Bump to lsc guest authorization support #155
Conversation
Previous authz PR shouldn't have merged so quickly
WalkthroughUpdates the assisted-chat container base image digest, advances the lightspeed-stack submodule pointer, and adjusts authorization rules in template.yaml to move the info action from the redhat_employee role to a wildcard role for probes. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Probe as K8s Probe
participant Svc as Assisted Chat Service
participant Auth as AuthZ (lightspeed-stack)
Probe->>Svc: GET /info
Svc->>Auth: authorize(action="info", role=*)
note over Auth: Match evaluation order<br/>- Specific role rules<br/>- Wildcard role "*"
Auth-->>Svc: allow (matched wildcard "info")
Svc-->>Probe: 200 OK (info)
rect rgba(230,250,230,0.6)
note right of Auth: New/changed path: wildcard rule grants "info"
end
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: eranco74, maorfr, omertuc The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
lightspeed-stack (1)
1-1: Optional: add provenance hintConsider annotating the submodule line in the PR description with the corresponding tag/release name to aid traceability in future audits.
template.yaml (1)
201-204: Align probe endpoints with the new rule (or document intent).
Deployment probes use /liveness and /readiness, while this grants info to "*". If /info is the intended probe target, consider switching probes; otherwise, note why /info needs wildcard access.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (3)
Containerfile.assisted-chat(1 hunks)lightspeed-stack(1 hunks)template.yaml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Red Hat Konflux / assisted-chat-saas-main-on-pull-request
🔇 Additional comments (4)
lightspeed-stack (2)
1-1: Submodule bump to 3e2d883 — LGTMPointer-only update; no in-repo code or API impact.
1-1: Sanity check summary
- ✅ lightspeed-stack submodule is at commit 3e2d883
- ✅ Containerfile.assisted-chat references the expected digest (
sha256:0171ec44c1684e0eb2961366a0e0cfcf99be49f25a28248deccc38dceef068ca)Manual verification required in template.yaml
The automated script did not conclusively locate the moved
infopermission. Please double-check that:
- The wildcard role (
role: "*") includesinfoin itsactionslist- The
redhat_employeerole no longer grantsinfoLet me know once you’ve confirmed those two points.
Containerfile.assisted-chat (1)
2-3: Pinned base image digest update looks good.
Digest pinning improves reproducibility. No functional concerns on these lines.template.yaml (1)
201-204: Verifyrole: "*"Semantics for Unauthenticated ProbesIt’s likely that in LSC’s policy engine the wildcard role (
"*") only matches authenticated principals (i.e. “any role”), and that unauthenticated requests carry no roles—so this rule wouldn’t actually apply to probes that don’t send a JWT. As a result, withauth_enabled=true, a bare GET /info may still be rejected before the rule is ever evaluated.Please manually verify the behavior and, if needed, introduce an explicit anonymous‐allow rule or flag for k8s probes. For example:
Test locally with
auth_enabled=true:
• curl GET /info without an Authorization header
• curl GET /info with an invalid or expired JWTIf the first returns 401/403, add a dedicated rule (if supported) to permit anonymous access to
/info, for example:# allow /info to unauthenticated k8s probes - unauthenticated: true actions: - infoor consult the Lightspeed Stack docs/CLI for any first-class “anonymous allow” setting.
| # This is the digest of quay.io/lightspeed-core/lightspeed-stack:dev-20250827-3e2d883 | ||
| FROM quay.io/lightspeed-core/lightspeed-stack@sha256:0171ec44c1684e0eb2961366a0e0cfcf99be49f25a28248deccc38dceef068ca |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Verify tag↔digest mapping (and signature) for supply-chain safety.
Please confirm the sha256 matches dev-20250827-3e2d883 and, if applicable, verify signatures.
🏁 Script executed:
#!/bin/bash
# Compare digest for the annotated tag vs pinned digest
TAG=dev-20250827-3e2d883
IMG=quay.io/lightspeed-core/lightspeed-stack
PIN=sha256:0171ec44c1684e0eb2961366a0e0cfcf99be49f25a28248deccc38dceef068ca
skopeo inspect docker://$IMG:$TAG | jq -r .Digest
echo "Pinned: $PIN"
# Optional: cosign verification (requires public key setup if used)
# cosign verify --key cosign.pub $IMG@${PIN}Length of output: 521
I’ll fetch the manifest headers directly via the Docker Registry API to extract the digest for the dev-20250827-3e2d883 tag and compare it against the pinned value.
🏁 Script executed:
#!/bin/bash
TAG=dev-20250827-3e2d883
REPO=lightspeed-core/lightspeed-stack
# Query the manifest for the tag and extract the Docker-Content-Digest header
curl -sI \
-H "Accept: application/vnd.docker.distribution.manifest.v2+json" \
https://quay.io/v2/${REPO}/manifests/${TAG} \
| grep -i Docker-Content-Digest
echo "Expected: sha256:0171ec44c1684e0eb2961366a0e0cfcf99be49f25a28248deccc38dceef068ca"Length of output: 527
Digest Mismatch Detected – Action Required
The manifest digest returned by Quay for tag dev-20250827-3e2d883 does not match the pinned digest in your Containerfile. This discrepancy poses a supply-chain integrity risk and must be corrected before merging.
• File: Containerfile.assisted-chat (Lines 2–3)
• Queried registry digest for quay.io/lightspeed-core/lightspeed-stack:dev-20250827-3e2d883:
sha256:909aa6516dcb53c106f33419b0f0018a53a3b5942e07666018b795a036db35fb
• Pinned digest in Containerfile:
sha256:0171ec44c1684e0eb2961366a0e0cfcf99be49f25a28248deccc38dceef068ca
Please verify which digest is correct, update the @sha256: reference to match the registry’s value, and—if you’re using cosign or another signature tool—re-run signature verification against the updated digest.
🤖 Prompt for AI Agents
In Containerfile.assisted-chat around lines 2–3, the pinned image digest
(sha256:0171ec44c1684e0eb2961366a0e0cfcf99be49f25a28248deccc38dceef068ca) does
not match the registry’s manifest digest
(sha256:909aa6516dcb53c106f33419b0f0018a53a3b5942e07666018b795a036db35fb);
update the FROM line to use the correct
@sha256:909aa6516dcb53c106f33419b0f0018a53a3b5942e07666018b795a036db35fb value,
then re-run your signature/cosign verification against that digest to ensure the
image is properly signed and the change is valid before merging.
|
@omertuc: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
Previous authz PR shouldn't have merged so quickly
Summary by CodeRabbit
Refactor
Chores