[release/0.5] AAP-85491: sanitize NO_PROXY IPv6 CIDR entries for httpx compatibility

[SiddharthRajaraman]

Description

On OpenShift IPv6 single-stack clusters with a cluster-wide Proxy, lightspeed-chatbot-api CrashLoops at startup when NO_PROXY contains IPv6 CIDR entries (for example fd00:1234:5678::/64). httpx mis-parses those values and raises httpx.InvalidURL: Invalid port: '1234:5678::' during client initialization (encode/httpx#3221). The upstream httpx fix exists in encode/httpx#3741 but has not been released.

This change sanitizes NO_PROXY / no_proxy at Lightspeed Core Stack startup by removing IPv6 CIDR entries that httpx cannot parse. Supported entries such as hostnames, domains, IPv4 addresses, and IPv4 CIDRs are preserved. Removed entries are logged at warning level.

Type of change

• Refactor
• New feature
• Bug fix
• CVE fix
• Optimization
• Documentation Update
• Configuration Update
• Bump-up service version
• Bump-up dependent library [pyproject.toml + uv.lock]
• Bump-up dependent library [requirements.*.txt for Konflux]
• Bump-up library or tool used for development (does not change the final image)
• CI configuration change
• Konflux configuration change
• Unit tests improvement
• Integration tests improvement
• End to end tests improvement
• Benchmarks improvement

Tools used to create PR

Identify any AI code assistants used in this PR (for transparency and review context)

• Assisted-by: Cursor
• Generated by: N/A

Related Tickets & Documents

• Related Issue #
• Closes https://redhat.atlassian.net/browse/AAP-85491

Checklist before requesting a review

• I have performed a self-review of my code.
• PR has passed all pre-merge test jobs.
• If it is a core feature, I have added thorough tests.

Testing

• Please provide detailed steps to perform tests related to this code change.

• How were the fix/results from this change verified? Please provide relevant screenshots or results.

• Unit tests:

  uv run pytest tests/unit/utils/test_proxy_env.py -q

• Lint (changed files):

  uv run black --check --line-length 88 \
    src/utils/proxy_env.py \
    src/lightspeed_stack.py \
    tests/unit/utils/test_proxy_env.py
  uv run ruff check \
    src/utils/proxy_env.py \
    src/lightspeed_stack.py \
    tests/unit/utils/test_proxy_env.py

Verification:

• test_sanitize_removes_only_ipv6_cidr_entries confirms OpenShift-style NO_PROXY values are sanitized while preserving localhost, IPv4 CIDRs, and internal DNS suffixes.
• test_httpx_client_initializes_after_sanitize confirms httpx no longer crashes once unsupported IPv6 CIDR entries are removed.

Made with Cursor

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 25fe9686-453a-4ef6-97a2-d00c72dedc4a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}