You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit 742e081
Browse filesBrowse the repository at this point in the historyBrowse files
authored
feat(lightspeed): replace RAG init container with OKP deployment (#500)
* feat(lightspeed): replace RAG init container with OKP deployment [RHIDP-16102]
Replace the RAG init container / FAISS vector store with an OKP (Offline
Knowledge Portal) Deployment, Service, and Route. Add platform-aware
config selection: OpenShift (or K8s with okp.ingress.host set) uses the
full OKP config; vanilla K8s uses the lightspeed-stack-no-okp.yaml
variant so LCORE does not crash without an OKP backend. Add OKP Ingress
support, imagePullSecrets, vector_store config, and align/pin the OKP and
LCORE (OGX) images. Swap Lightspeed plugins to Intelligent Assistant.
Add systemArgs/systemEnv for LCORE sidecar (HF_HOME, OTEL_SDK_DISABLED,
--synthesized-config-output). Sync vendored Lightspeed configs from
lightspeed-configs@main. Add docs/lightspeed.md with deployment
scenarios, vanilla K8s prerequisites, and OKP configuration reference.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(lightspeed): harden OKP security context and fix CI test failure [RHIDP-16102]
- Add securityContext to OKP deployment (allowPrivilegeEscalation: false,
runAsNonRoot: true, capabilities.drop: [ALL], seccompProfile: RuntimeDefault)
- Fix CI test failure: use lightspeed-stack-no-okp.yaml for upgrade test
ConfigMap to avoid LCORE crash against missing OKP services
- Remove OTEL_SDK_DISABLED from secret.example.yaml (managed by chart)
- Remove stale RAG init container references from README and values.yaml
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(intelligent-assistant): address review feedback for OKP integration [RHIDP-16102]
- Replace Capabilities.APIVersions.Has with openshift.route.enabled for
ArgoCD/helm-template compatibility
- Move OKP securityContext from hardcoded template to values.yaml
- Add readiness and liveness probes to OKP deployment
- Remove systemArgs/systemEnv (hardcoded in deployment template instead)
- Remove unused chunkFilterQuery field
- Rename lightspeed-okp component labels to intelligent-assistant-okp
- Rename docs/lightspeed.md to docs/intelligent-assistant.md
- Update OKP image tag to 1.2.12-1788274041
- Regenerate schema and README
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: bump chart version to 2.2.0 and fix CI OKP activation [RHIDP-16102]
- Bump chart version from 2.1.0 to 2.2.0 and regenerate README
- Fix okp.active helper to require okp.route.enabled on OpenShift
(prevents OKP stack from activating in CI Kind environments)
- Disable OKP in CI values files (default, custom-config, external-db)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(intelligent-assistant): address second round review feedback [RHIDP-16102]
- Shorten OKP resource name to avoid Route hostname >63 char overflow
- Add comment explaining why readOnlyRootFilesystem is not set for OKP
- Remove unused Solr admin port (8983) from OKP Service
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(intelligent-assistant): HTTPS OKP, configurable probes, scheduling fields [RHIDP-16102]
Address rm3l third round review: switch OKP_SERVICE_URL to HTTPS with
combined CA bundle (system + cluster self-signed), merge global and OKP
imagePullSecrets, add scheduling fields (affinity, nodeSelector, tolerations,
topologySpreadConstraints), make probes configurable, rename CI values file.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(intelligent-assistant): tighten OKP configuration [RHIDP-16102]
Require both an enabled Ingress and host before activating OKP on vanilla Kubernetes. Remove the obsolete RAG volume, define the complete strict OKP values schema, regenerate generated documentation and schema output, and update the deployment guide.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Codex <noreply@openai.com>
| extraContainers | Additional sidecar containers. These are ADDED to system containers (e.g. Lightspeed Core sidecar), never replacing them. | list | `[]` |
228
228
| extraEnv | Extra environment variables appended after the system env vars. | list | `[]` |
229
229
| extraEnvFrom | Extra envFrom entries appended to the container. Accepts raw Kubernetes envFrom entries (configMapRef, secretRef, prefix). | list | `[]` |
230
-
| extraInitContainers | Additional init containers. These are ADDED after system init containers (install-dynamic-plugins, Intelligent Assistant RAG init), never replacing them. | list | `[]` |
230
+
| extraInitContainers | Additional init containers. These are ADDED after system init containers (install-dynamic-plugins), never replacing them. | list | `[]` |
231
231
| extraVolumeMounts | Additional volume mounts to add to the main container. These are ADDED to system-required mounts, never replacing them. | list | `[]` |
232
232
| extraVolumes | Additional volumes to add to the pod. These are ADDED to system-required volumes (dynamic-plugins-root, temp, npmcacache, etc.), never replacing them. | list | `[]` |
233
233
| fullnameOverride | Override the full resource name. | string | `""` |
@@ -243,7 +243,7 @@ Kubernetes: `>= 1.31.0-0`
243
243
| image.digest | Overrides the image tag with an image digest. | string | `""` |
244
244
| imagePullSecrets | Secrets for pulling images from private registries (merged with global.imagePullSecrets). | list | `[]` |
| intelligentAssistant.config | Configuration files mounted into the sidecar. By default, the chart creates ConfigMaps from bundled source files. Set existingConfigMap to use a pre-existing ConfigMap instead. | object | `{"profile":{"existingConfigMap":{"key":"","name":""}},"stack":{"existingConfigMap":{"key":"","name":""}}}` |
| intelligentAssistant.config.profile.existingConfigMap | Use an existing ConfigMap instead of the bundled default. | object | Created from bundled rhdh-profile.py |
@@ -258,11 +258,16 @@ Kubernetes: `>= 1.31.0-0`
258
258
| intelligentAssistant.core.commandOverride | Override the container's default command. Leave empty to use the image entrypoint. | list | `[]` |
259
259
| intelligentAssistant.core.extraArgs | Extra arguments appended after the default arguments. Ignored when argsOverride is set. | list | `[]` |
260
260
| intelligentAssistant.existingSecret | Name of an existing Secret that supplies credentials and settings to the lightspeed-core container. Configure the provider itself in lightspeed-stack.yaml. If empty, no Secret is loaded. Expected keys (all optional; include only keys used by the configured provider): VLLM_URL, VLLM_API_KEY, VLLM_MAX_TOKENS, VLLM_TLS_VERIFY, OPENAI_API_KEY, VERTEX_AI_PROJECT, VERTEX_AI_LOCATION, GOOGLE_APPLICATION_CREDENTIALS, ENABLE_VALIDATION, VALIDATION_PROVIDER, VALIDATION_MODEL_NAME Set ENABLE_VALIDATION to question_validity to enable validation. GOOGLE_APPLICATION_CREDENTIALS must be a path to a credentials file mounted in the sidecar. See files/intelligent-assistant/secret.example.yaml for a reference template. | string | `""` |
261
+
| intelligentAssistant.okp | OKP (Offline Knowledge Portal) configuration. Deploys an OKP instance for document retrieval when Intelligent Assistant is enabled. | object | `{"affinity":{},"httpd":{"compressed":"true","encrypt":"false","serverName":"localhost"},"image":{"digest":"","pullPolicy":"IfNotPresent","registry":"registry.redhat.io","repository":"offline-knowledge-portal/rhokp-rhel9","tag":"1.2.12-1788274041"},"imagePullSecrets":[],"ingress":{"annotations":{},"className":"","enabled":true,"host":"","tls":{"enabled":false,"secretName":""}},"livenessProbe":{"initialDelaySeconds":30,"periodSeconds":30},"nodeSelector":{},"readinessProbe":{"initialDelaySeconds":10,"periodSeconds":10},"replicaCount":1,"resources":{"limits":{"cpu":"2","memory":"4Gi"},"requests":{"cpu":"200m","memory":"2Gi"}},"route":{"enabled":true,"tls":{"insecureEdgeTerminationPolicy":"Redirect","termination":"edge"}},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}},"service":{"type":"ClusterIP"},"solr":{"hostBind":"0.0.0.0","memory":"1g"},"tolerations":[],"topologySpreadConstraints":[]}` |
