feat(ess): add ess to monorepo - #649
Open
nvaghela-oss wants to merge 19 commits into
Open
Conversation
… to 2.49.0 Extend the shared Java hub with the coordinates ESS needs and keep the shared dependency graph aligned: - Add ESS coordinates: com.google.code.gson:gson, io.opentelemetry.instrumentation:opentelemetry-instrumentation-annotations:2.21.0, io.projectreactor:reactor-core-micrometer, reactor-test, reactor-tools, net.logstash.logback:logstash-logback-encoder:7.4, org.springdoc:springdoc-openapi-starter-webflux-ui:3.0.3, org.springframework.boot:spring-boot-starter-cache, spring-boot-starter-data-cassandra-reactive, spring-boot-testcontainers. - Override logback-classic/logback-core to 1.5.37 and nimbus-jose-jwt to 10.9.1. - Pin com.google.errorprone:error_prone_annotations:2.49.0 so the Maven resolver does not downgrade the shared graph to the Spring Boot BOM's 2.41.0. - Repin maven_install.json and regenerate component NOTICE files; drop the orphaned error_prone_annotations:2.41.0 metadata entry.
Add helper scripts under local_env/scripts to bring up a local ESS instance: start-cassandra.sh waits until the ess keyspace is applied, start-ess.sh builds and runs the service with the local profile and an absolute secrets path, stop-cassandra.sh tears down with optional volume purge, and start-local.sh orchestrates the full bring-up. Document the local workflow, including NCP mode, in the ESS README. Fix the cassandra-init Compose command to run "bash /init.sh" instead of "bash -c /init.sh". The bind-mounted script is not executable, so executing it directly failed with a bad-interpreter permission error and the schema was never applied. Ignore local security-scan output (bd_nspect/, scan-*.log), Maven target trees, and the root patch export in .gitignore.
|
Important Review skippedToo many files! This PR contains 371 files, which is 71 over the limit of 300. To get a review, reduce the PR to 300 files or fewer by splitting it into smaller PRs or changing its base branch. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (371)
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Contributor
🛡️ CodeQL Analysis🚨 Found 11 issue(s) Severity Breakdown:
📋 Top Issues🔗 View full details in Security tab 🕐 Last updated: 2026-08-04 00:44:42 UTC | Commit: 681f7fd |
The ESS import added src/control-plane-services/ess/NOTICE, but the root NOTICE rollup was not regenerated, so check-license failed. Add the missing path entry in sorted position to bring the rollup back in sync.
ESS declares itself a java-service via bazel-java-ci.json, so it must also be registered in github-release-subprojects.json for framework dependency-triggered releases to resolve. Add the ESS entry to fix test_java_ci_components_match_registered_subprojects.
ESS authenticates statelessly via a bearer JWT in the Authorization header and uses no cookie or session based auth, so CSRF is not exploitable and is intentionally disabled. Document this at the production disable site and note the test-only permit-all chains, to justify the CodeQL false positives.
ICMS declares itself a java-service via bazel-java-ci.json but was never added to github-release-subprojects.json (gap from the ICMS import), so the gating github-release-helper job failed test_java_ci_components_match_registered_subprojects. Register ICMS so the whole-repo release-helper check passes.
nvaghela-oss
marked this pull request as ready for review
August 4, 2026 04:16
nvaghela-oss
requested review from
RaitNao,
balajinvda,
jjayaraman-1 and
sanjay-saxena
and removed request for
balajinvda and
sanjay-saxena
August 4, 2026 04:48
Refresh dependencies.md to reflect the ESS runtime dependency set and the shared pin updates on this branch (nimbus-jose-jwt 10.9.1, logback 1.5.37, logstash-logback-encoder 8.1). Fixes the generated dependency docs freshness check.
Signed-off-by: nvaghela-oss <nvaghela@nvidia.com>
…into feat/ess-in-monorepo
sanjay-saxena
left a comment
sanjay-saxena
left a comment
Contributor
There was a problem hiding this comment.
@nvaghela-oss - I see changes to defs.bzl and spring.bzl files that are used by other components. Can you please verify this:
- Locally build internal nv-boot-managed-parent using the commit hash from your branch in the monorepo
- Locally build managed nvct-service using commit hashes from your branches in the github monorepo and internal nv-boot-managed-parent repo
Contributor
Author
|
Yes it builds fine. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
ESS (Encrypted Secret Store) is used internally by NVCF to store function and
account secrets, and by Cloud-tasks to store its task-related secrets. This PR
brings ESS into the public monorepo so it is built, tested, and released
alongside the other NVCF services.
What changed
This PR lands the Encrypted Secret Store (ESS) service natively in the monorepo
as a Bazel-built Java service.
New ESS subtree, all under
src/control-plane-services/ess/(356 new files):Shared and modified files:
MODULE.bazel dependency changes. New ESS coordinates:
Version overrides (intentional, ripple to all Java services):
Shared-graph impact vs main.
The only cross-service ripple in the sibling NOTICE files (api-keys, cloud-tasks, instance-cluster-management, notary,
nv-boot-parent) is the intended logback 1.5.34 to 1.5.37 and nimbus 10.4 to 10.9.1 bumps, plus the logstash-logback-encoder standardization to 8.1. The earlier error_prone_annotations 2.49.0 to 2.41.0 downgrade has been eliminated:
it is now 2.49.0 in the lockfile and in all NOTICE files, and the orphaned 2.41.0 metadata entry was removed.
Notes
apply uniformly to all Bazel-built Java services and restore parity with the
upstream Maven build.
config that is not part of this public snapshot. The ESS and
instance-cluster-management entries must also be added to that internal source
so a future regeneration does not drop them.
positive: ESS is a stateless API authenticated by a bearer JWT in the
Authorization header with no cookie or session auth, so CSRF is not
exploitable. The disable sites are documented in code and the alerts are
dismissed with justification.
Issues
This closes #592
Checklist