You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Brett testing the New Fleet → Kubernetes → submit path live (post-#118) surfaced a chain of issues, root-caused via Debug drawer MCP log (list_namespaces request/response) + cargo tree. Diagnostic thread: this issue's own comments below have the full back-and-forth; summary here.
Root cause (confirmed)
rustls 0.23.43 has bothring and aws-lc-rs crypto-provider features enabled simultaneously in studio-cp's dependency graph (kube's rustls-tls → hyper-rustls pulls ring; aws-sdk-sts/other AWS SDK crates in the same crate pull aws-lc-rs). Confirmed via cargo tree -e features -i ring / -i aws-lc-rs inside crates/studio-cp. Nobody calls rustls::crypto::CryptoProvider::install_default(), so the first real TLS handshake panics on a tokio-rt-worker thread:
Could not automatically determine the process-level CryptoProvider from Rustls crate features.
Call CryptoProvider::install_default() before this point...
Why it shows up two different ways depending on provider:
GKE context (exec-based auth, e.g. gke-gcloud-auth-plugin): fails before reaching TLS, at the exec-spawn step → clean synchronous error (auth error: unable to run auth exec: No such file or directory (os error 2) when the plugin binary isn't on the GUI app's PATH — separate PATH-inheritance issue, see below).
orbstack context (cert-based, no exec step): goes straight to TLS → hits the CryptoProvider panic on a background tokio task → the list_namespaces JSON-RPC request never gets a response (confirmed in MCP debug log: request id:1053 with {"context":"orbstack"} has no matching result, unlike neighboring id:1052/1054/1055). Namespace field's datalist silently never populates — reads as "can't select a namespace" with no visible error.
Ordered fix list
CryptoProvider::install_default() — call once at oab-mcp startup (pick one backend explicitly, e.g. aws-lc-rs since it's already used by the AWS SDK side). This is the actual blocker — orbstack (and any cert-based k8s context) can't complete a list_namespaces/list_service_accounts/deploy call without it. Also a prerequisite for feat: studio control-plane — agent-lifecycle + vendored oabctl + MCP (slice-0) #2 below (gcp_auth needs working TLS too).
fix-path-env (or equivalent) at Tauri app startup — GUI-launched process doesn't inherit shell PATH/dotfile-configured env, so exec-based auth plugins (e.g. gke-gcloud-auth-plugin installed via Homebrew-cask gcloud SDK) aren't found even when correctly installed. General safety net for any exec-based kubeconfig provider.
gcp_auth crate to replace GKE exec-plugin invocation — gcp_auth (MIT) implements the same ADC credential chain gke-gcloud-auth-plugin reads (~/.config/gcloud/application_default_credentials.json, GOOGLE_APPLICATION_CREDENTIALS, GCE/GKE metadata server) and can mint the OAuth2 bearer token in-process — set directly on kube::config::AuthInfo.token (public field, confirmed via kube 0.99 docs), skip exec entirely. Removes the PATH dependency for GKE specifically (fix-path-env in feat: studio control-plane — agent-lifecycle + vendored oabctl + MCP (slice-0) #2 still needed as a general net for other exec-based providers, e.g. Azure kubelogin — no equivalent pure-Rust replacement found for that one).
Namespace/Context load: stale error text not cleared on success — console/src/deploy.ts's loadK8sNamespaces()/loadK8sContexts() only call setStatus(identityStatusEl, ..., "err") in the catch path; nothing clears identityStatusEl on success. A prior failed attempt (e.g. ambient GKE context) leaves its red error text on screen even after a later successful load, which is misleading (this is part of why the orbstack namespace failure was confusing to diagnose live).
Debug drawer UX: MCP tab is hard to copy from (long JSON-RPC log, auto-scrolls to bottom continuously which fights manual text selection). Add a "download log" button (dump the tab's log as a file) and stop force-scrolling to bottom while the user has text selected / is scrolled up manually.
