Repository navigation
chore(deps): bump OpenShell to v0.1.6-rhaiv.1 - #845
hypershell-builder[bot] wants to merge 1 commit into
Conversation
Moves HyperShell's pinned OpenShell gateway from v0.1.5-rhaiv.3 to v0.1.6-rhaiv.1, the newest stable midstream release, and vendors the matching Helm chart. Supersedes the stale PR 810 (v0.1.5-rhaiv.4) and PR 822 (v0.1.6-rhaiv.0): the v0.1.6-rhaiv.0..v0.1.6-rhaiv.1 delta is dependency-only (rustls, RPM lockfile refresh), so 822's triage was re-verified against this tag rather than redone. Also folds back a gateway-spec Auth Section note (drafted in 810 but never merged) that documents the still-open issue 809 gap. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
hypershell-builder
Bot
added
the
agent/reviewable-code
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the
 |
HyperShell environment destroyedThis ephemeral OpenShift environment has been destroyed. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. @@ Coverage Diff @@
## main #845 +/- ##
=======================================
Coverage 44.82% 44.82%
=======================================
Files 386 386
Lines 30412 30412
=======================================
+ Hits 13631 13633 +2
+ Misses 15053 15051 -2
Partials 1728 1728
Flags with carried forward coverage won't be shown. Click here to find out more. Continue to review full report in Codecov by Sentry.
🚀 New features to boost your workflow:
|
Summary
This change moves HyperShell's pinned OpenShell gateway from
v0.1.5-rhaiv.3to
v0.1.6-rhaiv.1, the newest stable midstream release. It updates imagetags, vendors the matching Helm chart, and updates version citations in specs
and skill docs. It does not change control-plane behavior.
This replaces PR #810 and PR #822
Two OpenShell update PRs were already open when this run started:
v0.1.5-rhaiv.4. It is stale, conflicts withmain, andpredates PR refactor: remove the gateway-version capability and provisioning version #823 (merged), which removed the gateway-version capability
label this PR's diff still touches.
v0.1.6-rhaiv.0, one rhaiv patch behind the currentlatest tag.
Comparing
v0.1.6-rhaiv.0...v0.1.6-rhaiv.1onopendatahub-io/openshellshows only 5 dependency-bump commits (rustls, RPM lockfile refresh) - the
NVIDIA base version did not change, so every finding in PR #822's triage
still applies and was re-checked directly against the
v0.1.6-rhaiv.1chart rather than re-derived from scratch. Please close #810 and #822 once
this PR is reviewed; this agent does not close or merge pull requests.
What changed
OPENSHELL_TAGinOPENSHELL_VERSIONand ran the standard pin sync(
deploy/base/platform-resources/controller.yaml,deploy/ibm/kustomization.yaml).charts/openshell/from thev0.1.6-rhaiv.1tag. The chart addsan experimental shared-supervisor high-availability pool
(
supervisor_topology = "gateway"); it is off by default and HyperShelldoes not opt in, so it renders nothing for HyperShell's deployments.
pin, the IBM ROKS mirror commands, and spec/skill doc examples.
"Known gap" note to
openshell-gateway.spec.md's Auth Section documentingthe still-open auth-startup issue below, so the gap is visible in the spec
and not only in an issue thread.
make checkdirectly (the agentruntime cannot invoke
makeitself); all pass.go build/vet/testcouldnot run in this runtime (no Go toolchain) - the only changed
.gofile isa single string-literal image-tag edit in
tests/e2e/cli_test.go; this isa recorded gap for CI or a human reviewer to confirm, not a known break.
Release-note triage
Needs a maintainer decision (already tracked, not fixed here)
Issue #809 tracks a change that first appeared in
v0.1.5-rhaiv.4and isstill present in
v0.1.6-rhaiv.1: the gateway now refuses to start - beforeit opens any network port - if no OIDC, mTLS, operator auth, or
gateway_jwtis configured andallow_unauthenticated_usersis not set totrue(NVIDIA/OpenShell#4821). HyperShell's own config check(
ValidateRenderedGatewayConfig) still accepts that setup as valid today,and the control plane can produce it for a gateway reconciled while Keycloak
integration is off and no custom OIDC issuer is set. After this bump, such a
gateway will crash-loop at startup instead of running insecurely as before.
This PR does not change that behavior; #809 remains open for a maintainer
decision.
Verify before the next live deployment (not fixed here)
Starting in
v0.1.6-rhaiv.0, new sandboxes on the Kubernetes, Docker,Podman, and VM drivers open their control connection to the supervisor,
reversing the old direction where the supervisor connected to the sandbox
(NVIDIA/OpenShell#4656; already-running sandboxes keep the old direction
through the upgrade). HyperShell's
openshell-gateway-allow-sandboxNetworkPolicy already allows sandbox pods to reach the gateway pod, and the
chart's sandbox NetworkPolicy only ever restricted traffic into sandbox
pods, never outbound traffic from them, so nothing in the current
NetworkPolicy set should block this. The exact port was not confirmed from
static review alone. Flagging this for verification on the next Kind or
ROKS deployment; no NetworkPolicy change is made in this PR.
Additive or inert, no action needed
autoscaling, pod-disruption budget, a new NetworkPolicy) and an
operator-owned additional-CA trust bundle for sandbox supervisors. Both
are off unless HyperShell explicitly opts in, which it does not.
(
ResumeBoundaryRequest). This only affects external compute-driverplugins; HyperShell uses the built-in Kubernetes driver.
credential events. This needs no configuration from HyperShell.
the existing readable format, so current behavior is unchanged.
server.extraEnv,pkiInitJob.podLabels/podAnnotations). Not adopted.priorityclasses, pods, events, services, networkpolicies, secrets,
serviceaccounts, PVCs, sandboxes) are all already present in
controller-rbac.yaml. No RBAC change was needed.Console dashboard: unchanged
The console dashboard image stays pinned to its current release. No
.protofile changed upstream between
v0.1.5-rhaiv.3andv0.1.6-rhaiv.1, so theconsole digest stays as-is.
Sandbox API version: unchanged
agents.x-k8s.io/v1beta1is still the primary Agent Sandbox API version thevendored chart requires, with
v1alpha1as a preflight fallback.Files changed
OPENSHELL_VERSION,deploy/base/platform-resources/controller.yaml,deploy/ibm/kustomization.yaml- pin synccharts/openshell/- vendored Helm chart atv0.1.6-rhaiv.1components/pr-test/e2e-openshell-roks.sh,tests/e2e/cli_test.go- e2eimage pins
specs/platform/{data-model,openshell-gateway, openshell-image-auto-update}.spec.md- version citations and therecovered Auth Section "Known gap" note
skills/deploy/{deploy-cluster,gcp-cluster,ibm-cluster}/SKILL.md- exampleimage pins and ROKS mirror commands
skills/tooling/update-openshell/SKILL.md- Learnings log entryTest plan
make checksub-checks (Python policy scripts and theirunit tests) pass directly
controller-rbac.yaml; no escalationfindings from PR chore(deps): bump OpenShell to v0.1.6-rhaiv.0 #822 still hold against the
v0.1.6-rhaiv.1chartintentional fixtures and historical log entries
go build/vet/test- could not run in this agent runtime (no Gotoolchain); please confirm in CI
including the sandbox control-connection direction change above, is
still needed
🤖 Generated with Claude Code