Bartosz Majsak bartoszmajsak

maas-controller: Anti-Pattern Scanner Review

Static analysis flagged 114 findings (53 CRITICAL, 60 HIGH, 1 MEDIUM) across 6 anti-pattern categories. After verifying each against source code with controller-runtime and K8s API domain expertise, ~75% are false positives.

The scanner doesn't trace field-level client resolution (e.g. APIReader vs cached Client), doesn't check go.mod for typed alternatives before flagging unstructured usage, and projects core-resource cardinality onto singleton CRDs.

Base ref: 290712c on main

Authorino Scaling Analysis: Wristband Token Path

Performance analysis of Authorino's wristband token issuance and JWKS serving paths, with concrete fixes and estimated improvement factors.

Based on code analysis of the Authorino codebase in the context of the multi-cluster auth design for odh-model-controller.

The Hot Path

Plan: Optimize `make precommit` -- 5 focused PRs

Context

make precommit takes ~101s on a clean tree. 79% of time is in generate (57.7s) and manifests (33.8s), which run unconditionally even when no relevant files changed.

Deep tool-level analysis uncovered additional waste:

42 sequential yq invocations in manifests (16.4s) can be batched into 5 calls (1.3s)
go vet on main module is redundant (5.1s) -- golangci-lint already includes govet

	# Pipeline-Parallel Well-Known Configs Gap

	## Summary

	The LLMInferenceService API accepts pipeline-parallel configurations (`spec.parallelism.pipeline > 0`),
	the controller has code paths to handle them, but no well-known config YAML files are shipped.
	This means a user can create a valid-looking spec that passes webhook validation but fails
	at reconciliation time with `ConfigNotFound`.

	## Evidence

 #!/usr/bin/env bash
 # Measure Docker build context size with and without .dockerignore
 # Covers: legacy Docker builder, BuildKit (via buildx), and Podman
 #
 # Run from the repo root where .dockerignore lives.
 # The script temporarily moves .dockerignore aside to measure "without",
 # then restores it to measure "with".
 set -uo pipefail

	#!/usr/bin/env bash
	# KRM exec function: sets securityContext.runAsNonRoot=true on every
	# container and initContainer in LLMInferenceServiceConfig resources.
	#
	# Skips resources labeled opendatahub.io/config-type=accelerator
	# (minimal overrides that inherit securityContext from the base template).
	#
	# Receives a ResourceList on stdin, emits modified ResourceList on stdout.

	exec yq eval '

	#!/bin/bash
	# Reproducer: Attempt to chain 10 tokens (token proliferation attack)

	MAAS_URL="${MAAS_URL:-maas.$(oc get ingresses.config.openshift.io cluster -o jsonpath='{.spec.domain}')}"

	echo "=== Token Proliferation Test ==="
	echo "Attempting to create a chain of 10 tokens using each to issue the next"
	echo ""

	# Start with OpenShift identity token

	#!/bin/bash
	# Reproducer: SA tokens should NOT be able to issue new tokens

	MAAS_URL="${MAAS_URL:-maas.$(oc get ingresses.config.openshift.io cluster -o jsonpath='{.spec.domain}')}"

	echo "=== Step 1: Get token using OpenShift identity (expected: success) ==="
	TOKEN=$(curl -sSk -X POST \
	-H "Authorization: Bearer $(oc whoami -t)" \
	-H "Content-Type: application/json" \
	-d '{"expiration":"10m"}' \