support create modal sandbox with url and token returned - #44
Merged
Conversation
Signed-off-by: kerthcet <kerthcet@gmail.com>
InftyAI-Agent
added
needs-triage
Contributor
There was a problem hiding this comment.
Pull request overview
This PR extends Nebula’s provider and virtual-node plumbing to support providers (notably Modal) that mint a one-shot connect URL + bearer token at create time, publishing the URL on the Pod endpoint annotation while persisting the token in a Kubernetes Secret.
Changes:
- Change
provider.Provider.Provisionto return aProvisionResultstruct includingConnectURL/ConnectToken(with redacted string formatting). - Update the vnode handler to stamp/create-time endpoints, patch endpoint annotations via a single write path, and persist connect credentials to a Pod-owned Secret.
- Update Modal provider/client to mint and return credentials at sandbox creation; add/adjust unit tests and docs to reflect the new publication model.
Reviewed changes
Copilot reviewed 16 out of 16 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| README.md | Minor README presentation tweaks (capitalization/badge ordering). |
| pkg/vnode/status.go | Update comment reference to renamed endpoint patch helper. |
| pkg/vnode/handler.go | Core logic: publish create-time endpoint, patch endpoint annotation, and write connect Secret. |
| pkg/vnode/handler_test.go | Add/extend tests covering connect Secret behavior and endpoint persistence semantics. |
| pkg/provider/provider.go | Introduce ProvisionResult with connect credential fields and redacted stringers. |
| pkg/provider/modal/modal.go | Modal Provision now returns ProvisionResult including minted connect credential; add ConnectPort. |
| pkg/provider/modal/modal_test.go | Update tests for new Provision signature and add credential/ConnectPort test coverage. |
| pkg/provider/modal/client.go | SDK client now mints connect token on create and returns it (no per-tick endpoint lookup). |
| pkg/provider/fake/fake.go | Update fake provider to new Provision signature (no credential minted). |
| pkg/provider/fake/fake_test.go | Adjust fake provider tests for ProvisionResult. |
| pkg/provider/aws/aws.go | Update AWS provider to new Provision signature (explicitly returns no credential). |
| pkg/provider/aws/aws_test.go | Adjust AWS provider tests for ProvisionResult. |
| internal/controller/nodeclaim_controller_test.go | Update controller test fake provider signature. |
| docs/status.md | Document provider-dependent endpoint publication timing and “never clear” behavior. |
| config/manager/kustomization.yaml | Bump controller image tag. |
| api/v1alpha1/groupversion_info.go | Update endpoint annotation docs to include URL form and provider-dependent write timing. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+782
to
+793
| _, err := h.client.CoreV1().Secrets(pod.Namespace).Create(ctx, secret, metav1.CreateOptions{}) | ||
| switch { | ||
| case apierrors.IsAlreadyExists(err): | ||
| return // a Secret under this name already exists; see above | ||
| case err != nil: | ||
| // Loud, because it is not retried: the token cannot be re-minted, so this | ||
| // instance stays credential-less until it is replaced. | ||
| log.Error(err, "write connect secret; the workload's credential is LOST (delete the Pod to re-provision)", | ||
| "pod", k, "secret", ConnectSecretName(pod.Name)) | ||
| return | ||
| } | ||
| log.Info("wrote connect secret", "pod", k, "secret", ConnectSecretName(pod.Name)) |
Member
Author
There was a problem hiding this comment.
The possibility is quite small, ignore it for now.
Signed-off-by: kerthcet <kerthcet@gmail.com>
Signed-off-by: kerthcet <kerthcet@gmail.com>
Member
Author
|
/lgtm |
InftyAI-Agent
added
lgtm
InftyAI-Agent
approved these changes
Aug 13, 2026
InftyAI-Agent
left a comment
InftyAI-Agent
left a comment
Member
There was a problem hiding this comment.
Approved: PR has both lgtm and approved labels
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it
Which issue(s) this PR fixes
Fixes #
Special notes for your reviewer
Does this PR introduce a user-facing change?