pkg/admission: block WS creation if user cannot bind to default exports

[neolit123]

Summary

Block the creation of Workspace based on a custom WorkspaceType, if the user cannot bind to the APIExports requested on the WorkspaceType's defaultAPIBindings.

Extract some common logic from pkg/admission/workspacetype/admission.go in a function apibindingadmission.CheckDefaultAPIBindingsAccess().

i have tested the creation block with a script locally and it works.

What Type of PR Is This?

/kind bug

Related Issue(s)

Fixes #4299
(second attempt)

Release Notes

If the user cannot bind to the default API Bindings present on a `WorkspaceType`, prevent the user from being able to create a `Workspace` object of that type.

[kcp-ci-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign xrstf for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• pkg/admission/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[neolit123]

hmm, unclear why the api/change label was added.

[Copilot]

Pull request overview

This PR adds an admission-time permission gate to prevent creating a Workspace from a WorkspaceType when the requesting user cannot bind to the APIExports referenced by the type’s spec.defaultAPIBindings, and factors the shared authorization logic into a reusable helper in pkg/admission/apibinding.

Changes:

• Add a default-APIBindings access check to the WorkspaceTypeExists admission plugin to block workspace creation early when bind is not permitted.
• Extract common “default APIBindings bind permission” logic into apibindingadmission.CheckDefaultAPIBindingsAccess() and reuse it from the WorkspaceType admission path.
• Add unit tests covering allow/deny scenarios, including inherited bindings through extended types.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
pkg/admission/workspacetypeexists/admission.go	Adds defaultAPIBindings access enforcement during workspace create; wires LogicalCluster lookup helpers/indexers.
pkg/admission/workspacetypeexists/admission_test.go	Adds tests to ensure workspace creation is rejected when bind on default APIExports is missing.
pkg/admission/workspacetype/admission.go	Refactors existing WorkspaceType defaultAPIBindings permission logic to use the shared helper.
pkg/admission/apibinding/binding_permissions.go	Introduces CheckDefaultAPIBindingsAccess helper for centralized default binding authorization checks.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[neolit123]

=== Failed
=== FAIL: test/e2e/workspace TestInactiveLogicalClusterBlocksRequests (59.69s)
    inactive_test.go:83: Saving test artifacts for test "TestInactiveLogicalClusterBlocksRequests" under "/logs/artifacts/TestInactiveLogicalClusterBlocksRequests/302809948".
    inactive_test.go:83: Starting kcp servers...
    fixture.go:316: running: kcp start --root-directory /tmp/TestInactiveLogicalClusterBlocksRequests2709822804/002/kcp/main --secure-port=45357 --embedded-etcd-client-port=46537 --embedded-etcd-peer-port=40707 --embedded-etcd-wal-size-bytes=5000 --kubeconfig-path=/tmp/TestInactiveLogicalClusterBlocksRequests2709822804/002/kcp/main/admin.kubeconfig --audit-log-path /logs/artifacts/TestInactiveLogicalClusterBlocksRequests/302809948/test-inactive-logical-cluster-blocks-requests/kcp/main/kcp.audit --v=4 --feature-gates=DRAExtendedResource=false,SizeBasedListCostEstimate=false,UnknownVersionInteroperabilityProxy

https://public-prow.kcp.k8c.io/view/s3/prow-public-data/pr-logs/pull/kcp-dev_kcp/4311/pull-kcp-test-e2e-shared/2084686180107948032

/retest

[neolit123]

=== Failed
=== FAIL: test/e2e/quota TestKubeQuotaCRDChurn (83.82s)
    quota_test.go:750: Saving test artifacts for test "TestKubeQuotaCRDChurn" under "/logs/artifacts/TestKubeQuotaCRDChurn/2761795242".
I0804 17:42:12.593926   75210 crypto.go:609] "generating new CA for cert" certName="kcp-client-ca" certFile="/tmp/TestKubeQuotaCRDChurn3248012119

/retest

[neolit123]

/retest

=== Failed
=== FAIL: test/e2e/workspacetype TestWorkspaceTypes/create_a_workspace_without_an_explicit_type,_get_default_type (1.05s)
    controller_test.go:339: Created root:organization workspace root:e2e-workspace-gc2p8 as /clusters/2o3vshf2jweoqzbm on shard "root"
    controller_test.go:345: Create a workspace without explicit type
    controller_test.go:345: 
        	Error Trace:	/home/prow/go/src/github.com/kcp-dev/kcp/test/e2e/workspacetype/controller_test.go:69
        	            				/home/prow/go/src/github.com/kcp-dev/kcp/test/e2e/workspacetype/controller_test.go:345
        	Error:      	Received unexpected error:
        	            	the server could not find the requested resource (post workspaces.tenancy.kcp.io)
        	Test:       	TestWorkspaceTypes/create_a_workspace_without_an_explicit_type,_get_default_type
        	Messages:   	failed to create workspace
=== FAIL: test/e2e/workspacetype TestWorkspaceTypes (24.90s)
    controller_test.go:330: Saving test artifacts for test "TestWorkspaceTypes" under "/logs/artifacts/TestWorkspaceTypes/4143773557".
I0804 18:37:15.205684   78372 crypto.go:609] "generating new CA for cert" certName="kcp-client-ca" certFile="/tmp/TestWorkspaceTypes2387278109/003/client-ca.crt" keyFile="/tmp/TestWorkspaceTypes2387278109/003/client-ca.key"

[neolit123]

CI errors seem related

EDIT: NVM, it passed.

[neolit123]

/test pull-kcp-test-e2e-multiple-runs
/test pull-kcp-test-e2e-shared