Repository navigation
🤖 feat: activate the CoderAIProvider controller - #315
Conversation
The finalizer now deletes the Coder provider that the object proved it created: by the recorded ID, or after a read that finds this object's nonce when only a create marker exists. 204 or 404 releases the finalizer, and a failed delete retries every 60 seconds. When the control plane is gone, the finalizer goes at once. While the control plane is being deleted, one bounded delete attempt runs first (plan D12). Refs #154 Change-Id: I6e99fcb5d88121cc46f132599a13b9f7f82d2768 Signed-off-by: Thomas Kosiewski <tk@coder.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
@codex security review |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 96fbd65cf5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…lookup answer Change-Id: Ia687ee9bc423b12876f8827a959c735b556f1c56 Signed-off-by: Thomas Kosiewski <tk@coder.com>
96fbd65 to
cee53e3
Compare
|
@codex review |
|
@codex security review |
Kind E2E and dogfood (plan G3, section 9), run on 96fbd65The head has since moved to cee53e3: the #312 review fixes (delete-path edge cases, covered in envtest) and docs. I will rerun this on the final head after the reviews. Image identity: the operator image built from the head ( Part A: full CI Part B: plan section 9 steps 1 to 8 for
Notes from the run, none of them blocking:
Generated with |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cee53e37bc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
… control plane is being deleted Change-Id: I99f643fee0650ef981484202e3d35d8d67f10a7d Signed-off-by: Thomas Kosiewski <tk@coder.com>
cee53e3 to
4263ed8
Compare
|
@codex review |
|
@codex security review |
|
Codex Review: Didn't find any major issues. Keep it up! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
…s a 404 Change-Id: Id18d664b10707befd7e2c4bc2af78012f3ef8fb4 Signed-off-by: Thomas Kosiewski <tk@coder.com>
The operator now runs the CoderAIProvider controller and installs its CRD. The controller gets RBAC on coderaiproviders and its status and finalizers subresources. The Secret rule does not change. A new how-to covers the key Secret, the credential kill switch, the seeding limits and deletion. Refs #154 Change-Id: If0f7968062016829043a2559342ea3150a674f11 Signed-off-by: Thomas Kosiewski <tk@coder.com>
… delete as owner power Change-Id: Idfa61c5e1d811b02075dca247895563b9fb1242d Signed-off-by: Thomas Kosiewski <tk@coder.com>
Change-Id: I7ba108fd9674446d12ecb8f4f0aee6e3e5f5624b Signed-off-by: Thomas Kosiewski <tk@coder.com>
…CoderAIProvider in the inventories Change-Id: I941c32cbe8915d7cd6bfeeca63908111226e6ad5 Signed-off-by: Thomas Kosiewski <tk@coder.com>
Change-Id: I197dbdca709523bdd0a4f7bffe3e5690408be8b1 Signed-off-by: Thomas Kosiewski <tk@coder.com>
4263ed8 to
7b55c27
Compare
|
@codex review |
|
@codex security review |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7b55c2765f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Kind E2E and dogfood rerun on the final head 7b55c27Image identity: the image built from this head ( Part A, full CI Part B (Coder v2.37.2):
Not exercised live (envtest covers them): the 2-minute create settle window and the release on an access error while the control plane is being deleted.
