Move pkg/clone/auth to API lib

This way other projects don't have to vendor in CDI, the API lib will be enough.
While it's not a huge deal at this point, each existing dependency is an entry door
for pulling in more stuff in the future by accident.

Signed-off-by: Alex Kalenyuk <akalenyu@redhat.com>

pkg/apiserver/webhooks/BUILD.bazel

@@ -15,11 +15,11 @@ go_library(
     visibility = ["//visibility:public"],
     deps = [
         "//pkg/client/clientset/versioned:go_default_library",
-        "//pkg/clone:go_default_library",
         "//pkg/common:go_default_library",
         "//pkg/controller/common:go_default_library",
         "//pkg/token:go_default_library",
         "//staging/src/kubevirt.io/containerized-data-importer-api/pkg/apis/core/v1beta1:go_default_library",
+        "//staging/src/kubevirt.io/containerized-data-importer-api/pkg/apis/core/v1beta1/clone:go_default_library",
         "//vendor/github.com/appscode/jsonpatch:go_default_library",
         "//vendor/github.com/gorhill/cronexpr:go_default_library",
         "//vendor/github.com/kubernetes-csi/external-snapshotter/client/v6/apis/volumesnapshot/v1:go_default_library",

pkg/apiserver/webhooks/datavolume-mutate.go

@@ -33,8 +33,8 @@ import (
 	"k8s.io/klog/v2"
 
 	cdiv1 "kubevirt.io/containerized-data-importer-api/pkg/apis/core/v1beta1"
+	cdiv1cloneauth "kubevirt.io/containerized-data-importer-api/pkg/apis/core/v1beta1/clone"
 	cdiclient "kubevirt.io/containerized-data-importer/pkg/client/clientset/versioned"
-	"kubevirt.io/containerized-data-importer/pkg/clone"
 	"kubevirt.io/containerized-data-importer/pkg/common"
 	cc "kubevirt.io/containerized-data-importer/pkg/controller/common"
 	"kubevirt.io/containerized-data-importer/pkg/token"
@@ -44,7 +44,7 @@ type dataVolumeMutatingWebhook struct {
 	k8sClient      kubernetes.Interface
 	cdiClient      cdiclient.Interface
 	tokenGenerator token.Generator
-	proxy          clone.SubjectAccessReviewsProxy
+	proxy          cdiv1cloneauth.SubjectAccessReviewsProxy
 }
 
 type sarProxy struct {
@@ -62,7 +62,7 @@ const (
 type cloneSourceHandler struct {
 	cloneType       cloneType
 	tokenResource   metav1.GroupVersionResource
-	cloneAuthFunc   clone.UserCloneAuthFunc
+	cloneAuthFunc   cdiv1cloneauth.UserCloneAuthFunc
 	sourceName      string
 	sourceNamespace string
 }
@@ -246,15 +246,15 @@ func newCloneSourceHandler(dataVolume *cdiv1.DataVolume, cdiClient cdiclient.Int
 		return &cloneSourceHandler{
 			cloneType:       pvcClone,
 			tokenResource:   tokenResourcePvc,
-			cloneAuthFunc:   clone.CanUserClonePVC,
+			cloneAuthFunc:   cdiv1cloneauth.CanUserClonePVC,
 			sourceName:      pvcSource.Name,
 			sourceNamespace: pvcSource.Namespace,
 		}, nil
 	case snapshotSource != nil:
 		return &cloneSourceHandler{
 			cloneType:       snapshotClone,
 			tokenResource:   tokenResourceSnapshot,
-			cloneAuthFunc:   clone.CanUserCloneSnapshot,
+			cloneAuthFunc:   cdiv1cloneauth.CanUserCloneSnapshot,
 			sourceName:      snapshotSource.Name,
 			sourceNamespace: snapshotSource.Namespace,
 		}, nil

staging/src/kubevirt.io/containerized-data-importer-api/go.mod

@@ -6,6 +6,7 @@ require (
 	github.com/openshift/api v0.0.0-20211217221424-8779abfbd571
 	k8s.io/api v0.23.5
 	k8s.io/apimachinery v0.23.5
+	k8s.io/klog/v2 v2.40.1
 	kubevirt.io/controller-lifecycle-operator-sdk/api v0.0.0-20220329064328-f3cc58c6ed90
 )
 
@@ -22,7 +23,6 @@ require (
 	golang.org/x/text v0.7.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	k8s.io/klog/v2 v2.40.1 // indirect
 	k8s.io/utils v0.0.0-20211116205334-6203023598ed // indirect
 	sigs.k8s.io/json v0.0.0-20211020170558-c049b76a60c6 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.2.1 // indirect

pkg/clone/BUILD.bazel → staging/src/kubevirt.io/containerized-data-importer-api/pkg/apis/core/v1beta1/clone/BUILD.bazel

@@ -3,7 +3,7 @@ load("@io_bazel_rules_go//go:def.bzl", "go_library")
 go_library(
     name = "go_default_library",
     srcs = ["auth.go"],
-    importpath = "kubevirt.io/containerized-data-importer/pkg/clone",
+    importpath = "kubevirt.io/containerized-data-importer-api/pkg/apis/core/v1beta1/clone",
     visibility = ["//visibility:public"],
     deps = [
         "//staging/src/kubevirt.io/containerized-data-importer-api/pkg/apis/core/v1beta1:go_default_library",

tests/BUILD.bazel

@@ -49,7 +49,6 @@ go_test(
     embed = [":go_default_library"],
     deps = [
         "//pkg/client/clientset/versioned:go_default_library",
-        "//pkg/clone:go_default_library",
         "//pkg/common:go_default_library",
         "//pkg/controller:go_default_library",
         "//pkg/controller/common:go_default_library",
@@ -63,6 +62,7 @@ go_test(
         "//pkg/util/cert:go_default_library",
         "//pkg/util/naming:go_default_library",
         "//staging/src/kubevirt.io/containerized-data-importer-api/pkg/apis/core/v1beta1:go_default_library",
+        "//staging/src/kubevirt.io/containerized-data-importer-api/pkg/apis/core/v1beta1/clone:go_default_library",
         "//tests/framework:go_default_library",
         "//tests/reporters:go_default_library",
         "//tests/utils:go_default_library",

tests/webhook_test.go

@@ -17,7 +17,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes"
 
-	"kubevirt.io/containerized-data-importer/pkg/clone"
+	cdiv1cloneauth "kubevirt.io/containerized-data-importer-api/pkg/apis/core/v1beta1/clone"
 	"kubevirt.io/containerized-data-importer/tests/framework"
 	"kubevirt.io/containerized-data-importer/tests/utils"
 )
@@ -235,7 +235,7 @@ var _ = Describe("Clone Auth Webhook tests", func() {
 				Expect(err).To(HaveOccurred())
 
 				// let's do manual check as well
-				allowed, reason, err := clone.CanServiceAccountClonePVC(&sarProxy{client: f.K8sClient},
+				allowed, reason, err := cdiv1cloneauth.CanServiceAccountClonePVC(&sarProxy{client: f.K8sClient},
 					srcPVCDef.Namespace,
 					srcPVCDef.Name,
 					targetNamespace.Name,
@@ -260,7 +260,7 @@ var _ = Describe("Clone Auth Webhook tests", func() {
 				}, 60*time.Second, 2*time.Second).ShouldNot(HaveOccurred())
 
 				// let's do another manual check as well
-				allowed, reason, err = clone.CanServiceAccountClonePVC(&sarProxy{client: f.K8sClient},
+				allowed, reason, err = cdiv1cloneauth.CanServiceAccountClonePVC(&sarProxy{client: f.K8sClient},
 					srcPVCDef.Namespace,
 					srcPVCDef.Name,
 					targetNamespace.Name,
@@ -319,7 +319,7 @@ var _ = Describe("Clone Auth Webhook tests", func() {
 				Expect(err).To(HaveOccurred())
 
 				// let's do manual check as well
-				allowed, reason, err := clone.CanServiceAccountCloneSnapshot(&sarProxy{client: f.K8sClient},
+				allowed, reason, err := cdiv1cloneauth.CanServiceAccountCloneSnapshot(&sarProxy{client: f.K8sClient},
 					srcPVCDef.Namespace,
 					srcPVCDef.Name,
 					targetNamespace.Name,
@@ -354,7 +354,7 @@ var _ = Describe("Clone Auth Webhook tests", func() {
 				}, 60*time.Second, 2*time.Second).ShouldNot(HaveOccurred())
 
 				// let's do another manual check as well
-				allowed, reason, err = clone.CanServiceAccountCloneSnapshot(&sarProxy{client: f.K8sClient},
+				allowed, reason, err = cdiv1cloneauth.CanServiceAccountCloneSnapshot(&sarProxy{client: f.K8sClient},
 					srcPVCDef.Namespace,
 					srcPVCDef.Name,
 					targetNamespace.Name,

vendor/modules.txt

@@ -1197,6 +1197,7 @@ k8s.io/utils/trace
 kubevirt.io/containerized-data-importer-api/pkg/apis/core
 kubevirt.io/containerized-data-importer-api/pkg/apis/core/v1alpha1
 kubevirt.io/containerized-data-importer-api/pkg/apis/core/v1beta1
+kubevirt.io/containerized-data-importer-api/pkg/apis/core/v1beta1/clone
 kubevirt.io/containerized-data-importer-api/pkg/apis/core/v1beta1/utils
 kubevirt.io/containerized-data-importer-api/pkg/apis/upload
 kubevirt.io/containerized-data-importer-api/pkg/apis/upload/v1beta1