assert-openstack-lightspeed-instance.yaml

##############################################################################
#       Assert that the operator created all expected resources               #
##############################################################################

# Postgres PVC (persistent storage is always enabled)
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: openstack-lightspeed-database
  namespace: openstack-lightspeed
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi

# Postgres resources
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: lightspeed-postgres-conf
  namespace: openstack-lightspeed
---
apiVersion: v1
kind: Secret
metadata:
  name: lightspeed-postgres-bootstrap
  namespace: openstack-lightspeed
---
apiVersion: v1
kind: Service
metadata:
  name: lightspeed-postgres-server
  namespace: openstack-lightspeed
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: lightspeed-postgres-server
  namespace: openstack-lightspeed
status:
  replicas: 1
  readyReplicas: 1
  availableReplicas: 1
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: lightspeed-postgres-server
  namespace: openstack-lightspeed

# LCore resources
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: lightspeed-app-server
  namespace: openstack-lightspeed
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: lightspeed-app-server-sar-role
  labels:
    app.kubernetes.io/component: app-server
    app.kubernetes.io/managed-by: openstack-lightspeed-operator
    app.kubernetes.io/name: openstack-lightspeed-app-server
    app.kubernetes.io/part-of: openstack-lightspeed
rules:
  - apiGroups:
      - authorization.k8s.io
    resources:
      - subjectaccessreviews
    verbs:
      - create
  - apiGroups:
      - authentication.k8s.io
    resources:
      - tokenreviews
    verbs:
      - create
  - apiGroups:
      - config.openshift.io
    resources:
      - clusterversions
    verbs:
      - list
      - get
  - apiGroups:
      - ""
    resources:
      - secrets
    resourceNames:
      - pull-secret
    verbs:
      - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: lightspeed-app-server-sar-role-binding
  labels:
    app.kubernetes.io/component: app-server
    app.kubernetes.io/managed-by: openstack-lightspeed-operator
    app.kubernetes.io/name: openstack-lightspeed-app-server
    app.kubernetes.io/part-of: openstack-lightspeed
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: lightspeed-app-server-sar-role
subjects:
  - kind: ServiceAccount
    name: lightspeed-app-server
    namespace: openstack-lightspeed
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: llama-stack-config
  namespace: openstack-lightspeed
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: lightspeed-stack-config
  namespace: openstack-lightspeed
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: lightspeed-exporter-config
  namespace: openstack-lightspeed
---
apiVersion: v1
kind: Service
metadata:
  name: lightspeed-app-server
  namespace: openstack-lightspeed
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: lightspeed-stack-deployment
  namespace: openstack-lightspeed
spec:
  template:
    spec:
      containers:
      - name: llama-stack
        env:
        - name: OPENSTACK_LIGHTSPEED_PROVIDER_API_KEY
          valueFrom:
            secretKeyRef:
              key: apitoken
              name: openstack-lightspeed-apitoken
        - name: POSTGRES_PASSWORD
          valueFrom:
            secretKeyRef:
              key: password
              name: lightspeed-postgres-secret
        - name: LLAMA_STACK_LOGGING
          value: all=debug
        - name: OGX_LOGGING
          value: all=debug
        - name: VECTOR_DB_DATA_PATH
          value: /vector-db-discovered-values
        - name: REQUESTS_CA_BUNDLE
          value: /etc/certs/additional-ca/cert.crt
        - name: SSL_CERT_FILE
          value: /etc/certs/additional-ca/cert.crt
      - name: lightspeed-service-api
        env:
        - name: LIGHTSPEED_STACK_LOG_LEVEL
          value: WARNING
        - name: POSTGRES_PASSWORD
          valueFrom:
            secretKeyRef:
              key: password
              name: lightspeed-postgres-secret
      - name: lightspeed-to-dataverse-exporter
        args:
        - --mode
        - openshift
        - --config
        - /etc/config/config.yaml
        - --log-level
        - DEBUG
        - --data-dir
        - /tmp/data
status:
  replicas: 1
  readyReplicas: 1
  availableReplicas: 1
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: lightspeed-app-server
  namespace: openstack-lightspeed

# Vector DB init containers scripts
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: vector-db-scripts
  namespace: openstack-lightspeed

# Console Plugin resources
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: lightspeed-console-plugin
  namespace: openstack-lightspeed
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: lightspeed-console-plugin
  namespace: openstack-lightspeed
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: lightspeed-console-plugin
  namespace: openstack-lightspeed
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: lightspeed-console-plugin
  namespace: openstack-lightspeed
spec:
  template:
    spec:
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      initContainers:
        - name: rewrite-locales
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          volumeMounts:
            - name: locales-rewrite
              mountPath: /locales-rewrite
---
apiVersion: v1
kind: Service
metadata:
  name: lightspeed-console-plugin
  namespace: openstack-lightspeed
---
apiVersion: console.openshift.io/v1
kind: ConsolePlugin
metadata:
  name: lightspeed-console-plugin

# OpenStackLightspeed CR status
---
apiVersion: lightspeed.openstack.org/v1beta1
kind: OpenStackLightspeed
metadata:
  name: openstack-lightspeed
  namespace: openstack-lightspeed
spec:
  llmCredentials: openstack-lightspeed-apitoken
  llmEndpoint: http://mock-llm-api-server-pod:8000/v1
  llmEndpointType: openai
  modelName: ibm-granite/granite-3.1-8b-instruct
  tlsCACertBundle: openstack-lightspeed-cert
  llmProjectID: test-project-id
  llmDeploymentName: test-deployment-name
  llmAPIVersion: v1
  logging:
    ogxLogLevel: DEBUG
    lightspeedStackLogLevel: WARNING
status:
  conditions:
    - type: Ready
      status: "True"
      reason: Ready
      message: Setup complete
    - type: OCPRAGReady
      status: "True"
      reason: Ready
      message: OCP RAG is disabled
    - type: OpenStackLightspeedReady
      status: "True"
      reason: Ready
      message: OpenStack Lightspeed created