Filter core api calls by client-org

go.mod

@@ -47,12 +47,12 @@ require (
 	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8
 	kmodules.xyz/apiversion v0.2.0
 	kmodules.xyz/authorizer v0.29.1
-	kmodules.xyz/client-go v0.30.45-0.20250207123756-eee0c64ca0c6
+	kmodules.xyz/client-go v0.30.45
 	kmodules.xyz/custom-resources v0.30.0
 	kmodules.xyz/go-containerregistry v0.0.12
 	kmodules.xyz/monitoring-agent-api v0.30.4
 	kmodules.xyz/offshoot-api v0.30.1
-	kmodules.xyz/resource-metadata v0.24.3-0.20250127043106-3dc2cd2a29af
+	kmodules.xyz/resource-metadata v0.24.4-0.20250205085501-41f5e5666a3b
 	kmodules.xyz/resource-metrics v0.30.5
 	kmodules.xyz/resource-metrics/utils v0.30.4
 	kmodules.xyz/sets v0.29.0

go.sum

@@ -1174,8 +1174,8 @@ kmodules.xyz/apply v0.29.0 h1:0OXGfE2IPuvXHk6uI9zp6KCYdBibx8mK4PEl0g3LZ44=
 kmodules.xyz/apply v0.29.0/go.mod h1:bwToXErB+DC7/EEWjQVARCSbJBjGx5hIEuV1n0tC73g=
 kmodules.xyz/authorizer v0.29.1 h1:uByGGoryKbZcfiEAhjcK/Y345I9mygNQP7DVpkMbNQQ=
 kmodules.xyz/authorizer v0.29.1/go.mod h1:kZRhclL8twzyt2bQuJQJbpYww2sc+qFr8I5PPoq/sWY=
-kmodules.xyz/client-go v0.30.45-0.20250207123756-eee0c64ca0c6 h1:ZHDolQgpH230bA4N/bxhBX26jPJ/OBdcoaZQ5CUn36Q=
-kmodules.xyz/client-go v0.30.45-0.20250207123756-eee0c64ca0c6/go.mod h1:T9Kiu20wXEn65dLBQeegf4+y7oahJBR9ZJO2zGEVLIY=
+kmodules.xyz/client-go v0.30.45 h1:hSjNlJoPQ86CKS8BiEbSmBkF2+yWsFjjMFISOCVJ6aA=
+kmodules.xyz/client-go v0.30.45/go.mod h1:T9Kiu20wXEn65dLBQeegf4+y7oahJBR9ZJO2zGEVLIY=
 kmodules.xyz/crd-schema-fuzz v0.29.1 h1:zJTlWYOrT5dsVVHW8HGcnR/vaWfxQfNh11QwTtkYpcs=
 kmodules.xyz/crd-schema-fuzz v0.29.1/go.mod h1:n708z9YQqLMP2KNLQVgBcRJw1QpSWLvpNCEi+KJDOYE=
 kmodules.xyz/custom-resources v0.30.0 h1:vR3CbseHMLwR4GvtcJJuRuwIV8voKqFqNii27rMcm1o=
@@ -1186,8 +1186,8 @@ kmodules.xyz/monitoring-agent-api v0.30.4 h1:6CTKxYJKpWDsDYb0WRBHGFoW3xQof05d+W8
 kmodules.xyz/monitoring-agent-api v0.30.4/go.mod h1:ZuTQ5uGi6H80QLsOTuuC7m58dfXDGUv0YB+s059gnr4=
 kmodules.xyz/offshoot-api v0.30.1 h1:TrulAYO+oBsXe9sZZGTmNWIuI8qD2izMpgcTSPvgAmI=
 kmodules.xyz/offshoot-api v0.30.1/go.mod h1:T3mpjR6fui0QzOcmQvIuANytW48fe9ytmy/1cgx6D4g=
-kmodules.xyz/resource-metadata v0.24.3-0.20250127043106-3dc2cd2a29af h1:fvSfjg4Ypqu3XgflHLLinpT3ErDStI+LJf9s4+5E9fQ=
-kmodules.xyz/resource-metadata v0.24.3-0.20250127043106-3dc2cd2a29af/go.mod h1:rPUZSMR0e1Vi+gONQ2ZhOFW+GvUeK+1AI7h9fzTZoKI=
+kmodules.xyz/resource-metadata v0.24.4-0.20250205085501-41f5e5666a3b h1:fdS0AvniV8BaS5LiNSty3MdFK/n3oy5EYGZ3Dqc3PLY=
+kmodules.xyz/resource-metadata v0.24.4-0.20250205085501-41f5e5666a3b/go.mod h1:rPUZSMR0e1Vi+gONQ2ZhOFW+GvUeK+1AI7h9fzTZoKI=
 kmodules.xyz/resource-metrics v0.30.5 h1:ZhpGeR9DCz1HTrKUg/mWhr95wlFzCPRdgVAqwaggy1o=
 kmodules.xyz/resource-metrics v0.30.5/go.mod h1:w9+rz7/s/kGP1GWzYSuRdCn+l7EwpesmESSEHkLBnIQ=
 kmodules.xyz/resource-metrics/utils v0.30.4 h1:bJS/x0Qr7N1FFdxugFbzZ/Es6HVs4ptsFlhkmgj3jac=

