Repository Image Prewarming by michaeljguarino · Pull Request #4386 · pluralsh/console

michaeljguarino · 2026-09-21T19:28:41Z

Adds a prewarm field that resolves to an ImageWarmer cr that basically pulls our repository image on each node then gets removed. This will allow people to start these from cache and ensure decent start times.

Fixes PROD-5228

Test Plan

unit + e2e

Test environment: https://console.your-env.onplural.sh/

Checklist

I have added a meaningful title and summary to convey the impact of this PR to a user.
If required, I have updated the Plural documentation accordingly.
I have added tests to cover my changes.
I have deployed the agent to a test environment and verified that it works as expected (required only when changing agent code).

Plural Flow: console

linear · 2026-09-21T19:28:52Z

PROD-5238

PROD-5228

socket-security · 2026-09-21T19:29:12Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/github.com/robfig/cron/v3@v3.0.1

View full report

soffi-ai · 2026-09-21T19:30:59Z

Soffi AI Summary

This PR bundles several related improvements across the AI workbench, MCP server integration, OAuth token exchange, and a new image pre-warming capability for repository images.

Repository Image Pre-warming (ImageWarmer CRD): Introduces a new ImageWarmer custom resource that pulls the repository image onto every cluster node via a DaemonSet-style job, then self-destructs. This ensures repository images are cached locally so workloads start quickly from cache, addressing cold-start latency (PROD-5228).

OAuth Client Assertion Support: Extends the DeploymentSettings CRD and the token exchange subsystem to support signed JWT client assertions (RS256) as an alternative to plain client secrets when authenticating against OAuth token endpoints for OpenAI-compatible APIs. New fields include type (CLIENT_SECRET vs. CLIENT_ASSERTION), privateKeySecretRef, audience, keyId, resource, and scopes.

Bitbucket Datacenter & Jira Fixes: Repairs authentication and API integration issues with Bitbucket Datacenter and Jira (including Jira Datacenter) within the MCP server's SCM credentials layer. The scm_credentials.go refactor and its expanded test suite cover these cases.

MCP Server Enhancements: The MCPServer CRD gains new tool configuration fields via WorkbenchTool types. The MCP server reconciler and the agent-side MCP server binary are updated to conditionally sync workbench MCP servers into coding agents, giving AI coding agents access to the same tool set as the interactive workbench.

Workbench Monitoring View Improvements: UI and controller-side fixups for the workbench monitoring view, surfacing better status information for running workbench sessions.

Changes

Repository image pre-warming

Introduces the ImageWarmer CRD and supporting controller logic. When a prewarm field is set on a repository, an ImageWarmer CR is created that pulls the repository image onto every cluster node via a node-targeting job, then removes itself — ensuring images are cached for fast cold starts. (d61678b)

Bitbucket Datacenter and Jira integration fixes

Patches authentication handling for Bitbucket Datacenter in the MCP agent SCM credentials layer, addressing token and API compatibility issues that caused failures against self-hosted Bitbucket and Jira Datacenter instances. (7604da1)
Additional fixes for Bitbucket and Jira Datacenter integrations in the MCP server SCM credentials path, along with expanded test coverage for the corrected credential-resolution logic. (65df3bb)

OAuth client assertion support for LLM token exchange

Extends DeploymentSettings and the token exchange subsystem to support signed JWT client assertions (RS256) as an alternative to plain client secrets when obtaining OAuth access tokens for OpenAI-compatible LLM endpoints. Adds new CRD fields: type (CLIENT_SECRET / CLIENT_ASSERTION), privateKeySecretRef, audience, keyId, resource, and scopes. Also includes Jira Datacenter connectivity improvements and MCP tool integration groundwork. (714a107)

