fix(agent): remove floci AWS env credentials (FB-2197)

docs-internal/local-development.md

@@ -25,7 +25,7 @@ make test
 
 ## Why floci
 
-The metadata images shipped after 2026-05-13 refuse local-filesystem managed storage in dedicated-Pensieve mode. `values-dev.yaml` sets `customEngineConfig.storage` to `type: minio`, which hardcodes the S3 access/secret to `firebolt/firebolt` — floci (zero-auth) signs through without any env-var plumbing.
+The metadata images shipped after 2026-05-13 refuse local-filesystem managed storage in dedicated-Pensieve mode. `values-dev.yaml` points `customEngineConfig.storage` at floci (`managed_table_storage: s3` plus `aws.endpoint`) so local installs use object storage without cloud infrastructure.
 
 ## Reset floci
 

docs/quickstart.mdx

@@ -70,17 +70,10 @@ floci stores data in the pod's ephemeral filesystem and validates no credentials
 
 ## Configure the engine
 
-Create a values file that points the engine's storage at the floci endpoint. `managed_table_storage: s3` with `aws.endpoint` targets floci, and `managed_table_bucket_name` matches the bucket floci created. floci is zero-auth, so any AWS credentials work (set via `engineSpec.extraEnv`).
+Create a values file that points the engine's storage at the floci endpoint. `managed_table_storage: s3` with `aws.endpoint` targets floci, and `managed_table_bucket_name` matches the bucket floci created.
 
 ```yaml
 # my-values.yaml
-engineSpec:
-  extraEnv:
-    - name: AWS_ACCESS_KEY_ID
-      value: firebolt
-    - name: AWS_SECRET_ACCESS_KEY
-      value: firebolt
-
 customEngineConfig:
   storage:
     managed_table_storage: s3

helm/templates/tests/test-sql-query.yaml

@@ -61,19 +61,34 @@ spec:
           [ -n "$ACCESS_TOKEN" ] \
             || fail "did not receive access_token, response: $TOKEN_RESPONSE"
           {{- end }}
-          log "SQL: SELECT 1 via gateway (engine: $ENGINE)"
-          RESPONSE=$(curl --fail --silent $CURL_INSECURE \
-            --retry 10 --retry-delay 5 --retry-connrefused \
-            --max-time 30 \
-            -X POST "$GW/" \
-            -H "X-Firebolt-Engine: $ENGINE" \
-            {{- if $.Values.auth.enabled }}
-            -H "Authorization: Bearer $ACCESS_TOKEN" \
-            {{- end }}
-            -H "Content-Type: text/plain" \
-            --data "SELECT 1")
-          echo "Response: $RESPONSE"
-          echo "$RESPONSE" | grep -q "1" || fail "unexpected response from gateway"
-          pass "SELECT 1 returned a result containing '1'"
+          sql_query() {
+            LABEL="$1"
+            QUERY="$2"
+            EXPECTED="$3"
+            log "SQL: $LABEL via gateway (engine: $ENGINE)"
+            RESPONSE=$(curl --fail --silent $CURL_INSECURE \
+              --retry 10 --retry-delay 5 --retry-connrefused \
+              --max-time 30 \
+              -X POST "$GW/" \
+              -H "X-Firebolt-Engine: $ENGINE" \
+              {{- if $.Values.auth.enabled }}
+              -H "Authorization: Bearer $ACCESS_TOKEN" \
+              {{- end }}
+              -H "Content-Type: text/plain" \
+              --data "$QUERY")
+            echo "Response: $RESPONSE"
+            [ -z "$EXPECTED" ] || echo "$RESPONSE" | grep -q "$EXPECTED" \
+              || fail "unexpected response for $LABEL"
+          }
+
+          sql_query "SELECT 1" "SELECT 1" "1"
+
+          TABLE="helm_storage_smoke_$(printf '%s' "$ENGINE" | tr -c 'A-Za-z0-9_' '_')"
+          sql_query "managed table cleanup" "DROP TABLE IF EXISTS $TABLE" ""
+          sql_query "managed table create" "CREATE TABLE $TABLE (id INT, name TEXT)" ""
+          sql_query "managed table insert" "INSERT INTO $TABLE (id, name) VALUES (1, 'floci'), (2, 'managed-storage')" ""
+          sql_query "managed table select" "SELECT name FROM $TABLE WHERE id = 2" "managed-storage"
+          sql_query "managed table final cleanup" "DROP TABLE IF EXISTS $TABLE" ""
+          pass "SELECT 1 and managed-table read/write checks passed"
 {{- end }}
 {{- end }}

helm/values-dev.yaml

@@ -10,21 +10,14 @@
 engineSpec:
   image:
     tag: dev
-  # floci is zero-auth; the engine still signs S3 requests, so supply any creds.
-  extraEnv:
-    - name: AWS_ACCESS_KEY_ID
-      value: firebolt
-    - name: AWS_SECRET_ACCESS_KEY
-      value: firebolt
 
 metadata:
   image:
     tag: dev
 
 # Point the engine's managed storage at the local floci S3 emulator. The engine
 # refuses to start in dedicated-Pensieve mode without managed storage on object
-# storage. floci is zero-auth, so any AWS creds work (set via engineSpec.extraEnv
-# above). Apply local-floci.yaml in the same namespace before `make install`.
+# storage. Apply local-floci.yaml in the same namespace before `make install`.
 customEngineConfig:
   storage:
     managed_table_storage: s3

local-floci.yaml

@@ -8,8 +8,7 @@
 #   kubectl -n firebolt rollout status deployment/floci --timeout=120s
 #   make install   # or make upgrade
 #
-# Floci is zero-auth: SigV4 still required but credentials aren't validated.
-# Supply any AWS creds via engineSpec.extraEnv (see docs/quickstart.mdx).
+# Floci is zero-auth and validates no object-storage credentials.
 ---
 apiVersion: apps/v1
 kind: Deployment

scripts/lib/deploy.sh

@@ -81,22 +81,26 @@ wait_rollout() {
   return 1
 }
 
-# Run a query through the instance gateway and assert the result contains an
-# expected substring. Mirrors the curl example in docs/quickstart.mdx: the
+# Run a query through the instance gateway and optionally assert the result
+# contains an expected substring. Mirrors the curl example in docs/quickstart.mdx: the
 # gateway Service is <release>-gateway in the same namespace, and the target
 # engine is selected via the X-Firebolt-Engine header.
 #
 # Usage:
 #   run_query <namespace> <gateway-service> <engine> [query] [expected] [attempts] [sleep]
 #
+# An empty expected string means HTTP success is enough. DDL/DML statements may
+# return a 2xx response with no body, while SELECT statements should assert a
+# result substring.
+#
 # A rolled-out engine can still need a few seconds before the gateway routes
 # queries to it (engine HTTP listener warming up), so this polls.
 run_query() {
   local namespace="$1"
   local gateway="$2"
   local engine="$3"
   local query="${4:-SELECT 1}"
-  local expected="${5:-1}"
+  local expected="${5-1}"
   local attempts="${6:-24}"
   local sleep_seconds="${7:-5}"
 
@@ -115,8 +119,12 @@ run_query() {
         -H "X-Firebolt-Engine: ${engine}" \
         -H "Content-Type: text/plain" \
         --data-binary "${query}" 2>/dev/null); then
-      if printf '%s' "${output}" | grep -q "${expected}"; then
-        echo "Query succeeded after ${i} attempt(s); result contains '${expected}':"
+      if [[ -z "${expected}" ]] || printf '%s' "${output}" | grep -q "${expected}"; then
+        if [[ -z "${expected}" ]]; then
+          echo "Query succeeded after ${i} attempt(s)."
+        else
+          echo "Query succeeded after ${i} attempt(s); result contains '${expected}':"
+        fi
         printf '%s\n' "${output}"
         return 0
       fi
@@ -131,6 +139,23 @@ run_query() {
   return 1
 }
 
+# Exercise the managed-table path against the configured object store. SELECT 1
+# proves the gateway and query listener work; this sequence proves the engine can
+# create table metadata, write table data, and read it back using the chart's
+# customEngineConfig.storage block.
+run_managed_table_smoke() {
+  local namespace="$1"
+  local gateway="$2"
+  local engine="$3"
+  local table="helm_storage_smoke"
+
+  run_query "${namespace}" "${gateway}" "${engine}" "DROP TABLE IF EXISTS ${table}" ""
+  run_query "${namespace}" "${gateway}" "${engine}" "CREATE TABLE ${table} (id INT, name TEXT)" ""
+  run_query "${namespace}" "${gateway}" "${engine}" "INSERT INTO ${table} (id, name) VALUES (1, 'floci'), (2, 'managed-storage')" ""
+  run_query "${namespace}" "${gateway}" "${engine}" "SELECT name FROM ${table} WHERE id = 2" "managed-storage"
+  run_query "${namespace}" "${gateway}" "${engine}" "DROP TABLE IF EXISTS ${table}" ""
+}
+
 # Current pipeline phase and the failure_reason to report if this phase fails.
 # Both helm-test.sh (human output) and scripts/agent/up.sh (JSON output) walk the same
 # phases via deploy_and_verify; scripts/agent/up.sh reads these globals in its EXIT trap
@@ -217,13 +242,6 @@ deploy_and_verify() {
   my_values="$(mktemp)"
   trap 'rm -f "'"${my_values}"'"' RETURN
   cat > "${my_values}" <<EOF
-engineSpec:
-  extraEnv:
-    - name: AWS_ACCESS_KEY_ID
-      value: firebolt
-    - name: AWS_SECRET_ACCESS_KEY
-      value: firebolt
-
 customEngineConfig:
   storage:
     managed_table_storage: s3
@@ -295,6 +313,11 @@ EOF
   set_phase query query_failed
   run_query "${namespace}" "${gateway}" "${engine}"
 
+  # The local quickstart config points managed-table storage at floci. A simple
+  # table write/read catches storage config regressions that SELECT 1 cannot.
+  set_phase managed_table managed_table_failed
+  run_managed_table_smoke "${namespace}" "${gateway}" "${engine}"
+
   # --- Thorough verification (opt-in) ---------------------------------------
   # THOROUGH=true additionally runs the chart's full helm test suite
   # (helm/templates/tests/*.yaml): DNS for every service, configmaps, postgres,