Add feature flag for rhos-mcps

For now we don't want to automatically deploy the MCP tools, because:

- Releasing the rhos-mcps image may be done at a later time.
- This is an experimental feature right now, so we want it disabled by
  default.

The name of the feature flag is `rhos_mcps` as shown in the config
ample.

Jira: OSPRH-27075
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Akrog

api/v1beta1/conditions.go

@@ -59,6 +59,9 @@ const (
 	// OpenStackLightspeedMCPServerWaitingOpenStack
 	OpenStackLightspeedMCPServerWaitingOpenStack = "MCP server deployed, waiting for OpenStackControlPlane to become ready"
 
+	// OpenStackLightspeedMCPServerDisabledMessage
+	OpenStackLightspeedMCPServerDisabledMessage = "RHOS MCP server is disabled (rhos_mcps feature flag not set)"
+
 	// DeploymentCheckFailedMessage
 	DeploymentCheckFailedMessage = "Failed to check deployment status: %s"
 

config/samples/api_v1beta1_openstacklightspeed.yaml

@@ -20,11 +20,13 @@ spec:
   #   ogxLogLevel: "all=info"
   #   lightspeedStackLogLevel: "INFO"
   #   dataverseExporterLogLevel: "INFO"
-  # Uncomment to enable OKP (Offline Knowledge Portal) as an Inline RAG source:
-  # okp:
-  #   accessKey: okp-access-key-secret
+  # Uncomment to enable RHOS MCPs (MCP server sidecar with OpenStack/OpenShift tools)
+  # and/or OKP (Offline Knowledge Portal) as an Inline RAG source:
   # dev:
   #   featureFlags:
+  #     - rhos_mcps
   #     - okp
   #   okpChunkFilterQuery: "product:(*openstack* OR *openshift*)"
   #   okpRagOnly: true
+  # okp:
+  #   accessKey: okp-access-key-secret

internal/controller/common.go

@@ -24,6 +24,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"slices"
 	"strings"
 
 	common_cm "github.com/openstack-k8s-operators/lib-common/modules/common/configmap"
@@ -165,6 +166,15 @@ func parseDevConfig(instance *apiv1beta1.OpenStackLightspeed) (apiv1beta1.DevSpe
 	return config, nil
 }
 
+// isRHOSMCPEnabled returns true if the "rhos_mcps" feature flag is present in the dev config.
+func isRHOSMCPEnabled(instance *apiv1beta1.OpenStackLightspeed) (bool, error) {
+	config, err := parseDevConfig(instance)
+	if err != nil {
+		return false, err
+	}
+	return slices.Contains(config.FeatureFlags, "rhos_mcps"), nil
+}
+
 // getOKPChunkFilterQuery returns the chunk filter query from the dev config, or a version-aware default.
 func getOKPChunkFilterQuery(ctx context.Context, h *common_helper.Helper, instance *apiv1beta1.OpenStackLightspeed) string {
 	config, _ := parseDevConfig(instance)

internal/controller/lcore_config.go

@@ -246,6 +246,17 @@ func buildLCoreMCPServersConfig(openStackReady bool) []interface{} {
 	return mcpServers
 }
 
+func buildLCoreMCPServersConfigIfEnabled(instance *apiv1beta1.OpenStackLightspeed) ([]interface{}, error) {
+	enabled, err := isRHOSMCPEnabled(instance)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse dev config: %w", err)
+	}
+	if !enabled {
+		return []interface{}{}, nil
+	}
+	return buildLCoreMCPServersConfig(instance.Status.OpenStackReady), nil
+}
+
 // buildLCoreConfigYAML assembles the complete Lightspeed Core Service configuration and converts to YAML.
 // NOTE: quota handlers, and tools approval features are disabled for OpenStack Lightspeed.
 func buildLCoreConfigYAML(ctx context.Context, h *common_helper.Helper, instance *apiv1beta1.OpenStackLightspeed) (string, error) {
@@ -255,6 +266,11 @@ func buildLCoreConfigYAML(ctx context.Context, h *common_helper.Helper, instance
 		"inline": ragInline,
 	}
 
