Repository navigation
Conversation
The chart now tells the API, as OCC_API_HTTPS_EGRESS_OPEN, whether a sign-in egress rule allows TCP 443 to any address (GitHub, Google or OIDC enabled with empty egressCidrs). Production builds the Slack Channel Driver with expectProxy only when that egress is closed, so an open route that times out stays a retryable 503 instead of the missing-proxy 409 (finding 2533).
…ge owns the Helm rule docs/reference/settings/production.md is near the 2,500-word limit.
Contributor
|
🦞👀 Pull request received. I will update this pull request when review starts. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Production always builds the Slack Channel Driver with
expectProxy: true. With no Slack proxy, any unanswered Slack check (timeout, DNS failure, spent time budget) becomes the409that tells an administrator to setslackProxy.enabledorapi.channelDirectoryProxyUrl. But when GitHub, Google or OIDC sign-in is enabled with emptyegressCidrs, the chart's sign-in egress rule allows the API TCP 443 to any address except169.254.0.0/16, so Slack is reachable directly. On those installs a transient Slack outage gets the hedged, no-retry409instead of a plain retryable503. Follow-up to #3684.Change
openclaw.api.httpsEgressOpenrendersOCC_API_HTTPS_EGRESS_OPENon the API (only) as"true"when any sign-in provider is enabled with emptyegressCidrs(the same condition that renders a0.0.0.0/0login egress rule), else"false".OCC_API_HTTPS_EGRESS_OPENas a strict boolean (defaultfalse; any other value fails startup) intoapiHttpsEgressOpen.composeProduction:expectProxy: config.apiHttpsEgressOpen !== true. No change to theChannelDrivercontract;expectProxyis an existing option of the bundled Slack Driver.409applies and how Helm sets the flag.Verification
tests/integration/sign-in-chart-parity.test.mjs: renders password-only, a null GitHub map, GitHub/Google/OIDC with default and narrowedegressCidrs, and narrowed GitHub plus open Google; asserts the API env value, that it matches whether a login egress rule to0.0.0.0/0is rendered, and that the worker gets no flag. API startup accepts the renderedtrue(reaches the database step) and refusesopen. The case fails on main (no env var rendered).sign-in-chart-parity,production-kubernetes-packagingandslack-channel-directorypass there (147/147).tsc --build(sources + tests), eslint and prettier on touched files.expectProxyis covered bytests/conformance/slack-channel-directory.test.mjsandtests/integration/occ-api.test.mjs.Risks
Low. Installs with narrowed or no external sign-in keep today's
409. Open-egress installs that truly cannot reach Slack (for example an external firewall) now get a retryable503instead of the proxy hint. The new API env var rolls the API Pod once on upgrade; an older image ignores it, and a newer image without it keeps today's behavior.