fix konflux package issues - #2377
Conversation
WalkthroughThe change updates Konflux dependency inputs and pipeline references, adds PyPI wheel installation, relocates OGX and RAG storage in E2E manifests, centralizes startup through a shared entrypoint, and changes secret and ConfigMap provisioning. ChangesDependency and E2E runtime updates
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant InitContainer
participant RAGFixture
participant enrich-entrypoint.sh
participant OGX
InitContainer->>RAGFixture: restore seed data into RAG working directory
InitContainer->>enrich-entrypoint.sh: install shared startup wrapper
enrich-entrypoint.sh->>OGX: use OGX_CONFIG_DIR and configured storage paths
OGX->>enrich-entrypoint.sh: start Llama Stack with restored RAG data
Possibly related PRs
Suggested labels: Suggested reviewers: Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 warning, 1 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
/retest |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/e2e-prow/rhoai/pipeline-konflux.sh`:
- Around line 223-225: Replace the predictable /tmp/kv_store.db.gz archive path
in the pipeline script with a unique file created via mktemp, update the archive
creation and configmap upload commands to use that path, and register an EXIT
trap to remove it after completion or failure.
- Around line 68-73: Update create_secret to use server-side apply with the
e2e-provisioner field manager when applying the generated Secret manifest,
replacing the current client-side oc apply invocation while preserving the
existing secret generation and namespace behavior.
- Around line 68-73: Update create_secret so every generated Secret receives a
run-scoped same-namespace owner reference using the owner resource’s UID, or add
teardown that explicitly deletes all generated Secrets. Ensure optional Secrets
are also removed or owned when their inputs are absent, preventing stale
resources across runs.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: a7bb9639-ac6c-46c6-bab9-5b1b14efc9bf
📒 Files selected for processing (14)
.konflux/profiles.toml.konflux/requirements.hashes.source.txt.konflux/requirements.hashes.wheel.pypi.txt.konflux/requirements.hashes.wheel.txt.tekton/lightspeed-stack-0-8-pull-request.yaml.tekton/lightspeed-stack-0-8-push.yamldeploy/lightspeed-stack/Containerfiledocker-compose.yamltests/e2e-prow/rhoai/configs/run.yamltests/e2e-prow/rhoai/manifests/lightspeed/lightspeed-stack.yamltests/e2e-prow/rhoai/manifests/lightspeed/llama-stack-openai.yamltests/e2e-prow/rhoai/manifests/lightspeed/llama-stack-prow.yamltests/e2e-prow/rhoai/pipeline-konflux.shtests/e2e/features/unified-mode-validation.feature
💤 Files with no reviewable changes (1)
- .konflux/requirements.hashes.source.txt
📜 Review details
⏰ Context from checks skipped due to timeout. (4)
- GitHub Check: Konflux kflux-prd-rh02 / lightspeed-stack-0-8-on-pull-request
- GitHub Check: E2E: library mode / ci / group 2
- GitHub Check: E2E: server mode / ci / group 1
- GitHub Check: E2E: server mode / ci / group 3
⚠️ CI failures not shown inline (5)
GitHub Actions: PR Title Checker / 0_check.txt: fix konflux package issues
Conclusion: failure
##[group]Run thehanimo/pr-title-checker@v1.4.3
with:
GITHUB_***REDACTED_SECRET_ASSIGNMENT***
pass_on_octokit_error: false
configuration_path: .github/pr-title-checker-config.json
##[endgroup]
(node:2143) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
Using config file .github/pr-title-checker-config.json from repo lightspeed-core/lightspeed-stack [ref: d301b6346f16f36921092e6c3e0ec5b08f51cd10]
(Use `node --trace-deprecation ...` to show where the warning was created)
(node:2143) [DEP0169] DeprecationWarning: `url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities.
Creating label (title needs formatting)...
Label (title needs formatting) already created.
Adding label (title needs formatting) to PR...
HttpError: Resource not accessible by integration
##[error]Failed to add label (title needs formatting) to PR
GitHub Actions: PR Title Checker / check: fix konflux package issues
Conclusion: failure
##[group]Run thehanimo/pr-title-checker@v1.4.3
with:
GITHUB_***REDACTED_SECRET_ASSIGNMENT***
pass_on_octokit_error: false
configuration_path: .github/pr-title-checker-config.json
##[endgroup]
(node:2143) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
Using config file .github/pr-title-checker-config.json from repo lightspeed-core/lightspeed-stack [ref: d301b6346f16f36921092e6c3e0ec5b08f51cd10]
(Use `node --trace-deprecation ...` to show where the warning was created)
(node:2143) [DEP0169] DeprecationWarning: `url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities.
Creating label (title needs formatting)...
Label (title needs formatting) already created.
Adding label (title needs formatting) to PR...
HttpError: Resource not accessible by integration
##[error]Failed to add label (title needs formatting) to PR
GitHub Actions: E2E Tests for Lightspeed Evaluation / E2E Tests for Lightspeed Evaluation job: fix konflux package issues
Conclusion: failure
##[group]Run echo "=== Test failure logs ==="
�[36;1mecho "=== Test failure logs ==="�[0m
�[36;1mecho "=== lightspeed-stack (library mode) logs ==="�[0m
�[36;1mdocker compose -f docker-compose-library.yaml logs lightspeed-stack�[0m
shell: /usr/bin/bash -e {0}
env:
OPENAI_***REDACTED_SECRET_ASSIGNMENT***
E2E_OPENAI_MODEL: gpt-4o-mini
FAISS_VECTOR_STORE_ID: vs_8c94967b-81cc-4028-a294-9cfac6fd9ae2
##[endgroup]
=== Test failure logs ===
=== lightspeed-stack (library mode) logs ===
lightspeed-stack | .743 INFO: Lightspeed Core Stack startup [lightspeed_stack.__main__:160]
lightspeed-stack | .746 INFO: Configuration: name='Lightspeed Core Service (LCS)' service=ServiceConfiguration(host='0.0.0.0', port=8080, base_url=None, auth_enabled=False, workers=1, color_log=True, access_log=True, tls_config=TLSConfiguration(tls_certificate_path=None, tls_key_path=None, tls_key_***REDACTED_SECRET_ASSIGNMENT*** root_path='', cors=CORSConfiguration(allow_origins=['*'], allow_credentials=False, allow_methods=['*'], allow_headers=['*'])) llama_stack=LlamaStackConfiguration(url=AnyHttpUrl('http://localhost:8321/'), ***REDACTED_SECRET_ASSIGNMENT*** use_as_library_client=True, library_client_config_path='/app-root/run.yaml', timeout=180, max_retries=5, retry_delay=2, allow_degraded_mode=False, config=None) user_data_collection=UserDataCollection(feedback_enabled=True, feedback_storage='/tmp/data/feedback', transcripts_enabled=True, transcripts_storage='/tmp/data/transcripts') database=DatabaseConfiguration(sqlite=SQLiteDatabaseConfiguration(db_path='/tmp/lightspeed-stack.db'), postgres=None) mcp_servers=[] authentication=AuthenticationConfiguration(module='noop', skip_tls_verification=False, skip_for_health_probes=False, skip_for_metrics=False, k8s_cluster_api=None, k8s_ca_cert_path=None, jwk_config=None, api_key_config=None, rh_identity_config=None, trusted_proxy_config=None) authorization=None customization=None inference=InferenceConfiguration(default_mod...
GitHub Actions: E2E Tests for Lightspeed Evaluation / E2E Tests for Lightspeed Evaluation job: fix konflux package issues
Conclusion: failure
lightspeed-stack | ERROR Application startup failed. Exiting. category=server
Still waiting...
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
curl: (7) Failed to connect to localhost port 8080 after 0 ms: Couldn't connect to server
lightspeed-stack | File "/app-root/.venv/lib64/python3.12/site-packages/fastapi/routing.py", line 240, in merged_lifespan
lightspeed-stack | async with original_context(app) as maybe_original_state:
lightspeed-stack | ^^^^^^^^^^^^^^^^^^^^^
lightspeed-stack | File "/usr/lib64/python3.12/contextlib.py", line 210, in __aenter__
lightspeed-stack | return await anext(self.gen)
lightspeed-stack | ^^^^^^^^^^^^^^^^^^^^^
lightspeed-stack | File "/app-root/src/app/main.py", line 87, in lifespan
lightspeed-stack | await AsyncOgxClientHolder().load(llama_stack_config)
lightspeed-stack | File "/app-root/src/client.py", line 49, in load
lightspeed-stack | await self._load_library_client(llama_stack_config)
lightspeed-stack | File "/app-root/src/client.py", line 82, in _load_library_client
lightspeed-stack | await client.initialize()
lightspeed-stack | File "/app-root/.venv/lib64/python3.12/site-packages/ogx/core/library_client.py", line 413, in initialize
lightspeed-stack | await self.stack.initialize() # type: ignore
lightspeed-stack | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
lightspeed-stack | File "/app-root/.venv/lib64/python3.12/site-packages/ogx/core/stack.py", line 753, in initialize
lightspeed-stack | impls = await reso...
GitHub Actions: E2E Tests for Lightspeed Evaluation / 0_E2E Tests for Lightspeed Evaluation job.txt: fix konflux package issues
Conclusion: failure
lightspeed-stack | ERROR Application startup failed. Exiting. category=server
Still waiting...
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
curl: (7) Failed to connect to localhost port 8080 after 0 ms: Couldn't connect to server
lightspeed-stack | File "/app-root/.venv/lib64/python3.12/site-packages/fastapi/routing.py", line 240, in merged_lifespan
lightspeed-stack | async with original_context(app) as maybe_original_state:
lightspeed-stack | ^^^^^^^^^^^^^^^^^^^^^
lightspeed-stack | File "/usr/lib64/python3.12/contextlib.py", line 210, in __aenter__
lightspeed-stack | return await anext(self.gen)
lightspeed-stack | ^^^^^^^^^^^^^^^^^^^^^
lightspeed-stack | File "/app-root/src/app/main.py", line 87, in lifespan
lightspeed-stack | await AsyncOgxClientHolder().load(llama_stack_config)
lightspeed-stack | File "/app-root/src/client.py", line 49, in load
lightspeed-stack | await self._load_library_client(llama_stack_config)
lightspeed-stack | File "/app-root/src/client.py", line 82, in _load_library_client
lightspeed-stack | await client.initialize()
lightspeed-stack | File "/app-root/.venv/lib64/python3.12/site-packages/ogx/core/library_client.py", line 413, in initialize
lightspeed-stack | await self.stack.initialize() # type: ignore
lightspeed-stack | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
lightspeed-stack | File "/app-root/.venv/lib64/python3.12/site-packages/ogx/core/stack.py", line 753, in initialize
lightspeed-stack | impls = await reso...
🧰 Additional context used
📓 Path-based instructions (2)
**/*
📄 CodeRabbit inference engine (Custom checks)
**/*: Flag meaningful O(n^2)+ algorithms on non-trivial inputs, including handlers and Kubernetes list operations.
Flag N+1 patterns that list items and then query once per item, including Kubernetes API and database access.
Flag expensive work inside loops, including API calls, JSON parsing, and regex compilation.
Flag unbounded growth in caches, watchers, or buffers when eviction or limits are missing.
Flag missing pagination or limits on list operations and API endpoints.
Flag secrets or tokens logged in plaintext or hardcoded in source.
Flag API endpoints missing authentication or authorization.
Flag injection vulnerabilities, including SQL injection, command injection, and path traversal.
Flag sensitive data leaked in API responses, WebSocket messages, or logs.
Flag Kubernetes Secrets and Red Hat secrets missing OwnerReferences.
Files:
tests/e2e/features/unified-mode-validation.featuredeploy/lightspeed-stack/Containerfiletests/e2e-prow/rhoai/manifests/lightspeed/lightspeed-stack.yamldocker-compose.yamltests/e2e-prow/rhoai/manifests/lightspeed/llama-stack-prow.yamltests/e2e-prow/rhoai/configs/run.yamltests/e2e-prow/rhoai/manifests/lightspeed/llama-stack-openai.yamltests/e2e-prow/rhoai/pipeline-konflux.sh
tests/e2e/**/*.feature
📄 CodeRabbit inference engine (AGENTS.md)
Use Behave with Gherkin feature files for end-to-end tests.
Files:
tests/e2e/features/unified-mode-validation.feature
🧠 Learnings (2)
📚 Learning: 2026-02-19T10:06:50.647Z
Learnt from: radofuchs
Repo: lightspeed-core/lightspeed-stack PR: 1181
File: tests/e2e-prow/rhoai/manifests/lightspeed/mock-jwks.yaml:32-34
Timestamp: 2026-02-19T10:06:50.647Z
Learning: In the rhoai tests under tests/e2e-prow/rhoai/manifests, avoid static ConfigMap definitions for mock-jwks-script and mcp-mock-server-script since these ConfigMaps are created dynamically by the pipeline.sh deployment script using 'oc create configmap'. Ensure there are no static ConfigMap resources for these names in the manifests. If such ConfigMaps are added in the future, coordinate with the pipeline to reflect dynamic creation or adjust tests to rely on the dynamic provisioning.
Applied to files:
tests/e2e-prow/rhoai/manifests/lightspeed/lightspeed-stack.yamltests/e2e-prow/rhoai/manifests/lightspeed/llama-stack-prow.yamltests/e2e-prow/rhoai/manifests/lightspeed/llama-stack-openai.yaml
📚 Learning: 2026-05-20T08:09:30.641Z
Learnt from: max-svistunov
Repo: lightspeed-core/lightspeed-stack PR: 1580
File: docs/design/llama-stack-config-merge/poc-results/library-mode/synthesized-run.yaml:107-110
Timestamp: 2026-05-20T08:09:30.641Z
Learning: In Llama-stack config YAMLs, when defining a Llama Guard safety shield entry, set `provider_shield_id` to the *guard model identifier* (e.g., `meta-llama/Llama-Guard-3-8B`). Do not use a chat/generative model id (e.g., `openai/gpt-4o-mini`): a chat-model id (or `native_override`) indicates only an override landed and does **not** mean the safety shield is actually gating queries. Ensure any E2E coverage for the related implementation (JIRA/E2E tests) exercises a real Llama Guard model to verify that the shield is effective.
Applied to files:
tests/e2e-prow/rhoai/manifests/lightspeed/lightspeed-stack.yamldocker-compose.yamltests/e2e-prow/rhoai/manifests/lightspeed/llama-stack-prow.yamltests/e2e-prow/rhoai/configs/run.yamltests/e2e-prow/rhoai/manifests/lightspeed/llama-stack-openai.yaml
🪛 ast-grep (0.45.1)
tests/e2e-prow/rhoai/pipeline-konflux.sh
[warning] 225-225: Writing to or reading from a hardcoded, predictable path under /tmp is vulnerable to symlink and TOCTOU attacks: a local attacker can pre-create the file (or a symlink pointing elsewhere) and hijack or corrupt the contents. Generate a unique, unpredictable temporary file with mktemp instead, e.g. tmpfile="$(mktemp)" (or mktemp -d for directories) and reference "$tmpfile".
Context: /tmp/kv_store.db.gz
Note: [CWE-377] Insecure Temporary File.
(predictable-tmp-file-bash)
🔇 Additional comments (15)
.konflux/profiles.toml (1)
10-11: LGTM!.konflux/requirements.hashes.wheel.pypi.txt (1)
2-21: LGTM!.konflux/requirements.hashes.wheel.txt (1)
105-105: LGTM!Also applies to: 141-144, 218-218, 286-290, 299-301
.tekton/lightspeed-stack-0-8-pull-request.yaml (1)
51-57: LGTM!.tekton/lightspeed-stack-0-8-push.yaml (1)
52-58: LGTM!tests/e2e-prow/rhoai/pipeline-konflux.sh (3)
220-222: LGTM!
223-225: 🩺 Stability & AvailabilityAvoid an unprotected delete/create window for
rag-data.If
pipeline-konflux.shruns while Llama Stack is active,oc deleteremoves the ConfigMap beforeoc createrestores it. A restart or concurrent run can fail whilerag-datais absent. Use a no-gap replacement strategy, or verify that provisioning always completes before consumers start and that runs cannot overlap. The same ConfigMap name is used bytests/e2e-prow/rhoai/pipeline.sh:261-295.
418-418: LGTM!tests/e2e/features/unified-mode-validation.feature (1)
22-22: LGTM!deploy/lightspeed-stack/Containerfile (1)
73-73: LGTM!docker-compose.yaml (1)
60-61: LGTM!tests/e2e-prow/rhoai/configs/run.yaml (1)
66-72: LGTM!tests/e2e-prow/rhoai/manifests/lightspeed/lightspeed-stack.yaml (1)
57-59: LGTM!tests/e2e-prow/rhoai/manifests/lightspeed/llama-stack-openai.yaml (1)
1-7: LGTM!Also applies to: 50-62, 82-82, 94-97, 142-152, 196-221
tests/e2e-prow/rhoai/manifests/lightspeed/llama-stack-prow.yaml (1)
33-41: LGTM!Also applies to: 90-92, 142-143
| create_secret() { | ||
| local name=$1; shift | ||
| log "Creating secret $name..." | ||
| oc create secret generic "$name" "$@" -n "$NAMESPACE" 2>/dev/null || log "Secret $name exists" | ||
| log "Creating/updating secret $name..." | ||
| # Upsert: a stale FAISS_VECTOR_STORE_ID from a prior run in this namespace | ||
| # would otherwise leave registration/search pointing at the wrong store. | ||
| oc create secret generic "$name" "$@" -n "$NAMESPACE" --dry-run=client -o yaml | oc apply -f - |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -e
printf '%s\n' '--- target file ---'
sed -n '55,82p' tests/e2e-prow/rhoai/pipeline-konflux.sh
printf '%s\n' '--- oc apply usage in repository ---'
rg -n --glob '*.sh' --glob '*.yaml' --glob '*.yml' 'oc apply|kubectl apply|server-side|field-manager' . | head -200
printf '%s\n' '--- secret ownership patterns ---'
rg -n --glob '*.sh' --glob '*.yaml' --glob '*.yml' 'ownerReferences|create_secret|secret generic' tests/e2e-prow/rhoai . | head -200
printf '%s\n' '--- local oc availability ---'
if command -v oc >/dev/null 2>&1; then
oc version --client 2>&1 || true
oc apply --help 2>&1 | grep -E -- '--server-side|--field-manager|--dry-run' || true
else
echo 'oc is not installed'
fiRepository: lightspeed-core/lightspeed-stack
Length of output: 13220
🌐 Web query:
Kubernetes client-side apply last-applied-configuration Secret data server-side apply annotation official documentation
💡 Result:
The kubectl.kubernetes.io/last-applied-configuration annotation is a mechanism used exclusively by client-side apply (CSA) to track the state of an object as it was last applied by the client [1][2][3]. This annotation allows the client to perform three-way merges by comparing the live object, the new configuration, and the last-applied state to determine which fields to add, update, or remove [2][3]. When you use server-side apply (SSA) via kubectl apply --server-side, the Kubernetes API server takes over field management [1]. SSA does not use the last-applied-configuration annotation to track changes; instead, it uses the .metadata.managedFields field to track ownership of individual fields by different field managers [1][4][3]. Regarding the specific interaction between these strategies: 1. Transitioning to Server-Side Apply: When you run kubectl apply --server-side on an object previously managed by CSA, the client-side field ownership is transparently migrated to the specified --fieldmanager [5]. During this process, the last-applied-configuration annotation may be updated or eventually removed as ownership is transferred to the server's managed fields system [1][4][5]. 2. Secret Data and SSA: Official Kubernetes documentation notes that the stringData field for a Secret does not work well with server-side apply [6][7]. It is recommended to use the data field instead when working with SSA to avoid potential issues [8]. 3. Downgrading: If you are using SSA and wish to return to CSA, you can generally do so directly with kubectl apply. Because kubectl maintains the last-applied-configuration annotation during SSA operations, the transition back to client-side management remains possible [1]. In summary, SSA represents a shift from client-side state tracking (the annotation) to server-side field ownership (managed fields) [1][4]. When managing Secrets, favor the data field over stringData when utilizing SSA [6][8].
