-
Notifications
You must be signed in to change notification settings - Fork 125
Rename HTTPRoutes HTTPRoute #30
Rename HTTPRoutes HTTPRoute #30
Conversation
Well that's a bummer. Is there a better word we can use? It is a container of multiple routes, so Also, I'd assumed the group would be ps |
I agree it is not great, I was struggling myself, how about You are right on the namespace, I was just trying to get the codegening to work with our CRD build, will update that tomorrow once we get a few things figured out. |
Hah, Nic, we are on the same page. Was staring at this issue and had: |
I'm a big +1 to |
Ok how is this? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I like it, just one little comment/question, otherwise, merge away!
traffic-access-control.md
Outdated
@@ -154,7 +156,8 @@ protected label. | |||
|
|||
A `ClusterIdentityBinding` grants access for a specific identity, originating in | |||
a specific namespace, to a ClusterTrafficTarget associated with pods in any | |||
namespace. | |||
namespace. The ClusterTrafficTarget referenced by targetRef should always be in |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Both target and binding aren't namespaced (in my head at least).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Aha good catch, so the reason I added that is when we are building the CRD and are actually writing the code to read the TrafficTarget, the KubeAPI client requires the object namespace as a parameter.
Originally I added namespace to the TargetRef so that you could do the lookup, then reverted that as IdentityBindings would always be in the same location as TrafficTargets. However, that assumption does not apply for ClusterIdentityBinding.
I think we need to add namespace to the ref then?
---
kind: IdentityBinding
apiVersion: smi-spec.io/v1alpha1
metadata:
name: account-specific
namespace: default
subjects:
- kind: ServiceAccount
name: service-b
namespace: default
targetRef:
kind: TrafficTarget
name: foo
namespace: default
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It looks like RoleBinding
and ClusterRoleBinding
don't need the namespace. I suspect that is because you can only targetRef
the cluster or non-cluster resource. I think that targetRef
is a custom object there though (and not a ObjectReference). You're in the code so I'll defer to you though.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think we need namespace on everything, it will just make things easier when coding the CRDs no assumptions. I have added this in the latest commit. We can always change things later to make things easier.
When creating a CRD for the HTTPRoutes this causes a pluralization problem for example...
as opposed to