feat(cassandra): build the runtime image with Bazel (rules_oci) - #358
Closed
balajinvda wants to merge 4 commits into
Closed
feat(cassandra): build the runtime image with Bazel (rules_oci)#358balajinvda wants to merge 4 commits into
balajinvda wants to merge 4 commits into
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (5)
🚧 Files skipped from review as they are similar to previous changes (4)
📝 WalkthroughWalkthroughAdds ChangesCassandra Bazel image
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant CI
participant Bazel
participant ExternalArtifacts
participant OCIImage
CI->>Bazel: select infra/cassandra subtree
Bazel->>ExternalArtifacts: fetch pinned yq binaries
ExternalArtifacts-->>Bazel: provide amd64 and arm64 artifacts
Bazel->>OCIImage: assemble Cassandra layers
OCIImage-->>CI: produce multi-architecture image index
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Give the custom Apache-Cassandra runtime image (infra/cassandra) a Bazel rules_oci build so it releases through the same flow as every other NVCF image instead of a Dockerfile/buildah one-off. - infra/cassandra: nested Bazel module. oci.pull cassandra:5.0.8 (multi-arch, by digest), layer in a checksummed yq (public http_file) and the rack-aware cassandra-env.sh, set the exporter JVM --add-opens, expose 9500. Multi-arch image_index (amd64 + arm64) builds green; a yq exec-bit test guards the layer. - Public target ships NO exporter agent (OSS-safe). The Prometheus exporter layer and the ncp-dev push live in the OSS-excluded infra/cassandra/nvidia-internal overlay, via the shared //rules/oci-destinations macro. - rules_python toolchain sets ignore_root_user_error (rules_pkg needs it under the root CI container). Matrix row + .bazelignore wired. Follow-up: the internal (with-metrics) release variant needs the exporter agent jar's URL + sha256 (placeholder in rules/repos.bzl); the Dockerfile stays until the release cuts over. Co-authored-by: Balaji Ganesan <bganesan@nvidia.com> Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…public build The public Bazel image is exporter-free by design: the cassandra-exporter agent jar is internal-only and never redistributed in the OSS snapshot. The earlier scaffold left a dead `@cassandra_exporter_agent` http_file (EXPORTER-JAR-URL-TODO.invalid) plus a nvidia-internal/ overlay in the tree so the with-exporter variant would analyze. With the umbrella scrub retired, an in-repo nvidia-internal/ path is no longer excluded from the public mirror, so that overlay and the jar must not live here at all. Remove the placeholder repo from rules/repos.bzl, MODULE.bazel, and the lockfile, drop the untracked overlay, and reword the AGENTS.md/BUILD.bazel notes: the with-exporter image is built in the private release repo (nvcf-internal), which injects its own nvidia-internal/ overlay and jar into this module at release time and reuses the public yq/env layers. Co-authored-by: Balaji Ganesan <bganesan@nvidia.com>
The nvcf-internal bazel release backend builds every service image with `--config=release` for a uniform invocation. The Cassandra image is pure assembly (no compiled targets), so `-c opt` is effectively a no-op, but the config must exist or `bazel build --config=release` errors with an undefined config. Define it so the shared release script runs unmodified. Co-authored-by: Balaji Ganesan <bganesan@nvidia.com>
balajinvda
force-pushed
the
feat/cassandra-bazel-image
branch
from
July 22, 2026 20:57
5001c87 to
a8785b1
Compare
balajinvda
marked this pull request as ready for review
July 22, 2026 20:58
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@infra/cassandra/MODULE.bazel`:
- Around line 66-72: Establish a single validated Cassandra version contract: in
infra/cassandra/MODULE.bazel lines 66-72, derive or validate the pinned manifest
digest against the version used by the Dockerfile instead of maintaining them
independently; in infra/cassandra/AGENTS.md lines 52-55, replace the conflicting
bump guidance with synchronized instructions requiring the Dockerfile tag and
