apibindings/reconciler/labeller: fix informer error on non-persisted …

…resources Signed-off-by: Dr. Stefan Schimanski <[email protected]>
kcp-dev · May 13, 2024 · c58ce85 · c58ce85
1 parent f238118
commit c58ce85
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 0 deletions.
diff --git a/pkg/reconciler/apis/permissionclaimlabel/permissionclaimlabel_reconcile.go b/pkg/reconciler/apis/permissionclaimlabel/permissionclaimlabel_reconcile.go
@@ -36,6 +36,7 @@ import (
  "k8s.io/klog/v2"
 
  "github.com/kcp-dev/kcp/pkg/logging"
+ "github.com/kcp-dev/kcp/pkg/permissionclaim"
  apisv1alpha1 "github.com/kcp-dev/kcp/sdk/apis/apis/v1alpha1"
  conditionsv1alpha1 "github.com/kcp-dev/kcp/sdk/apis/third_party/conditions/apis/conditions/v1alpha1"
  "github.com/kcp-dev/kcp/sdk/apis/third_party/conditions/util/conditions"
@@ -106,6 +107,10 @@ func (c *controller) reconcile(ctx context.Context, apiBinding *apisv1alpha1.API
 
  for _, s := range sets.List[string](allChanges) {
  claim := claimFromSetKey(s)
+ if nonPersisted := permissionclaim.NonPersistedResourcesClaimable[schema.GroupResource{Group: claim.Group, Resource: claim.Resource}]; nonPersisted {
+ continue
+ }
+
  claimLogger := logger.WithValues("claim", s)
 
  informer, gvr, err := c.getInformerForGroupResource(claim.Group, claim.Resource)

diff --git a/test/e2e/apibinding/apibinding_permissionclaims_test.go b/test/e2e/apibinding/apibinding_permissionclaims_test.go
@@ -28,6 +28,7 @@ import (
  "github.com/kcp-dev/logicalcluster/v3"
  "github.com/stretchr/testify/require"
 
+ authorizationv1 "k8s.io/api/authorization/v1"
  metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
  "k8s.io/apimachinery/pkg/util/wait"
  "k8s.io/client-go/discovery/cached/memory"
@@ -197,6 +198,20 @@ func getAcceptedPermissionClaims(identityHash string) []apisv1alpha1.AcceptableP
  },
  State: apisv1alpha1.ClaimAccepted,
  },
+ {
+ PermissionClaim: apisv1alpha1.PermissionClaim{
+ GroupResource: apisv1alpha1.GroupResource{Group: authorizationv1.GroupName, Resource: "localsubjectaccessreviews"},
+ All: true,
+ },
+ State: apisv1alpha1.ClaimAccepted,
+ },
+ {
+ PermissionClaim: apisv1alpha1.PermissionClaim{
+ GroupResource: apisv1alpha1.GroupResource{Group: authorizationv1.GroupName, Resource: "subjectaccessreviews"},
+ All: true,
+ },
+ State: apisv1alpha1.ClaimAccepted,
+ },
  }
 }