Skip to content

OLS-3726: Replace RHOKP sidecar with standalone HTTPS Deployment #1896

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 1 commit into from
Jul 31, 2026
+1,416 −633
Merged

OLS-3726: Replace RHOKP sidecar with standalone HTTPS Deployment #1896

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 8 additions & 6 deletions .ai/spec/how/project-structure.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,9 +114,10 @@ External secret/configmap changes
-> If changed: SecretWatcherFilter() / ConfigMapWatcherFilter()
-> Match against SystemResources list (by name+namespace)
-> OR match against WatcherAnnotationKey annotation
-> Resolve "ACTIVE_BACKEND" to appserver deployment name
-> Call RestartAppServer() / RestartPostgres() / RestartConsoleUI() / RestartAgenticConsoleUI() / RestartAlertsAdapter()
-> Call restart function for each affected deployment (appserver, OTEL, MCP, RHOKP, etc.)
-> Set force-reload annotation with current timestamp
Comment thread
coderabbitai[bot] marked this conversation as resolved.
-> If applicable, call TouchAgenticConfiguration() to update the handoff ConfigMap timestamp
-> If applicable, call TouchAgenticConfiguration() to update the handoff ConfigMap timestamp
```

## Key Abstractions
Expand All @@ -127,16 +128,17 @@ Default images are stored in a `defaultImages` map in `cmd/main.go` keyed by log
### WatcherConfig
Declarative configuration for external resource watching. Built in `cmd/main.go` and passed via `OLSConfigReconcilerOptions.WatcherConfig`. Contains:
- `Secrets.SystemResources`: Fixed list of system secrets with affected deployment names:
- Telemetry pull secret → app server (`ACTIVE_BACKEND`)
- Telemetry pull secret → app server (`lightspeed-app-server`)
- `lightspeed-console-plugin-cert` → chat console deployment
- `lightspeed-agentic-console-plugin-cert` → agentic console deployment (`AgenticConsoleUIDeploymentName`)
- Postgres TLS cert → postgres + app server
- `lightspeed-otel-collector-cert` → OTEL Collector + app server (`ACTIVE_BACKEND`); `RestartAppServer` refreshes client CA Secrets and touches the handoff ConfigMap
- `openshift-mcp-server-tls` → OpenShift MCP server + app server (`ACTIVE_BACKEND`); static SystemResources entry, gated by `OpenShiftMCPServerTLSWatchEnabled` when `spec.ols.introspectionEnabled` is true; same app-server refresh+touch path
- `lightspeed-otel-collector-cert` → OTEL Collector + app server + agentic ConfigMap; `RestartAppServer` refreshes client CA Secrets and touches the handoff ConfigMap
- `openshift-mcp-server-tls` → OpenShift MCP server + app server + agentic ConfigMap; static SystemResources entry, gated by `OpenShiftMCPServerTLSWatchEnabled` when `spec.ols.introspectionEnabled` is true; same app-server refresh+touch path
- `lightspeed-rhokp-tls` → RHOKP + app server + agentic ConfigMap; gated by `RHOKPTLSWatchEnabled` when `!byokRAGOnly`; same refresh+touch path
- `ConfigMaps.SystemResources`: Fixed list of system configmaps (kube-root-ca.crt, service-ca bundle)
- `AnnotatedSecretMapping`: Dynamic map populated from CR spec at runtime (maps secret name to deployment names)
- `AnnotatedConfigMapMapping`: Dynamic map populated from CR spec at runtime (maps configmap name to deployment names)
The special deployment name `"ACTIVE_BACKEND"` resolves to the AppServer deployment name (`lightspeed-app-server`).
All deployment names in `AffectedDeployments` are explicit (e.g. `lightspeed-app-server`, `lightspeed-rhokp`).

When the service-ca operator rotates or populates a watched TLS secret, `SecretUpdateHandler` restarts the mapped deployment via `RestartConsoleUI()` or `RestartAgenticConsoleUI()` (registered in `watchers/watchers.go`).

Expand Down
6 changes: 5 additions & 1 deletion .ai/spec/how/reconciliation.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,9 @@ Reconcile(ctx, req)
| | mount at /etc/alerts-adapter when CM exists)
| |-- otelcollector.ReconcileOtelCollectorResources()
| |-- ocpmcp.ReconcileResources()
| | (when introspectionEnabled; else ocpmcp.Remove())
| |-- rhokp.ReconcileResources()

@coderabbitai coderabbitai Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Name the app-server explicitly.

Replace “active backend” with app-server/lightspeed-app-server; the cutover removes the ACTIVE_BACKEND pseudo-target and the controller invokes appserver.ReconcileAppServerDeployment() directly.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.ai/spec/how/reconciliation.md at line 31, Update the reconciliation
documentation entry around rhokp.ReconcileResources to name the target
explicitly as app-server or lightspeed-app-server instead of “active backend.”
Remove references to the ACTIVE_BACKEND pseudo-target and reflect that the
controller directly invokes appserver.ReconcileAppServerDeployment().

| | (when !byokRAGOnly; else rhokp.Remove())
| |-- appserver.ReconcileAppServerResources()
| +-- alertsadapter.ReconcileAlertsAdapterResources()
| (opt-in via configMapRef; RemoveAlertsAdapter() when disabled; no ConfigMap validation;
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Expand All @@ -37,6 +40,7 @@ Reconcile(ctx, req)
|-- postgres.ReconcilePostgresDeployment()
|-- otelcollector.ReconcileOtelCollectorDeployment() # OtelCollectorReady
|-- ocpmcp.ReconcileDeployment() # MCPServerReady / NotConfigured
|-- rhokp.ReconcileDeployment() # RHOKPReady / NotConfigured
|-- appserver.ReconcileAppServerDeployment()
|-- alertsadapter.ReconcileAlertsAdapterDeployment() # when configMapRef set
| (each deployment step above: checkDeploymentStatus → conditions)
Expand All @@ -47,7 +51,7 @@ Reconcile(ctx, req)
## Key Abstractions

### Reconciler Interface
The `reconciler.Reconciler` interface breaks the circular dependency between the main controller and component packages. Component packages (appserver, postgres, otelcollector, ocpmcp, agenticintegration, console, agenticconsole, alertsadapter) receive this interface instead of importing the controller package directly. It embeds `client.Client` and adds getter methods for images, namespace, and OpenShift version.
The `reconciler.Reconciler` interface breaks the circular dependency between the main controller and component packages. Component packages (appserver, postgres, otelcollector, ocpmcp, rhokp, agenticintegration, console, agenticconsole, alertsadapter) receive this interface instead of importing the controller package directly. It embeds `client.Client` and adds getter methods for images, namespace, and OpenShift version.

### ReconcileSteps Pattern
Both phases use a slice of `ReconcileSteps` structs, each containing a Name, reconcile function, and (for Phase 2) a ConditionType and Deployment name. Phase 1 iterates with continue-on-error; Phase 2 iterates but tracks all conditions and diagnostics.
Expand Down
11 changes: 7 additions & 4 deletions .ai/spec/what/agentic-sandbox-profile.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,10 +47,13 @@ See also: `templog.md` (collector), `ocpmcp.md` (MCP Service/CA), `crd-api.md` (
18. App-server mounts these Secrets at `/etc/certs/otel-collector-ca/` and `/etc/certs/openshift-mcp-server-ca/` (projected filename `service-ca.crt` for path compatibility). There is no dedicated MCP inject-cabundle ConfigMap.

### Refresh / rotation
19. Serving-cert watchers restart the server Deployment then the app-server (`ACTIVE_BACKEND`):
- OTEL: `lightspeed-otel-collector-cert` → `RestartOtelCollector` → `RestartAppServer`
- MCP: `openshift-mcp-server-tls` → MCP restart → `RestartAppServer`
20. `RestartAppServer` order: (1) refresh client CA Secrets from `openshift-service-ca.crt` (`RefreshClientCASecrets`), (2) bump annotation `ols.openshift.io/client-ca-reload` on the handoff ConfigMap (`TouchAgenticConfiguration`), (3) **re-Get** the app-server Deployment (current resourceVersion), apply any caller Spec mutations, bump `force-reload`, Update. **Fail-closed:** if step (1) fails (source CA ConfigMap missing/empty), steps (2)–(3) are skipped so pods are not rolled with stale CA material. Retry happens on a later OLSConfig reconcile or watcher event once the source CA is ready.
19. Serving-cert watchers restart the server Deployment then the app-server (`lightspeed-app-server`) and touch `lightspeed-agentic-configuration`:
- OTEL: `lightspeed-otel-collector-cert` → `RestartOtelCollector` + `RestartAppServer` + `TouchAgenticConfiguration`
- MCP: `openshift-mcp-server-tls` → MCP restart + `RestartAppServer` + `TouchAgenticConfiguration`
- RHOKP: `lightspeed-rhokp-tls` → RHOKP restart + `RestartAppServer` + `TouchAgenticConfiguration`
All three targets are declared in `AffectedDeployments` for each secret; the watcher invokes them independently.
20. `RestartAppServer` order: (1) refresh client CA Secrets from `openshift-service-ca.crt` (`RefreshClientCASecrets`), (2) **re-Get** the app-server Deployment (current resourceVersion), apply any caller Spec mutations, bump `force-reload`, Update. **Fail-closed:** if step (1) fails (source CA ConfigMap missing/empty), the app-server roll is skipped so pods are not rolled with stale CA material. Retry happens on a later OLSConfig reconcile or watcher event once the source CA is ready.
21. `TouchAgenticConfiguration` bumps `ols.openshift.io/client-ca-reload` annotation on the handoff ConfigMap so agentic-operator detects the change. It is a separate watcher callback (not part of `RestartAppServer`).
21. `RestartOtelCollector` only rolls the collector; it does **not** refresh agentic artifacts (that work is on the app-server restart path).
22. Agenticintegration ConfigMap reconcile preserves the cert-reload annotation when updating Data/Labels.
23. Content equality skips Secret/ConfigMap updates when Data, Labels, and OwnerReferences are unchanged.
Expand Down
24 changes: 12 additions & 12 deletions .ai/spec/what/app-server.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,11 @@ The App Server is the backend deployment for OpenShift Lightspeed. It runs the l
## Behavioral Rules

### Deployment Composition
1. The deployment contains a primary API container and up to two sidecar containers (data collector, RHOKP).
1. The deployment contains a primary API container and an optional sidecar container (data collector).
2. The primary container (lightspeed-service-api) runs the OLS service, listening on HTTPS.
3. The data collector sidecar (lightspeed-to-dataverse-exporter) is added when data collection is enabled AND the telemetry pull secret exists in the openshift-config namespace with a cloud.openshift.com auth entry.
4. The OpenShift MCP server runs as a standalone HTTPS Deployment/Service (`ocpmcp` package) when `spec.ols.introspectionEnabled` is true. The app-server connects via `https://openshift-mcp-server.<ns>.svc:8443/mcp` and trusts client CA Secret `lightspeed-agentic-mcp-ca` (cluster service-ca PEM). See `ocpmcp.md`.
5. [PLANNED: OLS-3697] OKP (Offline Knowledge Portal) / Solr hybrid RAG is operator-managed (no CR toggle besides `byokRAGOnly`). When OKP is enabled, the RHOKP standalone Deployment serves Solr via HTTPS at `https://lightspeed-rhokp.<ns>.svc:8443`. The app-server connects as a client, trusting the RHOKP service-ca cert via `extra_ca`. OKP is on by default; set `spec.ols.byokRAGOnly` to true to skip the RHOKP standalone operand, `solr_hybrid` config, and OCP documentation retrieval via Solr. See `rhokp.md`.
5. OKP (Offline Knowledge Portal) / Solr hybrid RAG is operator-managed (no CR toggle besides `byokRAGOnly`). When OKP is enabled, the RHOKP standalone Deployment serves Solr via HTTPS at `https://lightspeed-rhokp.<ns>.svc:8443`. The app-server connects as a client, trusting client CA Secret `lightspeed-agentic-rhokp-ca` (cluster service-ca PEM) via `extra_ca`. OKP is on by default; set `spec.ols.byokRAGOnly` to true to skip the RHOKP standalone operand, `solr_hybrid` config, and OCP documentation retrieval via Solr. See `rhokp.md`.
Comment thread
coderabbitai[bot] marked this conversation as resolved.
6. A PostgreSQL wait init container always runs before the main containers to ensure database readiness.
7. When `spec.ols.rag` is configured, additional init containers copy BYOK RAG data from container images into a shared volume.

Expand All @@ -20,7 +20,7 @@ The App Server is the backend deployment for OpenShift Lightspeed. It runs the l
11. PostgreSQL connection settings are hardcoded to point to the operator-managed PostgreSQL service within the same namespace.
