Repository navigation
Conversation
Create a ClusterIP Service next to the Deployment whenever spec.acp_enabled is set, making the pod's /acp port addressable inside the cluster. The Service uses the same labels as the Deployment's pod template so its selector always matches. - build_acp_service: constructs the ClusterIP Service (returns None when acp_enabled is off, so the Service isn't created for non-ACP agents) - acp_service_reconcile: plans Apply vs Prune so a redeploy that flips acp_enabled off tears down the stale Service - k8s_acp_url: returns the in-cluster ws:// URL that agents.toml dials - apply: runs the reconcile after the Deployment succeeds - delete: removes the Service alongside the Deployment Refs openabdev#155
Reese-max
force-pushed
the
devin/issue-155
branch
from
October 5, 2026 02:25
e34f49a to
397c6ec
Compare
Verify Service shape/selector/port/wire-shape, acp-off → no Service, ECS-runtime rejection, URL + slug, and apply-vs-prune decision. Refs openabdev#155
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Refs #155
K8sDriver::applypreviously produced a bareDeployment— the pod's/acplistener had no address anywhere in the cluster, so the ACP auth key the deploy writes into env had nothing to pair with andAppliedService.webhook_urlsalways came back empty.This change applies a
ClusterIPServicenext to theDeploymentwheneverspec.acpEnabledis set:oab-<name>slug as the Deployment; selector = the pod template labels, sourced from onepod_labels()helper so the two can't drift (unit-pinned against the built Deployment)default_container_portthe ECS ingress usesoabctlfield-manager + force as the Deployment — idempotent, re-apply is a no-opwebhook_urlsnow carriesws://oab-<name>.<ns>.svc.cluster.local:8080/acp, surfaced throughProvisionOutcome.webhook_urlsand thedeploy_provision*/deploy_provision_agentMCP results — "an address to put next to the auth key" foragents.tomldelete()removes the Service alongside the Deployment, and a re-apply withacpEnabledoff prunes a stale Service so it can't keep selecting pods that no longer listen on/acpClusterIP, deliberately not NodePort/LoadBalancer:
oab-<name>.<ns>.svc.cluster.localis reachable from the operator's machine on OrbStack (which routes*.svc.cluster.localand ClusterIPs to the host) and everywhere else viakubectl port-forward svc/oab-<name> 8080:8080— without publishing the bearer-authed port on node IPs or a provisioned LB. A Studio-side dynamic port-forward (the issue's candidate fix 2) remains a possible follow-up; the Service also gives that tunnel a stablesvc/target that survives pod restarts.Also closes a dispatch gap found in review:
deploy_deletehad no k8s branch, so a Studio-initiated delete of a k8s fleet agent never reachedK8sDriver— the Deployment (and now the Service) would dangle.t_deletenow mirrors thet_scalenamed-fleet dispatch from studio#161 viascp::delete_k8s_deployment.A separate commit normalizes workspace formatting + satisfies
clippy -D warningsunder the current toolchain (the base tree predates this rustfmt/clippy; same normalization as PR #166).Test plan
cargo fmt --all -- --checkcargo test --workspace(229 tests — new integration filecrates/oabctl/tests/k8s_acp_service.rscovers Service shape/selector/port/wire-shape, acp-off → no Service, ECS-runtime rejection, URL + slug; in-file unit test pins Service-selector ↔ pod-labels parity and the apply-vs-prune decision)cargo clippy --workspace --all-targets -- -D warningsGenerated with Devin