Request lifecycle#

main.go starts the process and HTTP server. app.go initializes configuration, database, cluster management and middleware. routes.go registers auth, administrative, protected and cluster-specific APIs. static.go serves the embedded UI with a fallback for frontend routes.

Protected resource requests go through authentication, scope/identity handling and cluster selection before their resource-specific authorization and handler. Delivery and AI have additional feature-specific permission and policy checks.

Add or modify a resource surface#

  1. Update the backend resource registry and handler registration for the kind and its scope.
  2. Use the existing generic or versioned handler where appropriate; add specialized behavior only when the resource needs it.
  3. Update ui/src/lib/resource-catalog.ts with the route identity, labels, icon and sidebar placement.
  4. Add the list/detail implementation and register it in resource-definitions.tsx if generic pages are insufficient.
  5. Add visible text to the English locale keys and keep naming consistent.
  6. Verify namespace scope, cluster scope, _all behavior, authorization and an unavailable-API case.

Keep boundaries intact#

  • Use model.SecretString for sensitive persisted strings and never log credentials.
  • Use the configured cluster manager/client path rather than constructing an unauthenticated shortcut.
  • Keep user-facing access checks and backend authorization aligned; frontend hiding is not enforcement.
  • Edit feature-level components without unnecessary changes to shadcn-managed primitives.
  • Keep runtime environment changes aligned with the Helm templates and values.