Expose allowed org ID authorization settings#88
Conversation
Olmo Maldonado (ibolmo)
changed the title
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a35bb1b6ae
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "Codex (@codex) review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".
| {{- if and (or (eq $orgName "") (eq $orgName "*")) (eq $primaryOrgName "") -}} | ||
| {{- fail "global.primaryOrgName is required when global.orgName is empty or \"*\"; self-hosted service-token management needs a primary organization." -}} |
There was a problem hiding this comment.
In wildcard or empty-org deployments that already set PRIMARY_ORG_NAME through api.extraEnvVars, this validation still aborts because it only checks global.primaryOrgName. I checked api-deployment.yaml: api.extraEnvVars is appended as explicit env entries after the ConfigMap envFrom, so it is an existing supported path for supplying/overriding API environment variables; with this change those upgrades fail before the Deployment is rendered even though the pod would receive the required variable. Consider accepting the existing extra env override or avoiding the hard fail for that case.
Useful? React with 👍 / 👎.
1 participant
Context
Hybrid/self-hosted data planes need a first-class Helm value for authorizing access by stable Braintrust organization IDs, matching the Terraform data-plane support for
ALLOWED_ORG_IDS. Deployments that use wildcard or empty org-name access also need an explicit primary org for self-hosted service-token management.Description
global.allowedOrgIdsand rendersALLOWED_ORG_IDSinto the API ConfigMap only when the trimmed value is non-empty.global.primaryOrgNameand rendersPRIMARY_ORG_NAMEalongside the existing trimmedORG_NAME.global.orgNameis empty or"*"andglobal.primaryOrgNameis empty, matching the Terraform module validation boundary.