fix(k8s): auto-create target namespace if it doesn't exist (studio#138 follow-up) - #140
Merged
Merged
Conversation
…o#138 follow-up) Brett hit "namespaces \"openab-studio\" not found" applying the ConfigMap right after #139 landed — the New Fleet wizard's "+ Create new namespace…" field (studio#119) only ever *typed* a name into the deploy request; nothing actually created the k8s Namespace object, so picking it 404'd the instant anything (ConfigMap/Secret/Deployment) tried to apply into it. New `ensure_namespace_k8s` (Patch::Apply, same idempotent shape as `provision_acp_auth_k8s_secret` — a no-op if the namespace already exists), called at the top of both k8s provision paths: `provision_agent_k8s` (the wizard, where Brett hit this) and `provision_from_library_k8s` (the older compose-library path — same gap, fixed for consistency). Verification: could not compile locally (this sandbox reliably OOMs on aws-sdk-ec2). Field types (Namespace/ObjectMeta) verified by reading the pinned k8s-openapi 0.24 source directly. CI is the real gate. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Merged
3 tasks
brettchien
added a commit
that referenced
this pull request
Aug 30, 2026
…studio#138 follow-up) (#141) Brett hit "ConfigMap \"Persephone-config\" is invalid ... must be a lowercase RFC 1123 subdomain" — the Agent name field's "suggest a Greek god name" default (studio#128) capitalizes the first letter, and nothing downstream lowercased it before using it to build k8s object names. ## Change - New `oabctl::k8s_safe_name` (in k8s_driver.rs, re-exported at crate root): lowercases and maps any character outside `[a-z0-9-]` to `-`, then trims leading/trailing `-` so the result still starts/ends alphanumeric per the RFC 1123 regex. - `k8s_deployment_name` now slugifies internally — every Deployment name derived from an agent name is safe by construction. - `provision_acp_auth_k8s_secret`/`provision_config_k8s_configmap` (studio-cp) now slugify the agent name before building their Secret/ConfigMap names. - `provision_agent_k8s`/`provision_from_library_k8s`: the free-typed "+ Create new namespace…" field has the exact same risk, so `namespace` is now normalized once up front and shadowed for the rest of the function — `ensure_namespace_k8s` (#140) and every object placed into that namespace now agree on the same slugified value, instead of `ensure_namespace_k8s` creating one casing while everything else tries to apply into another. Verification: could not compile locally (sandbox OOMs on aws-sdk-ec2). Added unit tests for `k8s_safe_name` and a regression test reproducing the exact "Persephone" case Brett hit. CI is the real gate. Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Brett hit
namespaces "openab-studio" not foundapplying the ConfigMap right after #139 landed — the S3-free path works, but the namespace it's deploying into doesn't exist.Root cause: the New Fleet wizard's "+ Create new namespace…" field (studio#119) only ever typed a name into the deploy request — nothing actually created the k8s
Namespaceobject, so picking it 404'd the instant anything (ConfigMap/Secret/Deployment) tried to apply into it.Change
New
ensure_namespace_k8sinstudio-cp—Patch::Applys a bareNamespace, same idempotent shape as the existingprovision_acp_auth_k8s_secret(a no-op if it already exists). Called at the top of both k8s provision paths:provision_agent_k8s(the wizard — where Brett hit this)provision_from_library_k8s(the older compose-library path — same gap, fixed for consistency)Test plan
aws-sdk-ec2.Namespace/ObjectMetafield shapes verified by reading the pinnedk8s-openapi 0.24source directly. CI (build-test) is the real gate.🤖 Generated with Claude Code