fix(kubernetes): implement Read + Importer for all 17 stub K8s resources

All 17 Kubernetes resources previously had stub Read functions (`return nil`)
and no Importer block, making them invisible to drift detection and blocking
`terraform import` entirely.

Changes:
- Added `Importer: &schema.ResourceImporter{StateContext: schema.ImportStatePassthroughContext}` to all 17 resources
- Replaced every `return nil` stub with a real context-based Read using `diag.Diagnostics`
- Added `internal/resource_kubernetes_common.go` with `k8sConfirmExistsByGET` — a shared helper used by the 13 manifest-based resources that issues a GET, handles 404 by clearing the ID, and avoids refreshing the manifest field (K8s server-expands objects, so re-reading would cause permanent diffs)
- `portainer_kubernetes_helm`: upgraded from existence-check to full Read; recovers `chart` and `repo` from `chartReference.{chartPath,repoURL}` in the release-detail response, eliminating the ForceNew destroy+recreate that would otherwise trigger after `terraform import`
- `portainer_kubernetes_namespace`: guards `owner` and `resource_quota` with nil checks so environments with EnableResourceOverCommit or a missing NamespaceOwner field don't generate permanent drift
- `portainer_kubernetes_namespace_system`: reads `IsSystem` from the namespace API and stores it
- All Read implementations follow the context-aware `diag.Diagnostics` pattern introduced in the recent provider refactor

Tested end-to-end on a live Portainer/k0s environment:
  terraform apply        → 17/17 created
  rm terraform.tfstate   → state dropped (brownfield simulation)
  terraform import (×17) → 17/17 "Import successful!"
  terraform apply        → 15 in-place reconciliation updates (idempotent re-POST of manifests; no resources destroyed)
  terraform plan         → No changes.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

Author: TheGnaneswar

internal/resource_kubernetes_application.go

@@ -21,6 +21,10 @@ func resourceKubernetesApplication() *schema.Resource {
 		UpdateContext: resourceKubernetesApplicationUpdate,
 		DeleteContext: resourceKubernetesApplicationDelete,
 
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
 		Timeouts: &schema.ResourceTimeout{
 			Create: schema.DefaultTimeout(10 * time.Minute),
 			Update: schema.DefaultTimeout(10 * time.Minute),
@@ -154,6 +158,24 @@ func resourceKubernetesApplicationUpdate(ctx context.Context, d *schema.Resource
 }
 
 func resourceKubernetesApplicationRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	client := meta.(*APIClient)
+
+	endpointID, namespace, name := parseApllicationsID(d.Id())
+	if endpointID == 0 || namespace == "" || name == "" {
+		return diag.FromErr(fmt.Errorf("invalid ID format, expected 'endpointID:namespace:name': %s", d.Id()))
+	}
+
+	url := fmt.Sprintf("%s/endpoints/%d/kubernetes/apis/apps/v1/namespaces/%s/deployments/%s", client.Endpoint, endpointID, namespace, name)
+	if diags := k8sConfirmExistsByGET(ctx, d, client, url, "deployment "+name); diags.HasError() {
+		return diags
+	}
+	if d.Id() == "" {
+		return nil
+	}
+
+	d.Set("endpoint_id", endpointID)
+	d.Set("namespace", namespace)
+	// "manifest" intentionally not refreshed — see k8sConfirmExistsByGET.
 	return nil
 }
 

internal/resource_kubernetes_clusterrole.go

@@ -20,6 +20,10 @@ func resourceKubernetesClusterRoles() *schema.Resource {
 		UpdateContext: resourceKubernetesClusterRolesUpdate,
 		DeleteContext: resourceKubernetesClusterRolesDelete,
 
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
 		Schema: map[string]*schema.Schema{
 			"endpoint_id": {
 				Type:        schema.TypeInt,
@@ -133,6 +137,23 @@ func resourceKubernetesClusterRolesUpdate(ctx context.Context, d *schema.Resourc
 }
 
 func resourceKubernetesClusterRolesRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	client := meta.(*APIClient)
+
+	endpointID, name := parseClusterRolesID(d.Id())
+	if endpointID == 0 || name == "" {
+		return diag.FromErr(fmt.Errorf("invalid ID format, expected 'endpointID:name': %s", d.Id()))
+	}
+
+	url := fmt.Sprintf("%s/endpoints/%d/kubernetes/apis/rbac.authorization.k8s.io/v1/clusterroles/%s", client.Endpoint, endpointID, name)
+	if diags := k8sConfirmExistsByGET(ctx, d, client, url, "clusterrole "+name); diags.HasError() {
+		return diags
+	}
+	if d.Id() == "" {
+		return nil
+	}
+
+	d.Set("endpoint_id", endpointID)
+	// "manifest" intentionally not refreshed — see k8sConfirmExistsByGET.
 	return nil
 }
 

internal/resource_kubernetes_clusterrolebinding.go

@@ -20,6 +20,10 @@ func resourceKubernetesClusterRoleBindings() *schema.Resource {
 		UpdateContext: resourceKubernetesClusterRoleBindingsUpdate,
 		DeleteContext: resourceKubernetesClusterRoleBindingsDelete,
 
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
 		Schema: map[string]*schema.Schema{
 			"endpoint_id": {
 				Type:        schema.TypeInt,
@@ -133,6 +137,23 @@ func resourceKubernetesClusterRoleBindingsUpdate(ctx context.Context, d *schema.
 }
 
 func resourceKubernetesClusterRoleBindingsRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	client := meta.(*APIClient)
+
+	endpointID, name := parseClusterRolesBindingsID(d.Id())
+	if endpointID == 0 || name == "" {
+		return diag.FromErr(fmt.Errorf("invalid ID format, expected 'endpointID:name': %s", d.Id()))
+	}
+
+	url := fmt.Sprintf("%s/endpoints/%d/kubernetes/apis/rbac.authorization.k8s.io/v1/clusterrolebindings/%s", client.Endpoint, endpointID, name)
+	if diags := k8sConfirmExistsByGET(ctx, d, client, url, "clusterrolebinding "+name); diags.HasError() {
+		return diags
+	}
+	if d.Id() == "" {
+		return nil
+	}
+
+	d.Set("endpoint_id", endpointID)
+	// "manifest" intentionally not refreshed — see k8sConfirmExistsByGET.
 	return nil
 }
 

internal/resource_kubernetes_common.go

@@ -0,0 +1,59 @@
+package internal
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+// k8sConfirmExistsByGET issues a GET against a manifest-based Kubernetes resource to
+// verify it still exists. On HTTP 404 it clears the resource ID via d.SetId("") so the
+// next plan recreates it (out-of-band deletion detection). On any other non-2xx it
+// returns diagnostics carrying the response body.
+//
+// It deliberately does NOT refresh the authored "manifest" field. The Kubernetes API
+// returns a fully server-expanded object (status, managedFields, resourceVersion,
+// defaulted spec fields, …) that never matches the user's hand-written manifest;
+// writing it back would produce a permanent diff. Since these resources' Update is
+// delete+recreate, that diff would also churn the workload on every apply. So the
+// authored manifest stays the source of truth in state — Read only confirms existence
+// and (in the caller) recovers identity fields. Manifest-content drift is therefore
+// not detected; only deletion is. After `terraform import`, the manifest field must be
+// set in config to match the live object.
+//
+// Returns nil diagnostics with the ID preserved when the object exists, or nil
+// diagnostics with the ID cleared when it is gone. Callers should check d.Id() == ""
+// before setting any other fields.
+func k8sConfirmExistsByGET(ctx context.Context, d *schema.ResourceData, client *APIClient, url, kind string) diag.Diagnostics {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return diag.FromErr(err)
+	}
+	if client.APIKey != "" {
+		req.Header.Set("X-API-Key", client.APIKey)
+	} else if client.JWTToken != "" {
+		req.Header.Set("Authorization", "Bearer "+client.JWTToken)
+	} else {
+		return diag.FromErr(fmt.Errorf("no valid authentication method provided (api_key or jwt token)"))
+	}
+
+	resp, err := client.HTTPClient.Do(req)
+	if err != nil {
+		return diag.FromErr(err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode == http.StatusNotFound {
+		d.SetId("")
+		return nil
+	}
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		body, _ := io.ReadAll(resp.Body)
+		return diag.FromErr(fmt.Errorf("failed to read %s (%d): %s", kind, resp.StatusCode, string(body)))
+	}
+	return nil
+}

internal/resource_kubernetes_configmaps.go

@@ -20,6 +20,10 @@ func resourceKubernetesConfigMaps() *schema.Resource {
 		UpdateContext: resourceKubernetesConfigMapsUpdate,
 		DeleteContext: resourceKubernetesConfigMapsDelete,
 
