fix: restore Platform in CRD annotations for scoped filtering

scotwells · claude · scotwells · commit e89b19c2b30c · 2026-04-17T11:04:50.000-05:00
Platform annotations are still meaningful — they tell the filter to hide
resources from Organization/Project/User contexts. Only the Platform
context *request path* bypasses filtering (so controllers see
everything); the annotation value is still used when filtering other
contexts.

Co-Authored-By: Claude Opus 4.6 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/config/crd/bases/iam/iam.miloapis.com_platformaccessapprovals.yaml b/config/crd/bases/iam/iam.miloapis.com_platformaccessapprovals.yaml
@@ -4,6 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
+    discovery.miloapis.com/parent-contexts: Platform
   name: platformaccessapprovals.iam.miloapis.com
 spec:
   group: iam.miloapis.com
diff --git a/config/crd/bases/iam/iam.miloapis.com_platformaccessdenials.yaml b/config/crd/bases/iam/iam.miloapis.com_platformaccessdenials.yaml
@@ -4,6 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
+    discovery.miloapis.com/parent-contexts: Platform
   name: platformaccessdenials.iam.miloapis.com
 spec:
   group: iam.miloapis.com
diff --git a/config/crd/bases/iam/iam.miloapis.com_platformaccessrejections.yaml b/config/crd/bases/iam/iam.miloapis.com_platformaccessrejections.yaml
@@ -4,6 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
+    discovery.miloapis.com/parent-contexts: Platform
   name: platformaccessrejections.iam.miloapis.com
 spec:
   group: iam.miloapis.com
diff --git a/config/crd/bases/iam/iam.miloapis.com_platforminvitations.yaml b/config/crd/bases/iam/iam.miloapis.com_platforminvitations.yaml
@@ -4,6 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
+    discovery.miloapis.com/parent-contexts: Platform
   name: platforminvitations.iam.miloapis.com
 spec:
   group: iam.miloapis.com
diff --git a/config/crd/bases/iam/iam.miloapis.com_policybindings.yaml b/config/crd/bases/iam/iam.miloapis.com_policybindings.yaml
@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
-    discovery.miloapis.com/parent-contexts: Organization
+    discovery.miloapis.com/parent-contexts: Organization,Platform
   name: policybindings.iam.miloapis.com
 spec:
   group: iam.miloapis.com
diff --git a/config/crd/bases/iam/iam.miloapis.com_protectedresources.yaml b/config/crd/bases/iam/iam.miloapis.com_protectedresources.yaml
@@ -4,6 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
+    discovery.miloapis.com/parent-contexts: Platform
   name: protectedresources.iam.miloapis.com
 spec:
   group: iam.miloapis.com
diff --git a/config/crd/bases/iam/iam.miloapis.com_roles.yaml b/config/crd/bases/iam/iam.miloapis.com_roles.yaml
@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
-    discovery.miloapis.com/parent-contexts: Organization
+    discovery.miloapis.com/parent-contexts: Organization,Platform
   name: roles.iam.miloapis.com
 spec:
   group: iam.miloapis.com
diff --git a/config/crd/bases/iam/iam.miloapis.com_userdeactivations.yaml b/config/crd/bases/iam/iam.miloapis.com_userdeactivations.yaml
@@ -4,6 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
+    discovery.miloapis.com/parent-contexts: Platform
   name: userdeactivations.iam.miloapis.com
 spec:
   group: iam.miloapis.com
diff --git a/config/crd/bases/iam/iam.miloapis.com_users.yaml b/config/crd/bases/iam/iam.miloapis.com_users.yaml
@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
-    discovery.miloapis.com/parent-contexts: User
+    discovery.miloapis.com/parent-contexts: Platform,User
   name: users.iam.miloapis.com
 spec:
   group: iam.miloapis.com
diff --git a/config/crd/bases/infrastructure/infrastructure.miloapis.com_projectcontrolplanes.yaml b/config/crd/bases/infrastructure/infrastructure.miloapis.com_projectcontrolplanes.yaml
@@ -4,6 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
+    discovery.miloapis.com/parent-contexts: Platform
   name: projectcontrolplanes.infrastructure.miloapis.com
 spec:
   group: infrastructure.miloapis.com
diff --git a/config/crd/bases/notes/notes.miloapis.com_clusternotes.yaml b/config/crd/bases/notes/notes.miloapis.com_clusternotes.yaml
@@ -4,6 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
+    discovery.miloapis.com/parent-contexts: Platform
   name: clusternotes.notes.miloapis.com
 spec:
   group: notes.miloapis.com
diff --git a/config/crd/bases/notification/notification.miloapis.com_contactgroupmembershipremovals.yaml b/config/crd/bases/notification/notification.miloapis.com_contactgroupmembershipremovals.yaml
@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
-    discovery.miloapis.com/parent-contexts: User
+    discovery.miloapis.com/parent-contexts: Platform,User
   name: contactgroupmembershipremovals.notification.miloapis.com
 spec:
   group: notification.miloapis.com
diff --git a/config/crd/bases/notification/notification.miloapis.com_contactgroupmemberships.yaml b/config/crd/bases/notification/notification.miloapis.com_contactgroupmemberships.yaml
@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
-    discovery.miloapis.com/parent-contexts: User
+    discovery.miloapis.com/parent-contexts: Platform,User
   name: contactgroupmemberships.notification.miloapis.com
 spec:
   group: notification.miloapis.com
diff --git a/config/crd/bases/notification/notification.miloapis.com_contactgroups.yaml b/config/crd/bases/notification/notification.miloapis.com_contactgroups.yaml
@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
-    discovery.miloapis.com/parent-contexts: User
+    discovery.miloapis.com/parent-contexts: Platform,User
   name: contactgroups.notification.miloapis.com
 spec:
   group: notification.miloapis.com
diff --git a/config/crd/bases/notification/notification.miloapis.com_contacts.yaml b/config/crd/bases/notification/notification.miloapis.com_contacts.yaml
@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
-    discovery.miloapis.com/parent-contexts: User
+    discovery.miloapis.com/parent-contexts: Platform,User
   name: contacts.notification.miloapis.com
 spec:
   group: notification.miloapis.com
diff --git a/config/crd/bases/notification/notification.miloapis.com_emailbroadcasts.yaml b/config/crd/bases/notification/notification.miloapis.com_emailbroadcasts.yaml
@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
-    discovery.miloapis.com/parent-contexts: User
+    discovery.miloapis.com/parent-contexts: Platform,User
   name: emailbroadcasts.notification.miloapis.com
 spec:
   group: notification.miloapis.com
diff --git a/config/crd/bases/notification/notification.miloapis.com_emails.yaml b/config/crd/bases/notification/notification.miloapis.com_emails.yaml
@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
-    discovery.miloapis.com/parent-contexts: User
+    discovery.miloapis.com/parent-contexts: Platform,User
   name: emails.notification.miloapis.com
 spec:
   group: notification.miloapis.com
diff --git a/config/crd/bases/notification/notification.miloapis.com_emailtemplates.yaml b/config/crd/bases/notification/notification.miloapis.com_emailtemplates.yaml
@@ -4,6 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
+    discovery.miloapis.com/parent-contexts: Platform
   name: emailtemplates.notification.miloapis.com
 spec:
   group: notification.miloapis.com
diff --git a/config/crd/bases/quota/quota.miloapis.com_claimcreationpolicies.yaml b/config/crd/bases/quota/quota.miloapis.com_claimcreationpolicies.yaml
@@ -4,6 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
+    discovery.miloapis.com/parent-contexts: Platform
   name: claimcreationpolicies.quota.miloapis.com
 spec:
   group: quota.miloapis.com
diff --git a/config/crd/bases/quota/quota.miloapis.com_grantcreationpolicies.yaml b/config/crd/bases/quota/quota.miloapis.com_grantcreationpolicies.yaml
@@ -4,6 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
+    discovery.miloapis.com/parent-contexts: Platform
   name: grantcreationpolicies.quota.miloapis.com
 spec:
   group: quota.miloapis.com
diff --git a/config/crd/bases/quota/quota.miloapis.com_resourceregistrations.yaml b/config/crd/bases/quota/quota.miloapis.com_resourceregistrations.yaml
@@ -4,6 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
+    discovery.miloapis.com/parent-contexts: Platform
   name: resourceregistrations.quota.miloapis.com
 spec:
   group: quota.miloapis.com
diff --git a/config/crd/bases/resourcemanager/resourcemanager.miloapis.com_organizations.yaml b/config/crd/bases/resourcemanager/resourcemanager.miloapis.com_organizations.yaml
@@ -4,6 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
+    discovery.miloapis.com/parent-contexts: Platform
   name: organizations.resourcemanager.miloapis.com
