Repository navigation
chore(openbao): bump openbao chart to 0.25.7 - #2991
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (9)
✅ Files skipped from review due to trivial changes (5)
🚧 Files skipped from review as they are similar to previous changes (4)
📝 WalkthroughWalkthroughThe PR parameterizes the OpenBao Grafana dashboard by replacing all hardcoded ChangesGrafana Dashboard Job Selector Parameterization
Headless Service Annotations Support
Chart Version Bump, Image Updates, and Helm Unit Tests
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~22 minutes Possibly related issues
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 Trivy (0.69.3)Trivy execution failed: 2026-06-23T00:32:56Z FATAL Fatal error run error: fs scan error: scan error: scan failed: failed analysis: post analysis error: post analysis error: cloudformation scan error: fs filter error: fs filter error: walk error range error: stat smartylint.json: no such file or directory: range error: stat smartylint.json: no such file or directory Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
area/uncategorized
github-actions
Bot
added
the
size/S
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request performs a routine maintenance update for the OpenBao Helm chart to incorporate the latest upstream changes within the 0.25.x release line. The primary goal is to mitigate identified security vulnerabilities while maintaining existing cozystack-specific configuration overrides. Additionally, the PR introduces automated unit testing for the chart to ensure configuration invariants are preserved in future updates. Highlights
New Features🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds a test target to the openbao package Makefile to run Helm unit tests, and introduces a new test suite (openbao_test.yaml) to verify chart rendering invariants. The review feedback suggests improving the precision of the image assertion by using an exact equal check against the full image string instead of a partial regex match.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| - matchRegex: | ||
| path: spec.template.spec.containers[0].image | ||
| pattern: 'openbao/openbao:2\.5\.1' |
There was a problem hiding this comment.
Using matchRegex with a partial pattern like 'openbao/openbao:2\.5\.1' is less precise because it would also match other registries (e.g., docker.io/openbao/openbao:2.5.1). Since the registry is explicitly configured as quay.io in values.yaml, it is more robust to use an equal assertion to verify the full image string.
- equal:
path: spec.template.spec.containers[0].image
value: quay.io/openbao/openbao:2.5.1There was a problem hiding this comment.
Good catch — switched the assertion from the partial matchRegex to an equal on the full registry-qualified image (quay.io/openbao/openbao:2.5.1), so it now pins the registry too and fails on an accidental registry change. e626690
Re-vendors the openbao-helm chart from 0.25.3 to 0.25.7 (app v2.5.0 -> v2.5.1), the latest in the ^0.25 line the Makefile pins, picking up the v2.5.1 security fix. cozystack overrides (injector + csi disabled) stay valid and render nothing, so the changed surface is the openbao server StatefulSet image only. Widening past 0.25.x to 0.28.x (app v2.5.5) would need a CHART_VERSION constraint change plus a 0.26/0.27/0.28 changelog review and is intentionally left out. Adds helm-unittest coverage (the package shipped none): pins the server image and the injector/csi-disabled invariants. Adaptations: - charts/: re-vendored via make update (helm pull openbao ^0.25 -> 0.25.7) - Makefile: add test target - tests/openbao_test.yaml: new helm-unittest coverage Assisted-By: Claude <[email protected]> Signed-off-by: Aleksei Sviridkin <[email protected]>
The managed-service app deploys the system openbao chart, whose server image follows that chart's appVersion (now v2.5.1). The app Chart.yaml appVersion ships verbatim on the openbao app CR, so leaving it at 2.5.0 makes every instance misreport its running OpenBAO version. Assisted-By: Claude <[email protected]> Signed-off-by: Aleksei Sviridkin <[email protected]>
2ba61d4 to
041c73c
Compare
github-actions
Bot
added
size/M
myasnikovdaniil
left a comment
myasnikovdaniil
left a comment
There was a problem hiding this comment.
Review: APPROVE
Clean, well-scoped CVE bump. Verified end to end:
Re-vendor hygiene — charts/openbao/ is byte-identical to a fresh upstream helm pull openbao/openbao --version 0.25.7 (diff -ruq exit 0). 0.25.7 is the highest version in the ^0.25 Makefile constraint (next published is 0.28.x), so this is the maximal in-line forward move; widening past 0.25.x would need a CHART_VERSION change as the description notes. No cozystack-local patches live inside the subchart — overrides are only in the umbrella values.yaml (openbao.injector.enabled: false, openbao.csi.enabled: false).
Upgrade safety — rendering both 0.25.3 and 0.25.7 with the cozystack overrides, the only diffs are the server image 2.5.0 → 2.5.1, the cosmetic helm.sh/chart label, and one chomped blank line in the headless Service. No change to the StatefulSet serviceName, selector.matchLabels, or volumeClaimTemplates, and no change to the unseal/init/storage config. updateStrategy: OnDelete keeps the roll operator-controlled.
Tests — the new helm unittest suite is non-vacuous: mutation-testing confirms the image-pin assertion fails on 2.5.0, the injector assertion fails when the override is flipped on (subchart default is global.enabled: true), and the CSI assertion fails when csi is enabled. 3/3 pass.
dev10 — installed the chart standalone; pod came up 1/1 Ready on quay.io/openbao/openbao:2.5.1 (logs show Go Version: go1.25.7, confirming the CVE-2025-68121 stdlib rebuild), initialized and unsealed cleanly. Injector Deployment / CSI DaemonSet / MutatingWebhookConfiguration all absent.
Non-blocking nit below.
| template: charts/openbao/templates/csi-daemonset.yaml | ||
| asserts: | ||
| - hasDocuments: | ||
| count: 0 |
There was a problem hiding this comment.
Nit (non-blocking): csi.enabled: false is also the upstream subchart default, so this assertion would still pass even if the cozystack csi.enabled: false override were deleted — unlike the injector assertion, which genuinely guards the override (subchart default is global.enabled: true). It does correctly fail if csi is flipped to true (mutation-verified), so it's not worthless, just weaker than the comment 'cozystack override' implies. Optional to strengthen or note.
2 participants
What this PR does
Re-vendors the openbao-helm chart from 0.25.3 to 0.25.7 (appVersion v2.5.0 → v2.5.1), the latest in the
^0.25line the Makefile pins. The vendored tree is byte-identical to a fresh upstream pull; cozystack overrides (injector.enabled: false,csi.enabled: false) are untouched and still render nothing, so the changed runtime surface is the openbao server StatefulSet image.Security scope (honest accounting): v2.5.1 fixes two OpenBao CVEs — including the critical CVE-2025-68121 (Go stdlib TLS, CVSS 10.0, via a Go 1.25.7 rebuild) and CVE-2026-24051 (otel/sdk). The issue also lists
github.com/jackc/pgx/v5— that is not addressed: pgx is unchanged in v2.5.1 upstream, so it can't be closed by an in-^0.25bump.libcap2/libexpatare base-image packages picked up incidentally by the rebuild (not verified here). Widening past 0.25.x to 0.28.x (app v2.5.5) would need a CHART_VERSION constraint change plus a 0.26/0.27/0.28 changelog review and is intentionally left out.Adds helm-unittest coverage (the package shipped none): pins the server image and the injector/CSI-disabled invariants.
helm unittest3/3 pass.Closes #2895
Release note
Summary by CodeRabbit
helm unittestMakefile target and new chart rendering invariants.