feat: add globalresourcequota api (#2068)

* feat: add globalresourcequota api

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

hack/distro/capsule/example-setup/global-resource-quotas.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: capsule.clastix.io/v1beta2
+kind: GlobalResourceQuota
+metadata:
+  name: green-shared-compute
+spec:
+  namespaceSelectors:
+    - matchLabels:
+        capsule.clastix.io/tenant: green
+  quota:
+    hard:
+      limits.cpu: "8"
+      limits.memory: 16Gi
+      requests.cpu: "8"
+      requests.memory: 16Gi

hack/distro/capsule/example-setup/kustomization.yaml

@@ -5,5 +5,6 @@ resources:
   - tenants.yaml
   - resource.yaml
   - pools.yaml
+  - global-resource-quotas.yaml
   - rbac.yaml
   - custom-quotas.yaml

hack/distro/capsule/example-setup/tenants.yaml

@@ -10,37 +10,62 @@ spec:
     - name: alice
       kind: User
   rules:
+    - namespaceSelector:
+        matchExpressions:
+          - key: env
+            operator: In
+            values:
+              - "test"
+      quota:
+        - name: "max-pods"
+          hard:
+            pods: "10"
+      permissions:
+        promotions:
+          - clusterRoles:
+              - "secret-replicator"
     - quota:
-        - hard:
+        - name: shared-compute
+          hard:
             limits.cpu: "8"
             limits.memory: 16Gi
             requests.cpu: "8"
             requests.memory: 16Gi
-      classes:
-        gateway:
-          - matchLabels:
-              team: platform
-        ingress:
-          - matchLabels:
-              team: platform
-        storage:
-          - matchLabels:
-              team: platform
-        priority:
-          - matchLabels:
-              team: platform
-        runtime:
-          - matchLabels:
-              team: platform
-        cluster:
-          - matchLabels:
-              team: platform
-            namespaceSelector:
-              matchExpressions:
-                - key: env
-                  operator: In
-                  values:
-                    - "test"
+      # classes:
+      #   cluster:
+      #     - matchLabels:
+      #         team: platform
+      #       namespaceSelector:
+      #         matchExpressions:
+      #           - key: env
+      #             operator: In
+      #             values:
+      #               - "test"
+      # classes:
+      #  gateway:
+      #    - matchLabels:
+      #        team: platform
+      #  ingress:
+      #    - matchLabels:
+      #        team: platform
+      #  storage:
+      #    - matchLabels:
+      #        team: platform
+      #  priority:
+      #    - matchLabels:
+      #        team: platform
+      #  runtime:
+      #    - matchLabels:
+      #        team: platform
+      #  cluster:
+      #    - matchLabels:
+      #        team: platform
+      #      namespaceSelector:
+      #        matchExpressions:
+      #          - key: env
+      #            operator: In
+      #            values:
+      #              - "test"
 
       permissions:
         bindings:
@@ -60,7 +85,7 @@ spec:
               - "Namespace"
             labels:
               pod-security.kubernetes.io/enforce:
-                managed: "restricted"
+                managed: "baseline"
     - audience:
         - kind: "Custom"
           name: "CapsuleUser"
@@ -101,16 +126,6 @@ spec:
     additionalMetadataList:
       - labels:
           customer: a
-  resourceQuotas:
-    scope: Tenant
-    items:
-    - hard:
-        limits.cpu: "8"
-        limits.memory: 16Gi
-        requests.cpu: "8"
-        requests.memory: 16Gi
-    - hard:
-        pods: "10"
 ---
 apiVersion: capsule.clastix.io/v1beta2
 kind: Tenant
@@ -155,25 +170,6 @@ spec:
           ports:
             - from: 30000
               to: 32767
-  - enforce:
-      action: "allow"
-      metadata:
-        - kinds:
-            - "ConfigMap"
-          labels:
-            "corp.com/tenant":
-              required: true
-              values:
-                - exact:
-                    - test
-          annotations:
-            "example.corp/cost-center":
-              required: true
-              values:
-                - exp: "^INV-[0-9]{4}$"
-                  exact:
-                    - prod
-                    - test
 ---
 apiVersion: capsule.clastix.io/v1beta2
 kind: Tenant

hack/kind-cluster.yaml

@@ -4,6 +4,8 @@ apiVersion: kind.x-k8s.io/v1alpha4
 name: capsule
 featureGates:
   ImageVolume: true
+  # Alpha and disabled by default on the Kubernetes 1.32 and 1.33 e2e jobs.
+  PodLevelResources: true
 nodes:
 - role: control-plane
 - role: worker