MCP: Allow override config

Currently there is no way to modify the MCP server configuration, which
means we cannot even configure the logs to be in debug mode.

In this commit we add a section in the `dev` field (named
`rhosMCPConfig`) to allow configuring anything within the lightspeed-mcp
service except for enabling the tools, which is still done by the
operator itself.

Configuring the logging has not been added to the standard location in
the CRD because the feature is still experimental, so we can't set its
configuration in the CRD as if it were a normal feature. This is to
avoid having to make non-compatible changes to the CRD down the road.
Added a small comment to the openstacklightspeed_types.go file
establishing this rule.

It is the users responsibility to ensure that configuration makes sense
and works. The operator will not be responsible if the service cannot
start.  For example, if we increase the number of workers the container
will need more memory than it has currently assigned and the container
will be restarted.

Author: Akrog

api/v1beta1/openstacklightspeed_types.go

@@ -57,13 +57,15 @@ const (
 // May change at any time without backward compatibility.
 //
 // Supported fields:
-//   - featureFlags: list of experimental feature flags to enable
+//   - featureFlags: list of experimental feature flags to enable. Configuration options for experimental features must also live within the `DevSpec`.
 //   - okpChunkFilterQuery: Solr filter query for OKP searches (default: version-aware query combining detected OpenStack and OCP versions)
 //   - okpRagOnly: when true, only OKP is used as a RAG source (default: true)
+//   - rhosMCPConfig: custom YAML configuration for the rhos-mcps service; deep-merged on top of the operator defaults, openstack.enabled and openshift.enabled are always overridden by the operator
 type DevSpec struct {
 	FeatureFlags        []string `json:"featureFlags,omitempty"`
 	OKPChunkFilterQuery string   `json:"okpChunkFilterQuery,omitempty"`
 	OKPRagOnly          *bool    `json:"okpRagOnly,omitempty"`
+	RhosMCPConfig       string   `json:"rhosMCPConfig,omitempty"`
 }
 
 // OKPSpec defines configuration for the Offline Knowledge Portal (OKP).

config/samples/api_v1beta1_openstacklightspeed.yaml

@@ -26,5 +26,10 @@ spec:
   #     - rhoso_mcps
   #   okpChunkFilterQuery: "product:(*openstack* OR *openshift*)"
   #   okpRagOnly: true
+  #   # Custom MCP server config (deep-merged with operator defaults;
+  #   # openstack.enabled and openshift.enabled are always overridden):
+  #   rhosMCPConfig: |
+  #     debug: true
+  #     workers: 4
   # okp:
   #   accessKey: okp-access-key-secret

internal/controller/mcp_server.go

@@ -76,9 +76,29 @@ type mcpServerConfigParams struct {
 	OpenShiftEnabled bool
 }
 
-// buildMCPServerConfigData renders the MCP server config template with the
-// enabled flags for each platform section.
-func buildMCPServerConfigData(openStackReady bool) (string, error) {
+// deepMerge recursively merges override into base. When both sides have a map
+// for the same key the maps are merged; otherwise the override value wins.
+func deepMerge(base, override map[string]interface{}) map[string]interface{} {
+	result := make(map[string]interface{}, len(base))
+	for k, v := range base {
+		result[k] = v
+	}
+	for k, v := range override {
+		if baseMap, ok := result[k].(map[string]interface{}); ok {
+			if overrideMap, ok := v.(map[string]interface{}); ok {
+				result[k] = deepMerge(baseMap, overrideMap)
+				continue
+			}
+		}
+		result[k] = v
+	}
+	return result
+}
+
+// buildMCPServerConfigData renders the MCP server config template and, when
+// rhosMCPConfig is provided, deep-merges the user config on top. The
+// openstack.enabled and openshift.enabled flags are always enforced.
+func buildMCPServerConfigData(openStackReady bool, rhosMCPConfig string) (string, error) {
 	var buf bytes.Buffer
 	err := mcpServerConfigTmpl.Execute(&buf, mcpServerConfigParams{
 		OpenStackEnabled: openStackReady,
@@ -88,15 +108,50 @@ func buildMCPServerConfigData(openStackReady bool) (string, error) {
 		return "", fmt.Errorf("failed to render MCP server config template: %w", err)
 	}
 
-	return buf.String(), nil
+	if rhosMCPConfig == "" {
+		return buf.String(), nil
+	}
+
+	var baseConfig map[string]interface{}
+	if err := yaml.Unmarshal(buf.Bytes(), &baseConfig); err != nil {
+		return "", fmt.Errorf("failed to parse base MCP server config: %w", err)
+	}
+
+	var userConfig map[string]interface{}
+	if err := yaml.Unmarshal([]byte(rhosMCPConfig), &userConfig); err != nil {
+		return "", fmt.Errorf("failed to parse rhosMCPConfig: %w", err)
+	}
+
+	merged := deepMerge(baseConfig, userConfig)
+
+	osSection, ok := merged["openstack"].(map[string]interface{})
+	if !ok {
+		osSection = make(map[string]interface{})
+		merged["openstack"] = osSection
+	}
+	osSection["enabled"] = openStackReady
+
+	ocpSection, ok := merged["openshift"].(map[string]interface{})
+	if !ok {
+		ocpSection = make(map[string]interface{})
+		merged["openshift"] = ocpSection
+	}
+	ocpSection["enabled"] = true
+
+	result, err := yaml.Marshal(merged)
+	if err != nil {
+		return "", fmt.Errorf("failed to marshal merged MCP server config: %w", err)
+	}
+	return string(result), nil
 }
 
 // BuildMCPServerConfigMap creates the ConfigMap for the MCP server configuration.
 func BuildMCPServerConfigMap(
 	instance *apiv1beta1.OpenStackLightspeed,
 	openStackReady bool,
 ) (corev1.ConfigMap, error) {
-	configData, err := buildMCPServerConfigData(openStackReady)
+	devConfig, _ := parseDevConfig(instance)
+	configData, err := buildMCPServerConfigData(openStackReady, devConfig.RhosMCPConfig)
 	if err != nil {
 		return corev1.ConfigMap{}, err
 	}

internal/controller/mcp_server_test.go

@@ -20,10 +20,12 @@ import (
 	"fmt"
 	"strings"
 	"testing"
+
+	"sigs.k8s.io/yaml"
 )
 
 func TestBuildMCPServerConfigData_OpenStackNotReady(t *testing.T) {
-	result, err := buildMCPServerConfigData(false)
+	result, err := buildMCPServerConfigData(false, "")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -36,7 +38,7 @@ func TestBuildMCPServerConfigData_OpenStackNotReady(t *testing.T) {
 }
 
 func TestBuildMCPServerConfigData_OpenStackReady(t *testing.T) {
-	result, err := buildMCPServerConfigData(true)
+	result, err := buildMCPServerConfigData(true, "")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -48,6 +50,101 @@ func TestBuildMCPServerConfigData_OpenStackReady(t *testing.T) {
 	}
 }
 
+func TestBuildMCPServerConfigData_CustomConfig_OverridesEnabled(t *testing.T) {
+	customConfig := `
+openstack:
+  enabled: true
+  allow_write: true
+openshift:
+  enabled: false
+`
+	result, err := buildMCPServerConfigData(false, customConfig)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	var parsed map[string]interface{}
+	if err := yaml.Unmarshal([]byte(result), &parsed); err != nil {
+		t.Fatalf("failed to parse result: %v", err)
+	}
+
+	osSection := parsed["openstack"].(map[string]interface{})
+	if osSection["enabled"] != false {
+		t.Errorf("expected openstack.enabled=false (operator override), got %v", osSection["enabled"])
+	}
+	if osSection["allow_write"] != true {
+		t.Errorf("expected openstack.allow_write=true (user value), got %v", osSection["allow_write"])
+	}
+
+	ocpSection := parsed["openshift"].(map[string]interface{})
+	if ocpSection["enabled"] != true {
+		t.Errorf("expected openshift.enabled=true (operator override), got %v", ocpSection["enabled"])
+	}
+}
+
+func TestBuildMCPServerConfigData_CustomConfig_DeepMergesWithDefaults(t *testing.T) {
+	customConfig := `
+debug: true
+workers: 4
+`
+	result, err := buildMCPServerConfigData(false, customConfig)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	var parsed map[string]interface{}
+	if err := yaml.Unmarshal([]byte(result), &parsed); err != nil {
+		t.Fatalf("failed to parse result: %v", err)
+	}
+
+	if parsed["debug"] != true {
+		t.Errorf("expected debug=true (user override), got %v", parsed["debug"])
+	}
+	if parsed["workers"] != float64(4) {
+		t.Errorf("expected workers=4 (user override), got %v", parsed["workers"])
+	}
+	if parsed["port"] != float64(8080) {
+		t.Errorf("expected port=8080 (template default preserved), got %v", parsed["port"])
+	}
+
+	osSection := parsed["openstack"].(map[string]interface{})
+	if osSection["ca_cert"] != "./tls-ca-bundle.pem" {
+		t.Errorf("expected openstack.ca_cert preserved from template, got %v", osSection["ca_cert"])
+	}
+}
+
+func TestBuildMCPServerConfigData_CustomConfig_AddsNewFields(t *testing.T) {
+	customConfig := `
+custom_section:
+  key1: value1
+  key2: 42
+`
+	result, err := buildMCPServerConfigData(true, customConfig)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	var parsed map[string]interface{}
+	if err := yaml.Unmarshal([]byte(result), &parsed); err != nil {
+		t.Fatalf("failed to parse result: %v", err)
+	}
+
+	custom := parsed["custom_section"].(map[string]interface{})
+	if custom["key1"] != "value1" {
+		t.Errorf("expected custom_section.key1=value1, got %v", custom["key1"])
+	}
+	if custom["key2"] != float64(42) {
+		t.Errorf("expected custom_section.key2=42, got %v", custom["key2"])
+	}
+}
+
+func TestBuildMCPServerConfigData_CustomConfig_InvalidYAML(t *testing.T) {
+	_, err := buildMCPServerConfigData(false, "not: valid: yaml: [")
+	if err == nil {
+		t.Error("expected error for invalid YAML")
+	}
+}
+
 func TestBuildLCoreMCPServersConfig_WithOpenStack(t *testing.T) {
 	servers := buildLCoreMCPServersConfig(true)
 

