OLS-3681: Install or update Lightspeed Operator in quickstart#352
OLS-3681: Install or update Lightspeed Operator in quickstart#352blublinsky wants to merge 1 commit into
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@blublinsky: This pull request references OLS-3681 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Warning Review limit reached
Next review available in: 35 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughChangesThe quickstart now uses a downloaded interactive installer that can optionally install Lightspeed Operator through OLM, configure OLSConfig, and deploy Agentic Operator resources with configurable timeouts and diagnostics. Quickstart installer workflow
Sequence Diagram(s)sequenceDiagram
participant Installer
participant OperatorSDK
participant Kubernetes
Installer->>OperatorSDK: Resolve and run Lightspeed Operator bundle
OperatorSDK->>Kubernetes: Install or update operator resources
Installer->>Kubernetes: Apply OLSConfig and Agentic Operator resources
Kubernetes-->>Installer: Report OLSConfig and rollout status
Installer-->>Installer: Print diagnostics or completion details
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@hack/quickstart/install.sh`:
- Around line 371-376: Update the existing OLS update decision flow around
install_or_update_ols so declining an update still guarantees the
lightspeed-otel-collector-client ConfigMap exists when the CRD is present. Reuse
the established CONFIGURE_OLSCONFIG or CREATE_EMPTY_OTEL_CM fallback used by the
fresh-install decline path, while preserving the current behavior for accepted
updates and unchanged installations.
- Around line 123-128: Update the operator-sdk download flow around the URL and
destination assignment to fetch the release’s checksums.txt for
${OPERATOR_SDK_VERSION}, verify the downloaded ${dest} against the entry
matching ${os}_${arch} before chmod or execution, and exit on any missing or
mismatched checksum. Keep the existing successful-download setup unchanged after
verification.
In `@hack/quickstart/README.md`:
- Around line 18-20: Update the quickstart download-and-execute commands so bash
install-agentic.sh runs only when curl successfully downloads install.sh, using
command chaining or a temporary-file workflow; preserve the existing installer
URL and execution behavior after a successful transfer.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: f5ab607c-01eb-4ab3-8f5f-a2e3c698f59a
📒 Files selected for processing (2)
hack/quickstart/README.mdhack/quickstart/install.sh
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift/lightspeed-agentic-sandbox(manual)
| url="https://github.com/operator-framework/operator-sdk/releases/download/v${OPERATOR_SDK_VERSION}/operator-sdk_${os}_${arch}" | ||
| echo " Downloading operator-sdk v${OPERATOR_SDK_VERSION}..." | ||
| curl -fsSL -o "${dest}" "${url}" | ||
| chmod +x "${dest}" | ||
| OPERATOR_SDK_BIN="${dest}" | ||
| info "operator-sdk ready (${OPERATOR_SDK_BIN})" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Confirm checksums.txt is published for this release
curl -fsSL "https://github.com/operator-framework/operator-sdk/releases/download/v1.36.1/checksums.txt" | head -20Repository: openshift/lightspeed-agentic-operator
Length of output: 1281
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sed -n '110,190p' hack/quickstart/install.shRepository: openshift/lightspeed-agentic-operator
Length of output: 3077
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n "checksum|sha256|gpg|cosign|verify" hack/quickstart/install.shRepository: openshift/lightspeed-agentic-operator
Length of output: 175
Verify the operator-sdk download before execution. The script fetches a release binary and chmod +xs it with no checksum or signature check. Use the published checksums.txt for ${OPERATOR_SDK_VERSION} and fail closed on mismatch; otherwise a tampered release asset or MITM can run arbitrary code in the cluster.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@hack/quickstart/install.sh` around lines 123 - 128, Update the operator-sdk
download flow around the URL and destination assignment to fetch the release’s
checksums.txt for ${OPERATOR_SDK_VERSION}, verify the downloaded ${dest} against
the entry matching ${os}_${arch} before chmod or execution, and exit on any
missing or mismatched checksum. Keep the existing successful-download setup
unchanged after verification.
| if prompt_yes_no "Update Lightspeed Operator to the latest related_images bundle?"; then | ||
| install_or_update_ols update | ||
| CONFIGURE_OLSCONFIG=1 | ||
| else | ||
| warn "Skipping OLS update (leaving current OLS install unchanged)" | ||
| fi |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
Declining an OLS update leaves the OTEL ConfigMap gap unhandled.
When the CRD is present and the user declines the update (Lines 374-376), neither CONFIGURE_OLSCONFIG nor CREATE_EMPTY_OTEL_CM is set. If the existing OLS install predates the OTEL bundle, lightspeed-otel-collector-client never gets created, and the agentic rollout blocks and fails at Step 8. The fresh-install decline path guards against this; this path does not. Confirm the ConfigMap is guaranteed to exist here, or add a fallback.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@hack/quickstart/install.sh` around lines 371 - 376, Update the existing OLS
update decision flow around install_or_update_ols so declining an update still
guarantees the lightspeed-otel-collector-client ConfigMap exists when the CRD is
present. Reuse the established CONFIGURE_OLSCONFIG or CREATE_EMPTY_OTEL_CM
fallback used by the fresh-install decline path, while preserving the current
behavior for accepted updates and unchanged installations.
| curl -fsSL -o install-agentic.sh \ | ||
| https://raw.githubusercontent.com/openshift/lightspeed-agentic-operator/main/hack/quickstart/install.sh | ||
| bash install-agentic.sh |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Make the download-and-execute step fail closed.
If curl fails, the shell still runs bash install-agentic.sh, potentially executing a stale file from a previous attempt. Chain execution on download success or download to a temporary file and execute only after a successful transfer.
Proposed fix
-curl -fsSL -o install-agentic.sh \
+curl -fsSL -o install-agentic.sh \
https://raw.githubusercontent.com/openshift/lightspeed-agentic-operator/main/hack/quickstart/install.sh
-bash install-agentic.sh
+&& bash install-agentic.sh🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@hack/quickstart/README.md` around lines 18 - 20, Update the quickstart
download-and-execute commands so bash install-agentic.sh runs only when curl
successfully downloads install.sh, using command chaining or a temporary-file
workflow; preserve the existing installer URL and execution behavior after a
successful transfer.
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: blublinsky The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
need to update uninstall script also |
0743fe6 to
3c2415a
Compare
|
uninstall updated |
|
@blublinsky: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/override "CodeRabbit" |
|
@blublinsky: Overrode contexts on behalf of blublinsky: CodeRabbit DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
tried the script. script invocation Logs(openshift-lightspeed/lightspeed-agentic-operator-56dd8f8b9b-4pgsr:manager) |
3 participants
Summary
OLSConfigCRD) and prompts to install or update it fromopenshift/lightspeed-operatorrelated_images.jsonviaoperator-sdk run bundle/bundle-upgrade.status.overallStatus=Ready, then deploys the agentic operator.curl | bash) so interactive prompts work; declining a fresh OLS install creates an emptylightspeed-otel-collector-clientConfigMap.Important
Use the latest Lightspeed Operator bundle that includes the OTEL collector (and creates
lightspeed-otel-collector-client). Olderrelated_images.jsonbundles without OTEL leave the agentic operator stuck waiting for that ConfigMap.Current operator main needs to be updated