Create BrowserStation auth secret in quickstart - #4
Conversation
…m k8s secret) The gateway (uvicorn app.main:app on ray-head) reads BROWSERSTATION_API_KEY and enforces X-API-Key on /browsers* when set, but the deploy never injected it, so the endpoint was open (health 200 with any key). Inject it from the browserstation-auth k8s secret so POST/GET/DELETE /browsers require the key. Verified: no-key -> 401, with-key -> browser created; driver connects over CDP.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds a BROWSERSTATION_API_KEY environment variable to the Ray service configuration, sourced from a Kubernetes secret, and updates the quickstart script to conditionally create this secret if an API key is provided. The review feedback correctly points out that since the API key is optional, the missing secret will cause pod startup failures. It suggests marking the secret reference as optional to prevent this issue.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| - name: BROWSERSTATION_API_KEY | ||
| valueFrom: | ||
| secretKeyRef: | ||
| name: browserstation-auth | ||
| key: BROWSERSTATION_API_KEY |
There was a problem hiding this comment.
Since the --api-key parameter in quickstart.sh is optional, the browserstation-auth secret will not be created if the user runs the quickstart without providing an API key. This will cause the Ray head pod to fail to start with a CreateContainerConfigError because of the missing secret reference. Marking the secretKeyRef as optional: true allows the pod to start successfully when the secret is not present.
- name: BROWSERSTATION_API_KEY
valueFrom:
secretKeyRef:
name: browserstation-auth
key: BROWSERSTATION_API_KEY
optional: true1 participant
Adds the BrowserStation API key Kubernetes secret during quickstart so rayservice.yaml can resolve BROWSERSTATION_API_KEY when gateway auth is enabled.
Acceptance criteria: