MCP: Deploy MCP server as sidecar container

With this commit we start deploying the MCP server as a sidecar
container of the lightspeed-service container.

The MCP server deployed is the one from our new lightspeed-mcps
repository [1].

On installation the `openshift-cli` tool is enabled when OpenStack
Lightspeed is configured (therefore deployed), and the `openstack-cli`
tool is enabled when the `OpenStackControlPlane` is ready.

From a security perspective since we are deploying the MCP tools in the
pod's network namespace, it's a sidecar container and the port is not
exposed, not using TLS is not a real security risk.

[1]: https://github.com/openstack-lightspeed/lightspeed-mcps

Jira: OSPRH-27075
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Akrog

api/v1beta1/conditions.go

@@ -27,6 +27,10 @@ const (
 	// OpenShift Lightspeed Operator Status=True condition which indicates if OpenShift Lightspeed is installed and
 	// operational and it can be used by OpenStack Lightspeed operator.
 	OpenShiftLightspeedOperatorReadyCondition condition.Type = "OpenShiftLightspeedOperatorReady"
+
+	// OpenStackLightspeedMCPServerReadyCondition is set to True when the MCP server
+	// deployment succeeds. False indicates a failure during MCP server deployment.
+	OpenStackLightspeedMCPServerReadyCondition condition.Type = "OpenStackLightspeedMCPServerReady"
 )
 
 // Common Messages used by API objects.
@@ -46,6 +50,15 @@ const (
 	// OpenShiftLightspeedOperatorReady
 	OpenShiftLightspeedOperatorReady = "OpenShift Lightspeed operator is ready."
 
+	// OpenStackLightspeedMCPServerInitMessage
+	OpenStackLightspeedMCPServerInitMessage = "MCP server deployment has not resolved"
+
+	// OpenStackLightspeedMCPServerDeployed
+	OpenStackLightspeedMCPServerDeployed = "MCP server is ready"
+
+	// OpenStackLightspeedMCPServerWaitingOpenStack
+	OpenStackLightspeedMCPServerWaitingOpenStack = "MCP server deployed, waiting for OpenStackControlPlane to become ready"
+
 	// DeploymentCheckFailedMessage
 	DeploymentCheckFailedMessage = "Failed to check deployment status: %s"
 

api/v1beta1/openstacklightspeed_types.go

@@ -46,6 +46,9 @@ const (
 	// OKPContainerImage is the fall-back container image for OKP (Offline Knowledge Portal)
 	OKPContainerImage = "registry.redhat.io/offline-knowledge-portal/rhokp-rhel9:latest"
 
+	// MCPServerContainerImage is the fall-back container image for the MCP server
+	MCPServerContainerImage = "quay.io/openstack-lightspeed/lightspeed-mcps:latest"
+
 	// MaxTokensForResponseDefault is the default maximum number of tokens that should be used for response
 	MaxTokensForResponseDefault = 2048
 )
@@ -205,6 +208,11 @@ type OpenStackLightspeedStatus struct {
 
 	// ObservedGeneration - the most recent generation observed for this object.
 	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
+
+	// +optional
+	// OpenStackReady indicates whether an OpenStackControlPlane was detected and
+	// is ready. When true, the OpenStack MCP tools are included in lightspeed-stack config.
+	OpenStackReady bool `json:"openStackReady,omitempty"`
 }
 
 // +kubebuilder:object:root=true
@@ -229,6 +237,7 @@ type OpenStackLightspeedStatus struct {
 // +operator-sdk:csv:customresourcedefinitions:resources={{PersistentVolumeClaim,v1,openstack-lightspeed-database}}
 // +operator-sdk:csv:customresourcedefinitions:resources={{ClusterRole,v1,lightspeed-app-server-sar-role}}
 // +operator-sdk:csv:customresourcedefinitions:resources={{ClusterRoleBinding,v1,lightspeed-app-server-sar-role-binding}}
+// +operator-sdk:csv:customresourcedefinitions:resources={{ConfigMap,v1,mcp-config}}
 // +operator-sdk:csv:customresourcedefinitions:resources={{Subscription,v1alpha1}}
 // +operator-sdk:csv:customresourcedefinitions:resources={{ClusterServiceVersion,v1alpha1}}
 // +operator-sdk:csv:customresourcedefinitions:resources={{InstallPlan,v1alpha1}}
@@ -268,6 +277,7 @@ type OpenStackLightspeedDefaults struct {
 	ConsoleImageURL      string
 	ConsoleImagePF5URL   string
 	OKPImageURL          string
+	MCPServerImageURL    string
 	MaxTokensForResponse int
 }
 
