chore(weave): allowlist weave-evaluate-model-worker SA on gorilla - #671
Draft
amwarrier wants to merge 1 commit into
Draft
chore(weave): allowlist weave-evaluate-model-worker SA on gorilla#671amwarrier wants to merge 1 commit into
amwarrier wants to merge 1 commit into
Conversation
Extend app.internalJWTMap so gorilla accepts internal JWTs signed by weave-evaluate-model-worker, matching the treatment weave-trace-worker already gets. Without this the worker's callbacks into gorilla fail JWT validation and surface as a generic 500 to callers. Bumps operator-wandb to 0.43.10 and refreshes the four snapshots that render GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
<release>-weave-evaluate-model-worker's service account toapp.internalJWTMapso gorilla'sGORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERSaccepts internal JWTs signed by this worker.operator-wandbchart to 0.43.10 and refreshes the four snapshots that render the map.Context
Follows #598, which added the initial
weave-trace-workerallowlist entry.weave-evaluate-model-worker(introduced in #505) also mountsWANDB_INTERNAL_SERVICE_TOKENand calls back into gorilla, but its SA was never added to the allowlist — gorilla rejects the JWT (issuer/subjectmismatch) and the failure surfaces as a generic 500 to upstream callers such as the playground custom-provider flow.weave-trace-agent-scoring-workerhas the same gap; I'll open a separate PR for it.Test plan
python3 scripts/format_templates.py— no diffpython3 -m unittest discover -s scripts/tests— 16 passpython3 scripts/check_template_maintainability.py— pass./snapshots.sh update operator-wandb— diff limited to the 4 snapshots that renderGORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS(mcp-server.snap,olap-features-enabled.snap,weave-trace.snap,weave-trace-with-worker.snap)🤖 Generated with Claude Code