Skip to content

OLS-3185: spec: create Service for ocp-mcp sidecar #1777

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
onmete wants to merge 1 commit into
base: main
Choose a base branch
from
+3 −0
Open

OLS-3185: spec: create Service for ocp-mcp sidecar #1777

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .ai/spec/what/app-server.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,9 @@ The App Server is the backend deployment for OpenShift Lightspeed. It runs the l
16. When the MCPServer feature gate is enabled, user-defined servers from `spec.mcpServers` are added to the config.
17. MCP header values of type "secret" are mounted as files from the referenced secret. Types "kubernetes" and "client" use placeholder strings that the service resolves at runtime.

### MCP Server Service
18a. When `spec.ols.introspectionEnabled` is true, the operator MUST create a `Service` named `openshift-mcp-server` in the operator namespace that selects the app server pods and targets port 8080 (the MCP sidecar port). This Service exposes the ocp-mcp sidecar to other pods in the cluster (e.g., agentic sandbox pods). When `introspectionEnabled` is false, the Service MUST be deleted if it exists.

Comment on lines +30 to +32

@coderabbitai coderabbitai Bot Jul 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | 🏗️ Heavy lift

Clarify the port layout before standardizing this Service.

This rule conflicts with the existing spec: the RHOKP sidecar is documented as always serving on localhost:8080, and the MCP sidecar is also documented on port 8080. Those containers share a pod network, so this Service can’t unambiguously target the MCP sidecar as written.

Please update the spec to use a distinct port/port name or explain how the two 8080 listeners coexist.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.ai/spec/what/app-server.md around lines 30 - 32, The MCP Server Service
rule is ambiguous because both the RHOKP sidecar and the MCP sidecar are
described as using 8080, so the Service target in the app-server spec needs to
be clarified. Update the spec in the MCP Server Service section to assign a
distinct port or port name for the ocp-mcp sidecar, or explicitly document how
the `openshift-mcp-server` Service should select the correct listener; keep the
language aligned with `spec.ols.introspectionEnabled` and the existing sidecar
port definitions.

### Service and Networking
18. The service exposes HTTPS on the configured port.
19. The network policy allows ingress from: Prometheus (openshift-monitoring), OpenShift Console (openshift-console), and ingress controllers.
Expand Down