rbac-controller-manager

A kcp-native controller that gives edge-connect its own RBAC API surface (rbac.edge-connect.eu/v1alpha1) and materialises it onto kcp's native RBAC primitives.

What it does

• ClusterRoleBinding → KCP ClusterRoleBinding. Reconciles cluster-scoped ClusterRoleBinding CRs across every workspace bound to the clusterrolebindings APIExport and materialises each one as a native KCP ClusterRoleBinding. Subject names are written in plain form by authors; the controller transparently prepends the oidc: prefix so KCP RBAC sees the identities produced by the workspace authentication configuration.

The ClusterRoles referenced by spec.role (org: owner/read; sub-workspace: workspace-owner/workspace-contributor/workspace-reader) are precreated externally and are not managed by this controller.

Layout

Path	Responsibility
api/v1alpha1	ClusterRoleBinding API types + scheme
cmd/rbac-controller	manager entrypoint (apiexport provider + reconciler)
internal/controller/clusterrolebinding	ClusterRoleBinding → KCP ClusterRoleBinding reconciler
internal/subject	oidc: subject prefixing (pure)
examples	sample ClusterRoleBinding and APIBinding manifests
config/crd, config/kcp	generated CRD and kcp APIResourceSchema
deploy/charts/rbac-controller	workload Deployment + host RBAC
deploy/charts/rbac-controller-kcp	APIResourceSchema, APIExport, consumer RBAC

Development

make all      # generate deepcopy + CRD + kcp schemas
make test     # unit tests (regenerates code first)
make build    # build ./cmd/rbac-controller
make helm-lint

The controller authenticates to the kcp front-proxy with the kubeconfig at $KCP_KUBECONFIG (mounted by the chart). --endpointslice (default clusterrolebindings) must match the deployed APIExport name.

Notes / limitations

• Single replica only: leader election is not yet wired up, so replicaCount > 1 is unsupported.
• The materialised native ClusterRoleBinding carries an owner reference to the cluster-scoped ClusterRoleBinding CR, so Kubernetes garbage collection cleans it up automatically on deletion (no finalizer required).
• The referenced ClusterRoles are precreated externally; a spec.role that names a missing role still produces a binding (operators own role lifecycle).
• Role rules use broad wildcards for the PoC; tightening is deferred.