MCP server workbench tool configuration

Adds WorkbenchTool CRD type and associates it with the MCPServer resource, enabling per-server tool configuration. Updates the MCP server reconciler and generated deepcopy methods accordingly. (c7e4d02)
Conditionally syncs workbench MCP servers into AI coding agents so that agent harnesses (Claude, Gemini, Codex, Opencode) have access to the same MCP tool set as interactive workbench sessions. (a0e4e05)

Workbench monitoring view improvements

Applies fixups to the workbench monitoring view, correcting status display and controller-side reconciliation details for running workbench sessions. (25f9f3a)
Further improvements to the workbench monitoring UI, refining how session health and resource status are surfaced to operators. (016a298)

Updated: 2026-09-22 20:45 UTC

Deploy in Soffi

greptile-apps · 2026-09-21T19:33:45Z

Confidence Score: 3/5

The PR is not yet safe to merge because normal ImageWarmer reconciliation can falsely report success or delete an unrelated DaemonSet.

Findings

Empty Warm Reports Success ▶
Foreign DaemonSet Gets Deleted ▶

Summary

This PR introduces periodic repository-image prewarming through a new ImageWarmer custom resource and controller, connects it to AgentRuntime, and adds the required API schemas, RBAC, tests, and documentation.

Creates temporary pull-always DaemonSets on selected nodes according to a cron schedule.
Tracks generated warmers and scheduling status through the AgentRuntime and ImageWarmer status fields.
Includes two lifecycle correctness issues: zero-node runs are reported as successful, and same-name unrelated DaemonSets can be deleted.

_{Reviews (1) · Last reviewed commit: "Repository Image Prewarming"}

greptile-apps · 2026-09-21T19:33:48Z

+		if daemonSet.Status.ObservedGeneration >= daemonSet.Generation &&
+			daemonSet.Status.NumberReady == daemonSet.Status.DesiredNumberScheduled &&
+			daemonSet.Status.NumberUnavailable == 0 {


Empty Warm Reports Success

When the selector matches no nodes, the DaemonSet can report zero desired and zero ready pods. This condition treats that as a successful warm, deletes the DaemonSet, and records LastSuccessfulTime even though the image was never pulled. Newly added or later-matching nodes therefore remain cold until the next cron run, while the status incorrectly reports success.

Suggested change

if daemonSet.Status.ObservedGeneration >= daemonSet.Generation &&

daemonSet.Status.NumberReady == daemonSet.Status.DesiredNumberScheduled &&

daemonSet.Status.NumberUnavailable == 0 {

if daemonSet.Status.ObservedGeneration >= daemonSet.Generation &&

daemonSet.Status.DesiredNumberScheduled > 0 &&

daemonSet.Status.NumberReady == daemonSet.Status.DesiredNumberScheduled &&

daemonSet.Status.NumberUnavailable == 0 {

michaeljguarino · 2026-09-21T20:20:45Z

plural deploy this

plural-copilot · 2026-09-21T20:30:39Z

Created demo deployment GitOps PR: https://github.com/pluralsh/plrl-up-demos/pull/3004 (Console image tag: sha-c8fd4a7; Plural Service: mgmt/apps).

michaeljguarino · 2026-09-21T22:01:05Z

plural deploy this

plural-copilot · 2026-09-21T22:21:49Z

Deployment PR created: https://github.com/pluralsh/plrl-up-demos/pull/3006

michaeljguarino · 2026-09-22T02:16:25Z

plural deploy this

plural-copilot

Deployment PR created: https://github.com/pluralsh/plrl-up-demos/pull/3007

This promotes the Console image to sha-3b6aa9a and is annotated Plural Service: mgmt/apps.

michaeljguarino · 2026-09-22T03:35:09Z

plural deploy this

plural-copilot · 2026-09-22T03:37:26Z

Deployment GitOps PR completed: https://github.com/pluralsh/plrl-up-demos/pull/3008 — pins the Console image to sha-0b2e50a.

