refactor: remove atlassian K8s secret and sandbox env injection#45
Merged
Conversation
Eliminates the parallel env injection path for atlassian non-secret config (JIRA_URL, JIRA_USERNAME). These vars remain in sandbox.env via BuildSandboxEnv() as a transition bridge until Phase 2 payload renderer ships. Removes: - ProviderEnvVars() and its call sites in up.go and create.go - sandbox = true flag on Input struct (now unused) - ensureCreds() and the openshell-atlassian K8s secret it created - cmd/creds.go and cmd/creds_test.go providers.toml: JIRA_URL/JIRA_USERNAME inputs are no longer marked sandbox = true since the Sandbox field is gone. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Add NO_PROVIDERS support to test_ocp so --ci mode works the same as local and kind (skip provider registration, use ci profile). OCP ci uses harness create instead of harness up to avoid auto-registration. Add validate-ocp and validate-ocp-ci Makefile targets. Remove openshell-atlassian from gateway.toml [secrets] — the K8s secret is no longer created (removed in the atlassian simplification). Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
…ars removal Phase 1 removed ProviderEnvVars() which was adding JIRA_URL and JIRA_USERNAME to cfg.Env at runtime. Without this, BuildSandboxEnv() / StageHarnessDir() produced sandbox.env without those vars, breaking startup.sh in the atlassian MCP server setup and causing sandboxes to fail to reach Ready. Add injectAtlassianEnv() as the explicit interim path: reads JIRA_URL and JIRA_USERNAME from the local environment and adds them to cfg.Env before any staging or configmap creation. Remove when Phase 2 payload renderer ships. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
…potent deploy Three fixes for validate-kind/validate-ocp with dev images: 1. SANDBOX_IMAGE override in upLocal(): direct-mode sandbox creation was not reading SANDBOX_IMAGE env var, so the profile private image was always used. Add same override that upRemote already had. 2. Idempotent gateway registration: re-deploying to existing kind gateway failed with 'already exists'. Now removes by name before re-adding so deploy is idempotent. 3. validate-kind Makefile: pass SANDBOX_IMAGE and SANDBOX_PULL_SECRET so kind can pull from quay.io/rcochran. Pre-creates quay-pull secret in openshell namespace using local docker credentials. Also adds sandbox_wait() helper with fast-fail on ImagePullBackOff. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
… env leak Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
…le line openshell sandbox exec rejects command arguments containing newline or carriage return characters (gRPC InvalidArgument). The test_gws Gmail API curl was split across lines with backslash continuation inside single quotes, which passes a literal newline to the sandbox exec API and fails. Collapse the curl commands to single lines. Also remove leftover sleep 2 and diagnostic code added during investigation. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Completes Phase 1 of the provider simplification: removes the last parallel env injection path and fixes all pre-existing test failures across the full validation matrix.
What's removed:
ProviderEnvVars()and its call sites inup.goandcreate.goSandbox boolfield onInputstructensureCreds()+openshell-atlassianK8s secret (creds.go,creds_test.go)sandbox = trueflags fromproviders.tomlopenshell-atlassianfromgateways/ocp/gateway.toml[secrets](no longer created)What stays (intentional interim):
BuildSandboxEnv()— keepsJIRA_URL/JIRA_USERNAMEinsandbox.envuntil Phase 2 payload renderer shipsinjectAtlassianEnv()— adds atlassian config vars from environment intocfg.Envbefore stagingAlso fixed in this PR:
SANDBOX_IMAGEenv var now respected byupLocal()(direct-mode gateways like kind) — was only read byupRemote()harness deploy: re-deploying to existing named gateway no longer fails with 'already exists'test_gwsto single linesandbox_wait()helper intest-flow.shwith fast-fail onImagePullBackOff/CrashLoopBackOffvalidate-kind/validate-ocptargets now use dev images (quay.io/rcochran/openshell) with pull secret pre-creationTest plan
All targets pass clean:
Generated with Claude Code