feat!: share a GitProvider across namespaces, and key the branch worker by repository

api/v1alpha3/gitprovider_types.go

@@ -48,6 +48,13 @@ type GitProviderSpec struct {
 	// +optional
 	KnownHostsRef *KnownHostsReference `json:"knownHostsRef,omitempty"`
 
+	// AccessFrom is the policy for which OTHER namespaces may reference this GitProvider from a
+	// GitTarget. This GitProvider's own namespace is always admitted. Empty (or omitted) admits no
+	// other namespace. A GitTarget admitted from another namespace writes with this provider's
+	// credential, commit identity and allowedBranches, as one in its own namespace does.
+	// +optional
+	AccessFrom *NamespaceMatcher `json:"accessFrom,omitempty"`
+
 	// AllowedBranches restricts which branches can be written to.
 	// +required
 	// +kubebuilder:validation:MinItems=1
@@ -391,6 +398,16 @@ type GitProviderList struct {
 	Items []GitProvider `json:"items"`
 }
 
+// AdmitsNamespace reports whether a GitTarget in namespace (by name and labels) may write through
+// this GitProvider: its own namespace always, another one only as spec.accessFrom admits it. A
+// malformed selector is an error, never a silent allow.
+func (p *GitProvider) AdmitsNamespace(nsName string, nsLabels map[string]string) (bool, error) {
+	if nsName == p.Namespace {
+		return true, nil
+	}
+	return p.Spec.AccessFrom.Matches(nsName, nsLabels)
+}
+
 func init() {
 	SchemeBuilder.Register(&GitProvider{}, &GitProviderList{})
 }

api/v1alpha3/gittarget_types.go

@@ -5,6 +5,7 @@ package v1alpha3
 import (
 	meta "github.com/fluxcd/pkg/apis/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
 )
 
 // GitTargetSpec defines the desired state of GitTarget.
@@ -37,12 +38,14 @@ import (
 // +kubebuilder:validation:XValidation:rule="self.clusterProviderRef == oldSelf.clusterProviderRef",message="spec.clusterProviderRef is immutable; delete and recreate the GitTarget to change the cluster it mirrors"
 // +kubebuilder:validation:XValidation:rule="!has(self.onRefusal) || self.onRefusal != 'Reapply' || has(self.applyTriggerRef)",message="spec.onRefusal: Reapply needs spec.applyTriggerRef, the trigger asked to reapply"
 type GitTargetSpec struct {
-	// GitProviderRef names the GitProvider that backs this target, in this GitTarget's own
-	// namespace. Many GitTargets may name the same GitProvider.
+	// GitProviderRef names the GitProvider that backs this target. Namespace omitted means this
+	// GitTarget's own namespace. A GitProvider in another namespace is used only while its
+	// spec.accessFrom admits this GitTarget's namespace. Many GitTargets may name the same
+	// GitProvider, and every GitTarget writing one repository branch must name the same one.
 	// Immutable: delete and recreate the GitTarget to change its destination.
 	// +required
 	// +kubebuilder:validation:XValidation:rule="self.name != ''",message="spec.gitProviderRef.name must not be empty"
-	GitProviderRef meta.LocalObjectReference `json:"gitProviderRef"`
+	GitProviderRef meta.NamespacedObjectReference `json:"gitProviderRef"`
 
 	// Branch to use for this target.
 	// Must be one of the allowed branches in the provider.
@@ -671,6 +674,16 @@ func (g *GitTarget) SourceCluster() string {
 	return g.Spec.ClusterProviderRef.Name
 }
 
