fix(ci): provision config-keyring Secret before waiting on data-server-controller - #113
Open
steiler wants to merge 1 commit into
Open
fix(ci): provision config-keyring Secret before waiting on data-server-controller#113steiler wants to merge 1 commit into
steiler wants to merge 1 commit into
Conversation
…r-controller config-server intentionally stopped shipping a default config-keyring Secret in its own deploy artifacts (commit 83d07f8, "added ENV keyring and removed keyring secret") to force real deployments to bring their own key material. The data-server-controller StatefulSet still mounts that Secret as a volume unconditionally, so without it the pod hangs in ContainerCreating for the full 10-minute Robot timeout instead of failing with a clear error. Add a CI-only placeholder Secret and apply it right after the generated artifacts.yaml (once the sdc-system namespace exists) and before 00-setup waits for the StatefulSet to become ready. Co-authored-by: Cursor <cursoragent@cursor.com>
This was referenced Aug 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
sdcio/config-serverintentionally stopped shipping a defaultconfig-keyringSecret in its own deploy artifacts (commit83d07f8, "added ENV keyring and removed keyring secret") to force real deployments to bring their own key material, but thedata-server-controllerStatefulSet still mounts that Secret as a volume unconditionally.kubectl apply-ing config-server's generatedartifacts.yamlproduces a pod stuck inContainerCreatingfor the full 10-minute Robot timeout with no clear error — this affectssdcio/config-serverPR #441 (and every run since) and currently blockssdcio/data-serverPR #471 /sdcio/config-serverPR #476.config-keyringSecret and applies it in00-setupright afterartifacts.yaml(so thesdc-systemnamespace already exists) and before the suite waits for the StatefulSet to become ready.Test plan
robot --dryrunontests/00-setup/passes (syntax-checked locally).python3 -c 'import yaml; yaml.safe_load(...)'), placeholder key confirmed to decode to a valid 32-byte AES key matchingconfig-server'spkg/keyring/keyring.gorequirements.sdcio/config-serverPR #476'sintegration-testsjob withPairs-with: sdcio/integration-tests#<this PR>to confirm the StatefulSet comes up.Made with Cursor