DNM: 2026.1 test check review - #2499
Conversation
📝 WalkthroughRemoves Rocky Linux 9 configuration across Ansible, repositories, images, and CI environments. Updates Rocky Linux 10 and current repository versions, Kolla build settings, vulnerability allowlists, and container images. Bumps Pulp to 3.85.26, switches Squid to Canonical’s 7.2 image, and rebuilds container tags. WalkthroughThe changes remove Rocky Linux 9 configuration and maintenance support. They update CIS, repository, OFED, Kolla, image, vulnerability, and release-note configuration for Rocky Linux 10 and current component versions. ChangesRocky Linux platform transition
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 176039f0-e755-4ea0-aea1-f952f3d30d56
📒 Files selected for processing (29)
etc/kayobe/ansible/fixes/fix-grub-rl9.ymletc/kayobe/ansible/maintenance/cis.ymletc/kayobe/ansible/maintenance/rocky-97-ofed-upgrade.ymletc/kayobe/ansible/requirements.ymletc/kayobe/dnf.ymletc/kayobe/environments/aio/automated-setup.shetc/kayobe/environments/aio/globals.ymletc/kayobe/environments/aio/inventory/group_vars/cis-hardening/cisetc/kayobe/environments/aio/kolla/config/nova/nova-compute.confetc/kayobe/environments/aio/release-train.ymletc/kayobe/environments/ci-builder/stackhpc-ci.ymletc/kayobe/environments/ci-multinode/inventory/group_vars/cis-hardening/cisetc/kayobe/environments/ci-multinode/stackhpc-ci.ymletc/kayobe/hooks/overcloud-host-package-update/post.d/10-fix-grub-rl9.ymletc/kayobe/inventory/group_vars/cis-hardening/cisetc/kayobe/inventory/group_vars/controllers/cisetc/kayobe/inventory/group_vars/wazuh-manager/wazuh-manageretc/kayobe/kolla-image-tags.ymletc/kayobe/kolla.ymletc/kayobe/kolla/repos.yamletc/kayobe/ofed.ymletc/kayobe/pulp-host-image-versions.ymletc/kayobe/pulp-ipa-image-versions.ymletc/kayobe/pulp-repo-versions.ymletc/kayobe/seed.ymletc/kayobe/stackhpc-overcloud-dib.ymletc/kayobe/stackhpc.ymletc/kayobe/trivy/allowed-vulnerabilities.ymlreleasenotes/notes/ubuntu-squid-container-75698bf1b9535163.yaml
💤 Files with no reviewable changes (12)
- etc/kayobe/hooks/overcloud-host-package-update/post.d/10-fix-grub-rl9.yml
- etc/kayobe/ansible/maintenance/rocky-97-ofed-upgrade.yml
- etc/kayobe/ansible/fixes/fix-grub-rl9.yml
- etc/kayobe/pulp-host-image-versions.yml
- etc/kayobe/stackhpc.yml
- etc/kayobe/ansible/requirements.yml
- etc/kayobe/kolla.yml
- etc/kayobe/environments/aio/inventory/group_vars/cis-hardening/cis
- etc/kayobe/inventory/group_vars/controllers/cis
- etc/kayobe/inventory/group_vars/cis-hardening/cis
- etc/kayobe/environments/ci-builder/stackhpc-ci.yml
- etc/kayobe/environments/ci-multinode/inventory/group_vars/cis-hardening/cis
📜 Review details
⏰ Context from checks skipped due to timeout. (3)
- GitHub Check: stackhpc/check
- GitHub Check: Ansible 2.19 lint with Python 3.12
- GitHub Check: Ansible 2.20 lint with Python 3.12
🔇 Additional comments (16)
etc/kayobe/ansible/maintenance/cis.yml (1)
15-15: LGTM!Also applies to: 50-53
etc/kayobe/environments/aio/globals.yml (1)
52-56: LGTM!etc/kayobe/environments/aio/kolla/config/nova/nova-compute.conf (1)
2-5: LGTM!etc/kayobe/inventory/group_vars/wazuh-manager/wazuh-manager (1)
133-140: 🔒 Security & PrivacyVerify that legacy agents no longer require these vulnerability feeds.
Removing
jammy,8, and9stops the providers from matching Ubuntu 22.04 and Red Hat/CentOS 8 or 9 agents. Wazuh still lists these operating systems in its compatibility matrix. Keep the old entries until all monitored agents migrate, or verify that the Wazuh inventory contains only Noble and version 10 agents. (documentation.wazuh.com)Source: MCP tools
etc/kayobe/seed.yml (2)
117-127: LGTM!
142-144: 🩺 Stability & AvailabilityValidate the Squid lifecycle contract before deployment.
seed_squid_containerkeeps the existingprehook while changing the image toubuntu/squid:7.2-26.04_edge. The Canonical image uses Pebble as its entrypoint. Ifcontainers/squid_proxy/pre.ymlassumes the old image's process, user, or service layout, the proxy can fail to start or fail its health checks. Run a smoke test with this exact tag, the existing hook, the mounted configuration, and a proxy request before merging. (hub.docker.com)Source: MCP tools
releasenotes/notes/ubuntu-squid-container-75698bf1b9535163.yaml (1)
4-7: 📐 Maintainability & Code QualityVerify the old image base before publishing this release note.
The supplied configuration identifies the former image as
ghcr.io/stackhpc/docker-squid:6.10, but it does not establish that its base was Rocky Linux 10. Confirm this statement against the image Dockerfile or registry metadata. Remove the sentence if the base was different.etc/kayobe/dnf.yml (1)
51-53: LGTM!Also applies to: 74-74, 95-95, 107-107, 156-161, 175-176
etc/kayobe/environments/aio/release-train.yml (1)
29-35: LGTM!Also applies to: 37-38, 42-50
etc/kayobe/environments/ci-multinode/stackhpc-ci.yml (1)
27-33: LGTM!Also applies to: 37-49
etc/kayobe/ofed.yml (1)
7-15: LGTM!Also applies to: 20-29
etc/kayobe/pulp-repo-versions.yml (1)
4-49: LGTM!etc/kayobe/kolla/repos.yaml (2)
25-126: LGTM!
7-9: 🔒 Security & PrivacyCheck that
trusted: truedoes not disable Debian/Ubuntu signature validation in the target Kolla branch.The
gpg_keyentries only protect packages if Kolla still applies them and does not rendertrustedas APTTrusted=yes. If it does bypass signature checks, remove it from the Ubuntu repositories and keep the configured keyring paths.etc/kayobe/stackhpc-overcloud-dib.yml (1)
40-42: LGTM!Also applies to: 72-72
etc/kayobe/kolla-image-tags.yml (1)
7-8: LGTM!
| if ! sudo docker image inspect kayobe:latest > /dev/null 2>&1; then | ||
| echo "Building Kayobe Automation image" | ||
| sudo DOCKER_BUILDKIT=1 docker build \ | ||
| --build-arg BASE_IMAGE=rockylinux/rockylinux:9 \ | ||
| --build-arg BASE_IMAGE=rockylinux/rockylinux:10 \ |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Force a rebuild after changing BASE_IMAGE.
run_tempest only executes docker build when kayobe:latest is absent. A worker with a cached image can therefore ignore Line 220 and continue running the previous Rocky Linux 9 image. Remove the existence-only shortcut or compare a build marker that includes the base image before reusing the tag.
| stackhpc_repo_opensearch_3_x_yum_version: "{{ stackhpc_pulp_repo_opensearch_3_x_version }}" | ||
| stackhpc_repo_opensearch_dashboards_3_x_yum_version: "{{ stackhpc_pulp_repo_opensearch_dashboards_3_x_version }}" | ||
| stackhpc_repo_rhel_10_mariadb_11_4_version: "{{ stackhpc_pulp_repo_multiarch_rhel_10_mariadb_11_4_version }}" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
names=(
stackhpc_pulp_repo_opensearch_3_x_version
stackhpc_pulp_repo_opensearch_dashboards_3_x_version
stackhpc_pulp_repo_multiarch_rhel_10_mariadb_11_4_version
)
for name in "${names[@]}"; do
echo "== Definitions for ${name} =="
rg -n --glob '*.yml' --glob '*.yaml' \
"^[[:space:]]*${name}[[:space:]]*:" . || true
doneRepository: stackhpc/stackhpc-kayobe-config
Length of output: 566
🏁 Script executed:
#!/bin/bash
set -euo pipefail
for f in etc/kayobe/environments/aio/release-train.yml etc/kayobe/environments/ci-multinode/stackhpc-ci.yml etc/kayobe/pulp.yml; do
if [ -f "$f" ]; then
echo "== $f =="
nl -ba "$f" | sed -n '1,90p'
echo
fi
done
echo "== References to derived Pulp aliases =="
rg -n --glob '*.yml' --glob '*.yaml' 'stackhpc_pulp_repo_(opensearch_3_x|opensearch_dashboards_3_x|multiarch_rhel_10_mariadb_11_4)_version' . || true
echo "== Repository variables mentioning opensearch/mariadb aliases =="
rg -n --glob '*.yml' --glob '*.yaml' 'stackhpc_pulp_repo_(opensearch|opensearch_dashboards|.*mariadb.*)' etc/kayobe || trueRepository: stackhpc/stackhpc-kayobe-config
Length of output: 261
🏁 Script executed:
#!/bin/bash
set -euo pipefail
for f in etc/kayobe/environments/aio/release-train.yml etc/kayobe/environments/ci-multinode/stackhpc-ci.yml etc/kayobe/pulp.yml; do
if [ -f "$f" ]; then
echo "== $f =="
awk '{printf "%5d\t%s\n", NR, $0}' "$f" | sed -n '1,90p'
echo
fi
done
echo "== References to derived Pulp aliases =="
rg -n --glob '*.yml' --glob '*.yaml' 'stackhpc_pulp_repo_(opensearch_3_x|opensearch_dashboards_3_x|multiarch_rhel_10_mariadb_11_4)_version' . || true
echo "== Repository variables mentioning opensearch/mariadb aliases =="
rg -n --glob '*.yml' --glob '*.yaml' 'stackhpc_pulp_repo_(opensearch|opensearch_dashboards|.*mariadb.*)' etc/kayobe || trueRepository: stackhpc/stackhpc-kayobe-config
Length of output: 16603
Use the existing generated repository versions for these repo mappings.
The referenced Pulp aliases are not defined in etc/kayobe/pulp.yml, except for the MariaDB multi-architecture alias in etc/kayobe/pulp.yml, so these mappings rely on outside generated variables and can resolve incorrectly if that source is missing.
etc/kayobe/environments/ci-multinode/stackhpc-ci.yml#L34-L36: usestackhpc_pulp_repo_opensearch_3_x_yum_version,stackhpc_pulp_repo_opensearch_dashboards_3_x_yum_version, and a defined MariaDB alias.etc/kayobe/environments/aio/release-train.yml#L36: keep the existing multi-architecture MariaDB mapping only after ensuring the generated Arch selection is available in this environment.
📍 Affects 2 files
etc/kayobe/environments/ci-multinode/stackhpc-ci.yml#L34-L36(this comment)etc/kayobe/environments/aio/release-train.yml#L36-L36
| # Should be fixed once Grafana 13.1.2 RPM is released | ||
| grafana_allowed_vulnerabilities: | ||
| - GHSA-r277-6w6q-xmqw | ||
|
|
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== allowed file =="
cat -n etc/kayobe/trivy/allowed-vulnerabilities.yml
echo
echo "== related docs/options references =="
rg -n "allowed-vulnerabilities|allow.*vulner|grafana_allowed_vulnerabilities|opensearch|CVE-2026-59873|GHSA-r277-6w6q-xmqw" -S .Repository: stackhpc/stackhpc-kayobe-config
Length of output: 12702
🌐 Web query:
CVE-2026-59873 node-tar package affected versions fixed version
💡 Result:
CVE-2026-59873 is a critical Denial of Service (DoS) vulnerability affecting the node-tar package [1][2]. Affected versions: All versions up to and including 7.5.18 [1][2]. Fixed version: 7.5.19 [1][3][2]. The vulnerability arises because the library fails to enforce hard upper bounds on total decompressed data, entry counts, or decompression ratios [3][4]. This allows an attacker to use a maliciously crafted "Gzip Bomb" to exhaust server resources, such as disk space and CPU, leading to potential service outages [1][2]. Users are advised to upgrade to version 7.5.19 or higher to mitigate this risk [1][3].
Citations:
- 1: GHSA-23hp-3jrh-7fpw
- 2: GHSA-23hp-3jrh-7fpw
- 3: https://nvd.nist.gov/vuln/detail/cve-2026-59873
- 4: https://osv.dev/vulnerability/CVE-2026-59873
🌐 Web query:
GHSA-r277-6w6q-xmqw getkin/kine-openapi affected versions fixed version
💡 Result:
The security advisory GHSA-r277-6w6q-xmqw identifies a critical "fail-open" authentication bypass vulnerability in the getkin/kin-openapi Go library [1][2]. Affected versions: All versions before 0.144.0 [3]. Fixed version: 0.144.0 [3]. The vulnerability exists in the ValidationHandler.Load function, which incorrectly replaced a nil AuthenticationFunc with NoopAuthenticationFunc by default [1][4]. Because NoopAuthenticationFunc always returns nil, this caused OpenAPI security requirements (such as API keys or OAuth tokens) to be silently bypassed for unauthenticated requests [1][5]. The fix in version 0.144.0 ensures that a nil AuthenticationFunc is not automatically replaced with the no-op version, causing such requests to correctly return an error instead of passing validation [5]. Users who intentionally require no-op authentication must now explicitly set h.AuthenticationFunc = openapi3filter.NoopAuthenticationFunc [5].
Citations:
- 1: GHSA-r277-6w6q-xmqw
- 2: GHSA-r277-6w6q-xmqw
- 3: https://advisories.gitlab.com/golang/github.com/getkin/kin-openapi/GHSA-r277-6w6q-xmqw/
- 4: GHSA-r277-6w6q-xmqw
- 5: https://cve.circl.lu/vuln/ghsa-r277-6w6q-xmqw
🌐 Web query:
GitHub advisories GHSA-r277-6w6q-xmqw grafana affected packages node-tar GitHub advisories
💡 Result:
The GitHub advisory GHSA-r277-6w6q-xmqw identifies a critical-severity authentication bypass vulnerability in the Go package getkin/kin-openapi [1][2]. It is not directly related to node-tar; rather, it pertains to the ValidationHandler.Load method in kin-openapi, which incorrectly defaults to a NoopAuthenticationFunc when a nil AuthenticationFunc is provided, effectively disabling security checks for API requests [1]. While your query associated this advisory with Grafana and node-tar, the connection is as follows: - Grafana: The getkin/kin-openapi package is a dependency used within Grafana [3]. Consequently, Grafana instances may be affected by this vulnerability through that dependency [3]. - node-tar: There is no direct link between GHSA-r277-6w6q-xmqw and node-tar. The node-tar library has its own distinct set of security advisories (e.g., GHSA-8qq5-rm4j-mr97, GHSA-83g3-92jg-28cx, and GHSA-9ppj-qmqm-q256) regarding file system traversal and arbitrary file write vulnerabilities [4][5][6]. Users should review their dependencies to ensure they are using patched versions of getkin/kin-openapi and, separately, ensure node-tar is updated to a secure version to address its specific, unrelated vulnerabilities [4][5][6].
