Tenant(workspace?) owner want some API

[vincent-pli]

Jump from kcp-dev/controller-runtime-example#25
I understand the logic of KCP for API part, I mean API provider could create apiexport to specific workspace, means provider agree to expose these API to the workspace, then the workspace(tenant?) owner create apibinding to import these API to her/his workspace.

But all these are from the perspective of Administrator, think about the scenario: Tenant owner want some API, how could he let the administrator know that, send a mail? or we already have some specific CRD to do the job? for example, tenant owner could create a CR, the CR with information about the API(group, version...)

[ncdc]

But all these are from the perspective of Administrator

Not really. Each workspace owner has full cluster-admin permissions in their workspace. So if a "tenant owner" wants an API, they just create an APIBinding in their workspace.

There does need to be RBAC configured in the workspace where the APIExport lives to allow specific users/groups to bind to the APIExport.

[vincent-pli]

So it means all apiexport are visiable for each "tenant owner" and use RBAC to controller the permision to create apibinding?
but how a tenant owner want to gain the permision they donot have previously.

[ncdc]

We have 2 roles/personas here:

1. API service provider - owner of an APIExport
2. API consumer - creator of an APIBinding

I think you are using "tenant owner" to refer to (2) - API consumer. Just trying to clarify terminology and make sure we're on the same page.

If an API consumer does not currently have bind permission for an APIExport that an API service provider owns, there is currently nothing built in to kcp to allow them to request it. We may build some solutions on top (not part of core kcp) that allow this sort of thing.