feat: add public read access to ResourceRegistration catalog#604
Merged
Conversation
Contributor
kevwilliams
force-pushed
the
feat/feature-flag-iam
branch
from
31c8c41 to
b56cde6
Compare
kevwilliams
changed the title
scotwells
reviewed
May 6, 2026
kevwilliams
force-pushed
the
feat/feature-flag-iam
branch
from
b56cde6 to
80ccbff
Compare
- Add config/services/features/ component scaffolding (iam + registrations placeholder) - Add quota.miloapis.com-resource-registration-viewer Role: read-only on ResourceRegistration (mirrors billing's meter-definition-viewer) - Add authenticated-user-resource-registration-read PolicyBinding: grants the viewer role to system:authenticated, scoped to ResourceRegistration kind - Wire features into config/services/kustomization.yaml Unblocks staff-portal Feature Flags UI: any authenticated user can list the ResourceRegistration catalog to discover available flags. Toggling flags (ResourceGrant create/delete) is governed by separate roles bound in datum-cloud/infra and is out of scope for this PR. The catalog read grants all ResourceRegistration kinds (Entity, Allocation, Feature) — PolicyBinding resourceSelector is kind-only, no spec filter. The catalog is non-sensitive metadata, same reasoning as MeterDefinition.
kevwilliams
force-pushed
the
feat/feature-flag-iam
branch
from
80ccbff to
53d76b9
Compare
scotwells
approved these changes
May 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Make the
ResourceRegistrationcatalog readable by any authenticated user, so the staff-portal Feature Flags UI can list available flags. Modeled after billing'smeter-definition-viewer+authenticated-user-meter-definition-readpattern.config/services/features/component scaffolding (iam+registrationsplaceholder).quota.miloapis.com-resource-registration-viewerRole: read-only on the registration catalog.authenticated-user-resource-registration-readPolicyBinding: grants the viewer role tosystem:authenticated, scoped viaresourceSelector.resourceKindtoResourceRegistration.featuresintoconfig/services/kustomization.yaml.Why
Staff-portal needs to call
list resourceregistrations.quota.miloapis.com(cluster-scoped) to enumerate the feature flag catalog before a flag can be toggled on for an org. Today this returns403 Forbiddenfor authenticated users because no PolicyBinding grants list access.The catalog of registered resource types is non-sensitive metadata — same reasoning as
MeterDefinition— so making it readable by all authenticated users keeps parity and unblocks the UI without per-team binding.Out of scope
ResourceGrantcreate/delete (the toggle action). Those bindings live indatum-cloud/infraand aren't required to render the catalog.Notes
The viewer role grants read on all
ResourceRegistrations (type∈ {Entity, Allocation, Feature}). PolicyBinding'sresourceSelectoris kind-only — no spec filter. If we ever want to restrict catalog visibility to onlytype=Feature, that requires admission/webhook enforcement, not IAM.Test plan
kustomize build config/services/features/produces the Role + PolicyBinding without errorskustomize build config/services/includes them in the aggregatedatumctl get resourceregistrations --platform-widesucceeds for any authenticated user