feat(agent-runtime): run PostgreSQL schema setup before deployment - #233
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b92a73172e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if schemaValues["PGSSLMODE"] == "" && schemaValues["PG_SSLMODE"] != "" { | ||
| schemaValues["PGSSLMODE"] = schemaValues["PG_SSLMODE"] |
There was a problem hiding this comment.
When PG_SSLMODE is supplied in the referenced checkpoint Secret rather than feature.env, this map contains no value to bridge, and envFrom exposes only PG_SSLMODE; it cannot rename it to libpq's PGSSLMODE. The schema process therefore ignores the requested SSL mode, potentially failing against databases that require certificate verification or connecting with weaker defaults, despite the documented allowance for settings to come from the Secret.
Useful? React with 👍 / 👎.
| if job.Annotations[schemaJobManagedAnnotation] != schemaJobManagedValue { | ||
| return false |
There was a problem hiding this comment.
If status.schemaJobId names an AIService-owned Job without this annotation—for example, a completed SAIA post-install Job retained when the mutable feature name is changed to agentruntime—returning false makes reconciliation treat that unrelated Job as the PostgreSQL schema run. A completed Job then allows the Agent Runtime Deployment to start without its schema having been installed; an unmarked Job should trigger replacement or an explicit error.
Useful? React with 👍 / 👎.
| featureEnv := buildSchemaSetupEnv(ai.Spec.Feature.Env) | ||
| job.Spec = batchv1.JobSpec{ | ||
| BackoffLimit: ptr(schemaJobBackoffLimit), | ||
| TTLSecondsAfterFinished: ptr(int32(86400)), |
There was a problem hiding this comment.
After a successful schema Job reaches this 24-hour TTL, Kubernetes deletes it while status.schemaJobId still contains its name. The owner deletion event, or any subsequent AIService reconciliation, then observes NotFound, clears the status field, and recreates the same schema Job even though neither fingerprint changed, causing every Agent Runtime schema setup to run repeatedly rather than only when its inputs change. Either retain the Job or persist enough completion and fingerprint state outside the expiring object.
Useful? React with 👍 / 👎.
| if schemaJobFailed(job) { | ||
| return fmt.Errorf("postgres schema setup Job %q failed", job.Name) | ||
| } | ||
| return fmt.Errorf("postgres schema setup Job %q is still running", job.Name) |
There was a problem hiding this comment.
While this Job is running, reconciliation returns an error and relies on a later retry to create the Deployment. However, the controller-wide filter in internal/controller/aiservice_controller.go:240-245 rejects a Job update that changes only status, so the local JobChangedPredicate cannot enqueue the AIService when the Complete condition appears. Completion is therefore noticed only on the next exponentially rate-limited error retry, which can leave longer-running schema jobs blocking deployment well after they finish; allow Job status changes through the global filter or use an ordinary timed requeue for this pending state.
Useful? React with 👍 / 👎.
1 participant
Summary
Implements AIP-5169 by preparing the Agent Runtime PostgreSQL schema in an AIService-owned Kubernetes Job before creating the AgentRuntime Deployment.
Changes
Compatibility
Validation
Testing-only cluster configuration was intentionally excluded from this PR.