+// GitProviderKey is the GitProvider this GitTarget writes through: spec.gitProviderRef, in this
+// GitTarget's own namespace unless the reference names another one.
+func (g *GitTarget) GitProviderKey() types.NamespacedName {
+	namespace := g.Spec.GitProviderRef.Namespace
+	if namespace == "" {
+		namespace = g.Namespace
+	}
+	return types.NamespacedName{Namespace: namespace, Name: g.Spec.GitProviderRef.Name}
+}
+
 // IsLocalSource reports whether this GitTarget references the "default" ClusterProvider, which the
 // watch data plane maps to its local cluster context. It is a NAME test, not a claim about the
 // physical cluster: a "default" provider may carry a kubeConfig. It only supplies the pre-discovery

config/crd/bases/configbutler.ai_gitproviders.yaml

@@ -60,6 +60,73 @@ spec:
           spec:
             description: spec defines the desired state of GitProvider
             properties:
+              accessFrom:
+                description: |-
+                  AccessFrom is the policy for which OTHER namespaces may reference this GitProvider from a
+                  GitTarget. This GitProvider's own namespace is always admitted. Empty (or omitted) admits no
+                  other namespace. A GitTarget admitted from another namespace writes with this provider's
+                  credential, commit identity and allowedBranches, as one in its own namespace does.
+                properties:
+                  names:
+                    description: |-
+                      Names is an explicit allow-list of namespace names. Entries are namespace names (DNS-1123
+                      labels), never patterns — `*` is rejected. To admit every namespace, declare `selector: {}`.
+                    items:
+                      maxLength: 63
+                      minLength: 1
+                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                      type: string
+                    type: array
+                    x-kubernetes-list-type: set
+                  selector:
+                    description: |-
+                      Selector is a label selector matched against Namespace labels; a namespace whose labels
+                      match is admitted. ORed with Names.
+                    properties:
+                      matchExpressions:
+                        description: matchExpressions is a list of label selector
+                          requirements. The requirements are ANDed.
+                        items:
+                          description: |-
+                            A label selector requirement is a selector that contains values, a key, and an operator that
+                            relates the key and values.
+                          properties:
+                            key:
+                              description: key is the label key that the selector
+                                applies to.
+                              type: string
+                            operator:
+                              description: |-
+                                operator represents a key's relationship to a set of values.
+                                Valid operators are In, NotIn, Exists and DoesNotExist.
+                              type: string
+                            values:
+                              description: |-
+                                values is an array of string values. If the operator is In or NotIn,
+                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                the values array must be empty. This array is replaced during a strategic
+                                merge patch.
+                              items:
+                                type: string
+                              type: array
+                              x-kubernetes-list-type: atomic
+                          required:
+                          - key
+                          - operator
+                          type: object
+                        type: array
+                        x-kubernetes-list-type: atomic
+                      matchLabels:
+                        additionalProperties:
+                          type: string
+                        description: |-
+                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                          map is equivalent to an element of matchExpressions, whose key field is "key", the
+                          operator is "In", and the values array contains only "value". The requirements are ANDed.
+                        type: object
+                    type: object
+                    x-kubernetes-map-type: atomic
+                type: object
               allowedBranches:
                 description: AllowedBranches restricts which branches can be written
                   to.

config/crd/bases/configbutler.ai_gittargets.yaml

@@ -323,13 +323,19 @@ spec:
                 type: object
               gitProviderRef:
                 description: |-
-                  GitProviderRef names the GitProvider that backs this target, in this GitTarget's own
-                  namespace. Many GitTargets may name the same GitProvider.
+                  GitProviderRef names the GitProvider that backs this target. Namespace omitted means this
+                  GitTarget's own namespace. A GitProvider in another namespace is used only while its
+                  spec.accessFrom admits this GitTarget's namespace. Many GitTargets may name the same
+                  GitProvider, and every GitTarget writing one repository branch must name the same one.
                   Immutable: delete and recreate the GitTarget to change its destination.
                 properties:
                   name:
                     description: Name of the referent.
                     type: string
+                  namespace:
+                    description: Namespace of the referent, when not specified it
+                      acts as LocalObjectReference.
+                    type: string
                 required:
                 - name
                 type: object

docs/TODO.md

@@ -115,6 +115,8 @@ rebuild fails is no longer dropped: it stays pending for that retry
   refusing rather than reporting when a governing root disappears, a CRD default for
   `placement.default` (legibility only, since #319 removed the correctness objection), and a
   namespace-local `GitProvider` so three targets in three namespaces need not copy one credential.
+  That last one is answered: a `GitTarget` may name a `GitProvider` in another namespace, which
+  its `spec.accessFrom` admits.
 