Generated with |
Change-Id: I90d1eedc61dc0fb679a738da32a7b1db88e1ac8b Signed-off-by: Thomas Kosiewski <tk@coder.com>
Change-Id: Id811345fe37e29ff88dfa3be63709a6932023ad4 Signed-off-by: Thomas Kosiewski <tk@coder.com>
|
@codex review |
|
@codex security review |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4e7685f36f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
G3 on the final head 4e7685fThis head merges CI full E2E: run 38518624650, job 115703697201 passed with the full Kind steps; the "Skip full E2E on pull requests" step was skipped. Image identity (local runs): the image built from this head ( Local full CI E2E replica ( Section 9 dogfood (Coder v2.37.2). Writes are POST, PATCH and DELETE on
"Stuck finalizer" docs, followed as written:
Notes, none blocking: a stuck object with a forged ID keeps showing Generated with |
1 participant
Summary
Plan row A7 of #154: the operator now runs the
CoderAIProvidercontroller and installs its CRD. A new how-to documents the key Secret, the credential kill switch, the seeding limits and deletion.This PR targets
main. It builds on #312 (plan row A6, the delete path) and #325 (the provider ID check and the Coder-only delete 404, #323), which have landed. I brought it ontomainwith a merge commit; the diff againstmainis only the A7 change.Refs #154
A7 gates (plan section 7.1, G3)
All hard gates are on
main: #227 (#238), #236 (#293), #249 (#258), the #253 round-3 follow-ups (#265), #267 (#276), #268 (#283), #290 (#298), #277 and #289 (#303), #287 and #296 (#302), and the config-file check (#310). Plan row A6 (the delete path, #312) lands first, because without it a deleted object and its namespace would never finish deleting.What
internal/app/controllerapp: registersCoderAIProviderReconciler.get,list,watch,patchoncoderaiproviders,get,updateoncoderaiproviders/status, andupdateoncoderaiproviders/finalizers.listis needed by the informer (the plan listed get, watch and patch). Thesecretsrule does not change (gate G2, test S9).coder.com_coderaiproviders.yamlleavesDORMANT_CRDS. The CI guard step for it is removed. The other dormant kinds keep the mechanism.e2epath filter addsinternal/controller/coderaiprovider*.config/samples/coder_v1alpha1_coderaiprovider.yaml.docs/how-to/manage-ai-providers.md(AI providers, chat models and AI policies as controller CRDs #154 A7 checklist item 1, comment 6159404078): the key Secret and its value rules, the status reasons, the credential kill switch (any credential error disables the provider, and re-enabling needs a spec edit), dashboard kill switches, the seeding limits (envFrom, config files throughCODER_CONFIG_PATH,--configor-creserveanthropic, and a seeding setting added after the provider exists), deletion, and RBAC guidance.internal/controller/coderaiprovider_env.go: the comment now says that onlybedrock_base_urlandbedrock_regionseedanthropicfrom YAML.IsConfiguredignoresbedrock_modelandbedrock_small_fast_model(codersdk/aiproviders_bedrock.go:82-96at v2.37.3). The check is unchanged.config/crd/bases,config/rbac/role.yaml,config/default/kustomization.yaml,dist/install.yaml,docs/reference/api/coderaiprovider.md, and the API nav inmkdocs.yml.Review round 1
docs/tutorials/getting-started.mdnow deletes everyCoderAIProviderbefore the control plane.deleteis owner power too): fixed. The warning and the RBAC table in the how-to namedelete.Review round 2
CoderAIProvideris listed indocs/how-to/deploy-controller.md,docs/index.mdanddocs/explanation/architecture.md.Review rounds 3 and 4
anthropic): not changed, by design. The env check is fail closed (🤖 CoderAIProvider: env-name check edge cases (case-variant duplicates, alias order, index zeros) #296): every Bedrock variable reserves the name with any value, because Coder's alias and case rules and kubelet expansion make value-based matching unreliable. A false reservation costs a rename; a missed one can stop coderd from starting.Stuck finalizer docs (#325 final assessment)
docs/how-to/manage-ai-providers.mdhas a "Stuck finalizer" section: an endlessCoderUnavailablewait on delete (Coder unreachable, or a 404 that Coder did not send), and theassertion failed:error for astatus.providerIDthat is not a UUID. It gives a JSON patch that first tests the finalizer at its index, then removes it, and a step to check Coder for a leftover provider and delete it in the dashboard.Not in this PR
envFromis not inspected (checklist item 4, optional). Reading the control plane'senvFromSecrets from the provider controller widens what it reads, so it stays a documented limit.config/gitops/(plan row A7) follow in their own PR, as 🤖 docs: add GitOps health rules for CoderTemplateTest #212 followed 🤖 feat: activate the CoderTemplateTest controller #210 forCoderTemplateTest. Tracked in CoderAIProvider activation follow-ups (#154) #321 with the other follow-ups.Validation
Local gates on the pushed tree, exit 0 each:
make verify-vendor,make test,make test-integration,make build,make lint,go tool govulncheck ./...,go test -race ./internal/controller/,make codegen manifests build-installer docs-referencewith no diff,make docs-check(strict MkDocs build), actionlint v1.7.10, and CI'smarkdownlint-cli20.18.1 andcspell8.19.4 ondocs/**/*.md.Kind E2E (full CI job replica, 21 of 21 steps) and the plan section 9 dogfood passed on 96fbd65 and again on the final head 7b55c27, including the bounded delete while the control plane is Terminating: see the PR comments 6160744797 and 6161226918. CI's own
E2E (Kind + CNPG + Templates)job also passed on this head.Line count
Hand-written: 9 files changed, 212 insertions(+), 28 deletions(-). Generated: 5 files changed, 389 insertions(+), 14 deletions(-) (CRD move, RBAC role, kustomization, install bundle, API reference).
Generated with
mux• Model:anthropic:claude-opus-5-5• Thinking:high• Cost:$90.15