Please address the comments from this code review:

## Overall Comments
- There are now three separate mapping implementations between `storage.Cluster` and `v1.ClusterConfig` (central service, sensor generate, plus the implicit proto identity), which makes it easy for fields to drift; consider centralizing these conversions in a shared helper/package so new/changed fields only need to be wired in one place.
- The notion of "server‑managed" fields (status, health_status, helm_config, etc.) is currently enforced only implicitly in `convertAPIClusterToStorage`; it may be safer to capture this set in a single, clearly named helper or configuration so future contributors don’t accidentally start persisting client-supplied values for those fields.

## Individual Comments

### Comment 1
<location path="central/cluster/service/convert.go" line_range="11-20" />
<code_context>
+func convertStorageClusterToAPI(cluster *storage.Cluster) *v1.ClusterConfig {
</code_context>
<issue_to_address>
**suggestion:** Manual 1:1 field mapping in both conversion functions is fragile and may drift as proto definitions evolve.

Both `convertStorageClusterToAPI` and `convertAPIClusterToStorage` manually copy every field, which is easy to miss when new fields are added, contradicting the comment that all fields are copied. Please consider a more robust pattern (shared helper, codegen, or tests/compile-time checks such as round-trip `proto.Equal`) so new fields can’t be accidentally omitted.

Suggested implementation:

```golang
import (
	v1 "github.com/stackrox/rox/generated/api/v1"
	"github.com/stackrox/rox/generated/storage"
	"google.golang.org/protobuf/encoding/protojson"
)

```

```golang
 // convertStorageClusterToAPI converts a storage.Cluster to the API representation.
 // All fields are copied 1:1 via protojson. The API type is structurally identical to the storage
 // type today; they are separated to allow independent evolution in the future. Using protojson
 // reduces the risk of fields drifting as proto definitions evolve.
func convertStorageClusterToAPI(cluster *storage.Cluster) *v1.ClusterConfig {
	if cluster == nil {
		return nil
	}

	out := &v1.ClusterConfig{}

	// Use protojson to perform a structural copy so newly-added fields are automatically handled
	// as long as the underlying proto definitions remain structurally compatible.
	bytes, err := protojson.Marshal(cluster)
	if err != nil {
		// In the unlikely event of an error, return an empty config rather than partially populated data.
		// Callers should treat a nil cluster input as the primary "no config" signal.
		return out
	}

	if err := protojson.Unmarshal(bytes, out); err != nil {
		return out
	}

	return out

```

To fully implement the suggestion for both directions, the same pattern should be applied to `convertAPIClusterToStorage`, replacing its manual 1:1 field assignments with a protojson-based structural copy (marshal the `*v1.ClusterConfig` to JSON, then unmarshal into `*storage.Cluster`). This will ensure that both conversion functions automatically handle newly added fields as long as the proto messages remain structurally compatible.
</issue_to_address>

Please address the comments from this code review:

## Overall Comments
- There are now three separate Cluster<->ClusterConfig conversion implementations (pkg/cluster, central/cluster/service, roxctl/sensor/generate); consider centralizing these or having pkg/cluster expose both directions with options (e.g., a flag to drop server-managed fields) to avoid drift when new fields are added.
- The manual field-by-field copies in the conversion helpers are easy to miss on future proto changes; you might want to add a small safeguard (e.g., a test that reflects over both types to assert they have the same set of fields you map, or use proto.Clone plus explicit zeroing for server-managed fields) to catch omissions early.

## Individual Comments

### Comment 1
<location path="central/cluster/service/convert.go" line_range="9" />
<code_context>
+	clusterutil "github.com/stackrox/rox/pkg/cluster"
+)
+
+// convertStorageClusterToAPI delegates to the shared conversion in pkg/cluster.
+var convertStorageClusterToAPI = clusterutil.StorageClusterToAPIClusterConfig
+
</code_context>
<issue_to_address>
**issue (complexity):** Consider removing the package-level conversion vars and centralizing both directions of cluster conversion in pkg/cluster so this service just calls the shared helpers directly.

You can simplify this by:

1. Removing the package-level function variables and calling the shared conversion directly.
2. Centralizing the API→storage conversion in `pkg/cluster` alongside the existing storage→API helpers, so we only have one implementation per direction.

### 1. Inline the function variables

Instead of:

```go
// convertStorageClusterToAPI delegates to the shared conversion in pkg/cluster.
var convertStorageClusterToAPI = clusterutil.StorageClusterToAPIClusterConfig

// convertStorageClustersToAPI delegates to the shared conversion in pkg/cluster.
var convertStorageClustersToAPI = clusterutil.StorageClustersToAPIClusterConfigs
```

Call the shared helpers directly where used:

```go
cfg := clusterutil.StorageClusterToAPIClusterConfig(sc)
// or
cfgs := clusterutil.StorageClustersToAPIClusterConfigs(storageClusters)
```

If you need test seams, define a small interface on the consumer side rather than package-level vars, e.g.:

```go
type ClusterConverter interface {
    ToAPI(*storage.Cluster) *v1.ClusterConfig
}

type defaultClusterConverter struct{}

func (defaultClusterConverter) ToAPI(c *storage.Cluster) *v1.ClusterConfig {
    return clusterutil.StorageClusterToAPIClusterConfig(c)
}
```

and inject a `ClusterConverter` in tests.

### 2. Move `convertAPIClusterToStorage` to `pkg/cluster`

To avoid having a third independent conversion implementation, move the inverse logic into `pkg/cluster` (or extend the existing one there) and call it from this service.

In `pkg/cluster/convert.go`:

```go
func APIClusterConfigToStorage(config *v1.ClusterConfig) *storage.Cluster {
    if config == nil {
        return nil
    }
    return &storage.Cluster{
        Id:                             config.GetId(),
        Name:                           config.GetName(),
        Type:                           config.GetType(),
        Labels:                         config.GetLabels(),
        MainImage:                      config.GetMainImage(),
        CollectorImage:                 config.GetCollectorImage(),
        CentralApiEndpoint:             config.GetCentralApiEndpoint(),
        CollectionMethod:               config.GetCollectionMethod(),
        AdmissionController:            config.GetAdmissionController(),
        AdmissionControllerUpdates:     config.GetAdmissionControllerUpdates(),
        AdmissionControllerEvents:      config.GetAdmissionControllerEvents(),
        AdmissionControllerFailOnError: config.GetAdmissionControllerFailOnError(),
        DynamicConfig:                  config.GetDynamicConfig(),
        TolerationsConfig:              config.GetTolerationsConfig(),
        SlimCollector:                  config.GetSlimCollector(),
        Priority:                       config.GetPriority(),
        ManagedBy:                      config.GetManagedBy(),
        // intentionally omit server-managed fields here
    }
}
```

Then in this service:

```go
func convertAPIClusterToStorage(config *v1.ClusterConfig) *storage.Cluster {
    return clusterutil.APIClusterConfigToStorage(config)
}
```

or even skip the local wrapper entirely and call `clusterutil.APIClusterConfigToStorage` directly.

This keeps all behavior (including the “server-managed fields are ignored” policy) in one place, reducing divergence risk and making the conversion story easier to understand.
</issue_to_address>

### Comment 2
<location path="roxctl/sensor/generate/convert.go" line_range="8" />
<code_context>
+	"github.com/stackrox/rox/generated/storage"
+)
+
+// clusterConfigToStorage converts a v1.ClusterConfig to storage.Cluster for use
+// with validation functions that accept storage.Cluster.
+func clusterConfigToStorage(config *v1.ClusterConfig) *storage.Cluster {
</code_context>
<issue_to_address>
**issue (complexity):** Consider replacing this hand-written ClusterConfig-to-Cluster converter with a shared helper in pkg/cluster and calling that here instead.

You’re re‑introducing another hand‑written `ClusterConfig -> storage.Cluster` converter, which duplicates existing logic and will be easy to forget when fields are added.

To reduce complexity and maintenance risk, centralize the mapping in `pkg/cluster` and make this file a thin wrapper.

For example, in `pkg/cluster/convert.go` add a reusable converter:

```go
// pkg/cluster/convert.go

// APIClusterConfigToStorage converts v1.ClusterConfig into storage.Cluster,
// excluding server-managed/runtime fields.
func APIClusterConfigToStorage(cfg *v1.ClusterConfig) *storage.Cluster {
	if cfg == nil {
		return nil
	}
	return &storage.Cluster{
		Id:                             cfg.GetId(),
		Name:                           cfg.GetName(),
		Type:                           cfg.GetType(),
		Labels:                         cfg.GetLabels(),
		MainImage:                      cfg.GetMainImage(),
		CollectorImage:                 cfg.GetCollectorImage(),
		CentralApiEndpoint:             cfg.GetCentralApiEndpoint(),
		CollectionMethod:               cfg.GetCollectionMethod(),
		AdmissionController:            cfg.GetAdmissionController(),
		AdmissionControllerUpdates:     cfg.GetAdmissionControllerUpdates(),
		AdmissionControllerEvents:      cfg.GetAdmissionControllerEvents(),
		AdmissionControllerFailOnError: cfg.GetAdmissionControllerFailOnError(),
		DynamicConfig:                  cfg.GetDynamicConfig(),
		TolerationsConfig:              cfg.GetTolerationsConfig(),
		SlimCollector:                  cfg.GetSlimCollector(),
		Priority:                       cfg.GetPriority(),
		ManagedBy:                      cfg.GetManagedBy(),
		HelmConfig:                     cfg.GetHelmConfig(),
	}
}
```

Then in this file, reuse that instead of maintaining another mapping:

```go
// roxctl/generate/cluster.go (or current file)

import (
    v1 "github.com/stackrox/rox/generated/api/v1"
    "github.com/stackrox/rox/generated/storage"
    clusterconvert "github.com/stackrox/rox/pkg/cluster"
)

func clusterConfigToStorage(config *v1.ClusterConfig) *storage.Cluster {
    return clusterconvert.APIClusterConfigToStorage(config)
}
```

This keeps the public behavior unchanged, but removes the duplicated field‑by‑field mapping and ensures future field additions only need to be updated in one place.
</issue_to_address>