feat: replace Maestro with kube-applier and add hyperfleet-db (RDS + DynamoDB)#677
Open
typeid wants to merge 1 commit into
Open
feat: replace Maestro with kube-applier and add hyperfleet-db (RDS + DynamoDB)#677typeid wants to merge 1 commit into
typeid wants to merge 1 commit into
Conversation
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
needs-rebase
Contributor
📝 WalkthroughWalkthroughThis PR replaces Maestro and legacy HyperFleet components with kube-applier and hyperfleet-operator, adds DynamoDB-backed management-cluster state and a HyperFleet PostgreSQL module, updates Platform API/bootstrap wiring, and removes obsolete IoT, AmazonMQ, adapter, cleanup, and observability paths. ChangesPlatform migration
Estimated code review effort: 5 (Critical) | ~120 minutes Possibly related PRs
✨ Finishing Touches🧪 Generate unit tests (beta)
|
openshift-ci
Bot
removed
the
needs-rebase
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
typeid
added
the
do-not-merge/hold
typeid
changed the title
typeid
force-pushed
the
pgruntime
branch
3 times, most recently
from
4ad193b to
45fe72d
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 15
🧹 Nitpick comments (7)
terraform/modules/hyperfleet-db/variables.tf (1)
15-18: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winValidate the Multi-AZ subnet requirement at the module boundary.
main.tfenables Multi-AZ RDS, but this input only documents>= 2subnets. Add validation so invalid callers fail during planning instead of during AWS provisioning.Proposed validation
variable "private_subnet_ids" { description = "Private subnet IDs for RDS subnet group (Multi-AZ requires >= 2 AZs)" type = list(string) + + validation { + condition = length(var.private_subnet_ids) >= 2 + error_message = "At least two private subnet IDs are required for the Multi-AZ RDS subnet group." + } }As per path instructions, Terraform modules must ensure multi-AZ high-availability patterns.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@terraform/modules/hyperfleet-db/variables.tf` around lines 15 - 18, Add a validation block to the private_subnet_ids variable declaration, requiring at least two subnet IDs to satisfy the Multi-AZ RDS configuration and fail invalid inputs during planning.Source: Path instructions
terraform/modules/hyperfleet-db/main.tf (3)
168-187: 🔒 Security & Privacy | 🔵 Trivial | 🏗️ Heavy liftNo rotation configured for RDS master password secret.
The master password secret has no
aws_secretsmanager_secret_rotationresource, so the credential is static indefinitely. Consider wiring up AWS's RDS PostgreSQL rotation Lambda (e.g. via theaws-secretsmanager-rds-postgres-rotation-single-userSAR app) for periodic rotation.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@terraform/modules/hyperfleet-db/main.tf` around lines 168 - 187, Add automatic rotation for the master password secret by defining an aws_secretsmanager_secret_rotation resource associated with aws_secretsmanager_secret.master, using the AWS RDS PostgreSQL single-user rotation Lambda and an appropriate rotation schedule. Configure the rotation Lambda, secret, and RDS instance dependencies so rotation runs successfully for the database managed by the module.
25-42: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winSecurity group has unrestricted (default) egress.
Only an ingress rule is defined; no
aws_vpc_security_group_egress_ruleis set, so AWS's default allow-all outbound rule remains active on this RDS security group.As per path instructions, "Validate security group rules follow least-privilege networking."
🔒️ Proposed fix
+resource "aws_vpc_security_group_egress_rule" "hyperfleet_db_egress" { + security_group_id = aws_security_group.hyperfleet_db.id + description = "Restrict outbound traffic" + ip_protocol = "-1" + cidr_ipv4 = var.vpc_cidr +}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@terraform/modules/hyperfleet-db/main.tf` around lines 25 - 42, Add an explicit aws_vpc_security_group_egress_rule for aws_security_group.hyperfleet_db that restricts outbound traffic to only the required destination, protocol, and port(s), removing the default allow-all egress behavior while preserving the existing PostgreSQL ingress rule.Source: Path instructions
193-239: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win
multi_azis hardcoded; no cost-tuning knob for ephemeral/dev environments.Every other cost-relevant RDS setting (deletion protection, final snapshot, performance insights, monitoring interval) is exposed as a variable and tuned down for ephemeral in
config/ephemeral/defaults.yaml, butmulti_az = trueis hardcoded here, roughly doubling RDS cost for disposable environments.♻️ Proposed fix
- multi_az = true + multi_az = var.multi_azSeparately, Checkov flags CKV_AWS_161 (RDS IAM database authentication not enabled) on this resource — worth considering as a defense-in-depth addition alongside the Secrets Manager password, though not blocking.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@terraform/modules/hyperfleet-db/main.tf` around lines 193 - 239, Expose the RDS Multi-AZ setting as a boolean module variable and replace the hardcoded multi_az = true in aws_db_instance.hyperfleet_db with that variable. Set the ephemeral environment’s value to false while preserving true as the production-safe default, and update the variable definitions and ephemeral defaults consistently. Consider enabling IAM database authentication on aws_db_instance.hyperfleet_db to address CKV_AWS_161 if supported by the surrounding configuration.Source: Linters/SAST tools
terraform/modules/kube-applier-dynamodb/variables.tf (1)
35-39: 🗄️ Data Integrity & Integration | 🔵 TrivialVerify PITR is explicitly enabled for non-ephemeral environments.
The default is
false, so staging or production tables lose point-in-time recovery unless every caller sets this variable. Enforce that requirement in environment configuration or make the value mandatory.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@terraform/modules/kube-applier-dynamodb/variables.tf` around lines 35 - 39, Ensure non-ephemeral environment configurations explicitly set enable_pitr to true, or remove its default and require callers to provide the value; update the variable declaration and relevant module invocations so staging and production cannot silently disable PITR.argocd/config/management-cluster/kube-applier/values.yaml (1)
40-45: 📐 Maintainability & Code Quality | 🔵 TrivialVerify that production overrides the disabled ServiceMonitor.
With
enabled: false, no ServiceMonitor is rendered even when Prometheus Operator is installed. Confirm management-cluster production values enable scraping.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@argocd/config/management-cluster/kube-applier/values.yaml` around lines 40 - 45, Verify the management-cluster production values override metrics.serviceMonitor.enabled from false to true, adding or updating the production override if necessary so the ServiceMonitor is rendered when Prometheus Operator is installed.terraform/modules/ecs-bootstrap/variables.tf (1)
68-72: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winConsider validating
rc_aws_account_idformat.This variable feeds an ArgoCD cluster secret annotation used to build cross-account ARNs, but unlike the
kube-appliermodule'src_aws_account_id(which validates a 12-digit AWS account ID), this one has no format validation. A malformed value would silently propagate into the annotation rather than failing fast at plan time.♻️ Proposed validation
variable "rc_aws_account_id" { description = "AWS account ID of the regional cluster where DynamoDB tables reside. Injected into the ArgoCD cluster secret so charts can build cross-account resource ARNs." type = string default = "" + + validation { + condition = var.rc_aws_account_id == "" || can(regex("^[0-9]{12}$", var.rc_aws_account_id)) + error_message = "rc_aws_account_id must be empty or a 12-digit AWS account ID" + } }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@terraform/modules/ecs-bootstrap/variables.tf` around lines 68 - 72, Add format validation to the `rc_aws_account_id` variable, matching the `kube-applier` module’s existing validation for a 12-digit AWS account ID. Preserve the empty-string default if required, and ensure malformed non-empty values fail during Terraform plan.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@argocd/config/management-cluster/kube-applier/templates/deployment.yaml`:
- Around line 25-27: Update the kube-applier container in the Deployment
template to set securityContext.readOnlyRootFilesystem: true. Add an emptyDir
volume and corresponding volumeMount only for any directory the kube-applier
process requires to remain writable, avoiding unnecessary writable mounts.
In `@argocd/config/management-cluster/kube-applier/values.yaml`:
- Around line 8-11: Replace the mutable "latest" value in the image
configuration with an immutable release version tag or content-addressable
digest, keeping the kube-applier deployment reproducible and rollbacks reliable.
In `@argocd/config/regional-cluster/platform-api/templates/deployment.yaml`:
- Around line 58-59: Update the BUCKET_COUNT value in the deployment template to
use 32 as the default instead of 1, keeping the fallback aligned with the
32-bucket contract when .Values.platformApi.hyperfleetdb.bucketCount is unset.
In `@config/templates/argocd-bootstrap/applicationset.yaml.j2`:
- Line 82: Update the oidcIssuerBaseURL rendering to conditionally include the
https:// prefix only when the oidc_cloudfront_domain annotation is set;
otherwise render an empty string. Modify the template expression for
oidcIssuerBaseURL and verify the rendered value remains valid YAML and matches
the expected OIDC configuration schema.
In `@docs/experiments/hyperfleet-operator-design.md`:
- Line 592: Correct the Phase 6 numbered sequence in the deployment removal list
so it is consecutive, changing the item currently labeled 5 to 4.
- Line 229: Add language identifiers to the fenced blocks in
hyperfleet-operator-design.md, including the blocks around the referenced lines.
Update each opening fence for pseudocode or plain-text content to use an
appropriate identifier such as ```text, ensuring markdownlint no longer reports
missing fence languages.
- Around line 426-427: Update the chart path in the documented ArgoCD deployment
section from `argocd/config/regional-cluster/hyperfleet-operator-chart/` to
`argocd/config/regional-cluster/hyperfleet/`, leaving the surrounding CRD
installation note unchanged.
- Around line 403-408: Update the fleet-db design section to reference the
implemented `terraform/modules/eks-cluster-workerless/` module instead of
`modules/eks-cluster`, and replace “No worker node scheduling” with terminology
that explicitly describes the workerless cluster while noting the required
system node pool for CoreDNS.
In `@scripts/buildspec/provision-kube-applier-dynamodb.sh`:
- Around line 34-62: Gate the hyperfleet role polling block using the script’s
apply/destroy action indicator, such as wrapping the Terraform initialization,
retry loop, and missing-role failure in an apply-only condition. Ensure the
destroy path skips this entire wait and continues using only the required rc_id
state output.
In `@scripts/buildspec/register.sh`:
- Around line 112-114: Remove the unused CloudFront prerequisite logic in
register.sh, including the wait for oidc_cloudfront_domain and construction of
CLOUDFRONT_URL. Confirm no subsequent steps consume either value, then delete
the gate and related variables while preserving the cluster registration flow.
In `@terraform/config/pipeline-management-cluster/main.tf`:
- Line 136: Update the Secrets Manager policy comment near the unrestricted
secretsmanager:* action to accurately describe account-wide access, or
preferably enforce least privilege by limiting the actions and Resource scope to
the required bootstrap and cluster secrets; ensure the comment matches the final
permissions.
In `@terraform/modules/eks-cluster/variables.tf`:
- Around line 10-11: The cluster_type documentation is missing the newly
supported fleet-db value. Update the variable description in variables.tf and
the corresponding documentation in README.md to list regional-cluster,
management-cluster, and fleet-db consistently with the validation condition.
In `@terraform/modules/hyperfleet-db/variables.tf`:
- Around line 20-22: Update the database ingress rules in the module’s
security-group resource to allow TCP/5432 only from the platform API and
Hyperfleet Operator security groups, replacing the broad vpc_cidr source; if
those groups cannot be referenced, document and enforce that the VPC is
dedicated to these clients.
In `@terraform/modules/kube-applier-dynamodb/main.tf`:
- Around line 27-37: Update the table-name expressions in specs_tables and
status_tables to prepend the required “mc-” prefix before var.mc_name, producing
names in the documented mc-{mc}-... format while preserving the existing
suffixes.
In `@terraform/modules/kube-applier-dynamodb/versions.tf`:
- Around line 2-7: Update the AWS provider constraint in the required_providers
block to require hashicorp/aws version 5.43.0 or newer, replacing the current >=
5.0 constraint; leave required_version unchanged.
---
Nitpick comments:
In `@argocd/config/management-cluster/kube-applier/values.yaml`:
- Around line 40-45: Verify the management-cluster production values override
metrics.serviceMonitor.enabled from false to true, adding or updating the
production override if necessary so the ServiceMonitor is rendered when
Prometheus Operator is installed.
In `@terraform/modules/ecs-bootstrap/variables.tf`:
- Around line 68-72: Add format validation to the `rc_aws_account_id` variable,
matching the `kube-applier` module’s existing validation for a 12-digit AWS
account ID. Preserve the empty-string default if required, and ensure malformed
non-empty values fail during Terraform plan.
In `@terraform/modules/hyperfleet-db/main.tf`:
- Around line 168-187: Add automatic rotation for the master password secret by
defining an aws_secretsmanager_secret_rotation resource associated with
aws_secretsmanager_secret.master, using the AWS RDS PostgreSQL single-user
rotation Lambda and an appropriate rotation schedule. Configure the rotation
Lambda, secret, and RDS instance dependencies so rotation runs successfully for
the database managed by the module.
- Around line 25-42: Add an explicit aws_vpc_security_group_egress_rule for
aws_security_group.hyperfleet_db that restricts outbound traffic to only the
required destination, protocol, and port(s), removing the default allow-all
egress behavior while preserving the existing PostgreSQL ingress rule.
- Around line 193-239: Expose the RDS Multi-AZ setting as a boolean module
variable and replace the hardcoded multi_az = true in
aws_db_instance.hyperfleet_db with that variable. Set the ephemeral
environment’s value to false while preserving true as the production-safe
default, and update the variable definitions and ephemeral defaults
consistently. Consider enabling IAM database authentication on
aws_db_instance.hyperfleet_db to address CKV_AWS_161 if supported by the
surrounding configuration.
In `@terraform/modules/hyperfleet-db/variables.tf`:
- Around line 15-18: Add a validation block to the private_subnet_ids variable
declaration, requiring at least two subnet IDs to satisfy the Multi-AZ RDS
configuration and fail invalid inputs during planning.
In `@terraform/modules/kube-applier-dynamodb/variables.tf`:
- Around line 35-39: Ensure non-ephemeral environment configurations explicitly
set enable_pitr to true, or remove its default and require callers to provide
the value; update the variable declaration and relevant module invocations so
staging and production cannot silently disable PITR.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 7647e65c-ac26-48f0-97e3-9b8354a70d43
📒 Files selected for processing (169)
.coderabbit.yamlargocd/config/management-cluster/kube-applier/Chart.yamlargocd/config/management-cluster/kube-applier/templates/_helpers.tplargocd/config/management-cluster/kube-applier/templates/clusterrole.yamlargocd/config/management-cluster/kube-applier/templates/clusterrolebinding.yamlargocd/config/management-cluster/kube-applier/templates/deployment.yamlargocd/config/management-cluster/kube-applier/templates/namespace.yamlargocd/config/management-cluster/kube-applier/templates/service.yamlargocd/config/management-cluster/kube-applier/templates/serviceaccount.yamlargocd/config/management-cluster/kube-applier/templates/servicemonitor.yamlargocd/config/management-cluster/kube-applier/values.yamlargocd/config/management-cluster/maestro-agent/.helmignoreargocd/config/management-cluster/maestro-agent/Chart.yamlargocd/config/management-cluster/maestro-agent/crds/appliedmanifestworks.yamlargocd/config/management-cluster/maestro-agent/templates/_helpers.tplargocd/config/management-cluster/maestro-agent/templates/clusterrole.yamlargocd/config/management-cluster/maestro-agent/templates/clusterrolebinding.yamlargocd/config/management-cluster/maestro-agent/templates/deployment.yamlargocd/config/management-cluster/maestro-agent/templates/namespace.yamlargocd/config/management-cluster/maestro-agent/templates/role-extension-apiserver.yamlargocd/config/management-cluster/maestro-agent/templates/rolebinding-extension-apiserver.yamlargocd/config/management-cluster/maestro-agent/templates/secretproviderclass.yamlargocd/config/management-cluster/maestro-agent/values.yamlargocd/config/regional-cluster/cloudwatch-exporter/values.yamlargocd/config/regional-cluster/cluster-cleanup/Chart.yamlargocd/config/regional-cluster/cluster-cleanup/templates/cronjob.yamlargocd/config/regional-cluster/cluster-cleanup/templates/rbac.yamlargocd/config/regional-cluster/cluster-cleanup/values.yamlargocd/config/regional-cluster/external-secrets-config/templates/hyperfleet-db-dsn.yamlargocd/config/regional-cluster/grafana/dashboards/infrastructure/clm.jsonargocd/config/regional-cluster/grafana/dashboards/infrastructure/platform-services.jsonargocd/config/regional-cluster/grafana/dashboards/mc/mc-health.jsonargocd/config/regional-cluster/grafana/dashboards/rc/rc-health.jsonargocd/config/regional-cluster/hyperfleet-adapter1-chart/.helmignoreargocd/config/regional-cluster/hyperfleet-adapter1-chart/Chart.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/README.mdargocd/config/regional-cluster/hyperfleet-adapter1-chart/adapter-config.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/adapter-task-config.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/manifestwork.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/_helpers.tplargocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/application.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/configmap-task.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/secretproviderclass.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/values.yamlargocd/config/regional-cluster/hyperfleet-api-chart/.helmignoreargocd/config/regional-cluster/hyperfleet-api-chart/templates/application.yamlargocd/config/regional-cluster/hyperfleet-api-chart/templates/secretproviderclass.yamlargocd/config/regional-cluster/hyperfleet-api-chart/values.yamlargocd/config/regional-cluster/hyperfleet-sentinel-chart/.helmignoreargocd/config/regional-cluster/hyperfleet-sentinel-chart/Chart.yamlargocd/config/regional-cluster/hyperfleet-sentinel-chart/templates/application.yamlargocd/config/regional-cluster/hyperfleet-sentinel-chart/templates/secretproviderclass.yamlargocd/config/regional-cluster/hyperfleet-sentinel-chart/values.yamlargocd/config/regional-cluster/hyperfleet/Chart.yamlargocd/config/regional-cluster/hyperfleet/templates/_helpers.tplargocd/config/regional-cluster/hyperfleet/templates/application.yamlargocd/config/regional-cluster/hyperfleet/values.yamlargocd/config/regional-cluster/maestro-server/.helmignoreargocd/config/regional-cluster/maestro-server/Chart.yamlargocd/config/regional-cluster/maestro-server/templates/_helpers.tplargocd/config/regional-cluster/maestro-server/templates/deployment.yamlargocd/config/regional-cluster/maestro-server/templates/namespace.yamlargocd/config/regional-cluster/maestro-server/templates/secretproviderclass.yamlargocd/config/regional-cluster/maestro-server/templates/serviceaccount.yamlargocd/config/regional-cluster/maestro-server/templates/services.yamlargocd/config/regional-cluster/maestro-server/values.yamlargocd/config/regional-cluster/platform-api/ta-templates/get_deployments.yamlargocd/config/regional-cluster/platform-api/ta-templates/get_pods.yamlargocd/config/regional-cluster/platform-api/ta-templates/get_resource.yamlargocd/config/regional-cluster/platform-api/templates/deployment.yamlargocd/config/regional-cluster/platform-api/templates/hyperfleet-db-dsn-externalsecret.yamlargocd/config/regional-cluster/platform-api/templates/rbac.yamlargocd/config/regional-cluster/platform-api/templates/zoa-job-config-configmap.yamlargocd/config/regional-cluster/platform-api/values.yamlci/e2e-platform-api-test.shci/e2e-tests.shconfig/defaults.yamlconfig/ephemeral/defaults.yamlconfig/templates/argocd-bootstrap/applicationset.yaml.j2config/templates/pipeline-regional-cluster-inputs/terraform.json.j2deploy/ephemeral/us-east-1/_merged_config.yamldeploy/ephemeral/us-east-1/argocd-bootstrap-management-cluster/applicationset.yamldeploy/ephemeral/us-east-1/argocd-bootstrap-regional-cluster/applicationset.yamldeploy/ephemeral/us-east-1/argocd-values-regional-cluster.yamldeploy/ephemeral/us-east-1/pipeline-regional-cluster-inputs/terraform.jsondeploy/integration/us-east-1/_merged_config.yamldeploy/integration/us-east-1/argocd-bootstrap-management-cluster/applicationset.yamldeploy/integration/us-east-1/argocd-bootstrap-regional-cluster/applicationset.yamldeploy/integration/us-east-1/argocd-values-regional-cluster.yamldeploy/integration/us-east-1/pipeline-regional-cluster-inputs/terraform.jsondocs/design/pipeline-based-lifecycle.mddocs/experiments/hyperfleet-operator-design.mdscripts/bootstrap-argocd.shscripts/buildspec/iot-mint.shscripts/buildspec/provision-infra-mc.shscripts/buildspec/provision-kube-applier-dynamodb.shscripts/buildspec/register.shscripts/cleanup-maestro-agent-iot.shscripts/dev/collect-cluster-logs.shscripts/dev/ephemeral-env.shscripts/dev/int-env.shscripts/pipeline-common/lib.shscripts/provision-maestro-agent-iot-regional.shterraform/config/kube-applier-dynamodb-provisioning/backend.tfterraform/config/kube-applier-dynamodb-provisioning/main.tfterraform/config/kube-applier-dynamodb-provisioning/outputs.tfterraform/config/kube-applier-dynamodb-provisioning/variables.tfterraform/config/maestro-agent-iot-provisioning/main.tfterraform/config/maestro-agent-iot-provisioning/outputs.tfterraform/config/maestro-agent-iot-provisioning/terraform.tfvars.exampleterraform/config/maestro-agent-iot-provisioning/variables.tfterraform/config/management-cluster/main.tfterraform/config/management-cluster/outputs.tfterraform/config/management-cluster/variables.tfterraform/config/pipeline-management-cluster/buildspec-iot-mint.ymlterraform/config/pipeline-management-cluster/buildspec-provision-kube-applier-dynamodb.ymlterraform/config/pipeline-management-cluster/main.tfterraform/config/regional-cluster/imports.shterraform/config/regional-cluster/main.tfterraform/config/regional-cluster/outputs.tfterraform/config/regional-cluster/variables.tfterraform/modules/ecs-bootstrap/main.tfterraform/modules/ecs-bootstrap/variables.tfterraform/modules/eks-cluster-workerless/main.tfterraform/modules/eks-cluster-workerless/outputs.tfterraform/modules/eks-cluster-workerless/variables.tfterraform/modules/eks-cluster/variables.tfterraform/modules/hyperfleet-db/main.tfterraform/modules/hyperfleet-db/outputs.tfterraform/modules/hyperfleet-db/variables.tfterraform/modules/hyperfleet-db/versions.tfterraform/modules/hyperfleet-infrastructure/README.mdterraform/modules/hyperfleet-infrastructure/amazonmq.tfterraform/modules/hyperfleet-infrastructure/iam.tfterraform/modules/hyperfleet-infrastructure/locals.tfterraform/modules/hyperfleet-infrastructure/outputs.tfterraform/modules/hyperfleet-infrastructure/rds.tfterraform/modules/hyperfleet-infrastructure/secrets.tfterraform/modules/hyperfleet-infrastructure/variables.tfterraform/modules/kube-applier-dynamodb/README.mdterraform/modules/kube-applier-dynamodb/iam.tfterraform/modules/kube-applier-dynamodb/main.tfterraform/modules/kube-applier-dynamodb/outputs.tfterraform/modules/kube-applier-dynamodb/variables.tfterraform/modules/kube-applier-dynamodb/versions.tfterraform/modules/kube-applier/README.mdterraform/modules/kube-applier/iam.tfterraform/modules/kube-applier/main.tfterraform/modules/kube-applier/outputs.tfterraform/modules/kube-applier/variables.tfterraform/modules/kube-applier/versions.tfterraform/modules/maestro-agent-iot-provisioning/main.tfterraform/modules/maestro-agent-iot-provisioning/outputs.tfterraform/modules/maestro-agent-iot-provisioning/variables.tfterraform/modules/maestro-agent-iot-provisioning/versions.tfterraform/modules/maestro-agent/README.mdterraform/modules/maestro-agent/iam.tfterraform/modules/maestro-agent/main.tfterraform/modules/maestro-agent/outputs.tfterraform/modules/maestro-agent/variables.tfterraform/modules/maestro-infrastructure/README.mdterraform/modules/maestro-infrastructure/iam.tfterraform/modules/maestro-infrastructure/iot.tfterraform/modules/maestro-infrastructure/main.tfterraform/modules/maestro-infrastructure/outputs.tfterraform/modules/maestro-infrastructure/rds.tfterraform/modules/maestro-infrastructure/secrets.tfterraform/modules/maestro-infrastructure/variables.tfterraform/modules/maestro-infrastructure/versions.tf
💤 Files with no reviewable changes (82)
- argocd/config/management-cluster/maestro-agent/Chart.yaml
- terraform/modules/maestro-agent/README.md
- argocd/config/regional-cluster/hyperfleet-api-chart/.helmignore
- argocd/config/management-cluster/maestro-agent/templates/clusterrolebinding.yaml
- argocd/config/management-cluster/maestro-agent/templates/secretproviderclass.yaml
- argocd/config/regional-cluster/hyperfleet-api-chart/templates/application.yaml
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/.helmignore
- terraform/modules/hyperfleet-infrastructure/README.md
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/application.yaml
- argocd/config/management-cluster/maestro-agent/.helmignore
- terraform/config/maestro-agent-iot-provisioning/variables.tf
- terraform/config/maestro-agent-iot-provisioning/terraform.tfvars.example
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/secretproviderclass.yaml
- terraform/config/maestro-agent-iot-provisioning/outputs.tf
- argocd/config/management-cluster/maestro-agent/values.yaml
- argocd/config/regional-cluster/hyperfleet-api-chart/values.yaml
- terraform/modules/maestro-agent/outputs.tf
- terraform/modules/maestro-agent-iot-provisioning/main.tf
- terraform/modules/maestro-infrastructure/main.tf
- terraform/modules/maestro-agent-iot-provisioning/versions.tf
- terraform/modules/hyperfleet-infrastructure/secrets.tf
- terraform/modules/hyperfleet-infrastructure/locals.tf
- terraform/modules/maestro-agent/main.tf
- argocd/config/regional-cluster/hyperfleet-sentinel-chart/templates/secretproviderclass.yaml
