echo-controller

Proof of concept. This controller exists to exercise the filteredapiexport-virtual-workspace project end to end. It is intentionally trivial — it is not a production component.

A kcp controller that owns a tiny Echo resource and mirrors spec.echo into status.echo. Its purpose is to prove that a standard multicluster-runtime controller can consume the filtered APIExport virtual workspace instead of the stock APIExport one.

What it demonstrates

Unlike a normal kcp controller — which watches an APIExportEndpointSlice (apis.kcp.io) — echo-controller watches a FilteredAPIExportEndpointSlice (sync.edge-connect.eu, served by filteredapiexport-virtual-workspace). Each URL in that slice's status.endpoints is a filtered virtual-workspace endpoint that only exposes the targeted APIExport's objects matching a label selector.

The wiring lives in cmd/echo-controller/main.go:

• The multicluster provider is built with kcp-dev/multicluster-provider's low-level provider.NewProvider, with the FilteredAPIExportEndpointSlice as an unstructured EndpointSliceObject. (The filtered SDK's typed struct omits status.endpoints, so the URLs are read straight from the served object via the default extractor.)
• ObjectToWatch is Echo rather than the default APIBinding, because the filtered virtual workspace only serves the targeted export's resources.

The reconciler in internal/controllers/echo.go just copies spec.echo to status.echo and sets status.ready.

Layout

.
├── api/v1alpha1/                  # CRD source of truth (kubebuilder annotations)
│   ├── groupversion_info.go
│   ├── echo_types.go              # Echo, EchoSpec, EchoStatus
│   └── zz_generated.deepcopy.go   # generated by `make generate`
├── cmd/
│   └── echo-controller/           # main binary (filtered-slice provider wiring)
├── internal/
│   └── controllers/               # the Echo reconciler
├── config/
│   ├── crd/                       # generated by `make manifests`
│   ├── kcp/                       # generated by `make schemas` / `make apiexport`
│   └── examples/                  # sample Echo CR
├── deploy/charts/
│   ├── echo-controller/           # deployment chart for the binary
│   └── echo-controller-kcp/       # APIExport + APIResourceSchema + RBAC + slice
├── hack/generate-schemas.sh       # hash-pinned APIResourceSchema generation
├── Dockerfile.echo.goreleaser
├── .goreleaser.yaml
├── Makefile
└── go.mod

Generating CRDs and APIResourceSchemas

make all                # generate + manifests + schemas + sync-chart-schemas + apiexport
make generate           # zz_generated.deepcopy.go
make manifests          # CRD YAML in config/crd/
make schemas            # APIResourceSchema YAML in config/kcp/ (hash-pinned prefix)
make build              # build the controller binary to bin/
make vet
make test
make lint
make helm-lint

Running the controller

The binary is configured entirely through the environment:

KCP_KUBECONFIG=/path/to/kcp.kubeconfig \
KCP_ENDPOINTSLICE=echoes \
go run ./cmd/echo-controller

• KCP_KUBECONFIG — kubeconfig pointing at the workspace that holds the FilteredAPIExportEndpointSlice.
• KCP_ENDPOINTSLICE — name of that slice.

Deploying

Two Helm charts, mirroring the controller / kcp split:

• deploy/charts/echo-controller-kcp — installs the APIExport, APIResourceSchema, RBAC, and (optionally) the FilteredAPIExportEndpointSlice into kcp.
• deploy/charts/echo-controller — runs the controller binary on the host cluster.

See each chart's README for values. Note: the filtered virtual workspace from filteredapiexport-virtual-workspace must be deployed and serving for the slice to be populated with endpoint URLs.