Repository navigation
🤖 test: run the CoderAIProvider Kind phases - #345
Merged
Merged
Conversation
Plan row A8 of #154 (plan 8.2 P1 to P4, and the provider halves of P6 and P7), after the activation in #315. - P1: an openai-compat provider on an opted-in Secret is Ready. Coder holds the spec, base URL and one key whose mask is first 4 + "..." + last 4 of the local key. The object holds neither the key nor the mask. - P2: a new Secret value gives one new Coder key ID; a metadata-only Secret change gives none. The operator log holds neither key. - P3: an unlabeled Secret, the operator token Secret, a foreign origin and a name taken in Coder stall with CredentialNotOptedIn, CredentialRefused, CredentialDestinationNotAllowed and NameConflict. The Coder provider list (IDs, fields, updated_at, key IDs) is the same before, after, and after their delete. - P4: a disable in Coder plus a reconcile gives DisabledExternally and Coder stays disabled. A spec edit enables the provider again. - P6: deleting the object makes Coder answer 404 for the provider ID. - P7: a Ready provider kept into the namespace-deletion phase must be gone with the namespace. Keys are synthetic, live in 0600 files, and reach kubectl, jq and grep through files only. The offline stub tests get a fake provider controller and Coder provider routes, the new mutation order, and 11 failure rows. Docs: the minimum Coder version and the operator release that CoderAIProvider needs. Signed-off-by: Thomas Kosiewski <tk@coder.com> --- _Generated with [`xum`](https://github.com/coder/xum) • Model: `anthropic:claude-opus-5-5` • Thinking: `high`_ Change-Id: I5c2dca2cd53f00d226f161bf8ed73c7dae33b7a8
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Member
Author
|
@codex security review |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Plan row A8 of #154: the Kind E2E driver now exercises the
CoderAIProvidercontroller that #315 activated. It runs plan 8.2 phases P1 to P4, plus the provider halves of P6 and P7. It also adds two lines to the how-to: the minimum Coder version, and installing from a release tag.Refs #154
Phases (
hack/e2e-workspace-lifecycle.sh)The new steps run after the tester key count and before the last phase (namespace deletion).
http://ai-upstream.invalid:8080and anopenai-compatproviderReady=True/Applied. Coder's GET bystatus.providerID: enabled, the spec's display name andbase_url, exactly one key whose mask is first 4 +...+ last 4 of the local key. The object holds neither the key nor the mask.status.credential.keyID. After the annotation, once the object records the Secret's newresourceVersion, the key ID is unchanged. The operator log holds neither key.e2e-taken)CredentialNotOptedIn,CredentialRefused,CredentialDestinationNotAllowed,NameConflict, and noproviderID. Coder's provider list (IDs, fields,updated_at, key IDs) is the same before, after, and after deleting the four objects.spec.displayNameeditDisabledExternallyand Coder stays disabled. After the edit:Ready, enabled, same key ID.ControlPlaneGone).Keys are 48 random hex characters in 0600 files. They reach
jq --rawfile,kubectl create/replace -fandgrep -fonly through files, never argv or output. The Secret is not applied withkubectl apply, which would copy the key data into the last-applied annotation. The driver removes the key and Secret files on exit, and masks the keys in GitHub Actions logs.Offline tests (
hack/e2e-workspace-lifecycle_test.sh)The stubs serve the new routes in the pass scenario. 11 new failure rows:
ai-never-ready,ai-mask-wrong,ai-cr-leak,ai-key-id-unchanged,ai-meta-resend,ai-log-leak,ai-wrong-reason,ai-conflict-writes,ai-kill-undone,ai-delete-kept,ai-ns-stuck. Result: 72 scenarios, 101 checks, 0 failures.Docs
Two bullets under "Before you start" in
docs/how-to/manage-ai-providers.md:coderd/ai_providers.gofirst appears in that tag), but older versions are not tested.ghcr.io/coder/coder-k8s:latesthas the same digest as:0.1.3, and v0.1.3 has neither the controller nor the CRD. Thedist/install.yamlonmainhas the CRD.Validation
Local gates on the pushed tree, exit 0 each:
make verify-vendor,make test,make test-integration,make build,make lint,go tool govulncheck ./...,go test -race ./internal/controller/,make codegen manifests build-installer docs-referencewith no diff,make docs-check, actionlint v1.7.10, shellcheck 0.11 on both driver scripts, andmake test-scripts(72 scenarios,ALL OFFLINE TESTS PASSED).Local Kind run of the full CI job (
E2E_FULL=true, kind v0.26.0, kindest/node v1.32.0) on the A8 commit before its cherry-pick onto the currentmain(the A8 diff is identical): all 23 steps passed in 1011 s. The built, node and running-container image IDs are equal. Driver receipt:RECEIPT (PASS), 33 cases,coder_version=v2.37.2+eb69e27. New phase timings:ai-provider=0s ai-rotation=4s ai-refusals=3s ai-kill-switch=1s ai-delete=0s. CI's full E2E job runs on this PR because it changeshack/e2e-workspace-lifecycle*.sh.Size: 3 files, +243/−18, all hand-written.
Generated with
mux• Model:anthropic:claude-opus-5-5• Thinking:high• Cost:$128.37