Fix APIBinding admission mishandling v1alpha1 API version

[xmudrii]

Summary

As of v0.28.0, it became impossible to apply v1alpha1 APIBindings. The error would look like this:

The APIBinding "foo" is invalid:
* spec.permissionClaims[0]: Invalid value: "object": either "all" or "resourceSelector" must be set
* spec.permissionClaims[1]: Invalid value: "object": either "all" or "resourceSelector" must be set
* spec.permissionClaims[2]: Invalid value: "object": either "all" or "resourceSelector" must be set

We found out that this is happening because the APIBinding admission is mishandling the v1alpha1 API version. The admission plugin would receive the v1alpha1 version of the object, but it would unpack it into the v1alpha2 struct leading to data loss. At the end, the admission plugin would write back the v1alpha2 object, causing further issues in addition to the data loss.

This PR modifies the admission plugin to be able to handle both v1alpha1 and v1alpha2 API versions. The implementation is based on #3539, i.e. I implemented an interface for APIBindings with functions needed by the admission plugin, then there are two implementations of that interface, for v1alpha1 and v1alpha2. I also added some simple unit tests to the APIBindings admission plugin to make sure we test this scenario in the CI.

Alternative considered was that we do conversion inside the APIBindings admission plugin, that would:

• Add some unnecessary load (convert v1alpha1 to v1alpha2, eventually convert old object to v1alpha2 in case of updates, then convert both back to v1alpha1)
• Introduce some more edge cases (conversion expects already valid object, however CEL validation happens in validating admission, so after mutating admission is done, which is too late in this case)

This is technically a workaround for not having internal types, which should be our goal for the future. I'll create a ticket to track that.

This will need to be cherry-picked to v0.28.

What Type of PR Is This?

/kind bug
/kind regression

Related Issue(s)

Fixes #3527

Release Notes

Fix APIBinding admission mishandling v1alpha1 API version. This fixes the bug where it was impossible to apply v1alpha1 APIBindings

/assign @xrstf @embik @mjudeikis

[mjudeikis]

Just small nit. Can we make name different so language server would not pick it or make it internal?

[kcp-ci-bot]

LGTM label has been added.

Git tree hash: efc3dde452b166308d184ec650954e824835f024

[mjudeikis]

/hold
unhold when ready

[xmudrii]

/cherrypick release-0.28
(this should be a straightforward cherry-pick)
(I hope we have the cherrypick bot here)

[kcp-ci-bot]

@xmudrii: once the present PR merges, I will cherry-pick it on top of release-0.28 in a new PR and assign it to you.

In response to this:

/cherrypick release-0.28
(this should be a straightforward cherry-pick)
(I hope we have the cherrypick bot here)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[xmudrii]

/test pull-kcp-test-integration
TestWorkspaceDeletionLeak flake (a known issue)

[xrstf]

/approve
/lgtm

[kcp-ci-bot]

LGTM label has been added.

Git tree hash: 24fb2d7a82c68a68d327198ed7b19f146a74d6c7

[kcp-ci-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: xrstf

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• pkg/admission/OWNERS [xrstf]
• sdk/apis/OWNERS [xrstf]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[mjudeikis]

/hold cancel

[kcp-ci-bot]

@xmudrii: new pull request created: #3544

In response to this:

/cherrypick release-0.28
(this should be a straightforward cherry-pick)
(I hope we have the cherrypick bot here)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.