Repository navigation
Send the Vizier ID when requesting Vizier configs from the cloud - #2415
Open
NopeCharon wants to merge 1 commit into
Open
NopeCharon wants to merge 1 commit into
NopeCharon wants to merge 1 commit into
Conversation
The config manager looks up the org of a Vizier from its deploy key to decide which per-org feature flags to set in the Vizier YAMLs. Deploy keys are usually deleted once the Vizier is running, so on updates the lookup fails and the feature flags are silently dropped. The config manager already falls back to looking up the org from the Vizier ID in ConfigForVizierRequest, but the operator never sends it. The operator now reads the Vizier ID from the cluster-id key of the pl-cluster-secrets secret and includes it in the request. The secret is populated by the cloud connector after it registers the Vizier, which happens after the operator deploys the Vizier. The previous attempt at this (pixie-io#1670) waited for the ID to appear, which blocked initial deploys for up to 10 minutes and was reverted in pixie-io#1899. This change reads the secret once and sends no ID when it is missing or invalid, so the initial deploy behaves exactly as before. generateVizierYAMLsConfig now takes a ConfigServiceClient instead of a gRPC connection so that the request can be tested with the generated mock. Signed-off-by: NopeCharon <115794254+NopeCharon@users.noreply.github.com>
NopeCharon
requested a deployment
to
pr-actions-approval
October 27, 2026 07:02 — with 
GitHub Actions
Waiting
GitHub Actions
Waiting
This branch is waiting to be deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary: Send the Vizier ID when requesting Vizier configs from the cloud
The config manager uses the deploy key in
ConfigForVizierRequestto find the Vizier's org and set that org's feature flags in the Vizier YAMLs. Deploy keys are usually deleted once the Vizier is running, so on updates the lookup fails and the feature flags are dropped. The config manager already falls back to finding the org fromConfigForVizierRequest.vizier_id(#1668, #1677), but the operator doesn't send it, because the operator part (#1670) was reverted in #1899.That revert happened because #1670 waited up to 10 minutes for
pl-cluster-secretsto contain the cluster ID. The cloud connector only writes the cluster ID after it registers the Vizier, and the operator deploys the cloud connector, so on a fresh installpx deployhung until the wait timed out.This PR sends the Vizier ID without waiting. The operator reads
cluster-idfrompl-cluster-secretsonce. If the secret or the key is missing, or the value isn't a valid UUID, it sends no ID, so the initial deploy works the same as before. On updates the ID is available, and the config manager can find the org even after the deploy key is deleted.generateVizierYAMLsConfignow takes acloudpb.ConfigServiceClientinstead of a gRPC connection, the same waygetVizierVersionStatetakes anArtifactTrackerClient, so the request can be tested with the generated mock.Relevant Issues: Fixes #1632
Type of change: /kind bug
Test Plan: Added
vizier_controller_test.goto//src/operator/controllers:controllers_test.TestGetVizierIDcovers a missing secret, a missingcluster-id, an invalid ID and a valid ID.TestGenerateVizierYAMLsConfig_VizierIDchecks that the request sent to the config service includes the Vizier ID when there is one and leaves it unset on the initial deploy. The update case fails if theVizierIDfield is not set.go test ./src/operator/controllers/,go vetand golangci-lint v2.3.1 with the repo's.golangci.yamlall pass. I have not run this against a live cluster and cloud.Changelog Message: