CH-226 CH-229 security updates by filippomc · Pull Request #822 · MetaCell/cloud-harness

filippomc · 2025-10-23T13:52:12Z

Closes CH-226
Closes CH-229
Also fixes unrelated Closes CH-207

Some of the changes included in this PR are low impact breaking changes:

changed sentry sid source (at works, sentry won't work)
regenerating the codefresh pipelines is recommended

Implemented solution

CH-226 Applications and template based on Connexion (python/flask serve openapi generator) are now supporting Connexion 3+
CH-229 base images have all been updated; minimal debian trixie is now used as a base
CH-207 base image names changed to better scope vulnerabilities in applications vs cloud harness

removed sentry sid handling in the common microservice in order to remove the unnecessary dependency on the microservice itself

How to test this PR

https://samples.test-ch.dev.metacell.us/ https://workflows.test-ch.dev.metacell.us/ https://common.test-ch.dev.metacell.us/ are deployed with the test pipeline. Might also be useful to test a new generated application.
...

Sanity checks:

The pull request is explicitly linked to the relevant issue(s)
The issue is well described: clearly states the problem and the general proposed solution(s)
In this PR it is explicitly stated how to test the current change
The labels in the issue set the scope and the type of issue (bug, feature, etc.)
The relevant components are indicated in the issue (if any)
All the automated test checks are passing
All the linked issues are included in one Sprint
All the linked issues are in the Review state
All the linked issues are assigned

Breaking changes (select one):

The present changes do not change the preexisting api in any way
This PR and the issue are tagged as a breaking-change and the migration procedure is well described above

Possible deployment updates issues (select one):

There is no reason why deployments based on CloudHarness may break after the current update
This PR and the issue are tagged as alert:deployment

Test coverage (select one):

Tests for the relevant cases are included in this pr
The changes included in this pr are out of the current test coverage scope

Documentation (select one):

The documentation has been updated to match the current changes
The changes included in this PR are out of the current documentation scope

Nice to have (if relevant):

Screenshots of the changes
Explanatory video/animated gif

Copilot

Pull Request Overview

This PR upgrades Connexion from version 2.14.2 to version 3.x across the CloudHarness framework and its applications, addressing compatibility issues with the newer API framework version.

Key changes:

Migrates from Connexion 2.x to 3.x with corresponding Flask compatibility updates
Replaces Flask-CORS with custom CORS handling compatible with Connexion 3.x
Updates error handling to work with Connexion 3.x's new exception handling paradigm

Reviewed Changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
libraries/cloudharness-common/cloudharness/utils/server.py	Core server initialization logic updated for Connexion 3.x compatibility, including JSON encoder changes, CORS setup, and error handling refactoring
infrastructure/common-images/cloudharness-flask/requirements.txt	Updated dependency versions for Connexion 3.x, Flask 2.x+, and added uvicorn
infrastructure/cluster-configuration/storageclass.yaml	Fixed Kubernetes StorageClass field name from deprecated volumeProvisioner to provisioner
infrastructure/cluster-configuration/storageclass-dockerdesktop.yaml	Added new StorageClass configuration for Docker Desktop environments
deployment/codefresh-test.yaml	Reorganized CI/CD build steps and updated build order for application images
deployment-configuration/helm/templates/ingress.yaml	Added support for whitelisted URI mappings in secured applications and proxy buffering configuration
applications/*/requirements.txt	Updated Connexion and related dependencies to version 3.x across all applications
applications/samples/tasks/sum/Dockerfile	Changed base image from CLOUDHARNESS_BASE to SAMPLES
applications/samples/backend/samples/controllers/test_controller.py	Removed environment variable validation logic from ping endpoint
applications/common/server/common/main.py	Removed Flask-CORS initialization as CORS is now handled centrally
application-templates/flask-server/backend/requirements.txt	Updated template dependencies to Connexion 3.x

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

libraries/cloudharness-common/cloudharness/utils/server.py

Copilot · 2025-10-23T13:54:16Z

libraries/cloudharness-common/cloudharness/utils/server.py

+            try:
+                import flask
+                request = flask.request if flask.has_request_context() else None
+            except:


Bare except: clause catches all exceptions including system-exiting exceptions. Use except Exception: to catch only standard exceptions.

Suggested change

except:

except Exception:

libraries/cloudharness-common/cloudharness/utils/server.py

infrastructure/common-images/cloudharness-flask/requirements.txt

applications/common/server/requirements.txt

…ure/CH-226

…ependencies

…to feature/CH-226

alxbrd · 2025-11-20T15:10:12Z

applications/accounts/Dockerfile

@@ -1,4 +1,4 @@
-FROM quay.io/keycloak/keycloak:26.3.5
+FROM quay.io/keycloak/keycloak:26.4


This automatically updates to the latest minor version. It could lead to having different versions across envs for the same app.

It should be no harm to use the latest patch update for keycloak, they respect semver quite well and release quite often

alxbrd · 2025-11-20T15:10:33Z

application-templates/flask-server/backend/requirements.txt

+python_dateutil >= 2.9.0
 setuptools >= 21.0.0
-
+gunicorn


Should we fix a specific version?

alxbrd · 2025-11-20T15:19:31Z

applications/workflows/server/requirements.txt

+swagger-ui-bundle>=1.1.0
+python_dateutil>=2.9.0
+setuptools>=21.0.0
+uvicorn


Should we fix a specific version?

Used to do pip freeze but now I prefer not to fix specific versions on cloud harness because getting security updates requires a lot of work in pinning every single requirement and we end up with outdated libraries. The risk of this simple microservice breaking is pretty low and we are now monitoring vulnerabilities that should catch bad guys coming in

alxbrd · 2025-11-20T15:24:14Z

infrastructure/base-images/cloudharness-frontend-build/Dockerfile

@@ -1,3 +1,3 @@
-FROM node:20
+FROM node:22-alpine


For consistency should we use 22-trixie-slim?

this is just for building, and alpine has less reported vulnerabilities than trixie (easily 0)

alxbrd · 2025-11-20T15:25:04Z

infrastructure/common-images/cloudharness-django/libraries/cloudharness-django/requirements.txt

+Pillow>=9.2.0
+python-keycloak
+django-prometheus
+uvicorn


Fix versions.

leaving that open for the common images so inheritors can pin versions as needed

alxbrd · 2025-11-20T15:28:26Z

applications/accounts/Dockerfile


 # # keycloak kafka listener plugin
-COPY plugins/metacell-admin-event-listener-module-1.0.0.jar /opt/keycloak/providers/
+COPY plugins/* /opt/keycloak/providers/


I would specifically list the plugins we want to install. Currently there is only one anyway.

I preferred this option so applications can add plugins without necessarily overriding the docker file

CH-226 connexion apps upgrade

838051f

filippomc marked this pull request as draft October 23, 2025 13:52

filippomc requested a review from Copilot October 23, 2025 13:52

CH-226 revert unrelated change

7e025e6

Copilot AI reviewed Oct 23, 2025

View reviewed changes

filippomc added 15 commits November 14, 2025 18:42

Merge branch 'develop' of github.com:MetaCell/cloud-harness into feat…

fe19dc4

…ure/CH-226

CH-226 requirements cleanup, regenerate apps, locally tested OK

45bd498

CH-226 JSON encoder fix

b0c173f

CH-226 JSON encoder fix

997d70e

CH-226 fix common service

055d9b3

CH-226 use uvicorn workers

cc82061

CH-226 unit tests fix

e2928f8

CH-226 remove volume manager tests

9b1503a

CH-226 fix samples dependency issue

ef69649

CH-226 remove deprecated common dependency

22027b4

CH-229 reduce base images vulnerabilities

f91a9d0

CH-229 add cloudharness django to default test pipeline to evaluate d…

31dd519

…ependencies

CH-226 fix cookie auth issue

57665ca

CH-229 fix e2e test post update

796085f

CH-207 fix images path - reverts CH-194

ad9cad5

filippomc requested a review from afonsobspinto November 18, 2025 16:38

filippomc added 6 commits November 18, 2025 17:46

Linting fixes

2198019

CH-226 fix workflows API endpoint

5b015e0

CH-207 fix tests

14123e7

CH-229 add g++

3ffc0bd

CH-207 fix tests

52f6d23

CH-226 fix workflows API endpoint

a6b14fe

This comment was marked as off-topic.

Sign in to view

Update libs versions

3c30407

filippomc marked this pull request as ready for review November 19, 2025 15:58

filippomc requested a review from alxbrd November 19, 2025 15:59

filippomc changed the title ~~CH-226 connexion apps upgrade~~ CH-226 CH-229 security updates Nov 19, 2025

filippomc added the alert:deployment Something may break in the scope of this issue/pr in existing deployments label Nov 19, 2025

filippomc added 2 commits November 19, 2025 17:09

Some keycloak updates/tweaks

3879b24

Merge branch 'feature/CH-226' of github.com:MetaCell/cloud-harness in…

5378b58

…to feature/CH-226

alxbrd reviewed Nov 20, 2025

View reviewed changes

filippomc merged commit 2509651 into develop Nov 21, 2025
6 of 7 checks passed

filippomc deleted the feature/CH-226 branch November 21, 2025 15:48

		@@ -1,4 +1,4 @@
		FROM quay.io/keycloak/keycloak:26.3.5
		FROM quay.io/keycloak/keycloak:26.4

Conversation

filippomc commented Oct 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Implemented solution

How to test this PR

Sanity checks:

Breaking changes (select one):

Possible deployment updates issues (select one):

Test coverage (select one):

Documentation (select one):

Nice to have (if relevant):

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Copilot AI Oct 23, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as off-topic.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

filippomc commented Oct 23, 2025 •

edited

Loading