This repository was archived by the owner on Jun 10, 2026. It is now read-only.
feat(controller): snapshot autoCreate/autoActivate switches + RBAC fixes - #5
Open
achetronic wants to merge 4 commits into
Open
feat(controller): snapshot autoCreate/autoActivate switches + RBAC fixes#5achetronic wants to merge 4 commits into
achetronic wants to merge 4 commits into
Conversation
added 4 commits
March 21, 2026 21:18
Add two boolean config fields to the controller's snapshot section that control whether the batcher creates and activates snapshots automatically: - snapshot.autoCreate (default: true) — when false, the controller syncs resources to Vrata's live config but never creates snapshots. Pending changes are cleared without calling POST /snapshots. - snapshot.autoActivate (default: true) — when false, snapshots are created but not activated. Proxies keep serving the previous active snapshot until a human activates the new one via the API. The combination autoCreate=false + autoActivate=true is rejected at config validation. Both fields default to true for full backwards compatibility. Changes: - config.go: AutoCreate/AutoActivate *bool fields on SnapshotConfig with helper methods and validation - batcher.go: flushLocked respects both flags. Three code paths: skip snapshot entirely, create without activating, or create+activate (default) - main.go: passes config values to batcher.New - config.yaml: new fields with inline documentation - values.yaml: Helm chart defaults - configuration.md: docs with field reference table - batcher_test.go: 3 new unit tests (one per mode) - config_test.go: 4 new tests (defaults, explicit false, explicit true, invalid combo rejection) - controller_test.go: e2e updated for new batcher signature - CONTROLLER_DECISIONS.md: decision documented All 17 unit tests pass (8 batcher + 9 config).
The ClusterRole only had rules for gateway.networking.k8s.io resources. When controller.config.watch.superHttpRoutes was set to true, the controller could not list/watch/get SuperHTTPRoute resources from the vrata.io API group, nor update their status. Add conditional RBAC rules for vrata.io/superhttproutes and vrata.io/superhttproutes/status, gated behind the same .Values.controller.config.watch.superHttpRoutes flag. When superHttpRoutes is false (default), no extra rules are rendered.
The controller uses coordination.k8s.io/leases for leader election but the ClusterRole had no rules for it. Enabling leaderElection.enabled would result in 403 Forbidden when the controller tries to create or renew its Lease. Add conditional RBAC rules for coordination.k8s.io/leases (get, create, update), gated behind .Values.controller.config.leaderElection.enabled.
Three new e2e tests covering the three snapshot mode combinations: - TestE2E_Controller_SnapshotAutoCreateDisabled: applies an HTTPRoute, verifies the route exists in Vrata live config, but no snapshot was created (autoCreate=false). - TestE2E_Controller_SnapshotAutoCreateTrue_AutoActivateFalse: applies an HTTPRoute, verifies a snapshot was created but is NOT active (autoCreate=true, autoActivate=false). - TestE2E_Controller_SnapshotAutoCreateTrue_AutoActivateTrue: applies an HTTPRoute, verifies a snapshot was created AND activated (autoCreate=true, autoActivate=true — default behaviour). Adds two e2e helpers: - vrataCleanControllerSnapshots: removes all vrata-controller-* snapshots - countControllerSnapshots: counts controller snapshots and checks active
achetronic
added a commit
that referenced
this pull request
Apr 6, 2026
achetronic
added a commit
that referenced
this pull request
Apr 6, 2026
Signed-off-by: Alby Hernández <donfumero@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Three changes in one branch:
1. Snapshot enabler switches
Two new boolean config fields in the controller snapshot section:
snapshot.autoCreate(default:true) — when false, the controller syncs resources to Vrata live config but never creates snapshots.snapshot.autoActivate(default:true) — when false, snapshots are created but not activated. A human reviews and activates via the API.The combination
autoCreate: false+autoActivate: trueis rejected at config validation. Both default totruefor full backwards compatibility.Use cases:
true/true— full autopilot (current default)true/false— human approval gatefalse/*— live config only, external snapshot management2. RBAC for SuperHTTPRoute
ClusterRole was missing rules for
vrata.ioapiGroup. Conditional oncontroller.config.watch.superHttpRoutes.3. RBAC for leader election Leases
ClusterRole was missing rules for
coordination.k8s.io/leases. Conditional oncontroller.config.leaderElection.enabled.Tests
All 17 unit tests pass (8 batcher + 9 config).