From a97aa97a1754b85d5be81d073139d44438b3b7f9 Mon Sep 17 00:00:00 2001 From: Giles Knap Date: Thu, 24 Sep 2026 07:40:24 +0000 Subject: [PATCH 1/2] Warn against bumping tiled past 0.2.9 without porting the access policy The access-policy plugin embedded in services/p49-tiled/templates/ configmap.yaml uses PrincipalType.external, which tiled removed in v0.2.10 (bluesky/tiled#1377). Raising image.tag past 0.2.9 on its own makes the plugin fail on import and the server will not start, and because the plugin lives in a ConfigMap nothing in CI catches it. Comment only: no rendered output changes. Co-Authored-By: Claude Opus 5 --- services/p49-tiled/values.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/services/p49-tiled/values.yaml b/services/p49-tiled/values.yaml index f0b96c5..5605b04 100644 --- a/services/p49-tiled/values.yaml +++ b/services/p49-tiled/values.yaml @@ -15,6 +15,14 @@ tiled: - name: PYTHONPATH value: /deploy/ image: + # WARNING: do not raise this past 0.2.9 on its own. The access-policy + # plugin embedded in templates/configmap.yaml uses + # PrincipalType.external, which tiled removed in v0.2.10 + # (bluesky/tiled#1377). The server then fails to import the plugin and + # will not start, and nothing in CI catches it. A bump must carry the + # port to PrincipalType.user in the same commit -- see + # epics-containers/p46-services#219, and t11-services for a working + # 0.2.18 + ported-plugin pair. tag: 0.2.7 config: database: From e7330303b6ba4cc6c901a15b14bbb4d403020094 Mon Sep 17 00:00:00 2001 From: Giles Knap Date: Thu, 24 Sep 2026 07:47:59 +0000 Subject: [PATCH 2/2] Describe the real failure mode of a tiled bump in the values.yaml guard The plugin only touches PrincipalType.external inside function bodies (_check_principal and build_input), so on tiled >= 0.2.10 it imports cleanly and the server starts. ExternalPolicyDecisionPoint calls build_input from filters, allowed_scopes, init_node and modify_node, so every authenticated request then raises AttributeError and returns HTTP 500 instead. Say that, rather than "fails to import and will not start". Comment only: no rendered output changes. Co-Authored-By: Claude Opus 5 --- services/p49-tiled/values.yaml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/services/p49-tiled/values.yaml b/services/p49-tiled/values.yaml index 5605b04..7b84545 100644 --- a/services/p49-tiled/values.yaml +++ b/services/p49-tiled/values.yaml @@ -18,9 +18,10 @@ tiled: # WARNING: do not raise this past 0.2.9 on its own. The access-policy # plugin embedded in templates/configmap.yaml uses # PrincipalType.external, which tiled removed in v0.2.10 - # (bluesky/tiled#1377). The server then fails to import the plugin and - # will not start, and nothing in CI catches it. A bump must carry the - # port to PrincipalType.user in the same commit -- see + # (bluesky/tiled#1377). The server still starts, but every + # authenticated request then fails with AttributeError (HTTP 500), and + # nothing in CI catches it. A bump must carry the port to + # PrincipalType.user in the same commit -- see # epics-containers/p46-services#219, and t11-services for a working # 0.2.18 + ported-plugin pair. tag: 0.2.7