 - [ ] Reduce duplication between `WatchRule` and `ClusterWatchRule` code paths where it makes sense.
 

docs/UPGRADING.md

@@ -7,6 +7,58 @@ guidance that the changelog's breaking-change entries link to.
 We are pre-1.0, so breaking changes bump the **minor** version (release-please is configured with
 `bump-minor-pre-major`) rather than the major. Read the relevant entry before upgrading across it.
 
+## One `GitProvider` per repository branch; a `GitTarget` may name one in another namespace
+
+**Breaking.** A branch worker is now keyed by repository and branch, and pushes with one
+`GitProvider`'s credential. So every `GitTarget` that writes one repository branch must name the same
+`GitProvider`. Where two `GitProvider`s name one repository (compared as URLs, so an `https://` and an
+SSH spelling of the same repository are one) and their `GitTarget`s write the same branch, the
+`GitProvider` of the oldest `GitTarget` that may write there keeps the branch (one its providers do
+not admit decides nothing). Every `GitTarget` writing it through another
+`GitProvider` stops writing and reports `Validated=False` (`TargetConflict`), with a message that
+names the `GitProvider` to share. Two `GitProvider`s for one repository on different branches are
+unaffected.
+
+To share one `GitProvider` across namespaces, admit the other namespaces on it, and point their
+`GitTarget`s at it:
+
+```yaml
+kind: GitProvider
+metadata: {name: monorepo, namespace: platform}
+spec:
+  accessFrom:
+    names: [team-a, team-b]      # or selector:, matched against Namespace labels
+---
+kind: GitTarget
+metadata: {name: apps, namespace: team-a}
+spec:
+  gitProviderRef: {name: monorepo, namespace: platform}
+```
+
+`spec.gitProviderRef` is immutable, so a `GitTarget` that has to move to the shared `GitProvider`
+is deleted and recreated. A `GitTarget` that names a `GitProvider` in another namespace whose
+`spec.accessFrom` does not admit it reports `Validated=False` (`NamespaceNotAuthorized`). Before
+upgrading, list the repositories more than one `GitProvider` names:
+
+```bash
+kubectl get gitproviders -A -o jsonpath='{range .items[*]}{.spec.url}{"\t"}{.metadata.namespace}/{.metadata.name}{"\n"}{end}' | sort
+```
+
+The list sorts the URLs as written, so an `https://` and an SSH spelling of one repository land
+apart: compare host and path, ignoring the scheme, the user, a trailing `.git` and case.
+
+The metrics keep their `provider_namespace` and `provider_name` labels, which now name the one
+`GitProvider` that owns the branch. Log lines name a branch as `repository@branch`.
+
+## `FluxTrigger` `spec.quietPeriod` and `status.source.prefetch` are removed
+
+**Breaking.** An apply no longer waits for a quiet branch: the branch worker publishes what is
+pending, then applies, so `spec.quietPeriod` has nothing left to set. The source prefetch is gone
+with `status.source.prefetch`. Server-side apply and `kubectl`'s strict field validation reject a
+`FluxTrigger` manifest that still sets `spec.quietPeriod`; a client with field validation off drops
+the field without an error. Remove `spec.quietPeriod` from your `FluxTrigger` manifests before
+upgrading. Nothing replaces either field.
+
 ## `allowAnySourceNamespace` is gone; `allowCrossNamespace.sources` replaces it
 
 **Breaking.** `ClusterProvider.spec.allowAnySourceNamespace` is no longer read.

docs/api-first-publication.md

@@ -35,7 +35,7 @@ a push, the [apply trigger design](design/apply-trigger.md) covers what follows
 
 ## The structures and their responsibilities
 
-One branch worker serializes writes for each `(GitProvider namespace, GitProvider name, branch)`.
+One branch worker serializes writes for each repository branch.
 Targets on that worker share its queue, checkout, and push cooldown. Their commit settings and
 destination paths remain target-specific.