refactor(providers)!: declare imported profile behavior safely by feloy · Pull Request #3775 · NVIDIA/OpenShell

feloy · 2026-09-28T13:35:54Z

Summary

Make imported provider profiles authoritative for non-secret environment defaults, discovery, and required platform adapters. Preserve sandbox environment precedence and Vertex credentials during migration from the legacy service-account key. Integrate the GCP metadata support restored on main through declarative profile settings.

Related Issue

Closes #3442. The issue remains labeled state:triage-needed; this PR follows a direct request and does not change its lifecycle labels.

Changes

Add bounded profile declarations for projected and fixed environment values, discovery config keys, and platform adapters, with deterministic profile serialization and updated Go bindings.
Replace provider-ID-selected Google Cloud and Vertex environment setup in the gateway with profile declarations while preserving caller environment values and credential placeholders in main and exec processes.
Keep the supervisor-backed GCP metadata relay restored by main in f7273e4. The google-cloud profile now requests the gcp-metadata platform adapter and declares the metadata host, IP, and detection environment values used by Google SDK discovery. The adapter is available on supported non-Windows runtimes and rejected on Windows/MXC.
Reject GOOGLE_SERVICE_ACCOUNT_KEY as an injectable credential or non-secret default. Older stored provider records can retain it without withholding the access token and SDK configuration.
Allow two attached providers to share a non-secret destination when their values match; reject differing values and overlapping credential keys. Update regression tests, examples, architecture docs, provider guides, and migration notes.
Restore the GCP token-response helper and its tests, and import the GCP profile in the provider E2E setup.

Testing

mise run pre-commit passed before the rebase; the final commit's hooks passed after the rebase
mise run ci passed before the rebase
Unit tests added/updated and focused post-rebase tests passed
E2E tests added/updated and focused post-rebase lanes passed

After the rebase, core and provider tests, focused gateway adapter tests, supervisor-network GCP metadata tests, and the restored token-response tests passed. mise run test:e2e-provider-profiles passed, as did all three Google SDK metadata-discovery cases in the Podman sandbox E2E suite. The metadata relay, supervisor handler, proxy, and core metadata protocol code match main; the intended change is how the imported profile enables and configures that path.

Checklist

Follows Conventional Commits
Commits are signed off (DCO)
Architecture docs updated

copy-pr-bot · 2026-09-28T13:35:58Z

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

github-actions · 2026-09-28T15:49:01Z

Label test:e2e applied, but pull-request/3775 does not exist yet. A maintainer needs to comment /ok to test 5e32a9462576ccf25ba7a12ea98dc18e36576fe7 to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

johntmyers · 2026-09-28T15:49:20Z

/ok to test 5e32a94

johntmyers

gator-agent

PR Review Status

This provider-boundary change is project-valid under linked issue #3442 and its pre-0.1.0 roadmap. The independent initial review found no blocking defects, and the required current-head branch, Helm, and E2E workflows are queued after creating the PR mirror.

Blocking findings:

No blocking findings remain

Carried findings:

None

Gator metadata

Validation: Implements the defined provider-boundary work in #3442 under roadmap #3171 and the coordinated pre-0.1.0 effort #2565
Docs: Fern provider and migration docs, provider examples, and architecture documentation are updated
Checks: Current-head Branch Checks and Helm Lint workflows are queued
E2E: test:e2e applied; /ok to test created the current-head mirror and Branch E2E Checks is queued
Head SHA: 5e32a9462576ccf25ba7a12ea98dc18e36576fe7
Base SHA: eef8bec0c96b384556d608f8d899a8a96f5d17a1
Merge base SHA: 9f60f55c6b0811b1651099b50e4618d435ebc02e
Patch ID: b24a544279787e3a990b12da55d77491e4d6bd1d
Gator payload: 9
Review mode: initial
Previous reviewed SHA: none
Review budget exhausted: no
Maintainer decision required: no
Next state: gator:watch-pipeline

johntmyers · 2026-09-28T16:24:45Z

/ok to test 8e48662

johntmyers

gator-agent

PR Review Status

The follow-up review checked the new endpointless-provider E2E coverage added since the prior reviewed head and found no blocking defects. The current-head mirror is now updated, and the required branch, Helm, and E2E workflows are queued.

