From d97a2a0212090417bbcd4db1d7b06735475c3a76 Mon Sep 17 00:00:00 2001 From: Nikhil Date: Tue, 4 Aug 2026 16:37:25 -0700 Subject: [PATCH 1/5] fix(weave): consolidate trace workload identities --- charts/operator-wandb/Chart.yaml | 2 +- .../tests/azure_storage_auth_test.yaml | 4 +-- charts/operator-wandb/values.yaml | 14 ++++++++ .../azure-workload-identity.snap | 2 +- .../__snapshots__/mcp-server.snap | 6 ++-- .../__snapshots__/olap-features-enabled.snap | 6 ++-- .../user-defined-clickhouse-secret.snap | 4 +-- .../weave-trace-with-worker.snap | 36 +++---------------- .../__snapshots__/weave-trace.snap | 6 ++-- 9 files changed, 34 insertions(+), 46 deletions(-) diff --git a/charts/operator-wandb/Chart.yaml b/charts/operator-wandb/Chart.yaml index 6ddf79497..a9eecadc3 100644 --- a/charts/operator-wandb/Chart.yaml +++ b/charts/operator-wandb/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: operator-wandb description: A Helm chart for deploying W&B to Kubernetes type: application -version: 0.44.5 +version: 0.44.6 appVersion: 1.0.0 icon: https://wandb.ai/logo.svg diff --git a/charts/operator-wandb/tests/azure_storage_auth_test.yaml b/charts/operator-wandb/tests/azure_storage_auth_test.yaml index a2795aa4a..cfb74d624 100644 --- a/charts/operator-wandb/tests/azure_storage_auth_test.yaml +++ b/charts/operator-wandb/tests/azure_storage_auth_test.yaml @@ -462,7 +462,7 @@ tests: - hasDocuments: count: 0 - - it: keeps Weave on its component account when its default bucket gate is disabled + - it: uses the trace ServiceAccount when its default bucket gate is disabled template: charts/weave-trace/templates/deployment.yaml set: weave-trace: @@ -488,7 +488,7 @@ tests: asserts: - equal: path: spec.template.spec.serviceAccountName - value: chartsnap-weave-trace + value: wandb-weave-trace - it: gives Bufstream the shared account and suppresses its component account template: charts/bufstream/templates/deployment.yaml diff --git a/charts/operator-wandb/values.yaml b/charts/operator-wandb/values.yaml index e341851b0..aa630d82b 100644 --- a/charts/operator-wandb/values.yaml +++ b/charts/operator-wandb/values.yaml @@ -853,6 +853,8 @@ app: tag: latest # TODO(dpanzella) Read from here for backwards compatability, needs to be moved so API can access as well internalJWTMap: + - subject: "system:serviceaccount:{{ .Release.Namespace }}:wandb-weave-trace" + issuer: "https://kubernetes.default.svc.cluster.local" - subject: "system:serviceaccount:{{ .Release.Namespace }}:{{ .Release.Name }}-weave-trace" issuer: "https://kubernetes.default.svc.cluster.local" - subject: "system:serviceaccount:{{ .Release.Namespace }}:{{ .Release.Name }}-weave-trace-worker" @@ -3856,6 +3858,9 @@ mcp-server: weave-trace: install: false + serviceAccount: + create: true + name: wandb-weave-trace deploymentPostfix: "bc" podLabels: azure.workload.identity/use: '{{ include `wandb.weaveTraceUsesAzureWorkloadIdentity` . }}' @@ -3997,6 +4002,9 @@ weave-trace: weave-trace-worker: install: false + serviceAccount: + create: false + name: wandb-weave-trace deploymentPostfix: "bc" podLabels: azure.workload.identity/use: '{{ include `wandb.weaveTraceUsesAzureWorkloadIdentity` . }}' @@ -4109,6 +4117,9 @@ weave-trace-worker: weave-evaluate-model-worker: install: false + serviceAccount: + create: false + name: wandb-weave-trace deploymentPostfix: "bc" podLabels: azure.workload.identity/use: '{{ include `wandb.weaveTraceUsesAzureWorkloadIdentity` . }}' @@ -4215,6 +4226,9 @@ weave-evaluate-model-worker: weave-trace-agent-scoring-worker: install: false + serviceAccount: + create: false + name: wandb-weave-trace deploymentPostfix: "bc" podLabels: azure.workload.identity/use: '{{ include `wandb.weaveTraceUsesAzureWorkloadIdentity` . }}' diff --git a/test-configs/operator-wandb/__snapshots__/azure-workload-identity.snap b/test-configs/operator-wandb/__snapshots__/azure-workload-identity.snap index 8faad4455..36d57bdd2 100644 --- a/test-configs/operator-wandb/__snapshots__/azure-workload-identity.snap +++ b/test-configs/operator-wandb/__snapshots__/azure-workload-identity.snap @@ -897,7 +897,7 @@ data: GORILLA_RUN_UPDATE_QUEUE_ADDR: "internal://" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_NAME: "wandb" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_PREFIX: "wandb-overflow" - GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace-worker": "https://kubernetes.default.svc.cluster.local"}' + GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:wandb-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace-worker": "https://kubernetes.default.svc.cluster.local"}' GORILLA_WEAVE_TRACE_SERVER_URL: "http://localhost:8080/traces" GORILLA_TASK_QUEUE_WORKER_ENABLED: "false" GORILLA_LOCAL_SERVICE_BYPASS: 'false' diff --git a/test-configs/operator-wandb/__snapshots__/mcp-server.snap b/test-configs/operator-wandb/__snapshots__/mcp-server.snap index 67544abaa..9ea697316 100644 --- a/test-configs/operator-wandb/__snapshots__/mcp-server.snap +++ b/test-configs/operator-wandb/__snapshots__/mcp-server.snap @@ -497,7 +497,7 @@ metadata: apiVersion: v1 kind: ServiceAccount metadata: - name: chartsnap-weave-trace + name: wandb-weave-trace labels: helm.sh/chart: '###CHART_VERSION###' app.kubernetes.io/name: weave-trace @@ -1617,7 +1617,7 @@ data: GORILLA_RUN_UPDATE_QUEUE_ADDR: "internal://" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_NAME: "wandb" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_PREFIX: "wandb-overflow" - GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace-worker": "https://kubernetes.default.svc.cluster.local"}' + GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:wandb-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace-worker": "https://kubernetes.default.svc.cluster.local"}' GORILLA_WEAVE_TRACE_SERVER_URL: "https://wandb.example.com/traces" GORILLA_TASK_QUEUE_WORKER_ENABLED: "false" GORILLA_LOCAL_SERVICE_BYPASS: 'false' @@ -6127,7 +6127,7 @@ spec: subPath: redis_ca.pem - mountPath: /tmp/ name: temp-dir - serviceAccountName: chartsnap-weave-trace + serviceAccountName: wandb-weave-trace securityContext: fsGroup: 0 fsGroupChangePolicy: OnRootMismatch diff --git a/test-configs/operator-wandb/__snapshots__/olap-features-enabled.snap b/test-configs/operator-wandb/__snapshots__/olap-features-enabled.snap index 0bef091b0..317111ba9 100644 --- a/test-configs/operator-wandb/__snapshots__/olap-features-enabled.snap +++ b/test-configs/operator-wandb/__snapshots__/olap-features-enabled.snap @@ -599,7 +599,7 @@ metadata: apiVersion: v1 kind: ServiceAccount metadata: - name: chartsnap-weave-trace + name: wandb-weave-trace labels: helm.sh/chart: '###CHART_VERSION###' app.kubernetes.io/name: weave-trace @@ -1761,7 +1761,7 @@ data: GORILLA_RUN_UPDATE_QUEUE_ADDR: "internal://" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_NAME: "wandb" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_PREFIX: "wandb-overflow" - GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace-worker": "https://kubernetes.default.svc.cluster.local"}' + GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:wandb-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace-worker": "https://kubernetes.default.svc.cluster.local"}' GORILLA_WEAVE_TRACE_SERVER_URL: "http://localhost:8080/traces" GORILLA_TASK_QUEUE_WORKER_ENABLED: "false" GORILLA_LOCAL_SERVICE_BYPASS: 'false' @@ -7058,7 +7058,7 @@ spec: subPath: redis_ca.pem - mountPath: /tmp/ name: temp-dir - serviceAccountName: chartsnap-weave-trace + serviceAccountName: wandb-weave-trace securityContext: fsGroup: 0 fsGroupChangePolicy: OnRootMismatch diff --git a/test-configs/operator-wandb/__snapshots__/user-defined-clickhouse-secret.snap b/test-configs/operator-wandb/__snapshots__/user-defined-clickhouse-secret.snap index 37c9cc617..8a6d1d625 100644 --- a/test-configs/operator-wandb/__snapshots__/user-defined-clickhouse-secret.snap +++ b/test-configs/operator-wandb/__snapshots__/user-defined-clickhouse-secret.snap @@ -224,7 +224,7 @@ metadata: apiVersion: v1 kind: ServiceAccount metadata: - name: chartsnap-weave-trace + name: wandb-weave-trace labels: helm.sh/chart: '###CHART_VERSION###' app.kubernetes.io/name: weave-trace @@ -3833,7 +3833,7 @@ spec: subPath: redis_ca.pem - mountPath: /tmp/ name: temp-dir - serviceAccountName: chartsnap-weave-trace + serviceAccountName: wandb-weave-trace securityContext: fsGroup: 0 fsGroupChangePolicy: OnRootMismatch diff --git a/test-configs/operator-wandb/__snapshots__/weave-trace-with-worker.snap b/test-configs/operator-wandb/__snapshots__/weave-trace-with-worker.snap index 562b27a93..9c90769cb 100644 --- a/test-configs/operator-wandb/__snapshots__/weave-trace-with-worker.snap +++ b/test-configs/operator-wandb/__snapshots__/weave-trace-with-worker.snap @@ -715,37 +715,11 @@ metadata: name: chartsnap-reloader namespace: default --- -# Source: operator-wandb/charts/weave-evaluate-model-worker/templates/serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: chartsnap-weave-evaluate-model-worker - labels: - helm.sh/chart: '###CHART_VERSION###' - app.kubernetes.io/name: weave-evaluate-model-worker - app.kubernetes.io/instance: chartsnap - app.kubernetes.io/version: "latest" - app.kubernetes.io/managed-by: Helm -automountServiceAccountToken: true ---- -# Source: operator-wandb/charts/weave-trace-worker/templates/serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: chartsnap-weave-trace-worker - labels: - helm.sh/chart: '###CHART_VERSION###' - app.kubernetes.io/name: weave-trace-worker - app.kubernetes.io/instance: chartsnap - app.kubernetes.io/version: "latest" - app.kubernetes.io/managed-by: Helm -automountServiceAccountToken: true ---- # Source: operator-wandb/charts/weave-trace/templates/serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: - name: chartsnap-weave-trace + name: wandb-weave-trace labels: helm.sh/chart: '###CHART_VERSION###' app.kubernetes.io/name: weave-trace @@ -1932,7 +1906,7 @@ data: GORILLA_RUN_UPDATE_QUEUE_ADDR: "internal://" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_NAME: "wandb" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_PREFIX: "wandb-overflow" - GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace-worker": "https://kubernetes.default.svc.cluster.local"}' + GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:wandb-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace-worker": "https://kubernetes.default.svc.cluster.local"}' GORILLA_WEAVE_TRACE_SERVER_URL: "http://localhost:8080/traces" GORILLA_TASK_QUEUE_WORKER_ENABLED: "false" GORILLA_LOCAL_SERVICE_BYPASS: 'false' @@ -7117,7 +7091,7 @@ spec: - name: redis-ca mountPath: /etc/ssl/certs/redis_ca.pem subPath: redis_ca.pem - serviceAccountName: chartsnap-weave-evaluate-model-worker + serviceAccountName: wandb-weave-trace securityContext: fsGroup: 0 fsGroupChangePolicy: OnRootMismatch @@ -7271,7 +7245,7 @@ spec: subPath: redis_ca.pem - mountPath: /tmp/weave-trace/internal-jwt name: weave-trace-internal-jwt - serviceAccountName: chartsnap-weave-trace-worker + serviceAccountName: wandb-weave-trace securityContext: fsGroup: 0 fsGroupChangePolicy: OnRootMismatch @@ -7517,7 +7491,7 @@ spec: subPath: redis_ca.pem - mountPath: /tmp/ name: temp-dir - serviceAccountName: chartsnap-weave-trace + serviceAccountName: wandb-weave-trace securityContext: fsGroup: 0 fsGroupChangePolicy: OnRootMismatch diff --git a/test-configs/operator-wandb/__snapshots__/weave-trace.snap b/test-configs/operator-wandb/__snapshots__/weave-trace.snap index 43aa14002..4ad00e417 100644 --- a/test-configs/operator-wandb/__snapshots__/weave-trace.snap +++ b/test-configs/operator-wandb/__snapshots__/weave-trace.snap @@ -599,7 +599,7 @@ metadata: apiVersion: v1 kind: ServiceAccount metadata: - name: chartsnap-weave-trace + name: wandb-weave-trace labels: helm.sh/chart: '###CHART_VERSION###' app.kubernetes.io/name: weave-trace @@ -1719,7 +1719,7 @@ data: GORILLA_RUN_UPDATE_QUEUE_ADDR: "internal://" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_NAME: "wandb" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_PREFIX: "wandb-overflow" - GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace-worker": "https://kubernetes.default.svc.cluster.local"}' + GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:wandb-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace-worker": "https://kubernetes.default.svc.cluster.local"}' GORILLA_WEAVE_TRACE_SERVER_URL: "http://localhost:8080/traces" GORILLA_TASK_QUEUE_WORKER_ENABLED: "false" GORILLA_LOCAL_SERVICE_BYPASS: 'false' @@ -6897,7 +6897,7 @@ spec: subPath: redis_ca.pem - mountPath: /tmp/ name: temp-dir - serviceAccountName: chartsnap-weave-trace + serviceAccountName: wandb-weave-trace securityContext: fsGroup: 0 fsGroupChangePolicy: OnRootMismatch From 8f56433cb5638631665d17f0241f86295a35b6a1 Mon Sep 17 00:00:00 2001 From: Nikhil Date: Wed, 5 Aug 2026 16:01:45 -0700 Subject: [PATCH 2/5] fix(weave): remove duplicate trace jwt subject --- charts/operator-wandb/values.yaml | 2 -- .../operator-wandb/__snapshots__/azure-workload-identity.snap | 2 +- test-configs/operator-wandb/__snapshots__/mcp-server.snap | 2 +- .../operator-wandb/__snapshots__/olap-features-enabled.snap | 2 +- .../operator-wandb/__snapshots__/weave-trace-with-worker.snap | 2 +- test-configs/operator-wandb/__snapshots__/weave-trace.snap | 2 +- 6 files changed, 5 insertions(+), 7 deletions(-) diff --git a/charts/operator-wandb/values.yaml b/charts/operator-wandb/values.yaml index aa630d82b..6603d12be 100644 --- a/charts/operator-wandb/values.yaml +++ b/charts/operator-wandb/values.yaml @@ -853,8 +853,6 @@ app: tag: latest # TODO(dpanzella) Read from here for backwards compatability, needs to be moved so API can access as well internalJWTMap: - - subject: "system:serviceaccount:{{ .Release.Namespace }}:wandb-weave-trace" - issuer: "https://kubernetes.default.svc.cluster.local" - subject: "system:serviceaccount:{{ .Release.Namespace }}:{{ .Release.Name }}-weave-trace" issuer: "https://kubernetes.default.svc.cluster.local" - subject: "system:serviceaccount:{{ .Release.Namespace }}:{{ .Release.Name }}-weave-trace-worker" diff --git a/test-configs/operator-wandb/__snapshots__/azure-workload-identity.snap b/test-configs/operator-wandb/__snapshots__/azure-workload-identity.snap index 36d57bdd2..8faad4455 100644 --- a/test-configs/operator-wandb/__snapshots__/azure-workload-identity.snap +++ b/test-configs/operator-wandb/__snapshots__/azure-workload-identity.snap @@ -897,7 +897,7 @@ data: GORILLA_RUN_UPDATE_QUEUE_ADDR: "internal://" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_NAME: "wandb" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_PREFIX: "wandb-overflow" - GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:wandb-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace-worker": "https://kubernetes.default.svc.cluster.local"}' + GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace-worker": "https://kubernetes.default.svc.cluster.local"}' GORILLA_WEAVE_TRACE_SERVER_URL: "http://localhost:8080/traces" GORILLA_TASK_QUEUE_WORKER_ENABLED: "false" GORILLA_LOCAL_SERVICE_BYPASS: 'false' diff --git a/test-configs/operator-wandb/__snapshots__/mcp-server.snap b/test-configs/operator-wandb/__snapshots__/mcp-server.snap index 9ea697316..5e655bb49 100644 --- a/test-configs/operator-wandb/__snapshots__/mcp-server.snap +++ b/test-configs/operator-wandb/__snapshots__/mcp-server.snap @@ -1617,7 +1617,7 @@ data: GORILLA_RUN_UPDATE_QUEUE_ADDR: "internal://" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_NAME: "wandb" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_PREFIX: "wandb-overflow" - GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:wandb-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace-worker": "https://kubernetes.default.svc.cluster.local"}' + GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace-worker": "https://kubernetes.default.svc.cluster.local"}' GORILLA_WEAVE_TRACE_SERVER_URL: "https://wandb.example.com/traces" GORILLA_TASK_QUEUE_WORKER_ENABLED: "false" GORILLA_LOCAL_SERVICE_BYPASS: 'false' diff --git a/test-configs/operator-wandb/__snapshots__/olap-features-enabled.snap b/test-configs/operator-wandb/__snapshots__/olap-features-enabled.snap index 317111ba9..32bfdc56b 100644 --- a/test-configs/operator-wandb/__snapshots__/olap-features-enabled.snap +++ b/test-configs/operator-wandb/__snapshots__/olap-features-enabled.snap @@ -1761,7 +1761,7 @@ data: GORILLA_RUN_UPDATE_QUEUE_ADDR: "internal://" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_NAME: "wandb" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_PREFIX: "wandb-overflow" - GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:wandb-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace-worker": "https://kubernetes.default.svc.cluster.local"}' + GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace-worker": "https://kubernetes.default.svc.cluster.local"}' GORILLA_WEAVE_TRACE_SERVER_URL: "http://localhost:8080/traces" GORILLA_TASK_QUEUE_WORKER_ENABLED: "false" GORILLA_LOCAL_SERVICE_BYPASS: 'false' diff --git a/test-configs/operator-wandb/__snapshots__/weave-trace-with-worker.snap b/test-configs/operator-wandb/__snapshots__/weave-trace-with-worker.snap index 9c90769cb..751520267 100644 --- a/test-configs/operator-wandb/__snapshots__/weave-trace-with-worker.snap +++ b/test-configs/operator-wandb/__snapshots__/weave-trace-with-worker.snap @@ -1906,7 +1906,7 @@ data: GORILLA_RUN_UPDATE_QUEUE_ADDR: "internal://" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_NAME: "wandb" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_PREFIX: "wandb-overflow" - GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:wandb-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace-worker": "https://kubernetes.default.svc.cluster.local"}' + GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace-worker": "https://kubernetes.default.svc.cluster.local"}' GORILLA_WEAVE_TRACE_SERVER_URL: "http://localhost:8080/traces" GORILLA_TASK_QUEUE_WORKER_ENABLED: "false" GORILLA_LOCAL_SERVICE_BYPASS: 'false' diff --git a/test-configs/operator-wandb/__snapshots__/weave-trace.snap b/test-configs/operator-wandb/__snapshots__/weave-trace.snap index 4ad00e417..10a437a1a 100644 --- a/test-configs/operator-wandb/__snapshots__/weave-trace.snap +++ b/test-configs/operator-wandb/__snapshots__/weave-trace.snap @@ -1719,7 +1719,7 @@ data: GORILLA_RUN_UPDATE_QUEUE_ADDR: "internal://" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_NAME: "wandb" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_PREFIX: "wandb-overflow" - GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:wandb-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace-worker": "https://kubernetes.default.svc.cluster.local"}' + GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace-worker": "https://kubernetes.default.svc.cluster.local"}' GORILLA_WEAVE_TRACE_SERVER_URL: "http://localhost:8080/traces" GORILLA_TASK_QUEUE_WORKER_ENABLED: "false" GORILLA_LOCAL_SERVICE_BYPASS: 'false' From 144f61ecd04f955d9888f49db7056cf9c6dc269d Mon Sep 17 00:00:00 2001 From: Nikhil Date: Tue, 11 Aug 2026 15:02:42 -0700 Subject: [PATCH 3/5] fix(weave): derive shared trace service account --- charts/lumen/Chart.lock | 8 +- charts/lumen/Chart.yaml | 6 +- charts/operator-wandb/Chart.lock | 60 ++++++------ charts/operator-wandb/Chart.yaml | 54 +++++------ .../tests/azure_storage_auth_test.yaml | 2 +- .../weave_trace_service_account_test.yaml | 92 +++++++++++++++++++ charts/operator-wandb/values.yaml | 12 +-- charts/orchestrator/Chart.lock | 12 +-- charts/orchestrator/Chart.yaml | 10 +- charts/wandb-base/Chart.yaml | 2 +- charts/wandb-base/templates/_helpers.tpl | 9 ++ .../wandb-base/templates/serviceaccount.yaml | 5 +- charts/wandb-base/values.yaml | 1 + .../__snapshots__/mcp-server.snap | 4 +- .../__snapshots__/olap-features-enabled.snap | 4 +- .../user-defined-clickhouse-secret.snap | 4 +- .../weave-trace-with-worker.snap | 8 +- .../__snapshots__/weave-trace.snap | 4 +- 18 files changed, 198 insertions(+), 99 deletions(-) create mode 100644 charts/operator-wandb/tests/weave_trace_service_account_test.yaml diff --git a/charts/lumen/Chart.lock b/charts/lumen/Chart.lock index a8766e120..641ee3e74 100644 --- a/charts/lumen/Chart.lock +++ b/charts/lumen/Chart.lock @@ -1,9 +1,9 @@ dependencies: - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 -digest: sha256:60d1023fe307cba27e2dfe573be514601dc0dcacb6d72f91323615fedaa42772 -generated: "2026-07-29T18:00:40.632395-05:00" + version: 0.12.7 +digest: sha256:6a4d35030d930a8ad4f6a1ada246116749584e084a7a6f2b2f2f48de13e0c990 +generated: "2026-08-11T14:59:58.54023-07:00" diff --git a/charts/lumen/Chart.yaml b/charts/lumen/Chart.yaml index 39f3c2f64..8c0a1e615 100644 --- a/charts/lumen/Chart.yaml +++ b/charts/lumen/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: lumen description: A Helm chart for deploying the W&B Lumen processor and notebook type: application -version: 0.2.5 +version: 0.2.6 appVersion: 1.0.0 maintainers: @@ -13,9 +13,9 @@ maintainers: dependencies: - name: wandb-base alias: processor - version: "0.12.6" + version: "0.12.7" repository: file://../wandb-base - name: wandb-base alias: notebook - version: "0.12.6" + version: "0.12.7" repository: file://../wandb-base diff --git a/charts/operator-wandb/Chart.lock b/charts/operator-wandb/Chart.lock index 302ff76e6..e38f3c9d8 100644 --- a/charts/operator-wandb/Chart.lock +++ b/charts/operator-wandb/Chart.lock @@ -1,43 +1,43 @@ dependencies: - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: mysql repository: file://charts/mysql version: 0.1.0 @@ -61,19 +61,19 @@ dependencies: version: 0.1.0 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: stackdriver repository: file://charts/stackdriver version: 0.1.0 @@ -82,39 +82,39 @@ dependencies: version: 0.1.0 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: reloader repository: https://stakater.github.io/stakater-charts version: 1.3.0 - name: clickhouse repository: file://charts/clickhouse version: 9.1.1 -digest: sha256:039ae3137a49174b04980ea7cafdd5f83fc517a898b577278b76a587b1723266 -generated: "2026-08-05T08:44:45.513577-05:00" +digest: sha256:1986ad265b0aaca94ee3286ce5b4f08e3841c9813bf22a16cc7ec97925d61a52 +generated: "2026-08-11T14:59:55.991901-07:00" diff --git a/charts/operator-wandb/Chart.yaml b/charts/operator-wandb/Chart.yaml index a9eecadc3..207420d65 100644 --- a/charts/operator-wandb/Chart.yaml +++ b/charts/operator-wandb/Chart.yaml @@ -14,67 +14,67 @@ maintainers: dependencies: - name: wandb-base alias: app - version: "0.12.6" + version: "0.12.7" repository: file://../wandb-base condition: app.install - name: wandb-base alias: appRenamePreHook - version: "0.12.6" + version: "0.12.7" repository: file://../wandb-base condition: appRenamePreHook.install - name: wandb-base alias: appRenamePostHook - version: "0.12.6" + version: "0.12.7" repository: file://../wandb-base condition: appRenamePostHook.install - name: wandb-base alias: api condition: global.api.enabled repository: file://../wandb-base - version: "0.12.6" + version: "0.12.7" - name: wandb-base alias: console - version: "0.12.6" + version: "0.12.7" repository: file://../wandb-base condition: console.install - name: wandb-base alias: weave - version: "0.12.6" + version: "0.12.7" repository: file://../wandb-base condition: weave.install - name: wandb-base alias: weave-trace - version: "0.12.6" + version: "0.12.7" repository: file://../wandb-base condition: weave-trace.install - name: wandb-base alias: weave-trace-worker - version: "0.12.6" + version: "0.12.7" repository: file://../wandb-base condition: weave-trace-worker.install - name: wandb-base alias: weave-evaluate-model-worker - version: "0.12.6" + version: "0.12.7" repository: file://../wandb-base condition: weave-evaluate-model-worker.install - name: wandb-base alias: weave-trace-agent-scoring-worker - version: "0.12.6" + version: "0.12.7" repository: file://../wandb-base condition: weave-trace-agent-scoring-worker.install - name: wandb-base alias: executor - version: "0.12.6" + version: "0.12.7" repository: file://../wandb-base condition: executor.install - name: wandb-base alias: parquet - version: "0.12.6" + version: "0.12.7" repository: file://../wandb-base condition: parquet.install - name: wandb-base alias: parquet-metadata-cache - version: "0.12.6" + version: "0.12.7" repository: file://../wandb-base condition: parquet-metadata-cache.install - name: mysql @@ -109,20 +109,20 @@ dependencies: alias: flat-run-fields-updater condition: flat-run-fields-updater.install repository: file://../wandb-base - version: "0.12.6" + version: "0.12.7" - name: wandb-base alias: history-updater condition: history-updater.install repository: file://../wandb-base - version: "0.12.6" + version: "0.12.7" - name: wandb-base alias: run-store-accelerator-run-updater condition: run-store-accelerator-run-updater.install repository: file://../wandb-base - version: "0.12.6" + version: "0.12.7" - name: wandb-base alias: filestream - version: "0.12.6" + version: "0.12.7" repository: file://../wandb-base condition: filestream.install - name: wandb-base @@ -142,52 +142,52 @@ dependencies: alias: frontend condition: frontend.install repository: file://../wandb-base - version: "0.12.6" + version: "0.12.7" - name: wandb-base alias: filemeta condition: filemeta.install repository: file://../wandb-base - version: "0.12.6" + version: "0.12.7" - name: wandb-base alias: anaconda2 condition: anaconda2.install repository: file://../wandb-base - version: "0.12.6" + version: "0.12.7" - name: wandb-base alias: internalSignerPreHook condition: global.localService.bypass repository: file://../wandb-base - version: "0.12.6" + version: "0.12.7" - name: wandb-base alias: metric-observer condition: metric-observer.install repository: file://../wandb-base - version: "0.12.6" + version: "0.12.7" - name: wandb-base alias: glue condition: global.glue.enabled repository: file://../wandb-base - version: "0.12.6" + version: "0.12.7" - name: wandb-base alias: settingsMigrationJob condition: settingsMigrationJob.install repository: file://../wandb-base - version: "0.12.6" + version: "0.12.7" - name: wandb-base alias: clickhouseMigrationJob condition: clickhouseMigrationJob.install repository: file://../wandb-base - version: "0.12.6" + version: "0.12.7" - name: wandb-base alias: mcp-server condition: mcp-server.install repository: file://../wandb-base - version: "0.12.6" + version: "0.12.7" - name: wandb-base alias: lumen-agent condition: lumen-agent.install repository: file://../wandb-base - version: "0.12.6" + version: "0.12.7" - name: reloader condition: reloader.install version: 1.3.0 diff --git a/charts/operator-wandb/tests/azure_storage_auth_test.yaml b/charts/operator-wandb/tests/azure_storage_auth_test.yaml index cfb74d624..3bc7967d9 100644 --- a/charts/operator-wandb/tests/azure_storage_auth_test.yaml +++ b/charts/operator-wandb/tests/azure_storage_auth_test.yaml @@ -488,7 +488,7 @@ tests: asserts: - equal: path: spec.template.spec.serviceAccountName - value: wandb-weave-trace + value: chartsnap-weave-trace - it: gives Bufstream the shared account and suppresses its component account template: charts/bufstream/templates/deployment.yaml diff --git a/charts/operator-wandb/tests/weave_trace_service_account_test.yaml b/charts/operator-wandb/tests/weave_trace_service_account_test.yaml new file mode 100644 index 000000000..a53300a41 --- /dev/null +++ b/charts/operator-wandb/tests/weave_trace_service_account_test.yaml @@ -0,0 +1,92 @@ +suite: Weave Trace service account +templates: + - charts/weave-trace/templates/deployment.yaml + - charts/weave-trace/templates/serviceaccount.yaml + - charts/weave-trace-worker/templates/deployment.yaml + - charts/weave-trace-worker/templates/serviceaccount.yaml + - charts/weave-evaluate-model-worker/templates/deployment.yaml + - charts/weave-evaluate-model-worker/templates/serviceaccount.yaml + - charts/weave-trace-agent-scoring-worker/templates/deployment.yaml + - charts/weave-trace-agent-scoring-worker/templates/serviceaccount.yaml +release: + name: custom-release + +tests: + - it: derives the trace ServiceAccount from the release name + template: charts/weave-trace/templates/deployment.yaml + set: + weave-trace: + install: true + asserts: + - equal: + path: spec.template.spec.serviceAccountName + value: custom-release-weave-trace + + - it: creates the release-derived trace ServiceAccount + template: charts/weave-trace/templates/serviceaccount.yaml + set: + weave-trace: + install: true + asserts: + - hasDocuments: + count: 1 + - equal: + path: metadata.name + value: custom-release-weave-trace + + - it: gives the trace worker the release-derived trace ServiceAccount + template: charts/weave-trace-worker/templates/deployment.yaml + set: + weave-trace-worker: + install: true + asserts: + - equal: + path: spec.template.spec.serviceAccountName + value: custom-release-weave-trace + + - it: does not create a trace worker ServiceAccount + template: charts/weave-trace-worker/templates/serviceaccount.yaml + set: + weave-trace-worker: + install: true + asserts: + - hasDocuments: + count: 0 + + - it: gives the evaluate-model worker the release-derived trace ServiceAccount + template: charts/weave-evaluate-model-worker/templates/deployment.yaml + set: + weave-evaluate-model-worker: + install: true + asserts: + - equal: + path: spec.template.spec.serviceAccountName + value: custom-release-weave-trace + + - it: does not create an evaluate-model worker ServiceAccount + template: charts/weave-evaluate-model-worker/templates/serviceaccount.yaml + set: + weave-evaluate-model-worker: + install: true + asserts: + - hasDocuments: + count: 0 + + - it: gives the agent-scoring worker the release-derived trace ServiceAccount + template: charts/weave-trace-agent-scoring-worker/templates/deployment.yaml + set: + weave-trace-agent-scoring-worker: + install: true + asserts: + - equal: + path: spec.template.spec.serviceAccountName + value: custom-release-weave-trace + + - it: does not create an agent-scoring worker ServiceAccount + template: charts/weave-trace-agent-scoring-worker/templates/serviceaccount.yaml + set: + weave-trace-agent-scoring-worker: + install: true + asserts: + - hasDocuments: + count: 0 diff --git a/charts/operator-wandb/values.yaml b/charts/operator-wandb/values.yaml index 6603d12be..9e4f9ad5e 100644 --- a/charts/operator-wandb/values.yaml +++ b/charts/operator-wandb/values.yaml @@ -3856,9 +3856,6 @@ mcp-server: weave-trace: install: false - serviceAccount: - create: true - name: wandb-weave-trace deploymentPostfix: "bc" podLabels: azure.workload.identity/use: '{{ include `wandb.weaveTraceUsesAzureWorkloadIdentity` . }}' @@ -4001,8 +3998,7 @@ weave-trace: weave-trace-worker: install: false serviceAccount: - create: false - name: wandb-weave-trace + useWeaveTraceIdentity: true deploymentPostfix: "bc" podLabels: azure.workload.identity/use: '{{ include `wandb.weaveTraceUsesAzureWorkloadIdentity` . }}' @@ -4116,8 +4112,7 @@ weave-trace-worker: weave-evaluate-model-worker: install: false serviceAccount: - create: false - name: wandb-weave-trace + useWeaveTraceIdentity: true deploymentPostfix: "bc" podLabels: azure.workload.identity/use: '{{ include `wandb.weaveTraceUsesAzureWorkloadIdentity` . }}' @@ -4225,8 +4220,7 @@ weave-evaluate-model-worker: weave-trace-agent-scoring-worker: install: false serviceAccount: - create: false - name: wandb-weave-trace + useWeaveTraceIdentity: true deploymentPostfix: "bc" podLabels: azure.workload.identity/use: '{{ include `wandb.weaveTraceUsesAzureWorkloadIdentity` . }}' diff --git a/charts/orchestrator/Chart.lock b/charts/orchestrator/Chart.lock index d124074ca..279e035f2 100644 --- a/charts/orchestrator/Chart.lock +++ b/charts/orchestrator/Chart.lock @@ -4,15 +4,15 @@ dependencies: version: 0.2.4 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 + version: 0.12.7 - name: wandb-base repository: file://../wandb-base - version: 0.12.6 -digest: sha256:e2514816c2f8ca70a4f0db5e1f76ce8a211f106d46c2d685094f7ae8da4855b6 -generated: "2026-07-29T18:00:53.549681-05:00" + version: 0.12.7 +digest: sha256:31d5aeb4b27d864b5238e142b54c7a95426c64d4c408afaadee643e6dcb7b78e +generated: "2026-08-11T15:00:00.655789-07:00" diff --git a/charts/orchestrator/Chart.yaml b/charts/orchestrator/Chart.yaml index 625f908ee..873b0feba 100644 --- a/charts/orchestrator/Chart.yaml +++ b/charts/orchestrator/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: orchestrator description: Orchestrator Helm chart for Kubernetes type: application -version: 1.4.3 +version: 1.4.4 appVersion: 1.0.0 maintainers: @@ -18,19 +18,19 @@ dependencies: - alias: web name: wandb-base condition: web.install - version: "0.12.6" + version: "0.12.7" repository: "file://../wandb-base" - alias: workspace-engine name: wandb-base condition: workspace-engine.install - version: "0.12.6" + version: "0.12.7" repository: "file://../wandb-base" - alias: workspace-engine-controllers name: wandb-base condition: workspace-engine-controllers.install - version: "0.12.6" + version: "0.12.7" repository: "file://../wandb-base" - alias: identity name: wandb-base - version: "0.12.6" + version: "0.12.7" repository: "file://../wandb-base" diff --git a/charts/wandb-base/Chart.yaml b/charts/wandb-base/Chart.yaml index a61508240..2d53fa4e2 100644 --- a/charts/wandb-base/Chart.yaml +++ b/charts/wandb-base/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: wandb-base description: A generic helm chart for deploying services to kubernetes type: application -version: 0.12.6 +version: 0.12.7 icon: https://wandb.ai/logo.svg maintainers: diff --git a/charts/wandb-base/templates/_helpers.tpl b/charts/wandb-base/templates/_helpers.tpl index 1171e863c..0c0c4dfa7 100644 --- a/charts/wandb-base/templates/_helpers.tpl +++ b/charts/wandb-base/templates/_helpers.tpl @@ -87,6 +87,8 @@ Create the name of the service account to use {{- define "wandb-base.serviceAccountName" -}} {{- if include "wandb-base.azureStorageServiceAccountEnabled" . | trim | eq "true" }} {{- include "wandb-base.azureStorageServiceAccountName" . }} + {{- else if .Values.serviceAccount.useWeaveTraceIdentity }} +{{- include "wandb-base.weaveTraceServiceAccountName" . }} {{- else if .Values.serviceAccount.create }} {{- default (include "wandb-base.fullname" .) .Values.serviceAccount.name }} {{- else }} @@ -130,6 +132,13 @@ their component accounts. {{- default "wandb-bucket-access" $serviceAccount.name -}} {{- end }} +{{/* +Create the name of the shared Weave Trace service account. +*/}} +{{- define "wandb-base.weaveTraceServiceAccountName" -}} + {{- printf "%s-weave-trace" .Release.Name -}} +{{- end }} + {{- define "wandb-base.deploymentRolloutStrategy" -}} {{- if eq .Values.strategy.type "RollingUpdate" }} type: RollingUpdate diff --git a/charts/wandb-base/templates/serviceaccount.yaml b/charts/wandb-base/templates/serviceaccount.yaml index 12babfdd5..716fe96c7 100644 --- a/charts/wandb-base/templates/serviceaccount.yaml +++ b/charts/wandb-base/templates/serviceaccount.yaml @@ -1,4 +1,7 @@ -{{- if and .Values.serviceAccount.create (not (include "wandb-base.azureStorageServiceAccountEnabled" . | trim | eq "true")) -}} +{{- if and .Values.serviceAccount.create +(not (include "wandb-base.azureStorageServiceAccountEnabled" . | trim | eq "true")) +(not .Values.serviceAccount.useWeaveTraceIdentity) +-}} apiVersion: v1 kind: ServiceAccount metadata: diff --git a/charts/wandb-base/values.yaml b/charts/wandb-base/values.yaml index 3250f78f9..f1e7f8bcf 100644 --- a/charts/wandb-base/values.yaml +++ b/charts/wandb-base/values.yaml @@ -84,6 +84,7 @@ common: serviceAccount: create: true + useWeaveTraceIdentity: false automount: true annotations: {} name: "" diff --git a/test-configs/operator-wandb/__snapshots__/mcp-server.snap b/test-configs/operator-wandb/__snapshots__/mcp-server.snap index 5e655bb49..67544abaa 100644 --- a/test-configs/operator-wandb/__snapshots__/mcp-server.snap +++ b/test-configs/operator-wandb/__snapshots__/mcp-server.snap @@ -497,7 +497,7 @@ metadata: apiVersion: v1 kind: ServiceAccount metadata: - name: wandb-weave-trace + name: chartsnap-weave-trace labels: helm.sh/chart: '###CHART_VERSION###' app.kubernetes.io/name: weave-trace @@ -6127,7 +6127,7 @@ spec: subPath: redis_ca.pem - mountPath: /tmp/ name: temp-dir - serviceAccountName: wandb-weave-trace + serviceAccountName: chartsnap-weave-trace securityContext: fsGroup: 0 fsGroupChangePolicy: OnRootMismatch diff --git a/test-configs/operator-wandb/__snapshots__/olap-features-enabled.snap b/test-configs/operator-wandb/__snapshots__/olap-features-enabled.snap index 32bfdc56b..0bef091b0 100644 --- a/test-configs/operator-wandb/__snapshots__/olap-features-enabled.snap +++ b/test-configs/operator-wandb/__snapshots__/olap-features-enabled.snap @@ -599,7 +599,7 @@ metadata: apiVersion: v1 kind: ServiceAccount metadata: - name: wandb-weave-trace + name: chartsnap-weave-trace labels: helm.sh/chart: '###CHART_VERSION###' app.kubernetes.io/name: weave-trace @@ -7058,7 +7058,7 @@ spec: subPath: redis_ca.pem - mountPath: /tmp/ name: temp-dir - serviceAccountName: wandb-weave-trace + serviceAccountName: chartsnap-weave-trace securityContext: fsGroup: 0 fsGroupChangePolicy: OnRootMismatch diff --git a/test-configs/operator-wandb/__snapshots__/user-defined-clickhouse-secret.snap b/test-configs/operator-wandb/__snapshots__/user-defined-clickhouse-secret.snap index 8a6d1d625..37c9cc617 100644 --- a/test-configs/operator-wandb/__snapshots__/user-defined-clickhouse-secret.snap +++ b/test-configs/operator-wandb/__snapshots__/user-defined-clickhouse-secret.snap @@ -224,7 +224,7 @@ metadata: apiVersion: v1 kind: ServiceAccount metadata: - name: wandb-weave-trace + name: chartsnap-weave-trace labels: helm.sh/chart: '###CHART_VERSION###' app.kubernetes.io/name: weave-trace @@ -3833,7 +3833,7 @@ spec: subPath: redis_ca.pem - mountPath: /tmp/ name: temp-dir - serviceAccountName: wandb-weave-trace + serviceAccountName: chartsnap-weave-trace securityContext: fsGroup: 0 fsGroupChangePolicy: OnRootMismatch diff --git a/test-configs/operator-wandb/__snapshots__/weave-trace-with-worker.snap b/test-configs/operator-wandb/__snapshots__/weave-trace-with-worker.snap index 751520267..d8564f960 100644 --- a/test-configs/operator-wandb/__snapshots__/weave-trace-with-worker.snap +++ b/test-configs/operator-wandb/__snapshots__/weave-trace-with-worker.snap @@ -719,7 +719,7 @@ metadata: apiVersion: v1 kind: ServiceAccount metadata: - name: wandb-weave-trace + name: chartsnap-weave-trace labels: helm.sh/chart: '###CHART_VERSION###' app.kubernetes.io/name: weave-trace @@ -7091,7 +7091,7 @@ spec: - name: redis-ca mountPath: /etc/ssl/certs/redis_ca.pem subPath: redis_ca.pem - serviceAccountName: wandb-weave-trace + serviceAccountName: chartsnap-weave-trace securityContext: fsGroup: 0 fsGroupChangePolicy: OnRootMismatch @@ -7245,7 +7245,7 @@ spec: subPath: redis_ca.pem - mountPath: /tmp/weave-trace/internal-jwt name: weave-trace-internal-jwt - serviceAccountName: wandb-weave-trace + serviceAccountName: chartsnap-weave-trace securityContext: fsGroup: 0 fsGroupChangePolicy: OnRootMismatch @@ -7491,7 +7491,7 @@ spec: subPath: redis_ca.pem - mountPath: /tmp/ name: temp-dir - serviceAccountName: wandb-weave-trace + serviceAccountName: chartsnap-weave-trace securityContext: fsGroup: 0 fsGroupChangePolicy: OnRootMismatch diff --git a/test-configs/operator-wandb/__snapshots__/weave-trace.snap b/test-configs/operator-wandb/__snapshots__/weave-trace.snap index 10a437a1a..43aa14002 100644 --- a/test-configs/operator-wandb/__snapshots__/weave-trace.snap +++ b/test-configs/operator-wandb/__snapshots__/weave-trace.snap @@ -599,7 +599,7 @@ metadata: apiVersion: v1 kind: ServiceAccount metadata: - name: wandb-weave-trace + name: chartsnap-weave-trace labels: helm.sh/chart: '###CHART_VERSION###' app.kubernetes.io/name: weave-trace @@ -6897,7 +6897,7 @@ spec: subPath: redis_ca.pem - mountPath: /tmp/ name: temp-dir - serviceAccountName: wandb-weave-trace + serviceAccountName: chartsnap-weave-trace securityContext: fsGroup: 0 fsGroupChangePolicy: OnRootMismatch From 1d0ad31328ce4563fd5952980d4e3d1b3401e779 Mon Sep 17 00:00:00 2001 From: Nikhil Date: Fri, 21 Aug 2026 17:14:33 -0400 Subject: [PATCH 4/5] fix(weave): own shared trace SA at umbrella level, prune dead JWT subject The shared -weave-trace ServiceAccount was implicitly owned by the weave-trace subchart via wandb-base.fullname coinciding with the shared name; flipping useWeaveTraceIdentity on weave-trace would have silently deleted it. Own it explicitly in the umbrella chart (same pattern as azure-storage-serviceaccount.yaml / wandb-bucket-access) and flip all four weave workloads to consume the flag uniformly. Annotations from weave-trace.serviceAccount pass through to the umbrella SA. Also drop the now-dead -weave-trace-worker default JWT subject and derive the surviving entry from the shared helper so the map and the SA share one source of truth (api.yaml already tpl-wraps the rendered map). Co-Authored-By: Claude Fable 5 --- charts/operator-wandb/templates/_bucket.tpl | 9 +++++ .../templates/weave-trace-serviceaccount.yaml | 14 +++++++ .../weave_trace_service_account_test.yaml | 37 ++++++++++++++++++- charts/operator-wandb/values.yaml | 6 +-- charts/wandb-base/templates/_helpers.tpl | 3 ++ .../azure-workload-identity.snap | 9 ++++- .../__snapshots__/mcp-server.snap | 18 +++------ .../__snapshots__/olap-features-enabled.snap | 18 +++------ .../weave-trace-with-worker.snap | 18 +++------ .../__snapshots__/weave-trace.snap | 18 +++------ 10 files changed, 96 insertions(+), 54 deletions(-) create mode 100644 charts/operator-wandb/templates/weave-trace-serviceaccount.yaml diff --git a/charts/operator-wandb/templates/_bucket.tpl b/charts/operator-wandb/templates/_bucket.tpl index 6acdbd67f..e9891f9ff 100644 --- a/charts/operator-wandb/templates/_bucket.tpl +++ b/charts/operator-wandb/templates/_bucket.tpl @@ -124,6 +124,15 @@ cannot be represented without changing Weave's object layout. {{- and (index $fileStorage "useDefaultBucket" | default false) $identityConfigured -}} {{- end }} +{{/* +Name of the shared Weave Trace ServiceAccount, owned at the umbrella level by +templates/weave-trace-serviceaccount.yaml. Must stay identical to +"wandb-base.weaveTraceServiceAccountName" in charts/wandb-base/templates/_helpers.tpl. +*/}} +{{- define "wandb.weaveTraceServiceAccountName" -}} + {{- printf "%s-weave-trace" .Release.Name -}} +{{- end }} + {{- define "wandb.bucket" -}} {{- $url := "" -}} diff --git a/charts/operator-wandb/templates/weave-trace-serviceaccount.yaml b/charts/operator-wandb/templates/weave-trace-serviceaccount.yaml new file mode 100644 index 000000000..089ee0dae --- /dev/null +++ b/charts/operator-wandb/templates/weave-trace-serviceaccount.yaml @@ -0,0 +1,14 @@ +{{- if index .Values "weave-trace" "install" }} +{{- $weaveTrace := index .Values "weave-trace" | default dict -}} +{{- $serviceAccount := $weaveTrace.serviceAccount | default dict -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "wandb.weaveTraceServiceAccountName" . }} + labels: + {{- include "wandb.commonLabels" . | nindent 4 }} + {{- with $serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/operator-wandb/tests/weave_trace_service_account_test.yaml b/charts/operator-wandb/tests/weave_trace_service_account_test.yaml index a53300a41..9e06f0e38 100644 --- a/charts/operator-wandb/tests/weave_trace_service_account_test.yaml +++ b/charts/operator-wandb/tests/weave_trace_service_account_test.yaml @@ -1,5 +1,6 @@ suite: Weave Trace service account templates: + - templates/weave-trace-serviceaccount.yaml - charts/weave-trace/templates/deployment.yaml - charts/weave-trace/templates/serviceaccount.yaml - charts/weave-trace-worker/templates/deployment.yaml @@ -22,8 +23,8 @@ tests: path: spec.template.spec.serviceAccountName value: custom-release-weave-trace - - it: creates the release-derived trace ServiceAccount - template: charts/weave-trace/templates/serviceaccount.yaml + - it: creates the release-derived trace ServiceAccount at the umbrella level + template: templates/weave-trace-serviceaccount.yaml set: weave-trace: install: true @@ -34,6 +35,38 @@ tests: path: metadata.name value: custom-release-weave-trace + - it: passes serviceAccount annotations through to the umbrella ServiceAccount + template: templates/weave-trace-serviceaccount.yaml + set: + weave-trace: + install: true + serviceAccount: + useWeaveTraceIdentity: true + annotations: + eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/example + asserts: + - equal: + path: metadata.annotations["eks.amazonaws.com/role-arn"] + value: arn:aws:iam::123456789012:role/example + + - it: does not render the umbrella ServiceAccount when weave-trace is disabled + template: templates/weave-trace-serviceaccount.yaml + set: + weave-trace: + install: false + asserts: + - hasDocuments: + count: 0 + + - it: does not create a trace ServiceAccount in the subchart + template: charts/weave-trace/templates/serviceaccount.yaml + set: + weave-trace: + install: true + asserts: + - hasDocuments: + count: 0 + - it: gives the trace worker the release-derived trace ServiceAccount template: charts/weave-trace-worker/templates/deployment.yaml set: diff --git a/charts/operator-wandb/values.yaml b/charts/operator-wandb/values.yaml index 9e4f9ad5e..3b3bfcf15 100644 --- a/charts/operator-wandb/values.yaml +++ b/charts/operator-wandb/values.yaml @@ -853,9 +853,7 @@ app: tag: latest # TODO(dpanzella) Read from here for backwards compatability, needs to be moved so API can access as well internalJWTMap: - - subject: "system:serviceaccount:{{ .Release.Namespace }}:{{ .Release.Name }}-weave-trace" - issuer: "https://kubernetes.default.svc.cluster.local" - - subject: "system:serviceaccount:{{ .Release.Namespace }}:{{ .Release.Name }}-weave-trace-worker" + - subject: "system:serviceaccount:{{ .Release.Namespace }}:{{ include `wandb.weaveTraceServiceAccountName` . }}" issuer: "https://kubernetes.default.svc.cluster.local" env: GORILLA_LICENSE_CERT_PATH: "/var/app/jwks.json" @@ -3856,6 +3854,8 @@ mcp-server: weave-trace: install: false + serviceAccount: + useWeaveTraceIdentity: true deploymentPostfix: "bc" podLabels: azure.workload.identity/use: '{{ include `wandb.weaveTraceUsesAzureWorkloadIdentity` . }}' diff --git a/charts/wandb-base/templates/_helpers.tpl b/charts/wandb-base/templates/_helpers.tpl index 0c0c4dfa7..4bf034a90 100644 --- a/charts/wandb-base/templates/_helpers.tpl +++ b/charts/wandb-base/templates/_helpers.tpl @@ -134,6 +134,9 @@ their component accounts. {{/* Create the name of the shared Weave Trace service account. +The SA object itself is owned by the operator-wandb umbrella chart +(templates/weave-trace-serviceaccount.yaml); this must stay identical to +"wandb.weaveTraceServiceAccountName" in operator-wandb/templates/_bucket.tpl. */}} {{- define "wandb-base.weaveTraceServiceAccountName" -}} {{- printf "%s-weave-trace" .Release.Name -}} diff --git a/test-configs/operator-wandb/__snapshots__/azure-workload-identity.snap b/test-configs/operator-wandb/__snapshots__/azure-workload-identity.snap index 8faad4455..298e71ea8 100644 --- a/test-configs/operator-wandb/__snapshots__/azure-workload-identity.snap +++ b/test-configs/operator-wandb/__snapshots__/azure-workload-identity.snap @@ -155,6 +155,13 @@ metadata: annotations: azure.workload.identity/client-id: authoritative-client-id --- +# Source: operator-wandb/templates/weave-trace-serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: chartsnap-weave-trace + labels: +--- # Source: operator-wandb/templates/bucket.yaml apiVersion: v1 kind: Secret @@ -897,7 +904,7 @@ data: GORILLA_RUN_UPDATE_QUEUE_ADDR: "internal://" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_NAME: "wandb" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_PREFIX: "wandb-overflow" - GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace-worker": "https://kubernetes.default.svc.cluster.local"}' + GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local"}' GORILLA_WEAVE_TRACE_SERVER_URL: "http://localhost:8080/traces" GORILLA_TASK_QUEUE_WORKER_ENABLED: "false" GORILLA_LOCAL_SERVICE_BYPASS: 'false' diff --git a/test-configs/operator-wandb/__snapshots__/mcp-server.snap b/test-configs/operator-wandb/__snapshots__/mcp-server.snap index 67544abaa..96ffbf540 100644 --- a/test-configs/operator-wandb/__snapshots__/mcp-server.snap +++ b/test-configs/operator-wandb/__snapshots__/mcp-server.snap @@ -493,31 +493,25 @@ metadata: name: chartsnap-reloader namespace: default --- -# Source: operator-wandb/charts/weave-trace/templates/serviceaccount.yaml +# Source: operator-wandb/charts/weave/templates/serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: - name: chartsnap-weave-trace + name: chartsnap-weave labels: helm.sh/chart: '###CHART_VERSION###' - app.kubernetes.io/name: weave-trace + app.kubernetes.io/name: weave app.kubernetes.io/instance: chartsnap app.kubernetes.io/version: "latest" app.kubernetes.io/managed-by: Helm automountServiceAccountToken: true --- -# Source: operator-wandb/charts/weave/templates/serviceaccount.yaml +# Source: operator-wandb/templates/weave-trace-serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: - name: chartsnap-weave + name: chartsnap-weave-trace labels: - helm.sh/chart: '###CHART_VERSION###' - app.kubernetes.io/name: weave - app.kubernetes.io/instance: chartsnap - app.kubernetes.io/version: "latest" - app.kubernetes.io/managed-by: Helm -automountServiceAccountToken: true --- # Source: operator-wandb/templates/bucket.yaml apiVersion: v1 @@ -1617,7 +1611,7 @@ data: GORILLA_RUN_UPDATE_QUEUE_ADDR: "internal://" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_NAME: "wandb" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_PREFIX: "wandb-overflow" - GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace-worker": "https://kubernetes.default.svc.cluster.local"}' + GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local"}' GORILLA_WEAVE_TRACE_SERVER_URL: "https://wandb.example.com/traces" GORILLA_TASK_QUEUE_WORKER_ENABLED: "false" GORILLA_LOCAL_SERVICE_BYPASS: 'false' diff --git a/test-configs/operator-wandb/__snapshots__/olap-features-enabled.snap b/test-configs/operator-wandb/__snapshots__/olap-features-enabled.snap index 0bef091b0..47d76b11c 100644 --- a/test-configs/operator-wandb/__snapshots__/olap-features-enabled.snap +++ b/test-configs/operator-wandb/__snapshots__/olap-features-enabled.snap @@ -595,31 +595,25 @@ metadata: name: chartsnap-reloader namespace: default --- -# Source: operator-wandb/charts/weave-trace/templates/serviceaccount.yaml +# Source: operator-wandb/charts/weave/templates/serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: - name: chartsnap-weave-trace + name: chartsnap-weave labels: helm.sh/chart: '###CHART_VERSION###' - app.kubernetes.io/name: weave-trace + app.kubernetes.io/name: weave app.kubernetes.io/instance: chartsnap app.kubernetes.io/version: "latest" app.kubernetes.io/managed-by: Helm automountServiceAccountToken: true --- -# Source: operator-wandb/charts/weave/templates/serviceaccount.yaml +# Source: operator-wandb/templates/weave-trace-serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: - name: chartsnap-weave + name: chartsnap-weave-trace labels: - helm.sh/chart: '###CHART_VERSION###' - app.kubernetes.io/name: weave - app.kubernetes.io/instance: chartsnap - app.kubernetes.io/version: "latest" - app.kubernetes.io/managed-by: Helm -automountServiceAccountToken: true --- # Source: operator-wandb/templates/bucket.yaml apiVersion: v1 @@ -1761,7 +1755,7 @@ data: GORILLA_RUN_UPDATE_QUEUE_ADDR: "internal://" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_NAME: "wandb" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_PREFIX: "wandb-overflow" - GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace-worker": "https://kubernetes.default.svc.cluster.local"}' + GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local"}' GORILLA_WEAVE_TRACE_SERVER_URL: "http://localhost:8080/traces" GORILLA_TASK_QUEUE_WORKER_ENABLED: "false" GORILLA_LOCAL_SERVICE_BYPASS: 'false' diff --git a/test-configs/operator-wandb/__snapshots__/weave-trace-with-worker.snap b/test-configs/operator-wandb/__snapshots__/weave-trace-with-worker.snap index d8564f960..65d41a815 100644 --- a/test-configs/operator-wandb/__snapshots__/weave-trace-with-worker.snap +++ b/test-configs/operator-wandb/__snapshots__/weave-trace-with-worker.snap @@ -715,31 +715,25 @@ metadata: name: chartsnap-reloader namespace: default --- -# Source: operator-wandb/charts/weave-trace/templates/serviceaccount.yaml +# Source: operator-wandb/charts/weave/templates/serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: - name: chartsnap-weave-trace + name: chartsnap-weave labels: helm.sh/chart: '###CHART_VERSION###' - app.kubernetes.io/name: weave-trace + app.kubernetes.io/name: weave app.kubernetes.io/instance: chartsnap app.kubernetes.io/version: "latest" app.kubernetes.io/managed-by: Helm automountServiceAccountToken: true --- -# Source: operator-wandb/charts/weave/templates/serviceaccount.yaml +# Source: operator-wandb/templates/weave-trace-serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: - name: chartsnap-weave + name: chartsnap-weave-trace labels: - helm.sh/chart: '###CHART_VERSION###' - app.kubernetes.io/name: weave - app.kubernetes.io/instance: chartsnap - app.kubernetes.io/version: "latest" - app.kubernetes.io/managed-by: Helm -automountServiceAccountToken: true --- # Source: operator-wandb/templates/bucket.yaml apiVersion: v1 @@ -1906,7 +1900,7 @@ data: GORILLA_RUN_UPDATE_QUEUE_ADDR: "internal://" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_NAME: "wandb" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_PREFIX: "wandb-overflow" - GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace-worker": "https://kubernetes.default.svc.cluster.local"}' + GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local"}' GORILLA_WEAVE_TRACE_SERVER_URL: "http://localhost:8080/traces" GORILLA_TASK_QUEUE_WORKER_ENABLED: "false" GORILLA_LOCAL_SERVICE_BYPASS: 'false' diff --git a/test-configs/operator-wandb/__snapshots__/weave-trace.snap b/test-configs/operator-wandb/__snapshots__/weave-trace.snap index 43aa14002..2e9a27e78 100644 --- a/test-configs/operator-wandb/__snapshots__/weave-trace.snap +++ b/test-configs/operator-wandb/__snapshots__/weave-trace.snap @@ -595,31 +595,25 @@ metadata: name: chartsnap-reloader namespace: default --- -# Source: operator-wandb/charts/weave-trace/templates/serviceaccount.yaml +# Source: operator-wandb/charts/weave/templates/serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: - name: chartsnap-weave-trace + name: chartsnap-weave labels: helm.sh/chart: '###CHART_VERSION###' - app.kubernetes.io/name: weave-trace + app.kubernetes.io/name: weave app.kubernetes.io/instance: chartsnap app.kubernetes.io/version: "latest" app.kubernetes.io/managed-by: Helm automountServiceAccountToken: true --- -# Source: operator-wandb/charts/weave/templates/serviceaccount.yaml +# Source: operator-wandb/templates/weave-trace-serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: - name: chartsnap-weave + name: chartsnap-weave-trace labels: - helm.sh/chart: '###CHART_VERSION###' - app.kubernetes.io/name: weave - app.kubernetes.io/instance: chartsnap - app.kubernetes.io/version: "latest" - app.kubernetes.io/managed-by: Helm -automountServiceAccountToken: true --- # Source: operator-wandb/templates/bucket.yaml apiVersion: v1 @@ -1719,7 +1713,7 @@ data: GORILLA_RUN_UPDATE_QUEUE_ADDR: "internal://" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_NAME: "wandb" GORILLA_RUN_UPDATE_SHADOW_QUEUE_OVERFLOW_BUCKET_PREFIX: "wandb-overflow" - GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local", "system:serviceaccount:default:chartsnap-weave-trace-worker": "https://kubernetes.default.svc.cluster.local"}' + GORILLA_INTERNAL_JWT_SUBJECTS_TO_ISSUERS: '{"system:serviceaccount:default:chartsnap-weave-trace": "https://kubernetes.default.svc.cluster.local"}' GORILLA_WEAVE_TRACE_SERVER_URL: "http://localhost:8080/traces" GORILLA_TASK_QUEUE_WORKER_ENABLED: "false" GORILLA_LOCAL_SERVICE_BYPASS: 'false' From 5aa56a6f7d3918ad3649aaf9400f09cc8886e7e1 Mon Sep 17 00:00:00 2001 From: Nikhil Date: Mon, 24 Aug 2026 08:44:22 -0700 Subject: [PATCH 5/5] fix(weave): format umbrella SA template, regen missed snapshot format_templates.py pass on weave-trace-serviceaccount.yaml (lint check), and regenerate user-defined-clickhouse-secret.snap which also renders the default internalJWTMap and was missed in the previous snapshot pass. Co-Authored-By: Claude Fable 5 --- .../templates/weave-trace-serviceaccount.yaml | 4 ++-- .../user-defined-clickhouse-secret.snap | 16 +++++----------- 2 files changed, 7 insertions(+), 13 deletions(-) diff --git a/charts/operator-wandb/templates/weave-trace-serviceaccount.yaml b/charts/operator-wandb/templates/weave-trace-serviceaccount.yaml index 089ee0dae..db27a98a4 100644 --- a/charts/operator-wandb/templates/weave-trace-serviceaccount.yaml +++ b/charts/operator-wandb/templates/weave-trace-serviceaccount.yaml @@ -1,6 +1,6 @@ {{- if index .Values "weave-trace" "install" }} -{{- $weaveTrace := index .Values "weave-trace" | default dict -}} -{{- $serviceAccount := $weaveTrace.serviceAccount | default dict -}} + {{- $weaveTrace := index .Values "weave-trace" | default dict -}} + {{- $serviceAccount := $weaveTrace.serviceAccount | default dict -}} apiVersion: v1 kind: ServiceAccount metadata: diff --git a/test-configs/operator-wandb/__snapshots__/user-defined-clickhouse-secret.snap b/test-configs/operator-wandb/__snapshots__/user-defined-clickhouse-secret.snap index 37c9cc617..5e874eba9 100644 --- a/test-configs/operator-wandb/__snapshots__/user-defined-clickhouse-secret.snap +++ b/test-configs/operator-wandb/__snapshots__/user-defined-clickhouse-secret.snap @@ -220,31 +220,25 @@ metadata: app.kubernetes.io/version: 7.2.4 helm.sh/chart: '###CHART_VERSION###' --- -# Source: operator-wandb/charts/weave-trace/templates/serviceaccount.yaml +# Source: operator-wandb/charts/weave/templates/serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: - name: chartsnap-weave-trace + name: chartsnap-weave labels: helm.sh/chart: '###CHART_VERSION###' - app.kubernetes.io/name: weave-trace + app.kubernetes.io/name: weave app.kubernetes.io/instance: chartsnap app.kubernetes.io/version: "latest" app.kubernetes.io/managed-by: Helm automountServiceAccountToken: true --- -# Source: operator-wandb/charts/weave/templates/serviceaccount.yaml +# Source: operator-wandb/templates/weave-trace-serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: - name: chartsnap-weave + name: chartsnap-weave-trace labels: - helm.sh/chart: '###CHART_VERSION###' - app.kubernetes.io/name: weave - app.kubernetes.io/instance: chartsnap - app.kubernetes.io/version: "latest" - app.kubernetes.io/managed-by: Helm -automountServiceAccountToken: true --- # Source: operator-wandb/templates/bucket.yaml apiVersion: v1