chore(weave): mount internal JWT on weave scoring/eval workers

[jwlee64]

Summary

• Mount internal JWT token on weave-evaluate-model-worker and weave-trace-agent-scoring-worker, matching the pattern from chore(weave): mount internal JWT + allowlist worker SA on gorilla #598
• Add both worker service accounts to gorilla's internal JWT subject allowlist so mounted tokens are accepted

Related: wandb/core#47739 (prod fix), #598 (original weave-worker mount)

Note: weave-trace-worker (scoring_worker) already had the mount from #598; there is no separate call-scoring deployment in this chart.

Test plan

• ./snapshots.sh build operator-wandb && ./snapshots.sh update operator-wandb
• ./snapshots.sh run operator-wandb

Made with Cursor

Summary by CodeRabbit

• New Features

  • Enabled secure service-account authentication for model evaluation and agent-scoring workers.
  • Added internal access permissions for these worker services.

• Chores

  • Updated the Helm chart version to 0.43.10.

[coderabbitai]

📝 Walkthrough

Walkthrough

The Helm chart now configures internal JWT authentication for the evaluate-model and agent-scoring workers. It adds projected service-account token mounts, allowlists both worker identities, and increments the chart version.

Changes

Worker internal JWT access

Layer / File(s)	Summary
Worker JWT mounts and allowlist charts/operator-wandb/values.yaml, charts/operator-wandb/Chart.yaml	The chart allowlists both worker service accounts and mounts projected tokens with the internal-service audience and 600-second expiration. The chart version changes to 0.43.10.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• wandb/helm-charts#598: Adds similar projected internal JWT mounts and worker service-account allowlisting.
• wandb/helm-charts#389: Updates the operator-wandb Helm chart version.

Suggested reviewers: zacharyblasczyk, adityachoudhari26

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The chart adds projected JWT mounts and allowlist entries for both target workers, matching the stated internal authentication requirements.
Out of Scope Changes check	✅ Passed	The changes are limited to the related Helm chart version bump and internal JWT configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes mounting the internal JWT on the Weave scoring and evaluation workers.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/weave-internal-jwt-scoring-eval-workers

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jtschoonhoven]

Why is this needed? Was something broken?

[jwlee64]

@jtschoonhoven https://weightsandbiases.slack.com/archives/C03BSTEBD7F/p1783624417132799?thread_ts=1783624414.351609&cid=C03BSTEBD7F

[dacbd]

Suggested change

	mountPath: /tmp/weave-trace/internal-jwt
	mountPath: /var/run/secrets/weave-trace

I think this would be more correct, than mounting under /tmp

the token is then at: /var/run/secrets/weave-trace/token