remove gw from k8s manifest, add agent fix ctrl vault for certs #4463

Flo4604 · 2025-12-03T13:07:58Z

What does this PR do?

Cleans up our k8s manfiests and adds agent and changes ctrl plane to use seperate vault for acme and normal vault.

If there is not an issue for this, please create one first. This is used to tracking purposes and also helps us understand why this PR exists

Type of change

Bug fix (non-breaking change which fixes an issue)
Chore (refactoring code, technical debt, workflow improvements)
Enhancement (small improvements)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
This change requires a documentation update

How should this be tested?

Test A
Test B

Checklist

Required

Appreciated

If a UI change was made: Added a screen recording or screenshots to this PR
Updated the Unkey Docs if changes were necessary

changeset-bot · 2025-12-03T13:08:02Z

⚠️ No Changeset found

Latest commit: e566197

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

vercel · 2025-12-03T13:08:03Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
dashboard	Error			Dec 9, 2025 4:19pm

1 Skipped Deployment

Project	Deployment	Preview	Comments	Updated (UTC)
engineering	Ignored	Preview		Dec 9, 2025 4:19pm

Flo4604 · 2025-12-03T13:08:14Z

coderabbitai · 2025-12-03T13:08:17Z

Warning

Rate limit exceeded

@chronark has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 25 minutes and 11 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between 2a0d2d0 and e566197.

📒 Files selected for processing (10)

deployment/docker-compose.yaml (2 hunks)
go/Tiltfile (7 hunks)
go/apps/ctrl/config.go (1 hunks)
go/apps/ctrl/run.go (3 hunks)
go/cmd/ctrl/main.go (2 hunks)
go/k8s/manifests/agent.yaml (1 hunks)
go/k8s/manifests/ctrl.yaml (1 hunks)
go/k8s/manifests/dashboard.yaml (2 hunks)
go/k8s/manifests/gw.yaml (0 hunks)
go/k8s/manifests/s3.yaml (3 hunks)

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch fix/clean-local-k8s

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

* feat: add environment variables db schema and queries * fix db query * feat: add SecretsConfig proto for encrypted env vars * [autofix.ci] apply automated fixes * feat: dashboard UI for environment variables management * fix comment and rename file * fix file export name * Remove unnecessary comments from add-env-vars * add toasts for environment variable operations * [autofix.ci] apply automated fixes * fix: add try/catch error handling to env var mutations * unfmt file * [autofix.ci] apply automated fixes * feat: decrypt env vars in CTRL workflow before passing to Krane * feat: inject env vars into pod spec via Krane * feat: add customer-workload service account for pod isolation * remove gw from k8s manifest, add agent fix ctrl vault for certs * seperate master keys too --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Andreas Thomas <[email protected]>

* feat: add environment variables db schema and queries * fix db query * feat: add SecretsConfig proto for encrypted env vars * [autofix.ci] apply automated fixes * feat: dashboard UI for environment variables management * fix comment and rename file * fix file export name * Remove unnecessary comments from add-env-vars * add toasts for environment variable operations * [autofix.ci] apply automated fixes * fix: add try/catch error handling to env var mutations * unfmt file * [autofix.ci] apply automated fixes * feat: decrypt env vars in CTRL workflow before passing to Krane * feat: inject env vars into pod spec via Krane * feat: add customer-workload service account for pod isolation * remove gw from k8s manifest, add agent fix ctrl vault for certs * seperate master keys too * add inital webhook stuff * add generated stuff * adjust comments * use otel lgtm stack in k8s too * fix some rabbit comments * fix some rabbit comments * get rid of some unncessary comments * actually add unkey env cmd gitignores... * fix golint issues * Fix/update validation issues status label (#4478) * fix: update API key status label from 'Potential issues' to 'High Error Rate' Changed the validation-issues status label to more clearly communicate that the key is receiving invalid requests, rather than implying the API or key itself is broken. Changes: - Label: 'Potential issues' → 'High Error Rate' - Tooltip: Updated to clarify that requests are invalid (rate limited, unauthorized, etc.) rather than suggesting system issues Fixes #4474 * chore: apply biome formatting * fix: update status label to 'Elevated Rejections' per review --------- Co-authored-by: CodeReaper <[email protected]> * chore: Remove un-used UI components (#4472) * removed un used components * updated members refs --------- Co-authored-by: James P <[email protected]> Co-authored-by: Andreas Thomas <[email protected]> * perf: fix n+1 (#4484) * fix: add 403 error when 0 key verification perms (#4483) * fix: add 403 error when 0 key verification perms * cleanup tests * feat: add environment variables db schema and queries (#4450) * feat: add environment variables db schema and queries * fix db query * feat: add SecretsConfig proto for encrypted env vars (#4451) * feat: add environment variables db schema and queries * fix db query * feat: add SecretsConfig proto for encrypted env vars * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Andreas Thomas <[email protected]> * feat: add GetPullToken * feat: dashboard UI for environment variables management (#4452) * feat: add environment variables db schema and queries * fix db query * feat: add SecretsConfig proto for encrypted env vars * [autofix.ci] apply automated fixes * feat: dashboard UI for environment variables management * fix comment and rename file * fix file export name * Remove unnecessary comments from add-env-vars * add toasts for environment variable operations * [autofix.ci] apply automated fixes * fix: add try/catch error handling to env var mutations * unfmt file * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Andreas Thomas <[email protected]> * feat: decrypt env vars in CTRL workflow before passing to Krane (#4453) * feat: add environment variables db schema and queries * fix db query * feat: add SecretsConfig proto for encrypted env vars * [autofix.ci] apply automated fixes * feat: dashboard UI for environment variables management * fix comment and rename file * fix file export name * Remove unnecessary comments from add-env-vars * add toasts for environment variable operations * [autofix.ci] apply automated fixes * fix: add try/catch error handling to env var mutations * unfmt file * [autofix.ci] apply automated fixes * feat: decrypt env vars in CTRL workflow before passing to Krane --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Andreas Thomas <[email protected]> * feat: inject env vars into pod spec via Krane (#4454) * feat: add environment variables db schema and queries * fix db query * feat: add SecretsConfig proto for encrypted env vars * [autofix.ci] apply automated fixes * feat: dashboard UI for environment variables management * fix comment and rename file * fix file export name * Remove unnecessary comments from add-env-vars * add toasts for environment variable operations * [autofix.ci] apply automated fixes * fix: add try/catch error handling to env var mutations * unfmt file * [autofix.ci] apply automated fixes * feat: decrypt env vars in CTRL workflow before passing to Krane * feat: inject env vars into pod spec via Krane --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Andreas Thomas <[email protected]> * feat: add customer-workload service account for pod isolation (#4455) * feat: add environment variables db schema and queries * fix db query * feat: add SecretsConfig proto for encrypted env vars * [autofix.ci] apply automated fixes * feat: dashboard UI for environment variables management * fix comment and rename file * fix file export name * Remove unnecessary comments from add-env-vars * add toasts for environment variable operations * [autofix.ci] apply automated fixes * fix: add try/catch error handling to env var mutations * unfmt file * [autofix.ci] apply automated fixes * feat: decrypt env vars in CTRL workflow before passing to Krane * feat: inject env vars into pod spec via Krane * feat: add customer-workload service account for pod isolation --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Andreas Thomas <[email protected]> * remove gw from k8s manifest, add agent fix ctrl vault for certs (#4463) * feat: add environment variables db schema and queries * fix db query * feat: add SecretsConfig proto for encrypted env vars * [autofix.ci] apply automated fixes * feat: dashboard UI for environment variables management * fix comment and rename file * fix file export name * Remove unnecessary comments from add-env-vars * add toasts for environment variable operations * [autofix.ci] apply automated fixes * fix: add try/catch error handling to env var mutations * unfmt file * [autofix.ci] apply automated fixes * feat: decrypt env vars in CTRL workflow before passing to Krane * feat: inject env vars into pod spec via Krane * feat: add customer-workload service account for pod isolation * remove gw from k8s manifest, add agent fix ctrl vault for certs * seperate master keys too --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Andreas Thomas <[email protected]> * chore: Make Stripe Great Again (#4479) * fix: Make stripe webhooks more robust * chore: Move alert to UI (#4485) * Moved alert to ui and swapped usages * feat: better env var injection (#4468) * feat: add environment variables db schema and queries * fix db query * feat: add SecretsConfig proto for encrypted env vars * [autofix.ci] apply automated fixes * feat: dashboard UI for environment variables management * fix comment and rename file * fix file export name * Remove unnecessary comments from add-env-vars * add toasts for environment variable operations * [autofix.ci] apply automated fixes * fix: add try/catch error handling to env var mutations * unfmt file * [autofix.ci] apply automated fixes * feat: decrypt env vars in CTRL workflow before passing to Krane * feat: inject env vars into pod spec via Krane * feat: add customer-workload service account for pod isolation * remove gw from k8s manifest, add agent fix ctrl vault for certs * seperate master keys too * add inital webhook stuff * add generated stuff * adjust comments * use otel lgtm stack in k8s too * fix some rabbit comments * fix some rabbit comments * get rid of some unncessary comments * actually add unkey env cmd gitignores... * fix golint issues (#4477) * [autofix.ci] apply automated fixes * fix fmt * linter be happy --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Andreas Thomas <[email protected]> * make token pod owned * feat: add lets encrypt challenges (#4471) * feat: add lets encrypt challenges * always disable cname following * cleanup some code * cleanup some code * cleanup some code * cleanup some code * cleanup some code * fix golint issues * fix golint issues * fmt * remove old webhook code * remove old webhook code * make build id not optiona * cleanup * cleanup * fmt * fmt --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: abhay <[email protected]> Co-authored-by: CodeReaper <[email protected]> Co-authored-by: James P <[email protected]> Co-authored-by: Andreas Thomas <[email protected]>