michaeljguarino · 2026-09-22T04:33:55Z

plural deploy this

plural-copilot · 2026-09-22T04:36:15Z

The requested demo deployment GitOps PR has been created: https://github.com/pluralsh/plrl-up-demos/pull/3009

michaeljguarino · 2026-09-22T13:37:30Z

plural deploy this

plural-copilot · 2026-09-22T13:40:17Z

Deployment PR is ready: https://github.com/pluralsh/plrl-up-demos/pull/3010

michaeljguarino · 2026-09-22T15:08:00Z

plural deploy this

plural-copilot · 2026-09-22T15:10:36Z

Demo deployment PR is ready: https://github.com/pluralsh/plrl-up-demos/pull/3016

Adds a prewarm field that resolves to an ImageWarmer cr that basically pulls our repository image on each node then gets removed. This will allow people to start these from cache and ensure decent start times.

…ration

michaeljguarino · 2026-09-22T15:17:41Z

plural deploy this

plural-copilot

Deployment PR has been created: https://github.com/pluralsh/plrl-up-demos/pull/3017. It deploys image tag sha-a0e4e05.

michaeljguarino · 2026-09-22T16:19:31Z

plural deploy this

plural-copilot · 2026-09-22T16:22:21Z

Deployment promotion created for source head 8964db8b6aec5b78f4a1875b092cfa40ba6b63c9 using image tag sha-8964db8: https://github.com/pluralsh/plrl-up-demos/pull/3018

The GitOps PR is annotated for mgmt/apps.

michaeljguarino · 2026-09-22T17:16:52Z

plural deploy this

plural-copilot

Deployment PR created: https://github.com/pluralsh/plrl-up-demos/pull/3019

michaeljguarino · 2026-09-22T19:13:57Z

plural deploy this

plural-copilot · 2026-09-22T19:17:21Z

GitOps deployment PR: https://github.com/pluralsh/plrl-up-demos/pull/3027

This PR promotes the current console head baada4991983a5828e6fa65d04c775f60e987b44 via image tag sha-baada49 and is awaiting merge.

michaeljguarino · 2026-09-22T19:53:21Z

plural deploy this

plural-copilot · 2026-09-22T19:56:31Z

Requested deployment PR created: https://github.com/pluralsh/plrl-up-demos/pull/3028. It pins Console to sha-dc8708b (source head dc8708b133cbe6b32f21ba50b8cea00ae94c1624).

michaeljguarino · 2026-09-22T20:58:29Z

plural deploy this

plural-copilot · 2026-09-22T21:01:15Z

Follow-up: the demo GitOps promotion is tracked in pluralsh/plrl-up-demos#3029. It pins Console to sha-016a298 and is associated with mgmt/apps.

michaeljguarino requested review from a team as code owners September 21, 2026 19:28

michaeljguarino added the enhancement New feature or request label Sep 21, 2026

greptile-apps Bot reviewed Sep 21, 2026

View reviewed changes

michaeljguarino force-pushed the mjg/prod-5238-image-warming-for-repository-prebake branch from 8bcb8af to 3b6aa9a Compare September 22, 2026 02:04

plural-copilot Bot reviewed Sep 22, 2026

View reviewed changes

michaeljguarino force-pushed the mjg/prod-5238-image-warming-for-repository-prebake branch 2 times, most recently from 5394b2d to 0b2e50a Compare September 22, 2026 03:16

michaeljguarino force-pushed the mjg/prod-5238-image-warming-for-repository-prebake branch from 4141b2e to 47254bb Compare September 22, 2026 13:32

michaeljguarino force-pushed the mjg/prod-5238-image-warming-for-repository-prebake branch from 47254bb to 95e1aa0 Compare September 22, 2026 14:25

JohnBlackwell approved these changes Sep 22, 2026

View reviewed changes

michaeljguarino force-pushed the mjg/prod-5238-image-warming-for-repository-prebake branch from 95e1aa0 to 01afb67 Compare September 22, 2026 14:48

