Merge branch 'lightspeed-core:main' into LCORE_2035_koflux_tls_e2e_fix

Author: radofuchs

.tekton/lightspeed-stack-push.yaml

@@ -2,6 +2,10 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   annotations:
+    # Cross-repo nudge: after each push build, the Konflux nudge controller
+    # opens an MR in lscore-deploy (gitlab.cee.redhat.com/rhel-lightspeed/lscore-deploy)
+    # to bump the image digest in openshift/lightspeed-stack.yml. See RSPEED-3082.
+    build.appstudio.openshift.io/build-nudge-files: "openshift/lightspeed-stack.yml"
     build.appstudio.openshift.io/repo: https://github.com/lightspeed-core/lightspeed-stack?rev={{revision}}
     build.appstudio.redhat.com/commit_sha: '{{revision}}'
     build.appstudio.redhat.com/target_branch: '{{target_branch}}'

README.md

@@ -188,7 +188,7 @@ To quickly get hands on LCS, we can run it using the default configurations prov
    ```
 4. access LCS web UI at [http://localhost:8080/](http://localhost:8080/)
 
-**Note**: `make run` uses containerized llama-stack (service mode). To run llama-stack manually instead, see the [Llama Stack as separate server](#llama-stack-as-separate-server) section below.
+**Note**: `make run` uses containerized llama-stack (service mode). For details on container lifecycle management, customization, and troubleshooting, see the [Container Orchestration Guide](docs/container_orchestration.md). To run llama-stack manually instead, see the [Llama Stack as separate server](#llama-stack-as-separate-server) section below.
 
 ## Container Runtime Requirements
 
@@ -199,6 +199,8 @@ The Makefile requires either Podman or Docker to launch the Llama Stack containe
 
 The Makefile will auto-detect which runtime is available.
 
+**For advanced usage** including customization options, cleanup commands, and troubleshooting, see the [Container Orchestration Guide](docs/container_orchestration.md).
+
 
 # Configuration
 

docs/auth/rh-identity.md

@@ -114,7 +114,13 @@ directly (e.g., Insights client, subscription-manager).
 
 **Identity extraction:**
 - `user_id`: From `identity.system.cn` (certificate Common Name)
-- `username`: From `identity.account_number`
+- `username`: From `identity.account_number` when present and non-empty,
+  otherwise falls back to `identity.system.cn`
+
+`org_id` is the required organizational identifier for System identities.
+`account_number` is optional: no-cost RHEL developer subscriptions send an
+empty `account_number` with a populated `org_id`. A System identity is rejected
+only when `org_id` or `system.cn` is empty or absent.
 
 **Header structure:**
 ```json
@@ -134,6 +140,22 @@ directly (e.g., Insights client, subscription-manager).
 }
 ```
 
+A developer-subscription System identity omits the account number:
+```json
+{
+  "identity": {
+    "account_number": "",
+    "org_id": "18939564",
+    "type": "System",
+    "auth_type": "cert-auth",
+    "system": {
+      "cn": "14b75b86-6f99-411d-b41d-f400268b5807",
+      "cert_type": "system"
+    }
+  }
+}
+```
+
 **Available System fields:**
 
 | Field | Type | Description |
@@ -147,8 +169,8 @@ Both identity types share these top-level fields:
 
 | Field | Type | Description |
 |-------|------|-------------|
-| `account_number` | string | Red Hat account number |
-| `org_id` | string | Organization ID |
+| `account_number` | string | Red Hat account number (optional for System identities; may be empty for developer subscriptions) |
+| `org_id` | string | Organization ID (required for System identities) |
 | `type` | string | Identity type: "User" or "System" |
 
 ## Entitlements
@@ -269,7 +291,7 @@ curl http://localhost:8080/v1/query \
 | 400 | Missing `username` in user | `{"detail": "Missing 'username' in user data"}` |
 | 400 | Missing `system` for System type | `{"detail": "Missing 'system' field for System type"}` |
 | 400 | Missing `cn` in system | `{"detail": "Missing 'cn' in system data"}` |
-| 400 | Missing `account_number` for System | `{"detail": "Missing 'account_number' for System type"}` |
+| 400 | Missing `org_id` for System | `{"detail": "Missing 'org_id' for System type"}` |
 | 400 | Unsupported identity type | `{"detail": "Unsupported identity type: X"}` |
 | 403 | Missing required entitlements | `{"detail": "Missing required entitlement: rhel"}` |