Implement kubernetes deployer#7
Merged
Merged
Conversation
added 3 commits
May 16, 2025 11:17
Signed-off-by: Jarek Cwiklik <cwiklik@mac.lan>
Signed-off-by: Jarek Cwiklik <cwiklik@mac.lan>
Signed-off-by: Jarek Cwiklik <cwiklik@mac.lan>
huang195
added a commit
to huang195/kagenti-operator
that referenced
this pull request
May 21, 2026
Four review items folded in: * rossoctl#2 Document the burst-reconcile implication of byte-hashing the namespace authbridge-runtime-config CM. Single-edit on N agents re-hashes all N pod specs; Kubernetes sequences the actual rolls but the controller load fans out. Fine for typical small namespaces; worth knowing before formatting edits during peak. * rossoctl#3 Add CR-side hash-change tests parallel to the existing CM-edit test: flipping MTLSMode disabled→strict on the AgentRuntime CR re-hashes; flipping AuthBridgeMode proxy-sidecar→lite on the CR re-hashes. Locks the rollout-on-CR-edit behavior so a future refactor that drops MTLSMode / AuthBridgeMode from resolvedConfig silently regresses into a failing test, not a silent shipping bug. * rossoctl#5 Clarify the MTLSMode field godoc on CR=empty vs CR="disabled". These ARE observably different in `kubectl get -o yaml` and now produce different effective behavior: - empty: falls through to namespace ConfigMap, then to default. - "disabled": pinned at the CR layer; namespace cannot override. The original resolver had a bug: both fell through to the namespace because the fallthrough check used `mtlsMode == MTLSModeDisabled` rather than "did the CR set the field." Fix the resolver to use a sentinel ("" = unset) — same shape as the AuthBridgeMode resolver above. Without this fix, the godoc would have been documenting unimplemented behavior. * rossoctl#6 Add a comment on the unrecognized-mtlsMode WARN explaining the defense-in-depth intent (CRD enum check at the API server is the primary line; this is insurance against a future schema-validation regression and against non-CRD config sources). Prevents a future cleanup PR from dropping it as "redundant." rossoctl#1 (auto-SPIRE log clarity) is already covered by the existing mutatorLog.Info("mtlsMode set; auto-enabling SPIRE for this workload", ...) — the why is in the message itself. No change. rossoctl#4 (stale-mtls-block scrub end-to-end test) is already covered by TestEnsurePerAgentConfigMap_MTLSScrubsStaleBlock — that test exactly exercises "base YAML has stale mtls: strict, render with MTLSModeDisabled, assert block gone." Reply on the PR pointing the reviewer at it. rossoctl#7 was an observation, no change. Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Hai Huang <huang195@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implemented kubernetes based deployer for a component. It generates manifests to create deployment and service objects for each component