+	mcpServers, err := buildLCoreMCPServersConfigIfEnabled(instance)
+	if err != nil {
+		return "", err
+	}
+
 	// Build the complete config as a map
 	config := map[string]interface{}{
 		"name":                 "Lightspeed Core Service (LCS)",
@@ -268,7 +284,7 @@ func buildLCoreConfigYAML(ctx context.Context, h *common_helper.Helper, instance
 		"conversation_cache":   buildLCoreConversationCacheConfig(h, instance),
 		"byok_rag":             []interface{}{},
 		"rag":                  ragConfig,
-		"mcp_servers":          buildLCoreMCPServersConfig(instance.Status.OpenStackReady),
+		"mcp_servers":          mcpServers,
 	}
 
 	config["okp"] = buildOKPConfig(ctx, h, instance)

internal/controller/lcore_deployment.go

@@ -205,26 +205,32 @@ func buildLCorePodTemplateSpec(h *common_helper.Helper, ctx context.Context, ins
 		containers = append(containers, exporterContainer)
 	}
 
-	// MCP sidecar
-	mcpMounts := []corev1.VolumeMount{}
-	addMCPVolumesAndMounts(&volumes, &mcpMounts, instance.Status.OpenStackReady)
-
-	mcpContainer := corev1.Container{
-		Name:         "rhos-mcp",
-		Image:        apiv1beta1.OpenStackLightspeedDefaultValues.MCPServerImageURL,
-		VolumeMounts: mcpMounts,
-		Resources: corev1.ResourceRequirements{
-			Requests: corev1.ResourceList{
-				corev1.ResourceCPU:    resource.MustParse("50m"),
-				corev1.ResourceMemory: resource.MustParse("64Mi"),
-			},
-			Limits: corev1.ResourceList{
-				corev1.ResourceMemory: resource.MustParse("200Mi"),
+	// MCP sidecar (only when rhos_mcps feature flag is enabled)
+	rhosMCPEnabled, err := isRHOSMCPEnabled(instance)
+	if err != nil {
+		return corev1.PodTemplateSpec{}, fmt.Errorf("failed to parse dev config: %w", err)
+	}
+	if rhosMCPEnabled {
+		mcpMounts := []corev1.VolumeMount{}
+		addMCPVolumesAndMounts(&volumes, &mcpMounts, instance.Status.OpenStackReady)
+
+		mcpContainer := corev1.Container{
+			Name:         "rhos-mcp",
+			Image:        apiv1beta1.OpenStackLightspeedDefaultValues.MCPServerImageURL,
+			VolumeMounts: mcpMounts,
+			Resources: corev1.ResourceRequirements{
+				Requests: corev1.ResourceList{
+					corev1.ResourceCPU:    resource.MustParse("50m"),
+					corev1.ResourceMemory: resource.MustParse("64Mi"),
+				},
+				Limits: corev1.ResourceList{
+					corev1.ResourceMemory: resource.MustParse("200Mi"),
+				},
 			},
-		},
-		ImagePullPolicy: corev1.PullIfNotPresent,
+			ImagePullPolicy: corev1.PullIfNotPresent,
+		}
+		containers = append(containers, mcpContainer)
 	}
-	containers = append(containers, mcpContainer)
 
 	// Build configmap resource version annotations for change detection
 	annotations, err := buildConfigMapAnnotations(h, ctx)

internal/controller/mcp_server.go

@@ -22,6 +22,7 @@ import (
 	"fmt"
 	"text/template"
 
+	"github.com/openstack-k8s-operators/lib-common/modules/common/condition"
 	common_helper "github.com/openstack-k8s-operators/lib-common/modules/common/helper"
 	apiv1beta1 "github.com/openstack-k8s-operators/lightspeed-operator/api/v1beta1"
 	corev1 "k8s.io/api/core/v1"
@@ -114,6 +115,38 @@ func GetMCPServerURL() string {
 // Reconciliation
 // ---------------------------------------------------------------------------
 
