fix inherited APIBinding not inheriting default permission claim selector by olamilekan000 · Pull Request #3786 · kcp-dev/kcp

olamilekan000 · 2026-01-14T21:35:33Z

Summary

change fixes how permission claim selectors are inherited from parent 
APIBindings instead of always defaulting to matchAll: true when creating inherited APIBindings
in child workspaces.

What Type of PR Is This?

/kind bug

Related Issue(s)

Fixes 3779

Release Notes

Fixed Inherited APIBindings now inherit permission claim selectors from parent workspaces instead of defaulting to matchAll: true.

olamilekan000 · 2026-01-15T00:38:03Z

/retest

olamilekan000 · 2026-01-15T01:32:28Z

/retest

olamilekan000 · 2026-01-15T08:34:53Z

/retest

olamilekan000 · 2026-01-15T09:27:07Z

/retest

olamilekan000 · 2026-01-15T14:18:55Z

/retest

olamilekan000 · 2026-01-15T19:21:11Z

/retest

olamilekan000 · 2026-01-15T20:18:08Z

/test

kcp-ci-bot · 2026-01-15T20:18:13Z

@olamilekan000: The /test command needs one or more targets.
The following commands are available to trigger required jobs:

/build-image

/test pull-kcp-build-image

/test pull-kcp-lint

/test pull-kcp-test-e2e

/test pull-kcp-test-e2e-multiple-runs

/test pull-kcp-test-e2e-sharded

/test pull-kcp-test-e2e-shared

/test pull-kcp-test-integration

/test pull-kcp-test-unit

/test pull-kcp-validate-prow-yaml

/test pull-kcp-verify

/test pull-kcp-verify-codegen

Use /test all to run the following jobs that were automatically triggered:

pull-kcp-build-image

pull-kcp-lint

pull-kcp-test-e2e

pull-kcp-test-e2e-multiple-runs

pull-kcp-test-e2e-sharded

pull-kcp-test-e2e-shared

pull-kcp-test-integration

pull-kcp-test-unit

pull-kcp-validate-prow-yaml

pull-kcp-verify

pull-kcp-verify-codegen

Details

In response to this:

/test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

olamilekan000 · 2026-01-15T20:19:56Z

/retest

olamilekan000 · 2026-01-16T15:40:47Z

/retest

olamilekan000 · 2026-01-19T02:28:13Z

/retest

mjudeikis · 2026-01-19T06:20:08Z

/retest

mjudeikis

I have feeling this might fail in sharded setup. Did you tested this with sharded api server?

pkg/reconciler/tenancy/defaultapibindinglifecycle/default_apibinding_lifecycle_controller.go

mjudeikis · 2026-01-19T06:24:29Z

pkg/reconciler/tenancy/initialization/apibinder_initializer_controller.go

 			return logicalClusterInformer.Lister().Cluster(clusterName).Get(corev1alpha1.LogicalClusterName)
 		},
+		getLogicalClusterByPath: func(path logicalcluster.Path) (*corev1alpha1.LogicalCluster, error) {
+			clusters, err := indexers.ByIndex[*corev1alpha1.LogicalCluster](logicalClustersInformer.Informer().GetIndexer(), indexers.ByLogicalClusterPath, path.String())


This will consult with local shard only. If logicalcluster lives on different shard, this should fail.

Is this not the case? We should be using fallback informers?

I didn't test this with a shard setup but my intention here was to fetch a cluster using the path . By the way, the shard tests are passing, I guess everything's good.

im not sure sharding tests are testing this. And if both workspaces land on the same shard, it would pass. So failure would be transiant

I think this needs to be WithFallback to be able to resolve clusters frm other shards. If parent is located on other shard this will fail.

What does WithFallback mean in this case?
ps: I am actually trying to carryout a manual test with a shard setup, but havn't really had time to

Fallback takes 2 informers: the local shard and the cache server.
If the object is not found in the local shard informer, it goes to the cache server.
So cross-shard operation objects need to be replicated to the cache server so other shards can "consult" them.

