From 10103317e80eb0d9f3a83c8faf522ffb6bb3f682 Mon Sep 17 00:00:00 2001 From: Rohan Adwankar <39285979+RohanAdwankar@users.noreply.github.com> Date: Wed, 7 Oct 2026 11:40:48 -0700 Subject: [PATCH 1/3] Bound startup asset downloads so stalled transfers retry Set connection, request and low-speed time limits on pinned startup downloads. Preserve the existing retry mechanism and make the terminal test assert its pinned source independently of curl options. Signed-off-by: Rohan Adwankar <39285979+RohanAdwankar@users.noreply.github.com> --- helm/mosaic-stack/templates/mosaic-terminal.yaml | 2 +- helm/mosaic-stack/templates/openclaw.yaml | 6 +++--- helm/mosaic-stack/tests/chart-render.test.mjs | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/helm/mosaic-stack/templates/mosaic-terminal.yaml b/helm/mosaic-stack/templates/mosaic-terminal.yaml index 3730fa9..ed8bce0 100644 --- a/helm/mosaic-stack/templates/mosaic-terminal.yaml +++ b/helm/mosaic-stack/templates/mosaic-terminal.yaml @@ -63,7 +63,7 @@ spec: *) echo "unsupported architecture: $(uname -m)" >&2; exit 1 ;; esac rm -f /tools/kubectl - curl -fsSL --retry 5 --retry-all-errors -o /tools/kubectl \ + curl -fsSL --connect-timeout 15 --max-time 120 --speed-limit 1024 --speed-time 30 --retry 5 --retry-all-errors -o /tools/kubectl \ "https://dl.k8s.io/release/{{ .Values.kubernetes.kubectlVersion }}/bin/linux/$architecture/kubectl" printf '%s %s\n' "$sha" /tools/kubectl | sha256sum -c - chmod 0555 /tools/kubectl diff --git a/helm/mosaic-stack/templates/openclaw.yaml b/helm/mosaic-stack/templates/openclaw.yaml index e7111c6..0c57e1e 100644 --- a/helm/mosaic-stack/templates/openclaw.yaml +++ b/helm/mosaic-stack/templates/openclaw.yaml @@ -53,7 +53,7 @@ spec: *) echo "unsupported architecture: $(uname -m)" >&2; exit 1 ;; esac rm -f /tools/kubectl - curl -fsSL --retry 5 --retry-all-errors -o /tools/kubectl \ + curl -fsSL --connect-timeout 15 --max-time 120 --speed-limit 1024 --speed-time 30 --retry 5 --retry-all-errors -o /tools/kubectl \ "https://dl.k8s.io/release/{{ .Values.kubernetes.kubectlVersion }}/bin/linux/$architecture/kubectl" printf '%s %s\n' "$sha" /tools/kubectl | sha256sum -c - chmod 0555 /tools/kubectl @@ -347,7 +347,7 @@ spec: *) echo "unsupported architecture: $(uname -m)" >&2; exit 1 ;; esac cli=/tmp/openshell-cli.tar.gz - curl -fsSL --retry 5 --retry-all-errors -o "$cli" \ + curl -fsSL --connect-timeout 15 --max-time 120 --speed-limit 1024 --speed-time 30 --retry 5 --retry-all-errors -o "$cli" \ "https://github.com/NVIDIA/OpenShell/releases/download/{{ .Values.openclaw.openshell.cliVersion }}/openshell-$target.tar.gz" printf '%s %s\n' "$sha" "$cli" | sha256sum -c - rm -f /tools/openshell /tools/openshell.real @@ -404,7 +404,7 @@ spec: chmod 0555 /tools/openshell plugin=/tmp/openshell-plugin.tar.gz - curl -fsSL --retry 5 --retry-all-errors -o "$plugin" \ + curl -fsSL --connect-timeout 15 --max-time 120 --speed-limit 1024 --speed-time 30 --retry 5 --retry-all-errors -o "$plugin" \ "https://registry.npmjs.org/@openclaw/openshell-sandbox/-/openshell-sandbox-{{ .Values.openclaw.openshell.pluginVersion }}.tgz" printf '%s %s\n' {{ .Values.openclaw.openshell.pluginSha256 | quote }} "$plugin" | sha256sum -c - rm -rf /openshell-plugin/* diff --git a/helm/mosaic-stack/tests/chart-render.test.mjs b/helm/mosaic-stack/tests/chart-render.test.mjs index cf4156f..c8fb483 100644 --- a/helm/mosaic-stack/tests/chart-render.test.mjs +++ b/helm/mosaic-stack/tests/chart-render.test.mjs @@ -909,7 +909,7 @@ test("renders the terminal service from the UI image with isolated read-only acc assert.match(output, /name: MOSAIC_TERMINAL_URL\s+value: "http:\/\/mosaic-terminal:3002"/); assert.match(output, /name: mosaic-terminal[\s\S]*namespace: mosaic-test[\s\S]*name: .*oc-reader/); assert.match(output, /requiredDuringSchedulingIgnoredDuringExecution:[\s\S]*app: openclaw/); - assert.match(output, /curl -fsSL --retry 5 --retry-all-errors -o \/tools\/kubectl \\\s+"https:\/\/dl\.k8s\.io\/release\/v1\.34\.1\/bin\/linux\/\$architecture\/kubectl"/); + assert.match(output, /"https:\/\/dl\.k8s\.io\/release\/v1\.34\.1\/bin\/linux\/\$architecture\/kubectl"/); assert.doesNotMatch(output, /registry\.k8s\.io\/kubectl/); assert.doesNotMatch(rbac, /resources: \[[^\]]*"secrets"/); assert.doesNotMatch(rbac, /resources: \[[^\]]*"pods\/exec"/); From 9c4149092aabb2daa5eefe710ad176f1902299fd Mon Sep 17 00:00:00 2001 From: Rohan Adwankar <39285979+RohanAdwankar@users.noreply.github.com> Date: Wed, 7 Oct 2026 11:54:15 -0700 Subject: [PATCH 2/3] Use UI image with Grafana proxy routing fix Select the existing source-built image that rewrites Grafana application routing and preserves plugin JavaScript integrity. Keep the image inside the customer release team repository. Signed-off-by: Rohan Adwankar <39285979+RohanAdwankar@users.noreply.github.com> --- helm/mosaic-stack/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/helm/mosaic-stack/values.yaml b/helm/mosaic-stack/values.yaml index 77f0722..4e9f8db 100644 --- a/helm/mosaic-stack/values.yaml +++ b/helm/mosaic-stack/values.yaml @@ -210,7 +210,7 @@ mosaicUi: replicaCount: 1 image: repository: nvcr.io/0948643769302270/afoa-release/mosaic-ui - tag: 84523f34 + tag: a011dcc8 pullPolicy: Always deploymentVersion: v0.0.1 auditPvc: From 983416a58948ab1a8bb032a1834ab07fe56d1879 Mon Sep 17 00:00:00 2001 From: Rohan Adwankar <39285979+RohanAdwankar@users.noreply.github.com> Date: Wed, 7 Oct 2026 13:47:40 -0700 Subject: [PATCH 3/3] Restore curl defaults for startup downloads Remove connection, overall-transfer and low-speed limits added without evidence for customer networks. Preserve the existing retry behavior and restore its unchanged test; the branch now only selects the Grafana routing fix image. Signed-off-by: Rohan Adwankar <39285979+RohanAdwankar@users.noreply.github.com> --- helm/mosaic-stack/templates/mosaic-terminal.yaml | 2 +- helm/mosaic-stack/templates/openclaw.yaml | 6 +++--- helm/mosaic-stack/tests/chart-render.test.mjs | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/helm/mosaic-stack/templates/mosaic-terminal.yaml b/helm/mosaic-stack/templates/mosaic-terminal.yaml index ed8bce0..3730fa9 100644 --- a/helm/mosaic-stack/templates/mosaic-terminal.yaml +++ b/helm/mosaic-stack/templates/mosaic-terminal.yaml @@ -63,7 +63,7 @@ spec: *) echo "unsupported architecture: $(uname -m)" >&2; exit 1 ;; esac rm -f /tools/kubectl - curl -fsSL --connect-timeout 15 --max-time 120 --speed-limit 1024 --speed-time 30 --retry 5 --retry-all-errors -o /tools/kubectl \ + curl -fsSL --retry 5 --retry-all-errors -o /tools/kubectl \ "https://dl.k8s.io/release/{{ .Values.kubernetes.kubectlVersion }}/bin/linux/$architecture/kubectl" printf '%s %s\n' "$sha" /tools/kubectl | sha256sum -c - chmod 0555 /tools/kubectl diff --git a/helm/mosaic-stack/templates/openclaw.yaml b/helm/mosaic-stack/templates/openclaw.yaml index 0c57e1e..e7111c6 100644 --- a/helm/mosaic-stack/templates/openclaw.yaml +++ b/helm/mosaic-stack/templates/openclaw.yaml @@ -53,7 +53,7 @@ spec: *) echo "unsupported architecture: $(uname -m)" >&2; exit 1 ;; esac rm -f /tools/kubectl - curl -fsSL --connect-timeout 15 --max-time 120 --speed-limit 1024 --speed-time 30 --retry 5 --retry-all-errors -o /tools/kubectl \ + curl -fsSL --retry 5 --retry-all-errors -o /tools/kubectl \ "https://dl.k8s.io/release/{{ .Values.kubernetes.kubectlVersion }}/bin/linux/$architecture/kubectl" printf '%s %s\n' "$sha" /tools/kubectl | sha256sum -c - chmod 0555 /tools/kubectl @@ -347,7 +347,7 @@ spec: *) echo "unsupported architecture: $(uname -m)" >&2; exit 1 ;; esac cli=/tmp/openshell-cli.tar.gz - curl -fsSL --connect-timeout 15 --max-time 120 --speed-limit 1024 --speed-time 30 --retry 5 --retry-all-errors -o "$cli" \ + curl -fsSL --retry 5 --retry-all-errors -o "$cli" \ "https://github.com/NVIDIA/OpenShell/releases/download/{{ .Values.openclaw.openshell.cliVersion }}/openshell-$target.tar.gz" printf '%s %s\n' "$sha" "$cli" | sha256sum -c - rm -f /tools/openshell /tools/openshell.real @@ -404,7 +404,7 @@ spec: chmod 0555 /tools/openshell plugin=/tmp/openshell-plugin.tar.gz - curl -fsSL --connect-timeout 15 --max-time 120 --speed-limit 1024 --speed-time 30 --retry 5 --retry-all-errors -o "$plugin" \ + curl -fsSL --retry 5 --retry-all-errors -o "$plugin" \ "https://registry.npmjs.org/@openclaw/openshell-sandbox/-/openshell-sandbox-{{ .Values.openclaw.openshell.pluginVersion }}.tgz" printf '%s %s\n' {{ .Values.openclaw.openshell.pluginSha256 | quote }} "$plugin" | sha256sum -c - rm -rf /openshell-plugin/* diff --git a/helm/mosaic-stack/tests/chart-render.test.mjs b/helm/mosaic-stack/tests/chart-render.test.mjs index c8fb483..cf4156f 100644 --- a/helm/mosaic-stack/tests/chart-render.test.mjs +++ b/helm/mosaic-stack/tests/chart-render.test.mjs @@ -909,7 +909,7 @@ test("renders the terminal service from the UI image with isolated read-only acc assert.match(output, /name: MOSAIC_TERMINAL_URL\s+value: "http:\/\/mosaic-terminal:3002"/); assert.match(output, /name: mosaic-terminal[\s\S]*namespace: mosaic-test[\s\S]*name: .*oc-reader/); assert.match(output, /requiredDuringSchedulingIgnoredDuringExecution:[\s\S]*app: openclaw/); - assert.match(output, /"https:\/\/dl\.k8s\.io\/release\/v1\.34\.1\/bin\/linux\/\$architecture\/kubectl"/); + assert.match(output, /curl -fsSL --retry 5 --retry-all-errors -o \/tools\/kubectl \\\s+"https:\/\/dl\.k8s\.io\/release\/v1\.34\.1\/bin\/linux\/\$architecture\/kubectl"/); assert.doesNotMatch(output, /registry\.k8s\.io\/kubectl/); assert.doesNotMatch(rbac, /resources: \[[^\]]*"secrets"/); assert.doesNotMatch(rbac, /resources: \[[^\]]*"pods\/exec"/);