feat: add per-proposal timeoutMinutes and configurable sandbox timeout

sakshiep1 · sakshiep1 · commit 667405d9c052 · 2026-06-04T14:31:24.000+05:30
diff --git a/.gitignore b/.gitignore
@@ -1,5 +1,6 @@
 # Binaries and local tool installs (Makefile uses ./bin for controller-gen, kustomize, etc.)
 /bin/
+/oc-agentic
 
 # IDE / OS
 .idea/
diff --git a/config/crd/bases/agentic.openshift.io_proposals.yaml b/config/crd/bases/agentic.openshift.io_proposals.yaml
@@ -481,6 +481,28 @@ spec:
                 x-kubernetes-validations:
                 - message: schema is required when mode is Minimal
                   rule: self.mode != 'Minimal' || has(self.schema)
+              dataSource:
+                description: |-
+                  dataSource references a PVC containing pre-populated input data
+                  (e.g., must-gather bundles, diagnostic data). The operator mounts
+                  it read-only at /data/input in the sandbox pod. Skills discover
+                  input data at this standard location.
+
+                  Immutable: input data source is fixed at creation.
+                properties:
+                  claimName:
+                    description: |-
+                      claimName is the name of the PersistentVolumeClaim to mount.
+                      The PVC must exist in the same namespace as the Proposal.
+                    maxLength: 253
+                    minLength: 1
+                    type: string
+                    x-kubernetes-validations:
+                    - message: must be a valid DNS subdomain
+                      rule: '!format.dns1123Subdomain().validate(self).hasValue()'
+                required:
+                - claimName
+                type: object
               execution:
                 description: |-
                   execution defines per-step configuration for the execution step.
@@ -913,6 +935,19 @@ spec:
                 x-kubernetes-validations:
                 - message: each namespace must be a valid DNS label
                   rule: self.all(ns, !format.dns1123Label().validate(ns).hasValue())
+              timeoutMinutes:
+                description: |-
+                  timeoutMinutes sets the per-step timeout for sandbox agent calls.
+                  This controls how long the operator waits for the sandbox pod to
+                  become ready and for the agent to complete its work. Increase this
+                  for long-running tools (e.g., IntelliAide RCA takes 10-30 minutes).
+                  Defaults to 5 minutes when omitted.
+
+                  Mutable: can be adjusted before approving a step.
+                format: int32
+                maximum: 60
+                minimum: 1
+                type: integer
               tools:
                 description: |-
                   tools defines the default tools for all steps: skills images,
@@ -1684,6 +1719,9 @@ spec:
             - message: verification is immutable once set
               rule: '!has(oldSelf.verification) || (has(self.verification) && self.verification
                 == oldSelf.verification)'
+            - message: dataSource is immutable once set
+              rule: '!has(oldSelf.dataSource) || (has(self.dataSource) && self.dataSource
+                == oldSelf.dataSource)'
           status:
             description: status defines the observed state of Proposal.
             minProperties: 1
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
@@ -4,6 +4,14 @@ kind: ClusterRole
 metadata:
   name: agentic-operator-manager-role
 rules:
+- apiGroups:
+  - ""
+  resources:
+  - persistentvolumeclaims
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - agentic.openshift.io
   resources:
@@ -58,35 +66,6 @@ rules:
   - proposals/finalizers
   verbs:
   - update
-- apiGroups:
-  - agents.x-k8s.io
-  resources:
-  - sandboxes
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - extensions.agents.x-k8s.io
-  resources:
-  - sandboxclaims
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - watch
-- apiGroups:
-  - extensions.agents.x-k8s.io
-  resources:
-  - sandboxtemplates
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - update
-  - watch
 - apiGroups:
   - rbac.authorization.k8s.io
   resources:
diff --git a/controller/proposal/agent.go b/controller/proposal/agent.go
@@ -2,6 +2,7 @@ package proposal
 
 import (
 	"context"
+	"time"
 