@olamilekan000 ping

I didn't forget, but thanks for the Ping

Can you kindly review once more @mjudeikis

kcp-ci-bot · 2026-01-19T11:48:10Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from mjudeikis. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

olamilekan000 · 2026-01-19T13:00:17Z

/retest

olamilekan000 · 2026-01-19T13:28:00Z

/retest

olamilekan000 · 2026-01-19T16:12:29Z

/retest

mjudeikis · 2026-01-21T08:58:25Z

/test all

olamilekan000 · 2026-01-21T09:36:39Z

/retest

olamilekan000 · 2026-01-21T11:19:39Z

/retest

olamilekan000 · 2026-01-21T15:59:22Z

/retest

olamilekan000 · 2026-01-22T03:46:37Z

/retest

pkg/reconciler/tenancy/defaultapibindinglifecycle/default_apibinding_lifecycle_controller.go

mjudeikis

just a question, but lgtm

…laim Signed-off-by: olalekan odukoya <odukoyaonline@gmail.com>

olamilekan000 · 2026-02-21T03:53:08Z

/retest

olamilekan000 requested review from gman0, mjudeikis and xrstf January 14, 2026 21:37

olamilekan000 changed the title ~~fix inherited APIBinding Selector not inheriting default permission claim selector~~ fix inherited APIBinding not inheriting default permission claim selector Jan 14, 2026

olamilekan000 force-pushed the fix-resource-selctor-not0being-inherited branch from fec326a to 1a0d605 Compare January 15, 2026 12:27

olamilekan000 force-pushed the fix-resource-selctor-not0being-inherited branch 2 times, most recently from 4766801 to 34d26b9 Compare January 15, 2026 18:19

olamilekan000 force-pushed the fix-resource-selctor-not0being-inherited branch from 34d26b9 to cfb0e0e Compare January 18, 2026 18:39

olamilekan000 force-pushed the fix-resource-selctor-not0being-inherited branch from cfb0e0e to e139340 Compare January 19, 2026 06:03

kcp-ci-bot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Jan 19, 2026

mjudeikis requested changes Jan 19, 2026

View reviewed changes

kcp-ci-bot assigned mjudeikis Jan 19, 2026

olamilekan000 force-pushed the fix-resource-selctor-not0being-inherited branch from e139340 to 9fd8aa4 Compare January 19, 2026 11:48

olamilekan000 requested a review from mjudeikis January 19, 2026 11:48

olamilekan000 force-pushed the fix-resource-selctor-not0being-inherited branch from 9fd8aa4 to c46f724 Compare January 22, 2026 02:51

mjudeikis reviewed Feb 3, 2026

View reviewed changes

pkg/reconciler/tenancy/defaultapibindinglifecycle/default_apibinding_lifecycle_controller.go Show resolved Hide resolved

mjudeikis reviewed Feb 3, 2026

View reviewed changes

fix inherited APIBinding Selector not inheriting default permission c…

68d93c3

…laim Signed-off-by: olalekan odukoya <odukoyaonline@gmail.com>

olamilekan000 force-pushed the fix-resource-selctor-not0being-inherited branch from c46f724 to 68d93c3 Compare February 21, 2026 03:02

olamilekan000 requested a review from mjudeikis February 21, 2026 03:02

Comments

Conversation

olamilekan000 commented Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What Type of PR Is This?

Related Issue(s)

Release Notes

Uh oh!

olamilekan000 commented Jan 15, 2026

Uh oh!

olamilekan000 commented Jan 15, 2026

Uh oh!

olamilekan000 commented Jan 15, 2026

Uh oh!

olamilekan000 commented Jan 15, 2026

Uh oh!

olamilekan000 commented Jan 15, 2026

Uh oh!

olamilekan000 commented Jan 15, 2026

Uh oh!

olamilekan000 commented Jan 15, 2026

Uh oh!

kcp-ci-bot commented Jan 15, 2026

Uh oh!

olamilekan000 commented Jan 15, 2026

Uh oh!

olamilekan000 commented Jan 16, 2026

Uh oh!

olamilekan000 commented Jan 19, 2026

Uh oh!

mjudeikis commented Jan 19, 2026

Uh oh!

mjudeikis left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mjudeikis Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

olamilekan000 Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mjudeikis Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

mjudeikis Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

olamilekan000 Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

mjudeikis Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

mjudeikis Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

olamilekan000 Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

olamilekan000 Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

kcp-ci-bot commented Jan 19, 2026

Uh oh!

olamilekan000 commented Jan 19, 2026

Uh oh!

olamilekan000 commented Jan 19, 2026

Uh oh!

olamilekan000 commented Jan 19, 2026

Uh oh!

mjudeikis commented Jan 21, 2026

Uh oh!

olamilekan000 commented Jan 21, 2026

Uh oh!

olamilekan000 commented Jan 21, 2026

Uh oh!

olamilekan000 commented Jan 14, 2026 •

edited

Loading

olamilekan000 Jan 19, 2026 •

edited

Loading

mjudeikis Feb 4, 2026 •

edited

Loading