Token-refresher silently produces an empty install plan when rendered manifests are missing

[plombardi89]

Problem

When deploy/token-refresher/rendered/ contains only its tracked .gitignore placeholder, direct Go compilation succeeds but the token-refresher component loads no manifests. For an eligible Site, it returns an empty installation plan with a successful reconciliation result.

Direct go test ./... in this checkout fails:

--- FAIL: TestPlanAppliesSingletonWhenAnyEligibleSiteEnablesIt
    tokenrefresher_test.go:114: planned 0 operations, want 9; deployment found=false

The test expects a Deployment, ConfigMap, ServiceAccount, and six RBAC resources.

Implementation path

Source references at the reviewed revision:

• embed.go:13–17 embeds all:rendered, allowing the placeholder-only directory to satisfy embedding.
• env.go:213–242 accepts an empty YAML inventory and returns no objects without error.
• tokenrefresher.go:107–118 constructs the empty plan and returns component.Reconciled().
• tokenrefresher_test.go:65–114 catches the missing installation resources.

Existing build prerequisite

make test and make unbounded-operator-build already depend on token-refresher-manifests. Direct Go commands bypass manifest rendering. See Makefile:546–553 and the rendering target.

Reproduction

In a checkout where deploy/token-refresher/rendered/ contains only .gitignore, before running manifest-rendering targets:

go test ./internal/operator/components/tokenrefresher -run TestPlanAppliesSingletonWhenAnyEligibleSiteEnablesIt -count=1

Expected: a clear missing-manifest error or a self-contained test setup.

Observed in the full suite: an empty successful plan, followed by the assertion above.

Suggested scope

• Reject an empty or incomplete required token-refresher manifest inventory instead of reporting successful reconciliation.
• Add regression coverage for missing embedded resources.
• Document the rendering prerequisite for direct Go testing/building.

Validation status

Observed the failing full-suite test and inspected the rendered directory, which contained only .gitignore. The implementation path above explains the zero-operation result. Rendering manifests and rerunning the test has not yet been verified. No deployed operator failure was exercised.

Discovered during ACL work in #713; this is a separate manifest/build-prerequisite issue, not evidence of an ACL regression.

[plombardi89]

Validation update: ran make fmt followed by make test in the same checkout. The test target rendered the manifest prerequisites and the full Go suite passed, including internal/operator/components/tokenrefresher. This confirms that the observed direct-Go-test failure was caused by missing rendered prerequisites. The issue remains relevant to silently returning a successful empty installation plan when those embedded manifests are absent; no token-refresher source changes were needed for the test suite to pass.