feat(dataset): add workspace share access policy / 支持工作空间共享访问策略

[usernameisnull]

feat(dataset): add workspace share access policy / 支持工作空间共享访问策略

中文

概述

为共享 Dataset 的引用挂载增加按目标工作空间控制的读写权限策略。

• 新增不可变的 spec.shareAccess 规则，通过 CRD 校验读写模式和命名空间选择器。
• 新增 status.mountSources 与 MountPolicy 状态条件，记录并验证引用链的实际挂载授权。
• 新增 pkg/mountpolicy，统一解析引用链、校验 Dataset/PVC/PV 身份，并在异常时默认拒绝访问。
• 更新 Dataset Controller：响应来源策略或命名空间标签变更、安全克隆引用 PV，并阻止通过引用 PVC 绕过授权。
• 保持兼容：未设置 shareAccess 的历史共享 Dataset 继续按只读方式授权。
• 补充实现、迁移边界和发布约束文档。

测试

• 增加策略解析、规则优先级、历史兼容行为和存储身份校验的单元测试。
• 增加引用挂载策略协调、失败恢复和 PVC 别名绕过防护的 Controller 测试。
• 增加 shareAccess CRD/CEL 校验的 envtest 覆盖。

升级注意事项

本次变更更新了 Dataset CRD schema，并新增 shareAccess、mountSources
及相关 CEL 校验。

当前 Chart 发布流程会将 config/crd/bases/* 复制到 Chart 的
templates/ 目录，因此 Helm upgrade 会尝试更新 CRD；但不建议依赖 Helm
管理 CRD 生命周期。

升级时请先显式应用 CRD，再升级 Chart：

kubectl apply -f config/crd/bases/dataset.baizeai.io_datasets.yaml
helm upgrade --install dataset <chart> --version <new-version>

若未来将 CRD 移至 Chart 的 crds/ 目录，Helm 只会在首次安装时创建 CRD，
不会在 helm upgrade --install 时更新它；届时上述显式 CRD 升级步骤仍为必需。

English

Summary

Add workspace-scoped read/write access policies for shared Dataset reference
mounts.

• Add immutable spec.shareAccess rules with CRD validation for access modes
  and namespace selectors.
• Add status.mountSources and a MountPolicy condition to record and verify
  effective reference-mount authorization.
• Introduce pkg/mountpolicy to resolve reference chains, verify
  Dataset/PVC/PV identities, and fail closed on authorization errors.
• Update the Dataset Controller to reconcile source-policy and namespace-label
  changes, safely clone reference PVs, and prevent authorization bypasses
  through reference PVC aliases.
• Preserve backward compatibility: shared Datasets without shareAccess
  continue to grant read-only access.
• Add implementation, migration, and release-contract documentation.

Tests

• Add unit tests for policy resolution, rule precedence, legacy behavior, and
  storage-identity verification.
• Add Controller tests for reference mount-policy reconciliation, failure
  recovery, and PVC alias-bypass protection.
• Add envtest coverage for shareAccess CRD/CEL validation.

Upgrade Notes

This change updates the Dataset CRD schema and adds shareAccess,
mountSources, and related CEL validations.

The current chart publishing workflow copies config/crd/bases/* into the
chart's templates/ directory, so Helm upgrade will attempt to update the
CRD. However, CRD lifecycle management should not rely on Helm.

Apply the CRD explicitly before upgrading the chart:

kubectl apply -f config/crd/bases/dataset.baizeai.io_datasets.yaml
helm upgrade --install dataset <chart> --version <new-version>

If the CRD is moved to the chart's crds/ directory in the future, Helm will
create it only during the initial installation and will not update it during
helm upgrade --install. The explicit CRD upgrade step above remains required.