Skip to content

OLS-1894 Add ROSA-aware OKP retrieval spec #1790

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
blublinsky wants to merge 1 commit into
base: main
Choose a base branch
from
+12 −0
Open

OLS-1894 Add ROSA-aware OKP retrieval spec #1790

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .ai/spec/how/config-generation.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -209,6 +209,7 @@ These schemas are created by the bootstrap script.
| TLS certs | Service-ca operator or user-provided secret | Path: `/etc/certs/lightspeed-tls/` |
| BYOK RAG indexes | CR `spec.ols.rag[]` | File paths in config YAML (BYOK only) |
| RHOKP image | `--rhokp-image` flag | Image for RHOKP sidecar container |
| ROSA product | Console brand + Infrastructure topology | `OLS_ROSA_PRODUCT` env var on app-server (not in config YAML). [PLANNED: OLS-1894] |
| MCP servers | CR `spec.mcpServers[]` + `spec.ols.introspectionEnabled` | Feature gated by `MCPServer` gate |
| Tool filtering | CR `spec.ols.toolFilteringConfig` | Feature gated by `ToolFiltering` gate; requires MCP servers |
| Proxy config | CR `spec.ols.proxyConfig` | Proxy URL + optional CA cert configmap |
Expand Down
2 changes: 2 additions & 0 deletions .ai/spec/how/deployment-generation.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,8 @@ GenerateOLSDeployment(r, cr)
15. Assemble Deployment:
- Container: "lightspeed-service-api", image: r.GetAppServerImage(), port: 8443
- Env: OLS_CONFIG_FILE path + proxy vars (HTTP_PROXY, HTTPS_PROXY, NO_PROXY)
- Env: OCP_CLUSTER_VERSION (`<major>.<minor>`) when `!byokRAGOnly`
- Env: OLS_ROSA_PRODUCT (ROSA OKP product identifier) when `!byokRAGOnly` AND cluster brand is `ROSA`. Value: `red_hat_openshift_service_on_aws` (HCP) or `red_hat_openshift_service_on_aws_classic_architecture` (Classic), determined from Console brand + Infrastructure controlPlaneTopology. [PLANNED: OLS-1894]
- Probes: HTTPS GET on /readiness, /liveness (initial: 30s, period: 30s, timeout: 30s, failure: 15)
- Default resources: 500m CPU request, 1Gi memory request (no limits)
16. Apply pod-level config (replicas, nodeSelector, tolerations)
Expand Down
9 changes: 9 additions & 0 deletions .ai/spec/what/app-server.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,15 @@ The App Server is the backend deployment for OpenShift Lightspeed. It runs the l
12. If `spec.ols.querySystemPrompt` is set, the custom prompt is written as a second key in the config ConfigMap and referenced by file path in the config.
13. BYOK reference content indexes from `spec.ols.rag` are configured when present. OCP documentation is served by OKP via the RHOKP sidecar, not via FAISS indexes.
14. The operator always generates a `solr_hybrid` config section in `olsconfig.yaml` pointing to `http://localhost:8080` with default hybrid retrieval tuning parameters, unless `byokRAGOnly` is true.
15a. Unless `byokRAGOnly` is true, the app-server container receives `OCP_CLUSTER_VERSION` (`<major>.<minor>` from the operator's cluster-version lookup) for Solr `chunk_filter_query` resolution in lightspeed-service.

### ROSA-Aware OKP Retrieval [PLANNED: OLS-1894]
15b. Unless `byokRAGOnly` is true, the operator detects whether the cluster is ROSA and, if so, which variant (Classic vs HCP). Detection uses two standard OpenShift API resources, following the same pattern as OCP version detection — determined once and passed to the service as an environment variable:
- **ROSA detection:** Read `console.operator.openshift.io/v1` Console `cluster` resource, field `.spec.customization.brand`. Value `ROSA` indicates a ROSA cluster (reliable on OCP 4.16+).
- **Variant detection:** Read `infrastructure.config.openshift.io/v1` Infrastructure `cluster` resource, field `.status.controlPlaneTopology`. `External` = HCP, `HighlyAvailable` = Classic.
- When ROSA is detected, the operator sets `OLS_ROSA_PRODUCT` on the app-server container: `red_hat_openshift_service_on_aws` for HCP, `red_hat_openshift_service_on_aws_classic_architecture` for Classic.
- On non-ROSA clusters the env var is absent and the service uses OCP-only retrieval.
- RBAC: requires `get` on `consoles` in the `operator.openshift.io` API group (Infrastructure is already covered by existing cluster-version permissions).
Comment on lines +26 to +32

@coderabbitai coderabbitai Bot Jul 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Repo files of interest:\n'
git ls-files '.ai/spec/what/app-server.md' | sed 's/^/ - /'
printf '\nSearch for infrastructure permission and ROSA-related references:\n'
rg -n --hidden --glob '!.git' -e 'infrastructure\.config\.openshift\.io' -e 'infrastructures/cluster' -e 'OLS_ROSA_PRODUCT' -e 'customization\.brand' -e 'controlPlaneTopology' .

Repository: openshift/lightspeed-operator

Length of output: 1519

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'RBAC and deployment files mentioning app-server / permissions:\n'
git ls-files | rg '(^|/)(rbac|role|clusterrole|deployment|app-server|serviceaccount|manifest|yaml|yml)' || true

printf '\nSearch for relevant permission rules and app-server references:\n'
rg -n --hidden --glob '!.git' \
  -e 'clusterversions' \
  -e 'infrastructures' \
  -e 'operator\.openshift\.io' \
  -e 'console\.operator\.openshift\.io' \
  -e 'app-server' \
  -e 'OLS_ROSA_PRODUCT' \
  -e 'get:\s*$' \
  .

Repository: openshift/lightspeed-operator

Length of output: 11747

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'appserver RBAC generation:\n'
ast-grep outline internal/controller/appserver/assets.go --view expanded || true
printf '\nRelevant slice of internal/controller/appserver/assets.go:\n'
sed -n '1,220p' internal/controller/appserver/assets.go

printf '\nRendered role manifest slice:\n'
sed -n '1,240p' config/rbac/role.yaml

printf '\nCSV permissions slice:\n'
sed -n '700,860p' bundle/manifests/lightspeed-operator.clusterserviceversion.yaml

Repository: openshift/lightspeed-operator

Length of output: 17524

Add get on config.openshift.io/infrastructures to the lookup role. The ROSA variant check reads Infrastructure/cluster, but the current RBAC only grants clusterversions and secret access, so that lookup will be forbidden on ROSA clusters. Mirror the change in the generated manifest/CSV.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.ai/spec/what/app-server.md around lines 26 - 32, Add the missing RBAC
permission for the ROSA variant lookup: the lookup role currently covers
`clusterversions` and secret access, but `Infrastructure/cluster` requires `get`
on `config.openshift.io/infrastructures`. Update the role used by the app-server
lookup path so the `controlPlaneTopology` read in the ROSA detection flow is
allowed, and mirror the same permission in the generated manifest/CSV. Ensure
the change stays aligned with the `OLS_ROSA_PRODUCT` detection logic that
depends on this lookup.


### MCP Server Integration
15. When `spec.ols.introspectionEnabled` is true, an "openshift" MCP server entry is added to the config pointing to localhost on the sidecar port.
Expand Down