feat: add access_profile_id support to bifrost helm chart virtual key schema and helpers#3622
Conversation
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThis PR extends the governance virtual keys configuration in the Bifrost Helm chart to support an optional ChangesVirtual Keys Access Profile Support
🎯 2 (Simple) | ⏱️ ~8 minutes Possibly Related PRs
Suggested Reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
Warning This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
This stack of pull requests is managed by Graphite. Learn more about stacking. |
BearTS
changed the title
access_profile_id support to bifrost helm chart virtual key schema and helpers
Confidence Score: 5/5Safe to merge — changes are additive, confined to the Helm chart layer, and the new schema constraint correctly enforces mutual exclusivity. The change adds a single optional integer field to the virtual key configuration. The template follows the established conditional-field pattern, the JSON Schema No files require special attention. Important Files Changed
Reviews (4): Last reviewed commit: "feat: support for helm to assign vk on a..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@helm-charts/bifrost/templates/_helpers.tpl`:
- Line 466: The template currently checks truthiness with "if
.access_profile_id" which will skip valid zero values; change the presence check
to use hasKey so numeric zero isn't dropped: replace the conditional with
something like {{- if hasKey . "access_profile_id" }} and keep the set call {{-
$_ := set $vk "access_profile_id" .access_profile_id }} unchanged so the key is
set when the field exists even if it's 0.
In `@helm-charts/bifrost/values.schema.json`:
- Around line 1232-1243: The schema currently documents but does not enforce
that team_id, customer_id, and access_profile_id are mutually exclusive; add a
validation rule that disallows any pairwise combination by adding a "not" +
"anyOf" block at the same object schema level that contains these properties,
e.g. a "not": { "anyOf": [ { "required": ["team_id","customer_id"] }, {
"required": ["team_id","access_profile_id"] }, { "required":
["customer_id","access_profile_id"] } ] } to the object that defines team_id,
customer_id and access_profile_id so the validator rejects configs with more
than one of these keys present.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 048bae26-53a4-4ede-ac83-f25028f7329d
📒 Files selected for processing (3)
helm-charts/bifrost/templates/_helpers.tplhelm-charts/bifrost/values.schema.jsonhelm-charts/bifrost/values.yaml
BearTS
force-pushed
the
05-20-chore_sort_keys_to_avoid_unneccessary_kubernetes_rollouts_on_diff
branch
from
da12406 to
2dffd87
Compare
BearTS
force-pushed
the
05-20-feat_support_for_helm_to_assign_vk_on_access_profile
branch
2 times, most recently
from
164b903 to
7a46efe
Compare
BearTS
force-pushed
the
05-20-feat_support_for_helm_to_assign_vk_on_access_profile
branch
from
7a46efe to
8fef3f3
Compare
BearTS
force-pushed
the
05-20-chore_sort_keys_to_avoid_unneccessary_kubernetes_rollouts_on_diff
branch
from
2dffd87 to
4ea46e8
Compare
1 participant
Summary
Adds support for
access_profile_idas a virtual key assignment option in the Bifrost Helm chart, enabling enterprise users to associate virtual keys with access profile templates.Changes
access_profile_idfield handling in the_helpers.tpltemplate so the value is included when constructing virtual key configurationsaccess_profile_idto the JSON schema as an integer type with a description noting it is enterprise-only and mutually exclusive withteam_idandcustomer_idteam_idandcustomer_idschema descriptions to reflect that they are also mutually exclusive withaccess_profile_idvalues.yamlcomments to document the new field and the mutual exclusivity constraints across all three assignment optionsType of change
Affected areas
How to test
Deploy the Helm chart with a virtual key configured using
access_profile_id:Verify the rendered template includes
access_profile_idin the virtual key configuration:Confirm that the schema validates correctly and rejects configurations where
access_profile_idis used alongsideteam_idorcustomer_id.Screenshots/Recordings
N/A
Breaking changes
Related issues
Security considerations
access_profile_idis an enterprise-only field that controls access profile assignment for virtual keys. Ensure that only authorized users can set this field, as it governs access control boundaries for the associated key.Checklist
docs/contributing/README.mdand followed the guidelines