@@ -291,6 +301,8 @@ func SetupDefaults() {
 			"RELATED_IMAGE_CONSOLE_PF5_IMAGE_URL_DEFAULT", ConsoleContainerImagePF5),
 		OKPImageURL: util.GetEnvVar(
 			"RELATED_IMAGE_OKP_IMAGE_URL_DEFAULT", OKPContainerImage),
+		MCPServerImageURL: util.GetEnvVar(
+			"RELATED_IMAGE_MCP_SERVER_IMAGE_URL_DEFAULT", MCPServerContainerImage),
 		MaxTokensForResponse: MaxTokensForResponseDefault,
 	}
 

bundle/manifests/lightspeed.openstack.org_openstacklightspeeds.yaml

@@ -234,6 +234,11 @@ spec:
                   for this object.
                 format: int64
                 type: integer
+              openStackReady:
+                description: |-
+                  OpenStackReady indicates whether an OpenStackControlPlane was detected and
+                  is ready. When true, the OpenStack MCP tools are included in lightspeed-stack config.
+                type: boolean
             type: object
         type: object
     served: true

bundle/manifests/openstack-lightspeed-operator.clusterserviceversion.yaml

@@ -110,6 +110,9 @@ spec:
       - kind: ConfigMap
         name: llama-stack-config
         version: v1
+      - kind: ConfigMap
+        name: mcp-config
+        version: v1
       - kind: Secret
         name: metrics-reader-token
         version: v1
@@ -162,6 +165,13 @@ spec:
     spec:
       clusterPermissions:
       - rules:
+        - apiGroups:
+          - ""
+          resources:
+          - configmaps
+          - secrets
+          verbs:
+          - get
         - apiGroups:
           - ""
           resourceNames:
@@ -170,6 +180,14 @@ spec:
           - secrets
           verbs:
           - get
+        - apiGroups:
+          - apiextensions.k8s.io
+          resources:
+          - customresourcedefinitions
+          verbs:
+          - get
+          - list
+          - watch
         - apiGroups:
           - config.openshift.io
           resources:
@@ -190,6 +208,14 @@ spec:
           - patch
           - update
           - watch
+        - apiGroups:
+          - core.openstack.org
+          resources:
+          - openstackcontrolplanes
+          verbs:
+          - get
+          - list
+          - watch
         - apiGroups:
           - lightspeed.openstack.org
           resources:
@@ -305,6 +331,8 @@ spec:
                   value: registry.redhat.io/openshift-lightspeed/lightspeed-console-plugin-rhel9:1.0.12
                 - name: RELATED_IMAGE_CONSOLE_PF5_IMAGE_URL_DEFAULT
                   value: registry.redhat.io/openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9:1.0.12
+                - name: RELATED_IMAGE_MCP_SERVER_IMAGE_URL_DEFAULT
+                  value: quay.io/openstack-lightspeed/lightspeed-mcps:latest
                 image: quay.io/openstack-lightspeed/operator:latest
                 livenessProbe:
                   httpGet:
@@ -500,4 +528,6 @@ spec:
     name: console-image-url-default
   - image: registry.redhat.io/openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9:1.0.12
     name: console-pf5-image-url-default
+  - image: quay.io/openstack-lightspeed/lightspeed-mcps:latest
+    name: mcp-server-image-url-default
   version: 0.0.1

cmd/main.go

@@ -22,13 +22,17 @@ import (
 	"fmt"
 	"os"
 	"strings"
+	"sync/atomic"
 
 	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
 	// to ensure that exec-entrypoint and run can make use of them.
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
 
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/client-go/kubernetes"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/cache"
@@ -62,6 +66,8 @@ func init() {
 	utilruntime.Must(consolev1.AddToScheme(scheme))
 
 	utilruntime.Must(openshiftv1.AddToScheme(scheme))
+
+	utilruntime.Must(apiextensionsv1.AddToScheme(scheme))
 	// +kubebuilder:scaffold:scheme
 }
 
@@ -154,7 +160,15 @@ func main() {
 		setupLog.Info(fmt.Sprintf("openstack-lightspeed operator watches %s namespace", namespace))
 	}
 
