cleanup

Author: mjudeikis

Dockerfile

@@ -12,32 +12,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.24.0 AS go-build-env
-WORKDIR /app
-
-# Accept build arguments for multi-arch support
-ARG TARGETARCH
-ARG TARGETOS
-ARG LDFLAGS
-
-RUN apt-get update && apt-get install -y make jq
-
-# <- COPY go.mod and go.sum files to the workspace
-COPY go.mod .
-COPY go.sum .
-
-# COPY the source code as the last step
-COPY . .
-
-# Build with custom LDFLAGS if provided, otherwise use make build
-# Use TARGETOS and TARGETARCH for cross-compilation
-RUN if [ -n "$LDFLAGS" ]; then \
-        echo "Building with LDFLAGS: $LDFLAGS for $TARGETOS/$TARGETARCH"; \
-        CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags="$LDFLAGS" -o bin/backend ./cmd/backend; \
-    else \
-        GOOS=$TARGETOS GOARCH=$TARGETARCH make build; \
-    fi
-
 # Use node:lts-alpine for better compatibility and smaller size
 FROM node:20.18.0-alpine3.20 AS ui-build-env
 WORKDIR /app
@@ -64,6 +38,35 @@ ENV VITE_BUILD_TARGET=docker
 # Building UI with Docker-specific config
 RUN npm run build
 
+# Build Go binary with embedded UI assets
+FROM golang:1.24.0 AS go-build-env
+WORKDIR /app
+
+# Accept build arguments for multi-arch support
+ARG TARGETARCH
+ARG TARGETOS
+ARG LDFLAGS
+
+RUN apt-get update && apt-get install -y make jq
+
+# Copy go.mod and go.sum files first for better caching
+COPY go.mod .
+COPY go.sum .
+
+# Copy the source code
+COPY . .
+
+# Copy built UI assets for embedding
+COPY --from=ui-build-env /app/dist ./backend/static/web/dist
+
+# Build with embedded assets
+RUN if [ -n "$LDFLAGS" ]; then \
+        echo "Building with LDFLAGS: $LDFLAGS for $TARGETOS/$TARGETARCH"; \
+        CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags="$LDFLAGS" -o bin/backend ./cmd/backend; \
+    else \
+        CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH make build; \
+    fi
+
 FROM alpine:3.22.1
 RUN apk --update add ca-certificates
 

Makefile

@@ -409,11 +409,15 @@ image-local:
 	@echo "  $(IMAGE_REPO)/konnector:$(REV) ($(PLATFORMS))"
 	@echo "  $(IMAGE_REPO)/backend:$(REV) ($(PLATFORMS))"
 
+# Kind cluster configuration
+KIND_CLUSTER ?= kube-bind
+DOCKER_REPO ?= $(IMAGE_REPO)
+
 .PHONY: kind-load
 kind-load:
 	@echo "Loading images into kind cluster '$(KIND_CLUSTER)'"
-	kind load docker-image $(KO_DOCKER_REPO)/konnector:$(REV) --name $(KIND_CLUSTER)
-	kind load docker-image $(KO_DOCKER_REPO)/backend:$(REV) --name $(KIND_CLUSTER)
+	kind load docker-image $(DOCKER_REPO)/konnector:$(REV) --name $(KIND_CLUSTER)
+	kind load docker-image $(DOCKER_REPO)/backend:$(REV) --name $(KIND_CLUSTER)
 	@echo "Successfully loaded images into kind cluster '$(KIND_CLUSTER)'"
 
 .PHONY: helm-build-local

backend/http/handler.go

@@ -38,6 +38,7 @@ import (
 	"github.com/kube-bind/kube-bind/backend/kubernetes"
 	"github.com/kube-bind/kube-bind/backend/session"
 	"github.com/kube-bind/kube-bind/backend/spaserver"
+	"github.com/kube-bind/kube-bind/backend/static"
 	bindversion "github.com/kube-bind/kube-bind/pkg/version"
 	kubebindv1alpha2 "github.com/kube-bind/kube-bind/sdk/apis/kubebind/v1alpha2"
 )
@@ -93,7 +94,7 @@ func NewHandler(
 	}, nil
 }
 
