Misc 2026-related fixes - #2511
Conversation
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughRebuilt Rocky Kolla images for 2026.1 and updated image tags. Enabled RPM repository WalkthroughThe change refreshes Kolla image and repository configuration, updates Pulp repository versions, adds two Trivy vulnerability allowlists, and pins Kayobe to a new commit. ChangesKolla content refresh
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 0d242632-21bb-404c-a3f2-1d28e3793d87
📒 Files selected for processing (5)
etc/kayobe/kolla-image-tags.ymletc/kayobe/kolla/repos.yamletc/kayobe/pulp-repo-versions.ymletc/kayobe/trivy/allowed-vulnerabilities.ymlrequirements.txt
📜 Review details
⏰ Context from checks skipped due to timeout. (3)
- GitHub Check: stackhpc/check
- GitHub Check: Ansible 2.19 lint with Python 3.12
- GitHub Check: Ansible 2.20 lint with Python 3.12
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2026-07-27T12:28:31.134Z
Learnt from: seunghun1ee
Repo: stackhpc/stackhpc-kayobe-config PR: 2454
File: etc/kayobe/pulp.yml:566-568
Timestamp: 2026-07-27T12:28:31.134Z
Learning: For `etc/kayobe/stackhpc.yml`, the configured Kolla-Ansible source `stackhpc/kolla-ansiblestackhpc/2026.1` no longer defines or deploys InfluxDB and does not contain `kolla_enable_influxdb`. InfluxDB should not be required in `etc/kayobe/pulp.yml` `stackhpc_pulp_images_kolla`; a remaining `kolla_enable_influxdb` setting in ci-builder configuration is obsolete and does not enable a deployable service.
Applied to files:
etc/kayobe/pulp-repo-versions.yml
🪛 OSV Scanner (2.4.0)
requirements.txt
[MEDIUM] 1-1: idna 3.9.0: undefined
(PYSEC-2026-215)
[MEDIUM] 1-1: idna 3.9.0: Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix
[MEDIUM] 1-1: requests 2.32.5: undefined
(PYSEC-2026-2275)
[MEDIUM] 1-1: requests 2.32.5: Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function
🔇 Additional comments (5)
etc/kayobe/trivy/allowed-vulnerabilities.yml (1)
30-32: 🔒 Security & PrivacyProvide scan evidence and removal tracking for both exceptions.
The script scopes these identifiers to the
grafanaandopensearch_dashboardsimages. Add scan evidence for each finding and a removal condition forCVE-2026-59873. Remove each exception when its image contains the fixed package version.requirements.txt (1)
1-1: 🔒 Security & PrivacyDocument transitive dependency reachability before merging.
requirements.txtand Kayobe’s pinned requirements do not declareidnaorrequests. Kayobe has no direct calls toidna.encodeorrequests.utils.extract_zipped_paths. Establish the installed dependency graph and document whether another dependency reaches either API.etc/kayobe/kolla-image-tags.yml (1)
7-20: LGTM!etc/kayobe/kolla/repos.yaml (1)
30-119: LGTM!Also applies to: 126-126
etc/kayobe/pulp-repo-versions.yml (1)
4-6: LGTM!Also applies to: 9-10, 13-19, 22-25, 28-36, 40-49
| stackhpc_pulp_repo_centos_stream_10_nfv_openvswitch_aarch64_version: 20260729T102151 | ||
| stackhpc_pulp_repo_centos_stream_10_nfv_openvswitch_version: 20260729T092535 |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
# Find OVN LTS version definitions and consumers.
rg -n --glob '*.yml' --glob '*.yaml' \
'stackhpc_(pulp_)?repo_(multiarch_)?centos_stream_10_ovn_lts(_aarch64)?_version' .Repository: stackhpc/stackhpc-kayobe-config
Length of output: 874
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- OVN references across tracked files ---'
rg -n --hidden --glob '!*.pyc' \
'centos_stream_10_ovn_lts|ovn_lts_version|nfv_openvswitch' .
printf '%s\n' '--- Relevant pulp configuration ---'
sed -n '225,265p' etc/kayobe/pulp.yml
printf '%s\n' '--- Pulp repository version entries ---'
rg -n -C 3 \
'stackhpc_pulp_repo_(centos_stream_10|multiarch_centos_stream_10)_' \
etc/kayobe/pulp-repo-versions.yml
printf '%s\n' '--- Version-file and variable-loading references ---'
rg -n --glob '*.yml' --glob '*.yaml' \
'pulp-repo-versions|repo-versions|vars_files|include_vars|pulp_repo_' \
etc/kayobe | head -250Repository: stackhpc/stackhpc-kayobe-config
Length of output: 41822
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- All OVN-related configuration ---'
rg -n -i --hidden --glob '!*.pyc' '\bovn\b|openvswitch' etc/kayobe
printf '%s\n' '--- Pulp configuration loading ---'
rg -n --hidden --glob '*.yml' --glob '*.yaml' \
'pulp\.yml|pulp-repo-versions\.yml|stackhpc_pulp_repo_multiarch_centos_stream_10_ovn_lts_version' \
etc
printf '%s\n' '--- Static variable-resolution check ---'
python3 - <<'PY'
from pathlib import Path
import re
root = Path(".")
versions = root / "etc/kayobe/pulp-repo-versions.yml"
pulp = root / "etc/kayobe/pulp.yml"
ci_files = [
root / "etc/kayobe/environments/ci-builder/stackhpc-ci.yml",
root / "etc/kayobe/environments/ci-multinode/stackhpc-ci.yml",
root / "etc/kayobe/environments/aio/release-train.yml",
]
text = versions.read_text()
defined = set(re.findall(r"^([A-Za-z0-9_]+):", text, re.M))
pulp_text = pulp.read_text()
lookup_names = re.findall(
r"lookup\('vars',\s*'([^']*?)'\s*~\s*arch_suffix\s*~\s*'([^']*)'",
pulp_text,
)
for prefix, suffix in lookup_names:
if "ovn_lts" in prefix:
print("OVN lookup template:", prefix + "<arch_suffix>" + suffix)
for arch_suffix in ("", "_aarch64"):
name = prefix + arch_suffix + suffix
print(f"{name}: {'DEFINED' if name in defined else 'MISSING'}")
for path in ci_files:
matches = [
line.strip()
for line in path.read_text().splitlines()
if "ovn_lts_version" in line
]
print(path, "OVN consumers:", matches)
PYRepository: stackhpc/stackhpc-kayobe-config
Length of output: 13458
Define the OVN LTS repository pins.
The OVN LTS lookup resolves neither architecture-specific variable. Add both generated entries to etc/kayobe/pulp-repo-versions.yml, or remove the stale OVN consumers.
1 participant
Rebuilt all kolla images, should be closer to getting check-review working. Now using OVN 26.03 🎉
Bumped the kayobe pin, there's also some kolla changes required to get images building, but I'm hoping to just get them merged upstream and synced to our fork.