fix: Local_resource and kubectl apply could risk deploying to the wrong context#66
Conversation
|
Warning Rate limit exceeded@danielpanzella has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 24 minutes and 1 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (1)
WalkthroughThe pull request simplifies resource management in the Tiltfile and streamlines security settings in the manager deployment. The Changes
Sequence Diagram(s)sequenceDiagram
participant T as Tiltfile
participant KR as k8s_yaml/k8s_resource
participant K8s as Kubernetes Cluster
T->>KR: Define resources (Minio, WandB, CRD, RBAC)
KR->>K8s: Apply resource configurations
K8s-->>KR: Return deployment status
KR-->>T: Propagate status update
Possibly related PRs
Suggested reviewers
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
Tiltfile (1)
108-109: Commented code should be removedThese commented-out lines are now redundant since you've implemented the proper Tilt-native approach in lines 99-106.
- #local_resource('Sample YAML', 'kubectl apply -f ./hack/testing-manifests/wandb/' + settings.get('wandbCRD') + - # '.yaml', deps=["./hack/testing-manifests/wandb/" + settings.get('wandbCRD') + ".yaml"], resource_deps=["controller-manager"])
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
Tiltfile(3 hunks)config/manager/manager.yaml(0 hunks)
💤 Files with no reviewable changes (1)
- config/manager/manager.yaml
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: Test
🔇 Additional comments (4)
Tiltfile (4)
67-75: Improved security by replacing kubectl direct calls with Tilt's k8s functionsThis change replaces the previous
local_resourcewithkubectl applycommand with Tilt's nativek8s_yamlandk8s_resourcefunctions. This is a significant security improvement as it ensures Minio is only deployed to contexts explicitly allowed byallow_k8s_contexts, preventing accidental deployments to unintended or production environments.
77-77: Enhanced safety with Tilt's k8s_yaml for CRD deploymentConverting the direct kubectl command to Tilt's native function prevents deployment to unintended contexts. This approach also captures the output of the local command, making it more consistent with Tilt's declarative approach.
79-90: Improved resource organization with explicit object definitionsThis change properly organizes CRD and RBAC resources with explicit object type definitions, making the deployment more structured and transparent. The explicit naming of cluster-scoped resources (clusterrole, clusterrolebinding) is particularly important for security awareness.
99-106: Enhanced safety for Wandb resource deploymentSimilar to other changes, this replaces a direct kubectl command with Tilt's native functions, ensuring deployments only target allowed contexts. The explicit dependency on "operator-controller-manager" maintains the correct deployment order.
### [1.19.2](v1.19.1...v1.19.2) (2025-03-17) ### Bug Fixes * Local_resource and kubectl apply could risk deploying to the wrong context ([#66](#66)) ([a90a270](a90a270))
|
This PR is included in version 1.19.2 🎉 |
## 1.0.0 (2025-04-11) ### Features * Add active-state cm ([wandb#2](https://github.com/sqaisar/wandb-operator/issues/2)) ([5a6c4c3](5a6c4c3)) * Add caching for deployer release requests ([1185b40](1185b40)) * Add events recording ([388d37b](388d37b)) * Add helm support ([077765c](077765c)) * Add option to set reconcileFrequency ([484c014](484c014)) * Add support for helm repo releases ([dfef752](dfef752)) * Add support for release from a git repository ([8a6b073](8a6b073)) * Adding owner ref and wait and timeout to uninstall ([wandb#51](https://github.com/sqaisar/wandb-operator/issues/51)) ([f21fd6d](f21fd6d)) * Allow the operator to support installation without cluster level permissions ([wandb#16](https://github.com/sqaisar/wandb-operator/issues/16)) ([6f29a3e](6f29a3e)) * Make wandb operator available on OperatorHub ([wandb#32](https://github.com/sqaisar/wandb-operator/issues/32)) ([1a59dab](1a59dab)) * **operator:** Add airgapped support ([wandb#12](https://github.com/sqaisar/wandb-operator/issues/12)) ([bfd3796](bfd3796)) * Prevent Logging of Sensitive info in Plain Text ([wandb#31](https://github.com/sqaisar/wandb-operator/issues/31)) ([5530cb3](5530cb3)) * Prevent Logging of Sensitive info in Plain Text ([wandb#35](https://github.com/sqaisar/wandb-operator/issues/35)) ([9a752fd](9a752fd)) * Release Version Pinning Init ([wandb#28](https://github.com/sqaisar/wandb-operator/issues/28)) ([dfe8bda](dfe8bda)) * Replace base image with RHEL UBI ([wandb#44](https://github.com/sqaisar/wandb-operator/issues/44)) ([12497d2](12497d2)) * Support for deploymenting via jobs ([da801ea](da801ea)) * Updated license.go file to include the feature for licenseSecret as well ([wandb#54](https://github.com/sqaisar/wandb-operator/issues/54)) ([bb55caa](bb55caa)) * Use container based deployments only ([3e6b222](3e6b222)) * use secrets instead of configmaps ([049797f](049797f)) ### Bug Fixes * add applied config to download bundle ([bef77c2](bef77c2)) * Add console namespace and service name to config properties ([0b9efef](0b9efef)) * Add debugging for installing release ([893ebd9](893ebd9)) * add gh token for ci ([72d456f](72d456f)) * add license log ([wandb#11](https://github.com/sqaisar/wandb-operator/issues/11)) ([e129fab](e129fab)) * Add operator namespace env ([846731a](846731a)) * add operator properties to config ([b5f48f0](b5f48f0)) * add pnpm, node and git to docker image ([176b6f0](176b6f0)) * Add Tilt configs for local development ([wandb#53](https://github.com/sqaisar/wandb-operator/issues/53)) ([5ef82b5](5ef82b5)) * added changelog commits ([61b5f5d](61b5f5d)) * Assign metadata instead of merging it ([908c839](908c839)) * Basic Auth Fix ([wandb#56](https://github.com/sqaisar/wandb-operator/issues/56)) ([414b2cf](414b2cf)) * Bump controller tools version to latest ([wandb#13](https://github.com/sqaisar/wandb-operator/issues/13)) ([c52dbb6](c52dbb6)) * Bump deps ([wandb#36](https://github.com/sqaisar/wandb-operator/issues/36)) ([eefb59c](eefb59c)) * Bump deps ([wandb#70](https://github.com/sqaisar/wandb-operator/issues/70)) ([11ba9f8](11ba9f8)) * Channel spec not getting applied correctly ([6e763a8](6e763a8)) * Charts download ([57355ce](57355ce)) * Clean up docker image ([ef7c629](ef7c629)) * clean up env for image push ([7213ed2](7213ed2)) * Correct merge order ([cd49cef](cd49cef)) * correctly check if chart is installed based on status ([384d330](384d330)) * Create release rc files ([f7f4622](f7f4622)) * Debug logging errors ([wandb#26](https://github.com/sqaisar/wandb-operator/issues/26)) ([a641621](a641621)) * Debug logging the cache ([wandb#21](https://github.com/sqaisar/wandb-operator/issues/21)) ([26e8fd5](26e8fd5)) * Debugging logic ([wandb#22](https://github.com/sqaisar/wandb-operator/issues/22)) ([2c019b8](2c019b8)) * Default to dev mode ([d961f77](d961f77)) * docker build ([d160a9c](d160a9c)) * docker image push ([e08b3da](e08b3da)) * Git release pulls correctly ([d47aebd](d47aebd)) * init controller ([0f0a9e9](0f0a9e9)) * install go version ([6664b4b](6664b4b)) * Install kubectl in docker image ([e5df9de](e5df9de)) * Jobs work? ([9972d26](9972d26)) * kubectl not working in docker image ([ffc694e](ffc694e)) * Local_resource and kubectl apply could risk deploying to the wrong context ([wandb#66](https://github.com/sqaisar/wandb-operator/issues/66)) ([a90a270](a90a270)) * lock pnpm version ([c2608f7](c2608f7)) * Log the diff of specs ([wandb#23](https://github.com/sqaisar/wandb-operator/issues/23)) ([c0ea0d8](c0ea0d8)) * Look for secret in namespace of wandb CR ([wandb#78](https://github.com/sqaisar/wandb-operator/issues/78)) ([e374c9a](e374c9a)) * Mask sensitive values in log ([wandb#14](https://github.com/sqaisar/wandb-operator/issues/14)) ([514336d](514336d)) * merge func ([94aa0d0](94aa0d0)) * Output json format logs ([90af7b6](90af7b6)) * Pass namespace into chart ([e8e0b8f](e8e0b8f)) * pass spec namespace and name ([79d77f2](79d77f2)) * Preserve unknown fields ([565a25f](565a25f)) * properly get license ([6ff6533](6ff6533)) * Properly merge chart specs together ([37c41bc](37c41bc)) * Properly parse chart from deployer ([5eabdfe](5eabdfe)) * Properly set namespace for deployments ([53f51a9](53f51a9)) * Properly update complete status ([86a5196](86a5196)) * push images to dockerhub ([d4cdd27](d4cdd27)) * refactor spec ([87be86b](87be86b)) * Refactor specs ([7c6da34](7c6da34)) * Release needs ginkgo ([wandb#65](https://github.com/sqaisar/wandb-operator/issues/65)) ([c51df78](c51df78)) * remove console ([fba45ee](fba45ee)) * remove debugging logs ([d4da31f](d4da31f)) * remove submodule ([bdb408a](bdb408a)) * Remove ui building step ([08ee985](08ee985)) * Rename config -> values and release -> chart ([519cd1b](519cd1b)) * Rename config spec cfs ([672100a](672100a)) * rename configs ([8727281](8727281)) * rename docker variables ([274e20c](274e20c)) * rename versioning step name ([77bf4ed](77bf4ed)) * reorder backup ([ab66486](ab66486)) * revert to v2 for semver ([535a721](535a721)) * Save active spec metadata ([47bd862](47bd862)) * Secret reading metadata ([6dab7ed](6dab7ed)) * secrets stored with correct values ([f6d61e9](f6d61e9)) * Serve console with gin ([c9e04aa](c9e04aa)) * set namespace when running kubectl apply ([1d6f00c](1d6f00c)) * Setting cached release namespace incorrectly ([e585555](e585555)) * Simplify docker image ([1cf55e4](1cf55e4)) * Support Openshift permissions schema for the helm cache ([wandb#17](https://github.com/sqaisar/wandb-operator/issues/17)) ([b498f79](b498f79)) * TLS ([wandb#67](https://github.com/sqaisar/wandb-operator/issues/67)) ([0d3013c](0d3013c)) * Tmp directory permissions ([b0820f5](b0820f5)) * Update to fix some CVEs ([wandb#55](https://github.com/sqaisar/wandb-operator/issues/55)) ([9a34cbe](9a34cbe)) * upgrade semantic to v3 ([594c463](594c463)) * Use cdk8s image for apply container ([189bc08](189bc08)) * Use deployer release channels ([480b380](480b380)) * Using validate for job spec ([5c7ff66](5c7ff66)) * x-kubernetes-preserve-unknown-fields ([bedac52](bedac52))
3 participants
Summary by CodeRabbit