Tags: NVIDIA/OpenShell
Tags
build(bazel): add OpenTelemetry crate targets (#2595) * build(bazel): add OpenTelemetry crate targets Signed-off-by: Simon Scatton <sscatton@nvidia.com> * fix(bazel): provide sandbox test policy input Signed-off-by: Simon Scatton <sscatton@nvidia.com> --------- Signed-off-by: Simon Scatton <sscatton@nvidia.com>
refactor(server): isolate gateway listener context (#2542) * refactor(server): isolate gateway listener context Signed-off-by: Evan Lezar <elezar@nvidia.com> * refactor(server): preserve gateway listener binding Signed-off-by: Evan Lezar <elezar@nvidia.com> * fix(server): preserve covered listener callback scope Signed-off-by: Evan Lezar <elezar@nvidia.com> * refactor(server): reuse gateway listener spec Signed-off-by: Evan Lezar <elezar@nvidia.com> * ci(e2e): pin rootless podman packages Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Evan Lezar <elezar@nvidia.com> Signed-off-by: Drew Newberry <anewberry@nvidia.com> Co-authored-by: Drew Newberry <anewberry@nvidia.com>
fix(cli): isolate subprocess tests from host OPENSHELL_ env vars (#2523) The subprocess-based integration tests inherit the full parent environment. If the developer has OPENSHELL_GATEWAY_INSECURE=true set in their shell, it leaks into the spawned CLI process and causes it to connect with .with_no_client_auth(), skipping the mTLS client certificate. The test server requires mTLS, so it responds with CertificateRequired and the test fails. Strip OPENSHELL_GATEWAY_INSECURE, OPENSHELL_GATEWAY, OPENSHELL_GATEWAY_ENDPOINT, and OPENSHELL_WORKSPACE from the subprocess environment. The test already sets --gateway and --gateway-endpoint explicitly via CLI args, so these env vars should not influence the subprocess behavior. Reported-by: Seth Jennings Signed-off-by: Roland Huß <rhuss@redhat.com>
fix(policy): avoid panic truncating multi-byte UTF-8 paths for display ( #2448) truncate_for_display sliced at a fixed byte index (&s[..77]), which panics when the index is not a char boundary. A policy with an over-long filesystem path containing multi-byte characters crashed the sandbox supervisor / OPA policy loader instead of producing the intended FieldTooLong violation. Back off to the nearest char boundary before slicing, and add regression tests. Signed-off-by: Andrew White <andrewh@cdw.com>
refactor(supervisor): pass agent proposal state explicitly (#2421) * test(supervisor-network): default L7 eval context in tests Signed-off-by: Evan Lezar <elezar@nvidia.com> * refactor(supervisor): pass agent proposal state explicitly Signed-off-by: Evan Lezar <elezar@nvidia.com> --------- Signed-off-by: Evan Lezar <elezar@nvidia.com>
fix(server): prevent unrelated sandbox deletes from blocking deletion… … events (#2340) * fix(server): unblock sandbox deletion events Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * refactor(server): simplify sandbox settings cleanup Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * refactor(server): make delete lock ordering explicit Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * fix(server): bind delete worker to stable sandbox id Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * fix(server): disarm canceled queued deletes Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * test: harden sandbox lifecycle cleanup coverage Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> --------- Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
PreviousNext