12. If `spec.ols.querySystemPrompt` is set, the custom prompt is written as a second key in the config ConfigMap and referenced by file path in the config.
13. BYOK reference content indexes from `spec.ols.rag` are written to `reference_content.indexes` when present. OCP product documentation is served exclusively via `solr_hybrid` (OKP); the operator does not emit a built-in OCP FAISS index.
14. [PLANNED: OLS-3697] Unless `byokRAGOnly` is true, the operator generates a `solr_hybrid` config section in `olsconfig.yaml` pointing to `https://lightspeed-rhokp.<ns>.svc:8443` with default hybrid retrieval tuning parameters.
14. Unless `byokRAGOnly` is true, the operator generates a `solr_hybrid` config section in `olsconfig.yaml` pointing to `https://lightspeed-rhokp.<ns>.svc:8443` with default hybrid retrieval tuning parameters.
15a. Unless `byokRAGOnly` is true, the app-server container receives `OCP_CLUSTER_VERSION` (`<major>.<minor>` from the operator's cluster-version lookup) for Solr `chunk_filter_query` resolution in lightspeed-service.

### ROSA-Aware OKP Retrieval
Expand All @@ -47,8 +47,9 @@ The App Server is the backend deployment for OpenShift Lightspeed. It runs the l
23. The app-server service account can read the cluster version and the telemetry pull secret.

### Change Detection
24. Deployment updates are triggered when: the deployment spec changes, the config ConfigMap resource version changes, the proxy CA certificate hash changes, or (when introspection is enabled) the MCP client CA Secret content hash changes.
25. When any of these change, the operator forces a rolling restart by updating a pod template annotation with the current timestamp.
24. Deployment updates are triggered when: the deployment spec changes, the config ConfigMap resource version changes, or the proxy CA certificate hash changes.
25. Client CA Secrets (OTEL, MCP, RHOKP) are refreshed via the table-driven `RefreshClientCASecrets` in `RestartAppServer`. The watcher detects TLS secret rotation and invokes `RestartAppServer`, which re-reads the service-ca ConfigMap and updates each enabled client CA Secret. No hash annotation is stored on the Deployment.
26. When any change is detected, the operator forces a rolling restart by updating a pod template annotation with the current timestamp.

### Health Probes [PLANNED: OLS-3221]
26. The app server deployment's liveness probe must point to the `/liveness` endpoint with `failureThreshold: 3` and `periodSeconds: 30`, giving the pod 90 seconds to self-heal via the background health-check loop before Kubernetes restarts it. These values are not currently user-configurable.
Expand All @@ -68,7 +69,7 @@ The App Server is the backend deployment for OpenShift Lightspeed. It runs the l
| `spec.ols.deployment.api.nodeSelector` | Node selector constraints |
| `spec.ols.deployment.dataCollector.resources` | Data collector container resources |
| `spec.ols.deployment.mcpServer` | Standalone MCP Deployment settings (`Config`: replicas, resources, tolerations, nodeSelector) |
| `spec.ols.deployment.rhokp` | Standalone RHOKP Deployment settings (`Config`: replicas, resources, tolerations, nodeSelector) [PLANNED: OLS-3697] |
| `spec.ols.deployment.rhokp` | Standalone RHOKP Deployment settings (`Config`: replicas, resources, tolerations, nodeSelector) |
| `spec.ols.defaultModel` | Default LLM model name |
| `spec.ols.defaultProvider` | Default LLM provider name |
| `spec.ols.logLevel` | Logging level for all service components |
Expand All @@ -92,15 +93,15 @@ The App Server is the backend deployment for OpenShift Lightspeed. It runs the l
2. Tool filtering requires MCP servers to be configured (either introspection or user-defined).
3. The service always connects to PostgreSQL via the internal cluster service DNS.
4. RAG init containers run in index order, copying data to subdirectories of the shared RAG volume.
5. [PLANNED: OLS-3697] RHOKP runs as a standalone Deployment (`lightspeed-rhokp`) with its own 75 GiB EmptyDir. The app-server pod no longer requires ephemeral storage for OKP. See `rhokp.md`.
5. RHOKP runs as a standalone Deployment (`lightspeed-rhokp`) with its own 75 GiB EmptyDir. The app-server pod no longer requires ephemeral storage for OKP. See `rhokp.md`.

### Resource Conventions [OLS-3397]
30. All operator-managed container defaults follow the [OpenShift resource conventions](https://github.com/openshift/enhancements/blob/master/CONVENTIONS.md#resources-and-limits): defaults declare CPU and memory requests only, and do not set resource limits. This applies to the primary API container, sidecars (data collector), the standalone MCP Deployment, and the standalone RHOKP Deployment.
31. Users may still set limits via the CRD (`spec.ols.deployment.<component>.resources`, including `spec.ols.deployment.rhokp.resources`) if their environment requires it. The CRD uses standard `corev1.ResourceRequirements` which accepts both requests and limits.
32. [PLANNED: OLS-3697] The RHOKP standalone Deployment's ~75 GiB EmptyDir sizeLimit is unchanged by this convention — it applies only to CPU and memory.
32. The RHOKP standalone Deployment's ~75 GiB EmptyDir sizeLimit is unchanged by this convention — it applies only to CPU and memory.
Comment on lines +96 to +101

@coderabbitai coderabbitai Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Document 75 GiB as the default, not a fixed limit.

internal/controller/rhokp/deployment.go replaces the default 75Gi size with the RHOKP ephemeral-storage request when one is configured. Update these rules so operators know that the CR can override the EmptyDir sizeLimit.

Proposed wording 
-5. RHOKP runs as a standalone Deployment (`lightspeed-rhokp`) with its own 75 GiB EmptyDir.
+5. RHOKP runs as a standalone Deployment (`lightspeed-rhokp`) with a default 75 GiB EmptyDir. The RHOKP `ephemeral-storage` request overrides this sizeLimit when configured.
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
5. RHOKP runs as a standalone Deployment (`lightspeed-rhokp`) with its own 75 GiB EmptyDir. The app-server pod no longer requires ephemeral storage for OKP. See `rhokp.md`.
### Resource Conventions [OLS-3397]
30. All operator-managed container defaults follow the [OpenShift resource conventions](https://github.com/openshift/enhancements/blob/master/CONVENTIONS.md#resources-and-limits): defaults declare CPU and memory requests only, and do not set resource limits. This applies to the primary API container, sidecars (data collector), the standalone MCP Deployment, and the standalone RHOKP Deployment.
31. Users may still set limits via the CRD (`spec.ols.deployment.<component>.resources`, including `spec.ols.deployment.rhokp.resources`) if their environment requires it. The CRD uses standard `corev1.ResourceRequirements` which accepts both requests and limits.
32. [PLANNED: OLS-3697] The RHOKP standalone Deployment's ~75 GiB EmptyDir sizeLimit is unchanged by this convention — it applies only to CPU and memory.
32. The RHOKP standalone Deployment's ~75 GiB EmptyDir sizeLimit is unchanged by this convention — it applies only to CPU and memory.
5. RHOKP runs as a standalone Deployment (`lightspeed-rhokp`) with a default 75 GiB EmptyDir. The RHOKP `ephemeral-storage` request overrides this sizeLimit when configured. The app-server pod no longer requires ephemeral storage for OKP. See `rhokp.md`.
### Resource Conventions [OLS-3397]
30. All operator-managed container defaults follow the [OpenShift resource conventions](https://github.com/openshift/enhancements/blob/master/CONVENTIONS.md#resources-and-limits): defaults declare CPU and memory requests only, and do not set resource limits. This applies to the primary API container, sidecars (data collector), the standalone MCP Deployment, and the standalone RHOKP Deployment.
31. Users may still set limits via the CRD (`spec.ols.deployment.<component>.resources`, including `spec.ols.deployment.rhokp.resources`) if their environment requires it. The CRD uses standard `corev1.ResourceRequirements` which accepts both requests and limits.
32. The RHOKP standalone Deployment's ~75 GiB EmptyDir sizeLimit is unchanged by this convention — it applies only to CPU and memory.
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.ai/spec/what/app-server.md around lines 96 - 101, Update the RHOKP resource
conventions in “Resource Conventions” to describe the EmptyDir sizeLimit as a
default of approximately 75 GiB rather than a fixed value. State that the RHOKP
CR’s configured ephemeral-storage request can override this default, while
preserving that the convention applies only to CPU and memory resource defaults.


