Skip to content

fix(compute-plane): prepare Samba and collector security pins - #2871

Merged
sbaum1994 merged 3 commits into
release-deploy/stacks/nvcf-compute-plane/v1.0from
sbaum1994/samba-stack-maintenance-104
Oct 25, 2026
Merged

sbaum1994 merged 3 commits into
release-deploy/stacks/nvcf-compute-plane/v1.0from
sbaum1994/samba-stack-maintenance-104

Conversation

@sbaum1994

@sbaum1994 sbaum1994 commented Oct 24, 2026 •

Copy link
Copy Markdown
Collaborator

TL;DR

Prepare the Compute Plane v1.0 stack to consume Samba 1.0.8 and both collector images at 0.160.0-nv-0.2.9. These maintenance candidates repair remaining helper/collector dependencies; merge only after all three images are published and qualified.

Additional Details

The existing Samba helper and maintenance collectors still link older x/net versions. Samba's producer patch selects x/net v0.60.0, x/text v0.42.0 and protobuf v1.33.0, with compatible x/sys v0.48.0 and x/term v0.46.0. Merged collector source PR #2877 selects x/net v0.60.0 and compatible modules while retaining the existing collector 0.160.0 / wrapper 0.2 feature set.

Update the shared-storage pin, ordinary collector pin and BYOO function/task collector pin together. Incorporate the already-merged collector wiring from #2872, then regenerate the backend and deployment fixtures, including encoded function/task overrides. Both collector forms retain inventory coverage. NVCA 3.10.3, operator chart 1.28.0, enablement defaults and registry/repository overrides retain their existing values.

Dependencies: the three existing images advance to proposed ordinary maintenance patches. Their producer fixes update existing BSD-3-Clause Go dependencies; Samba's exact LICENSE/PATENTS notices are refreshed, including protobuf. This consumer introduces no package, license text or NOTICE change.

For the Reviewer

The selected producer source is merged and its image/platform identities are verified. Catalog security/license checks and the approved bot-approval retries passed; the relevant catalog MRs are now merged. Verify post-merge publication and both-platform customer pulls/digests before merging these consumer pins. Auto-merge is not enabled.

This combined maintenance PR consumes Samba 1.0.8 from main #2870 plus both collectors 0.160.0-nv-0.2.9. Existing operator chart 1.28.0 consumes these stack overrides; no new operator chart release is needed. Verify the automatic Compute Plane stack release after merge.

#2823 is the full documented-baseline and previous-QA reconciliation ledger. #2492 owns final stack pins and candidate QA. Customer publication of all three stack resources and umbrella remains held for revised QA. Source CI/component tests do not qualify the assembled combination.

For QA

Passed combined Compute Plane test-local, full refreshed golden comparison, collector routing/default-ownership/observability tests, and whitespace checks. Decoded function/task overrides and the ordinary collector agree with the owning source pins; Samba runtime configuration and its inventory annotation agree with the shared-storage source pin. Existing tests cover this version-only change without copied version assertions.

Passed inventory tool unit tests/vet, generated-document consistency and Fern checks (zero errors, one existing warning). Inventory configuration/extraction from #2872 needs no additional change for these versions. Documentation release facts remain unchanged until artifacts and inventories are actually published.

Fresh Samba producer checks passed on native ARM64 and emulated AMD64: encrypted SMB3.1.1, rejected invalid credentials, read/write, byte-range locking, read-only shares, UID/GID, restart persistence, metrics, health checks and actual binary dependency guards. Its 22 Python tests and exporter tests with vet disabled pass; default exporter tests still report the unchanged upstream format-string vet defect in #2798. Collector producer qualification is tracked in #2877.

Remote checks at fc8b6ec: 12 succeeded and 4 skipped. The requested CodeRabbit review completed with no actionable comments and acknowledged the publication/qualification merge prerequisite. Its repository filters exclude generated golden files, which were verified by the local full comparison.

Native AMD64, live CSI/shared-volume function/task workflows, upgrade/rollback, catalog security validation and customer pulls remain release QA. Local render/container checks do not establish integrated stack BDD qualification or candidate availability.

Issues

Relates to #2797
Relates to #2823

Checklist

  • I am familiar with the contributing guidelines.
  • I have signed off my commits for DCO compliance.
  • Existing rendering and inventory tests cover the changed references.
  • No user-facing configuration change is required.

Select the Samba 1.0.6 runtime/security replacement through the supported maintenance chart override. Retain NVCA 3.10.3 and chart 1.28.0 while updating the rendered backend and inventory annotation.

Relates to #1895
Relates to #2823

Signed-off-by: Stephanie Baum <sbaum@nvidia.com>
@coderabbitai

coderabbitai Bot commented Oct 24, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review.

Recent review info
Run configuration
Commits

Reviewing files that changed from the base of the PR and between d5bac2a and fc8b6ec.

Files ignored due to path filters: 2
  • deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/deployment.yaml is excluded by !**/testdata/**
  • deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-nvca-operator/helm-nvca-operator/templates/self-managed-nvcfbackend-cm.yaml is excluded by !**/testdata/**
Files selected for processing: 1
  • deploy/stacks/nvcf-compute-plane/environments/base.yaml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 6 remain after this review.

Walkthrough

The Compute Plane base environment updates the BYOO and self-managed OpenTelemetry collector image tags to 0.160.0-nv-0.2.9 and adds a self-managed shared-storage image tag of 1.0.8.

Changes: Compute Plane image pins

Layer / File(s) Summary
Update environment image pins
deploy/stacks/nvcf-compute-plane/environments/base.yaml
The BYOO and self-managed OpenTelemetry collector tags change to 0.160.0-nv-0.2.9. The self-managed shared-storage tag is set to 1.0.8. Other listed defaults remain unchanged.

Priority: Low

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Other

Possibly related issues

  • NVIDIA/nvcf#16 — Tracks routing BYOO collector images from stack values; this change updates the BYOO collector pin.
  • NVIDIA/nvcf#2845 — Tracks the Compute Plane stack version selected for umbrella 1.0.4; this change updates Compute Plane image pins.
  • NVIDIA/nvcf#2823 — Lists combined Compute Plane maintenance pins as work for this PR.
  • NVIDIA/nvcf#2432 — Tracks collector and Samba updates that require new stack pins; this change updates the collector and shared-storage pins.
  • NVIDIA/nvcf#2492 — Selects Compute Plane stack releases containing the intended collector and Samba changes; this change updates those pins.
  • NVIDIA/nvcf#2797 — Tracks collector maintenance work; this change sets the collector pins that consume those updates.
  • NVIDIA/nvcf#2230 — Tracks publication and pull access for selected collector and Samba images; this change selects those image versions.
  • NVIDIA/nvcf#2843 — Tracks customer distribution of selected stack versions and images, including the Compute Plane.
  • NVIDIA/nvcf#2847 — Tracks release assets and inventories for selected stacks; this change updates pins for the next Compute Plane release.

Possibly related PRs

  • NVIDIA/nvcf#2867 — Changes the operator collector tag to 0.160.0-nv-0.2.8, which this PR advances in the Compute Plane stack.
  • NVIDIA/nvcf#2870 — Changes the shared-storage tag to Samba 1.0.8, also added by this PR.
  • NVIDIA/nvcf#2869 — Adds collector image discovery from rendered configuration and overrides, related to the collector image data updated here.

Suggested reviewers: kristinapathak

Merge Risk: Low · up to fc8b6

This updates the default image tags for the shared-storage and collector components. The change is correct as written, but deployments will fail to pull images if it ships before the new tags are published. The author has already said merge should wait for publication and qualification, so confirm that before merging.

Pre-merge checks: Passed 5
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title uses valid Conventional Commits syntax with the required scope. The fix type accurately describes the security-related image pin updates in the Compute Plane configuration.
Linked Issues check Passed The scoped coding objectives in directly linked issue #2797 are implemented for the collector and Samba workstreams. The PR updates the shared-storage, ordinary collector, and BYOO collector pins, reg…
Out of Scope Changes check Passed The changes remain within the stated maintenance scope. They update the three related image pins and their generated fixtures, while retaining NVCA, chart, defaults, and repository overrides. The summ…
Docstring Coverage Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Full details: Linked Issues check

Explanation

The scoped coding objectives in directly linked issue #2797 are implemented for the collector and Samba workstreams. The PR updates the shared-storage, ordinary collector, and BYOO collector pins, regenerates backend and deployment fixtures with encoded overrides, and reports passing rendering, routing, inventory, consistency, and Samba qualification tests. The NICLLS workstream remains outside this partial PR, as stated in the current description. Publication and release qualification are non-coding follow-up activities and do not block this assessment.

Full details: Out of Scope Changes check

Explanation

The changes remain within the stated maintenance scope. They update the three related image pins and their generated fixtures, while retaining NVCA, chart, defaults, and repository overrides. The summary reports no new package, license, or NOTICE changes and identifies no unrelated implementation.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

Select Samba image 1.0.7 with the patched metrics-helper dependencies.
Regenerate the backend fixture so runtime and inventory references agree.

Relates to #1895

Signed-off-by: Stephanie Baum <sbaum@nvidia.com>
@sbaum1994 sbaum1994 changed the title fix(compute-plane): backport Samba 1.0.6 stack pin fix(compute-plane): backport Samba 1.0.7 stack pin Oct 24, 2026
@balajinvda

Copy link
Copy Markdown
Contributor

This PR is included in version 1.0.2.

The release is available on GitHub release.

Integrate the released collector wiring and prepare Samba 1.0.8 plus both collector images at 0.160.0-nv-0.2.9. Their producer fixes select x/net v0.60.0 and x/text v0.42.0; Samba also selects protobuf v1.33.0. Regenerate the combined backend and encoded function/task fixtures.

Merge only after both producer patches are merged and all three images are independently published and qualified. Stack and umbrella customer publication remain held for QA.

Relates to #2797

Signed-off-by: Stephanie Baum <sbaum@nvidia.com>
@sbaum1994 sbaum1994 changed the title fix(compute-plane): backport Samba 1.0.7 stack pin fix(compute-plane): prepare Samba and collector security pins Oct 25, 2026
@sbaum1994
sbaum1994 marked this pull request as ready for review October 25, 2026 06:12
@sbaum1994
sbaum1994 requested a review from a team as a code owner October 25, 2026 06:12
@sbaum1994
sbaum1994 requested a review from vrv3814 October 25, 2026 06:12
@sbaum1994

Copy link
Copy Markdown
Collaborator Author

@coderabbitai review

Please review the combined maintenance image pins at fc8b6ec. The PR is ready for source review; its explicit merge prerequisite requires all three candidate images to be published and qualified before merging. The proposed tags are not claimed available, and auto-merge is disabled.

@coderabbitai

coderabbitai Bot commented Oct 25, 2026 •

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@sbaum1994
sbaum1994 merged commit df59504 into release-deploy/stacks/nvcf-compute-plane/v1.0 Oct 25, 2026
16 checks passed
@sbaum1994
sbaum1994 deleted the sbaum1994/samba-stack-maintenance-104 branch October 25, 2026 20:37
@balajinvda

Copy link
Copy Markdown
Contributor

This PR is included in version 1.0.3.

The release is available on GitHub release.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants