sq

raptorsun · raptorsun · commit 05010181f4b1 · 2026-03-31T18:57:20.000+02:00
Signed-off-by: Haoyu Sun &lt;hasun@redhat.com&gt;
diff --git a/Containerfile b/Containerfile
@@ -1,7 +1,7 @@
 # vim: set filetype=dockerfile
 ARG LIGHTSPEED_RAG_CONTENT_IMAGE=quay.io/redhat-user-workloads/crt-nshift-lightspeed-tenant/own-app-lightspeed-rag-content@sha256:51c25627274f0c8a1651dbc986a713bf4fc388b1b1037e3df759a28049d81382
-ARG BUILDER_BASE_IMAGE=registry.access.redhat.com/ubi9/python-312
-ARG RUNTIME_BASE_IMAGE=registry.access.redhat.com/ubi9/python-312-minimal
+ARG BUILDER_BASE_IMAGE=registry.redhat.io/rhel9/python-312@sha256:46f883684d02cef2a7abb0c4124f18308ad920018d76c5c56f130dae02bfed05
+ARG RUNTIME_BASE_IMAGE=registry.redhat.io/rhel9/python-312-minimal@sha256:804b928fd278fa03c2edf0352378eca73c8efcf665c6e0180e074340b9f22a50
 FROM --platform=linux/amd64 ${LIGHTSPEED_RAG_CONTENT_IMAGE} AS lightspeed-rag-content
 
 FROM --platform=$BUILDPLATFORM ${BUILDER_BASE_IMAGE} AS builder
diff --git a/README.md b/README.md
@@ -18,98 +18,98 @@ configure model, and connect to it.
 <!-- the following line is used by tool to autogenerate Table of Content when the document is changed -->
 <!-- vim-markdown-toc GFM -->
 