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
 		Schema: map[string]*schema.Schema{
 			"endpoint_id": {
 				Type:        schema.TypeInt,
@@ -139,6 +143,24 @@ func resourceKubernetesConfigMapsUpdate(ctx context.Context, d *schema.ResourceD
 }
 
 func resourceKubernetesConfigMapsRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	client := meta.(*APIClient)
+
+	endpointID, namespace, name := parseConfigMapsID(d.Id())
+	if endpointID == 0 || namespace == "" || name == "" {
+		return diag.FromErr(fmt.Errorf("invalid ID format, expected 'endpointID:namespace:name': %s", d.Id()))
+	}
+
+	url := fmt.Sprintf("%s/endpoints/%d/kubernetes/api/v1/namespaces/%s/configmaps/%s", client.Endpoint, endpointID, namespace, name)
+	if diags := k8sConfirmExistsByGET(ctx, d, client, url, "configmap "+name); diags.HasError() {
+		return diags
+	}
+	if d.Id() == "" {
+		return nil
+	}
+
+	d.Set("endpoint_id", endpointID)
+	d.Set("namespace", namespace)
+	// "manifest" intentionally not refreshed — see k8sConfirmExistsByGET.
 	return nil
 }
 

internal/resource_kubernetes_cronjob.go

@@ -20,6 +20,10 @@ func resourceKubernetesCronJob() *schema.Resource {
 		UpdateContext: resourceKubernetesCronJobUpdate,
 		DeleteContext: resourceKubernetesCronJobDelete,
 
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
 		Schema: map[string]*schema.Schema{
 			"endpoint_id": {
 				Type:        schema.TypeInt,
@@ -139,6 +143,24 @@ func resourceKubernetesCronJobUpdate(ctx context.Context, d *schema.ResourceData
 }
 
 func resourceKubernetesCronJobRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	client := meta.(*APIClient)
+
+	endpointID, namespace, name := parseCronJobID(d.Id())
+	if endpointID == 0 || namespace == "" || name == "" {
+		return diag.FromErr(fmt.Errorf("invalid ID format, expected 'endpointID:namespace:name': %s", d.Id()))
+	}
+
+	url := fmt.Sprintf("%s/endpoints/%d/kubernetes/apis/batch/v1/namespaces/%s/cronjobs/%s", client.Endpoint, endpointID, namespace, name)
+	if diags := k8sConfirmExistsByGET(ctx, d, client, url, "cronjob "+name); diags.HasError() {
+		return diags
+	}
+	if d.Id() == "" {
+		return nil
+	}
+
+	d.Set("endpoint_id", endpointID)
+	d.Set("namespace", namespace)
+	// "manifest" intentionally not refreshed — see k8sConfirmExistsByGET.
 	return nil
 }
 

internal/resource_kubernetes_helm.go

@@ -20,6 +20,10 @@ func resourceKubernetesHelm() *schema.Resource {
 		ReadContext:   resourceKubernetesHelmRead,
 		DeleteContext: resourceKubernetesHelmDelete,
 
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
 		Timeouts: &schema.ResourceTimeout{
 			Create: schema.DefaultTimeout(15 * time.Minute),
 			Delete: schema.DefaultTimeout(10 * time.Minute),
@@ -114,7 +118,70 @@ func resourceKubernetesHelmCreate(ctx context.Context, d *schema.ResourceData, m
 }
 
