Shift Control Center off the full-CR API onto target mode - #243
Merged
Conversation
Control Center's IDP create form spoke the old full-CR contract — it
constructed apiVersion/kind/metadata/spec client-side and server-side, and
fetched schema from a path-suffixed endpoint the gateway never actually
served. It now speaks target mode like every other Apply API caller:
submits {"target": "...", ...fields}, fetches schema from
GET /api/v1/schema?target=<target>, and never builds a CR — the gateway
does that from idp.fields/idp.additionalFields.
The runtime's /katalog response now carries a target field per CRD
(CRDEntry.IDPTargetOrEmpty) alongside idpEnabled, so Control Center
resolves target the same way every other caller does instead of deriving
one from Kind/GVK.
Closed a gap in the target-mode API itself found along the way:
BuildCRFromTarget had no fallback for a caller-supplied name when
idp.name isn't declared, unlike full CR mode's metadata.name — every
target-mode request against such a CRD was rejected regardless of what
the caller sent. It now falls back to a flat "name" field the same way.
concepts/idp reframed around the gateway as the entry point — schema discovery, apply, read, list, delete — with the CR as an internal contract the caller never sees, not "apply a CR" as the whole story. Target mode moved from a footnote link to the primary path throughout, full CR mode framed as the advanced/compat option. Added idp.allowedTokens as a first-class topic: a concepts/idp deep dive (03-token-scoping.md) and a dedicated security page (security/08-idp-permissions.md) — per-token operation and namespace scoping on the Apply API, a real authorization layer distinct from the CRD-level allowedNamespaces/restrictedNamespaces every caller shares. Filled in the Apply API reference (nested idp.fields.path, idp.config.response payload/exclude/poll, structured violation responses) and fixed pre-existing broken links in security/index.md. CHANGELOG updated to match — idp.name/idp.namespace entries describe both modes directly, no longer only full CR mode.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
{"target": "...", ...fields}, fetchesGET /api/v1/schema?target=<target>, never builds a CR itself./katalogresponse now carriestargetper CRD (CRDEntry.IDPTargetOrEmpty()), so Control Center resolves it the same way any caller does instead of deriving one from Kind/GVK.Test plan
go build ./...andgo test ./...clean on both the main module andcmd/controlcenter[+ Create]form against a running gateway + runtime