Add OSC plugins to container

This commit changes our container image because it's currently missing
almost all the OSC plugins, unlike the `openstackclient` image.

In this patch we ensure the image includes the plugins by:

* Adding the plugins to the project dependencies in the `osc-plugin`
  dependency group.

* Changing the source for all our openstack related packages, so instead
  of using PyPi to install them we use RPMs by using the
  `openstackclient` container image as the base.

* We use the Centos 10 base image of the `openstackclient` container so
  it has Python 3.12 instead of 3.9 that is in the Centos 9 container
  (quay.io/podified-antelope-centos9/openstack-openstackclient:current-podified)
  because the MCP python library has a minimum requirement of Python
  3.10.

This not only resolves the missing plugins, but also ensures that the
packages used are not coming from PyPi, facilitating a more
secure downstream release.

Available plugins are sent as part of the `openstack-cli` MCP tool
description to help LLMs know what is installed, as they may assume only
basic commands are available.

We also update the allowed commands on read-only mode.

Author: Akrog

Containerfile

@@ -1,4 +1,8 @@
-FROM registry.access.redhat.com/ubi9/python-312:latest AS builder
+# Use this base image so everything comes from RPM packages (including OSC plugins)
+ARG BUILDER_IMAGE=quay.rdoproject.org/podified-master-centos10/openstack-openstackclient:current-tested
+ARG BASE_IMAGE=quay.rdoproject.org/podified-master-centos10/openstack-openstackclient:current-tested
+
+FROM $BUILDER_IMAGE AS builder
 
 WORKDIR /app
 
@@ -8,19 +12,29 @@ COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
 # Copy dependency manifests and README first (build backend needs README.md).
 # Dependency layer is reused when only application code changes.
 COPY pyproject.toml uv.lock README.md ./
-RUN uv sync --frozen --no-dev --no-editable --no-install-project
+# Install dependencies but without the packages that come from the base image
+RUN uv sync --frozen --no-dev --no-editable --no-install-project \
+  --no-install-package openstackclient \
+  --no-install-package python-openstackclient \
+  --no-install-package stevedore
 
 # Copy application code and install the package into the venv.
 COPY src/ src/
-RUN uv sync --frozen --no-dev --no-editable
+RUN uv sync --frozen --no-dev --no-editable \
+  --no-install-package openstackclient \
+  --no-install-package python-openstackclient \
+  --no-install-package stevedore
+
+# FIX: Manually force the venv to look at system RPM packages at runtime
+RUN sed -i 's/include-system-site-packages = false/include-system-site-packages = true/' /app/.venv/pyvenv.cfg
 
 RUN curl -o oc.tar.gz https://mirror.openshift.com/pub/openshift-v4/clients/ocp/stable-4.18/openshift-client-linux.tar.gz && \
     tar xvf oc.tar.gz oc && \
     chmod +x oc && \
     rm oc.tar.gz
 
 # Final stage: smaller image without uv or build tools.
-FROM registry.access.redhat.com/ubi9/python-312:latest
+FROM $BASE_IMAGE
 
 LABEL com.redhat.component="rhos-ls-mcps" \
       name="openstack-lightspeed/rhos-mcps" \

pyproject.toml

@@ -25,6 +25,22 @@ dev = [
     "pre-commit>=4.6.0"
 ]
 
+osc-plugins = [
+    "osc-placement",
+    "python-barbicanclient",
+    "python-designateclient",
+    "python-glanceclient",
+    "python-heatclient",
+    "python-ironicclient",
+    "python-ironic-inspector-client",
+    "python-manilaclient",
+    "python-observabilityclient",
+    "python-octaviaclient",
+    "aodhclient",
+    "python-cloudkittyclient",
+    "python-watcherclient",
+]
+
 [build-system]
 requires = ["uv_build>=0.11.16,<0.12"]
 build-backend = "uv_build"

scripts/allow-deny-list.py

@@ -151,6 +151,11 @@
     "metric_benchmark measures add",
     "metric_measures_batch-metrics",
     "metric_measures_batch-resources-metrics",
+    "metric_clean-tombstones",
+    "metric_snapshot",
+    "rating_scope_patch",
+    "share_service_ensure_shares",
+    "share_replica_resync",
     # This sounds intrusive: https://docs.openstack.org/senlin/rocky/user/nodes.html#checking-a-node
     "cluster_node_check",
 }
@@ -183,6 +188,11 @@
     "workflow_engine_",
     "data_processing_",
     "orchestration_",
+    "observabilityclient_",
+    "placement_",
+    "share_",
+    "alarm_",
+    "rating_",
 }