fix(agents): grant agents-api cluster-scoped nodes:list (+ strip empty Helm docs in Platform Validate)#661
Merged
Merged
Conversation
agents-api runs a node-selector satisfiability preflight (spec 010) for setup-options and session launch/restart, which lists cluster-scoped Nodes. The SA only had the namespaced agents-api-runner-controller Role, so every check failed with a 403 that the API mapped to a 502 — breaking setup-options and session launch/restart in production. Add a ClusterRole/ClusterRoleBinding (agents-api-node-reader) granting nodes:get,list,watch to the agents-api SA. agents-api also degrades gracefully when this is absent (ExtraToast/agents#36); this restores accurate preflight validation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Platform Validate failed with `kubeconform … error while parsing:
missing 'kind' key` (1 of 666 resources). The offending document is an
empty one Helm emits when a template is guarded by a false `{{- if }}`:
the `---` separator and `# Source:` comment are still rendered but the
body is not. kubeconform -strict treats that empty document as a
kind-less resource and fails the whole render — unrelated to whatever
change triggered the run.
Strip documents with no non-comment content from the rendered stream
before validating, logging each dropped document (with its `# Source:`
line) so chart churn stays visible. A genuinely malformed resource — a
mapping that really lacks `kind` — has non-comment content and is kept,
so kubeconform still catches real schema errors; this only removes
parser noise.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ExtraToast
changed the title
Temporary diagnostic: surface which document kubeconform sees as missing 'kind' (with its # Source: line) so the offending chart can be identified from CI logs. Will fold into the strip fix once confirmed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Finalize the strip: drop documents with neither a top-level apiVersion nor kind (Helm empty-conditional output and flux-local's degenerate `metadata:` fragment after the grafana Deployment). Keep any doc that has apiVersion but no kind so genuine schema errors still fail. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two related fixes — the first restores the prod incident fix, the second unblocks CI for it.
1. RBAC: agents-api cluster-scoped
nodes:listagents-api 502'd on
setup-options, session launch, and workspace restart:The node-selector satisfiability preflight (spec 010) lists cluster-scoped Nodes, but the SA only had the namespaced
agents-api-runner-controllerRole. The 403 was mapped to a 502. AddsClusterRole/ClusterRoleBindingagents-api-node-reader(nodes: get,list,watch). App-side graceful degradation: ExtraToast/agents#36 (merged).Already applied out-of-band to restore service (
kubectl auth can-i list nodes --as=…agents-api→ yes); this makes it durable under Flux.2. Platform Validate: strip empty Helm-rendered documents
Platform Validatewas failing pre-existing (unrelated to the RBAC change) withkubeconform … missing 'kind' key(1 of 666 resources). Cause: Helm emits an empty document (just---+# Source:comment) when a template is guarded by a false{{- if }};kubeconform -stricttreats it as a kind-less resource.render-flux.shnow drops documents with no non-comment content before validating, logging each dropped doc with its# Source:line. A real mapping that lackskindhas non-comment content and is kept, so genuine schema errors still fail. Verified locally: a clean 713-doc render passes through unchanged; a synthetic empty doc is dropped while a real kind-less mapping is retained.🤖 Generated with Claude Code