Merge pull request #546 from NVIDIA/xutongr/sync

sync main

Author: xutongNV

.github/workflows/pr-checks.yaml

@@ -62,10 +62,7 @@ jobs:
               - 'cookbook/**'
             ui:
               - '.github/workflows/pr-checks.yaml'
-              - 'BUILD'
-              - 'MODULE.bazel'
-              - 'bzl/**'
-              - 'ui/**'
+              - 'src/ui/**'
 
   #######################
   #      CI Tests       #
@@ -125,7 +122,7 @@ jobs:
 
       - name: Run Tests
         run: |
-          bazel test --test_output=errors -- //... -//ui/...
+          bazel test --test_output=errors -- //...
 
   ci-internal:
     timeout-minutes: 30
@@ -212,8 +209,7 @@ jobs:
             --test_env=TESTCONTAINERS_HOST_OVERRIDE=docker \
             --test_output=errors \
             -- \
-            //... \
-            -//ui/...
+            //...
 
       - name: Docker cleanup
         if: always()
@@ -376,17 +372,28 @@ jobs:
         with:
           lfs: true
 
-      - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@4fd964a13a440a8aeb0be47350db2fc640f19ca8
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
         with:
-          bazelisk-cache: true
-          bazelisk-version: 1.27.0
-          disk-cache: ${{ github.workflow }}
-          repository-cache: true
-          external-cache: |
-            manifest:
-              npm: ui/pnpm-lock.yaml
+          package_json_file: src/ui/package.json
+
+      - name: Setup Node.js
+        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
+        with:
+          node-version-file: src/ui/.nvmrc
+          cache: pnpm
+          cache-dependency-path: src/ui/pnpm-lock.yaml
+
+      - name: Cache Next.js build
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        with:
+          path: src/ui/.next/cache
+          key: nextjs-${{ hashFiles('src/ui/pnpm-lock.yaml') }}-${{ hashFiles('src/ui/src/**') }}
+          restore-keys: |
+            nextjs-${{ hashFiles('src/ui/pnpm-lock.yaml') }}-
 
-      - name: Build UI
+      - name: Validate UI
+        working-directory: src/ui
         run: |
-          bazel build //ui/...
+          pnpm install --frozen-lockfile
+          pnpm validate

BUILD_AND_TEST.md

@@ -1,5 +1,5 @@
 <!--
-SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -146,8 +146,8 @@ bazel run @osmo_workspace//src/service/worker:worker_push_x86_64
 # OSMO Backend Operators
 bazel run @osmo_workspace//src/operator:listener_push_x86_64                               # Image name: backend-listener
 bazel run @osmo_workspace//src/operator:backend_worker_push_x86_64                         # Image name: backend-worker
-# OSMO UI
-bazel run @osmo_workspace//ui:web_ui_push_x86_64                                           # Image name: web-ui
+# OSMO UI (built via Docker)
+bazel run @osmo_workspace//src/ui:build_push_web_ui_x86_64                                 # Image name: web-ui
 # OSMO Runtime
 bazel run @osmo_workspace//src/runtime:init_push_x86_64                                    # Image name: init-container
 # OSMO Client
@@ -169,8 +169,8 @@ bazel run @osmo_workspace//src/service/worker:worker_push_arm64
 # OSMO Backend Operators
 bazel run @osmo_workspace//src/operator:listener_push_arm64                               # Image name: backend-listener
 bazel run @osmo_workspace//src/operator:backend_worker_push_arm64                         # Image name: backend-worker
-# OSMO UI
-bazel run @osmo_workspace//ui:web_ui_push_arm64                                           # Image name: web-ui
+# OSMO UI (built via Docker)
+bazel run @osmo_workspace//src/ui:build_push_web_ui_arm64                                 # Image name: web-ui
 # OSMO Runtime
 bazel run @osmo_workspace//src/runtime:init_push_arm64                                    # Image name: init-container
 # OSMO Client

DEV.md

@@ -1,5 +1,5 @@
 <!--
-SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -45,7 +45,7 @@ bazel run @osmo_workspace//run:start_service -- --mode bazel
 This command:
 
 - Creates postgres, redis, and localstack-s3 docker containers if they do not exist
-- Starts core OSMO services (osmo, ui, router) using bazel
+- Starts core OSMO services (osmo, router) using bazel and the UI using pnpm (from `src/ui/`)
 
 ### Start OSMO Backend
 

MODULE.bazel

@@ -327,15 +327,7 @@ oci.pull(
         "linux/arm64",
     ],
 )
-oci.pull(
-    name = "node_22_distroless",
-    digest = "sha256:9b6cc2cad6cd1a0008c14ca3edacd5929839b7a06a5d530036437c0ed257f3b2",
-    image = BASE_DISTROLESS_IMAGE_URL + "node:22-v4.0.2",
-    platforms = [
-        "linux/amd64",
-        "linux/arm64",
-    ],
-)
+
 use_repo(
     oci,
     "distroless_python3_10",
@@ -344,9 +336,6 @@ use_repo(
     # "distroless_python3_10_dev",
     # "distroless_python3_10_dev_linux_amd64",
     # "distroless_python3_10_dev_linux_arm64_v8",
-    "node_22_distroless",
-    "node_22_distroless_linux_amd64",
-    "node_22_distroless_linux_arm64",
     "ubuntu_22_04",
     "ubuntu_22_04_linux_amd64",
     "ubuntu_22_04_linux_arm64",
@@ -376,40 +365,3 @@ wheel_requires(
     name = "osmo_wheel_requires",
     requirements_txt = "//src:requirements.txt",
 )
-
-################
-#  JavaScript  #
-################
-
-bazel_dep(name = "aspect_rules_js", version = "2.3.5")
-
-# pnpm (https://pnpm.io/)
-# Replaces `npm import`
-# bazel run -- @pnpm//:pnpm --dir $PWD import
-pnpm = use_extension("@aspect_rules_js//npm:extensions.bzl", "pnpm")
-use_repo(pnpm, "pnpm")
-
-# Node.js
-bazel_dep(name = "rules_nodejs", version = "6.5.0")
-
-node = use_extension("@rules_nodejs//nodejs:extensions.bzl", "node")
-use_repo(node, "nodejs_linux_amd64")
-use_repo(node, "nodejs_linux_arm64")
-use_repo(node, "nodejs_darwin_arm64")
-node.toolchain(node_version = "22.17.1")
-
-# npm
-npm = use_extension("@aspect_rules_js//npm:extensions.bzl", "npm")
-npm.npm_translate_lock(
-    name = "npm",
-    data = [
-        "//ui:package.json",
-        "//ui:pnpm-lock.yaml",
-    ],
-    npm_package_lock = "//ui:package-lock.json",
-    npmrc = "//ui:.npmrc",
-    pnpm_lock = "//ui:pnpm-lock.yaml",
-    update_pnpm_lock = False,
-    verify_node_modules_ignored = "//:.bazelignore",
-)
-use_repo(npm, "npm")

deployments/charts/quick-start/values.yaml

@@ -620,6 +620,18 @@ service:
       ## Enable OTEL collector sidecar for metrics and tracing
       ##
       enabled: false
+    ## OAuth2 Proxy sidecar configuration
+    ##
+    oauth2Proxy:
+      ## Enable OAuth2 Proxy sidecar container
+      ##
+      enabled: false
+    ## Authorization sidecar configuration
+    ##
+    authz:
+      ## Enable authorization sidecar
+      ##
+      enabled: false
     ## Rate limiting sidecar configuration
     ##
     rateLimit:
@@ -674,6 +686,12 @@ web-ui:
       ## Enable Envoy proxy sidecar container
       ##
       enabled: false
+    ## OAuth2 Proxy sidecar configuration
+    ##
+    oauth2Proxy:
+      ## Enable OAuth2 Proxy sidecar container
+      ##
+      enabled: false
 
 ## Router service configuration
 ##
@@ -765,6 +783,18 @@ router:
       ## Enable log agent sidecar for centralized log collection
       ##
       enabled: false
+    ## OAuth2 Proxy sidecar configuration
+    ##
+    oauth2Proxy:
+      ## Enable OAuth2 Proxy sidecar container
+      ##
+      enabled: false
+    ## Authorization sidecar configuration
+    ##
+    authz:
+      ## Enable authorization sidecar
+      ##
+      enabled: false
 
 ## Backend operator configuration for managing compute workloads
 ##

deployments/charts/router/README.md

@@ -123,6 +123,7 @@ helm upgrade my-router ./router -f my-values.yaml
 
 | Parameter | Description | Default |
 |-----------|-------------|---------|
+| `targetSchema` | pgroll schema version for search_path (e.g., `public_v6_2_0`). Leave empty to use the default `public` schema. | `""` |
 | `services.postgres.serviceName` | PostgreSQL service name | `postgres` |
 | `services.postgres.port` | PostgreSQL service port | `5432` |
 | `services.postgres.db` | PostgreSQL database name | `osmo` |

deployments/charts/router/templates/_envoy-config-helpers.tpl

@@ -200,9 +200,6 @@ listeners:
                     allowed_client_headers_on_success:
                       patterns:
                       - exact: set-cookie
-                      - exact: x-auth-request-user
-                      - exact: x-auth-request-email
-                      - exact: x-auth-request-preferred-username
                 failure_mode_allow: false
         - name: envoy.filters.http.lua.copy-auth-header
           typed_config:

deployments/charts/router/templates/_sidecar-helpers.tpl

@@ -290,6 +290,8 @@ Authorization sidecar container
     - "--log-name=authz_sidecar"
     {{- end }}
   env:
+    - name: OSMO_SCHEMA_VERSION
+      value: {{ .Values.targetSchema | default "public" }}
     {{- with .Values.sidecars.authz.extraEnv }}
     {{- toYaml . | nindent 4 }}
     {{- end }}

deployments/charts/router/templates/log-agent-config.yaml

@@ -138,10 +138,6 @@ data:
         log_stream_prefix   ${NODE_NAME}-flb-
         auto_create_group   true
         extra_user_agent    container-insights
-        {{- if .Values.sidecars.logAgent.cloudwatch.role }}
-        role_arn            {{ .Values.sidecars.logAgent.cloudwatch.role }}
-        {{- end }}
-
 
   parsers.conf: |
     [PARSER]

deployments/charts/router/templates/router-service.yaml

@@ -114,6 +114,8 @@ spec:
         {{- end }}
         {{- end }}
         env:
+        - name: OSMO_SCHEMA_VERSION
+          value: {{ .Values.targetSchema | default "public" }}
         {{- if .Values.services.postgres.password }}
         - name: OSMO_POSTGRES_PASSWORD
           value: {{ .Values.services.postgres.password }}