add two ways of UI binding

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

On-behalf-of: @SAP karol.szwaj@sap.com

Author: cnvergence

backend/http/handler.go

@@ -149,6 +149,7 @@ func (h *handler) AddRoutes(mux *mux.Router) error {
 	// Public API routes (no authentication required)
 	mux.HandleFunc("/api/healthz", h.handleHealthz).Methods(http.MethodGet)
 	mux.HandleFunc("/api/bindable-resources", h.handleBindableResources).Methods(http.MethodGet)
+	mux.HandleFunc("/api/konnector-manifests", h.handleKonnectorManifests).Methods(http.MethodGet)
 
 	// Generic authentication routes (support both UI and CLI)
 	mux.HandleFunc("/api/authorize", h.authHandler.HandleAuthorize).Methods(http.MethodGet, http.MethodPost)
@@ -197,6 +198,92 @@ func (h *handler) handlePing(w http.ResponseWriter, r *http.Request) {
 	w.Write([]byte("pong")) //nolint:errcheck
 }
 
+// handleKonnectorManifests returns the pre-rendered konnector YAML manifests
+// that a consumer cluster needs to apply to deploy the konnector agent.
+func (h *handler) handleKonnectorManifests(w http.ResponseWriter, r *http.Request) {
+	prepareNoCache(w)
+
+	konnectorVersion, err := bindversion.BinaryVersion(componentbaseversion.Get().GitVersion)
+	if err != nil {
+		konnectorVersion = "latest"
+	}
+	konnectorImage := fmt.Sprintf("ghcr.io/kube-bind/konnector:%s", konnectorVersion)
+
+	manifests := fmt.Sprintf(`apiVersion: v1
+kind: Namespace
+metadata:
+  name: kube-bind
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: konnector
+  namespace: kube-bind
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kube-bind-konnector
+rules:
+- apiGroups: ["*"]
+  resources: ["*"]
+  verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: kube-bind-konnector
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kube-bind-konnector
+subjects:
+- kind: ServiceAccount
+  name: konnector
+  namespace: kube-bind
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: konnector
+  namespace: kube-bind
+  labels:
+    app: konnector
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: konnector
+  template:
+    metadata:
+      labels:
+        app: konnector
+    spec:
+      restartPolicy: Always
+      serviceAccountName: konnector
+      containers:
+      - name: konnector
+        image: %s
+        env:
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: 8090
+`, konnectorImage)
+
+	w.Header().Set("Content-Type", "text/yaml")
+	w.Header().Set("Content-Disposition", "attachment; filename=konnector.yaml")
+	w.Write([]byte(manifests)) //nolint:errcheck
+}
+
 func (h *handler) handleLogout(w http.ResponseWriter, r *http.Request) {
 	prepareNoCache(w)
 
@@ -368,7 +455,8 @@ func (h *handler) handleBind(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// Resolve the UI sentinel to a real identity derived from the authenticated session.
-	if identity == auth.UIIdentity {
+	isUIFlow := identity == auth.UIIdentity
+	if isUIFlow {
 		identity = state.Token.Issuer + "/" + state.Token.Subject
 		logger.Info("Resolved ui-identity from session", "identity", identity)
 	}
@@ -411,6 +499,26 @@ func (h *handler) handleBind(w http.ResponseWriter, r *http.Request) {
 		},
 	}
 
+	// For UI-only flow, create the APIServiceExportRequest on the provider cluster
+	// and wait for reconciliation. In CLI flow the konnector handles this instead.
+	var exportRequestName string
+	if isUIFlow {
+		exportRequest, err := h.kubeManager.CreateAPIServiceExportRequest(
+			r.Context(),
+			params.ClusterID,
+			handleResult.Namespace,
+			bindRequest.Name,
+			request.Spec,
+		)
+		if err != nil {
+			logger.Error(err, "failed to create APIServiceExportRequest")
+			statusCode, code, details := mapErrorToCode(err)
+			writeErrorResponse(w, statusCode, code, "Failed to create API service export request", details)
+			return
+		}
+		exportRequestName = exportRequest.Name
+	}
+
 	// callback response
 	requestBytes, err := json.Marshal(&request)
 	if err != nil {
@@ -430,8 +538,10 @@ func (h *handler) handleBind(w http.ResponseWriter, r *http.Request) {
 				ID:        state.Token.Issuer + "/" + state.Token.Subject,
 			},
 		},
-		Kubeconfig: handleResult.Kubeconfig,
-		Requests:   []runtime.RawExtension{{Raw: requestBytes}},
+		Kubeconfig:        handleResult.Kubeconfig,
+		Requests:          []runtime.RawExtension{{Raw: requestBytes}},
+		ProviderNamespace: handleResult.Namespace,
+		BindingName:       exportRequestName,
 	}
 
 	payload, err := json.Marshal(&response)

backend/kubernetes/manager.go

@@ -20,6 +20,7 @@ import (
 	"context"
 	"fmt"
 	"strings"
+	"time"
 
 	authzv1 "k8s.io/api/authorization/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -30,6 +31,7 @@ import (
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/wait"
 	authorizationv1 "k8s.io/client-go/kubernetes/typed/authorization/v1"
 	"k8s.io/klog/v2"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -173,6 +175,80 @@ func (m *Manager) HandleResources(
 	}, nil
 }
 
+// CreateAPIServiceExportRequest creates an APIServiceExportRequest in the given namespace
+// on the provider cluster and waits for it to be reconciled (Succeeded or Failed).
+func (m *Manager) CreateAPIServiceExportRequest(
+	ctx context.Context,
+	cluster, namespace, name string,
+	spec kubebindv1alpha2.APIServiceExportRequestSpec,
+) (*kubebindv1alpha2.APIServiceExportRequest, error) {
+	logger := klog.FromContext(ctx).WithValues("namespace", namespace, "name", name)
+
+	cl, err := m.manager.GetCluster(ctx, cluster)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get cluster client: %w", err)
+	}
+	c := cl.GetClient()
+
+	exportRequest := &kubebindv1alpha2.APIServiceExportRequest{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: namespace,
+		},
+		Spec: spec,
+	}
+
+	// Create the APIServiceExportRequest, handling name conflicts
+	if err := c.Create(ctx, exportRequest); err != nil {
+		if !errors.IsAlreadyExists(err) {
+			return nil, fmt.Errorf("failed to create APIServiceExportRequest: %w", err)
+		}
+		// Name conflict: use generateName
+		exportRequest.Name = ""
+		exportRequest.GenerateName = name + "-"
+		if err := c.Create(ctx, exportRequest); err != nil {
+			return nil, fmt.Errorf("failed to create APIServiceExportRequest with generated name: %w", err)
+		}
+	}
+
+	createdName := exportRequest.Name
+	logger = logger.WithValues("createdName", createdName)
+	logger.Info("Created APIServiceExportRequest, waiting for reconciliation")
+
+	// Poll until reconciled. The client reads from cache, so the object may not
+	// be visible immediately after creation. Tolerate NotFound for an initial
+	// grace period before treating it as a real deletion.
+	var result *kubebindv1alpha2.APIServiceExportRequest
+	seenOnce := false
+	if err := wait.PollUntilContextTimeout(ctx, 1*time.Second, 60*time.Second, false, func(ctx context.Context) (bool, error) {
+		req := &kubebindv1alpha2.APIServiceExportRequest{}
+		if err := c.Get(ctx, types.NamespacedName{Namespace: namespace, Name: createdName}, req); err != nil {
+			if errors.IsNotFound(err) {
+				if seenOnce {
+					return false, fmt.Errorf("APIServiceExportRequest %s was deleted", createdName)
+				}
+				// Cache hasn't synced yet — keep polling.
+				return false, nil
+			}
+			return false, err
+		}
+		seenOnce = true
+		if req.Status.Phase == kubebindv1alpha2.APIServiceExportRequestPhaseSucceeded {
+			result = req
+			return true, nil
+		}
+		if req.Status.Phase == kubebindv1alpha2.APIServiceExportRequestPhaseFailed {
+			return false, fmt.Errorf("APIServiceExportRequest failed: %s", req.Status.TerminalMessage)
+		}
+		return false, nil
+	}); err != nil {
+		return nil, fmt.Errorf("waiting for APIServiceExportRequest: %w", err)
+	}
+
+	logger.Info("APIServiceExportRequest reconciled successfully")
+	return result, nil
+}
+
 func (m *Manager) ListCustomResourceDefinitions(ctx context.Context, cluster string, selector labels.Selector) (*apiextensionsv1.CustomResourceDefinitionList, error) {
 	cl, err := m.manager.GetCluster(ctx, cluster)
 	if err != nil {

sdk/apis/kubebind/v1alpha2/bindingresponse_types.go

@@ -55,6 +55,21 @@ type BindingResourceResponse struct {
 	// +kubebuilder:validation:Required
 	// +kubebuilder:validation:MinItems=1
 	Requests []runtime.RawExtension `json:"requests"`
+
+	// providerNamespace is the namespace on the service provider cluster where the
+	// binding resources (APIServiceExport, BoundSchema, etc.) are created and managed.
+	// This is set when the binding is created via the UI flow.
+	//
+	// +optional
+	// +kubebuilder:validation:Optional
+	ProviderNamespace string `json:"providerNamespace,omitempty"`
+
+	// bindingName is the confirmed name for this binding, as created on the service
+	// provider cluster.
+	//
+	// +optional
+	// +kubebuilder:validation:Optional
+	BindingName string `json:"bindingName,omitempty"`
 }
 
 // BindingResponseAuthentication is the authentication data specific to the