Skip to content

fix: update Hub runtime defaults for v5 staging#7959

Merged
mattinannt merged 1 commit into
epic/v5from
fix/v5-hub-cube-runtime-staging
May 7, 2026
Merged

fix: update Hub runtime defaults for v5 staging#7959
mattinannt merged 1 commit into
epic/v5from
fix/v5-hub-cube-runtime-staging

Conversation

@BhagyaAmarasinghe
Copy link
Copy Markdown
Contributor

@BhagyaAmarasinghe BhagyaAmarasinghe commented May 7, 2026

Follow-up from the staging release verification.

Changes:

  • Bumps the bundled Hub image default to ghcr.io/formbricks/hub:0.3.0 by digest so Hub migrations include the PostgreSQL 16/17 uuidv7 fallback.
  • Adds numeric runAsUser: 1000 to Hub API and worker containers/init containers so Kubernetes can enforce runAsNonRoot with the Hub image USER app.
  • Adds runAsUser: 1000 to the default Cube container security context; cubejs/cube:v1.6.6 otherwise declares root and is rejected when runAsNonRoot is enabled.

Validation:

  • helm lint charts/formbricks --set cube.enabled=true --set secret.enabled=false --set externalSecret.enabled=true --set externalSecret.files.app-secrets.dataFrom.key=stage/formbricks
  • helm template formbricks charts/formbricks --set cube.enabled=true --set secret.enabled=false --set externalSecret.enabled=true --set externalSecret.files.app-secrets.dataFrom.key=stage/formbricks
  • git diff --check

Live staging verification:

  • formbricks-stage is Synced/Healthy on formbricks/formbricks revision 2c22b00 and gitops revision 4966c8e.
  • formbricks, formbricks-cube, formbricks-hub, formbricks-hub-worker, and formbricks-hub-embeddings are all ready.
  • Cube /readyz returns {"health":"HEALTH"}.

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented May 7, 2026

Review Change Stack
No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 40e9ef66-5e18-47f1-b34e-68d162a37683

📥 Commits

Reviewing files that changed from the base of the PR and between 2c22b00 and fd34091.

📒 Files selected for processing (3)
  • charts/formbricks/templates/hub-deployment.yaml
  • charts/formbricks/templates/hub-worker-deployment.yaml
  • charts/formbricks/values.yaml

Walkthrough

This pull request hardens the Kubernetes security posture of the Formbricks Helm chart by explicitly setting runAsUser: 1000 across multiple deployment containers and init containers. The Hub deployment (hub-deployment.yaml), Hub worker deployment (hub-worker-deployment.yaml), and Cube.js configuration in values.yaml are updated to enforce non-root user execution. Additionally, the Hub container image is upgraded from version 0.2.0 to 0.3.0 with an updated SHA256 digest for immutable versioning.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name Status Explanation Resolution
Description check ❓ Inconclusive The description provides a clear summary of changes and detailed validation steps, but the required 'How should this be tested?' section from the template is missing. Add a 'How should this be tested?' section with testing instructions and update the checklist to reflect items that were actually completed during development.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly describes the main change: updating Hub runtime defaults for v5 staging, which matches the primary objectives of bumping the Hub image, adding runAsUser settings, and updating security contexts.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented May 7, 2026

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@mattinannt mattinannt merged commit 550bfc6 into epic/v5 May 7, 2026
13 checks passed
@mattinannt mattinannt deleted the fix/v5-hub-cube-runtime-staging branch May 7, 2026 17:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mattinannt mattinannt mattinannt approved these changes

@pandeymangg pandeymangg Awaiting requested review from pandeymangg

@Dhruwang Dhruwang Awaiting requested review from Dhruwang

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@BhagyaAmarasinghe @mattinannt