Citations:
- 1: GHSA-r277-6w6q-xmqw
- 2: https://www.kodemsecurity.com/cve-archive/ghsa-r277-6w6q-xmqw
- 3: https://tuxcare.com/cve-tracker/cve/details/ghsa-r277-6w6q-xmqw/?context=11-5-0&product=grafana
- 4: https://osv.dev/GHSA-8qq5-rm4j-mr97
- 5: GHSA-83g3-92jg-28cx
- 6: GHSA-9ppj-qmqm-q256
🌐 Web query:
GitHub advisories CVE-2026-59873 node-tar GitHub advisories
💡 Result:
CVE-2026-59873 is a critical security vulnerability in the node-tar library (npm package tar) that involves a Denial of Service (DoS) condition caused by unlimited input processing [1][2][3]. Key details of the advisory: - Vulnerability Type: Decompression/parse DoS via unlimited input [1][2]. - Description: The node-tar library does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratios during archive extraction [1][4]. An attacker can exploit this by providing a maliciously crafted archive—often referred to as a "Gzip Bomb"—that causes the library to consume excessive disk space and CPU resources until the host service crashes or exhausts system storage [1][2][3]. - Impact: This vulnerability affects any application or service that uses node-tar to extract archives provided by untrusted sources, such as CI/CD pipelines, file-sharing platforms, or package registries [1][5]. - Affected Versions: All versions <= 7.5.18 [1][2]. - Patched Version: 7.5.19 [1][4]. - GitHub Advisory ID: GHSA-23hp-3jrh-7fpw [1][3]. - Severity: Critical (CVSS 4.0 base score 9.2) [1][6]. Users are advised to upgrade to version 7.5.19 or later to mitigate this risk [4][6].
Citations:
- 1: GHSA-23hp-3jrh-7fpw
- 2: GHSA-23hp-3jrh-7fpw
- 3: GHSA-23hp-3jrh-7fpw
- 4: https://osv.dev/vulnerability/CVE-2026-59873
- 5: https://osv.dev/vulnerability/GHSA-23hp-3jrh-7fpw
- 6: https://nvd.nist.gov/vuln/detail/CVE-2026-59873
🌐 Web query:
OSV GHSA-r277-6w6q-xmqw packages grafana kin-openapi
💡 Result:
GHSA-r277-6w6q-xmqw is a critical severity (CVSS 9.1) authentication bypass vulnerability in the Go package getkin/kin-openapi [1][2]. The vulnerability occurs in the ValidationHandler.Load method, which incorrectly defaults to a NoopAuthenticationFunc when a nil AuthenticationFunc is provided [1][2]. Because the no-op function always returns nil (indicating success), any OpenAPI security requirements (such as API keys or OAuth tokens) in the specification are silently ignored [1][2]. This creates a fail-open condition where unauthenticated requests are permitted to access protected handlers [1][3][2]. This vulnerability impacts any application using kin-openapi's ValidationHandler as enforcement middleware if they rely on the default (nil) authentication configuration [1][2]. Because of the popularity and widespread use of the library, many projects, including various components within the Grafana ecosystem (such as grafana-plugin-sdk-go and others), have been identified as potentially affected or requiring dependency updates [4]. Users should update to a non-vulnerable version of getkin/kin-openapi where the issue is remediated. For instance, specific security advisories have tracked remediation across affected packages, including updates within Grafana-related distributions [5]. [1][2]
Citations:
- 1: GHSA-r277-6w6q-xmqw
- 2: GHSA-r277-6w6q-xmqw
- 3: https://cve.circl.lu/vuln/ghsa-r277-6w6q-xmqw
- 4: https://tuxcare.com/cve-tracker/cve/details/ghsa-r277-6w6q-xmqw/
- 5: https://images.chainguard.dev/security/CGA-cf4m-m4wv-9grw
🌐 Web query:
OSV CVE-2026-59873 packages node-tar
💡 Result:
CVE-2026-59873 is a critical Denial of Service (DoS) vulnerability in the node-tar library for Node.js [1][2][3]. The vulnerability arises because the library fails to enforce hard upper bounds on total decompressed data, entry counts, or decompression ratios during archive extraction and parsing [2][4][3]. An attacker can exploit this flaw by providing a maliciously crafted archive—specifically a "Gzip Bomb"—that causes the system to exhaust disk space and CPU resources [1][3]. This can lead to system-wide failures and service outages for any application using node-tar to extract archives from untrusted sources [1][3]. Key details regarding the vulnerability include: - Affected Versions: All versions of node-tar <= 7.5.18 [1][3]. - Patched Version: The vulnerability is fixed in version 7.5.19 [1][2][4]. - Severity: Rated as Critical with a CVSS 4.0 base score of 9.2 [2][3][5]. - Weakness: Classified as CWE-770 (Allocation of Resources Without Limits or Throttling) [3]. Users are strongly advised to update to node-tar version 7.5.19 or later to mitigate this risk [1][2][3].
