* feat(kubernetes): add DNS endpoint support to GKE cluster locator
Add endpointType config option to GkeClusterLocator allowing use of
DNS-based control plane endpoints instead of public IP endpoints.
When set to 'dns', the locator uses the cluster's DNS endpoint
(e.g. gke-<uid>.<region>.gke.goog) with fallback to public IP if
no DNS endpoint is available.
Signed-off-by: Rickard Dybeck <dybeck@spotify.com>
* fix: fix relevant AI review comments
Signed-off-by: Rickard Dybeck <dybeck@spotify.com>
---------
Signed-off-by: Rickard Dybeck <dybeck@spotify.com>
Renames useTriggerScheduledTask to useScheduledTasksOperations and adds
cancelTask alongside triggerTask, with shared isLoading/error state. Adds
CancelScheduledTask type to devtools-common and cancelScheduledTask to the
DevToolsApi interface and client, hitting the existing scheduler cancel
endpoint. The ScheduledTasksContent UI now shows both trigger and cancel
buttons per task row.
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
Add tests for NULL entity_id rows surviving migration, FK enforcement
rejecting invalid inserts, and down migration orphan cleanup.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Replace the non-atomic MySQL transaction wrapper with a retry loop that
checks information_schema before dropping the FK and retries the add if
new orphan rows appear during the window between DROP and ADD.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
- Combine DROP CONSTRAINT and ADD CONSTRAINT into a single ALTER TABLE
statement for PostgreSQL, eliminating the brief window where no FK exists
- Reword MySQL transaction comment to clarify that ALTER TABLE causes
implicit commits in InnoDB, so the wrapper doesn't provide full atomicity
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
- Close PG race window: drop old FK and add NOT VALID FK before batch
cleanup, so no new orphans can be inserted during cleanup
- Extract batch-delete helpers (batchDeleteOrphansPg, batchDeleteOrphansMysql)
to reduce duplication across up/down and dialects
- Fix ShareUpdateExclusiveLock comment to be more precise
- Make changeset message more descriptive
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
The search FK migration uses transaction: false for PostgreSQL's benefit,
but this left MySQL and SQLite branches non-atomic. A failure between
dropForeign and the new addForeign would leave the table with no FK
constraint. Wrap those branches in explicit knex.transaction() calls.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
* fix: prevent SSRF via redirect in CIMD metadata fetch
* fix: prevent SSRF via redirect in CIMD metadata fetch
* fix: add redirect target listener to SSRF redirect test
Prevent orphan cleanup queries from incorrectly matching rows with NULL
entity_id via LEFT JOIN, and use DROP CONSTRAINT IF EXISTS for safer
partial re-runs given transaction: false.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Add the same auto-approval step that the renovate workflow already has,
so that dependabot PRs that only touch yarn.lock files get approved
automatically.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Address review feedback: replace NOT IN subquery with LEFT JOIN for
MySQL batch deletes. Since MySQL doesn't support LIMIT in multi-table
DELETE, orphan entity_ids are found via SELECT first, then deleted in
a separate statement.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
The search FK migration previously ran all DDL and a bulk DELETE in a
single transaction, holding AccessExclusiveLock for the entire duration.
On large tables this blocks all reads for potentially minutes or hours.
This restructures the migration per database engine:
- PostgreSQL: batch-deletes orphans before DDL, uses NOT VALID to skip
full table scan under AccessExclusiveLock, then VALIDATE CONSTRAINT
under the weaker ShareUpdateExclusiveLock
- MySQL: batch-deletes orphans with LIMIT before DDL
- SQLite: unchanged simple approach (no locking concerns)
Also sets transaction: false so the batched deletes run outside the
DDL transaction.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Replace the self-referencing callCount assertion with a concrete
expected value of 3, derived from the mocked time progression.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Fredrik Adelöw