Summary
Refactor NAuth resource lookups so the controller layer no longer depends on outbound Kubernetes ports/adapters through controller-specific contracts.
Problem
Today AccountReader and AccountExportReader live as outbound ports with Kubernetes implementations under internal/adapter/outbound/k8s/.
That creates a hard contract between:
- inbound controllers
- outbound Kubernetes adapters
The contract is not generic. It relies on reconciliation-specific rules and Kubernetes-specific details such as labels and lookup conventions for NAuth-
owned resources.
This is the wrong boundary. These lookups are part of controller orchestration, not reusable outbound capabilities.
Proposed change
- remove AccountReader as an outbound port
- remove AccountExportReader as an outbound port
- move these NAuth resource lookups into the controller layer
- let controllers use the Kubernetes client directly for these queries
- keep NatsClusterReader as an outbound port
Why NatsClusterReader stays
NatsClusterReader still represents a valid outbound abstraction.
A NatsCluster does not have to come from Kubernetes forever. It could come from another backend such as a database or external service. That makes it a
reasonable port to keep.
Account and AccountExport are different. They are NAuth-owned Kubernetes resources and their lookup rules are tightly bound to reconciliation behavior in
this controller.
Expected outcome
- clearer separation of responsibilities
- less coupling between inbound and outbound layers
- fewer Kubernetes-specific controller contracts hidden behind ports
- easier evolution of reconciliation logic and resource lookup rules
Acceptance criteria
- AccountReader is removed from the outbound port layer
- AccountExportReader is removed from the outbound port layer
- controller reconciliation performs these lookups directly
- NatsClusterReader remains unchanged as an outbound port
- related tests are updated
- unused adapter code is removed
Summary
Refactor NAuth resource lookups so the controller layer no longer depends on outbound Kubernetes ports/adapters through controller-specific contracts.
Problem
Today AccountReader and AccountExportReader live as outbound ports with Kubernetes implementations under internal/adapter/outbound/k8s/.
That creates a hard contract between:
The contract is not generic. It relies on reconciliation-specific rules and Kubernetes-specific details such as labels and lookup conventions for NAuth-
owned resources.
This is the wrong boundary. These lookups are part of controller orchestration, not reusable outbound capabilities.
Proposed change
Why NatsClusterReader stays
NatsClusterReader still represents a valid outbound abstraction.
A NatsCluster does not have to come from Kubernetes forever. It could come from another backend such as a database or external service. That makes it a
reasonable port to keep.
Account and AccountExport are different. They are NAuth-owned Kubernetes resources and their lookup rules are tightly bound to reconciliation behavior in
this controller.
Expected outcome
Acceptance criteria