 spec:
   group: resourcemanager.miloapis.com
diff --git a/pkg/apis/iam/v1alpha1/platformaccessapproval_types.go b/pkg/apis/iam/v1alpha1/platformaccessapproval_types.go
@@ -19,6 +19,7 @@ const (
 // +kubebuilder:resource:scope=Cluster
 // +kubebuilder:selectablefield:JSONPath=".spec.subjectRef.email"
 // +kubebuilder:selectablefield:JSONPath=".spec.subjectRef.userRef.name"
+// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Platform"
 type PlatformAccessApproval struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/pkg/apis/iam/v1alpha1/platformaccessrejection_types.go b/pkg/apis/iam/v1alpha1/platformaccessrejection_types.go
@@ -18,6 +18,7 @@ const (
 // It represents a formal denial of platform access for a user. Once the rejection is created, a notification can be sent to the user.
 // +kubebuilder:resource:scope=Cluster
 // +kubebuilder:selectablefield:JSONPath=".spec.subjectRef.name"
+// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Platform"
 type PlatformAccessRejection struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/pkg/apis/iam/v1alpha1/platforminvitation_types.go b/pkg/apis/iam/v1alpha1/platforminvitation_types.go
@@ -23,6 +23,7 @@ const (
 // +kubebuilder:printcolumn:name="Age",type=date,JSONPath=".metadata.creationTimestamp"
 // It represents a platform invitation for a user.
 // +kubebuilder:resource:scope=Cluster
+// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Platform"
 type PlatformInvitation struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/pkg/apis/iam/v1alpha1/policybinding_types.go b/pkg/apis/iam/v1alpha1/policybinding_types.go
@@ -102,7 +102,7 @@ type ResourceSelector struct {
 // +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].status"
 // +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
 // +kubebuilder:resource:path=policybindings,scope=Namespaced
-// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Organization"
+// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Organization,Platform"
 type PolicyBinding struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
diff --git a/pkg/apis/iam/v1alpha1/protectedresource_types.go b/pkg/apis/iam/v1alpha1/protectedresource_types.go
@@ -57,6 +57,7 @@ type ProtectedResourceStatus struct {
 // +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].status"
 // +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
 // +kubebuilder:resource:path=protectedresources,scope=Cluster,singular=protectedresource
+// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Platform"
 type ProtectedResource struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/pkg/apis/iam/v1alpha1/role_types.go b/pkg/apis/iam/v1alpha1/role_types.go
@@ -13,7 +13,7 @@ import (
 // +kubebuilder:printcolumn:name="Launch Stage",type="string",JSONPath=".spec.launchStage"
 // +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
 // +kubebuilder:resource:scope=Namespaced
-// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Organization"
+// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Organization,Platform"
 type Role struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/pkg/apis/iam/v1alpha1/user_types.go b/pkg/apis/iam/v1alpha1/user_types.go
@@ -47,7 +47,7 @@ const (
 // +kubebuilder:resource:path=users,scope=Cluster
 // +kubebuilder:selectablefield:JSONPath=".status.registrationApproval"
 // +kubebuilder:selectablefield:JSONPath=".spec.email"
-// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=User"
+// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Platform,User"
 type User struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/pkg/apis/iam/v1alpha1/userdeactivation_types.go b/pkg/apis/iam/v1alpha1/userdeactivation_types.go
@@ -54,6 +54,7 @@ type UserDeactivationStatus struct {
 // +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
 // +kubebuilder:selectablefield:JSONPath=".spec.userRef.name"
 // +kubebuilder:resource:scope=Cluster
+// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Platform"
 type UserDeactivation struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/pkg/apis/infrastructure/v1alpha1/projectcontrolplane_types.go b/pkg/apis/infrastructure/v1alpha1/projectcontrolplane_types.go
@@ -38,6 +38,7 @@ const (
 // +kubebuilder:resource:scope=Cluster
 
 // ProjectControlPlane is the Schema for the projectcontrolplanes API.
+// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Platform"
 type ProjectControlPlane struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/pkg/apis/notes/v1alpha1/note_types.go b/pkg/apis/notes/v1alpha1/note_types.go
@@ -50,6 +50,7 @@ type Note struct {
 // +kubebuilder:selectablefield:JSONPath=".spec.nextActionTime"
 // +kubebuilder:selectablefield:JSONPath=".spec.followUp"
 // +kubebuilder:selectablefield:JSONPath=".status.createdBy"
+// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Platform"
 type ClusterNote struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/pkg/apis/notification/v1alpha1/contact_types.go b/pkg/apis/notification/v1alpha1/contact_types.go
@@ -49,7 +49,7 @@ const (
 // +kubebuilder:selectablefield:JSONPath=".spec.email"
 // +kubebuilder:selectablefield:JSONPath=".spec.subject.name"
 // +kubebuilder:selectablefield:JSONPath=".spec.subject.kind"
-// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=User"
+// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Platform,User"
 type Contact struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/pkg/apis/notification/v1alpha1/contactgroup_types.go b/pkg/apis/notification/v1alpha1/contactgroup_types.go
@@ -53,7 +53,7 @@ const (
 // +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
 // +kubebuilder:resource:scope=Namespaced
 // +kubebuilder:selectablefield:JSONPath=".spec.visibility"
-// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=User"
+// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Platform,User"
 type ContactGroup struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/pkg/apis/notification/v1alpha1/contactgroupmembership.go b/pkg/apis/notification/v1alpha1/contactgroupmembership.go
@@ -52,7 +52,7 @@ const (
 // +kubebuilder:selectablefield:JSONPath=".spec.contactRef.name"
 // +kubebuilder:selectablefield:JSONPath=".spec.contactGroupRef.name"
 // +kubebuilder:selectablefield:JSONPath=".status.username"
-// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=User"
+// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Platform,User"
 type ContactGroupMembership struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/pkg/apis/notification/v1alpha1/contactgroupmembershipremoval_types.go b/pkg/apis/notification/v1alpha1/contactgroupmembershipremoval_types.go
@@ -26,7 +26,7 @@ const (
 // +kubebuilder:validation:Type=object
 // +kubebuilder:selectablefield:JSONPath=".spec.contactRef.name"
 // +kubebuilder:selectablefield:JSONPath=".status.username"
-// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=User"
+// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Platform,User"
 type ContactGroupMembershipRemoval struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/pkg/apis/notification/v1alpha1/email_types.go b/pkg/apis/notification/v1alpha1/email_types.go
@@ -156,7 +156,7 @@ type EmailStatus struct {
 // +kubebuilder:resource:scope=Namespaced
 // +kubebuilder:selectablefield:JSONPath=".spec.recipient.userRef.name"
 // +kubebuilder:selectablefield:JSONPath=".spec.recipient.emailAddress"
-// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=User"
+// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Platform,User"
 type Email struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/pkg/apis/notification/v1alpha1/emailbroadcast_types.go b/pkg/apis/notification/v1alpha1/emailbroadcast_types.go
@@ -37,7 +37,7 @@ const (
 // +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].status"
 // +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
 // +kubebuilder:resource:scope=Namespaced
-// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=User"
+// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Platform,User"
 type EmailBroadcast struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/pkg/apis/notification/v1alpha1/emailtemplate_types.go b/pkg/apis/notification/v1alpha1/emailtemplate_types.go
@@ -84,6 +84,7 @@ type EmailTemplateStatus struct {
 // +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].status"
