Skip to content

Navigation Menu

Appearance settings

View all features
- BY COMPANY SIZE
  Enterprises
  Small and medium teams
  Startups
  Nonprofits
- BY USE CASE
  App Modernization
  DevSecOps
  DevOps
  CI/CD
  View all use cases
- BY INDUSTRY
  Healthcare
  Financial services
  Manufacturing
  Government
  View all industries
View all solutions
- EXPLORE BY TOPIC
  AI
  Software Development
  DevOps
  Security
  View all topics
- EXPLORE BY TYPE
  Customer stories
  Events & webinars
  Ebooks & reports
  Business insights
  GitHub Skills
- SUPPORT & SERVICES
  Documentation
  Customer support
  Community forum
  Trust center
  Partners
View all resources
- COMMUNITY
  GitHub SponsorsFund open source developers
- PROGRAMS
  Security Lab
  Maintainer Community
  Accelerator
  GitHub Stars
  Archive Program
- REPOSITORIES
  Topics
  Trending
  Collections
- ENTERPRISE SOLUTIONS
  Enterprise platformAI-powered developer platform
- AVAILABLE ADD-ONS
  GitHub Advanced SecurityEnterprise-grade security features
  Copilot for BusinessEnterprise-grade AI features
  Premium SupportEnterprise-grade 24/7 support
Pricing

Appearance settings

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

Uh oh!

There was an error while loading. Please reload this page.

NVIDIA / aicr Public

Notifications You must be signed in to change notification settings
Fork 90
Star 397

Code
Issues 109
Pull requests 22
Actions
Projects
Security and quality
Insights

Additional navigation options

Code
Issues
Pull requests
Actions
Projects
Security and quality
Insights

feat(agent): isolate concurrent snapshot runs with per-run resources - #2357

#2357

Open

ayuskauskas wants to merge 52 commits into

mainNVIDIA/aicr:mainfrom

feat/issue-2120-snapshot-run-isolationNVIDIA/aicr:feat/issue-2120-snapshot-run-isolationCopy head branch name to clipboard

Conversation Commits52 (52)Checks Files changed

Open

feat(agent): isolate concurrent snapshot runs with per-run resources#2357
ayuskauskas wants to merge 52 commits into
mainfrom
feat/issue-2120-snapshot-run-isolation

Commits

Commits on Aug 25, 2026

refactor: extract run-ID and label primitives to neutral packages
ayuskauskas
committed
bea83cb
feat(agent): add run-scoped name helpers
ayuskauskas
committed
18e2b69
fix(agent): empty runID must not yield a trailing-dash name
ayuskauskas
committed
950e490
feat(agent): create run-scoped resources and drop create-or-update
ayuskauskas
committed
029796a
feat(agent): scope cleanup to created objects with UID preconditions
ayuskauskas
committed
fe192d8
feat(agent): authorize pod selection via controlling ownerReference
ayuskauskas
committed
458f342
fix(agent): fail closed in ownedByJob on a zero Job UID
ayuskauskas
committed
bae8003
feat(snapshotter): scope staging ConfigMap to the run and unify validate's run ID
ayuskauskas
committed
3596282
feat(cli): treat job and service-account names as prefixes
ayuskauskas
committed
b66fd05
fix(cli): stop Ruling-7 tests from overclaiming single-generation coverage
ayuskauskas
committed
dcc7163
docs: update selectors and names for run-scoped agent resources
ayuskauskas
committed
6ce022d
test(agent): prove concurrent runs are isolated
ayuskauskas
committed
d599b17
test(agent): add cleanup-ownership discriminator to concurrency proof
ayuskauskas
committed
03de4aa
fix(agent): isolate the staging ConfigMap from the validator's and sweep it
ayuskauskas
committed
0d2b7a7
fix(agent): do not fail Deploy on a forbidden adoption-drift Get
ayuskauskas
committed
8cb7f78
docs(cli): correct why the single-run-ID invariant is untested
ayuskauskas
committed
b91cd4e
test(e2e): add cluster-backed snapshot run-isolation checks
ayuskauskas
committed
4bc02a1
test(e2e): drop RBAC fixture superseded by run-scoped agent RBAC
ayuskauskas
committed
9d55575
docs: select the agent ServiceAccount by run ID when debugging
ayuskauskas
committed
75a0013
fix(agent): gate the configmaps delete pre-flight on output ownership
ayuskauskas
committed
63c4c91
fix(agent): reject an invalid RunID before Deploy creates anything
ayuskauskas
committed
7ace7d6
test(agent): run-scope the names asserted by the deployer tests
ayuskauskas
committed
5bf05f8
test(agent): cover a nil Controller ownerReference in ownedByJob
ayuskauskas
committed
99c58b6
test(agent): state the cleanup discriminator instead of citing a report
ayuskauskas
committed
7927038
test(e2e): scope agent Job cleanup to this script's own runs
ayuskauskas
committed
37ee7b3
docs: add the blank line markdownlint MD031 wants before code fences
ayuskauskas
committed
e72cf1c
fix(agent): record create intent so a lost response cannot orphan an object
ayuskauskas
committed
8c3b0e2
test(agent): cover ownership on the watch-based pod-discovery path
ayuskauskas
committed
4be6a44
fix(snapshotter): stop DeployAndCollect mutating the caller's AgentConfig
ayuskauskas
committed
d11917c
docs: correct agent label coverage, name prefixes, and validate flag targets
ayuskauskas
committed
35b2037
fix(cleanup): restore the name-based sweep for pre-ADR-020 agent leftovers
ayuskauskas
committed
d4f348b
fix(cleanup): remove the pre-ADR-020 unlabeled cluster RBAC pair
ayuskauskas
committed
a9d174d
test(agent): drop the always-constant namespace param from watchDeployer
ayuskauskas
committed
de45c63
test(agent): drop the leading blank line in the watch-path test
ayuskauskas
committed
2b1c2b3
test(agent): derive name-limit boundaries from defaults.MaxK8sNameLength
ayuskauskas
committed
9f5ff55
fix(agent): reject an invalid resolved object name before Deploy writes
ayuskauskas
committed
79e1597
test(agent): report reactor failures without t.Fatalf on a worker goroutine
ayuskauskas
committed
9a5abce
test(agent): use fake.NewClientset over the deprecated constructor
ayuskauskas
committed
77a2a99
docs: make the run-ID lookup self-contained and fix agent default drift
ayuskauskas
committed
c1bd48c
docs(cleanup): warn that the agent label sweep terminates a live run
ayuskauskas
committed
be66fce
test(e2e): poll until the leftover agent Job count settles
ayuskauskas
committed
379bdce
refactor(agent): name the shared error-context keys
ayuskauskas
committed
cff9a4d
fix(agent): establish cleanup ownership at create time, not by name
ayuskauskas
committed
8f3ca22
feat(agent): run as an existing ServiceAccount and manage none of its RBAC
ayuskauskas
committed
a4e3649
feat(agent): add --add-roles-to-service-account to grant the agent's RBAC
ayuskauskas
committed
18e2dee
docs: document exact-if-exists ServiceAccounts and the isolation waiver
ayuskauskas
committed
3386a73
test(agent): stop shadowing err in the existing-ServiceAccount test
ayuskauskas
committed
cbfe6df
feat(agent): write --add-roles-to-service-account RBAC as manifests
ayuskauskas
committed
82da10e
feat(agent): verify caller and ServiceAccount permissions at the gate
ayuskauskas
committed
9e8212a
docs(agent): document cleanup's label+UID re-verification of lost creates
ayuskauskas
committed
75e2c65
test(agent): cover cleanup's empty-RunID and missing-UID refuse paths
ayuskauskas
committed
ad831f0
test(agent): make the empty-RunID guard row fail without the guard
ayuskauskas
committed
1737275

Footer

© 2026 GitHub, Inc.

Footer navigation

Terms
Privacy
Security
Status
Community
Docs
Contact

You can’t perform that action at this time.