fix(ambient-api-server): run as non-root and add OIDC secret placeholders#1547
fix(ambient-api-server): run as non-root and add OIDC secret placeholders#1547javierpena wants to merge 1 commit into
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughRuntime image now runs as non-root ( ChangesAmbient API Server: runtime user & secret fields
Possibly related PRs
Suggested labels
🚥 Pre-merge checks | ✅ 8✅ Passed checks (8 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
components/manifests/base/platform/ambient-api-server-secrets.yml (1)
4-25:⚠️ Potential issue | 🟠 Major | ⚡ Quick winAdd
ownerReferencesto both Secret resources (ambient-api-server-db,ambient-api-server).Both Secrets are missing
metadata.ownerReferences, which violates manifest ownership/lifecycle policy for child resources.As per coding guidelines "All child resources (Jobs, Secrets, PVCs) must have
OwnerReferencesset with controller owner refs".🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@components/manifests/base/platform/ambient-api-server-secrets.yml` around lines 4 - 25, Both Secret manifests (metadata.name: ambient-api-server-db and metadata.name: ambient-api-server) are missing metadata.ownerReferences; add an ownerReferences array on each Secret pointing to the owning controller (set apiVersion, kind, name and uid of the parent/controller and set controller: true and blockOwnerDeletion: true) so they are properly garbage-collected and comply with the "child resources must have OwnerReferences" guideline; update the Secret resources with ownerReferences referencing the appropriate parent Deployment/CustomResource by its name/uid.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@components/manifests/base/platform/ambient-api-server-secrets.yml`:
- Around line 4-25: Both Secret manifests (metadata.name: ambient-api-server-db
and metadata.name: ambient-api-server) are missing metadata.ownerReferences; add
an ownerReferences array on each Secret pointing to the owning controller (set
apiVersion, kind, name and uid of the parent/controller and set controller: true
and blockOwnerDeletion: true) so they are properly garbage-collected and comply
with the "child resources must have OwnerReferences" guideline; update the
Secret resources with ownerReferences referencing the appropriate parent
Deployment/CustomResource by its name/uid.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 4ec727de-951a-4e47-8703-454ab9b06165
📒 Files selected for processing (2)
components/ambient-api-server/Dockerfilecomponents/manifests/base/platform/ambient-api-server-secrets.yml
✅ Deploy Preview for cheerful-kitten-f556a0 canceled.
|
javierpena
force-pushed
the
main
branch
2 times, most recently
from
3facd9c to
7d03343
Compare
…ders Add USER 1001 to the Dockerfile to satisfy restricted SecurityContext requirements. Add empty clientId/clientSecret keys to the base ambient-api-server Secret so the ambient-control-plane pod can start in Kind where OIDC is not configured (token auth is used instead). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1 participant
Add USER 1001 to the Dockerfile to satisfy restricted SecurityContext requirements.
Add empty clientId/clientSecret keys to the base ambient-api-server Secret so the ambient-control-plane pod can start in Kind where OIDC is not configured (token auth is used instead).
Summary by CodeRabbit