feat(supervisor): optionally strip digests from image refs #2410
Conversation
|
Walkthrough
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
apps/supervisor/src/env.ts (1)
79-79: Update documentation and deployment templates for KUBERNETES_STRIP_IMAGE_DIGEST
Add the new flag to docs/self-hosting/env/supervisor.mdx under “Kubernetes settings” (currently only
DOCKER_STRIP_IMAGE_DIGESTappears). For example:| KUBERNETES_STRIP_IMAGE_DIGEST | No | false | Strip image digest in Kubernetes. Turning on will remove the digest from pulled images. |Review your Helm charts/values.yaml and any deployment templates to expose
KUBERNETES_STRIP_IMAGE_DIGESTalongside the Docker equivalent.If you maintain an env-var schema or CLI reference, include the new flag there as well so operators see its default and description.
apps/supervisor/src/workloadManager/kubernetes.ts (1)
52-64: Digest stripping helper is straightforward; consider mild hardening and reuseThis does the job and matches the PR intent. Two optional improvements:
- Safety: optionally only strip when what follows “@” looks like an OCI digest (e.g., algo:hex), to guard against any unexpected “@” usage.
- Reuse: we already have DOCKER_STRIP_IMAGE_DIGEST semantics elsewhere; consider centralizing stripping logic in a tiny shared util to keep behavior consistent across orchestrators.
Optional tweak within this method to gate on a digest-like pattern:
private stripImageDigest(imageRef: string): string { if (!env.KUBERNETES_STRIP_IMAGE_DIGEST) { return imageRef; } - const atIndex = imageRef.lastIndexOf("@"); + const atIndex = imageRef.lastIndexOf("@"); if (atIndex === -1) { return imageRef; } - - return imageRef.substring(0, atIndex); + const digest = imageRef.slice(atIndex + 1); + // Only strip if the remainder looks like an OCI digest: "<algo>:<hex>" + if (!/^[a-z0-9]+:[A-Fa-f0-9]{32,}$/.test(digest)) { + return imageRef; + } + return imageRef.slice(0, atIndex); }
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
apps/supervisor/src/env.ts(1 hunks)apps/supervisor/src/workloadManager/kubernetes.ts(2 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
**/*.{ts,tsx}
📄 CodeRabbit Inference Engine (.github/copilot-instructions.md)
**/*.{ts,tsx}: Always prefer using isomorphic code like fetch, ReadableStream, etc. instead of Node.js specific code
For TypeScript, we usually use types over interfaces
Avoid enums
No default exports, use function declarations
Files:
apps/supervisor/src/env.tsapps/supervisor/src/workloadManager/kubernetes.ts
🧬 Code Graph Analysis (2)
apps/supervisor/src/env.ts (2)
apps/supervisor/src/envUtil.ts (1)
BoolEnv(15-17)apps/webapp/app/utils/boolEnv.ts (1)
BoolEnv(12-14)
apps/supervisor/src/workloadManager/kubernetes.ts (2)
apps/supervisor/src/env.ts (1)
env(105-105)apps/webapp/app/env.server.ts (1)
env(1065-1065)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (14)
- GitHub Check: units / internal / 🧪 Unit Tests: Internal (6, 8)
- GitHub Check: units / internal / 🧪 Unit Tests: Internal (1, 8)
- GitHub Check: units / webapp / 🧪 Unit Tests: Webapp (4, 8)
- GitHub Check: units / internal / 🧪 Unit Tests: Internal (3, 8)
- GitHub Check: units / internal / 🧪 Unit Tests: Internal (4, 8)
- GitHub Check: units / internal / 🧪 Unit Tests: Internal (5, 8)
- GitHub Check: units / webapp / 🧪 Unit Tests: Webapp (1, 8)
- GitHub Check: units / internal / 🧪 Unit Tests: Internal (2, 8)
- GitHub Check: units / webapp / 🧪 Unit Tests: Webapp (8, 8)
- GitHub Check: units / webapp / 🧪 Unit Tests: Webapp (6, 8)
- GitHub Check: e2e / 🧪 CLI v3 tests (windows-latest - npm)
- GitHub Check: units / packages / 🧪 Unit Tests: Packages (1, 1)
- GitHub Check: e2e / 🧪 CLI v3 tests (windows-latest - pnpm)
- GitHub Check: typecheck / typecheck
🔇 Additional comments (1)
apps/supervisor/src/workloadManager/kubernetes.ts (1)
91-91: Verified: stripImageDigest covers all Kubernetes image assignments — LGTMI ran
rg -n '\bopts\.image\b' apps/supervisor/src/workloadManagerand confirmed that the only Kubernetes spec referencingopts.imageis inkubernetes.ts(line 91), wherestripImageDigest(opts.image)is applied. All current container images are handled correctly. If you add initContainers or sidecars in the future, please ensure they also usestripImageDigest.
This can be switched on to help fix pull-through cache issues.