-func (h *handler) AddRoutes(mux *mux.Router) {
+func (h *handler) AddRoutes(mux *mux.Router) error {
 	// API routes - Server contains double routes for when backend is multi-cluster aware or single cluster.
 	// When called multi-cluster aware route in single cluster mode, it will ignore cluster parameter.
 	mux.HandleFunc("/api/clusters/{cluster}/exports", h.handleServiceExport).Methods(http.MethodGet)
@@ -120,16 +121,24 @@ func (h *handler) AddRoutes(mux *mux.Router) {
 	mux.HandleFunc("/clusters/{cluster}/exports", h.handleExportsRedirect).Methods(http.MethodGet)
 	mux.HandleFunc("/exports", h.handleExportsRedirect).Methods(http.MethodGet)
 
-	if strings.HasPrefix(h.frontend, "http://") {
+	switch {
+	case strings.HasPrefix(h.frontend, "http://"):
+		// Development mode: proxy to frontend dev server
 		spaserver, err := spaserver.NewSPAReverseProxyServer(h.frontend)
 		if err != nil {
-			panic(fmt.Sprintf("failed to create SPA reverse proxy server: %v", err)) // Development only.
+			return err
 		}
 		mux.PathPrefix("/").Handler(spaserver)
-	} else {
+	case h.frontend == "embedded":
+		// Production mode: serve embedded static files
+		fileSystem := static.GetFileSystem()
+		mux.PathPrefix("/").Handler(spaserver.NewSPAFileServer(fileSystem))
+	default:
+		// Custom filesystem path
 		fileSystem := http.Dir(h.frontend)
 		mux.PathPrefix("/").Handler(spaserver.NewSPAFileServer(fileSystem))
 	}
+	return nil
 }
 
 func (h *handler) handleExportsRedirect(w http.ResponseWriter, r *http.Request) {
@@ -579,10 +588,25 @@ func (h *handler) handleBindPost(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// Parse JSON request body
+	// Parse JSON request body
+	const maxBodySize = 1 << 20 // 1 MB
+	r.Body = http.MaxBytesReader(w, r.Body, maxBodySize)
 	var bindRequest kubebindv1alpha2.BindableResourcesRequest
 	if err := json.NewDecoder(r.Body).Decode(&bindRequest); err != nil {
 		logger.Error(err, "failed to parse JSON request body")
-		http.Error(w, "invalid JSON request body", http.StatusBadRequest)
+		var maxBytesError *http.MaxBytesError
+		if errors.As(err, &maxBytesError) {
+			http.Error(w, "request body too large", http.StatusRequestEntityTooLarge)
+		} else {
+			http.Error(w, "invalid JSON request body", http.StatusBadRequest)
+		}
+		return
+	}
+
+	err = bindRequest.Validate()
+	if err != nil {
+		logger.Error(err, "validation failed for bind request")
+		http.Error(w, fmt.Sprintf("invalid bind request: %v", err), http.StatusBadRequest)
 		return
 	}
 

backend/options/options.go

@@ -99,7 +99,7 @@ func NewOptions() *Options {
 			ClusterScopedIsolation: string(kubebindv1alpha2.IsolationPrefixed),
 			ServerURL:              "",
 			SchemaSource:           CustomResourceDefinitionSource.String(),
-			Frontend:               "/www",
+			Frontend:               "embedded",
 		},
 	}
 }

backend/server.go

@@ -123,7 +123,10 @@ func NewServer(ctx context.Context, c *Config) (*Server, error) {
 	if err != nil {
 		return nil, fmt.Errorf("error setting up HTTP Handler: %w", err)
 	}
-	handler.AddRoutes(s.WebServer.Router)
+	err = handler.AddRoutes(s.WebServer.Router)
+	if err != nil {
+		return nil, fmt.Errorf("error adding routes to HTTP Server: %w", err)
+	}
 
 	opts := controller.TypedOptions[mcreconcile.Request]{
 		SkipNameValidation: ptr.To(c.Options.TestingSkipNameValidation),

