fix(k8s-client): fix error classification for failed kubeconfig ingestion

[tjrasche]

Summary

Classify kubeconfig loading, parsing, and file-derived client construction failures as ErrCodeInvalidRequest instead of ErrCodeInternal.

Surfaced while working on a unrelated PR as a finding by @mchmarny: #1735 (comment)

Motivation / Context

Invalid caller configuration is deterministic and should not be reported as a retryable internal failure to SDK and API consumers.

Fixes: N/A
Related: N/A

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactoring (no functional changes)
• Build/CI/tooling

Component(s) Affected

• CLI (cmd/aicr, pkg/cli)
• API server (cmd/aicrd, pkg/server)
• Recipe engine / data (pkg/recipe)
• Bundlers (pkg/bundler, pkg/component/*)
• Collectors / snapshotter (pkg/collector, pkg/snapshotter)
• Validator (pkg/validator)
• Core libraries (pkg/errors, pkg/k8s)
• Docs/examples (docs/, examples/)
• Other: ____________

Implementation Notes

File-derived configuration errors are now INVALID_REQUEST; in-cluster configuration failures remain INTERNAL. Existing causes and kubeconfig-path context are preserved.

Testing

make qualify

All tests, lint checks, e2e tests, and scans passed.

Risk Assessment

• Low — Isolated change, well-tested, easy to revert
• Medium — Touches multiple components or has broader impact
• High — Breaking change, affects critical paths, or complex rollout

Rollout notes: No migration required. This changes the structured code returned for invalid kubeconfig input.

Checklist

• Tests pass locally (make test with -race)
• Linter passes (make lint)
• I did not skip/disable tests to make CI green
• I added/updated tests for new functionality
• I updated docs if user-facing behavior changed
• Changes follow existing patterns in the codebase
• Commits are cryptographically signed (git commit -S) — GPG signing info

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

BuildKubeClient now returns typed invalid-request errors for kubeconfig parsing and kubeconfig-driven Kubernetes client construction failures, including kubeconfig context. CLI, serializer, and snapshotter callers preserve these structured errors, with tests covering invalid paths, client initialization, and downstream propagation.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Suggested reviewers: mchmarny

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: kubeconfig ingestion error classification was fixed.
Description check	✅ Passed	The description accurately describes the kubeconfig error-code changes and is directly related to the changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/k8s/client/client_test.go`:
- Around line 41-56: Extend the invalid kubeconfig cases in the BuildKubeClient
tests to assert the structured “kubeconfig” error context contains the resolved
path. Cover both the explicit kubeconfigArg and kubeconfigEnv scenarios,
including the additional affected cases, while preserving the existing error
code and message assertions.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 88525997-b835-48ed-ae9c-9c55df83d25c

📥 Commits

Reviewing files that changed from the base of the PR and between ffe1d9c and 82afa70.

📒 Files selected for processing (2)

• pkg/k8s/client/client.go
• pkg/k8s/client/client_test.go

[mchmarny]

Direction is right and the test coverage is solid — file-derived kubeconfig failures are deterministic caller config and should not report as retryable INTERNAL. One medium finding: four call sites (serializer, snapshotter, cli/validate) still re-wrap these errors with ErrCodeInternal, so the new code gets masked on exactly the SDK paths the description targets; pkg/validator's PropagateOrWrap precedent is the fix. Plus one godoc nit. Nothing blocking merge.

[github-actions]

Recipe evidence check

No leaf overlays affected by this PR.

This gate is warning-only and never blocks merge.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/cli/validate.go`:
- Around line 159-161: Update deployAgentForValidation to create the Kubernetes
client through the config-aware helper using cfg.kubeconfig instead of the
default GetKubeClient call. Also update the snapshotter error handling in the
same function to propagate the original error while preserving the appropriate
error context, rather than flattening it to ErrCodeInternal.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 7390712a-30b3-42d4-8331-5d000757d3bb

📥 Commits

Reviewing files that changed from the base of the PR and between afc51eb and 4560d70.

📒 Files selected for processing (7)

• pkg/cli/validate.go
• pkg/serializer/configmap.go
• pkg/serializer/configmap_test.go
• pkg/serializer/reader.go
• pkg/serializer/reader_test.go
• pkg/snapshotter/agent.go
• pkg/snapshotter/agent_test.go

[mchmarny]

Latest head rechecked. File-derived kubeconfig failures now preserve ErrCodeInvalidRequest and path context through the affected consumers; in-cluster failures remain ErrCodeInternal. Focused race tests and lint pass, CI is green, and no merge blockers remain.