Skip to content

Add openshift template#1297

Closed
wcmitchell wants to merge 17 commits intoambient-code:mainfrom
RedHatInsights:add-openshift-template
Closed

Add openshift template#1297
wcmitchell wants to merge 17 commits intoambient-code:mainfrom
RedHatInsights:add-openshift-template

Conversation

@wcmitchell
Copy link
Copy Markdown

@wcmitchell wcmitchell commented Apr 11, 2026

Summary by CodeRabbit

  • New Features
    • Added platform deployment template with session and project settings management capabilities.
    • Enabled support for Vertex AI and Anthropic integration for LLM workflows.
    • Exposed API routes for HTTP and gRPC access to the ambient-api-server.
    • Configured externalized runner image settings for flexible deployment options.

red-hat-konflux and others added 17 commits April 6, 2026 20:22
Signed-off-by: red-hat-konflux <konflux@no-reply.konflux-ci.dev>
Signed-off-by: red-hat-konflux <konflux@no-reply.konflux-ci.dev>
Signed-off-by: red-hat-konflux <konflux@no-reply.konflux-ci.dev>
Signed-off-by: red-hat-konflux <konflux@no-reply.konflux-ci.dev>
Signed-off-by: red-hat-konflux <konflux@no-reply.konflux-ci.dev>
…d-main

Red Hat Konflux update ambient-code-backend-main
…nd-main

Red Hat Konflux update ambient-code-frontend-main
…or-main

Red Hat Konflux update ambient-code-operator-main
…-api-main

Red Hat Konflux update ambient-code-public-api-main
…t-api-server-main

Red Hat Konflux update ambient-code-ambient-api-server-main
Signed-off-by: red-hat-konflux <konflux@no-reply.konflux-ci.dev>
…nt-runner-main

Red Hat Konflux update ambient-code-ambient-runner-main
Creates kustomize overlay for deploying to hcmais01ue1 via app-interface:
- Uses Konflux images from redhat-services-prod/hcm-eng-prod-tenant
- Scales down in-cluster databases (using external RDS from app-interface Phase 2)
- Scales down MinIO (using external S3 from app-interface Phase 2)
- Includes CRDs, RBAC, routes, and all application components
- Patches operator to use Konflux runner image

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Convert kustomize overlay to OpenShift Template format for app-interface
SaaS deployment. The template:

- Defines 6 image parameters for Konflux-built images
- Uses IMAGE_TAG parameter (auto-generated from git commit SHA)
- Contains all resources from kustomize overlay except Namespace
- Scales in-cluster services to 0 (minio, postgresql, unleash)
- Uses external RDS and S3 configured in app-interface

This allows app-interface to use provider: openshift-template with
proper image gating support.
@wcmitchell wcmitchell closed this Apr 11, 2026
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Apr 11, 2026

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 5d0f5715-103c-481a-9c1e-12383e3b37bf

📥 Commits

Reviewing files that changed from the base of the PR and between 8a2310a and 593dce7.

📒 Files selected for processing (25)
  • .tekton/ambient-code-ambient-api-server-main-pull-request.yaml
  • .tekton/ambient-code-ambient-api-server-main-push.yaml
  • .tekton/ambient-code-ambient-runner-main-pull-request.yaml
  • .tekton/ambient-code-ambient-runner-main-push.yaml
  • .tekton/ambient-code-backend-main-pull-request.yaml
  • .tekton/ambient-code-backend-main-push.yaml
  • .tekton/ambient-code-frontend-main-pull-request.yaml
  • .tekton/ambient-code-frontend-main-push.yaml
  • .tekton/ambient-code-operator-main-pull-request.yaml
  • .tekton/ambient-code-operator-main-push.yaml
  • .tekton/ambient-code-public-api-main-pull-request.yaml
  • .tekton/ambient-code-public-api-main-push.yaml
  • components/ambient-api-server/Dockerfile
  • components/manifests/overlays/app-interface/ambient-api-server-db-secret-patch.yaml
  • components/manifests/overlays/app-interface/ambient-api-server-route.yaml
  • components/manifests/overlays/app-interface/backend-route.yaml
  • components/manifests/overlays/app-interface/kustomization.yaml
  • components/manifests/overlays/app-interface/namespace-patch.yaml
  • components/manifests/overlays/app-interface/namespace.yaml
  • components/manifests/overlays/app-interface/operator-config-openshift.yaml
  • components/manifests/overlays/app-interface/operator-runner-image-patch.yaml
  • components/manifests/overlays/app-interface/public-api-route.yaml
  • components/manifests/overlays/app-interface/route.yaml
  • components/runners/ambient-runner/Dockerfile
  • template.yaml

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to data retention organization setting


📝 Walkthrough

Walkthrough

Adds Tekton CI/CD pipeline manifests for building container images across multiple components (API server, runner, backend, frontend, operator, public API) on push and pull-request events, plus Kubernetes manifests defining deployment infrastructure including new CRDs for sessions and project settings, routes, secrets, and an OpenShift template for the complete platform stack.

Changes

Cohort / File(s) Summary
Tekton PipelineRun Manifests (Pull Request Triggers)
.tekton/ambient-code-ambient-api-server-main-pull-request.yaml, .tekton/ambient-code-ambient-runner-main-pull-request.yaml, .tekton/ambient-code-backend-main-pull-request.yaml, .tekton/ambient-code-frontend-main-pull-request.yaml, .tekton/ambient-code-operator-main-pull-request.yaml, .tekton/ambient-code-public-api-main-pull-request.yaml
New PipelineRun manifests triggered on pull requests targeting main for each component. Each defines a task chain: repository cloning, optional dependency prefetch, Buildah image build, image indexing, conditional security scans/checks (Clair, SAST, ClamAV, Coverity, RPM signature), tag application, and Dockerfile artifact push. Uses parameterized inputs for git source, output image naming (with PR revision), build controls, and conditional execution gated by skip-checks flag.
Tekton PipelineRun Manifests (Push Triggers)
.tekton/ambient-code-ambient-api-server-main-push.yaml, .tekton/ambient-code-ambient-runner-main-push.yaml, .tekton/ambient-code-backend-main-push.yaml, .tekton/ambient-code-frontend-main-push.yaml, .tekton/ambient-code-operator-main-push.yaml, .tekton/ambient-code-public-api-main-push.yaml
New PipelineRun manifests triggered on push events to main for each component. Similar structure to pull-request versions but with static image tagging. Tasks include initialization, OCI-backed repository cloning, optional dependency prefetch, container build via Buildah, image index creation, optional source image generation, conditional security/compliance scans, image tagging, and Dockerfile artifact push. Results expose image URL/digest and git metadata.
Dockerfile Updates
components/ambient-api-server/Dockerfile, components/runners/ambient-runner/Dockerfile
Removed vendor="Ambient" label from ambient-api-server image metadata. Modified ambient-runner Dockerfile to copy entire build context (COPY . /app/ambient-runner) instead of only the ambient-runner directory, affecting installed package contents.
Kubernetes Manifest Overlays (Routes & Networking)
components/manifests/overlays/app-interface/ambient-api-server-route.yaml, components/manifests/overlays/app-interface/backend-route.yaml, components/manifests/overlays/app-interface/public-api-route.yaml, components/manifests/overlays/app-interface/route.yaml
New OpenShift Route resources exposing internal services externally. Define HTTP/gRPC routes for ambient-api-server, backend, public API, and frontend (dashboard-ui). All configured with TLS edge termination and insecure traffic redirect policies.
Kubernetes Manifest Overlays (Configuration & Secrets)
components/manifests/overlays/app-interface/kustomization.yaml, components/manifests/overlays/app-interface/namespace.yaml, components/manifests/overlays/app-interface/namespace-patch.yaml, components/manifests/overlays/app-interface/ambient-api-server-db-secret-patch.yaml, components/manifests/overlays/app-interface/operator-config-openshift.yaml, components/manifests/overlays/app-interface/operator-runner-image-patch.yaml
New Kustomization overlay targeting ambient-code namespace with resource composition, patching, and image substitutions for production registry (quay.io/redhat-services-prod). Defines namespace with environment/service labels. Creates database secret with Vault-injected credentials and configures operator with Vertex AI settings and runner image reference. Scales down PostgreSQL and MinIO deployments (replicas=0) for external RDS usage.
OpenShift Template & Platform CRDs
template.yaml
Comprehensive deployment template introducing two new CRDs: AgenticSession for workflow sessions with LLM/repository/timeout configuration and reconciliation status; ProjectSettings singleton for group-based access, default timeouts, and repository configuration. Defines service accounts, RBAC bindings (view/edit/admin), ConfigMaps for auth/features/model registry/agent runner specs, Secrets for JWKS/ACL, PVCs for persistence, Deployments for operator/API server/database/backend/frontend/minio/public API/unleash, and OpenShift Routes for external access.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
✨ Simplify code
  • Create PR with simplified code

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants