Release the resource-data WSI stack to beta (wsi-serving-v5) (#695)

Pins beta blue and green, and the beta tile server, to the de-identified
resource-data WSI release beta-wsi-rd-20261006-1:

- portal: cBioPortal/cbioportal#12378 head b479612a95 (schema 3.6.0)
- frontend: cBioPortal/cbioportal-frontend#5732 head 045105b07, immutable
  Netlify deploy 6ac48117bcbba50008ca68db
- tile server: cBioPortal/cbioportal-tile-server#44 head 75dce4f488
  (wsi_auth_version 3: slide_key plus an encrypted source claim)

The tile server rejects a client-supplied X-WSI-Source, so the ingress hashes
on the bearer capability instead. The release validator and the routing smoke
test now expect wsi-serving-v5 and auth contract 3, and the smoke test checks
that a browser-supplied source is refused.

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: raylim

.github/scripts/smoke_wsi_triage.sh

@@ -10,8 +10,8 @@ ready_payload="$(curl --fail --silent --show-error "${base_url%/}/ready")"
 jq --exit-status \
   '.status == "ok"
    and .auth_required == true
-   and .auth_contract_version == 2
-   and .serving_contract_version == "wsi-serving-v3"' \
+   and .auth_contract_version == 3
+   and .serving_contract_version == "wsi-serving-v5"' \
   <<<"$ready_payload" >/dev/null || {
     echo "unexpected WSI readiness contract: $ready_payload" >&2
     exit 1
@@ -40,10 +40,20 @@ test "$status" = 401 || {
   exit 1
 }
 
+# The capability carries the slide source; a browser-supplied one is refused
+# before authentication.
+status="$(curl --silent --show-error --output /dev/null --write-out '%{http_code}' \
+  --header "X-WSI-Source: $source_url" \
+  "$tile_path")"
+test "$status" = 400 || {
+  echo "expected a client-supplied X-WSI-Source to return 400, got $status" >&2
+  exit 1
+}
+
 curl --silent --show-error --include --request OPTIONS \
   --header "Origin: $origin" \
   --header 'Access-Control-Request-Method: GET' \
-  --header 'Access-Control-Request-Headers: authorization, x-wsi-source' \
+  --header 'Access-Control-Request-Headers: authorization' \
   "$tile_path" \
   | grep -i "^access-control-allow-origin: $origin" >/dev/null || {
     echo "CORS preflight did not allow $origin" >&2
@@ -53,7 +63,6 @@ curl --silent --show-error --include --request OPTIONS \
 if [[ -n "${WSI_BEARER_TOKEN:-}" ]]; then
   status="$(curl --silent --show-error --output /dev/null --write-out '%{http_code}' \
     --header "Authorization: Bearer ${WSI_BEARER_TOKEN}" \
-    --header "X-WSI-Source: $source_url" \
     "$tile_path")"
   test "$status" != 401 || {
     echo "provided WSI_BEARER_TOKEN was rejected" >&2

.github/scripts/validate_wsi_beta_release.py

@@ -95,7 +95,7 @@ def portal_identity(path: Path) -> tuple[str, str, str, str]:
     expected_identity = {
         "--wsi.release-id": release_id,
         "--wsi.backend-git-sha": backend_image_match.group(1),
-        "--wsi.serving-contract-version": "wsi-serving-v3",
+        "--wsi.serving-contract-version": "wsi-serving-v5",
     }
     if any(
         runtime_identity.get(key) != expected
@@ -287,8 +287,8 @@ def assert_docker_digest(repository: str, digest: str) -> None:
 tile_env = env_map(tile_container)
 if tile_env.get("WSI_RELEASE_ID") != blue[0]:
     raise AssertionError("tile-server runtime release identity differs")
-if tile_env.get("WSI_SERVING_CONTRACT_VERSION") != "wsi-serving-v3":
-    raise AssertionError("tile-server does not declare wsi-serving-v3")
+if tile_env.get("WSI_SERVING_CONTRACT_VERSION") != "wsi-serving-v5":
+    raise AssertionError("tile-server does not declare wsi-serving-v5")
 if not re.fullmatch(r"[0-9a-f]{40}", tile_env.get("IMAGE_GIT_SHA", "")):
     raise AssertionError("tile-server does not declare a full immutable git SHA")
 tile_cors_origins = comma_separated_values(tile_env.get("CORS_ORIGINS", ""))

argocd/aws/666628074417/clusters/cbioportal-prod/apps/cbioportal/cbioportal-eks-msk-beta-blue-deployment-service.yaml

