chore(deps): OpenShell v0.1.0 upstream contract drift needs a maintainer decision before bumping past v0.0.116 #366

Activity

1. hypershell-builder

   added

   needs-decision

   on Sep 25, 2026
2. hypershell-builder commented on Sep 25, 2026

   

   hypershell-builderBot

   on Sep 25, 2026 – with Hypershell Builder

   ContributorAuthor

   More actions

   Independent re-run: same needs-decision conclusion, plus additional contract-surface hits

   An automated update-openshell Implementer re-run (current pin v0.0.116-rhaiv.6, latest NVIDIA upstream v0.1.0 published 2026-09-25, latest deployable midstream still v0.0.116-rhaiv.15) independently reached the same conclusion recorded here: v0.1.0 is upstream-only, not yet pinnable via the midstream image source, and touches contract surfaces that need a maintainer decision. No duplicate issue was opened and no PR was created for this path.

   Deep triage of the full v0.0.116...v0.1.0 changelog surfaced several breaking (!) and contract-affecting changes not listed in the issue body above. Adding them so the decision has the complete surface:

   • Sandbox CR / agents.x-k8s.io API version - chore(kubernetes): update Agent Sandbox to v1.0.3 (chore(kubernetes): update Agent Sandbox to v1.0.3 NVIDIA/OpenShell#3578). HyperShell hard-codes agents.x-k8s.io/v1beta1 (components/control-plane/internal/gateway/sandbox_observation.go:15) and pins agent-sandbox v0.5.6 (deploy/kind/infrastructure/kustomization.yaml). A jump to Agent Sandbox v1.0.x very likely moves the served CR API version off v1beta1, which would require changes to sandbox_observation.go, controller-rbac.yaml, control-plane/rbac/clusterrole.yaml, the networkpolicies, and the v1beta1 claim in global-architecture.spec.md / ibm-cluster/SKILL.md. This is the highest-risk hit and was not called out above.
   • Gateway config schema (TOML) - refactor(config): normalize and enforce gateway schema v2 (#2814). An enforced schema v2 directly affects the gateway.toml the control plane renders (manifests/gateway/configmap.yaml, internal/gateway/config.go); a bump could fail closed if rendered keys do not match v2.
   • gRPC / proto surface - refactor(proto)!: use well-known time types (#3113) and feat(api)!: use sandbox names as canonical RPC references (#3272). Both are breaking proto/API changes; the API server + control plane speak gRPC (components/api-server/proto/).
   • Auth (OIDC) - feat(server): support EC and EdDSA keys in OIDC JWKS validation (#2593), fix(auth): harden OIDC trust root retrieval (#3332), and fix(auth): remove legacy sandbox JWT admission (#3562). Re-check ValidateOIDCConfig and sandbox JWT assumptions.
   • PKI / TLS - fix(bootstrap): emit RFC 5280 extensions on generated gateway PKI (#3286) and fix(policy)!: reject unsupported TLS endpoint values (#3414). Interacts with HyperShell's hand-rolled per-tenant PKI and the sandbox client-TLS restored in the 0.0.109 run.
   • Deployment topology (Helm) - beyond the chart split already noted, feat(kubernetes): support HA gateway rebalancing (#1868) and fix(helm)!: reduce gateway Secret privileges (#3616) change gateway deployment/RBAC expectations.

   Net: this reinforces that v0.1.0 is a minor-version boundary with multiple breaking contract changes, not a mechanical bump.

   Interim mechanical option is still separable

   Independent of v0.1.0, the same-base midstream bump v0.0.116-rhaiv.6 -> v0.0.116-rhaiv.15 (Red Hat downstream patches only, no NVIDIA base change) remains available as a separate mechanical needs-review PR if maintainers want the downstream fixes now. This run did not open that PR (out of scope for the needs-decision finding); flagging it here for the decision.

