feat: add cloud api assets and docs

assets/cloud-api/consumer/README.md

@@ -0,0 +1,6 @@
+# consumer assets
+
+These manifests configure a kcp consumer workspace to subscribe to the ARC
+`APIExport`. An `APIBinding` references the export and explicitly accepts the
+provider's `PermissionClaims` for `Secrets`, `Namespaces`, `Events`, and
+`LogicalClusters` so the sync agent can operate across workspaces.

assets/cloud-api/consumer/apibinding.yaml

@@ -0,0 +1,35 @@
+---
+apiVersion: apis.kcp.io/v1alpha2
+kind: APIBinding
+metadata:
+  name: arc.opendefense.cloud
+spec:
+  reference:
+    export:
+      name: arc.opendefense.cloud
+      # path: root:somepath
+  permissionClaims:
+    - group: ""
+      resource: "secrets"
+      verbs: ["get", "list", "watch", "create", "update", "patch"]
+      selector:
+        matchAll: true
+      state: Accepted
+    - group: ""
+      resource: "namespaces"
+      verbs: ["get", "list", "watch"]
+      selector:
+        matchAll: true
+      state: Accepted
+    - group: ""
+      resource: "events"
+      verbs: ["get", "list", "watch", "create", "update", "patch"]
+      selector:
+        matchAll: true
+      state: Accepted
+    - group: "core.kcp.io"
+      resource: "logicalclusters"
+      verbs: ["get", "list", "watch"]
+      selector:
+        matchAll: true
+      state: Accepted

assets/cloud-api/provider/README.md

@@ -0,0 +1,32 @@
+# provider assets
+
+These manifests configure a kcp provider workspace to expose ARC APIs (`orders`
+and `endpoints`) to consumer workspaces through the kcp
+[`APIExport`][apiexport] marketplace. They define the
+[`APIResourceSchema`][ars] for each resource, the export, an
+`APIExportEndpointSlice` for virtual-workspace discovery, and the RBAC grants
+that let consumers [`APIBind`][apibinding] the export.
+
+[`PermissionClaims`][permissionclaims] for `Secrets`, `Namespaces`, `Events`,
+and `LogicalClusters` are offered on the export so consumer workspaces can
+accept them — the sync agent needs cross-workspace access to operate.
+
+A [`DependencyRule`][dep] prevents deletion of `Endpoints` while `Orders` still
+reference them.
+
+The sync agent's own schema and export controllers are intentionally disabled;
+schemas and exports are maintained here as plain Git-managed manifests for full
+reproducibility.
+
+Subdirectories:
+
+- **`syncagent/`** — Flux-based deployment of the kcp api-syncagent
+  (HelmRelease, RBAC, kubeconfig Secret).
+- **`ui/`** — ProviderMetadata and ContentConfiguration manifests that surface
+  ARC in the platform-mesh marketplace UI.
+
+[apiexport]: https://docs.kcp.io/kcp/latest/reference/apis/apiexport/
+[apibinding]: https://docs.kcp.io/kcp/latest/reference/apis/apibinding/
+[ars]: https://docs.kcp.io/kcp/latest/reference/apis/apiresourceschema/
+[permissionclaims]: https://docs.kcp.io/kcp/latest/reference/apis/apiexport/#permissionclaims
+[dep]: https://github.com/opendefensecloud/dependency-controller

assets/cloud-api/provider/apiexport-bind-rbac.yaml

@@ -0,0 +1,24 @@
+---
+# Grants the bind verb so marketplace consumers can APIBind this export.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: arc-apiexport-bind
+rules:
+  - apiGroups: ["apis.kcp.io"]
+    resources: ["apiexports"]
+    resourceNames: ["arc.opendefense.cloud"]
+    verbs: ["bind"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: arc-apiexport-bind
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: arc-apiexport-bind
+subjects:
+  - apiGroup: rbac.authorization.k8s.io
+    kind: Group
+    name: system:authenticated

