:
+                          additionalProperties:
+                            type: string
+                          description: MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+                          type: object
+                      type: object
+                    type: array
+                required:
+                - namespaceSelectors
+                type: object
               interval:
                 description: The interval at which to check the upstream for updates.
                 type: string

docs/api/source.md

@@ -200,6 +200,20 @@ bool
 <p>This flag tells the controller to suspend the reconciliation of this source.</p>
 </td>
 </tr>
+<tr>
+<td>
+<code>accessFrom</code><br>
+<em>
+<a href="https://godoc.org/github.com/fluxcd/pkg/apis/acl#AccessFrom">
+github.com/fluxcd/pkg/apis/acl.AccessFrom
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>AccessFrom defines an Access Control List for allowing cross-namespace references to this object.</p>
+</td>
+</tr>
 </table>
 </td>
 </tr>
@@ -425,6 +439,20 @@ This option is available only when using the &lsquo;go-git&rsquo; GitImplementat
 this resource.</p>
 </td>
 </tr>
+<tr>
+<td>
+<code>accessFrom</code><br>
+<em>
+<a href="https://godoc.org/github.com/fluxcd/pkg/apis/acl#AccessFrom">
+github.com/fluxcd/pkg/apis/acl.AccessFrom
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>AccessFrom defines an Access Control List for allowing cross-namespace references to this object.</p>
+</td>
+</tr>
 </table>
 </td>
 </tr>
@@ -593,6 +621,20 @@ bool
 <p>This flag tells the controller to suspend the reconciliation of this source.</p>
 </td>
 </tr>
+<tr>
+<td>
+<code>accessFrom</code><br>
+<em>
+<a href="https://godoc.org/github.com/fluxcd/pkg/apis/acl#AccessFrom">
+github.com/fluxcd/pkg/apis/acl.AccessFrom
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>AccessFrom defines an Access Control List for allowing cross-namespace references to this object.</p>
+</td>
+</tr>
 </table>
 </td>
 </tr>
@@ -755,6 +797,20 @@ bool
 <p>This flag tells the controller to suspend the reconciliation of this source.</p>
 </td>
 </tr>
+<tr>
+<td>
+<code>accessFrom</code><br>
+<em>
+<a href="https://godoc.org/github.com/fluxcd/pkg/apis/acl#AccessFrom">
+github.com/fluxcd/pkg/apis/acl.AccessFrom
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>AccessFrom defines an Access Control List for allowing cross-namespace references to this object.</p>
+</td>
+</tr>
 </table>
 </td>
 </tr>
@@ -1003,6 +1059,20 @@ bool
 <p>This flag tells the controller to suspend the reconciliation of this source.</p>
 </td>
 </tr>
+<tr>
+<td>
+<code>accessFrom</code><br>
+<em>
+<a href="https://godoc.org/github.com/fluxcd/pkg/apis/acl#AccessFrom">
+github.com/fluxcd/pkg/apis/acl.AccessFrom
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>AccessFrom defines an Access Control List for allowing cross-namespace references to this object.</p>
+</td>
+</tr>
 </tbody>
 </table>
 </div>
@@ -1388,6 +1458,20 @@ This option is available only when using the &lsquo;go-git&rsquo; GitImplementat
 this resource.</p>
 </td>
 </tr>
+<tr>
+<td>
+<code>accessFrom</code><br>
+<em>
+<a href="https://godoc.org/github.com/fluxcd/pkg/apis/acl#AccessFrom">
+github.com/fluxcd/pkg/apis/acl.AccessFrom
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>AccessFrom defines an Access Control List for allowing cross-namespace references to this object.</p>
+</td>
+</tr>
 </tbody>
 </table>
 </div>
@@ -1648,6 +1732,20 @@ bool
 <p>This flag tells the controller to suspend the reconciliation of this source.</p>
 </td>
 </tr>
+<tr>
+<td>
+<code>accessFrom</code><br>
+<em>
+<a href="https://godoc.org/github.com/fluxcd/pkg/apis/acl#AccessFrom">
+github.com/fluxcd/pkg/apis/acl.AccessFrom
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>AccessFrom defines an Access Control List for allowing cross-namespace references to this object.</p>
+</td>
+</tr>
 </tbody>
 </table>
 </div>
@@ -1843,6 +1941,20 @@ bool
 <p>This flag tells the controller to suspend the reconciliation of this source.</p>
 </td>
 </tr>
+<tr>
+<td>
+<code>accessFrom</code><br>
+<em>
+<a href="https://godoc.org/github.com/fluxcd/pkg/apis/acl#AccessFrom">
+github.com/fluxcd/pkg/apis/acl.AccessFrom
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>AccessFrom defines an Access Control List for allowing cross-namespace references to this object.</p>
+</td>
+</tr>
 </tbody>
 </table>
 </div>

