fix(security): NATS account boundaries and JetStream API prefixes [GNICFD-5354]#180
Open
dmathur0 wants to merge 1 commit into
Open
fix(security): NATS account boundaries and JetStream API prefixes [GNICFD-5354]#180dmathur0 wants to merge 1 commit into
dmathur0 wants to merge 1 commit into
Conversation
dmathur0
requested review from
jojung1,
polarweasel,
ryanheffernan,
spidercensus,
susanhooks and
zsblevins
as code owners
July 24, 2026 18:15
📝 WalkthroughWalkthroughChangesThe change adds per-stream JetStream API prefix configuration to Helm-generated INI files, resolves prefixes with fallback defaults, and applies them to admin and pull consumer JetStream contexts. Tests cover configured prefixes for Nautobot and device-change consumers. JetStream API Prefixes
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant Config as NATS configuration
participant Consumer as Config manager consumer
participant NATS as NATS connection
participant JetStream as JetStream context
Config->>Consumer: resolve stream API prefix
Consumer->>NATS: jetstream(prefix=api_prefix)
NATS->>JetStream: create prefixed context
Consumer->>JetStream: consume or manage consumer
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
…rcement [GNICFD-5354] Signed-off-by: Davesh Mathur <daveshm@nvidia.com>
dmathur0
force-pushed
the
davesh/nats-account-auth-gnicfd-5354
branch
from
July 24, 2026 18:18
902c681 to
8af2e18
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
src/tests/render/api/test_admin_v1.py (1)
104-105: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winMake the prefix assertions consumer-specific.
These assertions only prove that both prefixes were requested. Because both calls return the same
mock_js, a reversed Nautobot/device mapping would still pass. Use distinct JetStream mocks, or assert the ordered prefix calls together with the corresponding consumer calls.Minimal assertion improvement
- mock_conn.jetstream.assert_any_call(prefix="$JS.CEREBRO.API") - mock_conn.jetstream.assert_any_call(prefix="$JS.API") + assert [ + call.kwargs["prefix"] for call in mock_conn.jetstream.call_args_list + ] == ["$JS.CEREBRO.API", "$JS.API"]🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/tests/render/api/test_admin_v1.py` around lines 104 - 105, Update the JetStream assertions in the admin API test to verify prefix-to-consumer mapping rather than merely checking that both prefixes were requested. Use distinct JetStream mocks for the Nautobot and device prefixes, or assert the ordered prefix calls together with their corresponding consumer calls, so a reversed mapping fails.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@src/tests/render/api/test_admin_v1.py`:
- Around line 104-105: Update the JetStream assertions in the admin API test to
verify prefix-to-consumer mapping rather than merely checking that both prefixes
were requested. Use distinct JetStream mocks for the Nautobot and device
prefixes, or assert the ordered prefix calls together with their corresponding
consumer calls, so a reversed mapping fails.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 14631edc-9630-4fb7-8301-e6e3771173a6
📒 Files selected for processing (11)
deploy/helm/sample-nv-config-manager.inideploy/helm/templates/_vault-agent.tpldeploy/helm/templates/kubernetes-secrets.yamldeploy/helm/templates/vault-secrets.yamldeploy/helm/values.yamlsrc/nv_config_manager/common/config.pysrc/nv_config_manager/render/api/admin_v1.pysrc/nv_config_manager/render/pull_consumer.pysrc/tests/conftest.pysrc/tests/render/api/test_admin_v1.pysrc/tests/render/test_pull_consumer.py
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/nv_config_manager/common/config.py`:
- Around line 222-225: Update nats_nautobot_api_prefix to fall back to the
shared config_manager_api_prefix value before DEFAULT_NATS_API_PREFIX, matching
the fallback chain used by the other NATS API-prefix helpers. Add a regression
case in test_admin_v1.py covering a missing nautobot_api_prefix with a
configured config_manager_api_prefix and assert the configured shared prefix is
used.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 373323af-459b-4bf4-a0ed-38d288dfb1af
📒 Files selected for processing (11)
deploy/helm/sample-nv-config-manager.inideploy/helm/templates/_vault-agent.tpldeploy/helm/templates/kubernetes-secrets.yamldeploy/helm/templates/vault-secrets.yamldeploy/helm/values.yamlsrc/nv_config_manager/common/config.pysrc/nv_config_manager/render/api/admin_v1.pysrc/nv_config_manager/render/pull_consumer.pysrc/tests/conftest.pysrc/tests/render/api/test_admin_v1.pysrc/tests/render/test_pull_consumer.py
🚧 Files skipped from review as they are similar to previous changes (9)
- deploy/helm/values.yaml
- src/tests/conftest.py
- deploy/helm/templates/kubernetes-secrets.yaml
- deploy/helm/templates/_vault-agent.tpl
- src/tests/render/api/test_admin_v1.py
- src/tests/render/test_pull_consumer.py
- deploy/helm/templates/vault-secrets.yaml
- src/nv_config_manager/render/api/admin_v1.py
- src/nv_config_manager/render/pull_consumer.py
Comment on lines
+222
to
+225
| def nats_nautobot_api_prefix(config: ConfigParser | None = None) -> str: | ||
| """Return the JetStream API prefix for Nautobot changelog events.""" | ||
| nats_config = _nats_section(config) | ||
| return nats_config.get("nautobot_api_prefix", DEFAULT_NATS_API_PREFIX) |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Preserve the shared API-prefix fallback for Nautobot.
When nautobot_api_prefix is absent, this helper ignores a configured config_manager_api_prefix and returns $JS.API. For example, an account-scoped configuration using $JS.CEREBRO.API will make Nautobot consumers target the wrong JetStream API/account. Match the fallback chain used by the other helpers and add a regression case for the missing Nautobot-specific key in src/tests/render/api/test_admin_v1.py.
Proposed fix
- return nats_config.get("nautobot_api_prefix", DEFAULT_NATS_API_PREFIX)
+ return nats_config.get(
+ "nautobot_api_prefix",
+ nats_config.get("config_manager_api_prefix", DEFAULT_NATS_API_PREFIX),
+ )📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| def nats_nautobot_api_prefix(config: ConfigParser | None = None) -> str: | |
| """Return the JetStream API prefix for Nautobot changelog events.""" | |
| nats_config = _nats_section(config) | |
| return nats_config.get("nautobot_api_prefix", DEFAULT_NATS_API_PREFIX) | |
| def nats_nautobot_api_prefix(config: ConfigParser | None = None) -> str: | |
| """Return the JetStream API prefix for Nautobot changelog events.""" | |
| nats_config = _nats_section(config) | |
| return nats_config.get( | |
| "nautobot_api_prefix", | |
| nats_config.get("config_manager_api_prefix", DEFAULT_NATS_API_PREFIX), | |
| ) |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/nv_config_manager/common/config.py` around lines 222 - 225, Update
nats_nautobot_api_prefix to fall back to the shared config_manager_api_prefix
value before DEFAULT_NATS_API_PREFIX, matching the fallback chain used by the
other NATS API-prefix helpers. Add a regression case in test_admin_v1.py
covering a missing nautobot_api_prefix with a configured
config_manager_api_prefix and assert the configured shared prefix is used.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
mainso GitLab MR image builds can publish test images.$JS.CEREBRO.API).Test plan
docker-build-mr-amd64/docker-build-mr-arm64/docker-manifest-mr$CI_COMMIT_SHORT_SHAland in the internal registryexternalServices.nats.streams.nautobot.apiPrefixto$JS.CEREBRO.APIand confirm Nautobot consumer connects; kiwi streams remain on$JS.APISummary by CodeRabbit
*_api_prefixsettings.