 	agenticv1alpha1 "github.com/openshift/lightspeed-agentic-operator/api/v1alpha1"
 )
@@ -42,18 +43,18 @@ type EscalationOutput struct {
 // HTTP implementations POST to /v1/agent/run — a step-agnostic
 // endpoint where all workflow context is in the request payload.
 type AgentCaller interface {
-	Analyze(ctx context.Context, proposal *agenticv1alpha1.Proposal, step resolvedStep, requestText string) (*AnalysisOutput, error)
-	Execute(ctx context.Context, proposal *agenticv1alpha1.Proposal, step resolvedStep, option *agenticv1alpha1.RemediationOption) (*ExecutionOutput, error)
-	Verify(ctx context.Context, proposal *agenticv1alpha1.Proposal, step resolvedStep, option *agenticv1alpha1.RemediationOption, exec *ExecutionOutput) (*VerificationOutput, error)
-	Escalate(ctx context.Context, proposal *agenticv1alpha1.Proposal, step resolvedStep, requestText string) (*EscalationOutput, error)
+	Analyze(ctx context.Context, proposal *agenticv1alpha1.Proposal, step resolvedStep, requestText string, timeout time.Duration) (*AnalysisOutput, error)
+	Execute(ctx context.Context, proposal *agenticv1alpha1.Proposal, step resolvedStep, option *agenticv1alpha1.RemediationOption, timeout time.Duration) (*ExecutionOutput, error)
+	Verify(ctx context.Context, proposal *agenticv1alpha1.Proposal, step resolvedStep, option *agenticv1alpha1.RemediationOption, exec *ExecutionOutput, timeout time.Duration) (*VerificationOutput, error)
+	Escalate(ctx context.Context, proposal *agenticv1alpha1.Proposal, step resolvedStep, requestText string, timeout time.Duration) (*EscalationOutput, error)
 	ReleaseSandboxes(ctx context.Context, proposal *agenticv1alpha1.Proposal) error
 }
 
 // StubAgentCaller returns canned success results. Wire in a real
 // implementation (sandbox + HTTP) when the agent infrastructure is ready.
 type StubAgentCaller struct{}
 
-func (s *StubAgentCaller) Analyze(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ string) (*AnalysisOutput, error) {
+func (s *StubAgentCaller) Analyze(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ string, _ time.Duration) (*AnalysisOutput, error) {
 	return &AnalysisOutput{
 		Success: true,
 		Options: []agenticv1alpha1.RemediationOption{{
@@ -73,7 +74,7 @@ func (s *StubAgentCaller) Analyze(_ context.Context, _ *agenticv1alpha1.Proposal
 	}, nil
 }
 
-func (s *StubAgentCaller) Execute(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ *agenticv1alpha1.RemediationOption) (*ExecutionOutput, error) {
+func (s *StubAgentCaller) Execute(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ *agenticv1alpha1.RemediationOption, _ time.Duration) (*ExecutionOutput, error) {
 	return &ExecutionOutput{
 		Success: true,
 		ActionsTaken: []agenticv1alpha1.ExecutionAction{{
@@ -88,7 +89,7 @@ func (s *StubAgentCaller) Execute(_ context.Context, _ *agenticv1alpha1.Proposal
 	}, nil
 }
 
-func (s *StubAgentCaller) Escalate(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ string) (*EscalationOutput, error) {
+func (s *StubAgentCaller) Escalate(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ string, _ time.Duration) (*EscalationOutput, error) {
 	return &EscalationOutput{
 		Success: true,
 		Summary: "Stub escalation summary",
@@ -100,7 +101,7 @@ func (s *StubAgentCaller) ReleaseSandboxes(_ context.Context, _ *agenticv1alpha1
 	return nil
 }
 
-func (s *StubAgentCaller) Verify(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ *agenticv1alpha1.RemediationOption, _ *ExecutionOutput) (*VerificationOutput, error) {
+func (s *StubAgentCaller) Verify(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ *agenticv1alpha1.RemediationOption, _ *ExecutionOutput, _ time.Duration) (*VerificationOutput, error) {
 	return &VerificationOutput{
 		Success: true,
 		Checks: []agenticv1alpha1.VerifyCheck{{
diff --git a/controller/proposal/client.go b/controller/proposal/client.go
@@ -74,10 +74,13 @@ type AgentHTTPClient struct {
 	endpoint   string
 }
 
-func NewAgentHTTPClient(endpoint string) AgentHTTPClientInterface {
+func NewAgentHTTPClient(endpoint string, timeout time.Duration) AgentHTTPClientInterface {
+	if timeout <= 0 {
+		timeout = defaultSandboxTimeout
+	}
 	return &AgentHTTPClient{
 		httpClient: &http.Client{
-			Timeout: 5 * time.Minute,
+			Timeout: timeout,
 			Transport: &http.Transport{
 				TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //nolint:gosec // internal cluster traffic
 			},
@@ -87,11 +90,13 @@ func NewAgentHTTPClient(endpoint string) AgentHTTPClientInterface {
 }
 
 func (c *AgentHTTPClient) Run(ctx context.Context, systemPrompt, query string, outputSchema json.RawMessage, agentCtx *agentContext) (*agentRunResponse, error) {
+	timeoutMs := int64(c.httpClient.Timeout / time.Millisecond)
 	req := agentRunRequest{
 		Query:        query,
 		SystemPrompt: systemPrompt,
 		OutputSchema: outputSchema,
 		Context:      agentCtx,
+		TimeoutMs:    &timeoutMs,
 	}
 
 	body, err := json.Marshal(req)
diff --git a/controller/proposal/client_test.go b/controller/proposal/client_test.go
@@ -35,7 +35,7 @@ func TestAgentHTTPClient_RunSuccess(t *testing.T) {
 	}))
 	defer server.Close()
 
-	client := NewAgentHTTPClient(server.URL)
+	client := NewAgentHTTPClient(server.URL, 0)
 	resp, err := client.Run(context.Background(), "You are an SRE agent", "check health", nil, nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
@@ -52,15 +52,15 @@ func TestAgentHTTPClient_RunHTTPError(t *testing.T) {
 	}))
 	defer server.Close()
 
-	client := NewAgentHTTPClient(server.URL)
+	client := NewAgentHTTPClient(server.URL, 0)
 	_, err := client.Run(context.Background(), "", "test", nil, nil)
 	if err == nil {
 		t.Fatal("expected error for HTTP 500")
 	}
 }
 
 func TestAgentHTTPClient_RunConnectionError(t *testing.T) {
-	client := NewAgentHTTPClient("http://127.0.0.1:1")
+	client := NewAgentHTTPClient("http://127.0.0.1:1", 0)
 	_, err := client.Run(context.Background(), "", "test", nil, nil)
 	if err == nil {
 		t.Fatal("expected error for connection failure")
@@ -100,7 +100,7 @@ func TestAgentHTTPClient_RunWithExecutionResult(t *testing.T) {
 	}))
 	defer server.Close()
 
-	client := NewAgentHTTPClient(server.URL)
+	client := NewAgentHTTPClient(server.URL, 0)
 	agentCtx := &agentContext{
 		TargetNamespaces: []string{"production"},
 		ExecutionResult: &agentExecutionResult{
@@ -135,7 +135,7 @@ func TestAgentHTTPClient_RunWithoutExecutionResult(t *testing.T) {
 	}))
 	defer server.Close()
 
-	client := NewAgentHTTPClient(server.URL)
+	client := NewAgentHTTPClient(server.URL, 0)
 	agentCtx := &agentContext{
 		TargetNamespaces: []string{"production"},
 	}
@@ -169,7 +169,7 @@ func TestAgentHTTPClient_RunWithContext(t *testing.T) {
 	}))
 	defer server.Close()
 
-	client := NewAgentHTTPClient(server.URL)
+	client := NewAgentHTTPClient(server.URL, 0)
 	agentCtx := &agentContext{
 		TargetNamespaces: []string{"production"},
 		PreviousAttempts: []agentPreviousAttempt{{Attempt: 1, FailureReason: "timeout"}},
diff --git a/controller/proposal/handlers.go b/controller/proposal/handlers.go
@@ -58,7 +58,8 @@ func (r *ProposalReconciler) handleAnalysis(
 		return ctrl.Result{}, fmt.Errorf("update to Analyzing: %w", err)
 	}
 
-	analysisResult, err := r.Agent.Analyze(ctx, proposal, resolved.Analysis, proposal.Spec.Request)
+	timeout := proposalTimeout(proposal)
+	analysisResult, err := r.Agent.Analyze(ctx, proposal, resolved.Analysis, proposal.Spec.Request, timeout)
 	if err != nil {
 		return r.failStep(ctx, log, proposal, agenticv1alpha1.ProposalConditionAnalyzed, err)
 	}
@@ -124,7 +125,8 @@ func (r *ProposalReconciler) handleRevision(
 	revisionSuffix := buildRevisionContext(proposal)
 	requestWithRevision := proposal.Spec.Request + "\n\n" + revisionSuffix
 
-	analysisResult, err := r.Agent.Analyze(ctx, proposal, resolved.Analysis, requestWithRevision)
+	timeout := proposalTimeout(proposal)
+	analysisResult, err := r.Agent.Analyze(ctx, proposal, resolved.Analysis, requestWithRevision, timeout)
 	if err != nil {
 		return r.failStep(ctx, log, proposal, agenticv1alpha1.ProposalConditionAnalyzed, err)
 	}
@@ -240,7 +242,8 @@ func (r *ProposalReconciler) handleExecution(
 		return ctrl.Result{}, fmt.Errorf("update to Executing: %w", err)
 	}
 
-	execResult, err := r.Agent.Execute(ctx, proposal, *resolved.Execution, selectedOption)
+	timeout := proposalTimeout(proposal)
+	execResult, err := r.Agent.Execute(ctx, proposal, *resolved.Execution, selectedOption, timeout)
 	if err != nil {
 		return r.failStep(ctx, log, proposal, agenticv1alpha1.ProposalConditionExecuted, err)
 	}
@@ -343,7 +346,8 @@ func (r *ProposalReconciler) handleVerification(
 		}
 	}
 
-	verifyResult, err := r.Agent.Verify(ctx, proposal, *resolved.Verification, selectedOption, execOutput)
+	timeout := proposalTimeout(proposal)
+	verifyResult, err := r.Agent.Verify(ctx, proposal, *resolved.Verification, selectedOption, execOutput, timeout)
 	if err != nil {
 		return r.failStep(ctx, log, proposal, agenticv1alpha1.ProposalConditionVerified, err)
 	}
@@ -503,7 +507,8 @@ func (r *ProposalReconciler) handleEscalation(
 	}
 
 	escalationText := buildEscalationRequest(proposal)
-	escalationResult, err := r.Agent.Escalate(ctx, proposal, step, escalationText)
+	timeout := proposalTimeout(proposal)
+	escalationResult, err := r.Agent.Escalate(ctx, proposal, step, escalationText, timeout)
 	if err != nil {
 		return r.failStep(ctx, log, proposal, agenticv1alpha1.ProposalConditionEscalated, err)
 	}
diff --git a/controller/proposal/reconciler.go b/controller/proposal/reconciler.go
@@ -41,6 +41,7 @@ type ProposalReconciler struct {
 // +kubebuilder:rbac:groups=agentic.openshift.io,resources=analysisresults/status;executionresults/status;verificationresults/status;escalationresults/status,verbs=get;patch;update
 // +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles;rolebindings,verbs=get;create;delete
 // +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles;clusterrolebindings,verbs=get;create;delete
+// +kubebuilder:rbac:groups="",resources=persistentvolumeclaims,verbs=get;list;watch
 
