[arlenvasconcelos]

What this does

The radar-hub chart can now set up AI investigations on any model behind an OpenAI-compatible API (GPT on OpenAI or Azure, Kimi, DeepSeek or gpt-oss on Bedrock, Gemini, a company gateway, vLLM, Ollama), and can point the Claude anthropic provider at a company gateway. Both need radar-hub 1.15.0.

Installs that use anthropic, bedrock or vertex render exactly as before.

New values

• hub.agent.provider: openai-compatible, with a new hub.agent.openaiCompatible block:
  • baseUrl and model, both required;
  • api: chat (default) or responses;
  • authHeader: bearer (default) or api-key for Azure;
  • reasoningEffort: empty, low, medium or high;
  • maxOutputTokens: empty (32,000) or a lower limit, for models such as GPT-4o (16,384) that refuse longer replies.
• hub.agent.credentials.apiKey may be empty under this provider, for a keyless model server. An existingSecret carries HUB_AGENT_OPENAI_COMPAT_API_KEY, empty for keyless.
• hub.agent.anthropic.baseUrl: a Claude gateway in place of api.anthropic.com. Refused under other providers.
• image.agentSandbox.tag now defaults to image.hub.tag, then appVersion, so pinning the hub also pins a matching sandbox. Before, a pinned hub could run with a sandbox of a different version.
• The extraEgress docs now show a rule for a model endpoint off port 443, such as an in-cluster Ollama.

Guards

• Render fails when openai-compatible or anthropic.baseUrl is set with a hub image tag below 1.15.0. Render also fails when the sandbox image resolves below 1.15.0 under these settings. A pre-release counts only when it is the chart's own appVersion, the same rule as enrollment.
• The schema checks the enums, the base URL shape (no query, fragment or credentials) and the reply length (a positive integer), and rejects unknown keys.

Code pointers

• charts/radar-hub/values.yaml, values.schema.json
• Hub env: templates/deployment-hub.yaml; Secret key name and sandbox tag: templates/_helpers.tpl (radar-hub.agentKeyName, radar-hub.agentSandboxImage)
• Guards: templates/secret.yaml
• Tests: .github/ci/agent-test.sh (render assertions, run with image.hub.tag=1.15.0), charts/radar-hub/tests/render-matrix.sh (unknown keys)

Tests

• .github/ci/agent-test.sh: 104 assertions pass. An upgrade with --reuse-values from the current chart renders on every provider. They cover the new provider's env, keyless and existingSecret setups, every refusal (including an old sandbox), the sandbox following the hub tag, the gateway, and the Claude providers getting none of the new settings. The tests that expect a refusal pin their hub tag, so they keep passing after the release job raises appVersion; checked with appVersion set to 1.15.0.
• render-matrix.sh: the new unknown-key checks pass.
• render-matrix.sh needs PyYAML.
• helm lint passes with every ci/ values file.
• Renders for anthropic, bedrock, vertex and the default test values are byte-identical to main, apart from the chart-version label.
• No new ci/*-values.yaml: ct install installs each one, and a hub 1.15.0 image doesn't exist yet.

Release

Hub side: skyhook-dev/radar-hub#387 (private). Tested end to end on a self-hosted hub with this chart on the bedrock, anthropic and openai-compatible providers (vertex not run).

Chart version 1.15.0-rc.1, appVersion stays 1.14.1. Merge this after radar-hub 1.15.0 is released; the release job sets appVersion 1.15.0. Until then the new provider refuses to render with the default hub tag, which is intended.

🤖 Generated with Claude Code

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Support OpenAI-compatible investigations and Anthropic gateways

✨ Enhancement ⚙️ Configuration changes 🧪 Tests 📝 Documentation 🕐 20-40 Minutes

AI Description

• Add OpenAI-compatible models, keyless endpoints, optional prices, and Anthropic gateway
 configuration.
• Validate provider settings and require Hub 1.15.0 for the new capabilities.
• Document deployment options and add render tests while preserving existing provider output.

Diagram

graph TD
  Values["Agent values"] --> Schema["Values schema"] --> Guards["Render guards"] --> Deployment["Hub deployment"] --> Hub["Hub agent"] --> Sandbox["Sandbox jobs"]
  Guards --> Secret["Agent Secret"] --> Sandbox

Loading

High-Level Assessment

The chart's existing provider-specific environment variables, credential Secret, and sandbox-job path are the appropriate integration points. Reusing them preserves credential isolation and avoids a parallel deployment path; the version guard prevents configurations that the currently published Hub cannot consume.

Files changed (9) +299 / -14

Enhancement (3) +68 / -3

_helpers.tplSelect the OpenAI-compatible credential key +2/-0

Select the OpenAI-compatible credential key

• Maps the new provider to HUB_AGENT_OPENAI_COMPAT_API_KEY in the existing provider-specific Secret-key helper.

charts/radar-hub/templates/_helpers.tpl

deployment-hub.yamlRender provider-specific Hub agent configuration +29/-0

Render provider-specific Hub agent configuration

• Emits the OpenAI-compatible endpoint, model, API mode, authentication header, optional reasoning effort, and supplied prices. Emits the Anthropic gateway URL only when configured under the Anthropic provider.

charts/radar-hub/templates/deployment-hub.yaml

secret.yamlGuard new provider settings at render time +37/-3

Guard new provider settings at render time

• Requires Hub 1.15.0 for the new provider or gateway, rejects provider-inapplicable settings and incomplete prices, and requires an endpoint and model. Allows an empty API key only for the OpenAI-compatible provider.

charts/radar-hub/templates/secret.yaml

Tests (2) +74 / -0

agent-test.shExercise compatible-provider and gateway rendering +72/-0

Exercise compatible-provider and gateway rendering

• Adds render assertions for default and optional provider settings, keyless and existing-Secret credentials, pricing, and the Anthropic gateway. Checks invalid settings and confirms the existing Claude providers receive none of the new environment variables.

.github/ci/agent-test.sh

render-matrix.shReject misspelled new value keys +2/-0

Reject misspelled new value keys

• Adds schema checks confirming unknown OpenAI-compatible model and pricing keys fail rendering.

charts/radar-hub/tests/render-matrix.sh

Documentation (1) +66 / -7

README.mdDocument new model and gateway options +66/-7

Document new model and gateway options

• Explains the Hub 1.15.0 prerequisite, OpenAI-compatible setup and pricing, Anthropic gateways, and required Secret keys. Includes an extra-egress example for model endpoints on nonstandard ports.

charts/radar-hub/README.md

Other (3) +91 / -4

Chart.yamlAdvance chart version to 1.15.0-rc.1 +1/-1

Advance chart version to 1.15.0-rc.1

• Sets the chart's prerelease version while leaving appVersion at 1.14.1, so the new capabilities require an explicit compatible Hub image until release.

charts/radar-hub/Chart.yaml

values.schema.jsonValidate gateway, model, and pricing values +33/-1

Validate gateway, model, and pricing values

• Adds the provider and schemas for its endpoint, model, API mode, authentication header, reasoning effort, and prices. Constrains URL and price formats and rejects unknown keys.

charts/radar-hub/values.schema.json

values.yamlExpose compatible-model and gateway settings +57/-2

Expose compatible-model and gateway settings

• Adds defaults and guidance for the OpenAI-compatible provider, optional token prices, and the Anthropic gateway URL. Clarifies keyless credentials and shows an extra-egress rule for an in-cluster model server.

charts/radar-hub/values.yaml

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Old custom-tagged hubs accept new settings 🐞 Bug ≡ Correctness

Description

The new version guard skips semverCompare whenever image.hub.tag does not match its version
regex. If an older Hub image has a custom tag such as main-abc123, Helm renders either new feature
without checking its required Hub version, allowing the unsupported image to start with that
configuration.

Code

charts/radar-hub/templates/secret.yaml[299]

+{{- if and (regexMatch "^v?[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9A-Za-z.-]+)?$" $hubTag) (not (semverCompare $ocMinimum $hubTag)) -}}

Evidence

The new guard runs for the provider or gateway, but its and condition makes a nonmatching tag
bypass the version comparison. The image helper then uses the configured tag directly; the existing
enrollment tests also demonstrate that main-abc123 is an accepted non-semver tag.

charts/radar-hub/templates/secret.yaml[292-301]
charts/radar-hub/templates/_helpers.tpl[65-77]
charts/radar-hub/tests/render-matrix.sh[245-251]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The new feature guard silently skips version validation for custom Hub image tags, so an older custom-tagged image can be deployed with settings that require Hub 1.15.0.
## Fix Focus Areas
- charts/radar-hub/templates/secret.yaml[295-301]
- .github/ci/agent-test.sh[183-200]
## Recommended Fix
Require a verifiable image version when either new feature is enabled, or add an explicit operator acknowledgment for custom tags rather than treating an unparseable tag as passing. Test both an older custom-tagged image configuration and the supported custom-image path.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Agent test breaks once appVersion becomes 1.15.0 ✓ Resolved

Description

The assertion reject 'hub.agent.anthropic.baseUrl needs radar-hub 1.15.0 or later' renders without
image.hub.tag, so it only passes while the hub tag falls back to .Chart.AppVersion 1.14.1. The
PR says the release job sets appVersion to 1.15.0 before this merges; after that, the render
succeeds, reject exits with 'expected rejection', and the whole agent CI script fails on every
later chart change.

---

Tip of the day

💡 Did you know, you can hide the parts of a finding you never read, like the evidence or the agent prompt

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.