Bump osac-fulfillment-service: NO-ISSUE: Retry once on Unauthenticated in the gRPC client

[osac-dev-bot]

Bumps osac-fulfillment-service submodule.

Original PR: osac-project/fulfillment-service#581
Author: @jhernand
Merge commit: 2e798f607868b0a651b43a33334e404ade18f991

Summary by CodeRabbit

• Chores
  • Updated infrastructure components to latest versions for performance and stability improvements.

[openshift-ci-robot]

@osac-dev-bot: This pull request explicitly references no jira issue.

Details

In response to this:

Bumps osac-fulfillment-service submodule.

Original PR: osac-project/fulfillment-service#581
Author: @jhernand
Merge commit: 2e798f607868b0a651b43a33334e404ade18f991

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: osac-dev-bot
Once this PR has been reviewed and has the lgtm label, please ask for approval from jhernand. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Walkthrough

This PR updates two infrastructure dependencies: the postgres base image tag in kustomization.yaml and the osac-fulfillment-service git submodule pointer. Both are simple version/commit hash updates affecting the configured deployment images and referenced services.

Changes

Infrastructure Dependencies

Layer / File(s)	Summary
Base image and submodule version updates base/kustomization.yaml, base/osac-fulfillment-service	Postgres image tag updated from sha-706c84a to sha-2e798f6; fulfillment-service submodule pointer updated to a new commit hash.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• osac-project/osac-installer#55: Both PRs update the base/osac-fulfillment-service submodule pointer to a different commit, changing the referenced fulfillment-service code version.
• osac-project/osac-installer#88: The main PR's change to the base/osac-fulfillment-service git submodule pointer is directly aligned with the retrieved PR's submodule bump of the same base/osac-fulfillment-service reference.

Suggested labels

lgtm, approved

Suggested reviewers

• jhernand
• danmanor
• tzvatot

Poem

🐘 Postgres steps forward with a fresh digest,
Fulfillment service joins the quest,
Two hashes swapped with careful hand,
Infrastructure updates as planned. ✨

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (3 errors, 1 warning)

Check name	Status	Explanation	Resolution
No-Hardcoded-Secrets	❌ Error	Hardcoded OAuth client secret 't2N7qNiOYZzt6InsHOVsV5AzcZZbA7Sg' found in newly added prerequisites/keycloak/service/files/realm.json. HIGH RISK: Client credential exposed in version control.	Remove hardcoded secret from realm.json and use Keycloak templating or environment variable substitution for dynamic client secret generation.
No-Weak-Crypto	❌ Error	PR introduces HmacSHA1 in Keycloak realm.json for OTP and MD5 in refresh-after-snapshot.sh for file comparison; both are weak crypto patterns flagged by the check.	Upgrade HmacSHA1 to HmacSHA256 in realm.json; replace MD5 with SHA256 in refresh-after-snapshot.sh.
No-Sensitive-Data-In-Logs	❌ Error	Fulfillment-service deployment enables --log-headers=true and --log-bodies=true at debug level, exposing Authorization tokens and sensitive data in logs.	Remove --log-headers=true and --log-bodies=true flags from base/fulfillment-service/controller/deployment.yaml or restrict debug logging to development-only environments.
Ai-Attribution	⚠️ Warning	PR uses AI tools (Claude AI evidenced by CLAUDE.md and AGENTS.md files) but lacks required Red Hat attribution trailers (Assisted-by/Generated-by) in commit message.	Add appropriate Red Hat attribution trailers to commit message per policy if AI tools were used in creating/generating the code and documentation changes.

✅ Passed checks (7 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main change: bumping the osac-fulfillment-service submodule with specific gRPC client retry logic improvements.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Injection-Vectors	✅ Passed	PR adds scripts using yaml.safe_load (safe), no SQL injection, eval, pickle.loads, shell=True, or dangerouslySetInnerHTML found in modified code.
Container-Privileges	✅ Passed	No container privilege escalation configurations found (privileged: true, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation: true). Security contexts properly restrict privileges.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bump/osac-fulfillment-service/pr-581

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

@osac-dev-bot: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-vmaas	0ee5803	link	true	/test e2e-vmaas

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[omer-vishlitzky]

/close

[openshift-ci]

@omer-vishlitzky: Closed this PR.

Details

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.