Address more comments

Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt>
 On-behalf-of: @SAP mangirdas.judeikis@sap.com

Author: mjudeikis

backend/controllers/clusterbinding/clusterbinding_reconcile.go

@@ -19,8 +19,9 @@ package clusterbinding
 import (
 	"context"
 	"fmt"
+	"maps"
 	"reflect"
-	"sort"
+	"slices"
 	"time"
 
 	corev1 "k8s.io/api/core/v1"
@@ -157,17 +158,13 @@ func (r *reconciler) ensureRBACClusterRole(ctx context.Context, client client.Cl
 			key := res.ResourceGroupName()
 			grSet[key] = kubebindv1alpha2.GroupResource{Group: res.Group, Resource: res.Resource}
 		}
-		keys := make([]string, 0, len(grSet))
-		for k := range grSet {
-			keys = append(keys, k)
-		}
-		sort.Strings(keys)
+		keys := slices.Collect(maps.Keys(grSet))
+		slices.Sort(keys)
 		for _, k := range keys {
-			gr := grSet[k]
-			name := gr.Resource + "." + gr.Group
-			schema, err := r.getBoundSchema(ctx, cache, clusterBinding.Namespace, name)
+			// k is already normalized (e.g., "pods.core" for empty group).
+			schema, err := r.getBoundSchema(ctx, cache, clusterBinding.Namespace, k)
 			if err != nil {
-				return fmt.Errorf("failed to get BoundSchema %q: %w", name, err)
+				return fmt.Errorf("failed to get BoundSchema %q: %w", k, err)
 			}
 			expected.Rules = append(expected.Rules,
 				rbacv1.PolicyRule{

backend/controllers/serviceexport/serviceexport_reconcile.go

@@ -51,15 +51,16 @@ func (r *reconciler) ensureSchema(ctx context.Context, cache cache.Cache, export
 	schemas := make([]*kubebindv1alpha2.BoundSchema, 0, len(export.Spec.Resources))
 
 	for _, res := range export.Spec.Resources {
-		schema, err := r.getBoundSchema(ctx, cache, export.Namespace, res.ResourceGroupName())
+		name := res.ResourceGroupName()
+		schema, err := r.getBoundSchema(ctx, cache, export.Namespace, name)
 		if err != nil {
 			if errors.IsNotFound(err) {
 				conditions.MarkFalse(
 					export,
 					kubebindv1alpha2.APIServiceExportConditionProviderInSync,
 					"BoundSchemaMissing",
 					conditionsapi.ConditionSeverityError,
-					"BoundSchemas are not available: %v", schema.Name)
+					"BoundSchema %q is not available: %v", name, err)
 				return nil
 			}
 			return err
@@ -68,7 +69,10 @@ func (r *reconciler) ensureSchema(ctx context.Context, cache cache.Cache, export
 		schemas = append(schemas, schema)
 	}
 
-	hash := helpers.BoundSchemasSpecHash(schemas)
+	hash, err := helpers.BoundSchemasSpecHash(schemas)
+	if err != nil {
+		return err
+	}
 
 	if export.Annotations[kubebindv1alpha2.SourceSpecHashAnnotationKey] != hash {
 		// both exist, update APIServiceExport

backend/controllers/serviceexportrequest/serviceexportrequest_reconcile.go

@@ -189,7 +189,10 @@ func (r *reconciler) ensureExports(ctx context.Context, cl client.Client, cache
 			return nil
 		}
 
-		hash := helpers.BoundSchemasSpecHash(schemas)
+		hash, err := helpers.BoundSchemasSpecHash(schemas)
+		if err != nil {
+			return err
+		}
 		export := &kubebindv1alpha2.APIServiceExport{
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      req.Name,

sdk/apis/kubebind/v1alpha2/helpers/boundschema.go

@@ -114,14 +114,14 @@ func UnstructuredToBoundSchema(u unstructured.Unstructured) (*kubebindv1alpha2.B
 	return boundSchema, nil
 }
 
-func BoundSchemasSpecHash(schemas []*kubebindv1alpha2.BoundSchema) string {
+func BoundSchemasSpecHash(schemas []*kubebindv1alpha2.BoundSchema) (string, error) {
 	hash := sha256.New()
 	for _, schema := range schemas {
 		if err := json.NewEncoder(hash).Encode(schema); err != nil {
-			continue
+			return "", fmt.Errorf("failed to encode schema %s: %w", schema.Name, err)
 		}
 	}
-	return fmt.Sprintf("%x", hash.Sum(nil))
+	return fmt.Sprintf("%x", hash.Sum(nil)), nil
 }
 
 func BoundSchemaToCRD(schema *kubebindv1alpha2.BoundSchema) *apiextensionsv1.CustomResourceDefinition {