 // +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
 // +kubebuilder:resource:scope=Cluster
+// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Platform"
 type EmailTemplate struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/pkg/apis/quota/v1alpha1/claimcreationpolicy_types.go b/pkg/apis/quota/v1alpha1/claimcreationpolicy_types.go
@@ -366,6 +366,7 @@ func (t *ClaimTriggerResource) GetGVK() schema.GroupVersionKind {
 // +kubebuilder:selectablefield:JSONPath=".spec.trigger.resource.kind"
 // +kubebuilder:selectablefield:JSONPath=".spec.trigger.resource.apiVersion"
 // +kubebuilder:selectablefield:JSONPath=".spec.disabled"
+// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Platform"
 type ClaimCreationPolicy struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/pkg/apis/quota/v1alpha1/grantcreationpolicy_types.go b/pkg/apis/quota/v1alpha1/grantcreationpolicy_types.go
@@ -330,6 +330,7 @@ func (t *GrantTriggerResource) GetGVK() schema.GroupVersionKind {
 // +kubebuilder:selectablefield:JSONPath=".spec.trigger.resource.apiVersion"
 // +kubebuilder:selectablefield:JSONPath=".spec.target.parentContext.kind"
 // +kubebuilder:selectablefield:JSONPath=".spec.target.parentContext.apiGroup"
+// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Platform"
 type GrantCreationPolicy struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/pkg/apis/quota/v1alpha1/resourceregistration_types.go b/pkg/apis/quota/v1alpha1/resourceregistration_types.go
@@ -291,6 +291,7 @@ const (
 // +kubebuilder:validation:XValidation:rule="!has(oldSelf.spec.resourceType) || self.spec.resourceType == oldSelf.spec.resourceType",message="spec.resourceType is immutable"
 // +kubebuilder:validation:XValidation:rule="!has(oldSelf.spec.consumerType) || self.spec.consumerType == oldSelf.spec.consumerType",message="spec.consumerType is immutable"
 // +kubebuilder:validation:XValidation:rule="!has(oldSelf.spec.type) || self.spec.type == oldSelf.spec.type",message="spec.type is immutable"
+// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Platform"
 type ResourceRegistration struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/pkg/apis/resourcemanager/v1alpha1/organization_types.go b/pkg/apis/resourcemanager/v1alpha1/organization_types.go
@@ -43,6 +43,7 @@ type OrganizationStatus struct {
 // +kubebuilder:printcolumn:name="Age",type=date,JSONPath=".metadata.creationTimestamp"
 // Organization is the Schema for the Organizations API
 // +kubebuilder:object:root=true
+// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Platform"
 type Organization struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/pkg/apis/resourcemanager/v1alpha1/organizationmembership_types.go b/pkg/apis/resourcemanager/v1alpha1/organizationmembership_types.go
@@ -58,9 +58,9 @@ import (
 // +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].status"
 // +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
 // +kubebuilder:resource:path=organizationmemberships,scope=Namespaced,singular=organizationmembership
-// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Organization,User"
 // +kubebuilder:selectablefield:JSONPath=".spec.userRef.name"
 // +kubebuilder:selectablefield:JSONPath=".spec.organizationRef.name"
+// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Organization,User"
 type OrganizationMembership struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/pkg/apis/resourcemanager/v1alpha1/project_types.go b/pkg/apis/resourcemanager/v1alpha1/project_types.go
@@ -56,11 +56,11 @@ const (
 // +kubebuilder:object:root=true
 // +kubebuilder:subresource:status
 // +kubebuilder:resource:scope=Cluster
-// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Organization"
 
 // Project is the Schema for the projects API.
 // +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].status"
 // +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
+// +kubebuilder:metadata:annotations="discovery.miloapis.com/parent-contexts=Organization"
 type Project struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
