⚠️ ClusterWorkspace => LogicalCluster refactor

[sttts]

High-level overview: https://hackmd.io/Qb3HX2XGRV63Rt-83dZXNg

TODOs:

• Rename ThisWorkspace to LogicalCluster, group core.kcp.dev.
• Rename ClusterWorkspaceShard to Shard, group core.kcp.dev.
• Rename ClusterWorkspaceType to WorkspaceType.
• Rename tenancy.kcp.dev/path to kcp.dev/paths, and move into core package.
• create ThisWorkspace in some logical cluster that is NOT the workspace path: base36(sha224(random)) and name with cluster name.
• Rename LogicalCluster objects to "cluster"

Revisit:

• @s-urbaniak REVISIT(sur): Revert "SQUASH: enhance godoc"
• @s-urbaniak REVISIT(sur): Revert "pkg/authorization: add delegation reason in audit"
• @p0lyn0mial REVISIT(lukasz): skip quota and homeworkspace checks for thisworkspac…
• @davidfestal @jmprusi REVISIT(dfestal): e2e/virtual/syncer: disable test depending on root:…
• @sttts REVISIT(sttts): special case thisworkspaces as identity-less

Follow-ups:

• @sttts update https://hackmd.io/Qb3HX2XGRV63Rt-83dZXNg and copy into enhancement repo
• Rename kcp.dev everywhere (including groups) to *.kcp.io 🌱 replace kcp.dev by kcp.io logicalcluster#31 WIP: replace kcp.dev by kcp.io kubernetes#125 ⚠️ WIP: kcp.dev -> kcp.io #2517 ⚠️ replace kcp.dev by kcp.io #2523
• Remove ClusterWorkspace and the projection. @stevekuznetsov 🌱 *: remove tenancy.kcp.dev/v1alpha1.ClusterWorkspace #2543
• Replace kcp.dev/cluster in logicalcluster/v3.
• Move workspace.status.cluster to spec @vincepri ⚠️ Move Workspace.Status.{Cluster, URL} to Spec #2557
• @ncdc 🌱 Add indexers.ByPathAndName helper #2516 Add an indexer helper for getting by path, path+name
• Have ClusterNameFrom return a Name, not a string
• Rename SystemBoundCRDSClusterName to SystemBoundCRDsClusterName 🌱 *: s/SystemBoundCRDSClusterName/SystemBoundCRDsClusterName/g #2521
• Replace all references to this with cluster or something like that 🌱 :*: use 'logicalCluster' instead of 'this' #2524
• @vincepri Replace all instances of "cluster workspace" or "clusterworkspace" with appropriate new terms
• @p0lyn0mial Add unit tests for pathannotation admission (🌱 add missing unit tests for the pathannotation admission plugin #2535)
• @p0lyn0mial Add unit tests for pkg/index/index.go (🌱 add missing unit tests for the index #2565)
• @p0lyn0mial Add unit tests for pkg/index/rewriters
• Extract logic from pkg/proxy/handler.go shardHandler into separate method & add unit tests
• @ncdc 🌱 Use deletion handling keyfunc where needed #2519 Make sure all enqueue() functions that go from obj->key use DeletionHandlingMetaClusterNamespaceKeyFunc
• Update all API godoc to separate markers from actual docs
• Remove all uses of SetMultiClusterRoundTripper and mark it deprecated (or delete it) 🌱 logicalcluster deletion: switch to .Cluster() #2520 🌱 test/e2e: remove MultiClusterRoundTripper #2522
• Remove logicalcluster.WithCluster helper. 1st PR 🌱 remove unused ClusterRoundTripper apimachinery#66, bump WIP: 🌱 bump github.com/kcp-dev/apimachinery #2552
• Logical cluster deleter finalizeWorkspace godoc is wrong
• Logical cluster deleter should use patch instead of update when removing finalizers
• Move deletion of logical cluster rbac data to owner refs/gc
• Log swallowed errors in apibinding_admission
• kubectl kcp bind validation broken: error: fully qualified reference to workspace where APIExport exists is required. The format is root:<ws>:<apiexport> ✨ APIExportEndpointSlice reconciliation #2432

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ncdc

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [ncdc]
• config/crds/OWNERS [ncdc]
• pkg/admission/OWNERS [ncdc]
• pkg/apis/OWNERS [ncdc]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sttts]

/retest

[ncdc]

Hit #2501

[ncdc]

=== FAIL: test/e2e/apibinding TestAPIBindingAPIExportReferenceImmutability (49.16s)
    kcp.go:127: shared kcp server will target configuration "/go/src/github.com/kcp-dev/kcp/.kcp/admin.kubeconfig"
    assertions.go:1691: Waiting for condition, but got: workspace phase is Initializing, not Ready
    workspaces.go:142: Created root:organization workspace root:e2e-workspace-7mp22
    assertions.go:1691: Waiting for condition, but got: workspace phase is Initializing, not Ready
    workspaces.go:142: Created root:universal workspace 57vxee58had43wkn:service-provider-1
    assertions.go:1691: Waiting for condition, but got: workspace phase is Initializing, not Ready
    workspaces.go:142: Created root:universal workspace 57vxee58had43wkn:consumer-1-bound-against-1
    apibinding_test.go:74: Create an APIExport today-cowboys in "k4gbt3w1old718qw"
    apibinding_test.go:97: Create an APIBinding in "8pxokwmrdqcjioq9" that points to the today-cowboys export from "k4gbt3w1old718qw"
    apibinding_test.go:125: 
        	Error Trace:	apibinding_test.go:125
        	Error:      	Error "apibindings.apis.kcp.dev \"cowboys\" is forbidden: unable to update APIBinding: no permission to bind to export k4gbt3w1old718qw:other-export" does not contain "APIExport reference must not be changed"
        	Test:       	TestAPIBindingAPIExportReferenceImmutability

We swallow the errors that would indicate why 😦

[ncdc]

/retest

[ncdc]

=== CONT  TestPlacementUpdate
    syncer.go:594: checking secret kcp-syncer-synctarget-634511-m74yaiva/default-token-m5fjt for annotation kubernetes.io/service-account.name=kcp-syncer-synctarget-634511-m74yaiva
    syncer.go:594: checking secret kcp-syncer-synctarget-634511-m74yaiva/kcp-syncer-synctarget-634511-m74yaiva for annotation kubernetes.io/service-account.name=kcp-syncer-synctarget-634511-m74yaiva
    syncer.go:594: checking secret kcp-syncer-synctarget-634511-m74yaiva/kcp-syncer-synctarget-634511-m74yaiva-token for annotation kubernetes.io/service-account.name=kcp-syncer-synctarget-634511-m74yaiva
I1220 19:42:33.229391   28635 syncer.go:79] "starting syncer" syncTarget.workspace="211wd4ehtyqtyd6q" syncTarget.name="synctarget-634511"
I1220 19:42:33.231408   28635 syncer.go:106] "attempting to retrieve the Syncer virtual workspace URL" syncTarget.workspace="211wd4ehtyqtyd6q" syncTarget.name="synctarget-634511"
    syncer.go:372: 
        	Error Trace:	syncer.go:372
        	            				placement_scheduler_test.go:70
        	Error:      	Received unexpected error:
        	            	the server has asked for the client to provide credentials
        	Test:       	TestPlacementUpdate
        	Messages:   	syncer failed to start
    syncer.go:202: Collecting imported resource info: /logs/artifacts/TestPlacementUpdate/3876109408/artifacts
I1220 19:42:33.311067   28635 reflector.go:255] Listing and watching *unstructured.Unstructured from k8s.io/client-go@v0.0.0-20221215125340-abcb3d0c8338/tools/cache/reflector.go:167
    syncer.go:211: Error gathering /v1, Resource=services: the server could not find the requested resource
    syncer.go:211: Error gathering networking.k8s.io/v1, Resource=ingresses: the server could not find the requested resource
    syncer.go:211: Error gathering apps/v1, Resource=deployments: the server could not find the requested resource
--- FAIL: TestPlacementUpdate (83.76s)

https://prow.ci.openshift.org/view/gs/origin-ci-test/pr-logs/pull/kcp-dev_kcp/2510/pull-ci-kcp-dev-kcp-main-e2e-shared/1605285968393277440

[ncdc]

/retest

[sttts]

/retest

[sttts]

🎉

[sttts]

@ncdc Re: Move deletion of logical cluster rbac data to owner refs/gc

This would require blocking the LogicalCluster deletion as otherwise no gc is running for the logical cluster. Doesn't make the logic simpler, does it?

[ncdc]

@sttts I thought there was maybe a TODO somewhere for that, but now I'm not seeing it. If it's not worth it, we can cross it off the list