Repository navigation
fix(extraction): bump pinned OpenShell to v0.0.83 for Sandbox v1beta1 support - #794
Merged
Merged
Conversation
Contributor
📝 WalkthroughSummary by CodeRabbit
WalkthroughBoth OpenShell Dockerfiles now pin version Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 10 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (10 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
scripts/verify-fleet-apps-kartograph.sh (1)
79-81: 🔒 Security & Privacy | 🔵 TrivialDo not encode authorization state as a static fact.
This message claims the CRD/controller and ArgoCD RBAC escalation are confirmed “as of 2026-07-15,” but the shown branch only prints text. After permission drift, operators may incorrectly conclude that
openshell-rbac.yamlshould be active and miss the actual authorization failure. Make the check data-driven, or label this as a dated, non-authoritative note linked to the change record.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/verify-fleet-apps-kartograph.sh` around lines 79 - 81, Update the status message in the verification script so it does not present CRD/controller or ArgoCD RBAC authorization as a current confirmed fact based only on static text. Make the output reflect an actual validation result, or clearly label it as a dated, non-authoritative note referencing the change record.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@deploy/container/openshell-gateway/Dockerfile`:
- Around line 12-14: Replace the mutable ubi9/ubi-minimal:latest base image with
a digest-pinned UBI image in deploy/container/openshell-gateway/Dockerfile lines
12-14 and src/api/Dockerfile line 42. Preserve the existing UBI 9 minimal base
while pinning it to an immutable digest at both sites.
- Line 14: Pin and verify the downloaded OpenShell archive before extraction in
both deploy/container/openshell-gateway/Dockerfile (lines 14-14) and
src/api/Dockerfile (lines 42-42). Add the release checksum or signature as a
build-time verification input, validate each archive immediately after download,
and only run tar extraction after verification succeeds.
---
Nitpick comments:
In `@scripts/verify-fleet-apps-kartograph.sh`:
- Around line 79-81: Update the status message in the verification script so it
does not present CRD/controller or ArgoCD RBAC authorization as a current
confirmed fact based only on static text. Make the output reflect an actual
validation result, or clearly label it as a dated, non-authoritative note
referencing the change record.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 7073b993-df35-4329-b5db-4fd2b7d4edab
📒 Files selected for processing (4)
deploy/container/openshell-gateway/Dockerfilescripts/verify-fleet-apps-kartograph.shsrc/api/Dockerfilesrc/api/tests/unit/extraction/infrastructure/test_openshell_version_pin.py
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift-hyperfleet/architecture(manual)openshift-hyperfleet/hyperfleet-api(manual)openshift-hyperfleet/hyperfleet-sentinel(manual)openshift-hyperfleet/hyperfleet-adapter(manual)openshift-hyperfleet/hyperfleet-broker(manual)
Comment on lines
12
to
+14
| FROM registry.access.redhat.com/ubi9/ubi-minimal:latest | ||
|
|
||
| ARG OPENSHELL_VERSION=0.0.62 | ||
| ARG OPENSHELL_VERSION=0.0.83 |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== Dockerfile refs ==\n'
rg -n --glob 'deploy/container/openshell-gateway/Dockerfile' --glob 'src/api/Dockerfile' '^(FROM|ARG OPENSHELL_VERSION|COPY|RUN)' deploy/container/openshell-gateway/Dockerfile src/api/Dockerfile || true
printf '\n== Context: deploy/container/openshell-gateway/Dockerfile ==\n'
nl -ba deploy/container/openshell-gateway/Dockerfile | sed -n '1,120p'
printf '\n== Context: src/api/Dockerfile ==\n'
nl -ba src/api/Dockerfile | sed -n '1,120p'Repository: openshift-hyperfleet/kartograph
Length of output: 1903
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== Relevant diff/stat context ==\n'
git diff --stat -- deploy/container/openshell-gateway/Dockerfile src/api/Dockerfile || true
printf '\n== Changed lines around Dockerfiles ==\n'
git diff --unified=20 -- deploy/container/openshell-gateway/Dockerfile src/api/Dockerfile || trueRepository: openshift-hyperfleet/kartograph
Length of output: 243
Pin mutable UBI bases by digest — ubi9/ubi-minimal:latest is a mutable supply-chain input (CWE-829).
deploy/container/openshell-gateway/Dockerfile#L12-L14src/api/Dockerfile#L40-L42
Use a digest-pinned UBI image here instead of latest.
📍 Affects 2 files
deploy/container/openshell-gateway/Dockerfile#L12-L14(this comment)src/api/Dockerfile#L42-L42
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@deploy/container/openshell-gateway/Dockerfile` around lines 12 - 14, Replace
the mutable ubi9/ubi-minimal:latest base image with a digest-pinned UBI image in
deploy/container/openshell-gateway/Dockerfile lines 12-14 and src/api/Dockerfile
line 42. Preserve the existing UBI 9 minimal base while pinning it to an
immutable digest at both sites.
Source: Path instructions
| FROM registry.access.redhat.com/ubi9/ubi-minimal:latest | ||
|
|
||
| ARG OPENSHELL_VERSION=0.0.62 | ||
| ARG OPENSHELL_VERSION=0.0.83 |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n## Relevant Dockerfiles\n'
for f in deploy/container/openshell-gateway/Dockerfile src/api/Dockerfile; do
echo "--- $f"
nl -ba "$f" | sed -n '1,220p'
done
printf '\n## Search for checksum/signature/verification mechanisms\n'
rg -n --hidden --no-ignore-vcs -S \
'sha256|checksum|cosign|cosign|gpg|pgp|sha512|verify|openssl dgst|artifact|release' \
deploy/container src api .github 2>/dev/null || true
printf '\n## Search for OpenShell references\n'
rg -n --hidden --no-ignore-vcs -S 'openshell|OPENSHELL_VERSION' . 2>/dev/null || trueRepository: openshift-hyperfleet/kartograph
Length of output: 284
🏁 Script executed:
#!/bin/bash
set -euo pipefail
for f in deploy/container/openshell-gateway/Dockerfile src/api/Dockerfile; do
echo "===== $f ====="
nl -ba "$f" | sed -n '1,140p'
doneRepository: openshift-hyperfleet/kartograph
Length of output: 267
🏁 Script executed:
#!/bin/bash
set -euo pipefail
for f in deploy/container/openshell-gateway/Dockerfile src/api/Dockerfile; do
echo "===== $f ====="
sed -n '1,180p' "$f"
done
printf '\n===== OpenShell verification search =====\n'
rg -n -S 'sha256|checksum|cosign|gpg|pgp|verify|openssl dgst|openshell|OPENSHELL_VERSION' \
deploy/container src .github 2>/dev/null || trueRepository: openshift-hyperfleet/kartograph
Length of output: 50388
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '===== deploy/container/openshell-gateway/Dockerfile ====='
grep -n -E '^(ARG OPENSHELL_VERSION|RUN |COPY |ADD |ENV |FROM )' deploy/container/openshell-gateway/Dockerfile | sed -n '1,120p'
echo
echo '===== src/api/Dockerfile ====='
grep -n -E '^(ARG OPENSHELL_VERSION|RUN |COPY |ADD |ENV |FROM )' src/api/Dockerfile | sed -n '1,160p'
echo
echo '===== OpenShell verification markers ====='
grep -RIn -E 'sha256|checksum|cosign|gpg|pgp|verify|openssl dgst|OPENSHELL_VERSION|openshell' deploy/container src/api .github 2>/dev/null | sed -n '1,120p'Repository: openshift-hyperfleet/kartograph
Length of output: 15914
Add checksum or signature verification for both OpenShell archives (CWE-494). deploy/container/openshell-gateway/Dockerfile and src/api/Dockerfile download and extract release tarballs from GitHub without a pinned digest or signature check; verify the payload before tar xzf.
📍 Affects 2 files
deploy/container/openshell-gateway/Dockerfile#L14-L14(this comment)src/api/Dockerfile#L42-L42
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@deploy/container/openshell-gateway/Dockerfile` at line 14, Pin and verify the
downloaded OpenShell archive before extraction in both
deploy/container/openshell-gateway/Dockerfile (lines 14-14) and
src/api/Dockerfile (lines 42-42). Add the release checksum or signature as a
build-time verification input, validate each archive immediately after download,
and only run tar extraction after verification succeeds.
… support kartograph-stage's Graph Management Assistant was failing to start sessions: the openshell-gateway sidecar's Kubernetes compute driver errored on every sandbox list/watch call with a raw "404 page not found" (not a structured NotFound Status) once the previously-blocking RBAC issue (openshell-rbac.yaml, fixed via hybrid-platforms-gitops/infrastructure!76) was resolved. Root cause: our pinned OpenShell release (v0.0.62) hardcodes the Kubernetes driver's Sandbox custom resource to agents.x-k8s.io/v1alpha1 with no fallback. NVIDIA/OpenShell#2009 (first released in v0.0.72) added runtime detection of the served Sandbox API version, trying v1beta1 before falling back to v1alpha1 - required because the Agent Sandbox CRD installed on this cluster serves v1beta1, not v1alpha1. A raw (non-JSON) 404 is exactly the signature of probing a group/version the API server's router doesn't recognize at all, which matches this failure precisely. Bumps both Dockerfiles that vendor the OpenShell binaries (the CLI in src/api/Dockerfile and the gateway sidecar in deploy/container/openshell-gateway/Dockerfile) to v0.0.83, the latest published release, keeping CLI/gateway protocol versions in lockstep. Adds a regression test enforcing that invariant plus a minimum-version floor so this can't silently regress. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
…it review Verifies the downloaded openshell/openshell-gateway release archives against NVIDIA's published sha256 checksums before extraction, so a compromised or corrupted CDN response fails the build instead of silently landing in the image. Build-tested locally with podman for both Dockerfile stages, including a deliberate checksum mismatch to confirm the build fails closed. Also softens a verify-fleet-apps-kartograph.sh comment that stated the openshell-rbac.yaml RBAC/CRD prerequisites as a live authoritative fact rather than a dated historical note, per review feedback. Co-authored-by: Cursor <cursoragent@cursor.com>
aredenba-rh
force-pushed
the
fix/openshell-gateway-sandbox-v1beta1-support
branch
from
July 15, 2026 20:00
cfb0bd8 to
c4099c3
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@deploy/container/openshell-gateway/Dockerfile`:
- Around line 16-25: Convert the Dockerfile into a multi-stage build: use a
builder stage for installing gzip/tar, downloading and checksum-verifying the
archive, and extracting openshell-gateway; then use a minimal digest-pinned
runtime stage that copies only /usr/local/bin/openshell-gateway from the
builder. Remove build tooling and temporary artifacts from the final image while
preserving the existing OPENSHELL_VERSION-based download and verification flow.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: a2fa5ada-cb4f-4afb-b880-3fe9fab48e0d
📒 Files selected for processing (4)
deploy/container/openshell-gateway/Dockerfilescripts/verify-fleet-apps-kartograph.shsrc/api/Dockerfilesrc/api/tests/unit/extraction/infrastructure/test_openshell_version_pin.py
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift-hyperfleet/architecture(manual)openshift-hyperfleet/hyperfleet-api(manual)openshift-hyperfleet/hyperfleet-sentinel(manual)openshift-hyperfleet/hyperfleet-adapter(manual)openshift-hyperfleet/hyperfleet-broker(manual)
🚧 Files skipped from review as they are similar to previous changes (2)
- scripts/verify-fleet-apps-kartograph.sh
- src/api/tests/unit/extraction/infrastructure/test_openshell_version_pin.py
Comment on lines
16
to
25
| RUN microdnf install -y ca-certificates gzip tar \ | ||
| && curl -fsSL -o /tmp/openshell-gateway.tgz \ | ||
| && curl -fsSL -o /tmp/openshell-gateway-x86_64-unknown-linux-gnu.tar.gz \ | ||
| "https://github.com/NVIDIA/OpenShell/releases/download/v${OPENSHELL_VERSION}/openshell-gateway-x86_64-unknown-linux-gnu.tar.gz" \ | ||
| && tar xzf /tmp/openshell-gateway.tgz -C /usr/local/bin \ | ||
| && curl -fsSL -o /tmp/openshell-gateway-checksums-sha256.txt \ | ||
| "https://github.com/NVIDIA/OpenShell/releases/download/v${OPENSHELL_VERSION}/openshell-gateway-checksums-sha256.txt" \ | ||
| && (cd /tmp && grep " openshell-gateway-x86_64-unknown-linux-gnu.tar.gz$" openshell-gateway-checksums-sha256.txt | sha256sum -c -) \ | ||
| && tar xzf /tmp/openshell-gateway-x86_64-unknown-linux-gnu.tar.gz -C /usr/local/bin \ | ||
| && chmod 755 /usr/local/bin/openshell-gateway \ | ||
| && rm -f /tmp/openshell-gateway.tgz \ | ||
| && rm -f /tmp/openshell-gateway-x86_64-unknown-linux-gnu.tar.gz /tmp/openshell-gateway-checksums-sha256.txt \ | ||
| && microdnf clean all |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Move build tooling into a separate stage (CWE-250/CWE-732).
The gateway image installs gzip and tar directly into its only stage, leaving build-time packages in production. Use a builder stage for download, verification, and extraction, then copy only /usr/local/bin/openshell-gateway into a minimal digest-pinned runtime stage.
As per path instructions, container builds must use multi-stage builds to minimize final image size and attack surface.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@deploy/container/openshell-gateway/Dockerfile` around lines 16 - 25, Convert
the Dockerfile into a multi-stage build: use a builder stage for installing
gzip/tar, downloading and checksum-verifying the archive, and extracting
openshell-gateway; then use a minimal digest-pinned runtime stage that copies
only /usr/local/bin/openshell-gateway from the builder. Remove build tooling and
temporary artifacts from the final image while preserving the existing
OPENSHELL_VERSION-based download and verification flow.
Source: Path instructions
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
openshell-gateway's Kubernetes compute driver was erroring on every sandbox list/watch call with a raw (non-JSON)404 page not foundinkartograph-stage, breaking Graph Management Assistant session start.v0.0.62) hardcodes the Kubernetes driver's Sandbox custom resource toagents.x-k8s.io/v1alpha1with no fallback. The Agent Sandbox CRD installed on the cluster now servesv1beta1, notv1alpha1. NVIDIA/OpenShell#2009 (first released inv0.0.72) added runtime detection of the served Sandbox API version (v1beta1first, falling back tov1alpha1), and explicitly documents the raw-404 signature we observed as the exact failure mode this was written to handle.hybrid-platforms-gitops/infrastructure!76fixed a separate, previously-blocking RBAC issue (openshell-rbac.yaml's Role/RoleBinding couldn't sync because ArgoCD's application controller SA didn't hold the verbs it needed to grant). Once that RBAC sync succeeded, the driver's list/watch calls started reaching the API server, exposing this version mismatch underneath.OPENSHELL_VERSIONin bothsrc/api/Dockerfile(theopenshellCLI) anddeploy/container/openshell-gateway/Dockerfile(the gateway sidecar) tov0.0.83, the latest published release, keeping CLI/gateway protocol versions in lockstep.test_openshell_version_pin.py: a regression test enforcing both Dockerfiles stay pinned to the same version, and that the version is high enough to include the Sandbox API auto-detection fix.scripts/verify-fleet-apps-kartograph.shthat still describedopenshell-rbac.yamlas expected to be disabled.Test plan
v0.0.62pin, passes (green) after the bump.uv run pytest tests/unit, 3515 passed).kartograph-apiandkartograph-openshell-gatewayimages for this PR/merge, bump the stage image tags inhp-fleet-gitopsand confirm via ArgoCD/pod logs that the openshell-gateway sidecar inkartograph-stagesuccessfully detectsagents.x-k8s.io/v1beta1and stops erroring on sandbox list/watch.Made with Cursor