Skip to content

feat(cli): RR commit.#3309

Merged
c-r33d merged 2 commits intoDSPX-2655-migrate-otdfctlfrom
commit-rr
Apr 16, 2026
Merged

feat(cli): RR commit.#3309
c-r33d merged 2 commits intoDSPX-2655-migrate-otdfctlfrom
commit-rr

Conversation

@c-r33d
Copy link
Copy Markdown
Contributor

@c-r33d c-r33d commented Apr 15, 2026

Proposed Changes

1.) Add ability to commit registered_resources
2.) Call out that for partially migrated objects that cause collisions that we use a combination of Existing and Status to determine if the parent has already been migrated but the values need updates.

Checklist

  • I have added or updated unit tests
  • I have added or updated integration tests (if appropriate)
  • I have added or updated documentation

Testing Instructions

@c-r33d c-r33d requested a review from a team as a code owner April 15, 2026 17:35
@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Apr 15, 2026

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: bec09a73-34be-4cca-8a3b-025c4fa06adc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch commit-rr

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@gemini-code-assist
Copy link
Copy Markdown
Contributor

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces functionality to migrate registered resources within the CLI. It enhances the migration execution logic to support creating these resources and their values, while also providing a mechanism to reconcile existing resources to prevent unnecessary duplication during partial migrations.

Highlights

  • Registered Resource Migration: Implemented the ability to commit registered_resources during the migration process.
  • Collision Handling: Added logic to handle partially migrated objects by using a combination of Existing and Status to determine if a parent resource has already been migrated and requires updates.
  • Execution Logic: Introduced new executor methods to handle the creation of registered resources and their associated values, including robust error handling and state tracking.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.


The resources registered in the flow, To new namespaces they must go. With status checked and collisions cleared, The migration path is now revered.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

@github-actions
Copy link
Copy Markdown
Contributor

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 209.312003ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 107.000005ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 398.845718ms
Throughput 250.72 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 41.523504036s
Average Latency 413.466604ms
Throughput 120.41 requests/second

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request implements the execution logic for migrating registered resources, including updates to the ExecutorHandler interface and migration plan structures. The changes introduce the executeRegisteredResources method and its helpers to handle the creation of resources and values while tracking execution status. Feedback identifies a missing implementation of cachedActionTargetID that will lead to compilation errors, a need to support both IDs and FQNs for action identifiers, and a recommendation to reconcile action bindings when reusing existing resource values.

Comment thread otdfctl/migrations/namespacedpolicy/registered_resources_execute.go
Comment thread otdfctl/migrations/namespacedpolicy/registered_resources_execute.go
Comment on lines +114 to +121
if existingID := existingValues[registeredResourceValueKey(valuePlan.Source.GetValue())]; existingID != "" {
valuePlan.Execution = &ExecutionResult{
RunID: e.runID,
Applied: true,
CreatedTargetID: existingID,
}
continue
}
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

When an existing value is found on the parent Registered Resource, the migration marks it as applied and skips creation. However, it does not verify if the ActionBindings (AAVs) on the existing value match the ones defined in the migration plan. If the goal is full reconciliation, you might want to at least log a warning if the bindings differ, although the current ExecutorHandler lacks an update method for RR values.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Creating AAVs is tranasctional when creating RRVs. It is possible that if a RRV is manually updated to remove an AAV then there will be drift, but we are not handling after migration modifications. Meaning if a customer were to update a migrated RRV after a migration or added a RRV themselves we will not block on that.

@github-actions
Copy link
Copy Markdown
Contributor

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 199.477641ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 96.769005ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 389.23725ms
Throughput 256.91 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 40.269836125s
Average Latency 400.456494ms
Throughput 124.16 requests/second

@github-actions
Copy link
Copy Markdown
Contributor

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

  • examples
  • otdfctl
  • sdk
  • service
  • lib/fixtures
  • tests-bdd

See the workflow run for details.

@c-r33d c-r33d merged commit 73dba6c into DSPX-2655-migrate-otdfctl Apr 16, 2026
35 checks passed
@c-r33d c-r33d deleted the commit-rr branch April 16, 2026 14:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants