We should refactor konnector to use multicluster-runtime and become a singelton in the consumer cluster.
Meaning based on bindings it would just use it to engage different providers if there are many.,
Biggest challenges for this:
- PermissionClaims controller
- CRD gvr controllers.
Basically, those need to be "cluster aware". To make this happen, we need a single object in the cluster that represents "Cluster". For example:
APIServiceBinding - represents a binding contract - points to the connection secret.
Secret - Has cluster labels and represents a cluster.
We could establish a MCR cluster per secret.
Every time GVR is enqueued, we would need to check which APIServiceBinding it comes from and use that client to execute the reconcile loop.
Every time a permission claim is executed, we would need to check which APIBinding owns a particular object (for example, a secret). This might create some conflicts as if the same namespace has multiple conflicting secrets, we might have issues. For this, let's have a reconciler to check for APIServiceBinding permission claims clashes and warn if they happen.
We should refactor konnector to use multicluster-runtime and become a singelton in the consumer cluster.
Meaning based on bindings it would just use it to engage different providers if there are many.,
Biggest challenges for this:
Basically, those need to be "cluster aware". To make this happen, we need a single object in the cluster that represents "Cluster". For example:
APIServiceBinding - represents a binding contract - points to the connection secret.
Secret - Has cluster labels and represents a cluster.
We could establish a MCR cluster per secret.
Every time GVR is enqueued, we would need to check which APIServiceBinding it comes from and use that client to execute the reconcile loop.
Every time a permission claim is executed, we would need to check which APIBinding owns a particular object (for example, a secret). This might create some conflicts as if the same namespace has multiple conflicting secrets, we might have issues. For this, let's have a reconciler to check for APIServiceBinding permission claims clashes and warn if they happen.