chore(server): remove the resources_config_path boot loader flow

[rohilsurana]

Status

The deprecation window has elapsed. resources_config_path was deprecated at v0.110.0 for two minor versions, and frontier is now at v0.114.0, so the removal is due. This stays a draft on the deployment gate below: it should land only once every deployment has cut over to the reconcile flow.

What

Removes the app.resources_config_path boot loader end to end. Custom permissions and role overrides are now managed through the reconcile flow (the Permission and Role kinds), so the server no longer reads a resource config file at startup.

• cmd/serve.go: drop the resource blob load and the SchemaConfigRepository wiring.
• internal/bootstrap: drop the FileService (schemaConfig) dependency. MigrateSchema now re-applies the base schema merged with the permissions already in the DB (via AppendSchema, which preserves them) instead of reading a config file. MigrateRoles no longer creates config-defined custom roles, since reconcile owns them. BuiltinPermissions (the permission delete-guard) reports only base-schema permissions.
• pkg/server/config.go: remove the resources_config_path and resources_config_path_secret fields.
• internal/store/blob/schema_repository.go: removed, no longer used.
• config/sample.config.yaml: drop the sample entries.
• test/e2e: the regression and smoke suites seed custom compute resources through the admin API instead of a resource config file. The shared setup lives in testbench/helper.go.

Why it is safe

Existing custom permissions survive across boots because they live in the database, and AppendSchema merges them back into the schema. Existing role overrides survive because MigrateRoles is skip-if-exists. So on a server that has already migrated, this is a no-op. On one that has not, it stops seeding from the config, which is why the cutover gate matters.

Gating

• This is a breaking change for users still on resources_config_path, so removal waits out the two-minor-version deprecation window. That window is now over: deprecated at v0.110.0, past the v0.112.0 removal target, current release v0.114.0.
• A deployment must run the reconcile flow first, so roles and permissions are owned there, and must drop resources_config_path from its own config before taking this build.

Verification

Rebased onto current main (70 commits ahead of the old base) with no conflicts. go build ./..., go vet, and unit tests for internal/bootstrap, pkg/server, and core/resource pass. gofmt and vet clean.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
frontier	Ready	Preview	Aug 11, 2026 10:11am

[coderabbitai]

Warning

Review limit reached

@rohilsurana, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 7 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: c2860087-9ba1-4b0e-b0fc-a36068407a45

📥 Commits

Reviewing files that changed from the base of the PR and between 1f4e1a2 and b74cbdb.

📒 Files selected for processing (8)

• docs/content/docs/authz/custom-resources.mdx
• docs/content/docs/configurations.mdx
• docs/content/docs/reference/configurations.mdx
• internal/store/blob/testdata/compute.yml
• internal/store/blob/testdata/database.yml
• test/e2e/regression/api_test.go
• test/e2e/regression/onboarding_test.go
• test/e2e/testbench/helper.go

📝 Walkthrough

Summary by CodeRabbit

• Breaking Changes

  • Removed support for the deprecated resource configuration settings.
  • Resource permissions and custom roles are no longer loaded from configuration files during startup.

• Behavior Updates

  • Custom roles and permissions can be managed through the administration API.
  • Built-in permissions continue to be restored automatically when the service starts.
  • Permission deletion messaging now reflects the updated restoration behavior.

• Configuration

  • Removed deprecated resource configuration entries from the sample configuration.

Walkthrough

The server no longer loads deprecated resource configuration at boot. Bootstrap uses only the base schema and database-backed permissions. End-to-end tests seed custom compute permissions and roles through the admin API.

Changes

Resource configuration removal

Layer / File(s)	Summary
Remove resource configuration wiring cmd/serve.go	Server startup no longer creates the resource blob or schema repository.
Use base-schema bootstrap migration internal/bootstrap/service.go, internal/api/v1beta1connect/permission.go	Bootstrap removes configuration-based schema and role migration. Built-in permission messages now refer to the base schema.
Seed test resources through the admin API test/e2e/regression/..., test/e2e/smoke/..., test/e2e/testbench/helper.go	Tests remove fixture configuration and create compute permissions and roles with SeedComputeResources.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• raystack/frontier#1720: Both changes modify server startup and bootstrap dependency wiring.
• raystack/frontier#1766: Both changes remove deprecated resource configuration infrastructure and boot-time schema loading.

Suggested reviewers: whoabhisheksah

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coveralls]

Coverage Report for CI Build 31481063487

Coverage decreased (-0.02%) to 48.082%

Details

• Coverage decreased (-0.02%) from the base build.
• Patch coverage: 7 uncovered changes across 3 files (0 of 7 lines covered, 0.0%).
• 17 coverage regressions across 3 files.

Uncovered Changes

File	Changed	Covered	%
internal/bootstrap/service.go	5	0	0.0%
cmd/serve.go	1	0	0.0%
internal/api/v1beta1connect/permission.go	1	0	0.0%

Coverage Regressions

17 previously-covered lines in 3 files lost coverage.

File	Lines Losing Coverage	Coverage
internal/store/blob/blob.go	15	0.0%
cmd/serve.go	1	0.0%
internal/bootstrap/service.go	1	22.51%

---

Coverage Stats

Relevant Lines:	39861
Covered Lines:	19166
Line Coverage:	48.08%
Coverage Strength:	15.39 hits per line

---

💛 - Coveralls

[rohilsurana]

Automated code review (xhigh). Findings below, most important first. Two are behavior questions worth confirming before merge; the rest are cleanups.