Skip to content

Commit ebb12cf

Browse files
stubbiclaude
stubbi
and
claude
authored
fix: add get verb to pods/exec RBAC for WebSocket exec (#17)
fix: add K8s API egress and sandbox scheduling env vars Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent edb5c33 commit ebb12cf

8 files changed

Lines changed: 65 additions & 20 deletions

File tree

‎api/v1alpha1/paperclipinstance_types.go‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -357,12 +357,18 @@ type AdaptersSpec struct {
357357
// +optional
358358
CloudSandbox *CloudSandboxSpec `json:"cloudSandbox,omitempty"`
359359

360-
// ManagedInferenceSecretRef references a Secret containing the platform LLM API key.
361-
// The Secret must contain a key "PAPERCLIP_MANAGED_INFERENCE_API_KEY".
360+
// ManagedInferenceSecretRef references a Secret containing platform LLM API keys.
361+
// The Secret should contain one or more of these keys:
362+
// PAPERCLIP_MANAGED_ANTHROPIC_API_KEY
363+
// PAPERCLIP_MANAGED_OPENAI_API_KEY
364+
// PAPERCLIP_MANAGED_GEMINI_API_KEY
365+
// PAPERCLIP_MANAGED_OPENROUTER_API_KEY
366+
// For backward compatibility, PAPERCLIP_MANAGED_INFERENCE_API_KEY is also supported.
362367
// +optional
363368
ManagedInferenceSecretRef *corev1.LocalObjectReference `json:"managedInferenceSecretRef,omitempty"`
364369

365-
// ManagedInferenceProvider is the LLM provider for managed inference (e.g. "anthropic", "openrouter").
370+
// ManagedInferenceProvider is the LLM provider for the legacy single-key mode.
371+
// Ignored when per-provider keys are used.
366372
// +kubebuilder:default="anthropic"
367373
// +optional
368374
ManagedInferenceProvider string `json:"managedInferenceProvider,omitempty"`

‎charts/paperclip-operator/templates/crds/paperclip.inc_instances.yaml‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -273,13 +273,19 @@ spec:
273273
type: string
274274
managedInferenceProvider:
275275
default: anthropic
276-
description: ManagedInferenceProvider is the LLM provider for
277-
managed inference (e.g. "anthropic", "openrouter").
276+
description: |-
277+
ManagedInferenceProvider is the LLM provider for the legacy single-key mode.
278+
Ignored when per-provider keys are used.
278279
type: string
279280
managedInferenceSecretRef:
280281
description: |-
281-
ManagedInferenceSecretRef references a Secret containing the platform LLM API key.
282-
The Secret must contain a key "PAPERCLIP_MANAGED_INFERENCE_API_KEY".
282+
ManagedInferenceSecretRef references a Secret containing platform LLM API keys.
283+
The Secret should contain one or more of these keys:
284+
PAPERCLIP_MANAGED_ANTHROPIC_API_KEY
285+
PAPERCLIP_MANAGED_OPENAI_API_KEY
286+
PAPERCLIP_MANAGED_GEMINI_API_KEY
287+
PAPERCLIP_MANAGED_OPENROUTER_API_KEY
288+
For backward compatibility, PAPERCLIP_MANAGED_INFERENCE_API_KEY is also supported.
283289
properties:
284290
name:
285291
default: ""

‎charts/paperclip-operator/templates/rbac.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ rules:
2727
verbs: ["create", "delete", "get", "list", "patch", "watch"]
2828
- apiGroups: [""]
2929
resources: ["pods/exec"]
30-
verbs: ["create"]
30+
verbs: ["create", "get"]
3131
- apiGroups: [""]
3232
resources: ["pods/log"]
3333
verbs: ["get"]

‎config/crd/bases/paperclip.inc_instances.yaml‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -267,13 +267,19 @@ spec:
267267
type: string
268268
managedInferenceProvider:
269269
default: anthropic
270-
description: ManagedInferenceProvider is the LLM provider for
271-
managed inference (e.g. "anthropic", "openrouter").
270+
description: |-
271+
ManagedInferenceProvider is the LLM provider for the legacy single-key mode.
272+
Ignored when per-provider keys are used.
272273
type: string
273274
managedInferenceSecretRef:
274275
description: |-
275-
ManagedInferenceSecretRef references a Secret containing the platform LLM API key.
276-
The Secret must contain a key "PAPERCLIP_MANAGED_INFERENCE_API_KEY".
276+
ManagedInferenceSecretRef references a Secret containing platform LLM API keys.
277+
The Secret should contain one or more of these keys:
278+
PAPERCLIP_MANAGED_ANTHROPIC_API_KEY
279+
PAPERCLIP_MANAGED_OPENAI_API_KEY
280+
PAPERCLIP_MANAGED_GEMINI_API_KEY
281+
PAPERCLIP_MANAGED_OPENROUTER_API_KEY
282+
For backward compatibility, PAPERCLIP_MANAGED_INFERENCE_API_KEY is also supported.
277283
properties:
278284
name:
279285
default: ""