### RHOKP Image
33. [PLANNED: OLS-3697] The RHOKP standalone Deployment image is set via the operator `--rhokp-image` startup flag. Default comes from `related_images.json` entry `rhokp` (`utils.RHOOKPImageDefault` / `imageDefaultOr`). The OLM bundle lists it in CSV `spec.relatedImages` and passes the image via `--rhokp-image` on the manager deployment. See `rhokp.md`.
33. The RHOKP standalone Deployment image is set via the operator `--rhokp-image` startup flag. Default comes from `related_images.json` entry `rhokp` (`utils.RHOOKPImageDefault` / `imageDefaultOr`). The OLM bundle lists it in CSV `spec.relatedImages` and passes the image via `--rhokp-image` on the manager deployment. See `rhokp.md`.

### Agentic Sandbox Configuration Handoff [PLANNED: OLS-3572]

Expand All @@ -109,7 +110,7 @@ The App Server is the backend deployment for OpenShift Lightspeed. It runs the l
- `sandbox-mode`: `bare-pod` or `sandbox-claim` from `OLSConfig.spec.agenticOLS.sandboxMode`.
- `mcp-endpoint`: MCP server endpoint URL (when ocp-mcp is deployed as standalone HTTPS service).
- `otel-endpoint`: OTEL collector gRPC endpoint (when templog collector is deployed).
- `rhokp-endpoint`: RHOKP Solr HTTPS endpoint URL (when OKP is enabled, i.e., `!byokRAGOnly`). [PLANNED: OLS-3697]
- `rhokp-endpoint`: RHOKP Solr HTTPS endpoint URL (when OKP is enabled, i.e., `!byokRAGOnly`).

35. The ConfigMap is always created during reconciliation. Keys are absent when the corresponding feature is not enabled. The `sandbox-pod-spec` key is always present.

Expand All @@ -118,6 +119,5 @@ The App Server is the backend deployment for OpenShift Lightspeed. It runs the l
## Planned Changes

- [PLANNED: OLS-3221] Liveness probe now checks PostgreSQL health via the service's background health-check loop status. Probe configuration (failureThreshold, periodSeconds) added to deployment generation. See Rules 24–25.
- Classic→agentic sandbox handoff: appserver owns client CA Secrets (`lightspeed-agentic-otel-ca` / `lightspeed-agentic-mcp-ca`) and mounts them; `agenticintegration` owns the handoff ConfigMap — see `agentic-sandbox-profile.md` (OLS-3683 / OLS-3684). Optional agentic auto-injection remains deferred ([OLS-3594](https://redhat.atlassian.net/browse/OLS-3594)).
- Classic→agentic sandbox handoff: appserver owns client CA Secrets (`lightspeed-agentic-otel-ca` / `lightspeed-agentic-mcp-ca` / `lightspeed-agentic-rhokp-ca`) and mounts them; `agenticintegration` owns the handoff ConfigMap — see `agentic-sandbox-profile.md` (OLS-3683 / OLS-3684). Optional agentic auto-injection remains deferred ([OLS-3594](https://redhat.atlassian.net/browse/OLS-3594)).
- [PLANNED: OLS-3572] Agentic sandbox configuration handoff — classic operator builds base PodSpec and writes `lightspeed-sandbox-config` ConfigMap for the agentic operator. See Rules 34–36.
Comment on lines +122 to 123

@coderabbitai coderabbitai Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Remove implemented behavior from Planned Changes.

The current rules already document the classic-to-agentic handoff and CA Secret ownership as implemented behavior, while this bullet appears under Planned Changes without a planned marker. Remove it or narrow it to genuinely unfinished work; retain only the explicitly deferred auto-injection item.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.ai/spec/what/app-server.md around lines 122 - 123, Update the Planned
Changes section by removing the already-implemented classic-to-agentic sandbox
handoff and CA Secret ownership text. Retain only the explicitly deferred
optional agentic auto-injection item, preserving its OLS-3594 reference.

- [PLANNED: OLS-3697] RHOKP standalone HTTPS cutover — sidecar removed from app-server, standalone `lightspeed-rhokp` Deployment/Service created. `solr_hybrid.solr_http_base` changes to HTTPS cluster DNS. RHOKP CA added to `extra_ca`. `spec.ols.deployment.rhokp` type changes from `ContainerConfig` to `Config`. Handoff ConfigMap gains `rhokp-endpoint`. See `rhokp.md`.
Loading