262
+
| intelligentAssistant.okp.affinity | Pod scheduling: affinity rules for the OKP pod. | object | `{}` |
263
+
| intelligentAssistant.okp.imagePullSecrets | Image pull secrets for the OKP container image. Required on vanilla Kubernetes to authenticate with registry.redhat.io. Not needed on OpenShift where the cluster-wide pull secret covers Red Hat registries. | list | `[]` |
264
+
| intelligentAssistant.okp.livenessProbe | Liveness probe configuration for the OKP container. | object | `{"initialDelaySeconds":30,"periodSeconds":30}` |
265
+
| intelligentAssistant.okp.nodeSelector | Pod scheduling: node selector for the OKP pod. | object | `{}` |
266
+
| intelligentAssistant.okp.readinessProbe | Readiness probe configuration for the OKP container. | object | `{"initialDelaySeconds":10,"periodSeconds":10}` |
267
+
| intelligentAssistant.okp.securityContext | OKP container security context. readOnlyRootFilesystem is not set because Solr (Lucene) writes a lock file into its pre-built index directory at runtime. | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}` |
268
+
| intelligentAssistant.okp.tolerations | Pod scheduling: tolerations for the OKP pod. | list | `[]` |
269
+
| intelligentAssistant.okp.topologySpreadConstraints | Pod scheduling: topology spread constraints for the OKP pod. | list | `[]` |
@@ -409,15 +414,15 @@ For detailed information on configuring the catalog index, including how to over
409
414
410
415
Use `intelligentAssistant.enabled` to enable or disable the built-in Intelligent Assistant feature.
411
416
412
-
When enabled, the chart adds the default Intelligent Assistant dynamic plugins (`ref://red-hat-developer-hub-backstage-plugin-intelligent-assistant` and `ref://red-hat-developer-hub-backstage-plugin-intelligent-assistant-backend`), a RAG bootstrap init container, a Lightspeed Core sidecar listening on port `8080`, chart-generated ConfigMaps, and separate runtime and RAG data volumes. Override `intelligentAssistant.plugins` for disconnected environments. Plugin app-config uses the `intelligent-assistant:` namespace (not `lightspeed:`).
417
+
When enabled, the chart adds the default Intelligent Assistant dynamic plugins (`ref://red-hat-developer-hub-backstage-plugin-intelligent-assistant` and `ref://red-hat-developer-hub-backstage-plugin-intelligent-assistant-backend`), a Lightspeed Core sidecar listening on port `8080`, chart-generated ConfigMaps, and a writable runtime volume. Override `intelligentAssistant.plugins` for disconnected environments. Plugin app-config uses the `intelligent-assistant:` namespace (not `lightspeed:`).
413
418
414
419
The bundled `lightspeed-stack.yaml` does not enable an LLM inference provider. Create a provider-enabled stack in a ConfigMap and reference it with `intelligentAssistant.config.stack.existingConfigMap`. Supply that provider's credentials and settings with `intelligentAssistant.existingSecret`; the chart does not create the Secret.
415
420
416
421
This is a breaking change from chart 1.x: rename `lightspeed:` to `intelligentAssistant:` in your values. Chart-generated ConfigMaps are named `{fullname}-ia-{stack,profile}` instead of `{fullname}-lightspeed-*`, so Helm replaces those objects on upgrade. The `ia` infix is used because Kubernetes names are limited to 63 characters.
417
422
418
423
Chart 2.1.0 removes `intelligentAssistant.config.server` and the separate Llama Stack `config.yaml`. Remove the `server` entry from existing values. Move custom Llama Stack settings into the `lightspeed-stack.yaml` supplied through `intelligentAssistant.config.stack.existingConfigMap`.
419
424
420
-
Use `intelligentAssistant.runtimeVolume` to change the writable `/tmp` runtime storage between `emptyDir` and an existing PVC reference. The chart mounts that volume at `/tmp` so both generated temp files and `/tmp/data` remain writable. The `/rag-content` volume stays chart-managed and `emptyDir`-backed because the RAG assets are repopulated by the init container on each Pod start.
425
+
Use `intelligentAssistant.runtimeVolume` to change the writable `/tmp` runtime storage between `emptyDir` and an existing PVC reference. The chart mounts that volume at `/tmp` so both generated temporary files and `/tmp/data` remain writable.
421
426
422
427
When using the built-in Intelligent Assistant feature, do not also keep those plugin packages in `dynamicPlugins.plugins`. Existing installations that previously configured Lightspeed or Intelligent Assistant there should remove those entries if the built-in defaults are sufficient, or move their custom package definitions to `intelligentAssistant.plugins`; otherwise the rendered `dynamic-plugins.yaml` will contain duplicate plugin entries.
Copy file name to clipboardExpand all lines: charts/rhdh/README.md.gotmpl
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -259,15 +259,15 @@ For detailed information on configuring the catalog index, including how to over
259
259
260
260
Use `intelligentAssistant.enabled` to enable or disable the built-in Intelligent Assistant feature.
261
261
262
-
When enabled, the chart adds the default Intelligent Assistant dynamic plugins (`ref://red-hat-developer-hub-backstage-plugin-intelligent-assistant`and`ref://red-hat-developer-hub-backstage-plugin-intelligent-assistant-backend`), a RAG bootstrap init container, a Lightspeed Core sidecar listening on port `8080`, chart-generated ConfigMaps, andseparate runtime and RAG data volumes. Override `intelligentAssistant.plugins` for disconnected environments. Plugin app-config uses the `intelligent-assistant:` namespace (not`lightspeed:`).
262
+
When enabled, the chart adds the default Intelligent Assistant dynamic plugins (`ref://red-hat-developer-hub-backstage-plugin-intelligent-assistant`and`ref://red-hat-developer-hub-backstage-plugin-intelligent-assistant-backend`), a Lightspeed Core sidecar listening on port `8080`, chart-generated ConfigMaps, anda writable runtime volume. Override `intelligentAssistant.plugins` for disconnected environments. Plugin app-config uses the `intelligent-assistant:` namespace (not`lightspeed:`).
263
263
264
264
The bundled `lightspeed-stack.yaml` does not enable an LLM inference provider. Create a provider-enabled stack in a ConfigMap and reference it with`intelligentAssistant.config.stack.existingConfigMap`. Supply that provider's credentials and settings with`intelligentAssistant.existingSecret`; the chart does not create the Secret.
265
265
266
266
This is a breaking change from chart 1.x: rename `lightspeed:` to `intelligentAssistant:` in your values. Chart-generated ConfigMaps are named `{fullname}-ia-{stack,profile}` instead of `{fullname}-lightspeed-*`, so Helm replaces those objects on upgrade. The `ia` infix is used because Kubernetes names are limited to 63 characters.
267
267
268
268
Chart 2.1.0 removes `intelligentAssistant.config.server`and the separate Llama Stack `config.yaml`. Remove the `server` entry from existing values. Move custom Llama Stack settings into the `lightspeed-stack.yaml` supplied through `intelligentAssistant.config.stack.existingConfigMap`.
269
269
270
-
Use `intelligentAssistant.runtimeVolume` to change the writable `/tmp` runtime storage between `emptyDir`and an existing PVC reference. The chart mounts that volume at `/tmp` so both generated temp files and`/tmp/data` remain writable. The `/rag-content` volume stays chart-managed and`emptyDir`-backed because the RAG assets are repopulated by the init container on each Pod start.
270
+
Use `intelligentAssistant.runtimeVolume` to change the writable `/tmp` runtime storage between `emptyDir`and an existing PVC reference. The chart mounts that volume at `/tmp` so both generated temporary files and`/tmp/data` remain writable.
271
271
272
272
When using the built-in Intelligent Assistant feature, do not also keep those plugin packages in `dynamicPlugins.plugins`. Existing installations that previously configured Lightspeed or Intelligent Assistant there should remove those entries if the built-in defaults are sufficient, or move their custom package definitions to `intelligentAssistant.plugins`; otherwise the rendered `dynamic-plugins.yaml` will contain duplicate plugin entries.
0 commit comments