feat(agent chart): worker orchestration config + scoped worker RBAC#156
Open
sebasnallar wants to merge 8 commits into
Open
feat(agent chart): worker orchestration config + scoped worker RBAC#156sebasnallar wants to merge 8 commits into
sebasnallar wants to merge 8 commits into
Conversation
worker: block (backend, namespace, gRPC port, pod-template: SA/nodeSelector/ labels/env/resources/imagePullSecrets, per-package overrides) so ops shape how the agent deploys workers. Opt-in least-privilege Role/RoleBinding for the agent to manage worker Deployments/Services/Pods/ConfigMaps.
The worker orchestrator reads NP_WORKER_* (os.Getenv) to pick the backend and shape worker pods, but the chart only had the worker values block + RBAC — nothing wired them to the agent container. Add an agent.workerEnv helper rendering backend/namespace/serviceAccount/nodeSelector/labels/ imagePullSecrets/env/resources, injected into both the Deployment and StatefulSet env. Bump chart 2.35.0 -> 2.36.0.
- worker.security (mtls default) -> NP_WORKER_SECURITY; agent mints a per-process CA and does mTLS with its workers (no mesh / cert-manager). - worker.networkPolicy.create (default true): only the agent may reach worker pods' gRPC port (k8s backend; needs a policy-enforcing CNI). - worker RBAC gains secrets (agent mounts per-worker TLS Secrets).
…espace) The agent defaults an empty worker namespace to 'np-workers', but the chart's worker RBAC targets the agent namespace — so an empty worker.namespace left the agent creating workers in a non-existent namespace. Always emit NP_WORKER_NAMESPACE resolved to worker.namespace|agent namespace, so the agent and RBAC agree. Found via k3d e2e.
- worker.workers: an array of workers (package/version/image + optional per-worker serviceAccount/resources/env/namespace) rendered as NP_WORKERS. Replaces the single-worker model and the dead worker.overrides map. - Scope the agent SA from cluster-admin (*/*/*) to what it needs (worker Deployments/Services/Pods/Secrets + pods/log + events). - Drop the broken '--command-executor-git-command-repos $(AGENT_REPO)' default (it corrupted flag parsing when AGENT_REPO was empty); move optional args to extraArgs. Remove placeholder TAGS/DEBUG defaults. - No worker.env CA hack needed: the agent injects NODE_EXTRA_CA_CERTS and delivers NP_API_KEY via a Secret itself.
Reshape the worker.* block: allowedRegistries (deny-by-default registry guardrail), defaults (config for every worker), rules (selector-matched config for dynamic workers), pins (exact workers; renamed from workers). agent.workerEnv now emits NP_ALLOWED_REGISTRIES + NP_WORKER_RULES alongside NP_WORKERS/NP_WORKER_*.
…mpat) The worker-orchestration PR should be purely additive. Restore serviceAccount.role.rules to main's cluster-wide default instead of rescoping it — narrowing an existing install's permissions is a breaking change and is unrelated to the worker feature. Rescoped RBAC can land as its own opt-in later.
Restore values.yaml / deployment.yaml / statefulset.yaml to main and re-add ONLY the worker orchestration bits: the worker.* values block and the agent.workerEnv include. No changes to the agent's existing args, configuration.values defaults, or serviceAccount RBAC — those stay exactly as main has them. Fresh install with no worker config = deny-by-default, no worker spawns.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
charts/agent gains a worker: block (backend, gRPC port, pod template: SA/nodeSelector/labels/env/resources/imagePullSecrets, per-package overrides) and an opt-in least-privilege Role/RoleBinding for the agent to manage worker Deployments/Services/Pods/ConfigMaps.