Skip to content

fix(helm): use API Service address for NMP_BASE_URL #894

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
svvarom wants to merge 1 commit into
base: main
Choose a base branch
from
+20 −4
Open

fix(helm): use API Service address for NMP_BASE_URL #894

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 1 addition & 4 deletions k8s/helm/templates/api/api-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,12 +69,9 @@ spec:
{{- end }}
- name: NMP_CONFIG_FILE_PATH
value: /etc/nmp/config.yaml
{{- /* Service address, not loopback: copied into agent configs that run in another container. */}}
- name: NMP_BASE_URL
{{- if include "nemo-platform.embeddedPdpEnabled" . }}
value: {{ include "nemo-platform.apiLoopbackBaseUrl" . | quote }}
{{- else }}
value: {{ include "nemo-platform.internalBaseUrl" . | quote }}
{{- end }}
- name: NMP_AUTOMODEL_DEFAULT_TRAINING_EXECUTION_PROFILE
value: {{ dig "automodel" "default_training_execution_profile" "default" $platformConfig | quote }}
- name: NMP_UNSLOTH_DEFAULT_TRAINING_EXECUTION_PROFILE
Expand Down
19 changes: 19 additions & 0 deletions tests/auth_idp/static/test_authentik_kubernetes_demo.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1178,6 +1178,25 @@ def test_nemo_platform_controller_uses_internal_api_service_url_for_embedded_pdp
) in template


def test_nemo_platform_api_uses_internal_api_service_url_for_agent_configs() -> None:
"""NMP_BASE_URL on the API pod must be the Service address, never loopback.

The API copies this value into agent workflow configs, which run in a different
container -- loopback there resolves to the agent itself, not the platform.
Embedded PDP gets its loopback from NMP_AUTH_POLICY_DECISION_POINT_BASE_URL instead.
"""
template = Path("k8s/helm/templates/api/api-deployment.yaml").read_text(encoding="utf-8")

assert (
'name: NMP_BASE_URL\n value: {{ include "nemo-platform.internalBaseUrl" . | quote }}'
) in template
assert "nemo-platform.apiLoopbackBaseUrl" not in template.split("NMP_AUTOMODEL")[0]
assert (
"name: NMP_AUTH_POLICY_DECISION_POINT_BASE_URL\n value: "
'{{ include "nemo-platform.apiLoopbackBaseUrl" . | quote }}'
) in template
Comment on lines +1181 to +1197

@coderabbitai coderabbitai Bot Jul 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Cover both rendered authentication configurations.

This test only inspects template text; it never renders with authentication/PDP enabled and disabled. Add both render cases and assert that NMP_AUTH_POLICY_DECISION_POINT_BASE_URL is present only when enabled.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/auth_idp/static/test_authentik_kubernetes_demo.py` around lines 1181 -
1197, Extend
test_nemo_platform_api_uses_internal_api_service_url_for_agent_configs to render
the API deployment with authentication/PDP enabled and disabled, rather than
inspecting template text alone. Assert NMP_BASE_URL always uses the internal
service URL, while NMP_AUTH_POLICY_DECISION_POINT_BASE_URL is present only in
the enabled rendering and absent when disabled.



def test_authentik_helm_demo_does_not_inject_legacy_workload_token_envs() -> None:
template_files = sorted(path for path in (HELM_DIR / "templates").rglob("*") if path.is_file())
text_files = [
Expand Down