Make LogicalCLuster claimable

config/crds/apis.kcp.io_apibindings.yaml

@@ -115,10 +115,6 @@ spec:
                   - message: either "all" or "resourceSelector" must be set
                     rule: (has(self.all) && self.all) != (has(self.resourceSelector)
                       && size(self.resourceSelector) > 0)
-                  - message: logicalclusters cannot be claimed
-                    rule: '!has(self.group) || self.group != "core.kcp.io" || self.resource
-                      != "logicalclusters" || (has(self.identityHash) && self.identityHash
-                      != "")'
                 type: array
               reference:
                 description: reference uniquely identifies an API to bind to.
@@ -224,10 +220,6 @@ spec:
                   - message: either "all" or "resourceSelector" must be set
                     rule: (has(self.all) && self.all) != (has(self.resourceSelector)
                       && size(self.resourceSelector) > 0)
-                  - message: logicalclusters cannot be claimed
-                    rule: '!has(self.group) || self.group != "core.kcp.io" || self.resource
-                      != "logicalclusters" || (has(self.identityHash) && self.identityHash
-                      != "")'
                 type: array
               boundResources:
                 description: boundResources records the state of bound APIs.
@@ -402,10 +394,6 @@ spec:
                   - message: either "all" or "resourceSelector" must be set
                     rule: (has(self.all) && self.all) != (has(self.resourceSelector)
                       && size(self.resourceSelector) > 0)
-                  - message: logicalclusters cannot be claimed
-                    rule: '!has(self.group) || self.group != "core.kcp.io" || self.resource
-                      != "logicalclusters" || (has(self.identityHash) && self.identityHash
-                      != "")'
                 type: array
               phase:
                 description: 'phase is the current phase of the APIBinding: - "":

config/crds/apis.kcp.io_apiexports.yaml

@@ -180,10 +180,6 @@ spec:
                   - message: either "all" or "resourceSelector" must be set
                     rule: (has(self.all) && self.all) != (has(self.resourceSelector)
                       && size(self.resourceSelector) > 0)
-                  - message: logicalclusters cannot be claimed
-                    rule: '!has(self.group) || self.group != "core.kcp.io" || self.resource
-                      != "logicalclusters" || (has(self.identityHash) && self.identityHash
-                      != "")'
                 type: array
                 x-kubernetes-list-map-keys:
                 - group

pkg/informer/informer.go

@@ -852,6 +852,7 @@ var builtInInformableTypes map[schema.GroupVersionResource]GVRPartialMetadata =
 	gvrFor("admissionregistration.k8s.io", "v1alpha1", "validatingadmissionpolicies"):       withGVRPartialMetadata(apiextensionsv1.ClusterScoped, "ValidatingAdmissionPolicy", "validatingadmissionpolicy"),
 	gvrFor("admissionregistration.k8s.io", "v1alpha1", "validatingadmissionpolicybindings"): withGVRPartialMetadata(apiextensionsv1.ClusterScoped, "ValidatingAdmissionPolicyBinding", "validatingadmissionpolicybinding"),
 	gvrFor("apiextensions.k8s.io", "v1", "customresourcedefinitions"):                       withGVRPartialMetadata(apiextensionsv1.ClusterScoped, "CustomResourceDefinition", "customresourcedefinition"),
+	gvrFor("core.kcp.io", "v1alpha1", "logicalclusters"):                                    withGVRPartialMetadata(apiextensionsv1.ClusterScoped, "LogicalCluster", "logicalcluster"),
 }
 
 func (s *crdGVRSource) GVRs() map[schema.GroupVersionResource]GVRPartialMetadata {

pkg/informer/informer_test.go

@@ -84,6 +84,7 @@ func TestBuiltInInformableTypes(t *testing.T) {
 		{Group: "authorization.k8s.io", Version: "v1", Kind: "SelfSubjectRulesReview"}:   {},
 		{Group: "authorization.k8s.io", Version: "v1", Kind: "SubjectAccessReview"}:      {},
 		{Group: "apiextensions.k8s.io", Version: "v1", Kind: "ConversionReview"}:         {},
+		{Group: "core.kcp.io", Version: "v1alpha1", Kind: "Shard"}:                       {},
 	}
 
 	gvsToIgnore := map[schema.GroupVersion]struct{}{

pkg/server/scheme/scheme.go

@@ -28,10 +28,13 @@ import (
 	"k8s.io/kubernetes/pkg/apis/core/install"
 	eventsinstall "k8s.io/kubernetes/pkg/apis/events/install"
 	rbacinstall "k8s.io/kubernetes/pkg/apis/rbac/install"
+
+	installkcpcore "github.com/kcp-dev/kcp/sdk/apis/core/install"
 )
 
 func init() {
 	install.Install(Scheme)
+	installkcpcore.Install(Scheme)
 	authenticationinstall.Install(Scheme)
 	authorizationinstall.Install(Scheme)
 	apiextensionsinstall.Install(Scheme)

pkg/virtual/apiexport/schemas/builtin/builtin.go

@@ -32,17 +32,22 @@ import (
 	"k8s.io/kube-openapi/pkg/common"
 	generatedopenapi "k8s.io/kubernetes/pkg/generated/openapi"
 
