Skip to content

fix(manifests): add OIDC client credentials to control-plane deployment #1445

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
markturansky merged 1 commit into from
Apr 23, 2026
+10 −0
Merged

fix(manifests): add OIDC client credentials to control-plane deployment #1445

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions components/manifests/base/ambient-control-plane-service.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,16 @@ spec:
secretKeyRef:
name: ambient-control-plane-token
key: token
- name: OIDC_CLIENT_ID
valueFrom:
secretKeyRef:
name: ambient-api-server
key: clientId
- name: OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: ambient-api-server
key: clientSecret
Comment on lines +38 to +47
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Critical: referenced Secret keys do not exist in the base ambient-api-server Secret

Line 41/42 and Line 46/47 reference ambient-api-server keys clientId and clientSecret, but components/manifests/base/platform/ambient-api-server-secrets.yml currently defines only sentry.key. This will break env var resolution and block pod startup.

Suggested fix 
# components/manifests/base/platform/ambient-api-server-secrets.yml
 stringData:
+  clientId: ""
+  clientSecret: ""
   sentry.key: ""

As per coding guidelines, "Prioritize Critical and Major severity issues. Minimize Minor and Trivial findings."

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@components/manifests/base/ambient-control-plane-service.yml` around lines 38
- 47, The manifest references env vars OIDC_CLIENT_ID and OIDC_CLIENT_SECRET via
secretKeyRef name ambient-api-server keys clientId and clientSecret, but that
Secret only contains sentry.key; update the ambient-api-server Secret (the
resource defined in ambient-api-server-secrets.yml) to include clientId and
clientSecret (or change the env var references to point to existing secret keys)
so the OIDC_CLIENT_ID/OIDC_CLIENT_SECRET env vars can be resolved at pod
startup; ensure the Secret uses the same key names (clientId, clientSecret) and
appropriate base64-encoded values to match the env var references.

- name: AMBIENT_API_SERVER_URL
value: "https://ambient-api-server.ambient-code.svc:8000"
- name: AMBIENT_GRPC_SERVER_ADDR
Expand Down
Loading