pkg/registry/core/genericresource/storage.go

@@ -152,24 +152,34 @@ func (r *Storage) Get(ctx context.Context, name string, options *metav1.GetOptio
 }
 
 func (r *Storage) List(ctx context.Context, options *internalversion.ListOptions) (runtime.Object, error) {
+	user, ok := apirequest.UserFrom(ctx)
+	if !ok {
+		return nil, apierrors.NewBadRequest("missing user info")
+	}
+
 	ns, ok := apirequest.NamespaceFrom(ctx)
 	if !ok {
 		return nil, apierrors.NewBadRequest("missing namespace")
 	}
-	selector := shared.NewGroupKindSelector(options.LabelSelector)
+	// for client org user, show their own namespace only when all namespace objects is requested
+	if ns == "" {
+		result, err := clustermeta.IsClientOrgMember(r.kc, user)
+		if err != nil {
+			return nil, err
+		}
 
-	user, ok := apirequest.UserFrom(ctx)
-	if !ok {
-		return nil, apierrors.NewBadRequest("missing user info")
+		if result.IsClientOrg {
+			ns = result.Namespace.Name
+		}
 	}
 
+	selector := shared.NewGroupKindSelector(options.LabelSelector)
 	cmeta, err := clustermeta.ClusterMetadata(r.kc)
 	if err != nil {
 		return nil, apierrors.NewInternalError(err)
 	}
 
 	mapper := restmapper.NewDeferredDiscoveryRESTMapper(memory.NewMemCacheClient(r.dc))
-
 	gvks := make(map[schema.GroupKind]string)
 	for _, gvk := range api.RegisteredTypes() {
 		if !selector.Matches(gvk.GroupKind()) {

pkg/registry/core/podview/storage.go

@@ -32,6 +32,7 @@ import (
 	apirequest "k8s.io/apiserver/pkg/endpoints/request"
 	"k8s.io/apiserver/pkg/registry/rest"
 	"k8s.io/klog/v2"
+	clustermeta "kmodules.xyz/client-go/cluster"
 	mu "kmodules.xyz/client-go/meta"
 	promclient "kmodules.xyz/monitoring-agent-api/client"
 	rscoreapi "kmodules.xyz/resource-metadata/apis/core/v1alpha1"
@@ -224,14 +225,25 @@ func (r *Storage) NewList() runtime.Object {
 }
 
 func (r *Storage) List(ctx context.Context, options *internalversion.ListOptions) (runtime.Object, error) {
+	user, ok := apirequest.UserFrom(ctx)
+	if !ok {
+		return nil, apierrors.NewBadRequest("missing user info")
+	}
+
 	ns, ok := apirequest.NamespaceFrom(ctx)
 	if !ok {
 		return nil, apierrors.NewBadRequest("missing namespace")
 	}
+	// for client org user, show their own namespace only when all namespace objects is requested
+	if ns == "" {
+		result, err := clustermeta.IsClientOrgMember(r.kc, user)
+		if err != nil {
+			return nil, err
+		}
 
-	user, ok := apirequest.UserFrom(ctx)
-	if !ok {
-		return nil, apierrors.NewBadRequest("missing user info")
+		if result.IsClientOrg {
+			ns = result.Namespace.Name
+		}
 	}
 
 	attrs := authorizer.AttributesRecord{

pkg/registry/core/resourceservice/storage.go

@@ -163,18 +163,28 @@ func (r *Storage) Get(ctx context.Context, name string, options *metav1.GetOptio
 }
 
 func (r *Storage) List(ctx context.Context, options *internalversion.ListOptions) (runtime.Object, error) {
+	user, ok := apirequest.UserFrom(ctx)
+	if !ok {
+		return nil, apierrors.NewBadRequest("missing user info")
+	}
+
 	ns, ok := apirequest.NamespaceFrom(ctx)
 	if !ok {
 		return nil, apierrors.NewBadRequest("missing namespace")
 	}
+	// for client org user, show their own namespace only when all namespace objects is requested
+	if ns == "" {
+		result, err := clustermeta.IsClientOrgMember(r.kc, user)
+		if err != nil {
+			return nil, err
+		}
 
