zyratlo commented on PR #8032: URL: https://github.com/apache/texera/pull/8032#issuecomment-5457062585
Worth recording that this has been exercised end to end, not only unit tested. Stage 3 (#8006) is stacked on this branch, and deploying it to a local Minikube cluster ran every decision in this PR against real infrastructure. Calico was used deliberately, because Minikube's default CNI creates NetworkPolicy objects without enforcing them, which would make an isolation test look correct while enforcing nothing. What that confirmed: * Provisioning creates the pod on demand and the resource quota moves to match. The pod's labels, hostname and subdomain line up with what the headless service selects, so the FQDN this PR records actually resolves. * The token a user receives matches an independent HMAC derivation of the same uid, computed outside the JVM from the configured secret. Two users receive different tokens. * The stale row path works. Deleting a pod without touching its registry row makes the next request log the recorded address as unreachable, discard the row, and provision a replacement. * Per-user isolation holds. One user's pod cannot reach another's on 8888 by pod IP or by DNS, in either direction, while the same pod reaches another namespace in the same probe. Removing the NetworkPolicy makes the connection succeed and restoring it blocks again, so the denial is attributable to the policy rather than to incidental CNI behaviour. Three things only a real deployment surfaced, all fixed in the stage 3 branch rather than here, since none of them are defects in this code: * Deriving the browser-facing origin from a gateway hostname alone is not enough. A deployment reached by port-forward or NodePort has no hostname, so the origin has to be settable directly. * A proxy that rewrites the Host header breaks JupyterLab's own cross-origin check on cookie-authenticated requests, which silently prevents the kernel from starting. * The gateway route serving the LLM endpoints had no explicit timeout, so Envoy's 15 second default cut off completions that take longer and were succeeding upstream. On the Codecov result: the twelve lines it reports are partials, not uncovered lines. The per-file breakdown reads 0 Missing throughout. Ten are scala-logging macro branches, where `logger.warn(...)` expands to an `isWarnEnabled` check that would need the suite run at two log levels to cover both sides. The other two are a pattern-match dispatch branch and a case class synthetic. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