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/adapter-config.yaml
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/README.md
- argocd/config/regional-cluster/cluster-cleanup/Chart.yaml
- argocd/config/regional-cluster/hyperfleet-api-chart/templates/secretproviderclass.yaml
- terraform/modules/maestro-infrastructure/iot.tf
- argocd/config/regional-cluster/maestro-server/Chart.yaml
- terraform/config/maestro-agent-iot-provisioning/main.tf
- terraform/config/management-cluster/variables.tf
- terraform/modules/maestro-infrastructure/iam.tf
- terraform/modules/maestro-agent/iam.tf
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/manifestwork.yaml
- argocd/config/regional-cluster/maestro-server/templates/services.yaml
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/configmap-task.yaml
- argocd/config/management-cluster/maestro-agent/templates/rolebinding-extension-apiserver.yaml
- argocd/config/regional-cluster/cluster-cleanup/templates/cronjob.yaml
- argocd/config/regional-cluster/maestro-server/templates/deployment.yaml
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/Chart.yaml
- terraform/config/pipeline-management-cluster/buildspec-iot-mint.yml
- terraform/modules/maestro-agent-iot-provisioning/outputs.tf
- terraform/modules/maestro-infrastructure/outputs.tf
- argocd/config/management-cluster/maestro-agent/templates/role-extension-apiserver.yaml
- argocd/config/regional-cluster/maestro-server/.helmignore
- argocd/config/regional-cluster/hyperfleet-sentinel-chart/templates/application.yaml
- terraform/modules/maestro-infrastructure/versions.tf
- argocd/config/management-cluster/maestro-agent/templates/_helpers.tpl
- scripts/cleanup-maestro-agent-iot.sh
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/values.yaml
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/adapter-task-config.yaml
- argocd/config/regional-cluster/hyperfleet-sentinel-chart/Chart.yaml
- terraform/modules/hyperfleet-infrastructure/iam.tf
- argocd/config/regional-cluster/maestro-server/values.yaml
- argocd/config/management-cluster/maestro-agent/templates/clusterrole.yaml
- argocd/config/management-cluster/maestro-agent/templates/namespace.yaml
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/_helpers.tpl
- argocd/config/regional-cluster/maestro-server/templates/_helpers.tpl
- terraform/modules/hyperfleet-infrastructure/amazonmq.tf
- scripts/provision-maestro-agent-iot-regional.sh
- argocd/config/regional-cluster/maestro-server/templates/namespace.yaml
- argocd/config/regional-cluster/hyperfleet-sentinel-chart/values.yaml
- argocd/config/regional-cluster/maestro-server/templates/serviceaccount.yaml
- scripts/buildspec/iot-mint.sh
- argocd/config/management-cluster/maestro-agent/templates/deployment.yaml
- terraform/modules/maestro-agent-iot-provisioning/variables.tf
- argocd/config/management-cluster/maestro-agent/crds/appliedmanifestworks.yaml
- terraform/modules/maestro-agent/variables.tf
- argocd/config/regional-cluster/cluster-cleanup/values.yaml
- terraform/modules/maestro-infrastructure/secrets.tf
- terraform/modules/hyperfleet-infrastructure/outputs.tf
- argocd/config/regional-cluster/cloudwatch-exporter/values.yaml
- argocd/config/regional-cluster/cluster-cleanup/templates/rbac.yaml
- terraform/config/regional-cluster/imports.sh
- terraform/modules/maestro-infrastructure/rds.tf
- terraform/modules/maestro-infrastructure/README.md
- argocd/config/regional-cluster/hyperfleet-sentinel-chart/.helmignore
- terraform/modules/hyperfleet-infrastructure/variables.tf
- terraform/modules/maestro-infrastructure/variables.tf
- argocd/config/regional-cluster/maestro-server/templates/secretproviderclass.yaml
- terraform/modules/hyperfleet-infrastructure/rds.tf
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
terraform/modules/hyperfleet-db/main.tf (2)
193-239: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low valueConsider enabling IAM database authentication.
Static analysis flags that
iam_database_authentication_enabledis unset. Enabling it lets operator/platform-api authenticate with short-lived IAM tokens rather than relying solely on the long-lived master password, tightening the DB security posture.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@terraform/modules/hyperfleet-db/main.tf` around lines 193 - 239, Enable IAM database authentication in the aws_db_instance.hyperfleet_db resource by setting iam_database_authentication_enabled to true, alongside the existing authentication settings.Source: Linters/SAST tools
35-42: 🔒 Security & Privacy | 🔵 Trivial | ⚖️ Poor tradeoffRestrict DB ingress to consumer security groups instead of the whole VPC CIDR.
Opening 5432 to the entire
var.vpc_cidrgrants every workload in the VPC network reachability to the database. Prefer sourcing from the specific consumer security group(s) (operator/platform-api) viareferenced_security_group_idto follow least-privilege networking.As per path instructions: "Validate security group rules follow least-privilege networking."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@terraform/modules/hyperfleet-db/main.tf` around lines 35 - 42, The aws_vpc_security_group_ingress_rule.hyperfleet_db_postgres rule broadly permits PostgreSQL access from the entire VPC CIDR; replace cidr_ipv4 with referenced_security_group_id entries for the specific consumer security groups, such as operator and platform-api, while preserving the existing port and protocol settings.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@terraform/modules/hyperfleet-db/main.tf`:
- Line 83: Update the kms:ViaService condition in the hyperfleet DB KMS policy
to use data.aws_region.current.region instead of the deprecated
data.aws_region.current.name, preserving the existing RDS service string.
---
Nitpick comments:
In `@terraform/modules/hyperfleet-db/main.tf`:
- Around line 193-239: Enable IAM database authentication in the
aws_db_instance.hyperfleet_db resource by setting
iam_database_authentication_enabled to true, alongside the existing
authentication settings.
- Around line 35-42: The
aws_vpc_security_group_ingress_rule.hyperfleet_db_postgres rule broadly permits
PostgreSQL access from the entire VPC CIDR; replace cidr_ipv4 with
referenced_security_group_id entries for the specific consumer security groups,
such as operator and platform-api, while preserving the existing port and
protocol settings.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 4cdbd0e6-6ce2-4544-80a2-10a6011fd7f2
📒 Files selected for processing (168)
.coderabbit.yamlargocd/config/management-cluster/kube-applier/Chart.yamlargocd/config/management-cluster/kube-applier/templates/_helpers.tplargocd/config/management-cluster/kube-applier/templates/clusterrole.yamlargocd/config/management-cluster/kube-applier/templates/clusterrolebinding.yamlargocd/config/management-cluster/kube-applier/templates/deployment.yamlargocd/config/management-cluster/kube-applier/templates/namespace.yamlargocd/config/management-cluster/kube-applier/templates/service.yamlargocd/config/management-cluster/kube-applier/templates/serviceaccount.yamlargocd/config/management-cluster/kube-applier/templates/servicemonitor.yamlargocd/config/management-cluster/kube-applier/values.yamlargocd/config/management-cluster/maestro-agent/.helmignoreargocd/config/management-cluster/maestro-agent/Chart.yamlargocd/config/management-cluster/maestro-agent/crds/appliedmanifestworks.yamlargocd/config/management-cluster/maestro-agent/templates/_helpers.tplargocd/config/management-cluster/maestro-agent/templates/clusterrole.yamlargocd/config/management-cluster/maestro-agent/templates/clusterrolebinding.yamlargocd/config/management-cluster/maestro-agent/templates/deployment.yamlargocd/config/management-cluster/maestro-agent/templates/namespace.yamlargocd/config/management-cluster/maestro-agent/templates/role-extension-apiserver.yamlargocd/config/management-cluster/maestro-agent/templates/rolebinding-extension-apiserver.yamlargocd/config/management-cluster/maestro-agent/templates/secretproviderclass.yamlargocd/config/management-cluster/maestro-agent/values.yamlargocd/config/regional-cluster/cloudwatch-exporter/values.yamlargocd/config/regional-cluster/cluster-cleanup/Chart.yamlargocd/config/regional-cluster/cluster-cleanup/templates/cronjob.yamlargocd/config/regional-cluster/cluster-cleanup/templates/rbac.yamlargocd/config/regional-cluster/cluster-cleanup/values.yamlargocd/config/regional-cluster/external-secrets-config/templates/hyperfleet-db-dsn.yamlargocd/config/regional-cluster/grafana/dashboards/infrastructure/clm.jsonargocd/config/regional-cluster/grafana/dashboards/infrastructure/platform-services.jsonargocd/config/regional-cluster/grafana/dashboards/mc/mc-health.jsonargocd/config/regional-cluster/grafana/dashboards/rc/rc-health.jsonargocd/config/regional-cluster/hyperfleet-adapter1-chart/.helmignoreargocd/config/regional-cluster/hyperfleet-adapter1-chart/Chart.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/README.mdargocd/config/regional-cluster/hyperfleet-adapter1-chart/adapter-config.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/adapter-task-config.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/manifestwork.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/_helpers.tplargocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/application.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/configmap-task.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/secretproviderclass.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/values.yamlargocd/config/regional-cluster/hyperfleet-api-chart/.helmignoreargocd/config/regional-cluster/hyperfleet-api-chart/templates/application.yamlargocd/config/regional-cluster/hyperfleet-api-chart/templates/secretproviderclass.yamlargocd/config/regional-cluster/hyperfleet-api-chart/values.yamlargocd/config/regional-cluster/hyperfleet-sentinel-chart/.helmignoreargocd/config/regional-cluster/hyperfleet-sentinel-chart/Chart.yamlargocd/config/regional-cluster/hyperfleet-sentinel-chart/templates/application.yamlargocd/config/regional-cluster/hyperfleet-sentinel-chart/templates/secretproviderclass.yamlargocd/config/regional-cluster/hyperfleet-sentinel-chart/values.yamlargocd/config/regional-cluster/hyperfleet/Chart.yamlargocd/config/regional-cluster/hyperfleet/templates/_helpers.tplargocd/config/regional-cluster/hyperfleet/templates/application.yamlargocd/config/regional-cluster/hyperfleet/values.yamlargocd/config/regional-cluster/maestro-server/.helmignoreargocd/config/regional-cluster/maestro-server/Chart.yamlargocd/config/regional-cluster/maestro-server/templates/_helpers.tplargocd/config/regional-cluster/maestro-server/templates/deployment.yamlargocd/config/regional-cluster/maestro-server/templates/namespace.yamlargocd/config/regional-cluster/maestro-server/templates/secretproviderclass.yamlargocd/config/regional-cluster/maestro-server/templates/serviceaccount.yamlargocd/config/regional-cluster/maestro-server/templates/services.yamlargocd/config/regional-cluster/maestro-server/values.yamlargocd/config/regional-cluster/platform-api/ta-templates/get_deployments.yamlargocd/config/regional-cluster/platform-api/ta-templates/get_pods.yamlargocd/config/regional-cluster/platform-api/ta-templates/get_resource.yamlargocd/config/regional-cluster/platform-api/templates/deployment.yamlargocd/config/regional-cluster/platform-api/templates/hyperfleet-db-dsn-externalsecret.yamlargocd/config/regional-cluster/platform-api/templates/rbac.yamlargocd/config/regional-cluster/platform-api/templates/zoa-job-config-configmap.yamlargocd/config/regional-cluster/platform-api/values.yamlci/e2e-platform-api-test.shci/e2e-tests.shconfig/defaults.yamlconfig/ephemeral/defaults.yamlconfig/templates/argocd-bootstrap/applicationset.yaml.j2config/templates/pipeline-regional-cluster-inputs/terraform.json.j2deploy/ephemeral/us-east-1/_merged_config.yamldeploy/ephemeral/us-east-1/argocd-bootstrap-management-cluster/applicationset.yamldeploy/ephemeral/us-east-1/argocd-bootstrap-regional-cluster/applicationset.yamldeploy/ephemeral/us-east-1/argocd-values-regional-cluster.yamldeploy/ephemeral/us-east-1/pipeline-regional-cluster-inputs/terraform.jsondeploy/integration/us-east-1/_merged_config.yamldeploy/integration/us-east-1/argocd-bootstrap-management-cluster/applicationset.yamldeploy/integration/us-east-1/argocd-bootstrap-regional-cluster/applicationset.yamldeploy/integration/us-east-1/argocd-values-regional-cluster.yamldeploy/integration/us-east-1/pipeline-regional-cluster-inputs/terraform.jsondocs/design/pipeline-based-lifecycle.mdscripts/bootstrap-argocd.shscripts/buildspec/iot-mint.shscripts/buildspec/provision-infra-mc.shscripts/buildspec/provision-kube-applier-dynamodb.shscripts/buildspec/register.shscripts/cleanup-maestro-agent-iot.shscripts/dev/collect-cluster-logs.shscripts/dev/ephemeral-env.shscripts/dev/int-env.shscripts/pipeline-common/lib.shscripts/provision-maestro-agent-iot-regional.shterraform/config/kube-applier-dynamodb-provisioning/backend.tfterraform/config/kube-applier-dynamodb-provisioning/main.tfterraform/config/kube-applier-dynamodb-provisioning/outputs.tfterraform/config/kube-applier-dynamodb-provisioning/variables.tfterraform/config/maestro-agent-iot-provisioning/main.tfterraform/config/maestro-agent-iot-provisioning/outputs.tfterraform/config/maestro-agent-iot-provisioning/terraform.tfvars.exampleterraform/config/maestro-agent-iot-provisioning/variables.tfterraform/config/management-cluster/main.tfterraform/config/management-cluster/outputs.tfterraform/config/management-cluster/variables.tfterraform/config/pipeline-management-cluster/buildspec-iot-mint.ymlterraform/config/pipeline-management-cluster/buildspec-provision-kube-applier-dynamodb.ymlterraform/config/pipeline-management-cluster/main.tfterraform/config/regional-cluster/imports.shterraform/config/regional-cluster/main.tfterraform/config/regional-cluster/outputs.tfterraform/config/regional-cluster/variables.tfterraform/modules/ecs-bootstrap/main.tfterraform/modules/ecs-bootstrap/variables.tfterraform/modules/eks-cluster-workerless/main.tfterraform/modules/eks-cluster-workerless/outputs.tfterraform/modules/eks-cluster-workerless/variables.tfterraform/modules/eks-cluster/variables.tfterraform/modules/hyperfleet-db/main.tfterraform/modules/hyperfleet-db/outputs.tfterraform/modules/hyperfleet-db/variables.tfterraform/modules/hyperfleet-db/versions.tfterraform/modules/hyperfleet-infrastructure/README.mdterraform/modules/hyperfleet-infrastructure/amazonmq.tfterraform/modules/hyperfleet-infrastructure/iam.tfterraform/modules/hyperfleet-infrastructure/locals.tfterraform/modules/hyperfleet-infrastructure/outputs.tfterraform/modules/hyperfleet-infrastructure/rds.tfterraform/modules/hyperfleet-infrastructure/secrets.tfterraform/modules/hyperfleet-infrastructure/variables.tfterraform/modules/kube-applier-dynamodb/README.mdterraform/modules/kube-applier-dynamodb/iam.tfterraform/modules/kube-applier-dynamodb/main.tfterraform/modules/kube-applier-dynamodb/outputs.tfterraform/modules/kube-applier-dynamodb/variables.tfterraform/modules/kube-applier-dynamodb/versions.tfterraform/modules/kube-applier/README.mdterraform/modules/kube-applier/iam.tfterraform/modules/kube-applier/main.tfterraform/modules/kube-applier/outputs.tfterraform/modules/kube-applier/variables.tfterraform/modules/kube-applier/versions.tfterraform/modules/maestro-agent-iot-provisioning/main.tfterraform/modules/maestro-agent-iot-provisioning/outputs.tfterraform/modules/maestro-agent-iot-provisioning/variables.tfterraform/modules/maestro-agent-iot-provisioning/versions.tfterraform/modules/maestro-agent/README.mdterraform/modules/maestro-agent/iam.tfterraform/modules/maestro-agent/main.tfterraform/modules/maestro-agent/outputs.tfterraform/modules/maestro-agent/variables.tfterraform/modules/maestro-infrastructure/README.mdterraform/modules/maestro-infrastructure/iam.tfterraform/modules/maestro-infrastructure/iot.tfterraform/modules/maestro-infrastructure/main.tfterraform/modules/maestro-infrastructure/outputs.tfterraform/modules/maestro-infrastructure/rds.tfterraform/modules/maestro-infrastructure/secrets.tfterraform/modules/maestro-infrastructure/variables.tfterraform/modules/maestro-infrastructure/versions.tf
💤 Files with no reviewable changes (82)
- argocd/config/management-cluster/maestro-agent/.helmignore
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/README.md
- terraform/config/pipeline-management-cluster/buildspec-iot-mint.yml
- terraform/modules/hyperfleet-infrastructure/locals.tf
- terraform/modules/maestro-agent/outputs.tf
- argocd/config/regional-cluster/maestro-server/.helmignore
- argocd/config/regional-cluster/maestro-server/templates/namespace.yaml
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/.helmignore
- terraform/modules/maestro-agent-iot-provisioning/versions.tf
- argocd/config/regional-cluster/hyperfleet-api-chart/templates/application.yaml
- argocd/config/management-cluster/maestro-agent/templates/namespace.yaml
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/Chart.yaml
- argocd/config/management-cluster/maestro-agent/templates/role-extension-apiserver.yaml
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/adapter-task-config.yaml
- argocd/config/management-cluster/maestro-agent/values.yaml
- argocd/config/regional-cluster/hyperfleet-api-chart/.helmignore
- terraform/modules/maestro-agent-iot-provisioning/outputs.tf
- terraform/modules/hyperfleet-infrastructure/README.md
- terraform/config/maestro-agent-iot-provisioning/terraform.tfvars.example
- terraform/config/maestro-agent-iot-provisioning/outputs.tf
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/adapter-config.yaml
- terraform/modules/maestro-agent/iam.tf
- argocd/config/management-cluster/maestro-agent/templates/deployment.yaml
- argocd/config/management-cluster/maestro-agent/templates/clusterrolebinding.yaml
- argocd/config/management-cluster/maestro-agent/Chart.yaml
- argocd/config/regional-cluster/hyperfleet-api-chart/values.yaml
- terraform/modules/maestro-infrastructure/README.md
- terraform/modules/maestro-agent/README.md
- argocd/config/management-cluster/maestro-agent/templates/rolebinding-extension-apiserver.yaml
- terraform/modules/hyperfleet-infrastructure/secrets.tf
- terraform/modules/maestro-infrastructure/main.tf
- argocd/config/regional-cluster/hyperfleet-sentinel-chart/values.yaml
- argocd/config/management-cluster/maestro-agent/templates/clusterrole.yaml
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/configmap-task.yaml
- argocd/config/regional-cluster/hyperfleet-api-chart/templates/secretproviderclass.yaml
- argocd/config/regional-cluster/maestro-server/templates/secretproviderclass.yaml
- terraform/modules/maestro-infrastructure/iam.tf
- terraform/modules/maestro-agent-iot-provisioning/variables.tf
- argocd/config/management-cluster/maestro-agent/templates/_helpers.tpl
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/values.yaml
- argocd/config/regional-cluster/maestro-server/templates/_helpers.tpl
- terraform/modules/hyperfleet-infrastructure/iam.tf
- argocd/config/regional-cluster/maestro-server/templates/serviceaccount.yaml
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/secretproviderclass.yaml
- terraform/modules/maestro-infrastructure/outputs.tf
- argocd/config/management-cluster/maestro-agent/templates/secretproviderclass.yaml
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/manifestwork.yaml
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/_helpers.tpl
- terraform/config/maestro-agent-iot-provisioning/variables.tf
- argocd/config/regional-cluster/cluster-cleanup/templates/cronjob.yaml
- scripts/cleanup-maestro-agent-iot.sh
- terraform/modules/maestro-agent-iot-provisioning/main.tf
- terraform/modules/hyperfleet-infrastructure/rds.tf
- argocd/config/regional-cluster/maestro-server/templates/deployment.yaml
- argocd/config/regional-cluster/cloudwatch-exporter/values.yaml
- argocd/config/regional-cluster/hyperfleet-sentinel-chart/templates/secretproviderclass.yaml
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/application.yaml
- argocd/config/regional-cluster/cluster-cleanup/values.yaml
- terraform/modules/hyperfleet-infrastructure/outputs.tf
- argocd/config/regional-cluster/cluster-cleanup/Chart.yaml
- argocd/config/regional-cluster/hyperfleet-sentinel-chart/Chart.yaml
- argocd/config/regional-cluster/maestro-server/values.yaml
- argocd/config/regional-cluster/maestro-server/Chart.yaml
- argocd/config/regional-cluster/hyperfleet-sentinel-chart/.helmignore
- scripts/buildspec/iot-mint.sh
- terraform/modules/maestro-infrastructure/versions.tf
- terraform/config/regional-cluster/imports.sh
- scripts/provision-maestro-agent-iot-regional.sh
- terraform/config/maestro-agent-iot-provisioning/main.tf
- terraform/modules/hyperfleet-infrastructure/variables.tf
- terraform/modules/maestro-agent/main.tf
- argocd/config/regional-cluster/hyperfleet-sentinel-chart/templates/application.yaml
- terraform/modules/maestro-agent/variables.tf
- argocd/config/management-cluster/maestro-agent/crds/appliedmanifestworks.yaml
- terraform/modules/maestro-infrastructure/iot.tf
- terraform/config/management-cluster/variables.tf
- terraform/modules/maestro-infrastructure/variables.tf
- terraform/modules/hyperfleet-infrastructure/amazonmq.tf
- terraform/modules/maestro-infrastructure/rds.tf
- terraform/modules/maestro-infrastructure/secrets.tf
- argocd/config/regional-cluster/maestro-server/templates/services.yaml
- argocd/config/regional-cluster/cluster-cleanup/templates/rbac.yaml
✅ Files skipped from review due to trivial changes (16)
- argocd/config/regional-cluster/platform-api/ta-templates/get_pods.yaml
- argocd/config/management-cluster/kube-applier/values.yaml
- terraform/modules/kube-applier-dynamodb/iam.tf
- terraform/modules/eks-cluster-workerless/variables.tf
- argocd/config/regional-cluster/hyperfleet/Chart.yaml
- argocd/config/regional-cluster/platform-api/ta-templates/get_deployments.yaml
- terraform/modules/kube-applier/versions.tf
- argocd/config/regional-cluster/platform-api/ta-templates/get_resource.yaml
- ci/e2e-tests.sh
- terraform/modules/kube-applier-dynamodb/README.md
- deploy/integration/us-east-1/argocd-bootstrap-regional-cluster/applicationset.yaml
- argocd/config/regional-cluster/grafana/dashboards/infrastructure/clm.json
- argocd/config/regional-cluster/hyperfleet/templates/_helpers.tpl
- docs/design/pipeline-based-lifecycle.md
- .coderabbit.yaml
- terraform/modules/kube-applier/README.md
🚧 Files skipped from review as they are similar to previous changes (53)
- terraform/modules/kube-applier/outputs.tf
- terraform/config/kube-applier-dynamodb-provisioning/outputs.tf
- argocd/config/regional-cluster/platform-api/templates/zoa-job-config-configmap.yaml
- terraform/modules/kube-applier-dynamodb/versions.tf
- deploy/ephemeral/us-east-1/argocd-bootstrap-regional-cluster/applicationset.yaml
- terraform/modules/eks-cluster-workerless/outputs.tf
- argocd/config/regional-cluster/hyperfleet/values.yaml
- terraform/modules/hyperfleet-db/versions.tf
- terraform/config/pipeline-management-cluster/buildspec-provision-kube-applier-dynamodb.yml
- scripts/bootstrap-argocd.sh
- argocd/config/management-cluster/kube-applier/Chart.yaml
- argocd/config/regional-cluster/grafana/dashboards/rc/rc-health.json
- config/templates/pipeline-regional-cluster-inputs/terraform.json.j2
- terraform/modules/kube-applier/variables.tf
- config/ephemeral/defaults.yaml
- deploy/ephemeral/us-east-1/argocd-bootstrap-management-cluster/applicationset.yaml
- config/templates/argocd-bootstrap/applicationset.yaml.j2
- deploy/ephemeral/us-east-1/argocd-values-regional-cluster.yaml
- terraform/modules/kube-applier-dynamodb/variables.tf
- terraform/config/kube-applier-dynamodb-provisioning/variables.tf
- argocd/config/regional-cluster/platform-api/templates/deployment.yaml
- terraform/modules/kube-applier-dynamodb/outputs.tf
- scripts/buildspec/register.sh
- argocd/config/management-cluster/kube-applier/templates/_helpers.tpl
- deploy/integration/us-east-1/argocd-bootstrap-management-cluster/applicationset.yaml
- terraform/modules/ecs-bootstrap/variables.tf
- deploy/integration/us-east-1/argocd-values-regional-cluster.yaml
- config/defaults.yaml
- terraform/modules/eks-cluster/variables.tf
- terraform/modules/kube-applier-dynamodb/main.tf
- terraform/modules/kube-applier/main.tf
- terraform/modules/ecs-bootstrap/main.tf
- argocd/config/regional-cluster/grafana/dashboards/infrastructure/platform-services.json
- deploy/integration/us-east-1/_merged_config.yaml
- deploy/integration/us-east-1/pipeline-regional-cluster-inputs/terraform.json
- terraform/modules/hyperfleet-db/outputs.tf
- terraform/config/management-cluster/outputs.tf
- argocd/config/regional-cluster/platform-api/values.yaml
- deploy/ephemeral/us-east-1/_merged_config.yaml
- terraform/config/management-cluster/main.tf
- ci/e2e-platform-api-test.sh
- argocd/config/regional-cluster/grafana/dashboards/mc/mc-health.json
- scripts/dev/collect-cluster-logs.sh
- terraform/modules/hyperfleet-db/variables.tf
- terraform/config/kube-applier-dynamodb-provisioning/main.tf
- scripts/dev/int-env.sh
- terraform/modules/eks-cluster-workerless/main.tf
- terraform/config/regional-cluster/outputs.tf
- terraform/modules/kube-applier/iam.tf
- scripts/pipeline-common/lib.sh
- scripts/dev/ephemeral-env.sh
- terraform/config/pipeline-management-cluster/main.tf
- terraform/config/regional-cluster/variables.tf
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
argocd/config/management-cluster/kube-applier/templates/deployment.yaml (1)
25-27: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winContainer-level securityContext still missing (readOnlyRootFilesystem, capabilities, privilege escalation).
This was already flagged in a previous review round and Trivy (KSV-0014) still reports it: no
securityContextis set on thekube-appliercontainer itself — only pod-levelrunAsNonRoot/seccompProfileis present. Recommend addingreadOnlyRootFilesystem: true,allowPrivilegeEscalation: false, and dropping all capabilities.🔒 Proposed fix
- name: kube-applier image: "{{ .Values.kubeApplier.image.registry }}/{{ .Values.kubeApplier.image.repository }}:{{ .Values.kubeApplier.image.tag }}" imagePullPolicy: {{ .Values.kubeApplier.image.pullPolicy }} + securityContext: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] args:Also applies to: 72-75
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@argocd/config/management-cluster/kube-applier/templates/deployment.yaml` around lines 25 - 27, Add a container-level securityContext to the kube-applier container definition, and apply the same change to the additional matching container block: set readOnlyRootFilesystem to true, allowPrivilegeEscalation to false, and drop all Linux capabilities. Keep the existing pod-level security settings unchanged.
🧹 Nitpick comments (1)
argocd/config/management-cluster/kube-applier/templates/service.yaml (1)
13-21: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winService ports hardcoded independently of
deployment.yamlconfig values.
port: 8081/port: 8083are literals, whiledeployment.yamlderives the corresponding container ports from.Values.kubeApplier.config.metricsListenAddress/healthzListenAddress. SincetargetPortuses named ports, health checks/scraping won't break immediately, but the Service's external port can silently drift from config if those values are changed.♻️ Proposed fix
ports: - name: metrics - port: 8081 + port: {{ trimPrefix ":" .Values.kubeApplier.config.metricsListenAddress | int }} targetPort: metrics protocol: TCP - name: healthz - port: 8083 + port: {{ trimPrefix ":" .Values.kubeApplier.config.healthzListenAddress | int }} targetPort: healthz protocol: TCP🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@argocd/config/management-cluster/kube-applier/templates/service.yaml` around lines 13 - 21, Update the Service ports in the kube-applier service template to derive their values from the same `.Values.kubeApplier.config.metricsListenAddress` and `.Values.kubeApplier.config.healthzListenAddress` settings used by the deployment, extracting the numeric port as needed while preserving the named `targetPort` values.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@argocd/config/management-cluster/kube-applier/templates/clusterrole.yaml`:
- Around line 15-18: Reduce the broad permissions in the kube-applier
ClusterRole by replacing the wildcard apiGroups/resources rule with an explicit
allowlist of resources required by ApplyDesire, DeleteDesire, and ReadDesire.
Keep only necessary verbs, and place any genuinely privileged resources such as
RBAC objects or Secrets in a separate narrowly scoped role rather than granting
them by default.
In `@scripts/buildspec/provision-kube-applier-dynamodb.sh`:
- Line 74: Split the TF_VAR_enable_pitr assignment from its export in the
provisioning script: first assign the parseBool result to TF_VAR_enable_pitr,
then export it in a separate command. Ensure parseBool failures are surfaced and
cause the script to stop according to the script’s existing error-handling
settings.
---
Duplicate comments:
In `@argocd/config/management-cluster/kube-applier/templates/deployment.yaml`:
- Around line 25-27: Add a container-level securityContext to the kube-applier
container definition, and apply the same change to the additional matching
container block: set readOnlyRootFilesystem to true, allowPrivilegeEscalation to
false, and drop all Linux capabilities. Keep the existing pod-level security
settings unchanged.
---
Nitpick comments:
In `@argocd/config/management-cluster/kube-applier/templates/service.yaml`:
- Around line 13-21: Update the Service ports in the kube-applier service
template to derive their values from the same
`.Values.kubeApplier.config.metricsListenAddress` and
`.Values.kubeApplier.config.healthzListenAddress` settings used by the
deployment, extracting the numeric port as needed while preserving the named
`targetPort` values.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 784d43b6-7210-49dd-9f6a-ebcbfb0cb07f
📒 Files selected for processing (168)
.coderabbit.yamlargocd/config/management-cluster/kube-applier/Chart.yamlargocd/config/management-cluster/kube-applier/templates/_helpers.tplargocd/config/management-cluster/kube-applier/templates/clusterrole.yamlargocd/config/management-cluster/kube-applier/templates/clusterrolebinding.yamlargocd/config/management-cluster/kube-applier/templates/deployment.yamlargocd/config/management-cluster/kube-applier/templates/namespace.yamlargocd/config/management-cluster/kube-applier/templates/service.yamlargocd/config/management-cluster/kube-applier/templates/serviceaccount.yamlargocd/config/management-cluster/kube-applier/templates/servicemonitor.yamlargocd/config/management-cluster/kube-applier/values.yamlargocd/config/management-cluster/maestro-agent/.helmignoreargocd/config/management-cluster/maestro-agent/Chart.yamlargocd/config/management-cluster/maestro-agent/crds/appliedmanifestworks.yamlargocd/config/management-cluster/maestro-agent/templates/_helpers.tplargocd/config/management-cluster/maestro-agent/templates/clusterrole.yamlargocd/config/management-cluster/maestro-agent/templates/clusterrolebinding.yamlargocd/config/management-cluster/maestro-agent/templates/deployment.yamlargocd/config/management-cluster/maestro-agent/templates/namespace.yamlargocd/config/management-cluster/maestro-agent/templates/role-extension-apiserver.yamlargocd/config/management-cluster/maestro-agent/templates/rolebinding-extension-apiserver.yamlargocd/config/management-cluster/maestro-agent/templates/secretproviderclass.yamlargocd/config/management-cluster/maestro-agent/values.yamlargocd/config/regional-cluster/cloudwatch-exporter/values.yamlargocd/config/regional-cluster/cluster-cleanup/Chart.yamlargocd/config/regional-cluster/cluster-cleanup/templates/cronjob.yamlargocd/config/regional-cluster/cluster-cleanup/templates/rbac.yamlargocd/config/regional-cluster/cluster-cleanup/values.yamlargocd/config/regional-cluster/external-secrets-config/templates/hyperfleet-db-dsn.yamlargocd/config/regional-cluster/grafana/dashboards/infrastructure/clm.jsonargocd/config/regional-cluster/grafana/dashboards/infrastructure/platform-services.jsonargocd/config/regional-cluster/grafana/dashboards/mc/mc-health.jsonargocd/config/regional-cluster/grafana/dashboards/rc/rc-health.jsonargocd/config/regional-cluster/hyperfleet-adapter1-chart/.helmignoreargocd/config/regional-cluster/hyperfleet-adapter1-chart/Chart.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/README.mdargocd/config/regional-cluster/hyperfleet-adapter1-chart/adapter-config.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/adapter-task-config.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/manifestwork.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/_helpers.tplargocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/application.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/configmap-task.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/secretproviderclass.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/values.yamlargocd/config/regional-cluster/hyperfleet-api-chart/.helmignoreargocd/config/regional-cluster/hyperfleet-api-chart/templates/application.yamlargocd/config/regional-cluster/hyperfleet-api-chart/templates/secretproviderclass.yamlargocd/config/regional-cluster/hyperfleet-api-chart/values.yamlargocd/config/regional-cluster/hyperfleet-sentinel-chart/.helmignoreargocd/config/regional-cluster/hyperfleet-sentinel-chart/Chart.yamlargocd/config/regional-cluster/hyperfleet-sentinel-chart/templates/application.yamlargocd/config/regional-cluster/hyperfleet-sentinel-chart/templates/secretproviderclass.yamlargocd/config/regional-cluster/hyperfleet-sentinel-chart/values.yamlargocd/config/regional-cluster/hyperfleet/Chart.yamlargocd/config/regional-cluster/hyperfleet/templates/_helpers.tplargocd/config/regional-cluster/hyperfleet/templates/application.yamlargocd/config/regional-cluster/hyperfleet/values.yamlargocd/config/regional-cluster/maestro-server/.helmignoreargocd/config/regional-cluster/maestro-server/Chart.yamlargocd/config/regional-cluster/maestro-server/templates/_helpers.tplargocd/config/regional-cluster/maestro-server/templates/deployment.yamlargocd/config/regional-cluster/maestro-server/templates/namespace.yamlargocd/config/regional-cluster/maestro-server/templates/secretproviderclass.yamlargocd/config/regional-cluster/maestro-server/templates/serviceaccount.yamlargocd/config/regional-cluster/maestro-server/templates/services.yamlargocd/config/regional-cluster/maestro-server/values.yamlargocd/config/regional-cluster/platform-api/ta-templates/get_deployments.yamlargocd/config/regional-cluster/platform-api/ta-templates/get_pods.yamlargocd/config/regional-cluster/platform-api/ta-templates/get_resource.yamlargocd/config/regional-cluster/platform-api/templates/deployment.yamlargocd/config/regional-cluster/platform-api/templates/hyperfleet-db-dsn-externalsecret.yamlargocd/config/regional-cluster/platform-api/templates/rbac.yamlargocd/config/regional-cluster/platform-api/templates/zoa-job-config-configmap.yamlargocd/config/regional-cluster/platform-api/values.yamlci/e2e-platform-api-test.shci/e2e-tests.shconfig/defaults.yamlconfig/ephemeral/defaults.yamlconfig/templates/argocd-bootstrap/applicationset.yaml.j2config/templates/pipeline-regional-cluster-inputs/terraform.json.j2deploy/ephemeral/us-east-1/_merged_config.yamldeploy/ephemeral/us-east-1/argocd-bootstrap-management-cluster/applicationset.yamldeploy/ephemeral/us-east-1/argocd-bootstrap-regional-cluster/applicationset.yamldeploy/ephemeral/us-east-1/argocd-values-regional-cluster.yamldeploy/ephemeral/us-east-1/pipeline-regional-cluster-inputs/terraform.jsondeploy/integration/us-east-1/_merged_config.yamldeploy/integration/us-east-1/argocd-bootstrap-management-cluster/applicationset.yamldeploy/integration/us-east-1/argocd-bootstrap-regional-cluster/applicationset.yamldeploy/integration/us-east-1/argocd-values-regional-cluster.yamldeploy/integration/us-east-1/pipeline-regional-cluster-inputs/terraform.jsondocs/design/pipeline-based-lifecycle.mdscripts/bootstrap-argocd.shscripts/buildspec/iot-mint.shscripts/buildspec/provision-infra-mc.shscripts/buildspec/provision-kube-applier-dynamodb.shscripts/buildspec/register.shscripts/cleanup-maestro-agent-iot.shscripts/dev/collect-cluster-logs.shscripts/dev/ephemeral-env.shscripts/dev/int-env.shscripts/pipeline-common/lib.shscripts/provision-maestro-agent-iot-regional.shterraform/config/kube-applier-dynamodb-provisioning/backend.tfterraform/config/kube-applier-dynamodb-provisioning/main.tfterraform/config/kube-applier-dynamodb-provisioning/outputs.tfterraform/config/kube-applier-dynamodb-provisioning/variables.tfterraform/config/maestro-agent-iot-provisioning/main.tfterraform/config/maestro-agent-iot-provisioning/outputs.tfterraform/config/maestro-agent-iot-provisioning/terraform.tfvars.exampleterraform/config/maestro-agent-iot-provisioning/variables.tfterraform/config/management-cluster/main.tfterraform/config/management-cluster/outputs.tfterraform/config/management-cluster/variables.tfterraform/config/pipeline-management-cluster/buildspec-iot-mint.ymlterraform/config/pipeline-management-cluster/buildspec-provision-kube-applier-dynamodb.ymlterraform/config/pipeline-management-cluster/main.tfterraform/config/regional-cluster/imports.shterraform/config/regional-cluster/main.tfterraform/config/regional-cluster/outputs.tfterraform/config/regional-cluster/variables.tfterraform/modules/ecs-bootstrap/main.tfterraform/modules/ecs-bootstrap/variables.tfterraform/modules/eks-cluster-workerless/main.tfterraform/modules/eks-cluster-workerless/outputs.tfterraform/modules/eks-cluster-workerless/variables.tfterraform/modules/eks-cluster/variables.tfterraform/modules/hyperfleet-db/main.tfterraform/modules/hyperfleet-db/outputs.tfterraform/modules/hyperfleet-db/variables.tfterraform/modules/hyperfleet-db/versions.tfterraform/modules/hyperfleet-infrastructure/README.mdterraform/modules/hyperfleet-infrastructure/amazonmq.tfterraform/modules/hyperfleet-infrastructure/iam.tfterraform/modules/hyperfleet-infrastructure/locals.tfterraform/modules/hyperfleet-infrastructure/outputs.tfterraform/modules/hyperfleet-infrastructure/rds.tfterraform/modules/hyperfleet-infrastructure/secrets.tfterraform/modules/hyperfleet-infrastructure/variables.tfterraform/modules/kube-applier-dynamodb/README.mdterraform/modules/kube-applier-dynamodb/iam.tfterraform/modules/kube-applier-dynamodb/main.tfterraform/modules/kube-applier-dynamodb/outputs.tfterraform/modules/kube-applier-dynamodb/variables.tfterraform/modules/kube-applier-dynamodb/versions.tfterraform/modules/kube-applier/README.mdterraform/modules/kube-applier/iam.tfterraform/modules/kube-applier/main.tfterraform/modules/kube-applier/outputs.tfterraform/modules/kube-applier/variables.tfterraform/modules/kube-applier/versions.tfterraform/modules/maestro-agent-iot-provisioning/main.tfterraform/modules/maestro-agent-iot-provisioning/outputs.tfterraform/modules/maestro-agent-iot-provisioning/variables.tfterraform/modules/maestro-agent-iot-provisioning/versions.tfterraform/modules/maestro-agent/README.mdterraform/modules/maestro-agent/iam.tfterraform/modules/maestro-agent/main.tfterraform/modules/maestro-agent/outputs.tfterraform/modules/maestro-agent/variables.tfterraform/modules/maestro-infrastructure/README.mdterraform/modules/maestro-infrastructure/iam.tfterraform/modules/maestro-infrastructure/iot.tfterraform/modules/maestro-infrastructure/main.tfterraform/modules/maestro-infrastructure/outputs.tfterraform/modules/maestro-infrastructure/rds.tfterraform/modules/maestro-infrastructure/secrets.tfterraform/modules/maestro-infrastructure/variables.tfterraform/modules/maestro-infrastructure/versions.tf
