assert-openstack-lightspeed-instance.yaml

##############################################################################
#       Assert that the operator created all expected resources               #
##############################################################################

# Postgres PVC (persistent storage is always enabled)
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: openstack-lightspeed-database
  namespace: openstack-lightspeed
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi

# Postgres resources
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: lightspeed-postgres-conf
  namespace: openstack-lightspeed
---
apiVersion: v1
kind: Secret
metadata:
  name: lightspeed-postgres-bootstrap
  namespace: openstack-lightspeed
---
apiVersion: v1
kind: Secret
metadata:
  name: lightspeed-postgres-secret
  namespace: openstack-lightspeed
---
apiVersion: v1
kind: Service
metadata:
  name: lightspeed-postgres-server
  namespace: openstack-lightspeed
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: lightspeed-postgres-server
  namespace: openstack-lightspeed
spec:
  template:
    spec:
      containers:
        - name: lightspeed-postgres-server
          resources:
            requests:
              cpu: 30m
              memory: 300Mi
            limits:
              cpu: 500m
              memory: 2Gi
status:
  replicas: 1
  readyReplicas: 1
  availableReplicas: 1
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: lightspeed-postgres-server
  namespace: openstack-lightspeed

# OKP Deployment
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: lightspeed-okp-server
  namespace: openstack-lightspeed
spec:
  template:
    spec:
      containers:
        - name: okp
          ports:
            - name: okp
              containerPort: 8080
status:
  replicas: 1
  readyReplicas: 1
  availableReplicas: 1

# OKP Service
---
apiVersion: v1
kind: Service
metadata:
  name: lightspeed-okp-server
  namespace: openstack-lightspeed
spec:
  ports:
    - name: http
      port: 8080
      protocol: TCP
      targetPort: okp
  type: ClusterIP

# LCore resources
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: lightspeed-app-server
  namespace: openstack-lightspeed
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: lightspeed-app-server-sar-role
  labels:
    app.kubernetes.io/component: app-server
    app.kubernetes.io/managed-by: openstack-lightspeed-operator
    app.kubernetes.io/name: openstack-lightspeed-app-server
    app.kubernetes.io/part-of: openstack-lightspeed
rules:
  - apiGroups:
      - authorization.k8s.io
    resources:
      - subjectaccessreviews
    verbs:
      - create
  - apiGroups:
      - authentication.k8s.io
    resources:
      - tokenreviews
    verbs:
      - create
  - apiGroups:
      - config.openshift.io
    resources:
      - clusterversions
    verbs:
      - list
      - get
  - apiGroups:
      - ""
    resources:
      - secrets
    resourceNames:
      - pull-secret
    verbs:
      - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: lightspeed-app-server-sar-role-binding
  labels:
    app.kubernetes.io/component: app-server
    app.kubernetes.io/managed-by: openstack-lightspeed-operator
    app.kubernetes.io/name: openstack-lightspeed-app-server
    app.kubernetes.io/part-of: openstack-lightspeed
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: lightspeed-app-server-sar-role
subjects:
  - kind: ServiceAccount
    name: lightspeed-app-server
    namespace: openstack-lightspeed
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: llama-stack-config
  namespace: openstack-lightspeed
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: lightspeed-stack-config
  namespace: openstack-lightspeed
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: lightspeed-exporter-config
  namespace: openstack-lightspeed
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: openstack-lightspeed-ca-bundle
  namespace: openstack-lightspeed
---
apiVersion: v1
kind: Service
metadata:
  name: lightspeed-app-server
  namespace: openstack-lightspeed
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: lightspeed-stack-deployment
  namespace: openstack-lightspeed
spec:
  template:
    spec:
      initContainers:
        - name: vector-database-collect
        - name: vector-database-config-build
      containers:
        - name: llama-stack
          resources:
            requests:
              cpu: 500m
              memory: 2Gi
            limits:
              cpu: "2"
              memory: 8Gi
          env:
            - name: OPENSTACK_LIGHTSPEED_PROVIDER_API_KEY
              valueFrom:
                secretKeyRef:
                  key: apitoken
                  name: openstack-lightspeed-apitoken
            - name: POSTGRESQL_PASSWORD
              valueFrom:
                secretKeyRef:
                  key: password
                  name: lightspeed-postgres-secret
            - name: POSTGRESQL_USER
              valueFrom:
                secretKeyRef:
                  key: username
                  name: lightspeed-postgres-secret
            - name: PGSSLMODE
              value: verify-full
            - name: PGSSLROOTCERT
              value: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
            - name: LLAMA_STACK_LOGGING
              value: all=debug
            - name: OGX_LOGGING
              value: all=debug
            - name: VECTOR_DB_DATA_PATH
              value: /vector-db-discovered-values
            - name: RH_SERVER_OKP
              value: http://lightspeed-okp-server.openstack-lightspeed.svc:8080
          volumeMounts:
            - name: ca-bundle
              mountPath: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
              subPath: tls-ca-bundle.pem
              readOnly: true
            - name: vector-db-discovered-values
              mountPath: /vector-db-discovered-values
            - name: llama-cache
              mountPath: /tmp/llama-stack
            - name: vector-db-scripts
              mountPath: /scripts
              readOnly: true
        - name: lightspeed-service-api
          resources:
            requests:
              cpu: 250m
              memory: 512Mi
            limits:
              cpu: "1"
              memory: 2Gi
          env:
            - name: LIGHTSPEED_STACK_LOG_LEVEL
              value: WARNING
            - name: RH_SERVER_OKP
              value: http://lightspeed-okp-server.openstack-lightspeed.svc:8080
            - name: POSTGRESQL_PASSWORD
              valueFrom:
                secretKeyRef:
                  key: password
                  name: lightspeed-postgres-secret
            - name: POSTGRESQL_USER
              valueFrom:
                secretKeyRef:
                  key: username
                  name: lightspeed-postgres-secret
          volumeMounts:
            - name: ca-bundle
              mountPath: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
              subPath: tls-ca-bundle.pem
              readOnly: true
            - name: vector-db-discovered-values
              mountPath: /vector-db-discovered-values
            - name: tls-certs
              mountPath: /etc/certs/lightspeed-tls
              readOnly: true
            - name: ols-user-data
              mountPath: /tmp/data
        - name: lightspeed-to-dataverse-exporter
          args:
            - --mode
            - openshift
            - --config
            - /etc/config/config.yaml
            - --log-level
            - DEBUG
            - --data-dir
            - /tmp/data
          volumeMounts:
            - name: ols-user-data
              mountPath: /tmp/data
            - name: exporter-config
              mountPath: /etc/config
              readOnly: true
            - name: ca-bundle
              mountPath: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
              subPath: tls-ca-bundle.pem
              readOnly: true
      volumes:
        - name: ogx-config
          configMap:
            name: llama-stack-config
        - name: lightspeed-stack-config
          configMap:
            name: lightspeed-stack-config
        - name: vector-db-scripts
          configMap:
            name: vector-db-scripts
        - name: ca-bundle
          configMap:
            name: openstack-lightspeed-ca-bundle
        - name: vector-db-discovered-values
          emptyDir: {}
        - name: llama-cache
          emptyDir: {}
        - name: ols-user-data
          emptyDir: {}
        - name: exporter-config
          configMap:
            name: lightspeed-exporter-config
        - name: tls-certs
          secret:
            secretName: lightspeed-tls
status:
  replicas: 1
  readyReplicas: 1
  availableReplicas: 1
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: lightspeed-app-server
  namespace: openstack-lightspeed

# Vector DB init containers scripts
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: vector-db-scripts
  namespace: openstack-lightspeed

# Console Plugin resources
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: lightspeed-console-plugin
  namespace: openstack-lightspeed
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: lightspeed-console-plugin
  namespace: openstack-lightspeed
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: lightspeed-console-plugin
  namespace: openstack-lightspeed
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: lightspeed-console-plugin
  namespace: openstack-lightspeed
spec:
  template:
    spec:
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      initContainers:
        - name: rewrite-locales
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 200m
              memory: 256Mi
          volumeMounts:
            - name: locales-rewrite
              mountPath: /locales-rewrite
      containers:
        - name: lightspeed-console-plugin
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 200m
              memory: 256Mi
---
apiVersion: v1
kind: Service
metadata:
  name: lightspeed-console-plugin
  namespace: openstack-lightspeed
---
apiVersion: console.openshift.io/v1
kind: ConsolePlugin
metadata:
  name: lightspeed-console-plugin

# OpenStackLightspeed CR status
---
apiVersion: lightspeed.openstack.org/v1beta1
kind: OpenStackLightspeed
metadata:
  name: openstack-lightspeed
  namespace: openstack-lightspeed
spec:
  llmCredentials: openstack-lightspeed-apitoken
  llmEndpoint: http://mock-llm-api-server-pod:8000/v1
  llmEndpointType: openai
  modelName: ibm-granite/granite-3.1-8b-instruct
  tlsCACertBundle: openstack-lightspeed-cert
  llmProjectID: test-project-id
  llmDeploymentName: test-deployment-name
  llmAPIVersion: v1
  logging:
    ogxLogLevel: DEBUG
    lightspeedStackLogLevel: WARNING
status:
  conditions:
    - type: Ready
      status: "True"
      reason: Ready
      message: Setup complete
    - type: OpenStackLightspeedReady
      status: "True"
      reason: Ready
      message: OpenStack Lightspeed created