feat: add rolebindings to rules api (#2032)

* feat: add rolebindings to rules api

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: add rolebindings to rules api

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: add rolebindings to rules api

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: add rolebindings to rules api

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: add rolebindings to rules api

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: implement review

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

---------

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

pkg/api/rbac/additional_role_bindings.go

@@ -13,7 +13,7 @@ import (
 
 type AdditionalRoleBindingsSpec struct {
 	ClusterRoleName string `json:"clusterRoleName"`
-	// kubebuilder:validation:Minimum=1
+	// +kubebuilder:validation:MinItems=1
 	Subjects []rbacv1.Subject `json:"subjects"`
 	// Additional Labels for the synchronized rolebindings
 	Labels map[string]string `json:"labels,omitempty"`

pkg/api/rules/permission_types.go

@@ -5,10 +5,15 @@ package rules
 
 import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/projectcapsule/capsule/pkg/api/rbac"
 )
 
 // +kubebuilder:object:generate=true
 type NamespaceRulePermissionBody struct {
+	// Bindings defines additional RoleBindings for namespaces selected by this rule.
+	Bindings []rbac.AdditionalRoleBindingsSpec `json:"bindings,omitempty"`
+
 	// Define Promotion Rules which distributed additional ClusterRoles across the Tenant
 	// for promoted ServiceAccounts.
 	Promotions []*NamespaceRulePromotionRule `json:"promotions,omitempty"`

pkg/api/rules/zz_generated.deepcopy.go

@@ -8,6 +8,7 @@
 package rules
 
 import (
+	"github.com/projectcapsule/capsule/pkg/api/rbac"
 	"github.com/projectcapsule/capsule/pkg/api/runtime"
 	"k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -212,6 +213,13 @@ func (in *NamespaceRuleEnforceWorkloadsBody) DeepCopy() *NamespaceRuleEnforceWor
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *NamespaceRulePermissionBody) DeepCopyInto(out *NamespaceRulePermissionBody) {
 	*out = *in
+	if in.Bindings != nil {
+		in, out := &in.Bindings, &out.Bindings
+		*out = make([]rbac.AdditionalRoleBindingsSpec, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
 	if in.Promotions != nil {
 		in, out := &in.Promotions, &out.Promotions
 		*out = make([]*NamespaceRulePromotionRule, len(*in))