From 2728c71368c218d606ba004db4f93c8334e93a6a Mon Sep 17 00:00:00 2001 From: Avinash Kumar Deepak Date: Mon, 22 Jun 2026 22:41:49 +0530 Subject: [PATCH] workloadmanager: honor default code interpreter auth mode Signed-off-by: Avinash Kumar Deepak --- pkg/workloadmanager/workload_builder.go | 8 ++-- pkg/workloadmanager/workload_builder_test.go | 42 ++++++++++++++++++++ 2 files changed, 46 insertions(+), 4 deletions(-) diff --git a/pkg/workloadmanager/workload_builder.go b/pkg/workloadmanager/workload_builder.go index 2a42e4f0..190d96bd 100644 --- a/pkg/workloadmanager/workload_builder.go +++ b/pkg/workloadmanager/workload_builder.go @@ -309,11 +309,11 @@ func buildSandboxByAgentRuntime(namespace string, name string, ownerID string, i } // buildCodeInterpreterEnvVars copies the template env vars and injects the -// public key when authMode is picod. +// public key unless authMode is none. func buildCodeInterpreterEnvVars(templateEnv []corev1.EnvVar, authMode runtimev1alpha1.AuthModeType) []corev1.EnvVar { envVars := make([]corev1.EnvVar, len(templateEnv)) copy(envVars, templateEnv) - if authMode == runtimev1alpha1.AuthModePicoD { + if authMode != runtimev1alpha1.AuthModeNone { envVars = append(envVars, corev1.EnvVar{ Name: "PICOD_AUTH_PUBLIC_KEY", Value: GetCachedPublicKey(), @@ -331,8 +331,8 @@ func buildSandboxByCodeInterpreter(namespace string, codeInterpreterName string, return nil, nil, nil, fmt.Errorf("failed to get code interpreter %s/%s: %w", namespace, codeInterpreterName, err) } - // Check public key available if authMode is picod - if codeInterpreterObj.Spec.AuthMode == runtimev1alpha1.AuthModePicoD && !IsPublicKeyCached() { + // Check public key available unless authMode is none + if codeInterpreterObj.Spec.AuthMode != runtimev1alpha1.AuthModeNone && !IsPublicKeyCached() { return nil, nil, nil, api.ErrPublicKeyMissing } diff --git a/pkg/workloadmanager/workload_builder_test.go b/pkg/workloadmanager/workload_builder_test.go index 035dd5c6..90f2eb2e 100644 --- a/pkg/workloadmanager/workload_builder_test.go +++ b/pkg/workloadmanager/workload_builder_test.go @@ -332,6 +332,14 @@ func TestBuildCodeInterpreterEnvVars(t *testing.T) { {Name: "PICOD_AUTH_PUBLIC_KEY", Value: "test-public-key"}, }, }, + { + name: "empty authMode injects public key", + templateEnv: nil, + authMode: "", + expected: []corev1.EnvVar{ + {Name: "PICOD_AUTH_PUBLIC_KEY", Value: "test-public-key"}, + }, + }, } for _, tt := range tests { @@ -571,6 +579,40 @@ func TestBuildSandboxByCodeInterpreter_PicodAuthFailsWithoutKey(t *testing.T) { } } +func TestBuildSandboxByCodeInterpreter_DefaultAuthFailsWithoutKey(t *testing.T) { + codeInterpreter := &runtimev1alpha1.CodeInterpreter{ + ObjectMeta: metav1.ObjectMeta{ + Name: "ci-default-auth-no-key", + Namespace: testNamespace, + }, + Spec: runtimev1alpha1.CodeInterpreterSpec{ + Template: &runtimev1alpha1.CodeInterpreterSandboxTemplate{ + Image: "my-ci-image:latest", + }, + }, + } + + setCachedPublicKeyForTest(t, "") + + fakeClient := cubefake.NewSimpleClientset(codeInterpreter) + factory := cubeinformers.NewSharedInformerFactory(fakeClient, 0) + codeInterpreterInformer := factory.Runtime().V1alpha1().CodeInterpreters() + err := codeInterpreterInformer.Informer().GetStore().Add(codeInterpreter) + assert.NoError(t, err) + + ifm := &Informers{ + CodeInterpreterLister: codeInterpreterInformer.Lister(), + CodeInterpreterInformer: codeInterpreterInformer.Informer(), + informerFactory: newFactory(), + cubeInformerFactory: factory, + } + + _, _, _, err = buildSandboxByCodeInterpreter(testNamespace, "ci-default-auth-no-key", "", ifm) + if !errors.Is(err, api.ErrPublicKeyMissing) { + t.Fatalf("expected error %v, got %v", api.ErrPublicKeyMissing, err) + } +} + func TestBuildSandboxByCodeInterpreter_SuccessNoWarmPool(t *testing.T) { codeInterpreter := &runtimev1alpha1.CodeInterpreter{ ObjectMeta: metav1.ObjectMeta{