Citations:
- 1: GHSA-23hp-3jrh-7fpw
- 2: https://nvd.nist.gov/vuln/detail/cve-2026-59873
- 3: GHSA-23hp-3jrh-7fpw
- 4: https://osv.dev/vulnerability/CVE-2026-59873
- 5: https://www.tenable.com/cve/CVE-2026-59873
🌐 Web query:
GitHub CVE-2026-59873 OpenSearch Dashboards node-tar
💡 Result:
CVE-2026-59873 is a critical Denial of Service (DoS) vulnerability in the node-tar library (npm package 'tar') [1][2]. It is not a vulnerability specific to OpenSearch Dashboards, though OpenSearch Dashboards may be affected if it uses a vulnerable version of node-tar [1][3]. Vulnerability Details: The vulnerability arises because node-tar (versions 7.5.18 and below) fails to enforce hard upper bounds on total decompressed data, entry counts, or decompression ratios during extraction [1][2]. An attacker can provide a maliciously crafted "Gzip Bomb"—a small, compressed archive that expands into a massive amount of data—to cause resource exhaustion (disk space and CPU) on the server [1][2]. This can lead to system-wide failure or service outages [1][2]. Resolution: The issue was addressed and fixed in node-tar version 7.5.19 [1][4]. Users should upgrade to this version or higher to mitigate the risk [1][2]. Context regarding OpenSearch Dashboards: While OpenSearch Dashboards has experienced past security advisories related to its dependencies—including other issues in the node-tar library (e.g., CVE-2026-31802 and CVE-2026-26960)—CVE-2026-59873 is a separate, more recent issue affecting the upstream node-tar library itself [1][3][5]. Users of OpenSearch Dashboards should audit their environment for the vulnerable node-tar dependency and apply the necessary updates provided by the project maintainers if and when they issue a patch for the affected component [1][2].
Citations:
- 1: GHSA-23hp-3jrh-7fpw
- 2: GHSA-23hp-3jrh-7fpw
- 3: CVE-2026-31802 (High) detected in tar-7.5.7.tgz - autoclosed opensearch-project/OpenSearch-Dashboards#11498
- 4: https://osv.dev/vulnerability/CVE-2026-59873
- 5: CVE-2026-26960 (High) detected in tar-7.5.7.tgz opensearch-project/OpenSearch-Dashboards#11368
Confirm the dependency mapping before suppressing these critical advisories.
GHSA-r277-6w6q-xmqw affects getkin/kin-openapi before 0.144.0, and CVE-2026-59873 affects node-tar <= 7.5.18. Add evidence that the deployed Grafana and OpenSearch Dashboards images include the vulnerable dependency versions, and add an owner plus an expiry or removal condition tied to the fixed package release or RPM build.
Source: MCP tools
2 participants
Trying out check-review (and other CI jobs) with a few different features thrown in