feat: adds labels for better discovery

maas-api/internal/tier/mapper_test.go

@@ -155,7 +155,7 @@ func TestMapper_GetTierForGroups(t *testing.T) {
 func TestMapper_GetTierForGroups_MissingConfigMap(t *testing.T) {
 	ctx := t.Context()
 
-	clientset := fake.NewSimpleClientset()
+	clientset := fake.NewClientset()
 	mapper := tier.NewMapper(clientset, testTenant, testNamespace)
 
 	// Should default to free mappedTier when ConfigMap is missing
@@ -194,7 +194,7 @@ func TestMapper_GetTierForGroups_SameLevels(t *testing.T) {
 		},
 	}
 
-	clientset := fake.NewSimpleClientset([]runtime.Object{configMap}...)
+	clientset := fake.NewClientset([]runtime.Object{configMap}...)
 	mapper := tier.NewMapper(clientset, testTenant, testNamespace)
 
 	// When levels are equal, first tier found should win

maas-api/internal/token/labels.go

@@ -0,0 +1,20 @@
+package token
+
+func namespaceLabels(instance, tier string) map[string]string {
+	return map[string]string{
+		"app.kubernetes.io/component":        "token-issuer",
+		"app.kubernetes.io/part-of":          "maas-api",
+		"maas.opendatahub.io/instance":       instance,
+		"maas.opendatahub.io/tier":           tier,
+		"maas.opendatahub.io/tier-namespace": "true",
+	}
+}
+
+func serviceAccountLabels(instance, tier string) map[string]string {
+	return map[string]string{
+		"app.kubernetes.io/component":  "token-issuer",
+		"app.kubernetes.io/part-of":    "maas-api",
+		"maas.opendatahub.io/instance": instance,
+		"maas.opendatahub.io/tier":     tier,
+	}
+}

maas-api/internal/token/manager.go

@@ -134,7 +134,7 @@ func (m *Manager) ensureTierNamespace(ctx context.Context, tier string) (string,
 	ns := &corev1.Namespace{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:   namespace,
-			Labels: commonLabels(m.tenantName, tier),
+			Labels: namespaceLabels(m.tenantName, tier),
 		},
 	}
 
@@ -171,7 +171,7 @@ func (m *Manager) ensureServiceAccount(ctx context.Context, namespace, username,
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      saName,
 			Namespace: namespace,
-			Labels:    commonLabels(m.tenantName, userTier),
+			Labels:    serviceAccountLabels(m.tenantName, userTier),
 		},
 	}
 
@@ -255,12 +255,3 @@ func (m *Manager) sanitizeServiceAccountName(username string) (string, error) {
 
 	return name + "-" + suffix, nil
 }
-
-func commonLabels(name string, t string) map[string]string {
-	return map[string]string{
-		"app.kubernetes.io/component":  "token-issuer",
-		"app.kubernetes.io/part-of":    "maas-api",
-		"maas.opendatahub.io/instance": name,
-		"maas.opendatahub.io/tier":     t,
-	}
-}

maas-api/internal/token/reviewer_test.go

@@ -1,7 +1,6 @@
 package token_test
 
 import (
-	"context"
 	"errors"
 	"slices"
 	"testing"
@@ -90,7 +89,7 @@ func TestResolver_ExtractUserInfo(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			fakeClient := fake.NewSimpleClientset()
+			fakeClient := fake.NewClientset()
 
 			if tt.tokenReviewResponse != nil || tt.tokenReviewError != nil {
 				fakeClient.PrependReactor("create", "tokenreviews", func(action ktesting.Action) (bool, runtime.Object, error) {
@@ -102,7 +101,7 @@ func TestResolver_ExtractUserInfo(t *testing.T) {
 			}
 
 			resolver := token.NewReviewer(fakeClient)
-			ctx := context.Background()
+			ctx := t.Context()
 
 			result, err := resolver.ExtractUserInfo(ctx, tt.token)