feat: add discovery context annotations for project-scoped resources - #138
feat: add discovery context annotations for project-scoped resources#138scotwells wants to merge 2 commits into
Conversation
All networking resources are scoped to the Project discovery context. This controls which resources appear in API discovery when querying within a project's control plane. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
kevwilliams
left a comment
kevwilliams
left a comment
There was a problem hiding this comment.
Naming and value format match the established convention (discovery.miloapis.com/parent-contexts, compare compute and dns-operator repos), and RBAC/tests are correctly out of scope since this is static CRD/kubebuilder metadata, not runtime behavior.
One scoping concern: Location is cluster-scoped (kubebuilder:resource:scope=Cluster) but is tagged parent-contexts=Project only. Unlike ConnectorClass here, which matches the existing DNSZoneClass precedent of a cluster-scoped "class" companion type getting Project-only visibility, Location is the primary resource representing shared infrastructure (a datacenter/region), not a per-project owned object. The other cluster-scoped precedent in the org, RuntimeClass in compute, uses parent-contexts=Platform,Project rather than Project alone.
Should Location also include Platform in parent-contexts so it stays visible outside a project control plane, or is Project-only intentional here? Worth confirming before merge since this affects where the resource shows up in discovery.
3 participants
Summary
discovery.miloapis.com/parent-contexts: Projectannotation to all 13 CRD manifests inconfig/crd/bases/+kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Project"kubebuilder marker to all 13 top-level Go resource typesWhy
The Milo API server includes a discovery filter that controls which resources appear in API discovery responses based on the current request context (Platform, Organization, Project, or User). By annotating all networking resources with
parent-contexts: Project, they will only appear in discovery responses when a client queries within a Project's control plane — keeping the API surface clean and contextually appropriate.Affected CRDs
networking.datumapis.com(v1alpha)DomainHTTPProxyLocationNetworkNetworkBindingNetworkContextNetworkPolicySubnetSubnetClaimTrafficProtectionPolicynetworking.datumapis.com(v1alpha1)ConnectorConnectorAdvertisementConnectorClassNotes
The kubebuilder markers were added to the non-List resource types only (i.e., the types with
+kubebuilder:subresource:status). The CRD YAML files were updated directly to match whatcontroller-genwould produce when regenerating from the updated Go markers.