feat(demo): add MaaS IPP Kind lab - #22
Merged
Merged
Conversation
praxis-bot
reviewed
Aug 3, 2026
praxis-bot
left a comment
praxis-bot
left a comment
There was a problem hiding this comment.
Review: feat(demo): add MaaS IPP Kind lab
Overall this is a well-structured demo lab with good idempotency (all scripts check-before-apply), clear documentation, and a useful Forge exec path-resolution improvement in Rust.
The Rust change to resolve relative exec args against config_dir is clean: bare program names stay on PATH, absolute/flag args pass through, .. escape is rejected, and tests cover the happy path and the rejection case.
| Severity | Count |
|---|---|
| Critical | 0 |
| Large | 1 |
| Medium | 1 |
See inline comments for details.
Single-cluster Forge path for stock MaaS + IPP on Kind. Resolve relative exec scripts against the config dir, fetch the pinned istioctl instead of trusting PATH, and stop kubectl-setting RELATED_IMAGE env vars that conflict with valueFrom under server-side apply. Signed-off-by: Aslak Knutsen <aslak@4fs.no>
Add templated exec.env and URL sha256 so forge.yaml pins are authoritative for the MaaS IPP lab instead of unused decorations. Signed-off-by: Aslak Knutsen <aslak@4fs.no>
Document resolve_exec_arg and replace expect_err in tests so workspace lint with -D warnings passes. Signed-off-by: Aslak Knutsen <aslak@4fs.no>
shaneutt
approved these changes
Aug 4, 2026
github-project-automation
Bot
moved this from Review
to Done
in AI Gateway - Model Serving
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a single-cluster Forge lab (
demos/maas-ipp) that brings up the stock MaaS Kind datapath so IPP / Praxis integration work can run without the full Grid GLB demo:Client → Istio Gateway → IPP-pre → Kuadrant Auth → IPP-post → HTTPRoute → backendsISTIO_VERSIONintodemos/maas-ipp/.cache/(PATHistioctlis not trusted), and document bring-up / curl flows in the README.kubectl set envonRELATED_IMAGE_*vars that usevalueFrom; a literal value + server-side apply merge was rejected by the API.execscript paths against the config directory (with..escape rejected) so stacks work regardless of process cwd..cache/; link the lab fromdemos/README.md.Test plan
MAAS_ROOT=… cargo run -p praxis-forge -- apply local --config demos/maas-ipp/forge.yamlcompletescargo test -p praxis-forge(exec path resolution tests)Notes
Related #2