Bazel digest to be updated and verified together.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: c8e5facd-d6b1-4c61-908e-9b4fba9c389a
⛔ Files ignored due to path filters (1)
infra/cassandra/MODULE.bazel.lockis excluded by!**/*.lock,!**/MODULE.bazel.lock
📒 Files selected for processing (20)
.bazelignore.github/workflows/bazel.ymlinfra/cassandra/.bazelrcinfra/cassandra/.bazelversioninfra/cassandra/.gitignoreinfra/cassandra/AGENTS.mdinfra/cassandra/BUILD.bazelinfra/cassandra/MODULE.bazelinfra/cassandra/platforms/BUILD.bazelinfra/cassandra/rules/BUILD.bazelinfra/cassandra/rules/oci/BUILD.bazelinfra/cassandra/rules/oci/defs.bzlinfra/cassandra/rules/oci/private/BUILD.bazelinfra/cassandra/rules/oci/private/common.bzlinfra/cassandra/rules/oci/transition.bzlinfra/cassandra/rules/repos.bzlinfra/cassandra/tools/BUILD.bazelinfra/cassandra/tools/ci/BUILD.bazelinfra/cassandra/tools/ci/image_entrypoint_mode_test.shinfra/cassandra/tools/workspace_status.sh
…MODULE.bazel CodeRabbit flagged that the pinned oci.pull digest and the transitional Dockerfile `FROM cassandra:<tag>` are maintained independently while both are described as the source of truth, so a future bump could ship divergent versions. Make the digest authoritative and add an enforceable contract: record the resolved tag in a `# cassandra-version:` marker beside the digest, and add cassandra_version_consistency_test, which fails the build if the Dockerfile tag and the marker disagree. Reword the MODULE.bazel and AGENTS.md guidance into a single synchronized bump procedure (digest, marker, Dockerfile tag together). The test asserts the two human-maintained version strings agree; it does not resolve the digest over the network. The Dockerfile stays as a transitional manual/dev build path. Co-authored-by: Balaji Ganesan <bganesan@nvidia.com>
balajinvda
enabled auto-merge
July 22, 2026 21:31
nvjmcnamee
requested changes
Jul 22, 2026
nvjmcnamee
left a comment
nvjmcnamee
left a comment
Contributor
There was a problem hiding this comment.
If porting the Dockerfile is the desired direction (which I am not sure about yet), then a lot of this should be moved to a module so it can be reused (e.g. migrations).
However, I am not convinced that using Bazel here is the right approach.
Contributor
Author
|
Closing in favor of the Dockerfile approach. Per discussion: images that only assemble a base image (cassandra, and next openbao + migrations) will stay as a Dockerfile built through the release pipeline's |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The custom Apache-Cassandra runtime image (
infra/cassandra, from #328) has no build/push CI, and the existing image builds are all Bazelrules_oci. Give it a Bazel build so it releases the same way as every other NVCF image (no buildah/Dockerfile one-off).What changed
infra/cassandra: nested Bazel module.oci.pullcassandra:5.0.8(multi-arch by digest), layer checksummedyq(publichttp_file) + the rack-awarecassandra-env.sh, set the exporter--add-opensJVM opts, expose 9500.bazel build //:image_indexis green and carries linux/amd64 + linux/arm64; a yq exec-bitsh_testguards the layer.nvcr.io/0651155215864979/ncp-dev/cassandrapush live in the OSS-excludedinfra/cassandra/nvidia-internal/overlay (shared//rules/oci-destinationsmacro) — same split as stargate.rules_pythontoolchain setsignore_root_user_error(the root-in-CI trap stargate hit)..bazelignore+ acassandramatrix row wired.Open item
The metrics-enabled release variant needs one input: the exporter agent jar's internal URL + sha256 (a marked placeholder in
rules/repos.bzl). Until then the public no-exporter image builds; the internal variant resolves its full graph and fails only on that one fetch.Notes
The Dockerfile stays in place during the transition; retiring it + wiring the nvcf-internal
type: bazelrelease is the follow-up once this lands.References
None
Summary by CodeRabbit
New Features
yqutility, Cassandra environment config, JVM compatibility--add-openssettings, and port 9500 exposure.CI/CD
Documentation