💤 Files with no reviewable changes (82)
- terraform/modules/maestro-infrastructure/README.md
- terraform/modules/maestro-agent/README.md
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/README.md
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/configmap-task.yaml
- terraform/modules/hyperfleet-infrastructure/README.md
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/values.yaml
- argocd/config/management-cluster/maestro-agent/templates/secretproviderclass.yaml
- argocd/config/management-cluster/maestro-agent/templates/rolebinding-extension-apiserver.yaml
- argocd/config/regional-cluster/hyperfleet-api-chart/.helmignore
- argocd/config/management-cluster/maestro-agent/.helmignore
- argocd/config/regional-cluster/maestro-server/.helmignore
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/secretproviderclass.yaml
- argocd/config/management-cluster/maestro-agent/templates/deployment.yaml
- argocd/config/regional-cluster/maestro-server/templates/serviceaccount.yaml
- argocd/config/management-cluster/maestro-agent/templates/clusterrolebinding.yaml
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/adapter-config.yaml
- terraform/modules/hyperfleet-infrastructure/secrets.tf
- argocd/config/management-cluster/maestro-agent/templates/namespace.yaml
- argocd/config/management-cluster/maestro-agent/templates/clusterrole.yaml
- terraform/modules/maestro-infrastructure/versions.tf
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/.helmignore
- terraform/modules/maestro-agent/outputs.tf
- argocd/config/regional-cluster/cluster-cleanup/Chart.yaml
- argocd/config/management-cluster/maestro-agent/Chart.yaml
- argocd/config/regional-cluster/maestro-server/templates/namespace.yaml
- terraform/config/regional-cluster/imports.sh
- argocd/config/regional-cluster/cluster-cleanup/values.yaml
- terraform/modules/hyperfleet-infrastructure/rds.tf
- argocd/config/regional-cluster/hyperfleet-sentinel-chart/.helmignore
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/Chart.yaml
- terraform/modules/maestro-infrastructure/iot.tf
- argocd/config/regional-cluster/hyperfleet-api-chart/templates/secretproviderclass.yaml
- terraform/config/pipeline-management-cluster/buildspec-iot-mint.yml
- terraform/modules/maestro-agent-iot-provisioning/main.tf
- argocd/config/regional-cluster/hyperfleet-sentinel-chart/templates/secretproviderclass.yaml
- scripts/buildspec/iot-mint.sh
- argocd/config/regional-cluster/maestro-server/templates/secretproviderclass.yaml
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/manifestwork.yaml
- argocd/config/management-cluster/maestro-agent/values.yaml
- terraform/config/maestro-agent-iot-provisioning/outputs.tf
- terraform/modules/maestro-agent-iot-provisioning/outputs.tf
- argocd/config/management-cluster/maestro-agent/crds/appliedmanifestworks.yaml
- terraform/modules/maestro-infrastructure/outputs.tf
- argocd/config/regional-cluster/maestro-server/Chart.yaml
- terraform/modules/hyperfleet-infrastructure/amazonmq.tf
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/application.yaml
- argocd/config/regional-cluster/hyperfleet-api-chart/values.yaml
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/_helpers.tpl
- argocd/config/management-cluster/maestro-agent/templates/role-extension-apiserver.yaml
- terraform/modules/hyperfleet-infrastructure/locals.tf
- argocd/config/regional-cluster/maestro-server/values.yaml
- terraform/config/maestro-agent-iot-provisioning/terraform.tfvars.example
- argocd/config/regional-cluster/hyperfleet-api-chart/templates/application.yaml
- terraform/config/maestro-agent-iot-provisioning/variables.tf
- terraform/modules/maestro-agent/variables.tf
- terraform/modules/maestro-infrastructure/variables.tf
- argocd/config/regional-cluster/cluster-cleanup/templates/rbac.yaml
- terraform/modules/hyperfleet-infrastructure/iam.tf
- argocd/config/regional-cluster/maestro-server/templates/services.yaml
- terraform/modules/maestro-agent-iot-provisioning/variables.tf
- argocd/config/regional-cluster/cluster-cleanup/templates/cronjob.yaml
- terraform/modules/maestro-agent-iot-provisioning/versions.tf
- terraform/config/maestro-agent-iot-provisioning/main.tf
- terraform/modules/maestro-infrastructure/main.tf
- terraform/modules/maestro-infrastructure/iam.tf
- argocd/config/management-cluster/maestro-agent/templates/_helpers.tpl
- argocd/config/regional-cluster/maestro-server/templates/deployment.yaml
- argocd/config/regional-cluster/maestro-server/templates/_helpers.tpl
- terraform/modules/maestro-agent/iam.tf
- terraform/modules/hyperfleet-infrastructure/variables.tf
- terraform/modules/maestro-agent/main.tf
- argocd/config/regional-cluster/hyperfleet-sentinel-chart/Chart.yaml
- terraform/modules/maestro-infrastructure/secrets.tf
- argocd/config/regional-cluster/cloudwatch-exporter/values.yaml
- terraform/modules/hyperfleet-infrastructure/outputs.tf
- argocd/config/regional-cluster/hyperfleet-sentinel-chart/values.yaml
- terraform/modules/maestro-infrastructure/rds.tf
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/adapter-task-config.yaml
- terraform/config/management-cluster/variables.tf
- scripts/provision-maestro-agent-iot-regional.sh
- scripts/cleanup-maestro-agent-iot.sh
- argocd/config/regional-cluster/hyperfleet-sentinel-chart/templates/application.yaml
✅ Files skipped from review due to trivial changes (15)
- argocd/config/regional-cluster/platform-api/ta-templates/get_pods.yaml
- argocd/config/management-cluster/kube-applier/values.yaml
- argocd/config/management-cluster/kube-applier/Chart.yaml
- argocd/config/regional-cluster/platform-api/ta-templates/get_deployments.yaml
- ci/e2e-tests.sh
- terraform/modules/kube-applier-dynamodb/iam.tf
- docs/design/pipeline-based-lifecycle.md
- argocd/config/regional-cluster/platform-api/ta-templates/get_resource.yaml
- terraform/modules/hyperfleet-db/versions.tf
- argocd/config/regional-cluster/hyperfleet/Chart.yaml
- terraform/modules/kube-applier/README.md
- .coderabbit.yaml
- terraform/modules/kube-applier/versions.tf
- argocd/config/regional-cluster/grafana/dashboards/infrastructure/clm.json
- argocd/config/regional-cluster/grafana/dashboards/mc/mc-health.json
🚧 Files skipped from review as they are similar to previous changes (57)
- scripts/buildspec/register.sh
- terraform/modules/kube-applier/main.tf
- terraform/modules/kube-applier-dynamodb/README.md
- argocd/config/regional-cluster/platform-api/values.yaml
- deploy/integration/us-east-1/pipeline-regional-cluster-inputs/terraform.json
- terraform/modules/eks-cluster-workerless/outputs.tf
- terraform/config/pipeline-management-cluster/buildspec-provision-kube-applier-dynamodb.yml
- terraform/modules/ecs-bootstrap/variables.tf
- terraform/config/kube-applier-dynamodb-provisioning/outputs.tf
- deploy/ephemeral/us-east-1/pipeline-regional-cluster-inputs/terraform.json
- terraform/modules/eks-cluster/variables.tf
- terraform/modules/kube-applier-dynamodb/variables.tf
- terraform/modules/hyperfleet-db/outputs.tf
- terraform/modules/kube-applier/outputs.tf
- terraform/modules/eks-cluster-workerless/variables.tf
- deploy/integration/us-east-1/argocd-bootstrap-regional-cluster/applicationset.yaml
- argocd/config/management-cluster/kube-applier/templates/_helpers.tpl
- argocd/config/regional-cluster/hyperfleet/values.yaml
- config/templates/pipeline-regional-cluster-inputs/terraform.json.j2
- terraform/modules/hyperfleet-db/variables.tf
- config/ephemeral/defaults.yaml
- deploy/integration/us-east-1/argocd-bootstrap-management-cluster/applicationset.yaml
- config/templates/argocd-bootstrap/applicationset.yaml.j2
- argocd/config/regional-cluster/platform-api/templates/deployment.yaml
- terraform/modules/kube-applier-dynamodb/outputs.tf
- terraform/config/kube-applier-dynamodb-provisioning/variables.tf
- scripts/pipeline-common/lib.sh
- argocd/config/regional-cluster/grafana/dashboards/rc/rc-health.json
- terraform/modules/kube-applier-dynamodb/main.tf
- config/defaults.yaml
- terraform/modules/ecs-bootstrap/main.tf
- scripts/dev/int-env.sh
- deploy/integration/us-east-1/argocd-values-regional-cluster.yaml
- argocd/config/regional-cluster/grafana/dashboards/infrastructure/platform-services.json
- argocd/config/regional-cluster/hyperfleet/templates/_helpers.tpl
- argocd/config/regional-cluster/platform-api/templates/zoa-job-config-configmap.yaml
- terraform/modules/kube-applier-dynamodb/versions.tf
- deploy/ephemeral/us-east-1/argocd-values-regional-cluster.yaml
- deploy/ephemeral/us-east-1/_merged_config.yaml
- terraform/modules/kube-applier/iam.tf
- terraform/modules/kube-applier/variables.tf
- terraform/config/kube-applier-dynamodb-provisioning/main.tf
- deploy/ephemeral/us-east-1/argocd-bootstrap-management-cluster/applicationset.yaml
- terraform/modules/eks-cluster-workerless/main.tf
- terraform/config/management-cluster/main.tf
- deploy/integration/us-east-1/_merged_config.yaml
- terraform/config/management-cluster/outputs.tf
- scripts/bootstrap-argocd.sh
- deploy/ephemeral/us-east-1/argocd-bootstrap-regional-cluster/applicationset.yaml
- terraform/config/regional-cluster/main.tf
- terraform/config/regional-cluster/variables.tf
- ci/e2e-platform-api-test.sh
- scripts/dev/ephemeral-env.sh
- scripts/buildspec/provision-infra-mc.sh
- scripts/dev/collect-cluster-logs.sh
- terraform/config/regional-cluster/outputs.tf
- terraform/config/pipeline-management-cluster/main.tf
…DynamoDB) Replace the Maestro-based MC communication stack with kube-applier-aws backed by DynamoDB, and replace the fleet-db EKS cluster with a FleetStore RDS instance (hyperfleet-db). This consolidates the data plane onto AWS-native services with simpler operations. Key changes: Infrastructure: - Add kube-applier DynamoDB module with resource-based policies for cross-account MC access and DynamoDB Streams - Add hyperfleet-db RDS module (PostgreSQL) replacing the fleet-db EKS cluster - Add kube-applier IAM module for MC pod identity - Add workerless EKS cluster module - Remove Maestro infrastructure (IoT, AmazonMQ, RDS, IAM) - Remove hyperfleet-infrastructure module ArgoCD / Helm: - Add kube-applier Helm chart for management clusters - Add hyperfleet operator chart (regional cluster) - Remove maestro-agent, maestro-server, and hyperfleet-sentinel/adapter/api charts - Remove cluster-cleanup chart - Rename fleetstore references to hyperfleet-db/postgres-dsn - Add ExternalSecrets for hyperfleet-db DSN distribution - Update platform-api with POSTGRES_DSN, BUCKET_COUNT, and RBAC Pipeline: - Add kube-applier DynamoDB provisioning buildspec - Remove IoT mint and Maestro agent provisioning scripts - Update MC provisioning and registration scripts Config: - Update ephemeral and integration environment configs - Update rendered ApplicationSets and Terraform configs Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/buildspec/provision-kube-applier-dynamodb.sh`:
- Around line 38-46: _RC_STATE_BUCKET is initialized only in the apply branch
but later exported unconditionally, causing destroy runs to fail with set -u.
Move the _RC_STATE_BUCKET assignment (and any required state identifiers)
outside the apply-only block so it is available before the unconditional
TF_STATE_BUCKET export, while keeping terraform init gated to apply.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 373e2d07-0dc7-497e-811c-83b39b750f53
📒 Files selected for processing (168)
.coderabbit.yamlargocd/config/management-cluster/kube-applier/Chart.yamlargocd/config/management-cluster/kube-applier/templates/_helpers.tplargocd/config/management-cluster/kube-applier/templates/clusterrole.yamlargocd/config/management-cluster/kube-applier/templates/clusterrolebinding.yamlargocd/config/management-cluster/kube-applier/templates/deployment.yamlargocd/config/management-cluster/kube-applier/templates/namespace.yamlargocd/config/management-cluster/kube-applier/templates/service.yamlargocd/config/management-cluster/kube-applier/templates/serviceaccount.yamlargocd/config/management-cluster/kube-applier/templates/servicemonitor.yamlargocd/config/management-cluster/kube-applier/values.yamlargocd/config/management-cluster/maestro-agent/.helmignoreargocd/config/management-cluster/maestro-agent/Chart.yamlargocd/config/management-cluster/maestro-agent/crds/appliedmanifestworks.yamlargocd/config/management-cluster/maestro-agent/templates/_helpers.tplargocd/config/management-cluster/maestro-agent/templates/clusterrole.yamlargocd/config/management-cluster/maestro-agent/templates/clusterrolebinding.yamlargocd/config/management-cluster/maestro-agent/templates/deployment.yamlargocd/config/management-cluster/maestro-agent/templates/namespace.yamlargocd/config/management-cluster/maestro-agent/templates/role-extension-apiserver.yamlargocd/config/management-cluster/maestro-agent/templates/rolebinding-extension-apiserver.yamlargocd/config/management-cluster/maestro-agent/templates/secretproviderclass.yamlargocd/config/management-cluster/maestro-agent/values.yamlargocd/config/regional-cluster/cloudwatch-exporter/values.yamlargocd/config/regional-cluster/cluster-cleanup/Chart.yamlargocd/config/regional-cluster/cluster-cleanup/templates/cronjob.yamlargocd/config/regional-cluster/cluster-cleanup/templates/rbac.yamlargocd/config/regional-cluster/cluster-cleanup/values.yamlargocd/config/regional-cluster/external-secrets-config/templates/hyperfleet-db-dsn.yamlargocd/config/regional-cluster/grafana/dashboards/infrastructure/clm.jsonargocd/config/regional-cluster/grafana/dashboards/infrastructure/platform-services.jsonargocd/config/regional-cluster/grafana/dashboards/mc/mc-health.jsonargocd/config/regional-cluster/grafana/dashboards/rc/rc-health.jsonargocd/config/regional-cluster/hyperfleet-adapter1-chart/.helmignoreargocd/config/regional-cluster/hyperfleet-adapter1-chart/Chart.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/README.mdargocd/config/regional-cluster/hyperfleet-adapter1-chart/adapter-config.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/adapter-task-config.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/manifestwork.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/_helpers.tplargocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/application.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/configmap-task.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/secretproviderclass.yamlargocd/config/regional-cluster/hyperfleet-adapter1-chart/values.yamlargocd/config/regional-cluster/hyperfleet-api-chart/.helmignoreargocd/config/regional-cluster/hyperfleet-api-chart/templates/application.yamlargocd/config/regional-cluster/hyperfleet-api-chart/templates/secretproviderclass.yamlargocd/config/regional-cluster/hyperfleet-api-chart/values.yamlargocd/config/regional-cluster/hyperfleet-sentinel-chart/.helmignoreargocd/config/regional-cluster/hyperfleet-sentinel-chart/Chart.yamlargocd/config/regional-cluster/hyperfleet-sentinel-chart/templates/application.yamlargocd/config/regional-cluster/hyperfleet-sentinel-chart/templates/secretproviderclass.yamlargocd/config/regional-cluster/hyperfleet-sentinel-chart/values.yamlargocd/config/regional-cluster/hyperfleet/Chart.yamlargocd/config/regional-cluster/hyperfleet/templates/_helpers.tplargocd/config/regional-cluster/hyperfleet/templates/application.yamlargocd/config/regional-cluster/hyperfleet/values.yamlargocd/config/regional-cluster/maestro-server/.helmignoreargocd/config/regional-cluster/maestro-server/Chart.yamlargocd/config/regional-cluster/maestro-server/templates/_helpers.tplargocd/config/regional-cluster/maestro-server/templates/deployment.yamlargocd/config/regional-cluster/maestro-server/templates/namespace.yamlargocd/config/regional-cluster/maestro-server/templates/secretproviderclass.yamlargocd/config/regional-cluster/maestro-server/templates/serviceaccount.yamlargocd/config/regional-cluster/maestro-server/templates/services.yamlargocd/config/regional-cluster/maestro-server/values.yamlargocd/config/regional-cluster/platform-api/ta-templates/get_deployments.yamlargocd/config/regional-cluster/platform-api/ta-templates/get_pods.yamlargocd/config/regional-cluster/platform-api/ta-templates/get_resource.yamlargocd/config/regional-cluster/platform-api/templates/deployment.yamlargocd/config/regional-cluster/platform-api/templates/hyperfleet-db-dsn-externalsecret.yamlargocd/config/regional-cluster/platform-api/templates/rbac.yamlargocd/config/regional-cluster/platform-api/templates/zoa-job-config-configmap.yamlargocd/config/regional-cluster/platform-api/values.yamlci/e2e-platform-api-test.shci/e2e-tests.shconfig/defaults.yamlconfig/ephemeral/defaults.yamlconfig/templates/argocd-bootstrap/applicationset.yaml.j2config/templates/pipeline-regional-cluster-inputs/terraform.json.j2deploy/ephemeral/us-east-1/_merged_config.yamldeploy/ephemeral/us-east-1/argocd-bootstrap-management-cluster/applicationset.yamldeploy/ephemeral/us-east-1/argocd-bootstrap-regional-cluster/applicationset.yamldeploy/ephemeral/us-east-1/argocd-values-regional-cluster.yamldeploy/ephemeral/us-east-1/pipeline-regional-cluster-inputs/terraform.jsondeploy/integration/us-east-1/_merged_config.yamldeploy/integration/us-east-1/argocd-bootstrap-management-cluster/applicationset.yamldeploy/integration/us-east-1/argocd-bootstrap-regional-cluster/applicationset.yamldeploy/integration/us-east-1/argocd-values-regional-cluster.yamldeploy/integration/us-east-1/pipeline-regional-cluster-inputs/terraform.jsondocs/design/pipeline-based-lifecycle.mdscripts/bootstrap-argocd.shscripts/buildspec/iot-mint.shscripts/buildspec/provision-infra-mc.shscripts/buildspec/provision-kube-applier-dynamodb.shscripts/buildspec/register.shscripts/cleanup-maestro-agent-iot.shscripts/dev/collect-cluster-logs.shscripts/dev/ephemeral-env.shscripts/dev/int-env.shscripts/pipeline-common/lib.shscripts/provision-maestro-agent-iot-regional.shterraform/config/kube-applier-dynamodb-provisioning/backend.tfterraform/config/kube-applier-dynamodb-provisioning/main.tfterraform/config/kube-applier-dynamodb-provisioning/outputs.tfterraform/config/kube-applier-dynamodb-provisioning/variables.tfterraform/config/maestro-agent-iot-provisioning/main.tfterraform/config/maestro-agent-iot-provisioning/outputs.tfterraform/config/maestro-agent-iot-provisioning/terraform.tfvars.exampleterraform/config/maestro-agent-iot-provisioning/variables.tfterraform/config/management-cluster/main.tfterraform/config/management-cluster/outputs.tfterraform/config/management-cluster/variables.tfterraform/config/pipeline-management-cluster/buildspec-iot-mint.ymlterraform/config/pipeline-management-cluster/buildspec-provision-kube-applier-dynamodb.ymlterraform/config/pipeline-management-cluster/main.tfterraform/config/regional-cluster/imports.shterraform/config/regional-cluster/main.tfterraform/config/regional-cluster/outputs.tfterraform/config/regional-cluster/variables.tfterraform/modules/ecs-bootstrap/main.tfterraform/modules/ecs-bootstrap/variables.tfterraform/modules/eks-cluster-workerless/main.tfterraform/modules/eks-cluster-workerless/outputs.tfterraform/modules/eks-cluster-workerless/variables.tfterraform/modules/eks-cluster/variables.tfterraform/modules/hyperfleet-db/main.tfterraform/modules/hyperfleet-db/outputs.tfterraform/modules/hyperfleet-db/variables.tfterraform/modules/hyperfleet-db/versions.tfterraform/modules/hyperfleet-infrastructure/README.mdterraform/modules/hyperfleet-infrastructure/amazonmq.tfterraform/modules/hyperfleet-infrastructure/iam.tfterraform/modules/hyperfleet-infrastructure/locals.tfterraform/modules/hyperfleet-infrastructure/outputs.tfterraform/modules/hyperfleet-infrastructure/rds.tfterraform/modules/hyperfleet-infrastructure/secrets.tfterraform/modules/hyperfleet-infrastructure/variables.tfterraform/modules/kube-applier-dynamodb/README.mdterraform/modules/kube-applier-dynamodb/iam.tfterraform/modules/kube-applier-dynamodb/main.tfterraform/modules/kube-applier-dynamodb/outputs.tfterraform/modules/kube-applier-dynamodb/variables.tfterraform/modules/kube-applier-dynamodb/versions.tfterraform/modules/kube-applier/README.mdterraform/modules/kube-applier/iam.tfterraform/modules/kube-applier/main.tfterraform/modules/kube-applier/outputs.tfterraform/modules/kube-applier/variables.tfterraform/modules/kube-applier/versions.tfterraform/modules/maestro-agent-iot-provisioning/main.tfterraform/modules/maestro-agent-iot-provisioning/outputs.tfterraform/modules/maestro-agent-iot-provisioning/variables.tfterraform/modules/maestro-agent-iot-provisioning/versions.tfterraform/modules/maestro-agent/README.mdterraform/modules/maestro-agent/iam.tfterraform/modules/maestro-agent/main.tfterraform/modules/maestro-agent/outputs.tfterraform/modules/maestro-agent/variables.tfterraform/modules/maestro-infrastructure/README.mdterraform/modules/maestro-infrastructure/iam.tfterraform/modules/maestro-infrastructure/iot.tfterraform/modules/maestro-infrastructure/main.tfterraform/modules/maestro-infrastructure/outputs.tfterraform/modules/maestro-infrastructure/rds.tfterraform/modules/maestro-infrastructure/secrets.tfterraform/modules/maestro-infrastructure/variables.tfterraform/modules/maestro-infrastructure/versions.tf
💤 Files with no reviewable changes (82)
- terraform/modules/maestro-agent/README.md
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/values.yaml
- argocd/config/regional-cluster/hyperfleet-sentinel-chart/Chart.yaml
- argocd/config/regional-cluster/maestro-server/.helmignore
- argocd/config/regional-cluster/hyperfleet-api-chart/.helmignore
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/.helmignore
- argocd/config/regional-cluster/hyperfleet-api-chart/templates/secretproviderclass.yaml
- terraform/config/maestro-agent-iot-provisioning/terraform.tfvars.example
- terraform/modules/hyperfleet-infrastructure/README.md
- argocd/config/management-cluster/maestro-agent/templates/secretproviderclass.yaml
- terraform/modules/hyperfleet-infrastructure/locals.tf
- argocd/config/regional-cluster/hyperfleet-api-chart/templates/application.yaml
- argocd/config/regional-cluster/cluster-cleanup/Chart.yaml
- argocd/config/management-cluster/maestro-agent/.helmignore
- argocd/config/regional-cluster/hyperfleet-sentinel-chart/.helmignore
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/configmap-task.yaml
- argocd/config/regional-cluster/maestro-server/templates/serviceaccount.yaml
- argocd/config/management-cluster/maestro-agent/templates/namespace.yaml
- terraform/modules/hyperfleet-infrastructure/secrets.tf
- argocd/config/management-cluster/maestro-agent/values.yaml
- terraform/config/maestro-agent-iot-provisioning/main.tf
- argocd/config/regional-cluster/maestro-server/templates/deployment.yaml
- terraform/modules/maestro-agent-iot-provisioning/main.tf
- argocd/config/management-cluster/maestro-agent/templates/rolebinding-extension-apiserver.yaml
- argocd/config/management-cluster/maestro-agent/Chart.yaml
- argocd/config/management-cluster/maestro-agent/templates/_helpers.tpl
- terraform/modules/maestro-infrastructure/iam.tf
- terraform/modules/maestro-agent/variables.tf
- scripts/cleanup-maestro-agent-iot.sh
- terraform/config/pipeline-management-cluster/buildspec-iot-mint.yml
- terraform/modules/maestro-infrastructure/versions.tf
- terraform/modules/maestro-infrastructure/outputs.tf
- argocd/config/regional-cluster/maestro-server/templates/_helpers.tpl
- terraform/modules/maestro-infrastructure/secrets.tf
- terraform/modules/maestro-agent-iot-provisioning/versions.tf
- argocd/config/regional-cluster/maestro-server/values.yaml
- argocd/config/regional-cluster/hyperfleet-sentinel-chart/templates/application.yaml
- terraform/modules/maestro-agent/outputs.tf
- argocd/config/regional-cluster/cluster-cleanup/templates/rbac.yaml
- argocd/config/regional-cluster/maestro-server/templates/namespace.yaml
- terraform/modules/maestro-infrastructure/main.tf
- argocd/config/regional-cluster/maestro-server/Chart.yaml
- terraform/config/maestro-agent-iot-provisioning/variables.tf
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/application.yaml
- argocd/config/regional-cluster/hyperfleet-sentinel-chart/templates/secretproviderclass.yaml
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/adapter-task-config.yaml
- terraform/config/maestro-agent-iot-provisioning/outputs.tf
- argocd/config/regional-cluster/maestro-server/templates/secretproviderclass.yaml
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/adapter-config.yaml
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/Chart.yaml
- terraform/modules/hyperfleet-infrastructure/rds.tf
- terraform/modules/hyperfleet-infrastructure/outputs.tf
- terraform/modules/hyperfleet-infrastructure/iam.tf
- argocd/config/regional-cluster/cluster-cleanup/values.yaml
- terraform/modules/maestro-infrastructure/README.md
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/_helpers.tpl
- scripts/provision-maestro-agent-iot-regional.sh
- argocd/config/management-cluster/maestro-agent/templates/deployment.yaml
- terraform/modules/maestro-agent-iot-provisioning/outputs.tf
- argocd/config/management-cluster/maestro-agent/templates/clusterrole.yaml
- argocd/config/regional-cluster/maestro-server/templates/services.yaml
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/manifestwork.yaml
- argocd/config/regional-cluster/hyperfleet-sentinel-chart/values.yaml
- argocd/config/management-cluster/maestro-agent/templates/clusterrolebinding.yaml
- terraform/modules/maestro-infrastructure/iot.tf
- terraform/modules/hyperfleet-infrastructure/amazonmq.tf
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/templates/secretproviderclass.yaml
- argocd/config/regional-cluster/hyperfleet-api-chart/values.yaml
- scripts/buildspec/iot-mint.sh
- argocd/config/management-cluster/maestro-agent/templates/role-extension-apiserver.yaml
- argocd/config/management-cluster/maestro-agent/crds/appliedmanifestworks.yaml
- terraform/modules/maestro-agent/iam.tf
- terraform/modules/hyperfleet-infrastructure/variables.tf
- terraform/config/regional-cluster/imports.sh
- terraform/modules/maestro-infrastructure/rds.tf
- terraform/modules/maestro-agent-iot-provisioning/variables.tf
- terraform/modules/maestro-agent/main.tf
- terraform/config/management-cluster/variables.tf
- argocd/config/regional-cluster/cloudwatch-exporter/values.yaml
- argocd/config/regional-cluster/cluster-cleanup/templates/cronjob.yaml
- argocd/config/regional-cluster/hyperfleet-adapter1-chart/README.md
- terraform/modules/maestro-infrastructure/variables.tf
✅ Files skipped from review due to trivial changes (21)
- argocd/config/regional-cluster/platform-api/ta-templates/get_resource.yaml
- terraform/modules/hyperfleet-db/versions.tf
- deploy/integration/us-east-1/argocd-values-regional-cluster.yaml
- terraform/modules/kube-applier/versions.tf
- argocd/config/management-cluster/kube-applier/Chart.yaml
- argocd/config/management-cluster/kube-applier/values.yaml
- terraform/modules/eks-cluster-workerless/variables.tf
- ci/e2e-tests.sh
- deploy/ephemeral/us-east-1/argocd-values-regional-cluster.yaml
- terraform/modules/kube-applier-dynamodb/iam.tf
- argocd/config/regional-cluster/platform-api/ta-templates/get_pods.yaml
- terraform/modules/eks-cluster-workerless/outputs.tf
- .coderabbit.yaml
- argocd/config/regional-cluster/platform-api/ta-templates/get_deployments.yaml
- argocd/config/management-cluster/kube-applier/templates/_helpers.tpl
- argocd/config/regional-cluster/hyperfleet/Chart.yaml
- terraform/modules/kube-applier-dynamodb/README.md
- argocd/config/regional-cluster/grafana/dashboards/infrastructure/clm.json
- docs/design/pipeline-based-lifecycle.md
- terraform/modules/kube-applier/README.md
- terraform/modules/kube-applier-dynamodb/variables.tf
🚧 Files skipped from review as they are similar to previous changes (50)
- scripts/bootstrap-argocd.sh
- terraform/modules/kube-applier/main.tf
- argocd/config/regional-cluster/grafana/dashboards/rc/rc-health.json
- argocd/config/regional-cluster/platform-api/templates/zoa-job-config-configmap.yaml
- terraform/modules/eks-cluster/variables.tf
- config/ephemeral/defaults.yaml
- terraform/config/pipeline-management-cluster/buildspec-provision-kube-applier-dynamodb.yml
- terraform/modules/kube-applier-dynamodb/versions.tf
- argocd/config/regional-cluster/platform-api/values.yaml
- terraform/modules/kube-applier/variables.tf
- terraform/modules/ecs-bootstrap/variables.tf
- terraform/modules/hyperfleet-db/variables.tf
- config/templates/pipeline-regional-cluster-inputs/terraform.json.j2
- deploy/ephemeral/us-east-1/argocd-bootstrap-regional-cluster/applicationset.yaml
- argocd/config/regional-cluster/hyperfleet/values.yaml
- deploy/ephemeral/us-east-1/_merged_config.yaml
- deploy/integration/us-east-1/pipeline-regional-cluster-inputs/terraform.json
- terraform/modules/kube-applier/outputs.tf
- scripts/dev/int-env.sh
- terraform/config/kube-applier-dynamodb-provisioning/outputs.tf
- terraform/modules/hyperfleet-db/outputs.tf
- terraform/config/kube-applier-dynamodb-provisioning/variables.tf
- config/defaults.yaml
- argocd/config/regional-cluster/grafana/dashboards/mc/mc-health.json
- deploy/ephemeral/us-east-1/argocd-bootstrap-management-cluster/applicationset.yaml
- argocd/config/regional-cluster/platform-api/templates/deployment.yaml
- terraform/modules/kube-applier-dynamodb/outputs.tf
- scripts/pipeline-common/lib.sh
- scripts/buildspec/provision-infra-mc.sh
- terraform/modules/kube-applier/iam.tf
- config/templates/argocd-bootstrap/applicationset.yaml.j2
- terraform/modules/kube-applier-dynamodb/main.tf
- deploy/ephemeral/us-east-1/pipeline-regional-cluster-inputs/terraform.json
- deploy/integration/us-east-1/_merged_config.yaml
- scripts/dev/collect-cluster-logs.sh
- argocd/config/regional-cluster/grafana/dashboards/infrastructure/platform-services.json
- terraform/modules/eks-cluster-workerless/main.tf
- deploy/integration/us-east-1/argocd-bootstrap-management-cluster/applicationset.yaml
- terraform/modules/ecs-bootstrap/main.tf
- terraform/config/regional-cluster/main.tf
- deploy/integration/us-east-1/argocd-bootstrap-regional-cluster/applicationset.yaml
- terraform/config/kube-applier-dynamodb-provisioning/main.tf
- terraform/config/management-cluster/main.tf
- terraform/config/management-cluster/outputs.tf
- terraform/config/regional-cluster/outputs.tf
- terraform/config/regional-cluster/variables.tf
- scripts/dev/ephemeral-env.sh
- ci/e2e-platform-api-test.sh
- terraform/modules/hyperfleet-db/main.tf
- terraform/config/pipeline-management-cluster/main.tf
Comment on lines
+38
to
+46
| if [ "${TERRAFORM_ACTION}" == "apply" ]; then | ||
| _RC_STATE_BUCKET="terraform-state-${RESOLVED_REGIONAL_ACCOUNT_ID}-${TARGET_REGION}" | ||
| _RC_STATE_KEY="regional-cluster/${_RC_REGIONAL_ID}.tfstate" | ||
| _RC_TF_DIR="terraform/config/regional-cluster" | ||
| (cd "$_RC_TF_DIR" && terraform init -reconfigure \ | ||
| -backend-config="bucket=${_RC_STATE_BUCKET}" \ | ||
| -backend-config="key=${_RC_STATE_KEY}" \ | ||
| -backend-config="region=${TARGET_REGION}" \ | ||
| -backend-config="use_lockfile=true" >/dev/null 2>&1) |
Contributor
There was a problem hiding this comment.
🩺 Stability & Availability | 🔴 Critical | ⚡ Quick win
Destroy path crashes: _RC_STATE_BUCKET unset outside the apply-only block.
_RC_STATE_BUCKET is only assigned inside the if [ "${TERRAFORM_ACTION}" == "apply" ] block (line 39), but it's referenced unconditionally at line 69 (export TF_STATE_BUCKET="${_RC_STATE_BUCKET}"). With set -u in effect, this causes an unbound-variable failure on every destroy run before terraform destroy can execute, breaking teardown entirely. This regression was introduced while fixing the previous gating issue.
🐛 Proposed fix
+# ── Compute RC state coordinates (needed for role poll + terraform state) ──
+_RC_STATE_BUCKET="terraform-state-${RESOLVED_REGIONAL_ACCOUNT_ID}-${TARGET_REGION}"
+
# ── Wait for hyperfleet-operator role (created by RC pipeline) ──────────────
# The MC Deploy stage already waited for RC OIDC outputs, so the RC pipeline
# should be done or nearly done. Poll briefly as a safety net.
# Only needed on apply — the destroy path doesn't require the role ARN.
if [ "${TERRAFORM_ACTION}" == "apply" ]; then
- _RC_STATE_BUCKET="terraform-state-${RESOLVED_REGIONAL_ACCOUNT_ID}-${TARGET_REGION}"
_RC_STATE_KEY="regional-cluster/${_RC_REGIONAL_ID}.tfstate"
_RC_TF_DIR="terraform/config/regional-cluster"Also applies to: 68-71
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/buildspec/provision-kube-applier-dynamodb.sh` around lines 38 - 46,
_RC_STATE_BUCKET is initialized only in the apply branch but later exported
unconditionally, causing destroy runs to fail with set -u. Move the
_RC_STATE_BUCKET assignment (and any required state identifiers) outside the
apply-only block so it is available before the unconditional TF_STATE_BUCKET
export, while keeping terraform init gated to apply.
|
@typeid: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replace the Maestro-based MC communication stack with kube-applier-aws backed by DynamoDB, and replace the hyperfleet stack with hyperfleet-operator backed by hyperfleet-db (RDS instance). This consolidates the data plane onto AWS-native services with simpler operations.
Changes
Infrastructure (Terraform)
kube-applier-dynamodbmodule — DynamoDB tables with resource-based policies for cross-account MC access, DynamoDB Streams enabledhyperfleet-dbmodule — PostgreSQL RDS instance replacing the fleet-db EKS clusterkube-applierIAM module for MC pod identityeks-cluster-workerlessmodulemaestro-infrastructure,maestro-agent,maestro-agent-iot-provisioning, andhyperfleet-infrastructuremodulesArgoCD / Helm Charts
kube-applierchart for management clustershyperfleetoperator chart for regional clustermaestro-agent,maestro-server,hyperfleet-sentinel-chart,hyperfleet-adapter1-chart,hyperfleet-api-chart, andcluster-cleanupchartshyperfleet-db/postgres-dsnPOSTGRES_DSN,BUCKET_COUNTenv vars, and RBACPipeline / Scripts
provision-kube-applier-dynamodb.shbuildspeciot-mint.sh) and Maestro agent provisioning scriptsConfig / Rendered
Test plan
POSTGRES_DSNandBUCKET_COUNTenv vars🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Updates
Bug Fixes