Repository Image Prewarming

d61678b

Adds a prewarm field that resolves to an ImageWarmer cr that basically pulls our repository image on each node then gets removed. This will allow people to start these from cache and ensure decent start times.

michaeljguarino added 5 commits September 22, 2026 11:15

potential bb datacenter auth fixes

7604da1

more bb and jira fixes

65df3bb

oauth token client assertion support, and jira datacenter + mcp integ…

714a107

…ration

more improvements

c7e4d02

sync workbench mcp server into coding agents conditionally

a0e4e05

michaeljguarino force-pushed the mjg/prod-5238-image-warming-for-repository-prebake branch from 01afb67 to a0e4e05 Compare September 22, 2026 15:15

plural-copilot Bot reviewed Sep 22, 2026

View reviewed changes

monitor fixups

25f9f3a

michaeljguarino force-pushed the mjg/prod-5238-image-warming-for-repository-prebake branch from 8964db8 to a276640 Compare September 22, 2026 17:02

plural-copilot Bot reviewed Sep 22, 2026

View reviewed changes

michaeljguarino force-pushed the mjg/prod-5238-image-warming-for-repository-prebake branch 3 times, most recently from e9771b9 to baada49 Compare September 22, 2026 19:03

michaeljguarino force-pushed the mjg/prod-5238-image-warming-for-repository-prebake branch from baada49 to dc8708b Compare September 22, 2026 19:42

wb monitoring view improvements

016a298

michaeljguarino force-pushed the mjg/prod-5238-image-warming-for-repository-prebake branch from dc8708b to 016a298 Compare September 22, 2026 20:42

michaeljguarino merged commit 701c950 into master Sep 22, 2026
174 of 191 checks passed

michaeljguarino deleted the mjg/prod-5238-image-warming-for-repository-prebake branch September 22, 2026 21:32

Conversation

michaeljguarino commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Plan

Checklist

Uh oh!

linear Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

soffi-ai Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Repository image pre-warming

Bitbucket Datacenter and Jira integration fixes

OAuth client assertion support for LLM token exchange

MCP server workbench tool configuration

Workbench monitoring view improvements

Uh oh!

greptile-apps Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 3/5

Findings

Summary

Uh oh!

greptile-apps Bot Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

michaeljguarino commented Sep 21, 2026

Uh oh!

plural-copilot Bot commented Sep 21, 2026

Uh oh!

michaeljguarino commented Sep 21, 2026

Uh oh!

plural-copilot Bot commented Sep 21, 2026

Uh oh!

michaeljguarino commented Sep 22, 2026

Uh oh!

plural-copilot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

michaeljguarino commented Sep 22, 2026

Uh oh!

plural-copilot Bot commented Sep 22, 2026

Uh oh!

michaeljguarino commented Sep 22, 2026

Uh oh!

plural-copilot Bot commented Sep 22, 2026

Uh oh!

michaeljguarino commented Sep 22, 2026

Uh oh!

plural-copilot Bot commented Sep 22, 2026

Uh oh!

michaeljguarino commented Sep 22, 2026

Uh oh!

plural-copilot Bot commented Sep 22, 2026

Uh oh!

michaeljguarino commented Sep 22, 2026

Uh oh!

plural-copilot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

michaeljguarino commented Sep 22, 2026

Uh oh!

plural-copilot Bot commented Sep 22, 2026

Uh oh!

michaeljguarino commented Sep 22, 2026

Uh oh!

plural-copilot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

michaeljguarino commented Sep 22, 2026

Uh oh!

plural-copilot Bot commented Sep 22, 2026

Uh oh!

michaeljguarino commented Sep 22, 2026

Uh oh!

michaeljguarino commented Sep 21, 2026 •

edited

Loading

linear Bot commented Sep 21, 2026 •

edited

Loading

socket-security Bot commented Sep 21, 2026 •

edited

Loading

soffi-ai Bot commented Sep 21, 2026 •

edited

Loading

greptile-apps Bot commented Sep 21, 2026 •

edited

Loading