backend/static/embed.go

@@ -0,0 +1,38 @@
+/*
+Copyright 2025 The Kube Bind Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package static
+
+import (
+	"embed"
+	"io/fs"
+	"net/http"
+)
+
+// Static files embedded in the binary.
+//
+//go:embed web/dist/*
+var StaticFiles embed.FS
+
+// GetFileSystem returns the embedded file system for serving static files.
+func GetFileSystem() http.FileSystem {
+	// Create a sub-filesystem starting from web/dist
+	subFS, err := fs.Sub(StaticFiles, "web/dist")
+	if err != nil {
+		panic("failed to create sub filesystem: " + err.Error())
+	}
+	return http.FS(subFS)
+}

cli/pkg/kubectl/bind/plugin/bind.go

@@ -31,7 +31,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/davecgh/go-spew/spew"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
 	corev1 "k8s.io/api/core/v1"
@@ -158,7 +157,7 @@ func (b *BindOptions) Run(ctx context.Context, urlCh chan<- string) error {
 	if err != nil {
 		return fmt.Errorf("failed to fetch provider: %q: %v", exportURL, err)
 	}
-	spew.Dump(provider)
+
 	if provider.APIVersion != kubebindv1alpha2.GroupVersion {
 		return fmt.Errorf("unsupported binding provider version: %q != %q", provider.APIVersion, kubebindv1alpha2.GroupVersion)
 	}

hack/run-frontend.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 
 # Build frontend script for kube-bind
-# This script builds the Vue.js frontend and embeds it into the Go binary
+# This script builds the Vue.js frontend  and serves it using a development server.
 
 set -e
 

sdk/apis/kubebind/v1alpha2/bindingresponse_types.go

@@ -17,8 +17,13 @@ limitations under the License.
 package v1alpha2
 
 import (
+	"errors"
+	"fmt"
+	"strings"
+
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/util/validation"
 )
 
 // BindingResponse is a non-CRUD resource that is returned by the server after
@@ -166,3 +171,52 @@ type BindableResourcesRequest struct {
 	// +kubebuilder:validation:Optional
 	Namespaces []Namespaces `json:"namespaces,omitempty"`
 }
+
+func (r *BindableResourcesRequest) Validate() error {
+	if len(r.Resources) == 0 {
+		return errors.New("at least one resource must be specified")
+	}
+	for i, res := range r.Resources {
+		if res.Kind == "" {
+			return fmt.Errorf("resource at index %d has no kind", i)
+		}
+		if res.Scope == "" {
+			return fmt.Errorf("resource at index %d has no scope", i)
+		}
+		if res.APIVersion == "" {
+			return fmt.Errorf("resource at index %d has no apiVersion", i)
+		}
+		if res.Group == "" {
+			return fmt.Errorf("resource at index %d has no group", i)
+		}
+		if res.Resource == "" {
+			return fmt.Errorf("resource at index %d has no resource", i)
+		}
+	}
+	if len(r.Namespaces) > 0 {
+		for i, ns := range r.Namespaces {
+			if ns.Name == "" {
+				return fmt.Errorf("namespace at index %d has no name", i)
+			}
+		}
+	}
+	if r.Name == "" {
+		return errors.New("name is required")
+	}
+
+	// Validate DNS name format for the request name
+	if errs := validation.IsDNS1123Label(r.Name); len(errs) > 0 {
+		return fmt.Errorf("name %q is not a valid DNS label: %s", r.Name, strings.Join(errs, ", "))
+	}
+
+	// Validate namespace names
+	if len(r.Namespaces) > 0 {
+		for i, ns := range r.Namespaces {
+			if errs := validation.IsDNS1123Label(ns.Name); len(errs) > 0 {
+				return fmt.Errorf("namespace at index %d has invalid name %q: %s", i, ns.Name, strings.Join(errs, ", "))
+			}
+		}
+	}
+
+	return nil
+}

web/README.md

@@ -48,7 +48,7 @@ Frontend routes handle browser-based redirects for:
 #### Development with Hot Reload (Recommended)
 ```bash
 # Terminal 1: Start Go backend
-go run ./cmd/backend --listen-port=8080 --frontent http://localhost:3000
+go run ./cmd/backend --listen-port=8080 --frontend http://localhost:3000
 
 # Terminal 2: Start frontend dev server with hot reload
 cd web
@@ -73,7 +73,7 @@ npm run dev
 
 ## Project Structure
 
-```
+```text
 src/
 ├── main.ts              # Application entry point and routing
 ├── App.vue             # Root component