+	generatedkcpopenapi "github.com/kcp-dev/kcp/pkg/openapi"
 	kcpscheme "github.com/kcp-dev/kcp/pkg/server/scheme"
 	"github.com/kcp-dev/kcp/pkg/virtual/framework/internalapis"
 	apisv1alpha1 "github.com/kcp-dev/kcp/sdk/apis/apis/v1alpha1"
+	corev1alpha1 "github.com/kcp-dev/kcp/sdk/apis/core/v1alpha1"
 )
 
 // Create APIResourceSchemas for built-in APIs available as permission claims
 // for APIExport virtual workspace.
 // TODO(hasheddan): this could be handled via code generation.
 func init() {
 	schemes := []*runtime.Scheme{kcpscheme.Scheme}
-	openAPIDefinitionsGetters := []common.GetOpenAPIDefinitions{generatedopenapi.GetOpenAPIDefinitions}
+	openAPIDefinitionsGetters := []common.GetOpenAPIDefinitions{
+		generatedopenapi.GetOpenAPIDefinitions,    // core types
+		generatedkcpopenapi.GetOpenAPIDefinitions, // KCP core types for LogicalCluster
+	}
 
 	apis, err := internalapis.CreateAPIResourceSchemas(schemes, openAPIDefinitionsGetters, BuiltInAPIs...)
 	if err != nil {
@@ -266,4 +271,15 @@ var BuiltInAPIs = []internalapis.InternalAPI{
 		ResourceScope: apiextensionsv1.ClusterScoped,
 		HasStatus:     true,
 	},
+	{
+		Names: apiextensionsv1.CustomResourceDefinitionNames{
+			Plural:   "logicalclusters",
+			Singular: "logicalcluster",
+			Kind:     "LogicalCluster",
+		},
+		GroupVersion:  schema.GroupVersion{Group: "core.kcp.io", Version: "v1alpha1"},
+		Instance:      &corev1alpha1.LogicalCluster{},
+		ResourceScope: apiextensionsv1.ClusterScoped,
+		HasStatus:     true,
+	},
 }

sdk/apis/apis/v1alpha1/types_apiexport.go

@@ -198,7 +198,6 @@ const (
 // request and that a consumer may accept and allow the service provider access to.
 //
 // +kubebuilder:validation:XValidation:rule="(has(self.all) && self.all) != (has(self.resourceSelector) && size(self.resourceSelector) > 0)",message="either \"all\" or \"resourceSelector\" must be set"
-// +kubebuilder:validation:XValidation:rule="!has(self.group) || self.group != \"core.kcp.io\" || self.resource != \"logicalclusters\" || (has(self.identityHash) && self.identityHash != \"\")",message="logicalclusters cannot be claimed"
 type PermissionClaim struct {
 	GroupResource `json:","`
 

sdk/apis/apis/v1alpha1/types_apiexport_test.go

@@ -115,29 +115,6 @@ func TestAPIExportPermissionClaimCELValidation(t *testing.T) {
 				"openAPIV3Schema.properties.spec.properties.permissionClaims.items: Invalid value: \"object\": either \"all\" or \"resourceSelector\" must be set",
 			},
 		},
-		{
-			name: "logicalcluster invalid",
-			current: map[string]interface{}{
-				"group":    "core.kcp.io",
-				"resource": "logicalclusters",
-				"all":      true,
-			},
-			wantErrs: []string{
-				"openAPIV3Schema.properties.spec.properties.permissionClaims.items: Invalid value: \"object\": logicalclusters cannot be claimed",
-			},
-		},
-		{
-			name: "logicalcluster invalid with empty identityHash",
-			current: map[string]interface{}{
-				"group":        "core.kcp.io",
-				"resource":     "logicalclusters",
-				"identityHash": "",
-				"all":          true,
-			},
-			wantErrs: []string{
-				"openAPIV3Schema.properties.spec.properties.permissionClaims.items: Invalid value: \"object\": logicalclusters cannot be claimed",
-			},
-		},
 		{
 			name: "logicalcluster fine with non-empty identityHash",
 			current: map[string]interface{}{

sdk/apis/core/install/install.go

@@ -0,0 +1,31 @@
+/*
+Copyright 2022 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package install installs the v1alpha1 monolithic api, making it available as an
+// option to all of the API encoding/decoding machinery.
+package install
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+
+	v1alpha1 "github.com/kcp-dev/kcp/sdk/apis/core/v1alpha1"
+)
+
+// Install registers the API group and adds types to a scheme
+func Install(scheme *runtime.Scheme) {
+	utilruntime.Must(v1alpha1.AddToScheme(scheme))
+}