Add OSC plugins to container

This commit changes our container image because it's currently missing
almost all the OSC plugins, unlike the `openstackclient` image.

In this patch we ensure the image includes the plugins by:

* Adding the plugins to the project dependencies in the `osc-plugin`
  dependency group.

* Changing the source for all our openstack related packages, so instead
  of using PyPi to install them we use RPMs by using the
  `openstackclient` container image as the base.

* We use the Centos 10 base image of the `openstackclient` container so
  it has Python 3.12 instead of 3.9 that is in the Centos 9 container
  (quay.io/podified-antelope-centos9/openstack-openstackclient:current-podified)
  because the MCP python library has a minimum requirement of Python
  3.10.

This not only resolves the missing plugins, but also ensures that the
packages used are not coming from PyPi, facilitating a more
secure downstream release.

Available plugins are sent as part of the `openstack-cli` MCP tool
description to help LLMs know what is installed, as they may assume only
basic commands are available.

We also update the allowed commands on read-only mode.

Author: Akrog

Containerfile

@@ -1,4 +1,8 @@
-FROM registry.access.redhat.com/ubi9/python-312:latest AS builder
+# Use this base image so everything comes from RPM packages (including OSC plugins)
+ARG BUILDER_IMAGE=quay.rdoproject.org/podified-master-centos10/openstack-openstackclient:current-tested
+ARG BASE_IMAGE=quay.rdoproject.org/podified-master-centos10/openstack-openstackclient:current-tested
+
+FROM $BUILDER_IMAGE AS builder
 
 WORKDIR /app
 
@@ -7,7 +11,30 @@ COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
 
 # Copy dependency manifests and README first (build backend needs README.md).
 # Dependency layer is reused when only application code changes.
-COPY pyproject.toml uv.lock README.md ./
+COPY --chown=cloud-admin:cloud-admin pyproject.toml uv.lock README.md ./
+
+# Using `--no-install-package` in `uv sync` for these 3 packages only prevents
+# the top level package from installing, not their dependencies, installing
+# incompatible versions of the dependencies.
+RUN cat <<EOF >> pyproject.toml
+[tool.uv]
+exclude-dependencies = [
+    "openstackclient",
+    "python-openstackclient",
+    "stevedore"
+]
+EOF
+
+# This should be safe because uv’s resolver is highly conservative and should
+# keep every existing package pinned to its current locked version.
+# Checked this with `uv lock --dry-run`
+RUN uv lock
+
+# Create the virtual environment enabling system's site-packages (RPM packages
+# from base container) since `uv sync` doesn't support it.
+RUN uv venv --system-site-packages /app/.venv
+
+# Install dependencies but without the packages that come from the base image
 RUN uv sync --frozen --no-dev --no-editable --no-install-project
 
 # Copy application code and install the package into the venv.
@@ -20,7 +47,7 @@ RUN curl -o oc.tar.gz https://mirror.openshift.com/pub/openshift-v4/clients/ocp/
     rm oc.tar.gz
 
 # Final stage: smaller image without uv or build tools.
-FROM registry.access.redhat.com/ubi9/python-312:latest
+FROM $BASE_IMAGE
 
 LABEL com.redhat.component="rhos-ls-mcps" \
       name="openstack-lightspeed/rhos-mcps" \

pyproject.toml

@@ -25,6 +25,22 @@ dev = [
     "pre-commit>=4.6.0"
 ]
 
+osc-plugins = [
+    "osc-placement",
+    "python-barbicanclient",
+    "python-designateclient",
+    "python-glanceclient",
+    "python-heatclient",
+    "python-ironicclient",
+    "python-ironic-inspector-client",
+    "python-manilaclient",
+    "python-observabilityclient",
+    "python-octaviaclient",
+    "aodhclient",
+    "python-cloudkittyclient",
+    "python-watcherclient",
+]
+
 [build-system]
 requires = ["uv_build>=0.11.16,<0.12"]
 build-backend = "uv_build"

scripts/allow-deny-list.py

@@ -151,6 +151,11 @@
     "metric_benchmark measures add",
     "metric_measures_batch-metrics",
     "metric_measures_batch-resources-metrics",
+    "metric_clean-tombstones",
+    "metric_snapshot",
+    "rating_scope_patch",
+    "share_service_ensure_shares",
+    "share_replica_resync",
     # This sounds intrusive: https://docs.openstack.org/senlin/rocky/user/nodes.html#checking-a-node
     "cluster_node_check",
 }
@@ -183,6 +188,11 @@
     "workflow_engine_",
     "data_processing_",
     "orchestration_",
+    "observabilityclient_",
+    "placement_",
+    "share_",
+    "alarm_",
+    "rating_",
 }