-	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
+	cfg := ctrl.GetConfigOrDie()
+
+	kclient, err := kubernetes.NewForConfig(cfg)
+	if err != nil {
+		setupLog.Error(err, "unable to create kubernetes client")
+		os.Exit(1)
+	}
+
+	mgr, err := ctrl.NewManager(cfg, ctrl.Options{
 		Scheme:                 scheme,
 		Metrics:                metricsServerOptions,
 		WebhookServer:          webhookServer,
@@ -184,9 +198,14 @@ func main() {
 	// Defaults for OpenStackLightspeed
 	apiv1beta1.SetupDefaults()
 
+	dynamicWatchCRDs := getDynamicWatchCRDs()
+
 	if err = (&controller.OpenStackLightspeedReconciler{
-		Client: mgr.GetClient(),
-		Scheme: mgr.GetScheme(),
+		Client:          mgr.GetClient(),
+		Kclient:         kclient,
+		Scheme:          mgr.GetScheme(),
+		Cache:           mgr.GetCache(),
+		DynamicWatchCRD: dynamicWatchCRDs,
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "OpenStackLightspeed")
 		os.Exit(1)
@@ -224,3 +243,21 @@ func getWatchNamespaces() ([]string, error) {
 
 	return strings.Split(ns, ","), nil
 }
+
+// getDynamicWatchCRDs returns a map of GroupVersionKind to *atomic.Bool
+// representing resources that should be watched dynamically. The watch starts
+// once they appear in the cluster for the first time (not required at operator
+// start time).
+//
+// The OpenStackControlPlane GVK is hard-coded here to avoid pulling in the
+// openstack-operator/api dependency (which is pinned to an older k8s version).
+// The CRD is watched using unstructured types, so the Go type is not needed.
+func getDynamicWatchCRDs() map[schema.GroupVersionKind]*atomic.Bool {
+	return map[schema.GroupVersionKind]*atomic.Bool{
+		{
+			Group:   "core.openstack.org",
+			Version: "v1beta1",
+			Kind:    "OpenStackControlPlane",
+		}: new(atomic.Bool),
+	}
+}

config/crd/bases/lightspeed.openstack.org_openstacklightspeeds.yaml

@@ -234,6 +234,11 @@ spec:
                   for this object.
                 format: int64
                 type: integer
+              openStackReady:
+                description: |-
+                  OpenStackReady indicates whether an OpenStackControlPlane was detected and
+                  is ready. When true, the OpenStack MCP tools are included in lightspeed-stack config.
+                type: boolean
             type: object
         type: object
     served: true

config/manager/manager.yaml

@@ -87,6 +87,8 @@ spec:
             value: registry.redhat.io/openshift-lightspeed/lightspeed-console-plugin-rhel9:1.0.12
           - name: RELATED_IMAGE_CONSOLE_PF5_IMAGE_URL_DEFAULT
             value: registry.redhat.io/openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9:1.0.12
+          - name: RELATED_IMAGE_MCP_SERVER_IMAGE_URL_DEFAULT
+            value: quay.io/openstack-lightspeed/lightspeed-mcps:latest
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:

config/manifests/bases/openstack-lightspeed-operator.clusterserviceversion.yaml

@@ -87,6 +87,9 @@ spec:
       - kind: ConfigMap
         name: llama-stack-config
         version: v1
+      - kind: ConfigMap
+        name: mcp-config
+        version: v1
       - kind: Secret
         name: metrics-reader-token
         version: v1

config/rbac/role.yaml

@@ -4,6 +4,13 @@ kind: ClusterRole
 metadata:
   name: manager-role
 rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  verbs:
+  - get
 - apiGroups:
   - ""
   resourceNames:
@@ -12,6 +19,14 @@ rules:
   - secrets
   verbs:
   - get
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - config.openshift.io
   resources:
@@ -32,6 +47,14 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - core.openstack.org
+  resources:
+  - openstackcontrolplanes
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - lightspeed.openstack.org
   resources:

go.mod

@@ -13,6 +13,7 @@ require (
 	github.com/openstack-k8s-operators/lib-common/modules/common v0.6.0
 	github.com/operator-framework/api v0.37.0
 	k8s.io/api v0.34.2
+	k8s.io/apiextensions-apiserver v0.34.2
 	k8s.io/apimachinery v0.34.3
 	k8s.io/client-go v0.34.2
 	sigs.k8s.io/controller-runtime v0.22.4
@@ -99,7 +100,6 @@ require (
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/apiextensions-apiserver v0.34.2 // indirect
 	k8s.io/apiserver v0.34.2 // indirect
 	k8s.io/component-base v0.34.2 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect