feat: extend tenant cloud provider orchestration - #65
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8f059c969c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const creds = aliyunCredentials((providerCredentials?.aliyun ?? providerCredentials?.alibaba_cloud) as JsonRecord | undefined); | ||
| const region = creds.region || defaults.aliyun_fc.region || "cn-hangzhou"; | ||
| const deployScript = process.env.MAPLE_ALIYUN_FC_RUNTIME_DEPLOY_SCRIPT || ""; | ||
| const configuredInvokeUrl = String(process.env.MAPLE_ALIYUN_FC_INVOKE_URL || defaults.aliyun_fc.invoke_url || ""); |
There was a problem hiding this comment.
When an Aliyun runtime pool is created without a server-wide deploy script, provisioning only reads MAPLE_ALIYUN_FC_INVOKE_URL/global defaults here and ignores the tenant/workspace values that the API/UI collect (for example provider_credentials.aliyun.ALIYUN_FC_INVOKE_URL or runtime_pools[].config.invoke_url). In that common per-workspace setup the request can be accepted, but every Aliyun runtime member fails with the “requires ... invoke URL” error, leaving the workspace without a usable agent runtime unless the whole control plane has a global FC endpoint configured.
Useful? React with 👍 / 👎.
| sandbox_id: config.function_name || config.invoke_url, | ||
| session_id: String(session.id) | ||
| }); | ||
| await invokeAliyunFc(runtime, "bootstrap", { |
There was a problem hiding this comment.
If acquireRuntime returns a pooled Aliyun sandbox, the member has already been marked claimed; when this bootstrap call fails due to a bad endpoint, auth error, or timeout, the exception path never marks that member failed or releases it. Repeated failed sessions therefore drain the ready Aliyun sandbox pool until TTL expiry, unlike the vefaas/docker pooled paths that mark claimed members failed on validation/startup errors.
Useful? React with 👍 / 👎.
| ["ALIYUN_ACCESS_KEY_ID", aliyunCreds.ALIYUN_ACCESS_KEY_ID ?? aliyunCreds.access_key_id ?? aliyunCreds.ak], | ||
| ["ALIYUN_ACCESS_KEY_SECRET", aliyunCreds.ALIYUN_ACCESS_KEY_SECRET ?? aliyunCreds.access_key_secret ?? aliyunCreds.sk], | ||
| ["ALIYUN_REGION", aliyunCreds.ALIYUN_REGION ?? aliyunCreds.region], | ||
| ["ALIYUN_FC_INVOKE_URL", aliyunSandboxConfig.invoke_url ?? aliyunCreds.ALIYUN_FC_INVOKE_URL] |
There was a problem hiding this comment.
The new sandbox_pools[].config is later used by sandboxPoolManager to build provider-specific sandbox config, but this preflight only accepts the FC endpoint from global sandbox_config or credentials. API callers that put invoke_url on the Aliyun sandbox pool itself (the schema allows this, and provisioning reads it) are rejected with provider_credentials_required, so multi-provider pool configuration is unnecessarily broken unless the same endpoint is duplicated in sandbox_config.
Useful? React with 👍 / 👎.
2 participants
Summary\n- Extend tenant cloud provider orchestration with Aliyun credential validation/offline contract support.\n- Reuse tenant cloud credentials across workspace runtime, sandbox, and object storage provisioning.\n- Update admin/onboarding UI provider states and add contract coverage for tenant cloud provider orchestration.\n\n## Verification\n- rtk bun run typecheck\n- rtk bun run lint\n- rtk bun run build\n- rtk bun tests/contracts/tenant_cloud_provider_contract.ts\n- rtk bun tests/contracts/volcengine_credential_validation_contract.ts\n- rtk bun tests/contracts/aliyun_provider_orchestration_contract.ts\n- rtk run -c 'E2E_SERVER_LOG=/tmp/openmaple-e2e-api.log E2E_ISOLATED=1 E2E_SANDBOX_PROVIDER=e2b MAPLE_SANDBOX_PROVIDER=e2b MAPLE_AGENT_RUNTIME_PROVIDER=local MAPLE_AGENT_LOOP_EXECUTION=provider bun tests/e2e/e2e.mjs'\n\nE2E: ok=true, stamp=1782153055486, session=sess_OJdR3Xgs8q.\n\n## Screenshots\n- /Users/bytedance/workspace/open-maple/test-results/pr-63-cloud-ui/tenant-cloud-provider-cards.png\n- /Users/bytedance/workspace/open-maple/test-results/pr-63-cloud-ui/volcengine-aksk-modal.png\n- /Users/bytedance/workspace/open-maple/test-results/pr-63-cloud-ui/onboarding-cloud-step.png\n- /Users/bytedance/workspace/open-maple/test-results/pr-63-cloud-ui/onboarding-runtime-no-aksk.png\n- /Users/bytedance/workspace/open-maple/test-results/pr-63-cloud-ui/onboarding-sandbox-providers.png\n- /Users/bytedance/workspace/open-maple/test-results/pr-63-cloud-ui/workspace-create-blocked-no-volcengine.png\n- /Users/bytedance/workspace/open-maple/test-results/pr-63-cloud-ui/workspace-create-connected-runtime.png\n- /Users/bytedance/workspace/open-maple/test-results/pr-63-cloud-ui/workspace-create-connected-sandbox.png