This was referenced Dec 3, 2025

feat: decrypt env vars in CTRL workflow before passing to Krane #4453

Merged

feat: dashboard UI for environment variables management #4452

Merged

Flo4604 mentioned this pull request Dec 3, 2025

feat: add SecretsConfig proto for encrypted env vars #4451

Merged

19 tasks

This was referenced Dec 3, 2025

feat: add environment variables db schema and queries #4450

Merged

feat: inject env vars into pod spec via Krane #4454

Merged

Flo4604 mentioned this pull request Dec 3, 2025

feat: add customer-workload service account for pod isolation #4455

Merged

19 tasks

vercel bot deployed to Preview – engineering December 3, 2025 13:08 View deployment

vercel bot deployed to Preview – dashboard December 3, 2025 13:08 View deployment

Flo4604 marked this pull request as ready for review December 3, 2025 13:11

Flo4604 requested review from MichaelUnkey, chronark, imeyer, mcstepp, ogzhanolguncu and perkinsjr as code owners December 3, 2025 13:11

Flo4604 force-pushed the fix/clean-local-k8s branch from 920e540 to a238c5f Compare December 3, 2025 13:16

Flo4604 force-pushed the feat/env-vars-rbac-isolation branch from 362de6c to 3f16ac9 Compare December 3, 2025 13:16

vercel bot deployed to Preview – engineering December 3, 2025 13:17 View deployment

vercel bot deployed to Preview – dashboard December 3, 2025 13:20 View deployment

Flo4604 mentioned this pull request Dec 3, 2025

feat: better env var injection #4468

Merged

19 tasks

Flo4604 force-pushed the fix/clean-local-k8s branch from a238c5f to b5bf49a Compare December 4, 2025 09:51

Flo4604 force-pushed the feat/env-vars-rbac-isolation branch from 3f16ac9 to 30e9604 Compare December 4, 2025 09:51

vercel bot deployed to Preview – engineering December 4, 2025 09:52 View deployment

vercel bot deployed to Preview – dashboard December 4, 2025 09:52 View deployment

Flo4604 added 2 commits December 4, 2025 18:36

feat: add environment variables db schema and queries

405ea48

fix db query

5b0249e

Flo4604 and others added 16 commits December 4, 2025 18:36

feat: add SecretsConfig proto for encrypted env vars

60f228c

[autofix.ci] apply automated fixes

ac29218

feat: dashboard UI for environment variables management

d89e495

fix comment and rename file

117e0d4

fix file export name

8cd90b5

Remove unnecessary comments from add-env-vars

34ddff9

add toasts for environment variable operations

4f6534d

[autofix.ci] apply automated fixes

64d9bd6

fix: add try/catch error handling to env var mutations

d00a162

unfmt file

d4c4f50

[autofix.ci] apply automated fixes

8d1c219

feat: decrypt env vars in CTRL workflow before passing to Krane

9adddc0

feat: inject env vars into pod spec via Krane

b071965

feat: add customer-workload service account for pod isolation

8669905

remove gw from k8s manifest, add agent fix ctrl vault for certs

e240895

seperate master keys too

9fb5cce

Flo4604 force-pushed the fix/clean-local-k8s branch from b5bf49a to 9fb5cce Compare December 4, 2025 17:36

Flo4604 force-pushed the feat/env-vars-rbac-isolation branch from 30e9604 to 8669905 Compare December 4, 2025 17:36

vercel bot deployed to Preview – engineering December 4, 2025 17:37 View deployment

vercel bot deployed to Preview – dashboard December 4, 2025 17:40 View deployment

Flo4604 mentioned this pull request Dec 4, 2025

fix golint issues #4477

Merged

19 tasks

Base automatically changed from feat/env-vars-rbac-isolation to main December 9, 2025 16:16

Merge branch 'main' into fix/clean-local-k8s

e566197

chronark approved these changes Dec 9, 2025

View reviewed changes

chronark merged commit 44844c5 into main Dec 9, 2025
20 of 22 checks passed

chronark deleted the fix/clean-local-k8s branch December 9, 2025 16:17

vercel bot had a problem deploying to Preview – dashboard December 9, 2025 16:19 Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

remove gw from k8s manifest, add agent fix ctrl vault for certs #4463

remove gw from k8s manifest, add agent fix ctrl vault for certs #4463

Uh oh!

Flo4604 commented Dec 3, 2025 •

edited

Loading

Uh oh!

changeset-bot bot commented Dec 3, 2025 •

edited

Loading

Uh oh!

vercel bot commented Dec 3, 2025 •

edited

Loading

Uh oh!

Flo4604 commented Dec 3, 2025 •

edited

Loading

Uh oh!

coderabbitai bot commented Dec 3, 2025 •

edited

Loading

Rate limit exceeded

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

remove gw from k8s manifest, add agent fix ctrl vault for certs #4463

remove gw from k8s manifest, add agent fix ctrl vault for certs #4463

Uh oh!

Conversation

Flo4604 commented Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Type of change

How should this be tested?

Checklist

Required

Appreciated

Uh oh!

changeset-bot bot commented Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

vercel bot commented Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Flo4604 commented Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai bot commented Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rate limit exceeded

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Flo4604 commented Dec 3, 2025 •

edited

Loading

changeset-bot bot commented Dec 3, 2025 •

edited

Loading

vercel bot commented Dec 3, 2025 •

edited

Loading

Flo4604 commented Dec 3, 2025 •

edited

Loading

coderabbitai bot commented Dec 3, 2025 •

edited

Loading