fix(manifests): add CP token Service and wire CP_RUNTIME_NAMESPACE + CP_TOKEN_URL#1214
Merged
markturansky merged 1 commit intoalphafrom Apr 5, 2026
Merged
Conversation
…CP_TOKEN_URL The CP /token endpoint (port 8080) had no Kubernetes Service, so runner pods and the NetworkPolicy peer match had no stable DNS target. - Add ambient-control-plane-svc.yaml: ClusterIP Service exposing port 8080 (token server) on the CP pod selector. - Inject CP_RUNTIME_NAMESPACE via downward API (metadata.namespace) so ensureAPIServerNetworkPolicy() matches the actual deployed namespace rather than the hardcoded default ambient-code--runtime-int. - Set CP_TOKEN_URL to the FQDN of the new Service in ambient-code--ambient-s0 so runner pods can reach the token endpoint across namespace boundaries. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
Contributor
📝 WalkthroughWalkthroughAdded a Kubernetes Service manifest for Changes
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@components/manifests/overlays/mpp-openshift/ambient-control-plane-svc.yaml`:
- Around line 1-15: The CP_TOKEN_URL environment variable is pointing to the
wrong namespace; update the CP_TOKEN_URL value to use the service in the
ambient-code--runtime-int namespace so it resolves to the Service defined by
metadata.name ambient-control-plane; locate the CP_TOKEN_URL entry in
ambient-control-plane.yaml (around the env block containing CP_TOKEN_URL) and
change its value to reference
http://ambient-control-plane.ambient-code--runtime-int.svc:8080/token so it
matches the Service selector and port defined for the ambient-control-plane
Service.
In `@components/manifests/overlays/mpp-openshift/ambient-control-plane.yaml`:
- Around line 79-84: CP_TOKEN_URL currently hardcodes the wrong namespace;
update it so the token host uses the deployment runtime namespace instead of
"ambient-code--ambient-s0". Replace the static value for CP_TOKEN_URL with a
reference that uses the CP_RUNTIME_NAMESPACE env var (e.g.
"http://ambient-control-plane.$(CP_RUNTIME_NAMESPACE).svc:8080/token") so the
service DNS resolves to the same namespace as CP_RUNTIME_NAMESPACE; adjust the
CP_TOKEN_URL env entry in the same container spec where CP_RUNTIME_NAMESPACE is
defined.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 4ec5b080-2163-4103-9e3d-a0ecbcdc6ad8
📒 Files selected for processing (3)
components/manifests/overlays/mpp-openshift/ambient-control-plane-svc.yamlcomponents/manifests/overlays/mpp-openshift/ambient-control-plane.yamlcomponents/manifests/overlays/mpp-openshift/kustomization.yaml
Comment on lines
+1
to
+15
| apiVersion: v1 | ||
| kind: Service | ||
| metadata: | ||
| name: ambient-control-plane | ||
| namespace: ambient-code--runtime-int | ||
| labels: | ||
| app: ambient-control-plane | ||
| spec: | ||
| selector: | ||
| app: ambient-control-plane | ||
| ports: | ||
| - name: token | ||
| port: 8080 | ||
| targetPort: 8080 | ||
| protocol: TCP |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify namespace consistency across manifests
echo "=== Service namespace ==="
grep -n 'namespace:' components/manifests/overlays/mpp-openshift/ambient-control-plane-svc.yaml
echo "=== CP_TOKEN_URL value ==="
grep -n 'CP_TOKEN_URL' -A1 components/manifests/overlays/mpp-openshift/ambient-control-plane.yaml
echo "=== Deployment namespace ==="
grep -n 'namespace:' components/manifests/overlays/mpp-openshift/ambient-control-plane.yaml | head -1Repository: ambient-code/platform
Length of output: 359
Fix namespace mismatch: CP_TOKEN_URL points to wrong namespace.
Service ambient-control-plane is deployed to namespace ambient-code--runtime-int (line 5), but CP_TOKEN_URL in ambient-control-plane.yaml:84 references ambient-code--ambient-s0.svc:8080. The token endpoint will fail to resolve. Update the CP_TOKEN_URL to match the Service namespace:
value: "http://ambient-control-plane.ambient-code--runtime-int.svc:8080/token"
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@components/manifests/overlays/mpp-openshift/ambient-control-plane-svc.yaml`
around lines 1 - 15, The CP_TOKEN_URL environment variable is pointing to the
wrong namespace; update the CP_TOKEN_URL value to use the service in the
ambient-code--runtime-int namespace so it resolves to the Service defined by
metadata.name ambient-control-plane; locate the CP_TOKEN_URL entry in
ambient-control-plane.yaml (around the env block containing CP_TOKEN_URL) and
change its value to reference
http://ambient-control-plane.ambient-code--runtime-int.svc:8080/token so it
matches the Service selector and port defined for the ambient-control-plane
Service.
Comment on lines
+79
to
+84
| - name: CP_RUNTIME_NAMESPACE | ||
| valueFrom: | ||
| fieldRef: | ||
| fieldPath: metadata.namespace | ||
| - name: CP_TOKEN_URL | ||
| value: "http://ambient-control-plane.ambient-code--ambient-s0.svc:8080/token" |
Contributor
There was a problem hiding this comment.
CP_RUNTIME_NAMESPACE fix looks correct; CP_TOKEN_URL namespace needs verification.
Using fieldRef: metadata.namespace ensures NetworkPolicy targets the actual deployment namespace — good fix.
However, CP_TOKEN_URL hardcodes ambient-code--ambient-s0 while this Deployment and the new Service are both in ambient-code--runtime-int. See comment on the Service file for the mismatch.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@components/manifests/overlays/mpp-openshift/ambient-control-plane.yaml`
around lines 79 - 84, CP_TOKEN_URL currently hardcodes the wrong namespace;
update it so the token host uses the deployment runtime namespace instead of
"ambient-code--ambient-s0". Replace the static value for CP_TOKEN_URL with a
reference that uses the CP_RUNTIME_NAMESPACE env var (e.g.
"http://ambient-control-plane.$(CP_RUNTIME_NAMESPACE).svc:8080/token") so the
service DNS resolves to the same namespace as CP_RUNTIME_NAMESPACE; adjust the
CP_TOKEN_URL env entry in the same container spec where CP_RUNTIME_NAMESPACE is
defined.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #1213. The CP token endpoint was running but unreachable because:
CP_RUNTIME_NAMESPACE— defaulted toambient-code--runtime-intbut the actual deployed namespace isambient-code--ambient-s0, soensureAPIServerNetworkPolicy()was creating a NetworkPolicy that matched the wrong namespace selector — causingacpctl session eventsto still 502Changes
ambient-control-plane-svc.yaml— new ClusterIP Service exposing port 8080 on the CP podambient-control-plane.yaml— injectCP_RUNTIME_NAMESPACEvia downward API (metadata.namespace) so the NetworkPolicy peer label matches the actual runtime namespace; setCP_TOKEN_URLto the FQDN of the new ServiceTest plan
oc get svc ambient-control-plane -n ambient-code--ambient-s0exists with port 8080allow-ambient-api-serverNetworkPolicy in session namespace uses correct namespace selector (ambient-code--ambient-s0)acpctl session events <id>streams without 502🤖 Generated with Claude Code
Summary by CodeRabbit