+// ReconcileMCPServerTask reconciles the MCP server as a ReconcileFunc.
+func (r *OpenStackLightspeedReconciler) ReconcileMCPServerTask(h *common_helper.Helper, ctx context.Context, instance *apiv1beta1.OpenStackLightspeed) error {
+	rhosMCPEnabled, err := isRHOSMCPEnabled(instance)
+	if err != nil {
+		return fmt.Errorf("failed to parse dev config: %w", err)
+	}
+	if rhosMCPEnabled {
+		openStackReady, mcpErr := r.ReconcileMCPServer(ctx, h, instance)
+		if mcpErr != nil {
+			instance.Status.Conditions.Set(condition.FalseCondition(
+				apiv1beta1.OpenStackLightspeedMCPServerReadyCondition,
+				condition.ErrorReason,
+				condition.SeverityWarning,
+				apiv1beta1.DeploymentCheckFailedMessage,
+				mcpErr.Error(),
+			))
+			return mcpErr
+		}
+		instance.Status.OpenStackReady = openStackReady
+	} else {
+		if err := r.cleanupMCPResources(ctx, h, instance); err != nil {
+			return err
+		}
+		instance.Status.OpenStackReady = false
+		instance.Status.Conditions.MarkTrue(
+			apiv1beta1.OpenStackLightspeedMCPServerReadyCondition,
+			apiv1beta1.OpenStackLightspeedMCPServerDisabledMessage,
+		)
+	}
+	return nil
+}
+
 // ReconcileMCPServer performs the reconciliation of the MCP server.
 // The MCP server runs as a sidecar in the LCore pod. The OpenStack MCP tools
 // are only configured in lightspeed-stack when OpenStackControlPlane exists and is Ready.
@@ -301,6 +334,52 @@ func extractOSCPFields(
 	}, nil
 }
 
+// ---------------------------------------------------------------------------
+// Deletion
+// ---------------------------------------------------------------------------
+
+// cleanupMCPResources removes MCP server resources when the rhos_mcps feature
+// flag is disabled.
+func (r *OpenStackLightspeedReconciler) cleanupMCPResources(
+	ctx context.Context,
+	helper *common_helper.Helper,
+	instance *apiv1beta1.OpenStackLightspeed,
+) error {
+	log := helper.GetLogger()
+	ns := instance.Namespace
+
+	mcpCM := &corev1.ConfigMap{}
+	mcpCM.Name = MCPConfigYAMLConfigMapName
+	mcpCM.Namespace = ns
+	if err := helper.GetClient().Delete(ctx, mcpCM); err != nil && !k8s_errors.IsNotFound(err) {
+		return fmt.Errorf("failed to delete MCP config ConfigMap: %w", err)
+	}
+
+	cloudsCM := &corev1.ConfigMap{}
+	cloudsCM.Name = CloudsYAMLConfigMapName
+	cloudsCM.Namespace = ns
+	if err := helper.GetClient().Delete(ctx, cloudsCM); err != nil && !k8s_errors.IsNotFound(err) {
+		return fmt.Errorf("failed to delete openstack-config ConfigMap: %w", err)
+	}
+
+	secureSec := &corev1.Secret{}
+	secureSec.Name = SecureYAMLSecretName
+	secureSec.Namespace = ns
+	if err := helper.GetClient().Delete(ctx, secureSec); err != nil && !k8s_errors.IsNotFound(err) {
+		return fmt.Errorf("failed to delete openstack-config-secret Secret: %w", err)
+	}
+
+	caSec := &corev1.Secret{}
+	caSec.Name = CombinedCABundleSecretName
+	caSec.Namespace = ns
+	if err := helper.GetClient().Delete(ctx, caSec); err != nil && !k8s_errors.IsNotFound(err) {
+		return fmt.Errorf("failed to delete combined-ca-bundle Secret: %w", err)
+	}
+
+	log.Info("RHOS MCP resources cleaned up")
+	return nil
+}
+
 // copyObjectsToOpenStackLightspeedNamespace copies the required ConfigMaps and Secrets
 // from the OpenStackControlPlane's namespace to the OpenStack Lightspeed namespace.
 func copyObjectsToOpenStackLightspeedNamespace(

internal/controller/openstacklightspeed_controller.go

@@ -205,24 +205,8 @@ func (r *OpenStackLightspeedReconciler) Reconcile(ctx context.Context, req ctrl.
 		Log.Error(err, "failed to parse dev config, ignoring")
 	}
 
-	// Reconcile MCP server before LCore resources, because its result
-	// determines what goes into the lightspeed-stack config (mcp_servers section).
-	openStackReady, mcpErr := r.ReconcileMCPServer(ctx, helper, instance)
-	if mcpErr != nil {
-		instance.Status.Conditions.Set(condition.FalseCondition(
-			apiv1beta1.OpenStackLightspeedMCPServerReadyCondition,
-			condition.ErrorReason,
-			condition.SeverityWarning,
-			apiv1beta1.DeploymentCheckFailedMessage,
-			mcpErr.Error(),
-		))
-		return ctrl.Result{}, mcpErr
-	}
-
-	// Store the OpenStack readiness for config generation
-	instance.Status.OpenStackReady = openStackReady
-
 	reconcileTasks := []ReconcileTask{
+		{Name: "MCPServer", Task: r.ReconcileMCPServerTask},
 		{Name: "PostgresResources", Task: ReconcilePostgresResources},
 		{Name: "PostgresDeployment", Task: ReconcilePostgresDeployment},
 		{Name: "OKPDeployment", Task: ReconcileOKPDeployment},
@@ -309,17 +293,24 @@ func (r *OpenStackLightspeedReconciler) reconcileStatus(
 		}
 	}
 
