fix: resolve operator, agent networking, auth, alerting, and tracing issues - #26
Merged
Merged
Conversation
…issues Operator: - Fix API group mismatch (arcana.ai → arcana.io) preventing CRD reconciliation - Remove hardcoded namespace scope so operator discovers agents across all namespaces Agent networking: - Add HTTPS egress (port 443) to agent-isolation NetworkPolicy for PyPI access - Add ingress rule allowing traffic from ingress-nginx to agent pods - Create per-agent Ingress during provisioning for independent agent identity - Add CreateIngress method to mesh K8s client Studio frontend: - Add global fetch wrapper injecting auth headers from localStorage - Fix dashboard calling nonexistent /api/v1/mcp route (now uses /api/v1/tools) - Remove /agents/ ingress rule that hijacked SPA client-side routing API gateway: - Expand viewer role RBAC to allow read access to platform resources - Add /api/v1/webhooks/alerts/ endpoint for Alertmanager notifications Tracing: - Add http:// scheme prefix to OTEL_EXPORTER_OTLP_ENDPOINT across all 28 Helm charts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes multiple issues preventing the platform from operating correctly:
arcana.aivsarcana.io) and hardcoded namespace scope/api/v1/mcproute, and ingress hijacking SPA routeshttp://scheme prefix{name}.arcana.localhost.meChanges
Operator (
cmd/operator/main.go)arcana.ai→arcana.io.Namespace("arcana")from List call for cluster-wide agent discoveryAgent Networking (
cmd/mesh/k8s.go,cmd/mesh/handlers.go)agent-isolationNetworkPolicyingress-nginxnamespace traffic on port 5002CreateIngress()method for per-agent subdomain ingressARCANA_BASE_DOMAINconfigStudio Frontend (
services/studio/src/)window.fetchwrapper inmain.tsxinjectsX-Arcana-RoleandAuthorizationheaders/api/v1/mcp→/api/v1/toolsAPI Gateway (
cmd/api/)viewerrole to readskills,tools,models,connectors,rules,memory,costs, etc./api/v1/webhooks/alerts/POST handler for AlertmanagerIngress (
deploy/backing/ingress.yaml)/agents/path that conflicted with Studio SPA routingTracing (
deploy/helm/*/values.yaml)http://scheme toOTEL_EXPORTER_OTLP_ENDPOINTacross all 28 Helm chartsTest plan
Provisioned1/1 Runningafter NetworkPolicy fix/api/v1/health)/agents/{name}) loads without 403{"status":"accepted","severity":"critical"}No connection adapterserrors across all Python services{name}.arcana.localhost.me:8080/health