bug: admin permissions and resourceNames=* don't take effect for apibinding admission

[ncdc]

Describe the bug

When creating an APIBinding, the APIBinding admission logic performs a SAR with the following attributes:

bindAttr := authorizer.AttributesRecord{
		User:            user,
		Verb:            "bind",
		APIGroup:        apisv1alpha1.SchemeGroupVersion.Group,
		APIVersion:      apisv1alpha1.SchemeGroupVersion.Version,
		Resource:        "apiexports",
		Name:            apiExportName,
		ResourceRequest: true,
	}

if the user has admin permissions and/or a ClusterRole that grants bind to resourceNames: ["*"], their attempt to create the APIBinding is rejected with apibindings.apis.kcp.dev "test" is forbidden: unable to create APIImport: missing verb='bind' permission on apiexports

Steps To Reproduce

See description

Expected Behaviour

admin permissions and resourceNames=* would apply when checking binding permissions

Additional Context

No response

[ncdc]

@sttts @s-urbaniak @stevekuznetsov

[sparkoo]

is there some workaround until it's fixed?

[sparkoo]

workaround is to create ClusterRole + ClusterRoleBinding like this, in a workspace where trying to bind to API:

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: bind-apiexport-spi
rules:
- apiGroups:
  - apis.kcp.dev
  resourceNames:
  - spi
  resources:
  - apiexports
  verbs:
  - bind
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: bind-apiexport-spi
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: bind-apiexport-spi
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: rh-sso:mvalarh2

[kcp-ci-bot]

Issues go stale after 90d of inactivity. After a furter 30 days, they will turn rotten. Mark the issue as fresh with /remove-lifecycle stale.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[kcp-ci-bot]

Stale issues rot after 30d of inactivity. Mark the issue as fresh with /remove-lifecycle rotten. Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

/lifecycle rotten

[kcp-ci-bot]

Rotten issues close after 30d of inactivity. Reopen the issue with /reopen. Mark the issue as fresh with /remove-lifecycle rotten.

/close

[kcp-ci-bot]

@kcp-ci-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity. Reopen the issue with /reopen. Mark the issue as fresh with /remove-lifecycle rotten.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.