apply review comment, split konnector resources

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

On-behalf-of: @SAP karol.szwaj@sap.com

Author: cnvergence

backend/http/handler.go

@@ -30,12 +30,15 @@ import (
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+	kjson "k8s.io/apimachinery/pkg/runtime/serializer/json"
 	componentbaseversion "k8s.io/component-base/version"
 	"k8s.io/klog/v2"
 
 	"github.com/kube-bind/kube-bind/backend/auth"
 	"github.com/kube-bind/kube-bind/backend/client"
 	"github.com/kube-bind/kube-bind/backend/kubernetes"
+	kuberesources "github.com/kube-bind/kube-bind/backend/kubernetes/resources"
 	"github.com/kube-bind/kube-bind/backend/oidc"
 	"github.com/kube-bind/kube-bind/backend/session"
 	"github.com/kube-bind/kube-bind/backend/spaserver"
@@ -150,6 +153,9 @@ func (h *handler) AddRoutes(mux *mux.Router) error {
 	// Public API routes (no authentication required)
 	mux.HandleFunc("/api/healthz", h.handleHealthz).Methods(http.MethodGet)
 	mux.HandleFunc("/api/bindable-resources", h.handleBindableResources).Methods(http.MethodGet)
+	// Intentionally unauthenticated: serves static, deterministic deployment YAML
+	// (konnector image tag is the only variable, derived from the server's own version).
+	// No secrets or cluster-specific data are included.
 	mux.HandleFunc("/api/konnector-manifests", h.handleKonnectorManifests).Methods(http.MethodGet)
 
 	// Generic authentication routes (support both UI and CLI)
@@ -203,6 +209,8 @@ func (h *handler) handlePing(w http.ResponseWriter, r *http.Request) {
 
 // handleKonnectorManifests returns the pre-rendered konnector YAML manifests
 // that a consumer cluster needs to apply to deploy the konnector agent.
+// The manifests are generated from the same Go structs used by the one-click
+// apply flow (ensureKonnector) to avoid definition drift.
 func (h *handler) handleKonnectorManifests(w http.ResponseWriter, r *http.Request) {
 	prepareNoCache(w)
 
@@ -212,79 +220,34 @@ func (h *handler) handleKonnectorManifests(w http.ResponseWriter, r *http.Reques
 	}
 	konnectorImage := fmt.Sprintf("ghcr.io/kube-bind/konnector:%s", konnectorVersion)
 
-	manifests := fmt.Sprintf(`apiVersion: v1
-kind: Namespace
-metadata:
-  name: kube-bind
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: konnector
-  namespace: kube-bind
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: kube-bind-konnector
-rules:
-- apiGroups: ["*"]
-  resources: ["*"]
-  verbs: ["*"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: kube-bind-konnector
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: kube-bind-konnector
-subjects:
-- kind: ServiceAccount
-  name: konnector
-  namespace: kube-bind
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: konnector
-  namespace: kube-bind
-  labels:
-    app: konnector
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app: konnector
-  template:
-    metadata:
-      labels:
-        app: konnector
-    spec:
-      restartPolicy: Always
-      serviceAccountName: konnector
-      containers:
-      - name: konnector
-        image: %s
-        env:
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        readinessProbe:
-          httpGet:
-            path: /healthz
-            port: 8090
-`, konnectorImage)
+	manifests := kuberesources.NewKonnectorManifests(konnectorImage)
+
+	// Serialize each object to YAML and join with document separators
+	s := runtime.NewScheme()
+	kuberesources.AddKonnectorSchemes(s)
+	encoder := kjson.NewSerializerWithOptions(
+		kjson.DefaultMetaFactory,
+		s,
+		s,
+		kjson.SerializerOptions{Yaml: true, Pretty: true, Strict: false},
+	)
+	codec := serializer.NewCodecFactory(s).EncoderForVersion(encoder, nil)
+
+	var buf strings.Builder
+	objects := manifests.Objects()
+	for i, obj := range objects {
+		if i > 0 {
+			buf.WriteString("---\n")
+		}
+		if err := codec.Encode(obj, &buf); err != nil {
+			writeErrorResponse(w, http.StatusInternalServerError, kubebindv1alpha2.ErrorCodeInternalError, "Failed to serialize konnector manifests", err.Error())
+			return
+		}
+	}
 
 	w.Header().Set("Content-Type", "text/yaml")
 	w.Header().Set("Content-Disposition", "attachment; filename=konnector.yaml")
-	w.Write([]byte(manifests)) //nolint:errcheck
+	w.Write([]byte(buf.String())) //nolint:errcheck
 }
 
 func (h *handler) handleLogout(w http.ResponseWriter, r *http.Request) {

backend/kubernetes/manager.go

@@ -25,15 +25,13 @@ import (
 	appsv1 "k8s.io/api/apps/v1"
 	authzv1 "k8s.io/api/authorization/v1"
 	corev1 "k8s.io/api/core/v1"
-	rbacv1 "k8s.io/api/rbac/v1"
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/util/intstr"
 	"k8s.io/apimachinery/pkg/util/wait"
 	"k8s.io/client-go/kubernetes/scheme"
 	authorizationv1 "k8s.io/client-go/kubernetes/typed/authorization/v1"
@@ -569,122 +567,26 @@ func (m *Manager) ApplyToConsumer(
 func (m *Manager) ensureKonnector(ctx context.Context, c client.Client, konnectorImage string) (bool, error) {
 	// Check if konnector deployment already exists
 	existing := &appsv1.Deployment{}
-	err := c.Get(ctx, types.NamespacedName{Name: "konnector", Namespace: "kube-bind"}, existing)
+	err := c.Get(ctx, types.NamespacedName{Name: kuberesources.KonnectorDeploymentName, Namespace: kuberesources.KonnectorNamespace}, existing)
 	if err == nil {
 		return false, nil // already deployed
 	}
 	if !errors.IsNotFound(err) {
 		return false, fmt.Errorf("failed to check for existing konnector: %w", err)
 	}
 
-	// ServiceAccount
-	sa := &corev1.ServiceAccount{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "konnector",
-			Namespace: "kube-bind",
-		},
-	}
-	if err := c.Create(ctx, sa); err != nil && !errors.IsAlreadyExists(err) {
-		return false, fmt.Errorf("failed to create konnector service account: %w", err)
-	}
+	manifests := kuberesources.NewKonnectorManifests(konnectorImage)
 
-	// ClusterRole
-	cr := &rbacv1.ClusterRole{
-		ObjectMeta: metav1.ObjectMeta{
-			Name: "kube-bind-konnector",
-		},
-		Rules: []rbacv1.PolicyRule{
-			{
-				APIGroups: []string{"*"},
-				Resources: []string{"*"},
-				Verbs:     []string{"*"},
-			},
-		},
+	if err := c.Create(ctx, manifests.ServiceAccount); err != nil && !errors.IsAlreadyExists(err) {
+		return false, fmt.Errorf("failed to create konnector service account: %w", err)
 	}
-	if err := c.Create(ctx, cr); err != nil && !errors.IsAlreadyExists(err) {
+	if err := c.Create(ctx, manifests.ClusterRole); err != nil && !errors.IsAlreadyExists(err) {
 		return false, fmt.Errorf("failed to create konnector cluster role: %w", err)
 	}
-
-	// ClusterRoleBinding
-	crb := &rbacv1.ClusterRoleBinding{
-		ObjectMeta: metav1.ObjectMeta{
-			Name: "kube-bind-konnector",
-		},
-		RoleRef: rbacv1.RoleRef{
-			APIGroup: "rbac.authorization.k8s.io",
-			Kind:     "ClusterRole",
-			Name:     "kube-bind-konnector",
-		},
-		Subjects: []rbacv1.Subject{
-			{
-				Kind:      "ServiceAccount",
-				Name:      "konnector",
-				Namespace: "kube-bind",
-			},
-		},
-	}
-	if err := c.Create(ctx, crb); err != nil && !errors.IsAlreadyExists(err) {
+	if err := c.Create(ctx, manifests.ClusterRoleBinding); err != nil && !errors.IsAlreadyExists(err) {
 		return false, fmt.Errorf("failed to create konnector cluster role binding: %w", err)
 	}
-
-	// Deployment
-	replicas := int32(2)
-	httpPort := intstr.FromInt(8090)
-	deploy := &appsv1.Deployment{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "konnector",
-			Namespace: "kube-bind",
-			Labels:    map[string]string{"app": "konnector"},
-		},
-		Spec: appsv1.DeploymentSpec{
-			Replicas: &replicas,
-			Selector: &metav1.LabelSelector{
-				MatchLabels: map[string]string{"app": "konnector"},
-			},
-			Template: corev1.PodTemplateSpec{
-				ObjectMeta: metav1.ObjectMeta{
-					Labels: map[string]string{"app": "konnector"},
-				},
-				Spec: corev1.PodSpec{
-					RestartPolicy:      corev1.RestartPolicyAlways,
-					ServiceAccountName: "konnector",
-					Containers: []corev1.Container{
-						{
-							Name:  "konnector",
-							Image: konnectorImage,
-							Env: []corev1.EnvVar{
-								{
-									Name: "POD_NAME",
-									ValueFrom: &corev1.EnvVarSource{
-										FieldRef: &corev1.ObjectFieldSelector{
-											FieldPath: "metadata.name",
-										},
-									},
-								},
-								{
-									Name: "POD_NAMESPACE",
-									ValueFrom: &corev1.EnvVarSource{
-										FieldRef: &corev1.ObjectFieldSelector{
-											FieldPath: "metadata.namespace",
-										},
-									},
-								},
-							},
-							ReadinessProbe: &corev1.Probe{
-								ProbeHandler: corev1.ProbeHandler{
-									HTTPGet: &corev1.HTTPGetAction{
-										Path: "/healthz",
-										Port: httpPort,
-									},
-								},
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	if err := c.Create(ctx, deploy); err != nil {
+	if err := c.Create(ctx, manifests.Deployment); err != nil {
 		return false, fmt.Errorf("failed to create konnector deployment: %w", err)
 	}