go.mod

@@ -12,7 +12,7 @@ require (
 	github.com/fluxcd/pkg/gitutil v0.1.0
 	github.com/fluxcd/pkg/helmtestserver v0.2.0
 	github.com/fluxcd/pkg/lockedfile v0.1.0
-	github.com/fluxcd/pkg/runtime v0.13.0-rc.2
+	github.com/fluxcd/pkg/runtime v0.13.0-rc.3
 	github.com/fluxcd/pkg/ssh v0.1.0
 	github.com/fluxcd/pkg/testserver v0.1.0
 	github.com/fluxcd/pkg/untar v0.1.0

go.sum

@@ -226,6 +226,8 @@ github.com/exponent-io/jsonpath v0.0.0-20151013193312-d6023ce2651d/go.mod h1:ZZM
 github.com/fatih/camelcase v1.0.0/go.mod h1:yN2Sb0lFhZJUdVvtELVWefmrXpuZESvPmqwoZc+/fpc=
 github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/fluxcd/pkg/apis/acl v0.0.1 h1:biCgZMjpDSv3Q4mZPikUJILx3t2MuNXR4Oa5jRQxaNQ=
+github.com/fluxcd/pkg/apis/acl v0.0.1/go.mod h1:y3qOXUFObVWk7jzOjubMnr/u18j1kCeSi6olycnxr/E=
 github.com/fluxcd/pkg/apis/meta v0.11.0-rc.1 h1:RHHrztAFv9wmjM+Pk7Svt1UdD+1SdnQSp76MWFiM7Hg=
 github.com/fluxcd/pkg/apis/meta v0.11.0-rc.1/go.mod h1:yUblM2vg+X8TE3A2VvJfdhkGmg+uqBlSPkLk7dxi0UM=
 github.com/fluxcd/pkg/gittestserver v0.3.2 h1:oc1OoZ4b+kAu0vu/RT9wUwuQZxSqEjBOlQWYYA+YeLM=
@@ -236,8 +238,8 @@ github.com/fluxcd/pkg/helmtestserver v0.2.0 h1:cE7YHDmrWI0hr9QpaaeQ0vQ16Z0IiqZKi
 github.com/fluxcd/pkg/helmtestserver v0.2.0/go.mod h1:Yie8n7xuu5Nvf1Q7302LKsubJhWpwzCaK0rLJvmF7aI=
 github.com/fluxcd/pkg/lockedfile v0.1.0 h1:YsYFAkd6wawMCcD74ikadAKXA4s2sukdxrn7w8RB5eo=
 github.com/fluxcd/pkg/lockedfile v0.1.0/go.mod h1:EJLan8t9MiOcgTs8+puDjbE6I/KAfHbdvIy9VUgIjm8=
-github.com/fluxcd/pkg/runtime v0.13.0-rc.2 h1:+4uTEg+CU++hlr7NpOP4KYp60MtHDOgYvpz/74tbATg=
-github.com/fluxcd/pkg/runtime v0.13.0-rc.2/go.mod h1:TmvE2cJl1QkgZNmmlr7XUKoWDQwUiM5/wTUxXsQVoc8=
+github.com/fluxcd/pkg/runtime v0.13.0-rc.3 h1:VxtmEL/m3/9wJBhhhWQ48fz8m93B7UiyVi5cXYbiy3E=
+github.com/fluxcd/pkg/runtime v0.13.0-rc.3/go.mod h1:5ioX9wb63+RUvHBdjRsFG4uYn6Ll/Yoa7Ema6XKIIuQ=
 github.com/fluxcd/pkg/ssh v0.1.0 h1:cym2bqiT4IINOdLV0J6GYxer16Ii/7b2+RlK3CG+CnA=
 github.com/fluxcd/pkg/ssh v0.1.0/go.mod h1:KUuVhaB6AX3IHTGCd3Ti/nesn5t1Nz4zCThFkkjHctM=
 github.com/fluxcd/pkg/testserver v0.1.0 h1:nOYgM1HYFZNNSUFykuWDmrsxj4jQxUCvmLHWOQeqmyA=

hack/api-docs/config.json

@@ -22,6 +22,10 @@
     {
       "typeMatchPrefix": "^github.com/fluxcd/pkg/apis/meta",
       "docsURLTemplate": "https://godoc.org/github.com/fluxcd/pkg/apis/meta#{{ .TypeIdentifier }}"
+    },
+    {
+      "typeMatchPrefix": "^github.com/fluxcd/pkg/apis/acl",
+      "docsURLTemplate": "https://godoc.org/github.com/fluxcd/pkg/apis/acl#{{ .TypeIdentifier }}"
     }
   ],
   "typeDisplayNamePrefixOverrides": {