docs(demos): add config-driven GKE CUJ with evidence verify#917
Merged
Conversation
Adds demos/cuj1-gke-config.md as a config-driven variant of cuj1-gke.md: a single AICRConfig file drives recipe, bundle, and validate; the post-deploy validate emits a signed recipe-evidence bundle and the demo finishes with `aicr evidence verify`. Calls out three currently-required workarounds inline, each linked to its tracking issue (#914 helmfile CRD/CR ordering, #915 GKE ResourceQuota priorityClass admission, #916 validator image tag on tagged-release binaries).
Side-effects of validating demos/cuj1-gke-config.md against the UAT GKE cluster: - .gitignore: ignore artifacts the demo writes to the repo root (aicr-config.yaml, snapshot.yaml, dry-run.json, evidence/, report.json, evidence-result.json). - tests/uat/gcp/config.yaml: widen nw3 from 128.77.49.34/32 to 128.77.49.32/30 so adjacent egress addresses (.33) also pass the GKE control-plane authorized-networks check.
📝 WalkthroughWalkthroughThis PR adds infrastructure and documentation support for a configuration-driven CUJ 1 GKE workflow. Changes include: (1) updated Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@demos/cuj1-gke-config.md`:
- Around line 9-12: The blockquote lines in the demo text (the three lines
starting with "> The will be..." etc.) have extra spaces after the '>';
remove the surplus spaces so each blockquote line uses a single '>' followed by
one space ("> ") and correct the typo "The will" to "The plan" or appropriate
wording in that same block (identify and edit the three quoted lines in the
block starting with "Note: This demo duplicates...") to restore proper Markdown
blockquote formatting.
- Line 10: The sentence "The will be to generalize the cluster validation and
evidence collection" is missing a subject; replace it with a complete phrase
such as "The goal will be to generalize the cluster validation and evidence
collection" (or "This will be to generalize..." / "The aim will be to
generalize...") in the demos/cuj1-gke-config.md content to fix the grammar while
preserving the intended meaning.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: e94ee0c6-6eb4-4b53-bf7e-3eea24eba687
📒 Files selected for processing (3)
.gitignoredemos/cuj1-gke-config.mdtests/uat/gcp/config.yaml
lalitadithya
approved these changes
May 15, 2026
Contributor
Coverage Report ✅
Coverage BadgeNo Go source files changed in this PR. |
This was referenced May 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
demos/cuj1-gke-config.md— a config-driven variant ofdemos/cuj1-gke.mdwhere a singleAICRConfigfile drivesrecipe,bundle, andvalidate, and the post-deployvalidateemits a signed recipe-evidence bundle verified withaicr evidence verify.Motivation / Context
Showcases the
--configsurface end-to-end (snapshot is the only step still using bare flags — that gap is tracked in #913) and the recipe-evidence flow on the live UAT GKE cluster. Validated against the cluster provisioned bygh workflow run uat-gcp.yaml -f skip_delete=true -f skip_tests=true.Three currently-required workarounds are documented inline, each linked to its tracking issue, so the demo runs end-to-end on a tagged-release binary today.
Fixes: N/A
Related: #913 (snapshot
--config), #914 (helmfile CRD/CR ordering), #915 (GKE ResourceQuota / priorityClass), #916 (validator image tag on tagged-release binaries)Type of Change
Component(s) Affected
docs/,examples/)Implementation Notes
AICRConfigheredoc covers recipe criteria, bundle scheduling (selectors/tolerations/storageClass), validate input, andspec.validate.evidence.attestationfor emit.snapshotkeeps bare flags —--confignot yet wired (see [Feature]: --config support for aicr snapshot #913).deployer: helmfile; install step callshelmfile apply --skip-diff-on-installto sidestep the fresh-cluster CRD/CR ordering trap ([Bug]: helmfile bundle fails on fresh cluster — CRD/CR render order between nodewright-operator and nodewright-customizations #914).ResourceQuotais applied in thegpu-operatornamespace before the helmfile run to satisfy GKE'ssystem-*-criticalpriorityClass admission ([Bug]: helmfile/helm bundles fail on GKE — system-*-critical priorityClass pods rejected by ResourceQuota admission #915).AICR_VALIDATOR_IMAGE_TAG=edgeis set on the post-deploy validate to work around tagged-release binaries asking for unpublished:sha-<commit>validator images ([Bug]: validator image pull fails on every tagged-release binary — catalog requests sha-<commit> but release CI publishes v<version> #916).Testing
yamllint tests/uat/gcp/config.yamlclean.evidence verify). Pointer-based verify returns exit 0; manifest-hash chain validates 100% of bundled files; phase results: conformance passed 10/0/0.Risk Assessment
Rollout notes: Docs-only PR plus two trivial config tweaks. No code paths affected; the UAT config CIDR widen does not change the set of authorized network names and only adds three adjacent IPs (
.32,.33,.35) to the existingnw3block.Checklist
make testwith-race) — N/A (no Go changes)make lint) — yamllint clean on touched YAMLgit commit -S)