   Learnings-log note for this run

   v0.1.0 (2026-09-25, needs-decision, no bump - re-run): A prior automated run had already filed this complete needs-decision issue (#366). Deeper changelog triage found additional contract-surface hits the first pass omitted - most importantly the Agent Sandbox v1.0.3 bump (#3578), which threatens the hard-coded agents.x-k8s.io/v1beta1 dependency, plus gateway config schema v2 (#2814) and breaking proto changes (#3113, #3272). Lesson: on a minor-version boundary, triage the full compare range for ! markers and Agent-Sandbox/proto/auth changes, not just the headline features; the v1beta1 -> v1 risk is the one most likely to break a bump silently.

   Filed by the automated Implementer run per the update-openshell skill; the item was already tracked, so this is a supplement to #366 rather than a new issue.
3. markturansky commented on Sep 28, 2026

   

   markturansky

   on Sep 28, 2026

   Collaborator

   More actions

   Midstream has v0.1.2-rhaiv.0 as the latest tracking upstream 0.1.2
4. markturansky commented on Sep 28, 2026

   

   markturansky

   on Sep 28, 2026

   Collaborator

   More actions

   Resolved in #375. The update to v0.1.2-rhaiv.0 is now open for review. Triggered automatically by Step 0 of the update-openshell skill detecting this human reply.
5. markturansky

   closed this as completedon Sep 28, 2026
6. markturansky commented on Sep 28, 2026

   

   markturansky

   on Sep 28, 2026

   Collaborator

   More actions

   Reopening so the in-cluster Implementer can pick this up via the new Step 0 logic (PR #374) and open the bump PR as hypershell-builder[bot].
7. markturansky

   reopened this on Sep 28, 2026
8. markturansky

   added 3 commits that reference this issue on Sep 28, 2026

   chore(deps): bump OpenShell to v0.1.2-rhaiv.0 (closes #366)

   ...

   This issue will close once commit 2719adc is merged into the 'main' branch.

   2719adc

   chore(deps): bump OpenShell to v0.1.2-rhaiv.0 (closes #366)

   ...

   This issue will close once commit e177a82 is merged into the 'main' branch.

   e177a82

   chore(deps): bump OpenShell to v0.1.2-rhaiv.0 (closes #366)

   ...

   This issue will close once commit b565864 is merged into the 'main' branch.

   b565864
9. rh-amarin

   added a commit that references this issue on Sep 30, 2026

   feat(update-openshell): bumps to openshell v0.1.2 (openshift-online#374)

   ...

   This issue will close once commit 6392c4a is merged into the 'main' branch.

   6392c4a
10. hypershell-builder commented on Sep 30, 2026

    

    hypershell-builderBot

    on Sep 30, 2026 – with Hypershell Builder

    ContributorAuthor

    More actions

    update-openshell re-run: latest midstream is now v0.1.2-rhaiv.2 (current pin v0.1.2-rhaiv.0); the rhaiv.0 -> rhaiv.2 delta crosses contract surfaces and needs a maintainer decision

    Context

    • Current committed pin: v0.1.2-rhaiv.0 (deploy/base/control-plane/deployment.yaml + controller.yaml, OPENSHELL_VERSION, vendored charts/openshell/).
    • Latest deployable midstream tag: v0.1.2-rhaiv.2 (opendatahub-io/openshell).
    • Latest NVIDIA upstream release: v0.1.2 (unchanged; no new upstream release notes since rhaiv.0).
    • Per the skill exit condition, full-tag comparison rhaiv.0 != rhaiv.2 means this is an update (a rhaiv patch bump on the same NVIDIA base is still an update). This is not "already current."

    Why this is needs-decision, not a mechanical PR
    The human direction on this issue approved v0.1.2-rhaiv.0, which is already committed. rhaiv.1 + rhaiv.2 are not just Red Hat patches: the midstream merged upstream/main several times, pulling forward 37 commits that touch contract surfaces the update-openshell skill enumerates. Going beyond the approved rhaiv.0 needs fresh direction.

    Contract-surface triage (v0.1.2-rhaiv.0...v0.1.2-rhaiv.2)

    • gRPC/proto (proto/openshell.proto): additive only - new SandboxRestartPolicy enum + spec.restart_policy (15); status fields restart_count (14), next_restart_time (15), main_process_started_time (16); reserved 10 / "SANDBOX_PHASE_RESTARTING"; EXPERIMENTAL ProviderProfileFile + a provider files map. Additive/reserved = backward compatible. HyperShell does not vendor the gateway proto, so no api-server regen is forced. But the skill (Step 3b) mandates a console-dashboard image compatibility check whenever the workspace/sandbox gRPC proto changes; the current console pin (sha-71335e5, sha256:1d363311...) needs re-verification against a rhaiv.2 gateway (symptom of incompatibility is a silent infinite spinner on the Sandboxes tab).
    • Gateway config schema / TOML (deploy/helm .../gateway-config.yaml + values.yaml): new [openshell.gateway.ocsf_log] section (gateway-native OCSF JSONL export, #3264/#3876), default disabled/opt-in; podLifecycle.terminationGracePeriodSeconds default 5 -> 30; new server.extraVolumes/extraVolumeMounts. HyperShell renders its own gateway.toml and does not set ocsf_log, so nothing breaks by default, but adopting/exposing gateway-native OCSF logging overlaps HyperShell's own observability approach - a maintainer call.
    • Sandbox CR / agents.x-k8s.io API version: UNCHANGED, still v1beta1 at rhaiv.2 (verified in openshell-driver-kubernetes). The highest-risk item from the earlier triage (v1beta1 -> v1) did not materialize; HyperShell's hard-coded SandboxGVR (sandbox_observation.go) stays valid.
    • Supervisor readiness probe (#3700): changed from an exec probe to a tcpSocket probe on new port 5501 (CONTROL_HEALTH_PORT) for gateway-created sandbox pods. Internal to the sandbox pod, but confirm HyperShell's rendered networkpolicy (manifests/gateway/networkpolicy.yaml) does not block kubelet reaching 5501.
    • L7 / network policy: refuse protocol upgrades on JSON-RPC/MCP (#3753), MCP Tower protocol profiles (#3335), raw OPA settings validation (#3788). Supervisor-internal rego; HyperShell does not render it, but review if HyperShell relies on specific MCP/JSON-RPC behavior.

    Decision required

    1. Approve tracking v0.1.2-rhaiv.2 (or name a specific tag), given the above are additive/opt-in and v1beta1 is unchanged; OR hold at rhaiv.0.
    2. If approved: confirm the console-dashboard image is compatible with the rhaiv.2 gateway proto, or provide a new console digest to pin (Step 3b).
    3. Confirm whether to adopt/expose gateway-native OCSF JSONL logging or keep it disabled.

    On direction, an Implementer run will apply the mechanical sweep (re-vendor charts/openshell/ at the approved tag, cross-check chart RBAC + security-context for Kind, bump the pins across the footprint, run go build/vet/test + make check) and open a needs-review PR.

    Separable mechanical option: taking the rhaiv downstream patches is available independently if you want them now.

    Verification performed: no code/build change attempted (pins untouched, main unmodified). Findings are from the opendatahub-io/openshell rhaiv.0...rhaiv.2 content diff and cross-checks against the HyperShell tree.

    Learnings-log note for this run (no-PR path; paste into skills/tooling/update-openshell/SKILL.md when acting on this decision):

    v0.1.2-rhaiv.2 (2026-09-30, needs-decision, no bump): current pin rhaiv.0, latest midstream rhaiv.2, NVIDIA base v0.1.2 unchanged. Same-base rhaiv patch bump, but the midstream merged upstream/main (37 commits) pulling additive proto (SandboxRestartPolicy, ProviderProfileFile), a new opt-in [openshell.gateway.ocsf_log] gateway config section, supervisor readiness probe exec -> tcpSocket:5501, and L7/MCP policy changes. agents.x-k8s.io stayed v1beta1 (earlier v1 risk did not land). Lesson: a same-NVIDIA-base rhaiv patch bump can still cross contract surfaces because the midstream tracks upstream/main between rhaiv tags; triage the rhaiv.N...rhaiv.M content diff (not just NVIDIA release notes, which do not change) and flag proto/config-schema drift for a console-compat check even when additive. Prior human approval was scoped to rhaiv.0; exceeding it needs fresh direction.

    Filed by the automated update-openshell Implementer run. The item is already tracked here, so this supplements #366 rather than opening a duplicate. No PR opened; main and the version pins are unchanged.