assets/cloud-api/provider/apiexport.yaml

@@ -0,0 +1,34 @@
+---
+apiVersion: apis.kcp.io/v1alpha2
+kind: APIExport
+metadata:
+  name: arc.opendefense.cloud
+  labels:
+    # Surfaces ARC's provider ContentConfigurations to binding consumers — the
+    # /services/contentconfigurations VW selects provider CCs by this label.
+    ui.platform-mesh.io/content-for: arc.opendefense.cloud
+spec:
+  resources:
+    - group: arc.opendefense.cloud
+      name: orders
+      schema: v4d632a97.orders.arc.opendefense.cloud
+      storage:
+        crd: {}
+    - group: arc.opendefense.cloud
+      name: endpoints
+      schema: vcf11840f.endpoints.arc.opendefense.cloud
+      storage:
+        crd: {}
+  permissionClaims:
+    - group: ""
+      resource: "events"
+      verbs: ["get", "list", "watch", "create", "update", "patch"]
+    - group: ""
+      resource: "secrets"
+      verbs: ["get", "list", "watch", "create", "update", "patch"]
+    - group: ""
+      resource: "namespaces"
+      verbs: ["get", "list", "watch"]
+    - group: "core.kcp.io"
+      resource: "logicalclusters"
+      verbs: ["get", "list", "watch"]

assets/cloud-api/provider/apiexportendpointslice.yaml

@@ -0,0 +1,9 @@
+---
+# kcp populates .status.endpoints with the virtual-workspace URLs the agent connects to.
+apiVersion: apis.kcp.io/v1alpha1
+kind: APIExportEndpointSlice
+metadata:
+  name: arc.opendefense.cloud
+spec:
+  export:
+    name: arc.opendefense.cloud

assets/cloud-api/provider/ars-endpoints.yaml

@@ -0,0 +1,89 @@
+---
+# Hand-authored APIResourceSchema — workarounds for autogeneration failures (see #442).
+# Fixes: empty EndpointStatus → preserve-unknown-fields; added /status subresource.
+# Immutable: bumps metadata.name on schema changes.
+apiVersion: apis.kcp.io/v1alpha1
+kind: APIResourceSchema
+metadata:
+  name: vcf11840f.endpoints.arc.opendefense.cloud
+  labels:
+    syncagent.kcp.io/agent-name: arc
+  annotations:
+    syncagent.kcp.io/agent-name: arc
+    syncagent.kcp.io/source-generation: "0"
+spec:
+  group: arc.opendefense.cloud
+  nameValidation: DNS1123Subdomain
+  names:
+    kind: Endpoint
+    listKind: EndpointList
+    plural: endpoints
+    singular: endpoint
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      description: Endpoint is the Schema for the endpoints API
+      type: object
+      properties:
+        apiVersion:
+          description: 'APIVersion defines the versioned schema of this representation
+            of an object. Servers should convert recognized schemas to the latest
+            internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+          type: string
+        kind:
+          description: 'Kind is a string value representing the REST resource this
+            object represents. Servers may infer this from the endpoint the client
+            submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+          type: string
+        metadata:
+          type: object
+        spec:
+          description: EndpointSpec specifies a single artifact which is translated
+            into a corresponding Workflow based on its type.
+          type: object
+          required:
+          - type
+          - remoteURL
+          - usage
+          properties:
+            type:
+              description: Type specifies which ArtifactType is used to process this
+                artifact.
+              type: string
+            remoteURL:
+              description: RemoteURL defines the URL which is used to interact with
+                the endpoint.
+              type: string
+            usage:
+              description: |-
+                Usage defines how the endpoint is allowed to be used.
+
+                Possible enum values:
+                 - `"All"` means the endpoint can be used with all kinds of usage patterns.
+                 - `"PullOnly"` means the endpoint can only be used to pull data.
+                 - `"PushOnly"` means the endpoint can only be used to push data.
+              type: string
+              enum:
+              - All
+              - PullOnly
+              - PushOnly
+            secretRef:
+              description: SecretRef specifies the secret containing the relevant
+                credentials for the endpoint.
+              type: object
+              properties:
+                name:
+                  description: 'Name of the referent. This field is effectively required,
+                    but due to backwards compatibility is allowed to be empty. Instances
+                    of this type with an empty value here are almost certainly wrong.
+                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
+                  type: string
+        status:
+          description: EndpointStatus defines the observed state of Endpoint
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+    served: true
+    storage: true
+    subresources:
+      status: {}