@@ -28,8 +28,8 @@ spec:
     metadata:
       annotations:
         admission.datadoghq.com/java-lib.version: v1.24.2
-        wsi.cbioportal.org/release-id: "beta-wsi-v2-20260916-4"
-        wsi.cbioportal.org/frontend-git-sha: "ca327132101fcce80732b53b098083a9e273344b"
+        wsi.cbioportal.org/release-id: "beta-wsi-rd-20261006-1"
+        wsi.cbioportal.org/frontend-git-sha: "045105b073e6f3afcdb2fde5240f8ef45469b0c3"
       labels:
         admission.datadoghq.com/enabled: "true"
         run: eks-msk-beta-blue
@@ -86,10 +86,10 @@ spec:
             - --com.sun.management.jmxremote.local.only=false
             - --java.rmi.server.hostname=localhost
             # /enable remote debug
-            - --frontend.url=https://6aaad47e4dd99b00083d160d--cbioportalfrontend.netlify.app/
-            - --wsi.release-id=beta-wsi-v2-20260916-4
-            - --wsi.backend-git-sha=e56f407b2d31b45a6b1a314c5152be61b4954ae0
-            - --wsi.serving-contract-version=wsi-serving-v3
+            - --frontend.url=https://6ac48117bcbba50008ca68db--cbioportalfrontend.netlify.app/
+            - --wsi.release-id=beta-wsi-rd-20261006-1
+            - --wsi.backend-git-sha=b479612a9532a6581df750b24b5178c504be46ae
+            - --wsi.serving-contract-version=wsi-serving-v5
             - --default_cross_cancer_study_session_id=5c8a7d55e4b046111fee2296
             - --quick_search.enabled=true
             - --default_cross_cancer_study_list=mskimpact
@@ -119,7 +119,7 @@ spec:
             - --dbconnector=dbcp
             - --authenticate=saml_plus_basic
             - --authorization=false
-            - --security.cors.allowed-origins=https://beta.cbioportal.mskcc.org,https://keycloak.cbioportal.mskcc.org,https://6aaad47e4dd99b00083d160d--cbioportalfrontend.netlify.app
+            - --security.cors.allowed-origins=https://beta.cbioportal.mskcc.org,https://keycloak.cbioportal.mskcc.org,https://6ac48117bcbba50008ca68db--cbioportalfrontend.netlify.app
             - --db.user=$(DB_USER)
             - --db.password=$(DB_PASSWORD)
             - --db.suppress_schema_version_mismatch_errors=true
@@ -273,7 +273,7 @@ spec:
                 name: wsi-serving-policy
             - secretRef:
                 name: cbioportal-msk-beta-blue
-          image: cbioportal/cbioportal-dev:e56f407b2d31b45a6b1a314c5152be61b4954ae0-web-shenandoah@sha256:780fa5ec83b26eb5a0634a45a3b0494cc0144645a0683c4b69b210e7e668e9bd
+          image: cbioportal/cbioportal-dev:b479612a9532a6581df750b24b5178c504be46ae-web-shenandoah@sha256:5b7f004c4daacf60f219ad185fc49a6bc762a544fc6dfe29ad0939f85284f569
           imagePullPolicy: Always
           livenessProbe:
             failureThreshold: 20

argocd/aws/666628074417/clusters/cbioportal-prod/apps/cbioportal/cbioportal-eks-msk-beta-green-deployment-service.yaml

@@ -27,8 +27,8 @@ spec:
     metadata:
       annotations:
         admission.datadoghq.com/java-lib.version: v1.24.2
-        wsi.cbioportal.org/release-id: "beta-wsi-v2-20260916-4"
-        wsi.cbioportal.org/frontend-git-sha: "ca327132101fcce80732b53b098083a9e273344b"
+        wsi.cbioportal.org/release-id: "beta-wsi-rd-20261006-1"
+        wsi.cbioportal.org/frontend-git-sha: "045105b073e6f3afcdb2fde5240f8ef45469b0c3"
       labels:
         admission.datadoghq.com/enabled: "true"
         run: eks-msk-beta-green
@@ -85,10 +85,10 @@ spec:
             - --com.sun.management.jmxremote.local.only=false
             - --java.rmi.server.hostname=localhost
             # /enable remote debug
-            - --frontend.url=https://6aaad47e4dd99b00083d160d--cbioportalfrontend.netlify.app/
-            - --wsi.release-id=beta-wsi-v2-20260916-4
-            - --wsi.backend-git-sha=e56f407b2d31b45a6b1a314c5152be61b4954ae0
-            - --wsi.serving-contract-version=wsi-serving-v3
+            - --frontend.url=https://6ac48117bcbba50008ca68db--cbioportalfrontend.netlify.app/
+            - --wsi.release-id=beta-wsi-rd-20261006-1
+            - --wsi.backend-git-sha=b479612a9532a6581df750b24b5178c504be46ae
+            - --wsi.serving-contract-version=wsi-serving-v5
             - --default_cross_cancer_study_session_id=5c8a7d55e4b046111fee2296
             - --quick_search.enabled=true
             - --default_cross_cancer_study_list=mskimpact
@@ -118,7 +118,7 @@ spec:
             - --dbconnector=dbcp
             - --authenticate=saml_plus_basic
             - --authorization=false
-            - --security.cors.allowed-origins=https://beta.cbioportal.mskcc.org,https://keycloak.cbioportal.mskcc.org,https://6aaad47e4dd99b00083d160d--cbioportalfrontend.netlify.app
+            - --security.cors.allowed-origins=https://beta.cbioportal.mskcc.org,https://keycloak.cbioportal.mskcc.org,https://6ac48117bcbba50008ca68db--cbioportalfrontend.netlify.app
             - --db.user=$(DB_USER)
             - --db.password=$(DB_PASSWORD)
             - --db.suppress_schema_version_mismatch_errors=true
@@ -270,7 +270,7 @@ spec:
                 name: wsi-serving-policy
             - secretRef:
                 name: cbioportal-msk-beta-green
-          image: cbioportal/cbioportal-dev:e56f407b2d31b45a6b1a314c5152be61b4954ae0-web-shenandoah@sha256:780fa5ec83b26eb5a0634a45a3b0494cc0144645a0683c4b69b210e7e668e9bd
+          image: cbioportal/cbioportal-dev:b479612a9532a6581df750b24b5178c504be46ae-web-shenandoah@sha256:5b7f004c4daacf60f219ad185fc49a6bc762a544fc6dfe29ad0939f85284f569
           imagePullPolicy: Always
           livenessProbe:
             failureThreshold: 20

