[v0.5] Populate backing namespace field for projects (#533)

* Populate backing namespace field for projects

* Address comments

docs.md

@@ -200,6 +200,9 @@ This admission webhook prevents the disabling or deletion of a NodeDriver if the
 
 ClusterName must be equal to the namespace, and must refer to an existing management.cattle.io/v3.Cluster object. In addition, users cannot update the field after creation. 
 
+#### BackingNamespace validation
+The `BackingNamespace` field cannot be changed once set. Projects without the `BackingNamespace` field can have it added.
+
 #### Protects system project
 
 The system project cannot be deleted.
@@ -219,8 +222,17 @@ Limits for any resource must not be less than requests.
 
 #### On create
 
+Populates the `BackingNamespace` field by concatenating `Project.ClusterName` and `Project.Name`.
+
+If the project is using a generated name (ie `GenerateName` is not empty), the generation happens within the mutating webhook.
+The reason for this is that the BackingNamespace is made up of the `Project.Name`, and name generation happens after mutating webhooks and before validating webhooks.
+
 Adds the authz.management.cattle.io/creator-role-bindings annotation.
 
+#### On update
+
+If the `BackingNamespace` field is empty, it's populated with the project name.
+
 ## ProjectRoleTemplateBinding 
 
 ### Validation Checks
@@ -239,7 +251,6 @@ Users cannot create ProjectRoleTemplateBindings that violate the following const
 - The `ProjectName` field must be:
     - Provided as a non-empty value
     - Specified using the format of `clusterName:projectName`; `clusterName` is the `metadata.name` of a cluster, and `projectName` is the `metadata.name` of a project
-    - The `projectName` part of the field must match the namespace of the ProjectRoleTemplateBinding
     - Refer to a valid project and cluster (both must exist and project.Spec.ClusterName must equal the cluster)
 - Either a user subject (through `UserName` or `UserPrincipalName`), or a group subject (through `GroupName`
   or `GroupPrincipalName`), or a service account subject (through `ServiceAccount`) must be specified. Exactly one

go.mod

@@ -42,14 +42,14 @@ require (
 	github.com/gorilla/mux v1.8.1
 	github.com/rancher/dynamiclistener v0.6.0
 	github.com/rancher/lasso v0.0.0-20240809125800-8da6f11865d5
-	github.com/rancher/rancher/pkg/apis v0.0.0-20240918011937-2f9a7509687f
-	github.com/rancher/rke v1.6.2
+	github.com/rancher/rancher/pkg/apis v0.0.0-20241030145218-455fc5625e09
+	github.com/rancher/rke v1.6.4-rc.2
 	github.com/rancher/wrangler/v3 v3.0.0
 	github.com/robfig/cron v1.2.0
 	github.com/sirupsen/logrus v1.9.3
 	github.com/stretchr/testify v1.9.0
 	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
-	golang.org/x/text v0.18.0
+	golang.org/x/text v0.19.0
 	golang.org/x/tools v0.24.0
 	k8s.io/api v0.30.2
 	k8s.io/apimachinery v0.30.2
@@ -108,10 +108,10 @@ require (
 	github.com/prometheus/client_model v0.6.1 // indirect
 	github.com/prometheus/common v0.47.0 // indirect
 	github.com/prometheus/procfs v0.14.0 // indirect
-	github.com/rancher/aks-operator v1.9.2 // indirect
-	github.com/rancher/eks-operator v1.9.2 // indirect
+	github.com/rancher/aks-operator v1.9.3 // indirect
+	github.com/rancher/eks-operator v1.9.3 // indirect
 	github.com/rancher/fleet/pkg/apis v0.10.0 // indirect
-	github.com/rancher/gke-operator v1.9.2 // indirect
+	github.com/rancher/gke-operator v1.9.3 // indirect
 	github.com/rancher/norman v0.0.0-20240708202514-a0127673d1b9 // indirect
 	github.com/spf13/cobra v1.8.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
@@ -130,13 +130,13 @@ require (
 	go.opentelemetry.io/proto/otlp v1.0.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
-	golang.org/x/crypto v0.27.0 // indirect
+	golang.org/x/crypto v0.28.0 // indirect
 	golang.org/x/mod v0.20.0 // indirect
-	golang.org/x/net v0.29.0 // indirect
+	golang.org/x/net v0.30.0 // indirect
 	golang.org/x/oauth2 v0.23.0 // indirect
 	golang.org/x/sync v0.8.0 // indirect
-	golang.org/x/sys v0.25.0 // indirect
-	golang.org/x/term v0.24.0 // indirect
+	golang.org/x/sys v0.26.0 // indirect
+	golang.org/x/term v0.25.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 // indirect

go.sum

@@ -154,22 +154,22 @@ github.com/prometheus/common v0.47.0 h1:p5Cz0FNHo7SnWOmWmoRozVcjEp0bIVU8cV7OShpj
 github.com/prometheus/common v0.47.0/go.mod h1:0/KsvlIEfPQCQ5I2iNSAWKPZziNCvRs5EC6ILDTlAPc=
 github.com/prometheus/procfs v0.14.0 h1:Lw4VdGGoKEZilJsayHf0B+9YgLGREba2C6xr+Fdfq6s=
 github.com/prometheus/procfs v0.14.0/go.mod h1:XL+Iwz8k8ZabyZfMFHPiilCniixqQarAy5Mu67pHlNQ=
-github.com/rancher/aks-operator v1.9.2 h1:xlEbRO9qjW0/YoZqbovJXXhkvWsv/NQUrHlI6H9APpg=
-github.com/rancher/aks-operator v1.9.2/go.mod h1:Aj8LdDJ2L4BleF8qqyU6phkzEJ79Z3niHx2SbyT3Cg8=
+github.com/rancher/aks-operator v1.9.3 h1:2xNaXvMCwjLbzFowoOWGa+Vl/e6plc6JizOnBTw+j9Q=
+github.com/rancher/aks-operator v1.9.3/go.mod h1:Aj8LdDJ2L4BleF8qqyU6phkzEJ79Z3niHx2SbyT3Cg8=
 github.com/rancher/dynamiclistener v0.6.0 h1:M7x8Nq+GY0UORULANuW/AH1ocnyZaqlmTuviMQAHL1Q=
 github.com/rancher/dynamiclistener v0.6.0/go.mod h1:7VNEQhAwzbYJ08S1MYb6B4vili6K7CcrG4cNZXq1j+s=
-github.com/rancher/eks-operator v1.9.2 h1:YF8M2Y4Qj0eT8oIcpkS0WWIJjeIUMiY/xFD3XBv7294=
-github.com/rancher/eks-operator v1.9.2/go.mod h1:eQDK+i1UFQQpkTiZmSGX64hpkGLZCju6M9nmaMHcFys=
+github.com/rancher/eks-operator v1.9.3 h1:QuJrIUUUJwScn+7SCcJXYL5vGioeNGL/0Y44luSOpuc=
+github.com/rancher/eks-operator v1.9.3/go.mod h1:bqVuAcd7jsb46U2ysW0ddxnBWaiVEr16dYDsknPmXgY=
 github.com/rancher/fleet/pkg/apis v0.10.0 h1:0f8OEghEDJNzvUAR2fpg2dw8EnAgfWvkhnwsYFS9G+w=
 github.com/rancher/fleet/pkg/apis v0.10.0/go.mod h1:mjirthAmgpz0xo+qywUiaJDFpjnmX3xrc2E0/qmk3yc=
-github.com/rancher/gke-operator v1.9.2 h1:vPoqYX+E4Pq1qmZU6qRHSj4zm4q0hHyLKaMfakvyQag=
-github.com/rancher/gke-operator v1.9.2/go.mod h1:cvks/IUeoYUNzBcqQ24KIKJ3GFcYyerPpLZ/fZ2CpwE=
+github.com/rancher/gke-operator v1.9.3 h1:H8/M0kC3CuiG+W2vP1khF2dHikMVMi0G+v7QyhfcPBg=
+github.com/rancher/gke-operator v1.9.3/go.mod h1:XJK1G3PhobniVCWkMhSIrZCjUtCr4I8j+ZmWT0K8afE=
 github.com/rancher/lasso v0.0.0-20240809125800-8da6f11865d5 h1:qlVhaHTT7wwrI5+AGdkYHpveuoe8Ot4TdQr7LtxmVSk=
 github.com/rancher/lasso v0.0.0-20240809125800-8da6f11865d5/go.mod h1:Efx/+BbH3ivmnTPLu5cA3Gc9wT5oyGS0LBcqEuYTx+A=
 github.com/rancher/norman v0.0.0-20240708202514-a0127673d1b9 h1:AlRMRs5mHJcdiK83KKJyFVeybPMZ7dOUzC0l3k9aUa8=
 github.com/rancher/norman v0.0.0-20240708202514-a0127673d1b9/go.mod h1:dyjfXBsNiroPWOdUZe7diUOUSLf6HQ/r2kEpwH/8zas=
-github.com/rancher/rancher/pkg/apis v0.0.0-20240918011937-2f9a7509687f h1:roiCuVuYV6nT7ApMVFYyHCDIorUlFVrdZBUisI/d+XQ=
-github.com/rancher/rancher/pkg/apis v0.0.0-20240918011937-2f9a7509687f/go.mod h1:npd+q1ySuNMlQ8B1+2Pt917wNDytCJKkNZQG+QcevuI=
+github.com/rancher/rancher/pkg/apis v0.0.0-20241030145218-455fc5625e09 h1:svrjHvtTOJeMrSSHA6QBd4KSTVgRz+O/4ilrt+x6PJY=
+github.com/rancher/rancher/pkg/apis v0.0.0-20241030145218-455fc5625e09/go.mod h1:nr+5f718biWnS633d2yF9R1fn4goY4C2meg8mA+ZfZs=
 github.com/rancher/rke v1.6.2 h1:ttGk77t5oe7bsiS7s7SOFmAl3PALYI5M2SQQenjKevk=
 github.com/rancher/rke v1.6.2/go.mod h1:5xRbf3L8PxqJRhABjYRfaBqbpVqAnqyH3maUNQEuwvk=
 github.com/rancher/wrangler/v3 v3.0.0 h1:IHHCA+vrghJDPxjtLk4fmeSCFhNe9fFzLFj3m2B0YpA=
@@ -250,8 +250,8 @@ go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
-golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
+golang.org/x/crypto v0.28.0 h1:GBDwsMXVQi34v5CCYUm2jkJvu4cbtru2U4TN2PSyQnw=
+golang.org/x/crypto v0.28.0/go.mod h1:rmgy+3RHxRZMyY0jjAJShp2zgEdOqj2AO7U0pYmeQ7U=
 golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8=
 golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -264,8 +264,8 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/net v0.29.0 h1:5ORfpBpCs4HzDYoodCDBbwHzdR5UrLBZ3sOnUJmFoHo=
-golang.org/x/net v0.29.0/go.mod h1:gLkgy8jTGERgjzMic6DS9+SP0ajcu6Xu3Orq/SpETg0=
+golang.org/x/net v0.30.0 h1:AcW1SDZMkb8IpzCdQUaIq2sP4sZ4zw+55h6ynffypl4=
+golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
 golang.org/x/oauth2 v0.23.0 h1:PbgcYx2W7i4LvjJWEbf0ngHV6qJYr86PkAV3bXdLEbs=
 golang.org/x/oauth2 v0.23.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -281,15 +281,15 @@ golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.25.0 h1:r+8e+loiHxRqhXVl6ML1nO3l1+oFoWbnlu2Ehimmi34=
-golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.26.0 h1:KHjCJyddX0LoSTb3J+vWpupP9p0oznkqVk/IfjymZbo=
+golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.24.0 h1:Mh5cbb+Zk2hqqXNO7S1iTjEphVL+jb8ZWaqh/g+JWkM=
-golang.org/x/term v0.24.0/go.mod h1:lOBK/LVxemqiMij05LGJ0tzNr8xlmwBRJ81PX6wVLH8=
+golang.org/x/term v0.25.0 h1:WtHI/ltw4NvSUig5KARz9h521QvRC8RmF/cuYqifU24=
+golang.org/x/term v0.25.0/go.mod h1:RPyXicDX+6vLxogjjRxjgD2TKtmAO6NZBsBRfrOLu7M=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224=
-golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
+golang.org/x/text v0.19.0 h1:kTxAhCbGbxhK0IwgSKiMO5awPoDQ0RpfiVYBfK860YM=
+golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
 golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
 golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

pkg/codegen/main.go

@@ -46,6 +46,7 @@ func main() {
 					v3.Project{},
 					v3.ClusterProxyConfig{},
 					v3.Feature{},
+					v3.Setting{},
 				},
 			},
 			"provisioning.cattle.io": {

pkg/resources/management.cattle.io/v3/globalrolebinding/mutator_test.go

@@ -358,7 +358,7 @@ func Test_MutatorAdmit(t *testing.T) {
 
 				gotObj := &apisv3.GlobalRoleBinding{}
 				err = json.Unmarshal(patchedJS, gotObj)
-				require.NoError(t, err, "failed to unmarshall patched Object")
+				require.NoError(t, err, "failed to unmarshal patched Object")
 
 				require.True(t, equality.Semantic.DeepEqual(test.wantGRB(), gotObj), "patched object and desired object are not equivalent wanted=%#v got=%#v", test.wantGRB(), gotObj)
 			} else {

pkg/resources/management.cattle.io/v3/project/Project.md

@@ -4,6 +4,9 @@
 
 ClusterName must be equal to the namespace, and must refer to an existing management.cattle.io/v3.Cluster object. In addition, users cannot update the field after creation. 
 
+### BackingNamespace validation
+The `BackingNamespace` field cannot be changed once set. Projects without the `BackingNamespace` field can have it added.
+
 ### Protects system project
 
 The system project cannot be deleted.
@@ -23,4 +26,13 @@ Limits for any resource must not be less than requests.
 
 ### On create
 
+Populates the `BackingNamespace` field by concatenating `Project.ClusterName` and `Project.Name`.
+
+If the project is using a generated name (ie `GenerateName` is not empty), the generation happens within the mutating webhook.
+The reason for this is that the BackingNamespace is made up of the `Project.Name`, and name generation happens after mutating webhooks and before validating webhooks.
+
 Adds the authz.management.cattle.io/creator-role-bindings annotation.
+
+### On update
+
+If the `BackingNamespace` field is empty, it's populated with the project name.