test/kuttl/tests/rhoso-mcps-configuration/04-update-rhos-mcp-config.yaml

@@ -0,0 +1,30 @@
+---
+apiVersion: lightspeed.openstack.org/v1beta1
+kind: OpenStackLightspeed
+metadata:
+  name: openstack-lightspeed
+  namespace: openstack-lightspeed
+spec:
+  llmEndpoint: http://mock-llm-api-server-pod:8000/v1
+  llmEndpointType: openai
+  llmCredentials: openstack-lightspeed-apitoken
+  modelName: ibm-granite/granite-3.1-8b-instruct
+  tlsCACertBundle: openstack-lightspeed-cert
+  llmProjectID: test-project-id
+  llmDeploymentName: test-deployment-name
+  llmAPIVersion: v1
+  logging:
+    ogxLogLevel: DEBUG
+    lightspeedStackLogLevel: WARNING
+    dataverseExporterLogLevel: DEBUG
+  dev:
+    featureFlags:
+      - rhoso_mcps
+    rhosMCPConfig: |
+      debug: true
+      workers: 4
+      openstack:
+        enabled: true
+        allow_write: true
+      openshift:
+        enabled: false

test/kuttl/tests/rhoso-mcps-configuration/05-assert-rhos-mcp-config-merged.yaml

@@ -0,0 +1,51 @@
+##############################################################################
+#   Assert that rhosMCPConfig is deep-merged with operator defaults          #
+##############################################################################
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+commands:
+  - script: |
+      #!/bin/bash
+      set -euo pipefail
+      source ../../common/shared_funcs.sh
+
+      mcp_data=$(oc get configmap mcp-config -n "$NAMESPACE" \
+        -o jsonpath='{.data.config\.yaml}')
+
+      assert_yaml_field() {
+        local field="$1" expected="$2"
+        local actual
+        actual=$(echo "$mcp_data" | python3 -c "
+      import sys, yaml
+      data = yaml.safe_load(sys.stdin)
+      keys = '$field'.split('.')
+      val = data
+      for k in keys:
+          val = val[k]
+      print(val)
+      ")
+        if [ "$actual" != "$expected" ]; then
+          echo "ERROR: Expected $field=$expected, got $actual"
+          echo "$mcp_data"
+          exit 1
+        fi
+      }
+
+      # User values should be merged
+      assert_yaml_field "debug" "True"
+      assert_yaml_field "workers" "4"
+
+      # Template defaults should be preserved
+      assert_yaml_field "port" "8080"
+      assert_yaml_field "ip" "127.0.0.1"
+      assert_yaml_field "openstack.ca_cert" "./tls-ca-bundle.pem"
+      assert_yaml_field "openstack.insecure" "False"
+      assert_yaml_field "openshift.insecure" "False"
+
+      # User value in nested section should be merged
+      assert_yaml_field "openstack.allow_write" "True"
+
+      # Operator must override enabled fields
+      assert_yaml_field "openstack.enabled" "False"
+      assert_yaml_field "openshift.enabled" "True"
+    timeout: 180