Not in scope here (tracked separately if needed)
EKS k8s-aws-v1. token generation via manual SigV4 presign (aws-sigv4 crate) as a pure-Rust replacement for aws-iam-authenticator — no existing crate does this end-to-end, would need hand-rolling. Discussed, deliberately deferred, not urgent since AWS path doesn't need it today.
Context
Brett testing the New Fleet → Kubernetes → submit path live (post-#118) surfaced a chain of issues, root-caused via Debug drawer MCP log (
list_namespacesrequest/response) +cargo tree. Diagnostic thread: this issue's own comments below have the full back-and-forth; summary here.Root cause (confirmed)
rustls0.23.43 has bothringandaws-lc-rscrypto-provider features enabled simultaneously instudio-cp's dependency graph (kube'srustls-tls→hyper-rustlspullsring;aws-sdk-sts/other AWS SDK crates in the same crate pullaws-lc-rs). Confirmed viacargo tree -e features -i ring/-i aws-lc-rsinsidecrates/studio-cp. Nobody callsrustls::crypto::CryptoProvider::install_default(), so the first real TLS handshake panics on atokio-rt-workerthread:Why it shows up two different ways depending on provider:
gke-gcloud-auth-plugin): fails before reaching TLS, at the exec-spawn step → clean synchronous error (auth error: unable to run auth exec: No such file or directory (os error 2)when the plugin binary isn't on the GUI app's PATH — separate PATH-inheritance issue, see below).list_namespacesJSON-RPC request never gets a response (confirmed in MCP debug log: requestid:1053with{"context":"orbstack"}has no matching result, unlike neighboringid:1052/1054/1055). Namespace field's datalist silently never populates — reads as "can't select a namespace" with no visible error.Ordered fix list
CryptoProvider::install_default()— call once at oab-mcp startup (pick one backend explicitly, e.g.aws-lc-rssince it's already used by the AWS SDK side). This is the actual blocker — orbstack (and any cert-based k8s context) can't complete alist_namespaces/list_service_accounts/deploy call without it. Also a prerequisite for feat: studio control-plane — agent-lifecycle + vendored oabctl + MCP (slice-0) #2 below (gcp_auth needs working TLS too).fix-path-env(or equivalent) at Tauri app startup — GUI-launched process doesn't inherit shell PATH/dotfile-configured env, so exec-based auth plugins (e.g.gke-gcloud-auth-plugininstalled via Homebrew-cask gcloud SDK) aren't found even when correctly installed. General safety net for any exec-based kubeconfig provider.gcp_authcrate to replace GKE exec-plugin invocation —gcp_auth(MIT) implements the same ADC credential chaingke-gcloud-auth-pluginreads (~/.config/gcloud/application_default_credentials.json,GOOGLE_APPLICATION_CREDENTIALS, GCE/GKE metadata server) and can mint the OAuth2 bearer token in-process — set directly onkube::config::AuthInfo.token(public field, confirmed via kube 0.99 docs), skipexecentirely. Removes the PATH dependency for GKE specifically (fix-path-env in feat: studio control-plane — agent-lifecycle + vendored oabctl + MCP (slice-0) #2 still needed as a general net for other exec-based providers, e.g. Azure kubelogin — no equivalent pure-Rust replacement found for that one).console/src/deploy.ts'sloadK8sNamespaces()/loadK8sContexts()only callsetStatus(identityStatusEl, ..., "err")in the catch path; nothing clearsidentityStatusElon success. A prior failed attempt (e.g. ambient GKE context) leaves its red error text on screen even after a later successful load, which is misleading (this is part of why the orbstack namespace failure was confusing to diagnose live).Not in scope here (tracked separately if needed)
k8s-aws-v1.token generation via manual SigV4 presign (aws-sigv4crate) as a pure-Rust replacement foraws-iam-authenticator— no existing crate does this end-to-end, would need hand-rolling. Discussed, deliberately deferred, not urgent since AWS path doesn't need it today.kubelogin— no pure-Rust replacement identified; relies on fix-path-env in feat: studio control-plane — agent-lifecycle + vendored oabctl + MCP (slice-0) #2.🤖 Filed by Orca from live debugging session with Brett.