feat: implement clusterrolebinding primitive by sourcehawk · Pull Request #36 · sourcehawk/operator-component-framework

sourcehawk · 2026-03-22T03:12:09Z

Implements the clusterrolebinding Kubernetes resource primitive following the pattern established by the existing ConfigMap and Deployment primitives.

Summary

Adds clusterrolebinding primitive package under pkg/primitives/clusterrolebinding/
Implements required lifecycle interfaces
Includes editors, mutator, flavors, and builder

Checklist

Compiles cleanly
Tests pass
Follows naming conventions in CONTEXT.md
Does not modify shared files

Copilot

Pull request overview

Adds a new clusterrolebinding primitive to the operator-component-framework, extending the existing primitives system to support Kubernetes ClusterRoleBinding resources with the same builder/mutation/flavor/data-extraction patterns used elsewhere in the framework.

Changes:

Introduces pkg/primitives/clusterrolebinding with builder, resource wrapper, mutator, and field-application flavors (plus tests).
Adds a new shared mutation editor BindingSubjectsEditor for typed .subjects mutations (plus tests).
Adds an end-to-end example and new primitive documentation page for clusterrolebinding.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
pkg/primitives/clusterrolebinding/resource.go	Implements the primitive Resource wrapper and DefaultFieldApplicator (roleRef immutability handling).
pkg/primitives/clusterrolebinding/builder.go	Provides a fluent builder API for configuring mutations/flavors/extractors for ClusterRoleBinding.
pkg/primitives/clusterrolebinding/mutator.go	Adds a plan-and-apply mutator supporting metadata + subjects edits with feature boundaries.
pkg/primitives/clusterrolebinding/flavors.go	Exposes label/annotation preservation flavors for post-baseline field application.
pkg/primitives/clusterrolebinding/*_test.go	Adds unit tests for builder, mutator ordering, and flavor behavior.
pkg/mutation/editors/bindingsubjects.go	Adds a shared editor for typed RoleBinding/ClusterRoleBinding subjects mutations.
pkg/mutation/editors/bindingsubjects_test.go	Adds unit tests for BindingSubjectsEditor behavior.
examples/clusterrolebinding-primitive/**	Adds a runnable example showing builder usage, feature mutations, and extractors.
docs/primitives/clusterrolebinding.md	Adds user-facing documentation for the new primitive.

pkg/primitives/clusterrolebinding/resource.go

pkg/mutation/editors/bindingsubjects.go

examples/clusterrolebinding-primitive/README.md

Copilot

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated 3 comments.

pkg/primitives/clusterrolebinding/builder.go

pkg/primitives/clusterrolebinding/resource.go

pkg/mutation/editors/bindingsubjects.go

Copilot

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated 2 comments.

pkg/primitives/clusterrolebinding/resource.go

docs/primitives/clusterrolebinding.md

sourcehawk · 2026-03-22T13:25:52Z

Claude Review Cycle 1 Complete

Addressed:

ResourceVersion preservation in DefaultFieldApplicator (resource.go:20): The applicator was saving resourceVersion but not restoring it after DeepCopy. Now restores both roleRef and resourceVersion when the object already exists. Added test assertion for ResourceVersion preservation on updates.

Intentionally ignored:

Markdown table format (clusterrolebinding.md:15): The capabilities table already uses standard single-pipe markdown format (| ... | ... |), consistent with other primitive docs. The comment describes a || format that is not present in the file.

Copilot

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated 2 comments.

docs/primitives/clusterrolebinding.md

pkg/mutation/editors/bindingsubjects.go

sourcehawk · 2026-03-22T20:57:23Z

Approved

Copilot

Pull request overview

Copilot reviewed 39 out of 40 changed files in this pull request and generated 4 comments.

pkg/primitives/clusterrolebinding/builder.go

examples/clusterrolebinding-primitive/app/controller.go

pkg/component/create.go

docs/primitives/clusterrolebinding.md

sourcehawk · 2026-03-23T03:25:09Z

Claude Review Cycle 1 Complete

Addressed:

builder.go:25 — Refactored builder to wrap generic.NewStaticBuilder with MarkClusterScoped(), matching the ConfigMap pattern. Eliminates duplicated validation and framework wiring.
controller.go:7 — Updated package and struct comments to reflect current framework behavior: owner references are automatically skipped for cluster-scoped resources with namespace-scoped owners, with a note about GC implications.
clusterrolebinding.md:14 — Updated capabilities table to clarify that Build() validates Name and requires metadata.namespace to be empty (errors if set).

Intentionally ignored:

create.go:39 — This comment is about updating the PR description/checklist, not a code change. Additionally, pkg/component/create.go is not modified in this PR (the diff shows only new files). The shared infrastructure changes referenced (owner reference handling, server-managed metadata) were merged to main separately and are not part of this PR's diff.

Copilot

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated 2 comments.

examples/clusterrolebinding-primitive/README.md

docs/primitives/clusterrolebinding.md

sourcehawk · 2026-03-23T16:58:20Z

Claude Review Cycle 1 Complete

Addressed:

Added clusterrolebinding-primitive to the Makefile run-examples target so CI exercises it alongside other examples
Added clusterrolebinding to the Built-in Primitives table in docs/primitives.md
Added BindingSubjectsEditor to the Mutation Editors table in docs/primitives.md

Intentionally ignored:
None

Copilot

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 1 comment.

docs/primitives.md

Provides typed mutations for the .subjects field of binding resources: Add, Remove, EnsureServiceAccount, RemoveServiceAccount, and Raw. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Static, cluster-scoped primitive with custom validation (name only, no namespace). DefaultFieldApplicator preserves immutable roleRef on updates. Mutator supports metadata and subjects edits via plan-and-apply. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Demonstrates building and mutating a ClusterRoleBinding through multiple spec variations with feature-gated subject mutations, version labels, and field application flavors. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated 5 comments.

pkg/primitives/clusterrolebinding/mutator.go

pkg/mutation/editors/bindingsubjects.go

pkg/primitives/clusterrolebinding/resource_test.go

examples/clusterrolebinding-primitive/features/mutations.go

…rovements - Lazily initialize feature plan in EditObjectMetadata/EditSubjects to prevent nil dereference when BeginFeature() has not been called - Remove side-effect from BindingSubjectsEditor.Raw() (no longer converts nil slice to empty slice on read) - Use safe type assertions (comma-ok + require.True) in resource tests - Add test exercising EditSubjects without prior BeginFeature call - Use EnsureServiceAccount instead of Add in example for idempotency Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

sourcehawk · 2026-03-25T16:16:08Z

Claude Review Cycle 1 Complete

Addressed:

Mutator nil dereference (mutator.go lines 58, 73): Added ensureActive() helper that lazily calls BeginFeature() when m.active == nil, making EditObjectMetadata and EditSubjects safe to call without prior BeginFeature(). Added test TestMutator_EditSubjects_WithoutBeginFeature.
Raw() side-effect (bindingsubjects.go line 34): Removed nil-to-empty-slice initialization from Raw(), making it a pure read operation. append works correctly with nil slices so no initialization is needed.
Unsafe type assertion in test (resource_test.go line 61): Changed bare type assertion to comma-ok form with require.True(t, ok) in both TestResource_Mutate and TestResource_Mutate_WithMutation.
Example using Add instead of EnsureServiceAccount (mutations.go line 41): Replaced e.Add(rbacv1.Subject{...}) with e.EnsureServiceAccount("monitoring-agent", "monitoring") for idempotent, best-practice example code.

Intentionally ignored:
None

Copilot

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated no new comments.

Resolve conflicts in BindingSubjectsEditor by adopting main's improved base (nil-pointer safety, upsert semantics, zeroing on remove) and retaining this branch's convenience methods (EnsureServiceAccount, RemoveServiceAccount). Update docs/primitives.md to include both PolicyRulesEditor and BindingSubjectsEditor, and both clusterrole and clusterrolebinding primitives.

sourcehawk requested a review from Copilot March 22, 2026 03:42

Copilot started reviewing on behalf of sourcehawk March 22, 2026 03:43 View session

Copilot AI reviewed Mar 22, 2026

View reviewed changes

sourcehawk requested a review from Copilot March 22, 2026 04:21

Copilot started reviewing on behalf of sourcehawk March 22, 2026 04:22 View session

Copilot AI reviewed Mar 22, 2026

View reviewed changes

pkg/primitives/clusterrolebinding/builder.go Show resolved Hide resolved

pkg/primitives/clusterrolebinding/resource.go Outdated Show resolved Hide resolved

pkg/mutation/editors/bindingsubjects.go Show resolved Hide resolved

sourcehawk requested a review from Copilot March 22, 2026 13:19

Copilot started reviewing on behalf of sourcehawk March 22, 2026 13:19 View session

Copilot AI reviewed Mar 22, 2026

View reviewed changes

pkg/primitives/clusterrolebinding/resource.go Outdated Show resolved Hide resolved

docs/primitives/clusterrolebinding.md Outdated Show resolved Hide resolved

Copilot AI review requested due to automatic review settings March 22, 2026 19:51

Copilot started reviewing on behalf of sourcehawk March 22, 2026 19:51 View session

Copilot AI reviewed Mar 22, 2026

View reviewed changes

docs/primitives/clusterrolebinding.md Outdated Show resolved Hide resolved

pkg/mutation/editors/bindingsubjects.go Outdated Show resolved Hide resolved

sourcehawk force-pushed the feature/clusterrolebinding-primitive branch from 8ae0393 to 65a6d28 Compare March 23, 2026 00:47

Copilot AI review requested due to automatic review settings March 23, 2026 03:00

Copilot started reviewing on behalf of sourcehawk March 23, 2026 03:01 View session

Copilot AI reviewed Mar 23, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings March 23, 2026 16:00

Copilot started reviewing on behalf of sourcehawk March 23, 2026 16:00 View session

Copilot AI reviewed Mar 23, 2026

View reviewed changes

examples/clusterrolebinding-primitive/README.md Show resolved Hide resolved

docs/primitives/clusterrolebinding.md Show resolved Hide resolved

Copilot AI review requested due to automatic review settings March 23, 2026 16:58

Copilot started reviewing on behalf of sourcehawk March 23, 2026 16:58 View session

Copilot AI reviewed Mar 23, 2026

View reviewed changes

docs/primitives.md Outdated Show resolved Hide resolved

sourcehawk and others added 4 commits March 23, 2026 20:17

Add BindingSubjectsEditor for RoleBinding/ClusterRoleBinding subjects

b50c0ad

Provides typed mutations for the .subjects field of binding resources: Add, Remove, EnsureServiceAccount, RemoveServiceAccount, and Raw. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Add ClusterRoleBinding primitive documentation

8828947

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Add ClusterRoleBinding primitive example

daee41d

Demonstrates building and mutating a ClusterRoleBinding through multiple spec variations with feature-gated subject mutations, version labels, and field application flavors. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

sourcehawk requested review from Copilot and removed request for Copilot March 25, 2026 16:03

Copilot started reviewing on behalf of sourcehawk March 25, 2026 16:04 View session

sourcehawk requested review from Copilot and removed request for Copilot March 25, 2026 16:05

Copilot started reviewing on behalf of sourcehawk March 25, 2026 16:07 View session

sourcehawk requested review from Copilot and removed request for Copilot March 25, 2026 16:07

Copilot AI reviewed Mar 25, 2026

View reviewed changes

sourcehawk requested review from Copilot and removed request for Copilot March 25, 2026 16:16

Copilot AI reviewed Mar 25, 2026

View reviewed changes

Copilot started reviewing on behalf of sourcehawk March 25, 2026 16:18 View session

Copilot started reviewing on behalf of sourcehawk March 25, 2026 16:19 View session

Copilot started reviewing on behalf of sourcehawk March 25, 2026 16:28 View session

Copilot started reviewing on behalf of sourcehawk March 25, 2026 16:34 View session

Copilot started reviewing on behalf of sourcehawk March 25, 2026 16:37 View session

Copilot started reviewing on behalf of sourcehawk March 25, 2026 16:38 View session

sourcehawk added 2 commits March 25, 2026 18:08

resolve

888e1f3

sourcehawk merged commit 5d8ce33 into main Mar 25, 2026
2 checks passed

sourcehawk deleted the feature/clusterrolebinding-primitive branch March 25, 2026 18:11

Conversation

sourcehawk commented Mar 22, 2026

Summary

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

sourcehawk commented Mar 22, 2026

Claude Review Cycle 1 Complete

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

sourcehawk commented Mar 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sourcehawk commented Mar 23, 2026

Claude Review Cycle 1 Complete

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

sourcehawk commented Mar 23, 2026

Claude Review Cycle 1 Complete

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sourcehawk commented Mar 25, 2026

Claude Review Cycle 1 Complete

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!