[nadaverell]

Ingress TLS declarations share one extractor across forward context, reverse Secret context and resource topology. Named TLS Secrets resolve in the Ingress's namespace; empty names do not imply a controller default and duplicate declarations do not add duplicate links.

Resource topology connects observed Secrets to Ingress consumers through configuration edges, retaining Secret visibility. Reverse Secret context identifies the authorized Ingress and the spec.tls[].secretName field path. Exact core API-group identity prevents a custom Secret kind from borrowing core references. Failed Ingress inventory records referencedBy as omitted with reason unavailable.

Existing Ingress TLS presentation and Related Resources provide forward and reverse navigation. Secret-enabled relationship topology and explicit all-edge neighborhoods traverse the enrolled configuration links. Whole-topology REST, MCP and SSE responses use Secret-eliding defaults. This adds no endpoint, live Kubernetes reads or TLS readiness claim.

Regression tests cover duplicate and empty declarations, input immutability, namespace isolation, observed targets, Secret visibility, denied Ingress reads and unavailable inventory. Live EKS fixtures verify REST and MCP reverse field provenance, one Secret-to-Ingress configuration edge in an all-edge neighborhood, and separate Service backends in Ingress relationships. The default whole topology and SSE contain no Secret links. The fixture tests declarations and metadata; serving and TLS readiness are not claimed. Browser rendering has not been rechecked.

The final head passes the shared Go module and backend suites, both frontend test suites, type checks and the full embedded build. The shared UI suite retains one pre-existing skipped test.

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Connect Ingress TLS Secrets in topology and reverse context

✨ Enhancement 🧪 Tests 📝 Documentation 🕐 20-40 Minutes

AI Description

• Share one extractor for Ingress TLS Secret references across forward context, reverse context, and
 topology.
• Link only observed, same-namespace Secrets while preserving visibility and Ingress read
 authorization.
• Document the behavior and test deduplication, unavailable sources, and access boundaries.

Diagram

graph TD
  I["Ingress TLS"] --> E["Shared extractor"] --> T["Topology builder"] --> S["Observed Secret"]
  E --> C["Resource context"] --> F["Forward summary"]
  C --> R["Reverse consumers"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Serve all projections from a central reference index

• ➕ Could avoid repeated reference extraction when producing several projections.
• ➕ Could provide one indexed lookup for Secret consumers.
• ➖ Would couple resource context to topology indexing and its observed-resource and visibility rules.
• ➖ Requires broader changes to preserve field provenance and per-reference authorization.

Recommendation: Keep the shared pure extractor and reuse the existing topology enrollment path. It unifies declaration semantics without introducing another resolver or coupling reverse context to a graph that may omit hidden or unobserved Secrets.

Files changed (9) +196 / -4

Enhancement (4) +52 / -3

ingress.goExtract unique named Ingress TLS Secret references +24/-0

Extract unique named Ingress TLS Secret references

• Adds a pure extractor that returns same-namespace Secret references from Ingress TLS declarations. It ignores empty names, deduplicates repeated names, and handles nil input.

pkg/configrefs/ingress.go

build.goAdd Ingress consumers to reverse Secret context +21/-3

Add Ingress consumers to reverse Secret context

• Finds same-namespace Ingress TLS references for a Secret and records their API group and 'spec.tls[].secretName' provenance. Marks an unavailable Ingress source as omitted, retains per-reference access checks, and uses the shared extractor for forward Ingress summaries.

pkg/resourcecontext/build.go

types.goDefine an omission reason for unavailable sources +1/-0

Define an omission reason for unavailable sources

• Adds the 'unavailable' omission reason used when Ingresses cannot be retrieved for reverse Secret context.

pkg/resourcecontext/types.go

builder.goEnroll Ingress TLS Secrets in configuration relationships +6/-0

Enroll Ingress TLS Secrets in configuration relationships

• Passes extracted TLS Secret names into the existing configuration-reference tracking path for each Ingress. That path creates configuration edges only for observed, same-namespace Secrets when Secret visibility is enabled.

pkg/topology/builder.go

Tests (4) +138 / -1

ingress_test.goTest TLS reference extraction and input immutability +23/-0

Test TLS reference extraction and input immutability

• Checks deduplication, empty-name omission, namespace assignment, nil handling, and that extraction does not mutate the Ingress.

pkg/configrefs/ingress_test.go

build_test.goExpose Ingress fixtures through the resource provider mock +2/-1

Expose Ingress fixtures through the resource provider mock

• Extends the mock provider to return configured Ingresses, enabling reverse-reference tests.

pkg/resourcecontext/build_test.go

ingress_tls_test.goTest forward and reverse TLS context boundaries +50/-0

Test forward and reverse TLS context boundaries

• Verifies reverse provenance, deduplication, namespace isolation, denied Ingress reads, and the existing forward summary. Also checks that a failed Ingress source reports unavailable context rather than a successful empty result.

pkg/resourcecontext/ingress_tls_test.go

ingress_tls_test.goTest Ingress–Secret topology edges and relationships +63/-0

Test Ingress–Secret topology edges and relationships

• Checks that duplicate declarations produce one configuration edge and that relationships work in both directions. Verifies namespace filtering, Secret visibility, and the absence of edges to unobserved Secrets.

pkg/topology/ingress_tls_test.go

Documentation (1) +6 / -0

mcp.mdDocument Ingress TLS reference behavior +6/-0

Document Ingress TLS reference behavior

• Explains that forward context, reverse Secret references, and resource-view topology share TLS declaration extraction. Clarifies observed-Secret and visibility requirements, Ingress read gating, and the absence of inferred defaults.

docs/mcp.md

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can turn these tips off under Display > Comment parts

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Previous reviews

Review updated until commit 9ff522f ⚖️ Balanced

Results up to commit 07822ad

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Results up to commit d276fbf

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Results up to commit 057757d

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

[nadaverell]

/review

[qodo-free-for-open-source-projects]

Code review by qodo was updated up to the latest commit d276fbf

[nadaverell]

/review

[qodo-free-for-open-source-projects]

Code review by qodo was updated up to the latest commit 07822ad

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[nadaverell]

/review

[qodo-free-for-open-source-projects]

Code review by qodo was updated up to the latest commit 9ff522f