Blocking findings:

No blocking findings remain

Carried findings:

None

Gator metadata

Validation: Implements the provider-boundary work defined by linked issue #3442 under the coordinated pre-0.1.0 roadmap
Docs: Existing Fern provider and migration docs remain sufficient; this follow-up delta changes only E2E coverage
Checks: Current-head Branch Checks and Helm Lint workflows are queued
E2E: test:e2e remains applied; /ok to test updated the mirror and current-head Branch E2E Checks is queued
Head SHA: 8e48662edf04d770f1dfe1eaf5c4d1efb7a92b57
Base SHA: eef8bec0c96b384556d608f8d899a8a96f5d17a1
Merge base SHA: 9f60f55c6b0811b1651099b50e4618d435ebc02e
Patch ID: 9ff76bb05f61eeef8087be0b1cbec4c271e650bc
Gator payload: 9
Review mode: follow_up
Previous reviewed SHA: 5e32a9462576ccf25ba7a12ea98dc18e36576fe7
Review budget exhausted: no
Maintainer decision required: no
Next state: gator:watch-pipeline

johntmyers · 2026-09-29T06:05:27Z

/ok to test ab90b18

feloy · 2026-09-29T09:19:42Z

I have updated the user documentation which was incomplete

johntmyers · 2026-09-29T09:24:50Z

/ok to test baef723

feloy · 2026-09-29T09:44:36Z

@johntmyers @drew I wonder about the support of GCP metadata emulator. The implementation has been removed by PR #2942 (google_cloud_metadata.rs and metadata_server.rsremoved) but I cannot find the issue justifying this removal. Should the documentation completely remove references to it?

drew · 2026-09-29T14:12:54Z

@johntmyers @drew I wonder about the support of GCP metadata emulator. The implementation has been removed by PR #2942 (google_cloud_metadata.rs and metadata_server.rsremoved) but I cannot find the issue justifying this removal. Should the documentation completely remove references to it?

Can you file a bug to add it back? This was likely done in error and missed if there were no E2E tests.

drew · 2026-09-29T14:14:10Z

I'd also like to note that we can't merge this PR (#3775) unless we make it backwards compatible. Breaking changes need to get slotted into the 0.2.0 release.

feloy · 2026-09-29T14:57:14Z

@johntmyers @drew I wonder about the support of GCP metadata emulator. The implementation has been removed by PR #2942 (google_cloud_metadata.rs and metadata_server.rsremoved) but I cannot find the issue justifying this removal. Should the documentation completely remove references to it?

Can you file a bug to add it back? This was likely done in error and missed if there were no E2E tests.

I have created #3860

johntmyers · 2026-09-30T02:09:49Z

/ok to test b13c130

johntmyers

gator-agent

PR Review Status

Thanks @feloy, I compared the rebased author series with the last reviewed head and preserved the resolved documentation finding and the follow-up issue for the GCP metadata emulator. The bounded critical-only review found no newly introduced Critical defect, but @drew’s backward-compatibility requirement remains unresolved: the current PR still declares and implements a breaking provider migration for the current release.

Action required: make the provider change backward compatible for the current release, or defer the breaking behavior to the 0.2.0 release as @drew directed.

Blocking findings:

No new Gator code-review blockers on this delta

Carried findings:

GATOR-baef7232-01: resolved by the corrected installation-specific executable guidance
Maintainer requirement: backward compatibility remains unresolved

Gator metadata

Validation: Implements the provider-boundary work defined by linked issue #3442
Docs: Fern provider and migration documentation are updated; issue #3860 tracks restoring the GCP metadata emulator
Checks: Current-head Branch Checks and E2E are running; Helm Lint and Trivy Changes are green
E2E: test:e2e remains applied; /ok to test b13c130e3d8368d69db0294bb0c616e18ab10e8f created the current-head mirror and Branch E2E Checks is running
Head SHA: b13c130e3d8368d69db0294bb0c616e18ab10e8f
Base SHA: 252882f37f2daa63ef4078b3bbb89adbcf43b409
Merge base SHA: 252882f37f2daa63ef4078b3bbb89adbcf43b409
Patch ID: f43cae627b6478db3ddc287542918f34e8f95450
Gator payload: 9
Review mode: critical_only
Previous reviewed SHA: 6a281eb7a7b3c4d63a06ab6009549bad73b5a194
Review budget exhausted: yes
Maintainer decision required: no — @drew already gave the required release-compatibility direction
Next state: gator:in-review

johntmyers · 2026-09-30T23:31:55Z

/ok to test f252381

johntmyers

gator-agent

PR Review Status

Thanks @feloy, I compared the current author series with the last reviewed head after the force-push. The bounded critical-only review found no newly introduced Critical defect, and the resolved Claude executable guidance remains intact. @drew’s backward-compatibility requirement is still unresolved because this head retains the breaking provider migration.

Action required: make the provider change backward compatible for the current release, or defer the breaking behavior to the 0.2.0 release as @drew directed.

Blocking findings:

No new Gator code-review blockers on this delta

Carried findings:

GATOR-baef7232-01: resolved by the corrected installation-specific executable guidance
Maintainer requirement: backward compatibility remains unresolved

Gator metadata

Validation: Implements the provider-boundary work defined by linked issue #3442
Docs: Fern provider and migration documentation are updated; issue #3860 tracks restoring the GCP metadata emulator
Checks: Current-head required checks are pending dispatch after the host-maintenance restart and force-push
E2E: test:e2e remains applied; /ok to test f2523815e8d2e79347d4d9739714ed4951df1c29 requested the current-head mirror, but workflow dispatch is not yet confirmed
Head SHA: f2523815e8d2e79347d4d9739714ed4951df1c29
Base SHA: 9912d21d30978d9a4389a71e871da47e0f974feb
Merge base SHA: 912a077bd641272016fb8b2fd58209f6c7c6f194
Patch ID: 9ff1cbb3945a445f07c66d0f6fded1a51b482d6f
Gator payload: 9
Review mode: critical_only
Previous reviewed SHA: b13c130e3d8368d69db0294bb0c616e18ab10e8f
Review budget exhausted: yes
Maintainer decision required: no — @drew already gave the required release-compatibility direction
Next state: gator:in-review

Move non-secret environment defaults and discovery keys into bounded profile declarations. Validate credential collisions and required platform adapters, and keep profile revision encoding deterministic. Preserve sandbox template and spec environment values, including empty values, over non-secret profile defaults in both launch paths. Keep provider credential placeholders authoritative. Allow identical non-secret values from attached providers while rejecting conflicting values and credential key collisions. Never expose GOOGLE_SERVICE_ACCOUNT_KEY through credentials or non-secret defaults, including older stored profiles. Omit stale private-key records without withholding remaining Vertex tokens or SDK configuration. Remove ID-selected adapters and orphaned GCP metadata helpers; document migration and compatible example imports. Closes NVIDIA#3442 BREAKING CHANGE: Google Cloud and Vertex profiles must declare their environment and discovery effects. The Google Cloud metadata profile requires the currently unavailable gcp-metadata adapter. Configure Vertex private key material through credential refresh instead of GOOGLE_SERVICE_ACCOUNT_KEY. Signed-off-by: Philippe Martin <phmartin@redhat.com>

Signed-off-by: Philippe Martin <phmartin@redhat.com>

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

Allow standard non-Windows E2E lanes to import profiles requiring the restored supervisor metadata adapter. Keep the GCP token-response tests and remove unused compiled environment catalogs now declared by profiles. Signed-off-by: Philippe Martin <phmartin@redhat.com>

feloy · 2026-10-02T17:03:23Z

Rebased onto main, including f7273e4, which restored supervisor-backed GCP metadata. This branch now preserves that relay and token endpoint, enables the gcp-metadata adapter through the imported google-cloud profile on supported runtimes, and supplies the metadata environment values needed for Google SDK discovery. It also restores the token-response tests and imports the profile in E2E setup. All three Podman Google SDK discovery cases passed. An audit against main found no incidental changes to the sandbox relay, supervisor metadata handler, proxy, or core metadata protocol code.

johntmyers · 2026-10-02T17:18:50Z

/ok to test 542c940

johntmyers

gator-agent

PR Review Status

Thanks @feloy, I checked your update against the rebased author series: the restored GCP metadata path is retained and enabled through the imported profile, with token-response tests and E2E profile setup restored. The bounded critical-only review found no newly introduced Critical defect, and the resolved Claude executable guidance remains intact. @drew’s compatibility requirement remains unresolved: existing Google profiles still require new environment and discovery declarations to preserve their behavior.

Action required: @feloy, preserve compatibility for the current release or defer the breaking behavior to 0.2.0 as @drew directed. A maintainer also needs to approve the current-head Trivy workflow and re-run all jobs in Windows MSVC now that test:windows is applied; its first attempt skipped the architecture test jobs.

Blocking findings:

No new Gator code-review blockers on this delta

Carried findings:

GATOR-baef7232-01: resolved; the installation-specific executable guidance and resolved thread are preserved
Maintainer requirement: backward compatibility remains unresolved

Gator metadata

Validation: Implements the provider-boundary work defined by linked issue #3442
Docs: Fern provider and migration documentation updated; existing profiles must migrate environment and discovery declarations
Checks: Current-head Branch Checks queued; Helm Lint succeeded; Trivy requires workflow approval; Windows architecture tests skipped before the label was applied
E2E: test:e2e retained; current-head /ok to test updated the mirror and Branch E2E Checks is queued
Windows: test:windows applied for Windows-specific adapter behavior; maintainer rerun required
Head SHA: 542c940a0addad3ff56bdb5797018b675890747e
Base SHA: 046fd2a0246d6765845b3abf6f9cb2c74005781f
Merge base SHA: 046fd2a0246d6765845b3abf6f9cb2c74005781f
Patch ID: 136f20903b8dbf6ced0131a002d2c6ba6ac07d1d
Gator payload: 10
Review mode: critical_only
Previous reviewed SHA: f2523815e8d2e79347d4d9739714ed4951df1c29
Review budget exhausted: yes
Maintainer decision required: no — the existing compatibility direction is clear; workflow approval and dispatch are separate process actions
Next state: gator:blocked
Blocked reason: test_dispatch_required

Signed-off-by: Philippe Martin <phmartin@redhat.com>

johntmyers · 2026-10-02T19:36:34Z

/ok to test 89b62a3

johntmyers

gator-agent

PR Review Status

I checked the new test-only delta against the last reviewed head. The bounded Critical-only review found no newly introduced Critical defect, and the resolved Claude executable guidance remains intact. @drew’s compatibility requirement remains unresolved: this commit removes a metadata-status assertion without changing the breaking provider migration.

Action required: @feloy, preserve compatibility for the current release or defer the breaking behavior to 0.2.0 as @drew directed. A maintainer also needs to approve the current-head Trivy workflow.

Blocking findings:

No new Gator code-review blockers on this delta

Carried findings:

GATOR-baef7232-01: resolved; the corrected executable guidance and resolved thread are preserved
Maintainer requirement: backward compatibility remains unresolved

Gator metadata

Validation: Implements the provider-boundary work defined by linked issue #3442
Docs: Existing Fern provider and migration documentation retained; existing Google profiles still require new environment and discovery declarations
Checks: Current-head Branch Checks, Helm Lint, and E2E workflows queued or running; Trivy requires maintainer workflow approval
E2E: test:e2e retained; current-head /ok to test updated the mirror and Branch E2E Checks is queued
Windows: test:windows retained; both x64 and ARM64 lint/test jobs are running on this head
Head SHA: 89b62a3fb91fdcdfd968f9b5ed3c3e38ffb1b0fb
Base SHA: 046fd2a0246d6765845b3abf6f9cb2c74005781f
Merge base SHA: 046fd2a0246d6765845b3abf6f9cb2c74005781f
Patch ID: 208b74a667f9ed25d0b1bcc1eb50775d2435456e
Gator payload: 10
Review mode: critical_only
Previous reviewed SHA: 542c940a0addad3ff56bdb5797018b675890747e
Review budget exhausted: yes
Maintainer decision required: no — the existing compatibility direction is clear; workflow approval is a separate process action
Next state: gator:blocked
Blocked reason: workflow_approval_required

feloy · 2026-10-02T20:38:57Z

On the latest PR run, Windows x64 and arm64 fail on Clippy warnings in openshell-cli/src/ssh.rs, which this PR does not change and which matches current main. Docker Rust E2E fails in the restart policy test: the replacement supervisor connects, then Docker reports ContainerExited. That test has no providers attached, so it appears unrelated to the profile changes, though I can’t confirm the cause from the log. A rerun may help determine whether it’s intermittent.

feloy requested review from a team, derekwaynecarr, mrunalp and sjenning as code owners September 28, 2026 13:35

feloy mentioned this pull request Sep 28, 2026

refactor(providers)!: make provider behavior explicit in imported profiles #3442

Open

2 of 13 tasks

johntmyers added gator:in-review Gator is reviewing or awaiting PR review feedback test:e2e Requires end-to-end coverage labels Sep 28, 2026

johntmyers reviewed Sep 28, 2026

View reviewed changes

johntmyers added gator:watch-pipeline Gator is monitoring PR CI/CD status and removed gator:in-review Gator is reviewing or awaiting PR review feedback labels Sep 28, 2026

johntmyers reviewed Sep 28, 2026

View reviewed changes

johntmyers force-pushed the fix-3442/vertex branch from 8e48662 to ab90b18 Compare September 29, 2026 06:05

feloy mentioned this pull request Sep 29, 2026

bug: Restore GCP metadata server support #3860

Closed

3 tasks

johntmyers added gator:blocked Gator is blocked by process or repository gates and removed gator:in-review Gator is reviewing or awaiting PR review feedback labels Sep 30, 2026

johntmyers force-pushed the fix-3442/vertex branch from 6a281eb to b13c130 Compare September 30, 2026 02:09

johntmyers reviewed Sep 30, 2026

View reviewed changes

feloy force-pushed the fix-3442/vertex branch from b13c130 to f252381 Compare September 30, 2026 23:18

johntmyers reviewed Sep 30, 2026

View reviewed changes

feloy and others added 5 commits October 2, 2026 18:41

test(e2e): cover endpointless credentials with imported profile

c32afd4

Signed-off-by: Philippe Martin <phmartin@redhat.com>

docs: update provider user documentation

857a9a5

Signed-off-by: Philippe Martin <phmartin@redhat.com>

docs(providers): correct Claude executable guidance

bc48824

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

feloy force-pushed the fix-3442/vertex branch from f252381 to 542c940 Compare October 2, 2026 17:04

johntmyers added the test:windows Run native Windows x64 and ARM64 lint/tests on PR mirrors label Oct 2, 2026

johntmyers reviewed Oct 2, 2026

View reviewed changes

fix(e2e): remove stale GCP metadata check from endpointless test

89b62a3

Signed-off-by: Philippe Martin <phmartin@redhat.com>

johntmyers reviewed Oct 2, 2026

View reviewed changes

Conversation

feloy commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issue

Changes

Testing

Checklist

Uh oh!

copy-pr-bot Bot commented Sep 28, 2026

Uh oh!

github-actions Bot commented Sep 28, 2026

Uh oh!

johntmyers commented Sep 28, 2026

Uh oh!

johntmyers left a comment

Choose a reason for hiding this comment

PR Review Status

Uh oh!

johntmyers commented Sep 28, 2026

Uh oh!

johntmyers left a comment

Choose a reason for hiding this comment

PR Review Status

Uh oh!

johntmyers commented Sep 29, 2026

Uh oh!

feloy commented Sep 29, 2026

Uh oh!

johntmyers commented Sep 29, 2026

Uh oh!

feloy commented Sep 29, 2026

Uh oh!

drew commented Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

drew commented Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

feloy commented Sep 29, 2026

Uh oh!

johntmyers commented Sep 30, 2026

Uh oh!

johntmyers left a comment

Choose a reason for hiding this comment

PR Review Status

Uh oh!

johntmyers commented Sep 30, 2026

Uh oh!

johntmyers left a comment

Choose a reason for hiding this comment

PR Review Status

Uh oh!

feloy commented Oct 2, 2026

Uh oh!

johntmyers commented Oct 2, 2026

Uh oh!

johntmyers left a comment

Choose a reason for hiding this comment

PR Review Status

Uh oh!

johntmyers commented Oct 2, 2026

Uh oh!

johntmyers left a comment

Choose a reason for hiding this comment

PR Review Status

Uh oh!

feloy commented Oct 2, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

feloy commented Sep 28, 2026 •

edited

Loading

drew commented Sep 29, 2026 •

edited

Loading

drew commented Sep 29, 2026 •

edited

Loading