-* [About The Project](#about-the-project)
-* [Prerequisites](#prerequisites)
-* [Installation](#installation)
-   * [1. Clone the repo](#1-clone-the-repo)
-   * [2. Install python packages](#2-install-python-packages)
-   * [3. Get API keys](#3-get-api-keys)
-      * [OpenAI](#openai)
-      * [Azure OpenAI](#azure-openai)
-      * [WatsonX](#watsonx)
-      * [OpenShift AI](#openshift-ai)
-      * [RHEL AI](#rhel-ai)
-      * [Locally running InstructLab](#locally-running-instructlab)
-   * [4. Store local copies of API keys securely](#4-store-local-copies-of-api-keys-securely)
-* [Configuration](#configuration)
-   * [1. Configure OpenShift LightSpeed (OLS)](#1-configure-openshift-lightspeed-ols)
-   * [2. Configure LLM providers](#2-configure-llm-providers)
-      * [OpenAI provider](#openai-provider)
-      * [Azure OpenAI](#azure-openai-1)
-      * [WatsonX](#watsonx-1)
-      * [RHEL AI provider](#rhel-ai-provider)
-      * [Red Hat OpenShift AI](#red-hat-openshift-ai)
-      * [Local *ollama* server](#local-ollama-server)
-   * [3. Configure OLS Authentication](#3-configure-ols-authentication)
-      * [3.1. K8S-based auth mechanism](#31-k8s-based-auth-mechanism)
-      * [3.2. no-op auth mechanism](#32-no-op-auth-mechanism)
-   * [4. Configure OLS TLS communication](#4-configure-ols-tls-communication)
-   * [5. (Optional) Configure RAG](#5-optional-configure-rag)
-      * [5.1 OCP documentation](#51-ocp-documentation)
-      * [5.2 BYOK](#52-byok)
-      * [5.3 Confirming the OLS is loading the configured vector databases.](#53-confirming-the-ols-is-loading-the-configured-vector-databases)
-   * [6. (Optional) Configure conversation cache](#6-optional-configure-conversation-cache)
-   * [7. (Optional) Incorporating additional CA(s). You have the option to include an extra TLS certificate into the OLS trust store as follows.](#7-optional-incorporating-additional-cas-you-have-the-option-to-include-an-extra-tls-certificate-into-the-ols-trust-store-as-follows)
-   * [8. (Optional) Configure the number of workers](#8-optional-configure-the-number-of-workers)
-   * [9. Registering a new LLM provider](#9-registering-a-new-llm-provider)
-   * [10. TLS security profiles](#10-tls-security-profiles)
-   * [11. System prompt](#11-system-prompt)
-   * [12. Quota limits](#12-quota-limits)
-      * [Tokens and token quota limits](#tokens-and-token-quota-limits)
-      * [Quota limiter features](#quota-limiter-features)
-      * [Configuration format](#configuration-format)
-   * [13. Configuration dump](#13-configuration-dump)
-   * [14. Cluster introspection](#14-cluster-introspection)
-   * [MCP Server Configuration](#mcp-server-configuration)
-      * [Basic Configuration](#basic-configuration)
-      * [MCP Server Authentication](#mcp-server-authentication)
-         * [1. Static Tokens from Files (Recommended for Service Credentials)](#1-static-tokens-from-files-recommended-for-service-credentials)
-         * [2. Kubernetes Token (User Context)](#2-kubernetes-token-user-context)
-         * [3. Client-Provided Tokens (Per-Request)](#3-client-provided-tokens-per-request)
-      * [OpenShift MCP Server Example](#openshift-mcp-server-example)
-* [Usage](#usage)
-   * [Deployments](#deployments)
-      * [Local Deployment](#local-deployment)
-         * [Run the server](#run-the-server)
-      * [Optionally run with podman](#optionally-run-with-podman)
-      * [Validation if the logged-in user is authorized to access service](#validation-if-the-logged-in-user-is-authorized-to-access-service)
-      * [Swagger UI](#swagger-ui)
-      * [OpenAPI](#openapi)
-      * [Metrics](#metrics)
-      * [Gradio UI](#gradio-ui)
-      * [Swagger UI](#swagger-ui-1)
-      * [CPU profiling](#cpu-profiling)
-      * [Memory profiling](#memory-profiling)
-   * [Deploying OLS on OpenShift](#deploying-ols-on-openshift)
-* [Project structure](#project-structure)
-   * [Overall architecture](#overall-architecture)
-      * [FastAPI server](#fastapi-server)
-      * [Authorization checker](#authorization-checker)
-      * [Query handler](#query-handler)
-      * [Redactor](#redactor)
-      * [Question validator](#question-validator)
-      * [Document summarizer](#document-summarizer)
-      * [Conversation history cache interface](#conversation-history-cache-interface)
-      * [Conversation history cache implementations](#conversation-history-cache-implementations)
-         * [In-memory cache](#in-memory-cache)
-         * [Postgres cache](#postgres-cache)
-      * [LLM providers registry](#llm-providers-registry)
-      * [LLM providers interface implementations](#llm-providers-interface-implementations)
-   * [Sequence diagram](#sequence-diagram)
-   * [Token truncation algorithm](#token-truncation-algorithm)
-* [Development workflow](#development-workflow)
-* [Additional tools](#additional-tools)
-   * [Utility to generate OpenAPI schema](#utility-to-generate-openapi-schema)
-      * [Path](#path)
-      * [Usage](#usage-1)
-* [Konflux](#konflux)
-   * [Updating Dependencies for Hermetic Builds](#updating-dependencies-for-hermetic-builds)
-      * [When to Update Dependency Files](#when-to-update-dependency-files)
-      * [Updating Python Dependencies](#updating-python-dependencies)
-      * [Updating RPM Dependencies](#updating-rpm-dependencies)
-   * [Question and Answer Quality Evaluation](#question-and-answer-quality-evaluation)
-* [Contributing](#contributing)
-* [License](#license)
+- [About The Project](#about-the-project)
+- [Prerequisites](#prerequisites)
+- [Installation](#installation)
+  - [1. Clone the repo](#1-clone-the-repo)
+  - [2. Install python packages](#2-install-python-packages)
+  - [3. Get API keys](#3-get-api-keys)
+    - [OpenAI](#openai)
+    - [Azure OpenAI](#azure-openai)
+    - [WatsonX](#watsonx)
+    - [OpenShift AI](#openshift-ai)
+    - [RHEL AI](#rhel-ai)
+    - [Locally running InstructLab](#locally-running-instructlab)
+  - [4. Store local copies of API keys securely](#4-store-local-copies-of-api-keys-securely)
+- [Configuration](#configuration)
+  - [1. Configure OpenShift LightSpeed (OLS)](#1-configure-openshift-lightspeed-ols)
+  - [2. Configure LLM providers](#2-configure-llm-providers)
+    - [OpenAI provider](#openai-provider)
+    - [Azure OpenAI](#azure-openai-1)
+    - [WatsonX](#watsonx-1)
+    - [RHEL AI provider](#rhel-ai-provider)
+    - [Red Hat OpenShift AI](#red-hat-openshift-ai)
+    - [Local *ollama* server](#local-ollama-server)
+  - [3. Configure OLS Authentication](#3-configure-ols-authentication)
+    - [3.1. K8S-based auth mechanism](#31-k8s-based-auth-mechanism)
+    - [3.2. no-op auth mechanism](#32-no-op-auth-mechanism)
+  - [4. Configure OLS TLS communication](#4-configure-ols-tls-communication)
+  - [5. (Optional) Configure RAG](#5-optional-configure-rag)
+    - [5.1 OCP documentation](#51-ocp-documentation)
+    - [5.2 BYOK](#52-byok)
+    - [5.3 Confirming the OLS is loading the configured vector databases.](#53-confirming-the-ols-is-loading-the-configured-vector-databases)
+  - [6. (Optional) Configure conversation cache](#6-optional-configure-conversation-cache)
+  - [7. (Optional) Incorporating additional CA(s). You have the option to include an extra TLS certificate into the OLS trust store as follows.](#7-optional-incorporating-additional-cas-you-have-the-option-to-include-an-extra-tls-certificate-into-the-ols-trust-store-as-follows)
+  - [8. (Optional) Configure the number of workers](#8-optional-configure-the-number-of-workers)
+  - [9. Registering a new LLM provider](#9-registering-a-new-llm-provider)
+  - [10. TLS security profiles](#10-tls-security-profiles)
+  - [11. System prompt](#11-system-prompt)
+  - [12. Quota limits](#12-quota-limits)
+    - [Tokens and token quota limits](#tokens-and-token-quota-limits)
+    - [Quota limiter features](#quota-limiter-features)
+    - [Configuration format](#configuration-format)
+  - [13. Configuration dump](#13-configuration-dump)
+  - [14. Cluster introspection](#14-cluster-introspection)
+  - [MCP Server Configuration](#mcp-server-configuration)
+    - [Basic Configuration](#basic-configuration)
+    - [MCP Server Authentication](#mcp-server-authentication)
+      - [1. Static Tokens from Files (Recommended for Service Credentials)](#1-static-tokens-from-files-recommended-for-service-credentials)
+      - [2. Kubernetes Token (User Context)](#2-kubernetes-token-user-context)
+      - [3. Client-Provided Tokens (Per-Request)](#3-client-provided-tokens-per-request)
+    - [OpenShift MCP Server Example](#openshift-mcp-server-example)
+- [Usage](#usage)
+  - [Deployments](#deployments)
+    - [Local Deployment](#local-deployment)
+      - [Run the server](#run-the-server)
+    - [Optionally run with podman](#optionally-run-with-podman)
+    - [Validation if the logged-in user is authorized to access service](#validation-if-the-logged-in-user-is-authorized-to-access-service)
+    - [Swagger UI](#swagger-ui)
+    - [OpenAPI](#openapi)
+    - [Metrics](#metrics)
+    - [Gradio UI](#gradio-ui)
+    - [Swagger UI](#swagger-ui-1)
+    - [CPU profiling](#cpu-profiling)
+    - [Memory profiling](#memory-profiling)
+  - [Deploying OLS on OpenShift](#deploying-ols-on-openshift)
+- [Project structure](#project-structure)
+  - [Overall architecture](#overall-architecture)
+    - [FastAPI server](#fastapi-server)
+    - [Authorization checker](#authorization-checker)
+    - [Query handler](#query-handler)
+    - [Redactor](#redactor)
+    - [Question validator](#question-validator)
+    - [Document summarizer](#document-summarizer)
+    - [Conversation history cache interface](#conversation-history-cache-interface)
+    - [Conversation history cache implementations](#conversation-history-cache-implementations)
+      - [In-memory cache](#in-memory-cache)
+      - [Postgres cache](#postgres-cache)
+    - [LLM providers registry](#llm-providers-registry)
+    - [LLM providers interface implementations](#llm-providers-interface-implementations)
+  - [Sequence diagram](#sequence-diagram)
+  - [Token truncation algorithm](#token-truncation-algorithm)
+- [Development workflow](#development-workflow)
+- [Additional tools](#additional-tools)
+  - [Utility to generate OpenAPI schema](#utility-to-generate-openapi-schema)
+    - [Path](#path)
+    - [Usage](#usage-1)
+- [Konflux](#konflux)
+  - [Updating Dependencies for Hermetic Builds](#updating-dependencies-for-hermetic-builds)
+    - [When to Update Dependency Files](#when-to-update-dependency-files)
+    - [Updating Python Dependencies](#updating-python-dependencies)
+    - [Updating RPM Dependencies](#updating-rpm-dependencies)
+- [Question and Answer Quality Evaluation](#question-and-answer-quality-evaluation)
+- [Contributing](#contributing)
+- [License](#license)
 
 <!-- vim-markdown-toc -->
 
@@ -1177,7 +1177,7 @@ make schema
 # Konflux
 
 The official image of Lightspeed Service is built on [Konflux](https://konflux-ui.apps.stone-prd-rh01.pg1f.p1.openshiftapps.com/ns/crt-nshift-lightspeed-tenant/applications/ols).
-We have both x86_64 and ARM64 images.
+We have both amd64 and aarch64 images.
 
 ## Updating Dependencies for Hermetic Builds
 
@@ -1211,19 +1211,18 @@ The script also updates the Tekton pipeline configurations (`.tekton/lightspeed-
 **Prerequisites:**
 - Install [rpm-lockfile-prototype](https://github.com/konflux-ci/rpm-lockfile-prototype?tab=readme-ov-file#installation)
 - Have an active RHEL Subscription, get activation keys from [RH console](https://console.redhat.com/insights/connector/activation-keys)
-- Have `dnf` installed in system
 
 **Steps:**
 
 1. **List your RPM packages** in `rpms.in.yaml` under the `packages` field
 
 2. **If you changed the base image**, extract its repo file:
 ```shell
-# UBI images
-podman run -it $BASE_IMAGE cat /etc/yum.repos.d/ubi.repo > ubi.repo
 # RHEL images
 podman run -it $BASE_IMAGE cat /etc/yum.repos.d/redhat.repo > redhat.repo
 ```
+The base image is configured: 1. directly in the [ContainerFile](Containerfile) for Prow CI builds. 2. in [build.args](build.args) for Konflux builds.
+
 If the repo file contains too many entries, we can filter them and keep only required repositories.
 Here is the command to check active repositories:
 ```shell
@@ -1242,7 +1241,7 @@ make konflux-rpm-lock
 This creates `rpms.lock.yaml` with pinned RPM versions.
 
 
-## Question and Answer Quality Evaluation
+# Question and Answer Quality Evaluation
 There is an extensive suite of evaluation tools and scripts available in this
 repository if you are interested in exploring different LLMs and their
 performance. Please look at
diff --git a/scripts/generate-rpm-lock.sh b/scripts/generate-rpm-lock.sh
