workspace-controller

workspace-controller is part of the IPCEI-CIS cloud infrastructure initiative. Within the IPCEI-CIS edge framework it provides the multi-tenant workspace provisioning layer of the edge-connect platform.

kcp controller that owns the Workspace resource (per ADR-0020). A Workspace authored inside an org workspace (root:orgs:{org}) is reconciled into a kcp nested workspace at root:orgs:{org}:{name}, with:

• the three controller-managed ClusterRoles (workspace-owner / workspace-editor / workspace-viewer) seeded inside it,
• ClusterRoleBindings for every entry in spec.owners (the unified OwnerBinding{Kind, Name} shape from ADR-0021),
• an APIBinding per configured customer-facing APIExport.

The controller is multi-cluster: a single binary watches Workspace CRs across every org workspace via an APIExport's virtual-workspace endpoint, using kcp-dev/multicluster-provider + multicluster-runtime.

Layout

.
├── api/v1alpha1/                  # CRD source of truth (kubebuilder annotations)
│   ├── groupversion_info.go
│   ├── ownerbinding_types.go      # canonical OwnerBinding{Kind, Name}
│   ├── workspace_types.go         # Workspace, WorkspaceSpec, WorkspaceStatus
│   └── zz_generated.deepcopy.go   # generated by `make generate`
├── cmd/
│   └── workspace-controller/      # main binary
├── internal/
│   ├── controller/
│   │   ├── quota/                 # ADR-0026 §4b trueup: Workspace count -> QuotaEnforcement
│   │   ├── util/                  # shared helpers (conditions)
│   │   ├── workspace/             # the Workspace reconciler
│   │   └── testutil/              # test fixtures + fake mcmanager
│   └── kcpws/                     # kcp-facing client (workspace + RBAC + APIBindings)
├── config/
│   ├── crd/                       # generated by `make manifests`
│   └── kcp/                       # generated by `make schemas`
├── deploy/charts/
│   ├── workspace-controller/      # deployment chart for the binary
│   └── workspace-controller-kcp/  # APIExport + APIResourceSchema + RBAC
├── Dockerfile.workspace.goreleaser
├── .goreleaser.yaml
├── Makefile
└── go.mod

Generating CRDs and APIResourceSchemas

make all                # generate + manifests + schemas
make generate           # zz_generated.deepcopy.go
make manifests          # CRD YAML in config/crd/
make schemas            # APIResourceSchema YAML in config/kcp/
make build              # build the controller binary to bin/
make vet
make test
make helm-lint

Running the controller

KCP_KUBECONFIG=/path/to/kcp.kubeconfig \
go run ./cmd/workspace-controller \
  --endpointslice=workspaces \
  --apibinding=workspaces:root:controllers:workspace-controller \
  --owner-cluster-role-name=workspace-owner

--apibinding may be repeated. Each value is name:exportPath (or name:exportPath:exportName when the binding name differs from the export name) and produces one APIBinding inside every provisioned workspace. The APIBindingsReady condition flips True once all of them report Bound / Ready. Pass none to skip the binding step entirely; the condition then trivially reports True.

Quota trueup

With --quota-trueup, the binary also runs the ADR-0026 §4b trueup for the child-workspace count: internal/controller/quota counts Workspace CRs from the multicluster cache the controller already maintains, and the shared pkg/trueup reconciler writes that count into QuotaEnforcement.status.usage for directives addressed to the workspace-controller enforcer. This is what reclaims quota slots after an out-of-band delete, and reservations that were admitted but never persisted.

The flag needs the APIExport to claim tenancy.edgeconnect.eu/quotaenforcements — see quotaEnforcements.enabled in the workspace-controller-kcp chart.

License

Apache-2.0 — see LICENSE.

Funding and Support

This open source project is part of activities carried out within the Important Project of Common European Interest on Next Generation Cloud Infrastructure and Services (IPCEI-CIS) — FKZ 13IPC005, an EU initiative to build a sovereign, interoperable and energy-efficient cloud-to-edge infrastructure in Europe.

The work in this repository has been supported and co-funded by Deutsche Telekom in the context of IPCEI-CIS, where Deutsche Telekom contributes its expertise in secure, sustainable connectivity and cloud-edge platform orchestration for a European cloud-edge continuum.

Where applicable, further national or European public funding instruments associated with IPCEI-CIS may also have contributed to the development of this software.