-	// Mark MCP server condition based on readiness
-	if instance.Status.OpenStackReady {
-		instance.Status.Conditions.MarkTrue(
-			apiv1beta1.OpenStackLightspeedMCPServerReadyCondition,
-			apiv1beta1.OpenStackLightspeedMCPServerDeployed,
-		)
-	} else {
-		instance.Status.Conditions.MarkTrue(
-			apiv1beta1.OpenStackLightspeedMCPServerReadyCondition,
-			apiv1beta1.OpenStackLightspeedMCPServerWaitingOpenStack,
-		)
+	// Mark MCP server condition based on readiness (only when RHOS MCP is enabled;
+	// when disabled the condition was already set in Reconcile).
+	rhosMCPEnabled, err := isRHOSMCPEnabled(instance)
+	if err != nil {
+		return ctrl.Result{}, fmt.Errorf("failed to parse dev config: %w", err)
+	}
+	if rhosMCPEnabled {
+		if instance.Status.OpenStackReady {
+			instance.Status.Conditions.MarkTrue(
+				apiv1beta1.OpenStackLightspeedMCPServerReadyCondition,
+				apiv1beta1.OpenStackLightspeedMCPServerDeployed,
+			)
+		} else {
+			instance.Status.Conditions.MarkTrue(
+				apiv1beta1.OpenStackLightspeedMCPServerReadyCondition,
+				apiv1beta1.OpenStackLightspeedMCPServerWaitingOpenStack,
+			)
+		}
 	}
 
 	instance.Status.Conditions.MarkTrue(

test/kuttl/common/expected-configs/lightspeed-stack-update.yaml

@@ -71,11 +71,7 @@ inference:
 llama_stack:
   url: http://localhost:8321
   use_as_library_client: false
-mcp_servers:
-- authorization_headers:
-    OCP_TOKEN: kubernetes
-  name: rhos-ocp-tools
-  url: http://127.0.0.1:8080/openshift/
+mcp_servers: []
 name: Lightspeed Core Service (LCS)
 okp:
   chunk_filter_query: product:(*openstack* OR *openshift*)

test/kuttl/common/expected-configs/lightspeed-stack.yaml

@@ -71,11 +71,7 @@ inference:
 llama_stack:
   url: http://localhost:8321
   use_as_library_client: false
-mcp_servers:
-- authorization_headers:
-    OCP_TOKEN: kubernetes
-  name: rhos-ocp-tools
-  url: http://127.0.0.1:8080/openshift/
+mcp_servers: []
 name: Lightspeed Core Service (LCS)
 okp:
   chunk_filter_query: product:(*openstack* OR *openshift*)

test/kuttl/common/openstack-lightspeed-instance/assert-openstack-lightspeed-instance.yaml

@@ -311,7 +311,6 @@ spec:
               mountPath: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
               subPath: tls-ca-bundle.pem
               readOnly: true
-        - name: rhos-mcp
       volumes:
         - name: ogx-config
           configMap:
@@ -337,12 +336,6 @@ spec:
         - name: tls-certs
           secret:
             secretName: lightspeed-tls
-        - name: mcp-config
-          configMap:
-            name: mcp-config
-            items:
-              - key: config.yaml
-                path: config.yaml
 status:
   replicas: 1
   readyReplicas: 1
@@ -362,14 +355,6 @@ metadata:
   name: vector-db-scripts
   namespace: openstack-lightspeed
 
-# MCP server resources
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: mcp-config
-  namespace: openstack-lightspeed
-
 # Console Plugin resources
 ---
 apiVersion: v1
@@ -467,6 +452,7 @@ status:
       message: Setup complete
     - type: OpenStackLightspeedMCPServerReady
       status: "True"
+      message: "RHOS MCP server is disabled (rhos_mcps feature flag not set)"
     - type: OpenStackLightspeedReady
       status: "True"
       reason: Ready