argocd/aws/666628074417/clusters/cbioportal-prod/apps/slide-viewer-triage/deployment.yaml

@@ -31,7 +31,7 @@ spec:
       labels:
         app: slide-viewer-triage
       annotations:
-        wsi.cbioportal.org/release-id: "beta-wsi-v2-20260916-4"
+        wsi.cbioportal.org/release-id: "beta-wsi-rd-20261006-1"
         # Restart the pod when the ConfigMap-backed CORS allowlist changes.
         # Force a clean beta block cache after source-region tile failures.
         slide-viewer-cache-revision: "2026-08-31-native-overview-cache-recovery"
@@ -80,7 +80,7 @@ spec:
                 - ALL
           # Keep the channel tag for operator familiarity; the digest is the
           # immutable release identity validated by CI.
-          image: cbioportal/cbioportal-tile-server:main@sha256:0638d904f004bc0cd2f678869ccc7dab8ec4e092c0b30f9872cb1095b4942197
+          image: cbioportal/cbioportal-tile-server:beta-wsi-20261006-75dce4f488@sha256:2d6f3582f691c33ce52e6027dd17622a4113a5c75c9164441b0a84707f7bfbbc
           imagePullPolicy: Always
           resources:
             requests:
@@ -109,13 +109,13 @@ spec:
             - name: MAX_IMAGE_OPERATIONS
               value: "4"
             - name: CORS_ORIGINS
-              value: "https://beta.cbioportal.mskcc.org,https://6aaad47e4dd99b00083d160d--cbioportalfrontend.netlify.app"
+              value: "https://beta.cbioportal.mskcc.org,https://6ac48117bcbba50008ca68db--cbioportalfrontend.netlify.app"
             - name: WSI_RELEASE_ID
-              value: "beta-wsi-v2-20260916-4"
+              value: "beta-wsi-rd-20261006-1"
             - name: IMAGE_GIT_SHA
-              value: "082c3f77ec7eb091bc4a17b96d89cf6d1618d73c"
+              value: "75dce4f488d2cf4bb8616bb135840c78b6a6925a"
             - name: WSI_SERVING_CONTRACT_VERSION
-              value: "wsi-serving-v3"
+              value: "wsi-serving-v5"
             - name: AWS_ACCESS_KEY_ID
               valueFrom:
                 secretKeyRef:

argocd/aws/666628074417/clusters/cbioportal-prod/apps/slide-viewer-triage/ingress.yaml

@@ -16,8 +16,10 @@ metadata:
     # users behind one NAT address. The tile server still bounds expensive
     # image work independently with MAX_IMAGE_OPERATIONS.
     nginx.ingress.kubernetes.io/limit-connections: "300"
-    # Keep a slide's cold-open cache and SlideCache affinity on one pod.
-    nginx.ingress.kubernetes.io/upstream-hash-by: "$http_x_wsi_source"
+    # Keep a slide's cold-open cache and SlideCache affinity on one pod. The
+    # bearer capability is the only per-slide request input (it rotates with
+    # its TTL, so affinity holds for one token lifetime).
+    nginx.ingress.kubernetes.io/upstream-hash-by: "$http_authorization"
     # The browser uses a same-origin /wsi route while the FastAPI application
     # owns root-level /tiles, /thumbnails, /health, and /ready paths.
     nginx.ingress.kubernetes.io/use-regex: "true"