Manifestwork enhancement: query workload status which created by Manifestwork

[zychina]

1. End user wants to run a Job (e.g. tf job) in OCM.
2. End user created a manifestwork in one managed cluster namespace.
3. Managed cluster pull the manifestwork and run on the job.
4. End user wants to know what is the status of the Job (e.g. tf job).

OCM should provide a way to let end user know the status of the real workload (tf job in above scenario).

[yue9944882]

@zychina basically i can think of two approaches to reflect the real-time state of resources in managedcluster to the hub cluster:

• having a gateway/proxy server so that k8s clients can access the apiservers imperatively, ref: Support calling API of the services running in management cluster directly from hub cluster (a.k.a push mode) #73 which is previously discussed in the meeting to automate the installation of https://github.com/kubernetes-sigs/apiserver-network-proxy. by the proxy, the hub cluster will be able to access the target kube-apiserver through the tunnel w/o having any concrete per-cluster credentials.

• have a new resource projection/mapping api which basically list-watches the target resources and reflect the latest status in near real-time.

we will be seeing the first approach landing as a new sub-project really soon in month-ish, or do you have any alternatives in mind?

[zychina]

Yes, I think the first approach has more flexibility if hub cluster could access managedcluster to query resource status, as for some workload (tf job), there will have some other resource belong to it, like pod and service, some advanced user may want to access pod/service resource to do debug work.

Additionally, what is the authorization design for the proxy ? For example in hub cluster, user(controller or real person user) uses a service account or token to access hub cluster api server, then api server forward the request to proxy server. Is there any authorization running on proxy server ? when request proxy to proxy client, then the request will use proxy client service account to forward request to managedcluster api server. What kind of permission for the proxy client service account ? Only query permission ?
The proxy is good to bring convenience, but is also bring some security risk. We need to design the authorization carefully. Like:

1. leverage user's permission in hub cluster, proxy server do authorization on hub cluster before forward the request to managedcluster.
2. only allow the query action to be forwarded.

[qiujian16]

I think it is becoming an important requirement. I will create a doc to collect the use cases and some ideas at first

/assign @qiujian16

[qiujian16]

/kind feature