feat: graduate Notes API to dedicated notes.miloapis.com group

[OscarLlamas6]

• Create new notes.miloapis.com API group with Note (namespaced) and ClusterNote (cluster-scoped)
• Implement controllers with PolicyBinding support for both resource types
• Add validation and mutation webhooks for Note and ClusterNote
• Generate CRDs for notes.miloapis.com/v1alpha1
• Configure ProtectedResources for IAM integration
• Add domain note examples demonstrating all use cases
• Remove Notes from crm.miloapis.com (graduated to dedicated group)
• Clean up CRM API group structure for future CRM-specific resources
• Update all kustomizations and configurations

This allows Notes to be attached to any resource (including networking.datumapis.com/Domain) while keeping CRM API group available for future CRM-specific resources like Leads, Opportunities, and Accounts.

Needed for datum-cloud/enhancements#501

[joggrbot]

📝 Documentation Analysis

All docs are up to date! 🎉

---

✅ Latest commit analyzed: 15d626d | Powered by Joggr

[JoseSzycho]

Both controllers (clusternote and note) share most of the logic. While it’s beneficial to have separate controllers, I would suggest sharing all of the functions that would be common to both.

[JoseSzycho]

Overall, great work.

Just left some comments about sharing functionalities and setting up the resources owners.

[OscarLlamas6]

Overall, great work.

Just left some comments about sharing functionalities and setting up the resources owners.

Thanks for the feedback @JoseSzycho ! I've implemented both suggestions. Let me know your feedback again please

[JoseSzycho]

Looks great! I really like the use of gvk, so the notes can be used for any resources.

I’ve left a few minor comments.

What do you think if we rename Note to NamespaceNote? This way, API consumers won’t be confused about when to use each.

Please add some unit tests for the webhooks and end-to-end tests for both note types. You should be able to verify that the garbage collection works and that the creatorRef is correctly set.

[OscarLlamas6]

@JoseSzycho Thanks for the detailed feedback! I've implemented all the suggestions. Here's what changed:

ClusterNote validation - Now validates that subjectRef.namespace is empty (cluster-scoped only):

if clusterNote.Spec.SubjectRef.Namespace != "" {
    return Invalid("ClusterNote can only reference cluster-scoped resources")
}

Note validation - Validates that subject is namespaced AND in the same namespace:

if note.Spec.SubjectRef.Namespace == "" {
    return Invalid("Note can only reference namespaced resources")
} else if note.Spec.SubjectRef.Namespace != note.Namespace {
    return Invalid("Note must be in the same namespace as its subject")
}

Owner reference enforcement - Changed the webhook to fail if owner reference can't be set. This ensures GC always works as intended. The webhook will fail if:

• The subject resource exists but owner reference setup fails
• The subject resource doesn't exist (NotFound error)

This is a fail-fast approach - if we can't guarantee GC will work, we don't create the note.

Unit Tests

Added comprehensive tests for both webhooks - 17 test cases total, all passing ✅

Tests cover:

• Mutator: owner reference setup (success/failure scenarios)
• Validator: valid/invalid subject references for create and update
• Edge cases: cross-namespace, cluster vs namespaced mismatches

Local Testing

Spun up a local kind cluster with Milo and tested both scenarios:

ClusterNote + Organization:

$ kubectl get clusternote clusternote-gc-test -o yaml
ownerReferences:
- apiVersion: resourcemanager.miloapis.com/v1alpha1
  kind: Organization
  name: test-org-gc

$ kubectl delete organization test-org-gc
$ kubectl get clusternote clusternote-gc-test
Error: NotFound  # ✅ GC worked!

Note + Group:

$ kubectl get note note-gc-test -n test-notes -o yaml
ownerReferences:
- apiVersion: iam.miloapis.com/v1alpha1
  kind: Group
  name: test-group-gc

$ kubectl delete group test-group-gc -n test-notes
$ kubectl get note note-gc-test -n test-notes
Error: NotFound  # ✅ GC worked!

Also verified the validations work - tried creating invalid configs and they were all rejected with clear error messages.

[OscarLlamas6]

What do you think if we rename Note to NamespaceNote? This way, API consumers won’t be confused about when to use each.

@JoseSzycho I'd prefer to keep it as Note and ClusterNote to follow K8s conventions (Role/ClusterRole, RoleBinding/ClusterRoleBinding, Issuer/ClusterIssuer). The pattern is that the base resource is namespaced by default, with Cluster prefix for cluster-scoped variants.

[JoseSzycho]

Great work!