feat(teamrolebindings): support multiple teamRefs in a single TRB

[mikolajkucinski]

Description

Adds teamRefs to TeamRoleBindingSpec so a single TRB can reference multiple teams. The old teamRef is deprecated (the webhook merges it into teamRefs automatically, so existing resources migrate lazily). The controller handles partial failures (missing teams don't break RBAC for the rest) and metrics track each team individually.

What type of PR is this? (check all applicable)

• 🍕 Feature
• 🐛 Bug Fix
• 📝 Documentation Update
• 🎨 Style
• 🧑‍💻 Code Refactor
• 🔥 Performance Improvements
• ✅ Test
• 🤖 Build
• 🔁 CI
• 📦 Chore (Release)
• ⏩ Revert

Related Tickets & Documents

• Closes [FEAT] - Allow multiple teamRefs in TRB #1781

Added tests?

• 👍 yes
• 🙅 no, because they aren't needed
• 🙋 no, because I need help
• Separate ticket for tests # (issue/pr)

Added to documentation?

• 📜 README.md
• 🤝 Documentation pages updated
• 🙅 no documentation needed
• (if applicable) generated OpenAPI docs for CRD changes

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• My changes generate no new warnings
• New and existing unit tests pass locally with my changes

[Copilot]

Pull request overview

This PR extends TeamRoleBinding to support binding a single TeamRole to multiple Teams via spec.teamRefs, while deprecating the legacy spec.teamRef. The webhook defaults/migrates legacy fields, the controller reconciles RBAC across multiple teams (tolerating missing teams), and metrics/tests are updated accordingly.

Changes:

• Add spec.teamRefs to the API/CRD and deprecate spec.teamRef (with deepcopy + printcolumn updates).
• Update webhook defaulting/validation and add tests for migration/deduplication + deprecation warnings.
• Update TeamRBAC controller/metrics to resolve multiple teams, reconcile subjects accordingly, and add/adjust tests.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
api/v1alpha2/teamrolebinding_types.go	Adds TeamRefs to the spec, deprecates TeamRef, updates printer columns.
api/v1alpha2/zz_generated.deepcopy.go	Adds deepcopy support for TeamRefs.
charts/manager/crds/greenhouse.sap_teamrolebindings.yaml	CRD schema + printer column updates for teamRefs and deprecation text for teamRef.
api/well_known.go	Renames field index constant to .spec.teamRefs.
internal/webhook/v1alpha2/teamrolebinding_webhook.go	Implements defaulting migration to teamRefs + deprecation warnings; updates warning aggregation.
internal/webhook/v1alpha2/teamrolebinding_webhook_test.go	Adds/updates tests for defaulting migration, deduplication, and warnings.
internal/controller/teamrbac/teamrolebinding_controller.go	Reconciles RBAC subjects from multiple teams; indexes/enqueues by teamRefs; adds resolveTeamRefs + getTeams.
internal/controller/teamrbac/metrics.go	Emits readiness gauge per teamRef; cleans up old label sets on updates.
internal/controller/teamrbac/teamrolebinding_controller_test.go	Adds integration tests for multi-team behavior and legacy teamRef migration.
internal/controller/teamrbac/teamrolebinding_controller_unit_test.go	Adds unit tests for resolveTeamRefs.
internal/test/resources.go	Adds WithTeamRefs test helper; keeps WithTeamRef for backwards compatibility.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.