 func (r *ProposalReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 	log := r.Log.WithValues("proposal", req.NamespacedName)
diff --git a/controller/proposal/reconciler_test.go b/controller/proposal/reconciler_test.go
@@ -36,32 +36,32 @@ type testAgentCaller struct {
 
 func newTestAgentCaller() *testAgentCaller {
 	stub := &StubAgentCaller{}
-	a, _ := stub.Analyze(context.Background(), nil, resolvedStep{}, "")
-	e, _ := stub.Execute(context.Background(), nil, resolvedStep{}, nil)
-	v, _ := stub.Verify(context.Background(), nil, resolvedStep{}, nil, nil)
-	esc, _ := stub.Escalate(context.Background(), nil, resolvedStep{}, "")
+	a, _ := stub.Analyze(context.Background(), nil, resolvedStep{}, "", 0)
+	e, _ := stub.Execute(context.Background(), nil, resolvedStep{}, nil, 0)
+	v, _ := stub.Verify(context.Background(), nil, resolvedStep{}, nil, nil, 0)
+	esc, _ := stub.Escalate(context.Background(), nil, resolvedStep{}, "", 0)
 	return &testAgentCaller{analyzeResult: a, executeResult: e, verifyResult: v, escalateResult: esc}
 }
 
-func (ta *testAgentCaller) Analyze(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ string) (*AnalysisOutput, error) {
+func (ta *testAgentCaller) Analyze(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ string, _ time.Duration) (*AnalysisOutput, error) {
 	if ta.analyzeErr != nil {
 		return nil, ta.analyzeErr
 	}
 	return ta.analyzeResult, nil
 }
-func (ta *testAgentCaller) Execute(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ *agenticv1alpha1.RemediationOption) (*ExecutionOutput, error) {
+func (ta *testAgentCaller) Execute(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ *agenticv1alpha1.RemediationOption, _ time.Duration) (*ExecutionOutput, error) {
 	if ta.executeErr != nil {
 		return nil, ta.executeErr
 	}
 	return ta.executeResult, nil
 }
-func (ta *testAgentCaller) Verify(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ *agenticv1alpha1.RemediationOption, _ *ExecutionOutput) (*VerificationOutput, error) {
+func (ta *testAgentCaller) Verify(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ *agenticv1alpha1.RemediationOption, _ *ExecutionOutput, _ time.Duration) (*VerificationOutput, error) {
 	if ta.verifyErr != nil {
 		return nil, ta.verifyErr
 	}
 	return ta.verifyResult, nil
 }
-func (ta *testAgentCaller) Escalate(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ string) (*EscalationOutput, error) {
+func (ta *testAgentCaller) Escalate(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ string, _ time.Duration) (*EscalationOutput, error) {
 	if ta.escalateErr != nil {
 		return nil, ta.escalateErr
 	}
@@ -248,7 +248,7 @@ func newMockSandboxAgent(analysisJSON, executionJSON, verificationJSON string) (
 	caller := &SandboxAgentCaller{
 		Sandbox:   sandbox,
 		K8sClient: fc,
-		ClientFactory: func(_ string) AgentHTTPClientInterface {
+		ClientFactory: func(_ string, _ time.Duration) AgentHTTPClientInterface {
 			resp := responses[callCount%len(responses)]
 			callCount++
 			httpClient.response = &agentRunResponse{Response: json.RawMessage(resp)}
diff --git a/controller/proposal/sandbox_agent.go b/controller/proposal/sandbox_agent.go
diff --git a/controller/proposal/sandbox_agent_test.go b/controller/proposal/sandbox_agent_test.go

Original file line number	Diff line number	Diff line change
`@@ -58,7 +58,8 @@ func (r *ProposalReconciler) handleAnalysis(`
`58`	`58`	`return ctrl.Result{}, fmt.Errorf("update to Analyzing: %w", err)`
`59`	`59`	`}`
`60`	`60`
`61`		`- analysisResult, err := r.Agent.Analyze(ctx, proposal, resolved.Analysis, proposal.Spec.Request)`
	`61`	`+ timeout := proposalTimeout(proposal)`
	`62`	`+ analysisResult, err := r.Agent.Analyze(ctx, proposal, resolved.Analysis, proposal.Spec.Request, timeout)`
`62`	`63`	`if err != nil {`
`63`	`64`	`return r.failStep(ctx, log, proposal, agenticv1alpha1.ProposalConditionAnalyzed, err)`
`64`	`65`	`}`
`@@ -124,7 +125,8 @@ func (r *ProposalReconciler) handleRevision(`
`124`	`125`	`revisionSuffix := buildRevisionContext(proposal)`
`125`	`126`	`requestWithRevision := proposal.Spec.Request + "\n\n" + revisionSuffix`
`126`	`127`
`127`		`- analysisResult, err := r.Agent.Analyze(ctx, proposal, resolved.Analysis, requestWithRevision)`
	`128`	`+ timeout := proposalTimeout(proposal)`
	`129`	`+ analysisResult, err := r.Agent.Analyze(ctx, proposal, resolved.Analysis, requestWithRevision, timeout)`
`128`	`130`	`if err != nil {`
`129`	`131`	`return r.failStep(ctx, log, proposal, agenticv1alpha1.ProposalConditionAnalyzed, err)`
`130`	`132`	`}`
`@@ -240,7 +242,8 @@ func (r *ProposalReconciler) handleExecution(`
`240`	`242`	`return ctrl.Result{}, fmt.Errorf("update to Executing: %w", err)`
`241`	`243`	`}`
`242`	`244`
`243`		`- execResult, err := r.Agent.Execute(ctx, proposal, *resolved.Execution, selectedOption)`
	`245`	`+ timeout := proposalTimeout(proposal)`
	`246`	`+ execResult, err := r.Agent.Execute(ctx, proposal, *resolved.Execution, selectedOption, timeout)`
`244`	`247`	`if err != nil {`
`245`	`248`	`return r.failStep(ctx, log, proposal, agenticv1alpha1.ProposalConditionExecuted, err)`
`246`	`249`	`}`
`@@ -343,7 +346,8 @@ func (r *ProposalReconciler) handleVerification(`
`343`	`346`	`}`
`344`	`347`	`}`
`345`	`348`
`346`		`- verifyResult, err := r.Agent.Verify(ctx, proposal, *resolved.Verification, selectedOption, execOutput)`
	`349`	`+ timeout := proposalTimeout(proposal)`
	`350`	`+ verifyResult, err := r.Agent.Verify(ctx, proposal, *resolved.Verification, selectedOption, execOutput, timeout)`
`347`	`351`	`if err != nil {`
`348`	`352`	`return r.failStep(ctx, log, proposal, agenticv1alpha1.ProposalConditionVerified, err)`
`349`	`353`	`}`
`@@ -503,7 +507,8 @@ func (r *ProposalReconciler) handleEscalation(`
`503`	`507`	`}`
`504`	`508`
`505`	`509`	`escalationText := buildEscalationRequest(proposal)`
`506`		`- escalationResult, err := r.Agent.Escalate(ctx, proposal, step, escalationText)`
	`510`	`+ timeout := proposalTimeout(proposal)`
	`511`	`+ escalationResult, err := r.Agent.Escalate(ctx, proposal, step, escalationText, timeout)`
`507`	`512`	`if err != nil {`
`508`	`513`	`return r.failStep(ctx, log, proposal, agenticv1alpha1.ProposalConditionEscalated, err)`
`509`	`514`	`}`