[nadaverell]

Certificates can reference a working Issuer or ClusterIssuer that has no owner-connected topology node. Join built-in issuer references to exact cached objects so the existing Depends On / Required By views and REST/MCP context can navigate the issuance dependency.

The resolver applies cert-manager's omitted-kind/group defaults, lists each target kind once and materializes only observed referenced issuers. Missing targets and same-name objects in another namespace or API group do not create links. ClusterIssuer nodes carry their exact cluster authorization tuple, and already-seeded issuers retain their metadata owner without duplicate nodes or edges. No new endpoint or permission grant is introduced.

Validation: the complete Go, type-check and frontend matrix passes at the final head. A fresh embedded build and live main/PR REST/MCP comparisons with cert-manager 1.20.2 verify both issuer directions, missing-target rejection and preservation of the Issuer's Deployment owner. Browser captures of both drawers are below.

A cold target kind may initialize an informer; the resolver performs no per-certificate object Gets. External issuer groups remain out of scope.

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Connect certificates to observed cert-manager issuers

🐞 Bug fix 🧪 Tests 📝 Documentation 🕐 20-40 Minutes

AI Description

• Resolve certificate issuer references from cached Issuer and ClusterIssuer inventories, including
 defaulted references.
• Add only observed, referenced issuers while preserving namespace, group, and cluster-scoped
 permission identity.
• Test resolution and visibility behavior, and document the resulting topology.

Diagram

graph TD
  Cert["Certificate"] --> Resolver["Reference resolver"] --> Cache["Issuer inventories"] --> Match{"Observed match?"} -->|Yes| Graph["Topology dependency"] --> Filter["Permission filter"]
  Match -->|No| Skip["No issuer link"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Fetch each referenced issuer individually

• ➕ Avoids listing unreferenced issuer objects.
• ➖ Introduces per-certificate lookups and potentially substantial API traffic.
• ➖ Does not use the existing cached per-kind inventory.

Recommendation: Keep cached per-kind listing: it bounds issuer lookups to one list per available kind and permits exact identity checks before adding nodes. Per-certificate fetching offers little benefit here relative to its lookup cost.

Files changed (4) +186 / -33

Bug fix (2) +90 / -32

builder.goDelegate certificate issuer linking to cached resolution +2/-32

Delegate certificate issuer linking to cached resolution

• Replaces the existing-node-only issuer edge loop with the new resolver and propagates its lookup warnings.

pkg/topology/builder.go

certificate_issuers.goResolve and link observed built-in issuers +88/-0

Resolve and link observed built-in issuers

• Lists available issuer kinds through the dynamic provider, applies default kind and group, and matches references by exact group, kind, namespace, and name. Creates nodes only for referenced observed issuers and records the dynamic permission tuple on new ClusterIssuer nodes.

pkg/topology/certificate_issuers.go

Tests (1) +95 / -0

certificate_issuers_test.goTest cached issuer joins and permission filtering +95/-0

Test cached issuer joins and permission filtering

• Covers default and cluster issuer references, collisions, missing and shared targets, lookup failures, and denied cluster-scoped visibility. Asserts one list per issuer kind and no per-certificate object fetches.

pkg/topology/certificate_issuers_test.go

Documentation (1) +1 / -1

integrations.mdClarify cert-manager issuer topology behavior +1/-1

Clarify cert-manager issuer topology behavior

• Documents links to observed, referenced built-in issuers, cert-manager reference defaults, external-group exclusions, and cluster-scoped visibility.

docs/integrations.md

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Referenced issuers lose owner links ✓ Resolved

Description

addCertificateIssuerEdges adds a referenced issuer before addGenericCRDNodes, whose
existing-resource check then skips that issuer without creating its owner edges. When a referenced
issuer has an owner reference to a node already in the topology and generic CRD support is enabled,
its owner-to-issuer relationship is absent.

Code

pkg/topology/certificate_issuers.go[R82-83]

+			nodes = append(nodes, Node{ID: target, Kind: NodeKind(kind), Name: name, Status: extractGenericStatus(issuer), Data: data})
+			byResource[key] = target

Evidence

The new pass appends the issuer node before the generic pass runs. The generic pass skips candidates
whose exact resource identity is already present, and its owner edges are generated only for
candidates it adds.

pkg/topology/builder.go[5769-5775]
pkg/topology/builder.go[8874-8879]
pkg/topology/builder.go[8927-8953]
pkg/topology/certificate_issuers.go[75-85]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Adding a referenced issuer before the generic CRD pass causes that pass to skip the issuer and omit its owner-reference edges.
## Fix Focus Areas
- pkg/topology/certificate_issuers.go[75-85]
- pkg/topology/builder.go[8874-8879]
- pkg/topology/builder.go[8927-8953]
## Recommended Fix
Preserve owner-reference edge creation for issuer nodes already added by the certificate pass. Reuse the generic pass's exact-resource owner resolution and avoid adding a duplicate issuer node or edge.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can turn these tips off under Display > Comment parts

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3b78585. Configure here.}