Namespace support#4
Merged
Merged
Conversation
added 3 commits
April 30, 2025 14:36
Signed-off-by: Jarek Cwiklik <cwiklik@mac.lan>
Signed-off-by: Jarek Cwiklik <cwiklik@mac.lan>
Signed-off-by: Jarek Cwiklik <cwiklik@mac.lan>
huang195
added a commit
to huang195/kagenti-operator
that referenced
this pull request
May 14, 2026
Restore manual webhook manifest overrides clobbered by `make manifests`, add a deprecated annotation fallback in the mode resolution chain, and clean up minor code-review nits. Per-comment changes: rossoctl#1 (must-fix): Restore namespaceSelector / objectSelector / timeoutSeconds on the inject.kagenti.io webhook in config/webhook/manifests.yaml. PR rossoctl#357 manually re-added these fields after `make manifests` clobbered them; the prior commit on this branch wiped them again. Without them the webhook fires on every pod admission cluster-wide which, combined with the new proxy-sidecar default, is a much wider blast radius than today. rossoctl#3 (suggestion): Re-introduce AnnotationAuthBridgeMode as a deprecated fourth layer of the mode resolution chain (between the namespace ConfigMap and the cluster-wide proxy-sidecar fallback). Workloads that still set kagenti.io/authbridge-mode get the same mode they had before this PR, with a `DEPRECATED:` log line per pod admission to push them toward AgentRuntime.Spec.AuthBridgeMode. rossoctl#4 (suggestion): Add a TODO on InjectionDecision.SpiffeHelper marking it for rename to SpireEnabled in a follow-up PR. rossoctl#5 (suggestion): Replace the `evaluateSidecar("spiffe-helper", true, ...)` magic-true call with a dedicated `evaluateSpiffeHelper(label)` helper, mirroring the previous evaluateClientRegistration pattern. rossoctl#6 (nit): Update the proxy-sidecar test error message that still referenced the old "authbridge-light" image name. Comment rossoctl#2 (spiffe-helper bundling readiness) is a coordination concern between this PR and kagenti-extensions PR rossoctl#409. The combined Dockerfiles on rossoctl#409's branch (76d2cb3) DO bundle spiffe-helper and the entrypoint-proxy.sh / entrypoint-envoy.sh DO conditionally start it on SPIRE_ENABLED — so end-state is correct as long as rossoctl#409 lands first. No code change here; merge ordering is the answer. Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Hai Huang <huang195@gmail.com>
huang195
added a commit
to huang195/kagenti-operator
that referenced
this pull request
May 21, 2026
Four review items folded in: * rossoctl#2 Document the burst-reconcile implication of byte-hashing the namespace authbridge-runtime-config CM. Single-edit on N agents re-hashes all N pod specs; Kubernetes sequences the actual rolls but the controller load fans out. Fine for typical small namespaces; worth knowing before formatting edits during peak. * rossoctl#3 Add CR-side hash-change tests parallel to the existing CM-edit test: flipping MTLSMode disabled→strict on the AgentRuntime CR re-hashes; flipping AuthBridgeMode proxy-sidecar→lite on the CR re-hashes. Locks the rollout-on-CR-edit behavior so a future refactor that drops MTLSMode / AuthBridgeMode from resolvedConfig silently regresses into a failing test, not a silent shipping bug. * rossoctl#5 Clarify the MTLSMode field godoc on CR=empty vs CR="disabled". These ARE observably different in `kubectl get -o yaml` and now produce different effective behavior: - empty: falls through to namespace ConfigMap, then to default. - "disabled": pinned at the CR layer; namespace cannot override. The original resolver had a bug: both fell through to the namespace because the fallthrough check used `mtlsMode == MTLSModeDisabled` rather than "did the CR set the field." Fix the resolver to use a sentinel ("" = unset) — same shape as the AuthBridgeMode resolver above. Without this fix, the godoc would have been documenting unimplemented behavior. * rossoctl#6 Add a comment on the unrecognized-mtlsMode WARN explaining the defense-in-depth intent (CRD enum check at the API server is the primary line; this is insurance against a future schema-validation regression and against non-CRD config sources). Prevents a future cleanup PR from dropping it as "redundant." rossoctl#1 (auto-SPIRE log clarity) is already covered by the existing mutatorLog.Info("mtlsMode set; auto-enabling SPIRE for this workload", ...) — the why is in the message itself. No change. rossoctl#4 (stale-mtls-block scrub end-to-end test) is already covered by TestEnsurePerAgentConfigMap_MTLSScrubsStaleBlock — that test exactly exercises "base YAML has stale mtls: strict, render with MTLSModeDisabled, assert block gone." Reply on the PR pointing the reviewer at it. rossoctl#7 was an observation, no change. Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Hai Huang <huang195@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Currently Tekton pipeline always runs in a default NS. Remove hardcoded NS assignment and instead use the namespace of the AgentBuild CR.