[matejvasek]

Summary

• Create a dedicated func-github ServiceAccount with RBAC permissions
  (pods, services, deployments, imagestreams, Knative serving resources)
  and a system:image-builder ClusterRole binding so CI can build and
  deploy functions
• Generate a kubeconfig from a TokenRequest (1-year expiry) and cluster
  CA/API server info, then encrypt and store it as a GitHub Actions
  KUBECONFIG secret using libsodium sealed-box encryption
• Reorder the create flow so the secret is set before the initial push,
  ensuring the workflow has cluster credentials on its first run
• Handle 409 Conflict for idempotent resource creation (both K8s Status
  objects and standard HTTP error shapes)

New files

• ClusterCredentialService interface + OcpClusterCredentialService implementation
• useClusterCredentialService hook
• ClusterCredentialService.test.ts (4 tests: happy path, two 409 shapes, error propagation)

Changed files

• GithubService -- createSecret + encryptForGithub (libsodium sealed box)
• SourceControlService interface -- added createSecret
• FunctionCreatePage -- wired getKubeconfig + createSecret before push
• SourceControlService.test.ts -- createSecret tests (encrypt + error)
• FunctionCreatePage.test.ts -- updated to verify ordering (secret before push)
• package.json / yarn.lock -- added libsodium-wrappers + @types/libsodium-wrappers

Test plan

• Unit tests pass (yarn test)
• Lint passes (yarn lint)
• Create a function from the UI on an OCP cluster with a GitHub PAT
  that has repo and admin:repo_hook scopes
• Verify the KUBECONFIG secret appears under the repo's
  Settings > Secrets and variables > Actions
• Verify the GitHub Actions workflow succeeds and deploys the
  function to the cluster
• Re-create in the same namespace to confirm 409 handling
  (SA/Role/RoleBinding already exist)

🤖 Generated with Claude Code

[matejvasek]

PTAL @twoGiants