fix(k8s): remove stale NFS writes and decouple PVC from skills#106
Merged
fred-scitix merged 2 commits intomainfrom Mar 13, 2026
Merged
fix(k8s): remove stale NFS writes and decouple PVC from skills#106fred-scitix merged 2 commits intomainfrom
fred-scitix merged 2 commits intomainfrom
Conversation
…edentialPayload
buildCredentialPayload() was creating an `agent-data/` directory under
skillsDir on the NFS, contradicting its own JSDoc ("Returns data only —
does NOT write to disk"). Gateway should never write to the shared NFS;
only AgentBox pods should write to their own user-data mount.
jacoblee-io
force-pushed
the
fix/remove-agent-data-from-skills-dir
branch
from
eafac9f to
ec13edb
Compare
Skills are synced via RPC (buildSkillBundle), not shared filesystem. The NFS PVC should only be used for user-data persistence. agentbox-template.yaml: - Remove all skills/credentials/kube NFS mounts (were on siclaw-skills PVC) - Add emptyDir volumes for skills, credentials, config (synced via RPC) - Add client-cert secret volume (mTLS) - Align with what k8s-spawner.ts actually generates gateway-deployment.yaml: - Add NFS PVC (siclaw-data) mount at /app/.siclaw/user-data - Add persistence env vars (CLAIM_NAME, MOUNT_PATH) - Gateway uses this mount only for ensureUserDir() before spawning pods
jacoblee-io
force-pushed
the
fix/remove-agent-data-from-skills-dir
branch
from
ec13edb to
c95c67b
Compare
jacoblee-io
changed the title
jacoblee-io
commented
Mar 13, 2026
Collaborator
Author
jacoblee-io
left a comment
jacoblee-io
left a comment
There was a problem hiding this comment.
LGTM. The removed mkdirSync was writing to skillsDir (gateway's skills emptyDir/NFS), but the AgentBox pod's user-data subPath (user/{userId}/agent-data) is on a completely separate volume. So this directory creation never served a purpose for the AgentBox — it was a no-op side effect that contradicted the JSDoc. Clean removal, no risk.
fred-scitix
approved these changes
Mar 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
buildCredentialPayload()inrpc-methods.tscreatesagent-data/underskillsDiron NFS — gateway should never write to NFSagentbox-template.yamlmounted the NFS PVC for skills, credentials, and kube configs — but these are all synced via RPC, not shared filesystemk8s/gateway-deployment.yamlwas missing the NFS PVC mount needed forensureUserDir()Solution
rpc-methods.ts: Remove the
fs.mkdirSync()call frombuildCredentialPayload().agentbox-template.yaml: Rewrite to match what
k8s-spawner.tsactually generates:siclaw-data) with subPathusers/{userId}/{workspaceId}gateway-deployment.yaml: Add NFS PVC mount at
/app/.siclaw/user-data+ persistence env vars, so gateway canensureUserDir()before spawning AgentBox pods.NFS PVC usage after this PR
/app/.siclaw/user-dataensureUserDir()— create per-user subdirectories/app/.siclaw/user-data(subPath)Skills are not on NFS — they live in emptyDir and are synced via RPC.
Test plan
agent-data/directories appear underskillsDir