OLS-3350: Remove console plugin deployment from agentic-operator - #249
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@blublinsky: This pull request references OLS-3350 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (8)
🔗 Linked repositories identifiedCodeRabbit considers these linked repositories for cross-repo context during reviews:
💤 Files with no reviewable changes (4)
🚧 Files skipped from review as they are similar to previous changes (4)
📝 WalkthroughSummary by CodeRabbit
WalkthroughConsole plugin management is removed from the operator controller and moved into standalone quickstart scripts. ChangesConsole plugin extraction
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://cdn.github.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@hack/quickstart/deploy-console.sh`:
- Around line 179-186: The console plugin activation step in the deploy script
assumes spec.plugins already exists and blindly patches /spec/plugins/-, which
can fail or duplicate entries on reruns. Update the console patch logic in the
activation block to first handle a missing spec.plugins list and only add
PLUGIN_NAME if it is not already present, using the existing step/info flow in
the script. Also remove the unconditional success masking so failures to
activate the plugin are surfaced instead of being reported as deployed.
In `@hack/quickstart/undeploy-console.sh`:
- Around line 20-47: Remove the conditional guards around the teardown in
undeploy-console.sh so cleanup always runs even if the ConsolePlugin or
Deployment is already gone. In the console deregistration block and the workload
cleanup block, keep the oc delete/patch operations best-effort and
unconditional, using the existing PLUGIN_NAME and NAMESPACE variables, so reruns
still remove any leftover console registration and Service, ConfigMap,
ServiceAccount, and Secret resources.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 2d5d6f65-aa30-46bb-880b-208a279bcb12
⛔ Files ignored due to path filters (1)
config/rbac/role.yamlis excluded by!config/rbac/role.yaml
📒 Files selected for processing (8)
cmd/main.gocontroller/console/reconciler.gocontroller/console/reconciler_test.gocontroller/setup.gohack/quickstart/deploy-console.shhack/quickstart/install.shhack/quickstart/undeploy-console.shhack/quickstart/uninstall.sh
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift/lightspeed-agentic-sandbox(manual)
💤 Files with no reviewable changes (4)
- controller/console/reconciler_test.go
- controller/console/reconciler.go
- controller/setup.go
- cmd/main.go
bfdb83d to
ac3a4cf
Compare
vimalk78
left a comment
vimalk78
left a comment
There was a problem hiding this comment.
Review: OLS-3350 (jira mode, round 1) — Score: 82/100
Adherence: 3/6 AC pass, 0 fail, 3 need human review (CSV change not in this repo, runtime + test verification deferred to CI).
The core operator-side removal is clean and complete — controller/console/ deleted, setup.go/main.go wiring removed, RBAC trimmed correctly. The standalone quickstart scripts are a sensible addition.
Must-fix: Missing seccompProfile in deploy-console.sh
File: hack/quickstart/deploy-console.sh — pod securityContext block
The deleted Go code set SeccompProfile: RuntimeDefault on the pod security context. The new shell script only has runAsNonRoot: true, dropping the seccomp profile. This is a security regression — the seccomp profile provides syscall filtering.
Fix — add to the pod securityContext in the YAML heredoc:
securityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault🤖 Generated with Claude Code
ac3a4cf to
f88e0e1
Compare
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: blublinsky The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
/lgtm |
|
@blublinsky: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
Summary
Removes the console plugin lifecycle management from the agentic-operator. The console plugin is now deployed as a standalone workload via dedicated quickstart scripts, decoupling it from the operator's reconciliation loop.
Motivation: The agentic console plugin has its own release cadence and image lifecycle. Embedding its deployment inside the operator created tight coupling — operator upgrades could inadvertently redeploy or disrupt the console, and the operator needed broad RBAC (ConsolePlugin, Deployment, Service, ConfigMap) that it shouldn't own. Extracting it into standalone scripts aligns with the console plugin being independently deployable.
Quickstart changes: The install.sh script no longer passes --agentic-console-image to the operator. Instead, it calls a new deploy-console.sh script as a separate post-install step. A matching undeploy-console.sh handles teardown and is called by uninstall.sh. Both console scripts are independently invocable — users can deploy or remove the console plugin without touching the operator.