Add backplane trusted actions

openapi/openapi.yaml

@@ -35,6 +35,45 @@ x-k8s-proxy: &k8s-proxy
     5XX:
       description: 5XX
 
+x-k8s-proxy-with-body: &k8s-proxy-with-body
+  summary: Proxy kubectl/oc api requests, opaque in backplane-api
+  requestBody:
+    required: false
+    content:
+      application/json:
+        schema:
+          type: object
+          description: Arbitrary JSON request body forwarded to Kubernetes API
+      application/json-patch+json:
+        schema:
+          type: array
+          items:
+            type: object
+          description: JSON Patch operations for Kubernetes resources
+      application/merge-patch+json:
+        schema:
+          type: object
+          description: Merge patch for Kubernetes resources
+      application/strategic-merge-patch+json:
+        schema:
+          type: object
+          description: Strategic merge patch for Kubernetes resources
+      application/apply-patch+yaml:
+        schema:
+          type: object
+          description: Server-side apply patch for Kubernetes resources
+  responses:
+    1XX:
+      description: 1XX
+    2XX:
+      description: 2XX
+    3XX:
+      description: 3XX
+    4XX:
+      description: 4XX
+    5XX:
+      description: 5XX
+
 x-script-lang: &script-lang
   - python
   - bash
@@ -45,10 +84,10 @@ paths:
     parameters:
       - *cluster-id-param
     get: *k8s-proxy
-    post: *k8s-proxy
-    patch: *k8s-proxy
+    post: *k8s-proxy-with-body
+    patch: *k8s-proxy-with-body
     delete: *k8s-proxy
-    put: *k8s-proxy
+    put: *k8s-proxy-with-body
     options: *k8s-proxy
     head: *k8s-proxy
     trace: *k8s-proxy
@@ -153,10 +192,10 @@ paths:
         schema:
           type: string
     get: *k8s-proxy
-    post: *k8s-proxy
-    patch: *k8s-proxy
+    post: *k8s-proxy-with-body
+    patch: *k8s-proxy-with-body
     delete: *k8s-proxy
-    put: *k8s-proxy
+    put: *k8s-proxy-with-body
     options: *k8s-proxy
     head: *k8s-proxy
     trace: *k8s-proxy
@@ -241,6 +280,88 @@ paths:
         500:
           <<: *base-errors
 
+  /backplane/trustedactions/{clusterId}:
+    parameters:
+      - *cluster-id-param
+    post:
+      operationId: createTrustedAction
+      summary: Creates a trusted action instance & the scoped service account (SA) and RBAC on the target cluster used to proxy kube-api requests
+      parameters:
+        - name: managingCluster
+          in: query
+          description: If specified, which managing cluster to create kube-api access for ( service | management | hive )
+          required: false
+          schema:
+            type: string
+            enum: ["management", "service", "hive"]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CreateTrustedActionRequest'
+      responses:
+        200:
+          description: Returns the proxy uri to use for kube-api requests, the instance id to use for deletion, and the expiry of the scoped service account
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/CreateTrustedActionResult'
+        400:
+          <<: *base-errors
+        403:
+          <<: *base-errors
+        406:
+          <<: *base-errors
+        500:
+          <<: *base-errors
+
+  /backplane/trustedactions/{clusterId}/{trustedActionInstanceId}:
+    parameters:
+      - *cluster-id-param
+      - name: trustedActionInstanceId
+        in: path
+        description: The instance ID of a previously created trusted action
+        required: true
+        schema:
+          type: string
+    delete:
+      operationId: deleteTrustedAction
+      summary: Deletes an existing trusted action instance; removes the scoped service account (SA) and RBAC created for the trusted action
+      responses:
+        200:
+          description: Trusted action resources deleted
+          content:
+            application/json:
+              schema:
+                type: string
+        400:
+          <<: *base-errors
+        404:
+          <<: *base-errors
+        406:
+          <<: *base-errors
+        500:
+          <<: *base-errors
+
+  /backplane/trustedaction/{clusterId}/{trustedActionInstanceId}/:
+    parameters:
+      - *cluster-id-param
+      - name: trustedActionInstanceId
+        in: path
+        description: The instance ID of a previously created trusted action
+        required: true
+        schema:
+          type: string
+    get: *k8s-proxy
+    post: *k8s-proxy-with-body
+    patch: *k8s-proxy-with-body
+    delete: *k8s-proxy
+    put: *k8s-proxy-with-body
+    options: *k8s-proxy
+    head: *k8s-proxy
+    trace: *k8s-proxy
+
   /backplane/testscript/{clusterId}:
     post:
       operationId: createTestScriptRun
@@ -1145,6 +1266,72 @@ components:
           items:
             $ref: '#/components/schemas/RoleRbacDecl'
 
+    TrustedActionRbacDecl:
+      description: RBAC rules to grant on the target cluster for a trusted action
+      type: object
+      required:
+        - clusterRoleRules
+        - roles
+      properties:
+        clusterRoleRules:
+          type: array
+          description: Cluster-scoped RBAC rules
+          items:
+            $ref: '#/components/schemas/PolicyRule'
+        roles:
+          type: array
+          description: Namespace-scoped role declarations
+          items:
+            $ref: '#/components/schemas/RoleRbacDecl'
+
+    CreateTrustedActionRequest:
+      description: Request body to create a trusted action instance
+      type: object
+      required:
+        - name
+        - customerDataAccess
+        - rbac
+      properties:
+        name:
+          type: string
+          description: Base name for the trusted action; becomes the prefix of the returned instanceId
+        customerDataAccess:
+          type: boolean
+          description: If true, triggers Access Transparency checks before proceeding
+        rbac:
+          $ref: '#/components/schemas/TrustedActionRbacDecl'
+        managementClusterRbac:
+          type: object
+          nullable: true
+          description: Reserved for forward-compatibility; not yet implemented and must be null/absent (a non-null value returns 400)
+        serviceClusterRbac:
+          type: object
+          nullable: true
+          description: Reserved for forward-compatibility; not yet implemented and must be null/absent (a non-null value returns 400)
+        hiveClusterRbac:
+          type: object
+          nullable: true
+          description: Reserved for forward-compatibility; not yet implemented and must be null/absent (a non-null value returns 400)
+
+    CreateTrustedActionResult:
+      description: Response returned when a trusted action instance is created
+      type: object
+      required:
+        - proxyUri
+        - instanceId
+        - expiry
+      properties:
+        proxyUri:
+          type: string
+          description: Path to use for proxying kube-api calls via this trusted action
+        instanceId:
+          type: string
+          description: 'Opaque identifier for the trusted action instance, format: {name}--{uuid4}'
+        expiry:
+          type: string
+          format: date-time
+          description: RFC3339 UTC timestamp when the scoped service account expires (720 minutes from creation)
+
     ScriptMetadata:
       description: Script metadata
       required: