[hypershell-builder]

Summary

This change moves HyperShell's pinned OpenShell gateway from v0.1.5-rhaiv.3
to v0.1.6-rhaiv.0, the newest stable midstream release. It updates image
tags, vendors the matching Helm chart, and updates version citations in specs
and skill docs. It does not change any Go code.

• Bumped OPENSHELL_TAG in OPENSHELL_VERSION and ran the standard sync
  (deployment env vars, capability labels on four overlays).
• Vendored charts/openshell/ from the v0.1.6-rhaiv.0 tag (27 files
  changed). All new chart features are optional and off by default for
  HyperShell; see the triage notes below.
• Updated the matching tag string in the ROKS e2e script, the CLI e2e image
  pin, and spec/skill doc examples that cite the tag.
• Ran all Python policy checks that make up make check directly (make
  itself cannot run in this agent runtime); all pass. go build/vet/test
  could not run in this runtime (no Go toolchain available) - the one
  changed .go file is a single string-literal image-tag edit, so this is a
  recorded gap for CI or a human reviewer to confirm, not a known break.

This replaces PR #810

PR #810 (chore(deps): bump OpenShell to v0.1.5-rhaiv.4) is open but now
conflicts with main, and a newer stable tag exists. This PR branches from
current main and bumps straight to v0.1.6-rhaiv.0, carrying forward the
findings from #810's triage. Please close #810 once this PR is reviewed;
this agent does not close or merge pull requests.

Release-note triage

Needs a maintainer decision (already tracked, not fixed here)

Issue #809 tracks a change that first appeared in v0.1.5-rhaiv.4 and is
still present in v0.1.6-rhaiv.0: the gateway now refuses to start - before
it opens any network port - if no OIDC, mTLS, operator auth, or
gateway_jwt is configured and allow_unauthenticated_users is not set to
true (NVIDIA/OpenShell#4821). HyperShell's own config check
(ValidateRenderedGatewayConfig) still accepts that setup as valid today,
and the control plane can produce it for a gateway reconciled while Keycloak
integration is off and no custom OIDC issuer is set. After this bump, such a
gateway will crash-loop at startup instead of running insecurely as before.
This PR does not change that behavior; #809 remains open for a maintainer
decision.

New finding: verify before the next live deployment (not fixed here)

Starting in v0.1.6-rhaiv.0, new sandboxes on the Kubernetes, Docker,
Podman, and VM drivers open their control connection to the supervisor,
reversing the old direction where the supervisor connected to the sandbox
(NVIDIA/OpenShell#4656; already-running sandboxes keep the old direction
through the upgrade). HyperShell's openshell-gateway-allow-sandbox
NetworkPolicy already allows sandbox pods to reach the gateway pod on port
8080, and the chart's sandbox NetworkPolicy only ever restricted traffic
into sandbox pods on port 2222 (SSH) - never outbound traffic from
sandbox pods - so nothing in the current NetworkPolicy set should block
this. However, the exact port the reversed control connection itself uses
was not confirmed from the release notes or the vendored chart. Flagging
this for verification on the next Kind or ROKS deployment; no NetworkPolicy
change is made in this PR.

Additive or inert, no action needed

• An experimental shared-supervisor high-availability pool (replicas,
  autoscaling, pod-disruption budget, a new NetworkPolicy) and an
  operator-owned additional-CA trust bundle for sandbox supervisors. Both
  are off unless HyperShell explicitly opts in
  (supervisor_topology = "gateway" or
  supervisor.network.additionalCaConfigMapName), and HyperShell sets
  neither. Confirmed by reading the chart's conditional logic directly, not
  only the release notes.
• A field in an internal compute-driver message was renamed
  (ResumeBoundaryRequest). This only affects external compute-driver
  plugins; HyperShell uses the built-in Kubernetes driver.
• The gateway now writes its own audit log entries for authorization and
  credential events. This needs no configuration from HyperShell.
• A new optional hostname format for exposed sandbox services defaults to
  the existing readable format, so current behavior is unchanged.
• Two new optional Helm values (server.extraEnv,
  pkiInitJob.podLabels/podAnnotations). Not adopted.

Console dashboard: unchanged

The console dashboard image stays pinned to its current release. A newer
release exists, but this agent runtime cannot reach quay.io to resolve its
image digest. This gap is already tracked in issues #760 and #752 and is not
duplicated here.

Files changed

• OPENSHELL_VERSION, deploy/base/platform-resources/controller.yaml,
  deploy/{gitops/platform,ibm,kind,openshift}/kustomization.yaml - pin sync
• charts/openshell/ - vendored Helm chart at v0.1.6-rhaiv.0
• components/pr-test/e2e-openshell-roks.sh, tests/e2e/cli_test.go - e2e
  image pins
• specs/platform/{data-model,global-architecture,openshell-gateway, openshell-image-auto-update}.spec.md - version citations
• skills/deploy/{deploy-cluster,gcp-cluster,ibm-cluster}/SKILL.md - example
  image pins
• skills/tooling/update-openshell/SKILL.md - Learnings log entry and a
  footprint-table correction

Test plan

• All runnable make check sub-checks (Python policy scripts and their
  unit tests) pass directly
• Confirmed the new chart's RBAC grants and NetworkPolicy are all gated
  behind opt-in features HyperShell does not enable; no
  controller-rbac.yaml change needed
• Full-repo grep confirms no stray old-version string remains outside
  intentional fixtures and historical log entries
• go build/vet/test - could not run in this agent runtime (no Go
  toolchain); please confirm in CI
• Live cluster validation (Kind or ROKS) of the new gateway image,
  including the sandbox control-connection direction change above, is
  still needed

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: openshift-online/hypershell
• Branch: main
• File: .coderabbit.yaml
• Commit: 78100ec
• Layers: Repository YAML (base), Central YAML (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1690c6c5-b87c-4983-88f7-f9370aab4421

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

HyperShell environment destroyed

This ephemeral OpenShift environment has been destroyed. Comment /pr-extend to redeploy it.

[codecov-appsre]

Codecov Report

✅ All modified and coverable lines are covered by tests.

@@           Coverage Diff           @@
##             main     #822   +/-   ##
=======================================
  Coverage   43.88%   43.88%           
=======================================
  Files         383      383           
  Lines       29514    29514           
=======================================
  Hits        12951    12951           
  Misses      14923    14923           
  Partials     1640     1640           

Flag	Coverage Δ
control-plane	54.14% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 78100ec...31f6c8e. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.