feat: add administrator capabilities (#2049)

* feat: implement performance optimizations Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat: add administrator capabilities Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat: add administrator capabilities Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * chore * feat: add administrator capabilities Signed-off-by: Oliver Baehler <oliver@sudo-i.net> --------- Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
2026-08-19 04:26:45 +00:00 · 2026-07-23 00:09:23 +02:00
parent 84e8dca31e
commit e8ac32d364
23 changed files with 1441 additions and 196 deletions
@@ -8,6 +8,7 @@ import (
 	"testing"

 	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"

 	capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2"
@@ -81,6 +82,78 @@ func TestAddTenantNameLabel(t *testing.T) {
 	}
 }

+func TestHasConsistentTenantReference(t *testing.T) {
+	t.Parallel()
+
+	tenantRef := func(name string) metav1.OwnerReference {
+		return metav1.OwnerReference{
+			APIVersion: capsulev1beta2.GroupVersion.String(),
+			Kind:       tenant.ObjectReferenceTenantKind,
+			Name:       name,
+		}
+	}
+
+	tests := []struct {
+		name string
+		ns   *corev1.Namespace
+		want bool
+	}{
+		{name: "nil namespace", want: true},
+		{name: "unmanaged namespace", ns: &corev1.Namespace{}, want: true},
+		{
+			name: "matching label and owner reference",
+			ns: &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{
+				Labels:          map[string]string{meta.TenantLabel: "green"},
+				OwnerReferences: []metav1.OwnerReference{tenantRef("green")},
+			}},
+			want: true,
+		},
+		{
+			name: "label only",
+			ns: &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{
+				Labels: map[string]string{meta.TenantLabel: "green"},
+			}},
+			want: false,
+		},
+		{
+			name: "owner reference only",
+			ns: &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{
+				OwnerReferences: []metav1.OwnerReference{tenantRef("green")},
+			}},
+			want: false,
+		},
+		{
+			name: "mismatched label and owner reference",
+			ns: &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{
+				Labels:          map[string]string{meta.TenantLabel: "green"},
+				OwnerReferences: []metav1.OwnerReference{tenantRef("blue")},
+			}},
+			want: false,
+		},
+		{
+			name: "multiple tenant owner references",
+			ns: &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{
+				Labels: map[string]string{meta.TenantLabel: "green"},
+				OwnerReferences: []metav1.OwnerReference{
+					tenantRef("green"),
+					tenantRef("blue"),
+				},
+			}},
+			want: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			if got := tenant.HasConsistentTenantReference(tt.ns); got != tt.want {
+				t.Fatalf("HasConsistentTenantReference() = %t, want %t", got, tt.want)
+			}
+		})
+	}
+}
+
 func TestBuildInstanceMetadataForNamespace_NoInstance(t *testing.T) {
 	t.Parallel()

@@ -39,6 +39,23 @@ func HasTenantReference(ns *corev1.Namespace) bool {
 	return false
 }

+// HasConsistentTenantReference reports whether Tenant ownership is either
+// completely absent or represented by one matching label and ownerReference.
+func HasConsistentTenantReference(ns *corev1.Namespace) bool {
+	if ns == nil {
+		return true
+	}
+
+	label := TenanLabelValue(ns)
+	refs := TenantOwnerReferences(ns)
+
+	if label == "" {
+		return len(refs) == 0
+	}
+
+	return len(refs) == 1 && refs[0].Name == label
+}
+
 func TenantOwnerReferences(ns *corev1.Namespace) []metav1.OwnerReference {
 	if ns == nil {
 		return nil