feat: implement SBOM status subresource

[doraem-on]

Overview

This PR implements the /status REST subresource for the SBOMSyft and SBOMSyftFiltered custom resources.

Historically, the SBOMSyftStatus struct was defined as an empty struct ({}). This meant that critical operational state—such as whether an SBOM scan was learning, incomplete, tooLarge, etc.—could not be stored using standard Kubernetes API conventions.

Workarounds typically involved saving status indicators as annotations, which is an anti-pattern for aggregated API servers and makes programmatic state tracking difficult for controllers.

This PR addresses the missing implementation by giving SBOMSyft and SBOMSyftFiltered proper status capabilities, allowing downstream consumers (such as kubevuln) to reliably read and write SBOM processing states.

Detailed Changes

1. API Definitions Updated (pkg/apis/softwarecomposition)

   • Modified SBOMSyftStatus in both the internal (types.go) and external (v1beta1/types.go) API groups.
   • Added the following structured fields, complete with JSON and Protobuf tags:
     • Status (string): The current operational state of the SBOM generation.
     • StatusReason (string): A detailed explanation corresponding to the status.
     • Limit (string): The specific limit that triggered a failure/fallback (e.g., maxImageSize, maxSBOMSize, memoryLimit).

2. Code Generation

   • Ran hack/update-codegen.sh to regenerate the deepcopy, conversion, openapi, and clientset files to reflect the new SBOMSyftStatus fields.

3. Status Strategy Enforcement (pkg/registry/softwarecomposition)

   • Implemented SbomSyftStatusStrategy and SbomSyftFilteredStatusStrategy.
   • Overrode PrepareForUpdate in the strategy to ensure that modifying the /status endpoint strictly drops any mutations to the Spec fields, keeping the oldObj.Spec fully intact.

4. REST Subresource Registry (etcd.go)

   • Implemented and exported NewStatusREST factory functions for both sbomsyfts and sbomsyftfiltereds.
   • Configured the stores to use UpdateStrategy: statusStrategy so that validation and isolation are properly enforced at the etcd layer.

5. API Server Wiring (pkg/apiserver/apiserver.go)

   • Registered the new status stores in the v1beta1 API group endpoint map:
     • sbomsyfts/status: ep(sbomsyfts.NewStatusREST)
     • sbomsyftfiltereds/status: ep(sbomsyftfiltereds.NewStatusREST)

How to Test

1. Compile the API server using:

   make build

2. Start the storage API server locally or deploy it to a test cluster.

3. Attempt to PATCH or PUT against the /apis/spdx.softwarecomposition.kubescape.io/v1beta1/namespaces/<namespace>/sbomsyfts/<name>/status endpoint.

4. Verify that:

   • The status, statusReason, and limit fields update correctly.
   • Any payload attempting to modify the spec via this endpoint is ignored.
   • The existing Spec remains unchanged after a status update.

5. Run the complete test suite:

   go test ./...

   All existing tests should pass.

Related issues/PRs

This is a prerequisite upstream blocker to fix the status annotation handling in the vulnerability scanner:

• Required for Enhancement: Store SBOM status in CRD Status subresource instead of Annotations kubevuln#496
• Closes Enhancement: Implement /status subresource for SBOMSyft and SBOMSyftFiltered #360

Summary by CodeRabbit

• New Features
  • Added status fields for SBOM resources, including status, reason, and limit information.
  • Added REST API status endpoints for SBOM Syft and filtered SBOM Syft resources.
  • Status updates now preserve the resource specification while allowing status information to be updated independently.

[coderabbitai]

📝 Walkthrough

Walkthrough

The change adds status fields and version conversions for SBOM Syft resources. It adds status REST storage and update strategies for filtered and unfiltered resources. The API server registers both status subresources.

Changes

SBOM Syft status subresources

Layer / File(s)	Summary
Status API contract pkg/apis/softwarecomposition/types.go, pkg/apis/softwarecomposition/v1beta1/types.go, pkg/apis/softwarecomposition/v1beta1/zz_generated.conversion.go	SBOMSyftStatus now contains Status, StatusReason, and Limit. Conversions copy these fields in both directions.
Status storage and update strategies pkg/registry/softwarecomposition/sbomsyftfiltereds/strategy.go, pkg/registry/softwarecomposition/sbomsyftfiltereds/etcd.go, pkg/registry/softwarecomposition/sbomsyfts/strategy.go, pkg/registry/softwarecomposition/sbomsyfts/etcd.go	Both resources now have status REST storage and dedicated strategies. Status updates preserve the existing Spec, perform no additional validation, and emit no warnings.
API status registration pkg/apiserver/apiserver.go	The API server registers /status subresources for filtered and unfiltered SBOM Syft resources.

Estimated code review effort: 3 (Moderate) | ~15 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant API server
  participant Status REST
  participant Status strategy
  participant Storage
  Client->>API server: Submit SBOM Syft status update
  API server->>Status REST: Route request to /status
  Status REST->>Status strategy: Prepare update
  Status strategy->>Status strategy: Preserve existing Spec
  Status REST->>Storage: Persist status fields

Loading

Suggested reviewers: matthyx

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the implementation of the SBOM status subresource, which is the main change in the pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}