[nadaverell]

A refactor with no behavior change: certificate → issuer links are identical before and after. It moves cached observed-dependency materialization into one shared helper, so the identity, scope and deduplication rules have one implementation. The KEDA (#1987) and Flux (#1989) dependency PRs are built on it; it exists so those two don't carry separate copies of the same logic.

Controller-specific parsers supply exact source/target references and retain their own defaults and valid-kind rules. The common helper groups target reads by group/kind, lists each kind once, reuses existing node identities and adds only observed referenced targets. Missing sources or targets and repeated passes cannot fabricate or duplicate relationships. Exact cluster authorization metadata stays attached to materialized nodes.

Validation: the complete Go, type-check and frontend matrix passes at the final head. Fresh live REST/MCP checks preserve both issuer dependency directions and the Issuer's metadata owner. Unit cases cover lookup fanout, missing/reused targets, scope/group collisions, absent sources and repeated-pass deduplication. Visual testing is skipped because this backend refactor changes no rendered surface.

No new endpoint, renderer or mandatory provider interface is added. Cached reads are distinct from startup discovery and informer traffic.

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Share cached materialization of observed dependency targets

✨ Enhancement 🧪 Tests 🕐 20-40 Minutes

AI Description

• Extract shared topology handling for controller-declared dependencies backed by observed CRD
 targets.
• Preserve certificate issuer defaults, node identities, namespace scope, and cluster-scoped
 authorization metadata.
• Avoid unnecessary lookups and duplicate edges; test cache failures, reuse, and repeated passes.

Diagram

graph TD
  Cert["Certificate issuerRef"] --> Parse["Issuer reference parser"] --> Helper["Observed dependency helper"] --> Eligible{"Eligible source?"}
  Eligible -->|yes| Cache["Dynamic cache"] --> Join["Identity join"] --> Graph["Topology graph"]
  Eligible -->|no| Skip["No lookup"]
  Join -->|observed targets| Graph
  subgraph Legend
    direction LR
    _step["Processing step"] ~~~ _decision{"Decision"}
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Integrate with generic CRD graph construction

• ➕ Could reuse CRD target discovery already performed by the generic graph pass.
• ➖ Couples explicit dependencies to generic CRD settings and ownership handling.
• ➖ Makes certificate issuer behavior harder to preserve independently.

Recommendation: Keep the focused shared helper: it makes declared dependencies reusable without changing the generic CRD pass or public contracts. The generic-pass alternative offers possible lookup reuse but adds coupling and behavior risk.

Files changed (4) +160 / -63

Enhancement (1) +107 / -0

observed_dependencies.goAdd shared cached observed-dependency graph construction +107/-0

Add shared cached observed-dependency graph construction

• Groups eligible references by exact group and kind, lists referenced targets once per kind, and joins only observed objects by canonical identity. Reuses existing nodes, preserves cluster-scoped authorization metadata, deduplicates Uses edges, and reports list failures per kind.

pkg/topology/observed_dependencies.go

Refactor (1) +7 / -61

certificate_issuers.goDelegate certificate issuer dependencies to the shared helper +7/-61

Delegate certificate issuer dependencies to the shared helper

• Retains issuerRef defaults, valid kinds, and namespaced versus cluster-scoped target selection. Converts valid declarations to exact resource references and delegates observed-target resolution and graph materialization.

pkg/topology/certificate_issuers.go

Tests (2) +46 / -2

certificate_issuers_test.goAdjust unavailable-issuer regression expectations +2/-2

Adjust unavailable-issuer regression expectations

• Gives the certificate source its namespace identity and expects one list-failure warning for the referenced Issuer kind rather than warnings for both issuer kinds.

pkg/topology/certificate_issuers_test.go

observed_dependencies_test.goTest shared dependency identity and lookup behavior +44/-0

Test shared dependency identity and lookup behavior

• Covers existing-node reuse, duplicate declarations and repeated passes, namespace and absent-target filtering, and no per-reference Get calls. Verifies that a missing source does not trigger target listing.

pkg/topology/observed_dependencies_test.go

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (1) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Core-group links can hit wrong resources 📘 Rule violation ≡ Correctness

Description

addObservedDependencyEdges calls GetGVRWithGroup for every target, but an empty group is
resolved through the unqualified kind lookup rather than an exact core-group lookup. When a kind
exists in multiple API groups, the returned non-core GVR indexes observed objects under a different
group key, so valid core-group dependencies are not materialized.

Code

pkg/topology/observed_dependencies.go[56]

+		gvr, ok := provider.GetGVRWithGroup(kind.Kind, kind.Group)

Evidence

The new shared resolver requests a GVR by kind and group, but the discovery helper falls back to an
unqualified kind lookup for the empty core group. That lookup can select a non-core colliding
resource, while the resolver indexes objects with the returned GVR group and searches using the
requested core-group key, preventing the dependency from being found.

Rule 3036574: Disambiguate Kubernetes resource kinds that share the same Kind name by group-aware GVR and ID prefixes
pkg/topology/observed_dependencies.go[56-81]
pkg/k8score/discovery.go[475-499]
pkg/resourceid/model.go[35-37]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Core-group dependency targets pass an empty group to `GetGVRWithGroup`, whose fallback can select a colliding resource from another API group. The resulting GVR group does not match the dependency reference group, so valid core-group links can be skipped.
## Fix Focus Areas
- pkg/topology/observed_dependencies.go[56-78]
- pkg/k8score/discovery.go[491-531]
## Recommended Fix
Ensure the GVR lookup performs an exact group-aware match even when the requested group is empty, rather than falling back to the unqualified kind lookup. Keep observed-object indexing and dependency-key matching based on the same exact group identity, and add a collision test covering a core-group kind and a non-core resource with the same Kind.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can turn these tips off under Display > Comment parts

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[nadaverell]

/review

[qodo-free-for-open-source-projects]

Code review by qodo was updated up to the latest commit 5b8ad1e