Kubectl removal - Phase 1

[bpradipt]

No description provided.

[Copilot]

Pull request overview

This PR migrates several Kubernetes “read” operations away from kubectl subprocess calls to client-go, introducing a shared Kubernetes client factory and expanding test coverage using fake clientsets.

Changes:

• Added pkg/k8s client factory (NewClient, GetCurrentNamespace, WrapError) and migrated namespace resolution to use it.
• Reworked cluster/runtime, node IP, trustee deployment, and secret inspection read paths to use client-go with context.Context.
• Added extensive unit/integration tests (fake clientsets) and improved offline/--skip-apply behavior (including namespace precedence and sidecar cert YAML output).

Reviewed changes

Copilot reviewed 22 out of 23 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
pkg/trustee/trustee.go	Replace kubectl-based “is deployed” and namespace existence checks with client-go APIs; update Deploy signature.
pkg/trustee/trustee_test.go	Add tests for IsDeployed and ensureNamespace.
pkg/trustee/kbs.go	Use client-go for KBS pod discovery; thread context through upload paths.
pkg/trustee/kbs_test.go	Add fake-client tests for KBS pod selection behavior.
pkg/secrets/kubernetes.go	Replace kubectl JSON parsing with typed client-go reads; generate Secret YAML via native YAML marshal.
pkg/secrets/kubernetes_test.go	Large new test suite for secret inspection/offline mode/YAML generation.
pkg/secrets/secrets.go	Use pkg/k8s namespace resolution; add ctx + client-go fallback for imagePullSecrets via default ServiceAccount.
pkg/secrets/output_test.go	Switch config parsing expectations from JSON to YAML.
pkg/k8s/client.go	New shared kubeconfig discovery + namespace resolution + API error wrapper.
pkg/k8s/client_test.go	Tests for client factory, namespace discovery, and error wrapping.
pkg/cluster/runtimeclass.go	Replace kubectl runtimeclass detection with client-go list.
pkg/cluster/runtimeclass_test.go	Tests for runtime class selection logic.
pkg/cluster/nodes.go	Replace kubectl node IP extraction with client-go list + address filtering.
pkg/cluster/nodes_test.go	Tests for node IP selection/dedup logic.
cmd/root.go	Add kubectl availability detection cached in context.
cmd/init.go / cmd/init_test.go	Use client-go for runtime class + trustee checks; ensure tests set cobra context.
cmd/apply.go	Add --namespace flag + kubectl-optional --skip-apply flows; offline secret resolution; sidecar cert file output.
cmd/apply_skip_test.go	Tests for namespace precedence, skip-apply sidecar cert YAML output, and actionable error formatting.
integration_test/workflow_test.go	Add integration-ish tests validating key queries via fake clientsets without kubectl.
go.mod / go.sum	Add Kubernetes client-go dependencies and update module metadata.
.planning/phases/02-simple-read-operations/02-UAT.md	UAT notes and resolution for init test context issue.

Comments suppressed due to low confidence (1)

pkg/trustee/trustee.go:145

• ensureNamespace returns nil for any error other than NotFound, which can mask real failures (e.g., cluster unreachable, auth errors) and lead to harder-to-debug follow-on errors later. Consider explicitly handling Forbidden (if you want to assume the namespace exists) but returning a wrapped error for other unexpected failures.

	_, err := clientset.CoreV1().ServiceAccounts(namespace).List(ctx, metav1.ListOptions{Limit: 1})
	if err == nil {
		// Successfully accessed resources in namespace, so it exists
		return nil
	}

	// Check if the error indicates namespace doesn't exist
	if apierrors.IsNotFound(err) {
		// Namespace doesn't exist, try to create it with kubectl
		// (namespace creation via client-go is out of scope for this phase)
		cmd := exec.Command("kubectl", "create", "namespace", namespace)
		output, err := cmd.CombinedOutput()
		if err != nil && !strings.Contains(string(output), "AlreadyExists") {
			return fmt.Errorf("failed to create namespace: %w\n%s", err, output)
		}
		return nil
	}

	// For any other error (e.g., Forbidden when user lacks namespace creation permissions
	// but namespace exists), assume namespace exists and proceed.
	// Subsequent operations will fail appropriately if the namespace truly doesn't exist.
	return nil
}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

isKubectlAvailable uses a direct type assertion v.(bool), which will panic if the context value is ever set to a non-bool (or if a different key collides). Prefer a safe assertion (b, ok := v.(bool)) and default to false when it’s missing/unexpected.

Suggested change

	return v.(bool)
	if b, ok := v.(bool); ok {
	return b
	}

[Copilot]

This test doesn’t currently assert any behavior (it only logs). Also, fake.NewSimpleClientset() typically won’t return a NotFound error for listing ServiceAccounts in a non-existent namespace, so it won’t exercise the apierrors.IsNotFound(err) branch. Consider using a client-go reactor to force a NotFound on the List call and assert whether ensureNamespace returns the expected error/success for the create-namespace path.

[Copilot]

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 6 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 6 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.