-	selector := shared.NewGroupKindSelector(options.LabelSelector)
-
-	user, ok := apirequest.UserFrom(ctx)
-	if !ok {
-		return nil, apierrors.NewBadRequest("missing user info")
+		if result.IsClientOrg {
+			ns = result.Namespace.Name
+		}
 	}
 
+	selector := shared.NewGroupKindSelector(options.LabelSelector)
 	cmeta, err := clustermeta.ClusterMetadata(r.kc)
 	if err != nil {
 		return nil, apierrors.NewInternalError(err)

pkg/registry/core/resourcesummary/storage.go

@@ -109,7 +109,6 @@ func (r *Storage) List(ctx context.Context, options *internalversion.ListOptions
 	if !ok {
 		return nil, apierrors.NewBadRequest("missing namespace")
 	}
-
 	// for client org user, show their own namespace only when all namespace summary is requested
 	if ns == "" {
 		result, err := clustermeta.IsClientOrgMember(r.kc, user)

vendor/kmodules.xyz/resource-metadata/apis/core/v1alpha1/generic_resource_types.go

@@ -76,7 +76,9 @@ type GenericResourceSpec struct {
 }
 
 type ComputeResource struct {
-	Name string `json:"name"`
+	// +optional
+	UID  types.UID `json:"uid,omitempty"`
+	Name string    `json:"name"`
 	// +optional
 	CreationTimestamp metav1.Time         `json:"creationTimestamp,omitempty"`
 	Containers        []ContainerResource `json:"containers,omitempty"`
@@ -91,7 +93,9 @@ type ContainerResource struct {
 }
 
 type StorageResource struct {
-	Name string `json:"name"`
+	// +optional
+	UID  types.UID `json:"uid,omitempty"`
+	Name string    `json:"name"`
 	// +optional
 	CreationTimestamp metav1.Time `json:"creationTimestamp,omitempty"`
 	// +optional

vendor/kmodules.xyz/resource-metadata/crds/core.k8s.appscode.com_genericresources.yaml

@@ -286,6 +286,12 @@ spec:
                       type: array
                     name:
                       type: string
+                    uid:
+                      description: UID is a type that holds unique ID values, including
+                        UUIDs.  Because we don't ONLY use UUIDs, this is an alias
+                        to string.  Being a type captures intent and helps make sure
+                        that UIDs and names do not get conflated.
+                      type: string
                   required:
                   - name
                   type: object
@@ -367,6 +373,12 @@ spec:
                             cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
                           type: object
                       type: object
+                    uid:
+                      description: UID is a type that holds unique ID values, including
+                        UUIDs.  Because we don't ONLY use UUIDs, this is an alias
+                        to string.  Being a type captures intent and helps make sure
+                        that UIDs and names do not get conflated.
+                      type: string
                   required:
                   - name
                   type: object

vendor/kmodules.xyz/resource-metadata/hub/resourceoutlines/core.kubestash.com/v1alpha1/backupsessions.yaml

@@ -14,16 +14,19 @@ spec:
   - name: Overview
     sections:
     - blocks:
-      - kind: Block
-        name: core.kubestash.com-v1alpha1-backupsessions
-      info:
-        actions:
+      - actions:
           create: Never
         displayMode: Field
-        kind: Self
+        kind: Connection
+        name: Target
+        query:
+          byLabel: backup_via
+          type: GraphQL
+        ref:
+          group: appcatalog.appscode.com
+          kind: AppBinding
         view:
-          name: core.kubestash.com-v1alpha1-backupsessions
-    - blocks:
+          name: appcatalog.appscode.com-v1alpha1-appbindings-kubedb
       - actions:
           create: Never
         displayMode: List

vendor/modules.txt

@@ -2575,7 +2575,7 @@ kmodules.xyz/authorizer/apiserver
 kmodules.xyz/authorizer/rbac
 kmodules.xyz/authorizer/rbac/helpers
 kmodules.xyz/authorizer/rbac/validation
-# kmodules.xyz/client-go v0.30.45-0.20250207123756-eee0c64ca0c6
+# kmodules.xyz/client-go v0.30.45
 ## explicit; go 1.22.0
 kmodules.xyz/client-go
 kmodules.xyz/client-go/api/v1
@@ -2613,7 +2613,7 @@ kmodules.xyz/monitoring-agent-api/client
 kmodules.xyz/offshoot-api/api/v1
 kmodules.xyz/offshoot-api/api/v2
 kmodules.xyz/offshoot-api/util
-# kmodules.xyz/resource-metadata v0.24.3-0.20250127043106-3dc2cd2a29af
+# kmodules.xyz/resource-metadata v0.24.4-0.20250205085501-41f5e5666a3b
 ## explicit; go 1.22.1
 kmodules.xyz/resource-metadata/apis/core/install
 kmodules.xyz/resource-metadata/apis/core/v1alpha1