‎config/rbac/role.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ rules:
4343
- pods/exec
4444
verbs:
4545
- create
46+
- get
4647
- apiGroups:
4748
- ""
4849
resources:

‎internal/controller/instance_controller.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,9 @@ type InstanceReconciler struct {
7979
// +kubebuilder:rbac:groups="",resources=persistentvolumeclaims,verbs=get;list;watch;create;update;patch;delete
8080
// +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;patch
8181
// +kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch;create;update;patch;delete
82-
// +kubebuilder:rbac:groups="",resources=pods,verbs=get;list;watch
82+
// +kubebuilder:rbac:groups="",resources=pods,verbs=create;delete;get;list;patch;watch
83+
// +kubebuilder:rbac:groups="",resources=pods/exec,verbs=create;get
84+
// +kubebuilder:rbac:groups="",resources=pods/log,verbs=get
8385
// +kubebuilder:rbac:groups="",resources=events,verbs=create;patch
8486
// +kubebuilder:rbac:groups=networking.k8s.io,resources=ingresses,verbs=get;list;watch;create;update;patch;delete
8587
// +kubebuilder:rbac:groups=networking.k8s.io,resources=networkpolicies,verbs=get;list;watch;create;update;patch;delete

‎internal/resources/sandbox_rbac.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ func sandboxBaseRules() []rbacv1.PolicyRule {
2828
{
2929
APIGroups: []string{""},
3030
Resources: []string{"pods/exec"},
31-
Verbs: []string{"create"},
31+
Verbs: []string{"create", "get"},
3232
},
3333
{
3434
APIGroups: []string{""},

‎internal/resources/statefulset.go‎

Lines changed: 30 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -372,18 +372,42 @@ func buildManagedInferenceEnvVars(instance *paperclipv1alpha1.Instance) []corev1
372372
return nil
373373
}
374374

375-
vars := []corev1.EnvVar{
376-
{
377-
Name: "PAPERCLIP_MANAGED_INFERENCE_API_KEY",
375+
secretRef := *instance.Spec.Adapters.ManagedInferenceSecretRef
376+
377+
// Per-provider keys - each is optional in the Secret
378+
providerKeys := []string{
379+
"PAPERCLIP_MANAGED_ANTHROPIC_API_KEY",
380+
"PAPERCLIP_MANAGED_OPENAI_API_KEY",
381+
"PAPERCLIP_MANAGED_GEMINI_API_KEY",
382+
"PAPERCLIP_MANAGED_OPENROUTER_API_KEY",
383+
}
384+
385+
vars := make([]corev1.EnvVar, 0, len(providerKeys)+3)
386+
for _, key := range providerKeys {
387+
vars = append(vars, corev1.EnvVar{
388+
Name: key,
378389
ValueFrom: &corev1.EnvVarSource{
379390
SecretKeyRef: &corev1.SecretKeySelector{
380-
LocalObjectReference: *instance.Spec.Adapters.ManagedInferenceSecretRef,
381-
Key: "PAPERCLIP_MANAGED_INFERENCE_API_KEY",
391+
LocalObjectReference: secretRef,
392+
Key: key,
393+
Optional: Ptr(true),
382394
},
383395
},
384-
},
396+
})
385397
}
386398

399+
// Legacy single-key for backward compatibility
400+
vars = append(vars, corev1.EnvVar{
401+
Name: "PAPERCLIP_MANAGED_INFERENCE_API_KEY",
402+
ValueFrom: &corev1.EnvVarSource{
403+
SecretKeyRef: &corev1.SecretKeySelector{
404+
LocalObjectReference: secretRef,
405+
Key: "PAPERCLIP_MANAGED_INFERENCE_API_KEY",
406+
Optional: Ptr(true),
407+
},
408+
},
409+
})
410+
387411
if instance.Spec.Adapters.ManagedInferenceProvider != "" {
388412
vars = append(vars, corev1.EnvVar{
389413
Name: "PAPERCLIP_MANAGED_INFERENCE_PROVIDER",

0 commit comments

Comments
 (0)