Skip to content

fix(manifests): add CP token Service and wire CP_RUNTIME_NAMESPACE + CP_TOKEN_URL #1214

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
markturansky merged 1 commit into from
Apr 5, 2026
Merged

fix(manifests): add CP token Service and wire CP_RUNTIME_NAMESPACE + CP_TOKEN_URL #1214

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions components/manifests/overlays/mpp-openshift/ambient-control-plane-svc.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
apiVersion: v1
kind: Service
metadata:
name: ambient-control-plane
namespace: ambient-code--runtime-int
labels:
app: ambient-control-plane
spec:
selector:
app: ambient-control-plane
ports:
- name: token
port: 8080
targetPort: 8080
protocol: TCP
Comment on lines +1 to +15
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot Apr 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify namespace consistency across manifests
echo "=== Service namespace ==="
grep -n 'namespace:' components/manifests/overlays/mpp-openshift/ambient-control-plane-svc.yaml

echo "=== CP_TOKEN_URL value ==="
grep -n 'CP_TOKEN_URL' -A1 components/manifests/overlays/mpp-openshift/ambient-control-plane.yaml

echo "=== Deployment namespace ==="
grep -n 'namespace:' components/manifests/overlays/mpp-openshift/ambient-control-plane.yaml | head -1

Repository: ambient-code/platform

Length of output: 359

Fix namespace mismatch: CP_TOKEN_URL points to wrong namespace.

Service ambient-control-plane is deployed to namespace ambient-code--runtime-int (line 5), but CP_TOKEN_URL in ambient-control-plane.yaml:84 references ambient-code--ambient-s0.svc:8080. The token endpoint will fail to resolve. Update the CP_TOKEN_URL to match the Service namespace:

value: "http://ambient-control-plane.ambient-code--runtime-int.svc:8080/token"
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@components/manifests/overlays/mpp-openshift/ambient-control-plane-svc.yaml`
around lines 1 - 15, The CP_TOKEN_URL environment variable is pointing to the
wrong namespace; update the CP_TOKEN_URL value to use the service in the
ambient-code--runtime-int namespace so it resolves to the Service defined by
metadata.name ambient-control-plane; locate the CP_TOKEN_URL entry in
ambient-control-plane.yaml (around the env block containing CP_TOKEN_URL) and
change its value to reference
http://ambient-control-plane.ambient-code--runtime-int.svc:8080/token so it
matches the Service selector and port defined for the ambient-control-plane
Service.

6 changes: 6 additions & 0 deletions components/manifests/overlays/mpp-openshift/ambient-control-plane.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,12 @@ spec:
value: "ambient-vertex"
- name: VERTEX_SECRET_NAMESPACE
value: "ambient-code--runtime-int"
- name: CP_RUNTIME_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: CP_TOKEN_URL
value: "http://ambient-control-plane.ambient-code--ambient-s0.svc:8080/token"
Comment on lines +79 to +84
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot Apr 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

CP_RUNTIME_NAMESPACE fix looks correct; CP_TOKEN_URL namespace needs verification.

Using fieldRef: metadata.namespace ensures NetworkPolicy targets the actual deployment namespace — good fix.

However, CP_TOKEN_URL hardcodes ambient-code--ambient-s0 while this Deployment and the new Service are both in ambient-code--runtime-int. See comment on the Service file for the mismatch.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@components/manifests/overlays/mpp-openshift/ambient-control-plane.yaml`
around lines 79 - 84, CP_TOKEN_URL currently hardcodes the wrong namespace;
update it so the token host uses the deployment runtime namespace instead of
"ambient-code--ambient-s0". Replace the static value for CP_TOKEN_URL with a
reference that uses the CP_RUNTIME_NAMESPACE env var (e.g.
"http://ambient-control-plane.$(CP_RUNTIME_NAMESPACE).svc:8080/token") so the
service DNS resolves to the same namespace as CP_RUNTIME_NAMESPACE; adjust the
CP_TOKEN_URL env entry in the same container spec where CP_RUNTIME_NAMESPACE is
defined.

volumeMounts:
- name: project-kube-token
mountPath: /var/run/secrets/project-kube
Expand Down
1 change: 1 addition & 0 deletions components/manifests/overlays/mpp-openshift/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ resources:
- ambient-api-server-db.yaml
- ambient-api-server.yaml
- ambient-control-plane.yaml
- ambient-control-plane-svc.yaml
- ambient-api-server-route.yaml
- ambient-control-plane-sa.yaml
- tenant-rbac/
Expand Down
Loading