Skip to content

direct: raise resource generator recursion cap from 4 to 10 - #6376

Merged
janniklasrose merged 3 commits into
mainfrom
janniklasrose/raise-resource-generator-cap
Aug 25, 2026
Merged

direct: raise resource generator recursion cap from 4 to 10#6376
janniklasrose merged 3 commits into
mainfrom
janniklasrose/raise-resource-generator-cap

Conversation

@janniklasrose

@janniklasrose janniklasrose commented Aug 25, 2026

Copy link
Copy Markdown
Contributor

Changes

  • Increase resource field depth cap from 4 to 10
  • Auto-generate the spec:input_only for a depth 5 field

Why

#6366 allowed field behaviour from nested fields, but custom_provider_config fields were still skipped.
The cap of depth 4 was arbitrary and 10 is sufficient to prevent runaway.

Tests

Existing ones pass, added custom_provider_config to exercise it e2e

Before bumping max_depth to 10 the task generate-direct-resources would fail like this:

Traceback (most recent call last):
  File "/Users/jan.rose/pub/cli.worktrees/review-pr-6366/bundle/direct/tools/generate_resources.py", line 225, in <module>
    main()
  File "/Users/jan.rose/pub/cli.worktrees/review-pr-6366/bundle/direct/tools/generate_resources.py", line 214, in main
    all_behaviors = get_field_behaviors(schemas, type_name, resource, array_element_types)
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/jan.rose/pub/cli.worktrees/review-pr-6366/bundle/direct/tools/generate_resources.py", line 110, in get_field_behaviors
    return extract(schemas[type_name], "", set(), 0, inherited)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/jan.rose/pub/cli.worktrees/review-pr-6366/bundle/direct/tools/generate_resources.py", line 105, in extract
    results.update(extract(schemas[elem_type], f"{path}[*]", visited, depth + 1, propagate))
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/jan.rose/pub/cli.worktrees/review-pr-6366/bundle/direct/tools/generate_resources.py", line 97, in extract
    results.update(extract(schemas[ref], path, visited, depth + 1, propagate))
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/jan.rose/pub/cli.worktrees/review-pr-6366/bundle/direct/tools/generate_resources.py", line 105, in extract
    results.update(extract(schemas[elem_type], f"{path}[*]", visited, depth + 1, propagate))
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/jan.rose/pub/cli.worktrees/review-pr-6366/bundle/direct/tools/generate_resources.py", line 97, in extract
    results.update(extract(schemas[ref], path, visited, depth + 1, propagate))
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/jan.rose/pub/cli.worktrees/review-pr-6366/bundle/direct/tools/generate_resources.py", line 97, in extract
    results.update(extract(schemas[ref], path, visited, depth + 1, propagate))
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/jan.rose/pub/cli.worktrees/review-pr-6366/bundle/direct/tools/generate_resources.py", line 82, in extract
    raise Exception(f"Nested field found at depth {depth} ({max_depth=})")
Exception: Nested field found at depth 5 (max_depth=4)
task: Failed to run task "generate-direct-resources": exit status 1

The generator's field-behavior walker capped recursion at depth 4. Now that
fields legitimately sit at depth 5 -- e.g.
config.served_entities[*].external_model.custom_provider_config.{api_key_auth.value_plaintext,bearer_token_auth.token_plaintext},
where the extra auth wrapper object pushes them one level past the cap while
the sibling providers' plaintext keys land at depth 4 and were already caught.

The cap is not needed for termination: `visited` already expands each schema
type at most once, so recursion is bounded regardless. Output saturates at
depth 5 (cap 5, 6, and 10 produce identical results), so 10 is pure headroom
as a runaway guard.

Regenerate resources.generated.yml (adds the two fields above) and drop the
now-redundant manual workaround for them in resources.yml.

Co-authored-by: Isaac <no-reply@databricks.com>
reason: spec:input_only
- field: config.served_entities[*].external_model.cohere_config.cohere_api_key_plaintext
reason: spec:input_only
- field: config.served_entities[*].external_model.custom_provider_config.api_key_auth.value_plaintext

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we also add a test covering custom_provider_config?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've extended acceptance/bundle/resources/model_serving_endpoints/drift/write_only to verify it works e2e. But in general we probably need a test on the generate_resources.py tool to assert behaviour (at arbitrary depth). Leaving this out of scope of this PR though.

@eng-dev-ecosystem-bot

eng-dev-ecosystem-bot commented Aug 25, 2026

Copy link
Copy Markdown
Collaborator

Integration test report

Commit: 09dab5c

Run: 32846484949

Env 🔄​flaky 💚​RECOVERED 🙈​SKIP ✅​pass 🙈​skip Time
💚​ aws linux 1 4 274 1182 5:01
💚​ aws windows 1 4 276 1180 4:00
💚​ azure linux 1 4 273 1182 4:50
💚​ azure windows 1 4 275 1180 4:41
🔄​ gcp linux 2 1 4 272 1182 5:03
💚​ gcp windows 1 4 276 1180 4:17
7 interesting tests: 4 SKIP, 2 flaky, 1 RECOVERED
Test Name aws linux aws windows azure linux azure windows gcp linux gcp windows
💚​ TestAccept 💚​R 💚​R 💚​R 💚​R 💚​R 💚​R
🙈​ TestAccept/bundle/invariant/no_drift 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S
🙈​ TestAccept/bundle/resources/vector_search_endpoints/drift/recreated_same_name 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S
🙈​ TestAccept/bundle/resources/vector_search_indexes/recreate/embedding_dimension 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S
🙈​ TestAccept/ssh/connection 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S
🔄​ TestFilerRecursiveDelete ✅​p ✅​p ✅​p ✅​p 🔄​f ✅​p
🔄​ TestFilerRecursiveDelete/workspace_files_extensions ✅​p ✅​p ✅​p ✅​p 🔄​f ✅​p
Top 3 slowest tests (at least 2 minutes):
duration env testname
4:36 azure windows TestAccept
4:08 gcp windows TestAccept
3:56 aws windows TestAccept

@janniklasrose
janniklasrose requested a review from radakam August 25, 2026 11:56

@radakam radakam left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

probably makes sense to add .nextchanges?

# (e.g. external_model.custom_provider_config.bearer_token_auth.token_plaintext),
# so keep ample headroom above that.
if depth > 10:
return {}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we crash here instead of silently dropping fields?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is build-time so yes, let's crash and raise the limit if we encounter resources nested that deep

@janniklasrose

Copy link
Copy Markdown
Contributor Author

probably makes sense to add .nextchanges?

@radakam not a user-facing change since the field was already marked input-only, this is internal-only

@janniklasrose
janniklasrose added this pull request to the merge queue Aug 25, 2026
Merged via the queue into main with commit 174e4ea Aug 25, 2026
23 checks passed
@janniklasrose
janniklasrose deleted the janniklasrose/raise-resource-generator-cap branch August 25, 2026 12:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants