Fix Java AI workshop deployment reliability - #930
Merged
Conversation
added 30 commits
August 20, 2026 13:45
Scope workshop permissions and replace the public Lambda function URL with an authenticated API Gateway endpoint. Preserve dynamic account and region handling for Workshop Studio deployments.
Regenerate the java-on-aws CloudFormation template from the committed security remediation and embed the feat/holmes-remediation branch for workshop bootstrap.
Generate deterministic unattended Bash tests from workshop content using a shared runtime and central workshop registry. Reuse the registry for CloudFormation generation and synchronization, and preserve benchmark process cleanup.
Tag foundation and runtime ECR resources with immutable workshop identity. Persist stack identity in the IDE environment and add a java-on-aws-specific cleanup workflow that validates ownership, enumerates EKS and optional ECS dependencies, and fails closed before stack deletion.
- Remove --yaml flag from CDK synthesis to output JSON by default - Update workshop script generator to use template identifiers instead of repository names - Migrate temporary file cleanup to use template artifact IDs - Add cleanup for legacy repository-named artifacts during template migration - Reorder CodeBuild environment variables for consistency - Update script documentation to reference content paths without repository prefix - Regenerate CloudFormation template with updated content hash and timestamp
- Retain CloudFormation stack after cleanup instead of requesting deletion - Comment out delete-stack API call to allow cleanup to be rerun - Increase kubectl deployment wait timeout from 180s to 300s - Increase ECS service readiness deadline from 180s to 300s - Consolidate endpoint wait loop to use shared readiness_deadline variable - Change curl flags from -sS to -s for consistency - Remove unused endpoint_deadline variable in ECS service verification - Update line numbers in ws_run_block and ws_skip_block declarations - Stack is now preserved for post-workshop inspection and cleanup reruns
- Enable CloudFormation stack deletion in cleanup script after validation - Update cleanup error messages to reflect new deletion behavior - Add new ecs-redeploy.sh script for ECS service redeployment with status tracking - Enhance workshop generator to track tab container state and pass tab IDs to blocks - Update ws_begin_run invocation to accept additional arguments for test configuration - Improve ECS redeploy script with progress indicators and comprehensive error handling - Container tracking enables better tab state management in workshop test execution
…fication - Add explicit `aws ecs wait services-stable` call after ECS service deployment to ensure service reaches stable state before proceeding - Update health check endpoint from root path to `/actuator/health` for more reliable service readiness verification - Update line number references in ws_run_block and ws_skip_block calls to reflect added deployment wait logic - Improve reliability of deployment verification workflow by ensuring service stability before checking HTTP endpoint availability
…bers - Update ECS task definition query to target PRIMARY deployment status instead of latest - Change query from 'services[0].taskDefinition' to "services[0].deployments[?status=='PRIMARY'].taskDefinition | [0]" - Adjust test block line numbers to account for additional query line in block-005 - Apply consistent query pattern across multiple ECS describe-services calls - Ensures task definition retrieval uses currently active deployment rather than potentially stale reference
- Add credential variable extraction for ECR authentication in SOCI workflow - Replace docker login with ctr pull for more reliable image retrieval - Implement secure credential handling with variable unsetting after use - Add variable quoting to ECR_URI references for robustness - Update line number references in ws_run_block calls to reflect added lines - Improve script maintainability and security posture for container authentication
- Add --force flag to soci create command to handle existing indices - Ensures SOCI index creation succeeds even if index already exists - Improves reliability of container image preparation in workshop testing
- Add nodeSelector constraint to ECS DaemonSet to schedule collector on workshop node pool - Include clarifying comment explaining why node-local scheduling is required for discovery and profiling - Update line number references in ws_run_block calls to reflect added nodeSelector lines (164→254, 266→271, 281→286, 335→340, 343→348) - Enhance ws_run_block passed output to display formatted duration and current page/section/step/block context for better test visibility
- Add enabled block counting logic to track total enabled blocks across all pages - Implement block number sequencing to track current block position during execution - Update ws_run_block calls to include block number and total count parameters - Pass block progress information (current block number and total count) to runtime - Regenerate java-on-aws.sh with updated block progress tracking for all 217 enabled blocks - Improves workshop execution visibility by showing which block is currently running
- Reformat Docker login command to single line for clarity - Update line number references for block-001 from 40-49 to 37-44 - Update line number references for block-002 from 63-73 to 56-66 - Update line number references for block-003 from 83-96 to 76-89 - Update line number references for block-004 from 112-125 to 105-118 - Update line number references for block-005 from 135-151 to 128-144 - Update line number references for block-006 from 163-168 to 156-161 - Update line number references for block-007 from 182-191 to 175-184 - Update line number references for block-008 from 201-201 to 194-194 - Update line number references for block-009 from 207-217 to 200-210 - Update line number references for block-010 from 225-232 to 218-225 - Update line number references for block-011 from 238-238 to 231-231 - Update line number references for block-012 from 246-260 to 239-253 - Adjust all subsequent block line numbers to reflect source file changes
- Update all ws_run_block line number parameters from 217 to 219 across containerize-run and deploy-to-eks sections - Adjust references to accommodate documentation content shifts - Maintain consistency with source material line numbering
- Extract ServiceLatency alert rule creation logic into create_service_latency_alert() helper function - Consolidate platform-specific ALB discovery and alert payload generation into single reusable function - Update EKS and ECS blocks to call helper function instead of duplicating alert creation code - Add error handling with curl --fail and --fail-with-body flags for better debugging - Improve jq queries with -e flag and proper error handling for API responses - Add idempotency check to update existing alerts instead of creating duplicates - Simplify test block structure by reducing platform-specific code duplication - Update line number references in ws_run_block calls to reflect refactored content
…ine references - Replace while-read loop with awk for more efficient log tailing in analyzer output blocks - Use awk to print lines and flush output, exit on completion pattern match - Disable pipefail to allow awk to exit cleanly without propagating SIGPIPE - Update line number references across multiple worksheet blocks due to code restructuring - Simplify webhook log tailing implementation for consistency with other log monitoring blocks - Update informational block description to remove redundant platform-specific context
… module 322 - Add yq commands to remove profiling configuration (command, args, volumeMounts, volumes) from deployment before redeployment in block-002 - Remove persistent-storage volume references that remain from continuous-profiling module - Apply cleaned deployment YAML before kubectl rollout restart - Update line number references across all blocks (002-010) to account for new profiling cleanup commands - Ensures clean state when entering module 322 directly after continuous-profiling module
- Update line number references in block-008 from 167 to 172 - Refactor yq filter to remove existing ECS scrape config before adding new one - Change scrape_configs assignment from append operation to filter-and-append pattern - Update line number references in block-009 from 181/191 to 186/196 - Update line number references in block-010 from 198/207 to 203/212 - Prevents duplicate job entries when Prometheus configuration is reapplied
…ring - Check Express Gateway services first before classic ECS services to preserve correct deletion semantics - Add explanatory comment about Express API visibility through describe-services - Update error message to reflect Express-first detection order - Replace is_stack_resource calls with direct jq filtering for cluster resource lookup - Improve cluster filtering to explicitly check ResourceType and PhysicalResourceId match
…tasource verification - Add retry loop to verify Grafana Pod Identity credentials are injected before proceeding - Implement health check polling for CloudWatch datasource to ensure API access is ready - Replace simple pod restart with resilient credential verification (up to 6 retries) - Add detailed error messages for Pod Identity and CloudWatch datasource failures - Simplify workshop test block identifiers from padded strings to numeric block numbers - Remove unused explicitId field from block metadata in generate.mjs - Update all generated workshop test blocks to use numeric identifiers - Ensure both platform readiness and datasource health before completing setup
…rkshop test - Add S3 bucket retrieval and analysis baseline snapshot before load test execution - Implement polling loop with 9-minute timeout to wait for AI JVM analysis report completion - Add conditional logic to distinguish between full runs (requiring new analysis) and block-qualified resumes (accepting prior analysis) - Add guard clause to prevent redundant S3 bucket lookups when already cached - Update line number references for all affected test blocks (36-302) to reflect expanded block 5 content - Improve user feedback with periodic status messages during analysis wait period - Prevent false positives by comparing analysis report ETags against baseline snapshot
- Replace complex jq-based S3 object filtering with simpler awk pattern matching - Consolidate baseline tracking into single variable assignment with parameter expansion - Refactor polling loop to use SECONDS-based deadline instead of iteration counter - Eliminate separate ANALYSIS_REQUIRE_NEW flag logic by comparing baseline inline - Simplify error handling with single conditional check instead of nested branches - Remove intermediate variable parsing and directly output latest file timestamp - Update all block line number references to reflect condensed script size - Improve readability and reduce potential for polling timeout edge cases
- Split monolithic bedrock-agentcore policy into granular statements for browser automation, code interpreter, and identity operations - Add new agentcore-managed-tools-policy.json with scoped permissions for browser and code interpreter resources - Update WorkshopStack to apply resource-specific ARNs (aws.browser.v1 and aws.codeinterpreter.v1) instead of account-wide wildcards - Add AgentCoreManagedToolsPolicy to IDE role for java-spring-ai-agents, java-ai-agents, and java-ai-agents-advanced templates - Update workshop-boundary.json with matching granular policy statements for permission boundaries - Sync CloudFormation templates (java-ai-agents-stack.yaml, java-ai-agents-advanced-stack.yaml, java-spring-ai-agents-stack.yaml) with CDK changes - Improves least-privilege security posture by scoping bedrock-agentcore permissions to specific AWS-managed resources
added 8 commits
August 25, 2026 14:51
…orkflow - Add AWS SDK BOM import to resolve dependency conflicts between AgentCore Memory 2.1.0 and Spring AI 2.0.1 - Introduce DynamoDB table to persist CloudFormation callback state during CodeBuild execution - Refactor CodeBuild Lambda functions to use DynamoDB for tracking pending builds and coordinating responses - Update EventBridge rule to capture additional CodeBuild terminal states (FAULT, TIMED_OUT) - Replace Arrays with List for consistency in EventBridge event patterns - Fix EC2 network interface deletion policy to use wildcard resource instead of specific ARN - Add CDK Nag suppression for DynamoDB point-in-time recovery requirement - Add explicit construct dependencies to ensure proper deployment ordering - Remove unused CodeBuildIamRoleArn property from custom resource - Simplify Lambda function environment variable management through table grants - Update demo script to handle AWS SDK version coherence for Java Spring AI agents
…CR repository validation
…and improved logging
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Remediates workshop IAM, infrastructure, and end-to-end deployment validation; please squash merge.