Skip to content

feat: credential MCP sidecar isolation with CI/CD pipeline support #1623

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mergify merged 1 commit into from
Jun 1, 2026
+3,041 −73
Merged

feat: credential MCP sidecar isolation with CI/CD pipeline support #1623

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 24 additions & 2 deletions .github/workflows/components-build-deploy.yml
100755 → 100644
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ on:
- 'components/ambient-control-plane/**'
- 'components/ambient-mcp/**'
- 'components/ambient-ui/**'
- 'components/credential-sidecars/**'
pull_request:
branches: [main, alpha]
paths:
Expand All @@ -29,10 +30,11 @@ on:
- 'components/ambient-control-plane/**'
- 'components/ambient-mcp/**'
- 'components/ambient-ui/**'
- 'components/credential-sidecars/**'
workflow_dispatch:
inputs:
components:
description: 'Components to build (comma-separated: frontend,backend,operator,ambient-runner,state-sync,public-api,ambient-api-server,ambient-control-plane,ambient-mcp,ambient-ui) - leave empty for all'
description: 'Components to build (comma-separated: frontend,backend,operator,ambient-runner,state-sync,public-api,ambient-api-server,ambient-control-plane,ambient-mcp,ambient-ui,credential-github,credential-jira,credential-k8s,credential-google) - leave empty for all'
required: false
type: string
default: ''
Expand Down Expand Up @@ -63,7 +65,11 @@ jobs:
{"name":"ambient-api-server","context":"./components/ambient-api-server","image":"quay.io/ambient_code/vteam_api_server","dockerfile":"./components/ambient-api-server/Dockerfile"},
{"name":"ambient-control-plane","context":"./components","image":"quay.io/ambient_code/vteam_control_plane","dockerfile":"./components/ambient-control-plane/Dockerfile"},
{"name":"ambient-mcp","context":"./components/ambient-mcp","image":"quay.io/ambient_code/vteam_mcp","dockerfile":"./components/ambient-mcp/Dockerfile"},
{"name":"ambient-ui","context":"./components","image":"quay.io/ambient_code/vteam_ambient_ui","dockerfile":"./components/ambient-ui/Dockerfile"}
{"name":"ambient-ui","context":"./components","image":"quay.io/ambient_code/vteam_ambient_ui","dockerfile":"./components/ambient-ui/Dockerfile"},
{"name":"credential-github","context":"./components","image":"quay.io/ambient_code/vteam_credential_github","dockerfile":"./components/credential-sidecars/github/Dockerfile"},
{"name":"credential-jira","context":"./components","image":"quay.io/ambient_code/vteam_credential_jira","dockerfile":"./components/credential-sidecars/jira/Dockerfile"},
{"name":"credential-k8s","context":"./components","image":"quay.io/ambient_code/vteam_credential_k8s","dockerfile":"./components/credential-sidecars/k8s/Dockerfile"},
{"name":"credential-google","context":"./components","image":"quay.io/ambient_code/vteam_credential_google","dockerfile":"./components/credential-sidecars/google/Dockerfile"}
]'

SELECTED="${{ github.event.inputs.components }}"
Expand Down Expand Up @@ -413,6 +419,14 @@ jobs:
AMBIENT_CODE_RUNNER_IMAGE="quay.io/ambient_code/vteam_claude_runner:${{ github.sha }}" \
STATE_SYNC_IMAGE="quay.io/ambient_code/vteam_state_sync:${{ github.sha }}"

- name: Update credential sidecar image tags on control plane
run: |
oc set env deployment/ambient-control-plane -n ambient-code \
GITHUB_MCP_IMAGE="quay.io/ambient_code/vteam_credential_github:${{ github.sha }}" \
JIRA_MCP_IMAGE="quay.io/ambient_code/vteam_credential_jira:${{ github.sha }}" \
K8S_MCP_IMAGE="quay.io/ambient_code/vteam_credential_k8s:${{ github.sha }}" \
GOOGLE_MCP_IMAGE="quay.io/ambient_code/vteam_credential_google:${{ github.sha }}"

- name: Pin OPERATOR_IMAGE in operator-config ConfigMap
run: |
oc patch configmap operator-config -n ambient-code --type=merge \
Expand Down Expand Up @@ -492,6 +506,14 @@ jobs:
AMBIENT_CODE_RUNNER_IMAGE="quay.io/ambient_code/vteam_claude_runner:${{ github.sha }}" \
STATE_SYNC_IMAGE="quay.io/ambient_code/vteam_state_sync:${{ github.sha }}"

- name: Update credential sidecar image tags on control plane
run: |
oc set env deployment/ambient-control-plane -n ambient-code \
GITHUB_MCP_IMAGE="quay.io/ambient_code/vteam_credential_github:${{ github.sha }}" \
JIRA_MCP_IMAGE="quay.io/ambient_code/vteam_credential_jira:${{ github.sha }}" \
K8S_MCP_IMAGE="quay.io/ambient_code/vteam_credential_k8s:${{ github.sha }}" \
GOOGLE_MCP_IMAGE="quay.io/ambient_code/vteam_credential_google:${{ github.sha }}"

- name: Pin OPERATOR_IMAGE in operator-config ConfigMap
run: |
oc patch configmap operator-config -n ambient-code --type=merge \
Expand Down
30 changes: 28 additions & 2 deletions .github/workflows/prod-release-deploy.yaml
100755 → 100644
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ on:
type: boolean
default: true
components:
description: 'Components to build (comma-separated: frontend,backend,operator,ambient-runner,state-sync,public-api,ambient-api-server,ambient-control-plane,ambient-mcp,ambient-ui) - leave empty for all'
description: 'Components to build (comma-separated: frontend,backend,operator,ambient-runner,state-sync,public-api,ambient-api-server,ambient-control-plane,ambient-mcp,ambient-ui,credential-github,credential-jira,credential-k8s,credential-google) - leave empty for all'
required: false
type: string
default: ''
Expand Down Expand Up @@ -239,7 +239,11 @@ jobs:
{"name":"ambient-api-server","context":"./components/ambient-api-server","image":"quay.io/ambient_code/vteam_api_server","dockerfile":"./components/ambient-api-server/Dockerfile"},
{"name":"ambient-control-plane","context":"./components","image":"quay.io/ambient_code/vteam_control_plane","dockerfile":"./components/ambient-control-plane/Dockerfile"},
{"name":"ambient-mcp","context":"./components/ambient-mcp","image":"quay.io/ambient_code/vteam_mcp","dockerfile":"./components/ambient-mcp/Dockerfile"},
{"name":"ambient-ui","context":"./components","image":"quay.io/ambient_code/vteam_ambient_ui","dockerfile":"./components/ambient-ui/Dockerfile"}
{"name":"ambient-ui","context":"./components","image":"quay.io/ambient_code/vteam_ambient_ui","dockerfile":"./components/ambient-ui/Dockerfile"},
{"name":"credential-github","context":"./components","image":"quay.io/ambient_code/vteam_credential_github","dockerfile":"./components/credential-sidecars/github/Dockerfile"},
{"name":"credential-jira","context":"./components","image":"quay.io/ambient_code/vteam_credential_jira","dockerfile":"./components/credential-sidecars/jira/Dockerfile"},
{"name":"credential-k8s","context":"./components","image":"quay.io/ambient_code/vteam_credential_k8s","dockerfile":"./components/credential-sidecars/k8s/Dockerfile"},
{"name":"credential-google","context":"./components","image":"quay.io/ambient_code/vteam_credential_google","dockerfile":"./components/credential-sidecars/google/Dockerfile"}
]'

FORCE_ALL="${{ github.event.inputs.force_build_all }}"
Expand Down Expand Up @@ -710,6 +714,28 @@ jobs:
oc set env deployment/agentic-operator -n ambient-code -c agentic-operator $ARGS
fi


- name: Update credential sidecar image tags on control plane
run: |
RELEASE_TAG="${{ needs.release.outputs.new_tag }}"
BUILT="${{ steps.built.outputs.names }}"
ARGS=""
if echo ",$BUILT," | grep -q ",credential-github,"; then
ARGS="$ARGS GITHUB_MCP_IMAGE=quay.io/ambient_code/vteam_credential_github:${RELEASE_TAG}"
fi
if echo ",$BUILT," | grep -q ",credential-jira,"; then
ARGS="$ARGS JIRA_MCP_IMAGE=quay.io/ambient_code/vteam_credential_jira:${RELEASE_TAG}"
fi
if echo ",$BUILT," | grep -q ",credential-k8s,"; then
ARGS="$ARGS K8S_MCP_IMAGE=quay.io/ambient_code/vteam_credential_k8s:${RELEASE_TAG}"
fi
if echo ",$BUILT," | grep -q ",credential-google,"; then
ARGS="$ARGS GOOGLE_MCP_IMAGE=quay.io/ambient_code/vteam_credential_google:${RELEASE_TAG}"
fi
if [ -n "$ARGS" ]; then
oc set env deployment/ambient-control-plane -n ambient-code $ARGS
fi

- name: Pin OPERATOR_IMAGE in operator-config ConfigMap
run: |
RELEASE_TAG="${{ needs.release.outputs.new_tag }}"
Expand Down
2 changes: 1 addition & 1 deletion components/ambient-api-server/plugins/credentials/migration.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,7 +108,7 @@ func rolesMigration() *gormigrate.Migration {

func dropProjectIDMigration() *gormigrate.Migration {
return &gormigrate.Migration{
ID: "202505120001",
ID: "202605060003",
Migrate: func(tx *gorm.DB) error {
return tx.Exec(`ALTER TABLE IF EXISTS credentials DROP COLUMN IF EXISTS project_id`).Error
},
Expand Down
2 changes: 1 addition & 1 deletion components/ambient-api-server/plugins/projects/migration.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ func promptMigration() *gormigrate.Migration {

func dropDisplayNameMigration() *gormigrate.Migration {
return &gormigrate.Migration{
ID: "202505090001",
ID: "202605060002",
Migrate: func(tx *gorm.DB) error {
return tx.Exec(`ALTER TABLE IF EXISTS projects DROP COLUMN IF EXISTS display_name`).Error
},
Expand Down
10 changes: 7 additions & 3 deletions components/ambient-api-server/plugins/roleBindings/migration.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,15 +34,19 @@ func typedFKMigration() *gormigrate.Migration {
return &gormigrate.Migration{
ID: "202603100139",
Migrate: func(tx *gorm.DB) error {
// Drop the old unique index that depends on scope_id before altering columns
var exists bool
if err := tx.Raw(`SELECT EXISTS (SELECT 1 FROM information_schema.tables WHERE table_name = 'role_bindings')`).Scan(&exists).Error; err != nil {
return err
}
if !exists {
return nil
}
if err := tx.Exec(`DROP INDEX IF EXISTS idx_binding_lookup`).Error; err != nil {
return err
}
// Make user_id nullable
if err := tx.Exec(`ALTER TABLE role_bindings ALTER COLUMN user_id DROP NOT NULL`).Error; err != nil {
return err
}
// Drop scope_id column (replaced by typed FKs)
if err := tx.Exec(`ALTER TABLE role_bindings DROP COLUMN IF EXISTS scope_id`).Error; err != nil {
return err
}
Expand Down
Loading
Loading