feat: add state migration to remove ServiceUserRole resources#357
Merged
rshoemaker merged 2 commits intomainfrom Apr 21, 2026
Merged
feat: add state migration to remove ServiceUserRole resources#357rshoemaker merged 2 commits intomainfrom
rshoemaker merged 2 commits intomainfrom
Conversation
Add Version_1_1_0 migration that removes all swarm.service_user_role resources from etcd state and scrubs dependency references from all remaining resources. Covers MCP, RAG, and PostgREST service types.
📝 WalkthroughWalkthroughAdded a state migration Changes
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 6 |
| Duplication | 0 |
TIP This summary will be updated as you push new changes. Give us feedback
jason-lynch
approved these changes
Apr 21, 2026
Member
jason-lynch
left a comment
jason-lynch
left a comment
There was a problem hiding this comment.
Nice! This looks good to me. The comment is non-blocking if you're in a hurry. We can fix it on the next update.
| @@ -1,4 +1,4 @@ | |||
| { | |||
| "version": "1.0.0", | |||
| "version": "1.1.0", | |||
Member
There was a problem hiding this comment.
Having these change on every update is going to be a nuisance. We should probably switch 1_0_0_test.go to not use NewState:
diff --git a/server/internal/resource/migrations/1_0_0_test.go b/server/internal/resource/migrations/1_0_0_test.go
index 703880a2..fb74a858 100644
--- a/server/internal/resource/migrations/1_0_0_test.go
+++ b/server/internal/resource/migrations/1_0_0_test.go
@@ -139,7 +139,10 @@ func TestVersion_1_0_0(t *testing.T) {
},
} {
t.Run(tc.name, func(t *testing.T) {
- state := resource.NewState()
+ state := &resource.State{
+ Version: resource.StateVersion_1_0_0,
+ Resources: map[resource.Type]map[string]*resource.ResourceData{},
+ }
state.Add(tc.in...)
migration := &migrations.Version_1_0_0{}Avoid golden file churn by constructing state with an explicit version instead of NewState(), which picks up CurrentVersion.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@server/internal/resource/migrations/1_1_0.go`:
- Around line 25-35: The migration currently filters out serviceUserRoleType
from each ResourceData's Dependencies but misses TypeDependencies; update the
same loop over state.Resources (the block handling ResourceData) to also remove
entries equal to serviceUserRoleType from each data.TypeDependencies slice
(e.g., build a filtered slice like you do for data.Dependencies and assign back
to data.TypeDependencies). Ensure you reference ResourceData.TypeDependencies
and the serviceUserRoleType constant so persisted TypeDependencies entries like
"swarm.service_user_role" are scrubbed as well.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: e593b052-25cb-4d9f-9160-a8d7c744a270
📒 Files selected for processing (5)
server/internal/resource/migrations/1_0_0_test.goserver/internal/resource/migrations/1_1_0.goserver/internal/resource/migrations/1_1_0_test.goserver/internal/resource/migrations/provide.goserver/internal/resource/state.go
jason-lynch
approved these changes
Apr 21, 2026
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
swarm.service_user_roleresources from existing deploymentsswarm.service_user_roleentries from etcd state regardless of service typeswarm.service_user_rolereferences from all other resources' dependency listsContext
Now that MCP (#338), RAG (#351), and PostgREST (#352) all use
connect_as, the auto-createdsvc_*_ro/svc_*_rwservice accounts are no longer needed. This migration cleans up stale state from existing v0.7.0 deployments.Note: orphaned Postgres roles (
svc_*_ro/svc_*_rw) are not dropped from the database — they remain as harmless orphans. Dropping them would require SQL execution during a workflow, which is out of scope for a state migration.Test plan
TestVersion_1_1_0/removes_service_user_role_resources— MCP RO+RW removed, deps scrubbedTestVersion_1_1_0/removes_service_user_role_resources_across_all_service_types— MCP, RAG, PostgREST roles removed in single stateTestVersion_1_1_0/no-op_when_no_service_user_role_resources_exist— safe on clean stateTestVersion_1_1_0/empty_state— safe on empty state