 func resourceKubernetesHelmRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	// No-op for now
+	client := meta.(*APIClient)
+
+	idParts := strings.SplitN(d.Id(), ":", 3)
+	if len(idParts) != 3 {
+		return diag.FromErr(fmt.Errorf("invalid ID format, expected 'envID:namespace:release': %s", d.Id()))
+	}
+	var envID int
+	fmt.Sscanf(idParts[0], "%d", &envID)
+	namespace := idParts[1]
+	release := idParts[2]
+	if envID == 0 || release == "" {
+		return diag.FromErr(fmt.Errorf("invalid ID format, expected 'envID:namespace:release': %s", d.Id()))
+	}
+
+	url := fmt.Sprintf("%s/endpoints/%d/kubernetes/helm/%s?namespace=%s", client.Endpoint, envID, release, namespace)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return diag.FromErr(err)
+	}
+	if client.APIKey != "" {
+		req.Header.Set("X-API-Key", client.APIKey)
+	} else if client.JWTToken != "" {
+		req.Header.Set("Authorization", "Bearer "+client.JWTToken)
+	} else {
+		return diag.FromErr(fmt.Errorf("no valid authentication method provided (api_key or jwt token)"))
+	}
+
+	resp, err := client.HTTPClient.Do(req)
+	if err != nil {
+		return diag.FromErr(err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode == http.StatusNotFound {
+		d.SetId("")
+		return nil
+	}
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		body, _ := io.ReadAll(resp.Body)
+		return diag.FromErr(fmt.Errorf("failed to read helm release %s (%d): %s", release, resp.StatusCode, string(body)))
+	}
+
+	var helmRelease struct {
+		ChartReference struct {
+			ChartPath string `json:"chartPath"`
+			RepoURL   string `json:"repoURL"`
+		} `json:"chartReference"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&helmRelease); err != nil {
+		return diag.FromErr(fmt.Errorf("failed to decode helm release response: %w", err))
+	}
+
+	d.Set("environment_id", envID)
+	d.Set("namespace", namespace)
+	d.Set("name", release)
+	if helmRelease.ChartReference.ChartPath != "" {
+		d.Set("chart", helmRelease.ChartReference.ChartPath)
+	}
+	if helmRelease.ChartReference.RepoURL != "" {
+		d.Set("repo", helmRelease.ChartReference.RepoURL)
+	}
+	// values not restored — the API returns server-merged computed values, not the
+	// original user-supplied YAML. Keep whatever is currently in state; users with
+	// custom values should add lifecycle { ignore_changes = [values] } after import.
 	return nil
 }
 

internal/resource_kubernetes_ingresses.go

@@ -20,6 +20,10 @@ func resourceKubernetesNamespaceIngress() *schema.Resource {
 		UpdateContext: resourceKubernetesNamespaceIngressUpdate,
 		DeleteContext: resourceKubernetesNamespaceIngressDelete,
 
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
 		Schema: map[string]*schema.Schema{
 			"environment_id": {
 				Type:        schema.TypeInt,
@@ -215,7 +219,37 @@ func createOrUpdateIngress(ctx context.Context, d *schema.ResourceData, client *
 }
 
 func resourceKubernetesNamespaceIngressRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	return nil // No-op
+	client := meta.(*APIClient)
+
+	parts := strings.SplitN(d.Id(), ":", 3)
+	if len(parts) != 3 {
+		return diag.FromErr(fmt.Errorf("invalid ID format, expected 'envID:namespace:name': %s", d.Id()))
+	}
+	var envID int
+	fmt.Sscanf(parts[0], "%d", &envID)
+	namespace := parts[1]
+	name := parts[2]
+	if envID == 0 || namespace == "" || name == "" {
+		return diag.FromErr(fmt.Errorf("invalid ID format, expected 'envID:namespace:name': %s", d.Id()))
+	}
+
+	// Existence check via the K8s proxy (standard networking.k8s.io path) for clean 404s.
+	url := fmt.Sprintf("%s/endpoints/%d/kubernetes/apis/networking.k8s.io/v1/namespaces/%s/ingresses/%s", client.Endpoint, envID, namespace, name)
+	if diags := k8sConfirmExistsByGET(ctx, d, client, url, "ingress "+name); diags.HasError() {
+		return diags
+	}
+	if d.Id() == "" {
+		return nil
+	}
+
+	d.Set("environment_id", envID)
+	d.Set("namespace", namespace)
+	d.Set("name", name)
+	// Nested spec (hosts/tls/paths/annotations/labels/class_name) intentionally not
+	// refreshed — reconstructing it from the live Ingress object is lossy and would diff
+	// against the authored config. The config stays the source of truth; only deletion is
+	// detected. After `terraform import`, set those fields to match.
+	return nil
 }
 
 func resourceKubernetesNamespaceIngressDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {