feat(swarm): add global_id handling in secret initialization script

[zbitname]

Summary by CodeRabbit

• Bug Fixes
  • Improved secret initialization to always read the global identifier from configuration and ensure its reference is present.
  • Added a safeguard that creates the identifier lookup record when it doesn’t already exist, preventing downstream initialization issues.
  • Enhanced the DNS manager bootstrap to automatically create the required cluster policy affinity rule if it’s missing, ensuring cluster policy affinity is correctly established.

[coderabbitai]

Warning

Review limit reached

@zbitname, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 37 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e73458b5-6116-44f4-bb03-af1e49f4eed9

📥 Commits

Reviewing files that changed from the base of the PR and between e673da5 and 7df46d5.

📒 Files selected for processing (3)

• src/swarm-scripts/00-initialize-secrets.sh
• src/swarm-scripts/74.setup-dns-manager.sh
• src/swarm-scripts/swarm-cli.py

Walkthrough

The initialization script now reads global_id from config and creates the matching pointer record when missing. The DNS manager setup script now derives an affinity-rule id and bootstraps a missing ClusterPolicyAffinityRule for knot.

Changes

Global ID initialization

Layer / File(s)	Summary
Load and persist global ID src/swarm-scripts/00-initialize-secrets.sh	Reads global_id from config.yaml, defines a helper that inserts the SwarmIdPointer row when missing, and invokes it during initialization.

DNS manager affinity bootstrap

Layer / File(s)	Summary
Ensure knot affinity rule src/swarm-scripts/74.setup-dns-manager.sh	Derives AFFINITY_RULE_ID, checks that the knot cluster policy exists, and creates the ClusterPolicyAffinityRule when it is absent.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Poem

🐰 I hopped through config by starlit light,
Found one new pointer and one rule set right.
A global ID and knot affinity gleam,
Two little bootstraps in a tidy stream.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately reflects the main secret-initialization change around handling global_id.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/custom-globalid

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/swarm-scripts/00-initialize-secrets.sh`:
- Around line 72-87: The ensure_global_id_pointer function is missing DB
password handling and is doing unsafe manual SQL escaping. Update the mysql
calls in ensure_global_id_pointer to use the same DB credentials as the rest of
the init flow, including DB_PASSWORD from the environment, so the SELECT/INSERT
can authenticate correctly. Replace the inline sed-based escaping for the INSERT
value with a safer approach by delegating to swarm-cli.py or another
parameterized/escaping mechanism that correctly handles backslashes and quotes.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 06420a02-5788-4244-8e3c-648a835ad6f8

📥 Commits

Reviewing files that changed from the base of the PR and between d6ac3f0 and c53a3d3.

📒 Files selected for processing (1)

• src/swarm-scripts/00-initialize-secrets.sh

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/swarm-scripts/74.setup-dns-manager.sh`:
- Around line 71-87: The final success message is being printed before the new
ClusterPolicyAffinityRule setup path completes, so move the completion log to
after the AFFINITY_RULE_ID check/create block in setup-dns-manager.sh. Update
the script flow around the new affinity-rule logic so the existing “Done...”
message is emitted only after the cluster policy and swarm-cli.py operations
finish successfully.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 31113a90-0d5a-423c-af46-71ed70bbf56a

📥 Commits

Reviewing files that changed from the base of the PR and between c53a3d3 and 7db4d30.

📒 Files selected for processing (2)

• src/swarm-scripts/00-initialize-secrets.sh
• src/swarm-scripts/74.setup-dns-manager.sh

💤 Files with no reviewable changes (1)

• src/swarm-scripts/00-initialize-secrets.sh