Citations:
- 1: https://kubernetes.io/docs/reference/using-api/server-side-apply/
- 2: https://kubernetes.io/docs/tasks/manage-kubernetes-objects/declarative-config/
- 3: https://learnkube.com/server-side-apply-kubernetes
- 4: https://github.com/kubernetes/enhancements/blob/master/keps/sig-api-machinery/555-server-side-apply/README.md
- 5: https://github.com/kubernetes/kubernetes/pull/112905/files
- 6: https://kubernetes.io/docs/tasks/configmap-secret/managing-secret-using-config-file/
- 7: https://kubernetes.io/docs/concepts/configuration/secret/
- 8: Document snag with
stringDataand server-side apply kubernetes/website#42603
🌐 Web query:
site:docs.redhat.com OpenShift oc apply --server-side --field-manager
💡 Result:
The command oc apply --server-side --field-manager is used to perform Server-Side Apply (SSA) in OpenShift, a process that enables collaborative management of Kubernetes resources [1]. Server-Side Apply (SSA) shifts the responsibility of merging resource changes from the client to the API server [1]. Unlike traditional client-side apply, which relies on a last-applied-configuration annotation to calculate diffs, SSA tracks field ownership directly on the server [2][1]. Here is a breakdown of the components: --server-side: This flag instructs the API server to perform the apply operation [1]. It enables the server to track which controller or user manages specific fields within an object [1]. When multiple actors attempt to modify the same resource, the server uses this information to detect and resolve conflicts [1]. --field-manager: This flag allows you to specify a custom name (the "manager") associated with the entity making the changes [3][4]. This name is recorded in the resource's.metadata.managedFields property [2][1]. If you do not provide a name, a default one is typically assigned. Key benefits of this approach include: Conflict Detection: The server prevents unintentional overwrites by identifying when different managers attempt to modify the same field [1]. Ownership Tracking: Because field ownership is stored in managedFields, the system provides a clear audit trail of which actor is responsible for which part of the object configuration [2][1]. Declarative Management: It allows multiple tools or users to manage different parts of the same resource without interfering with each other, as long as they are not modifying the same fields [1]. If a conflict occurs, you may need to use the --force-conflicts flag to override existing field ownership [1].
Citations:
- 1: https://docs.redhat.com/ja/documentation/red_hat_openshift_cluster_observability_operator/1-latest/html/about_red_hat_openshift_cluster_observability_operator/server-side-apply_cluster_observability_operator_overview
- 2: https://docs.redhat.com/en/documentation/red_hat_streams_for_apache_kafka/3.2/html/deploying_and_managing_streams_for_apache_kafka_on_openshift/ref-operator-cluster-feature-gates-str
- 3: https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/operator_apis/kubeapiserver-operator-openshift-io-v1
- 4: https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/extension_apis/customresourcedefinition-apiextensions-k8s-io-v1
Use server-side apply for Secret data.
Client-side oc apply stores the generated Secret, including Secret.data, in kubectl.kubernetes.io/last-applied-configuration. Use oc apply --server-side --field-manager=e2e-provisioner -f -, or use a patch/replace operation.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tests/e2e-prow/rhoai/pipeline-konflux.sh` around lines 68 - 73, Update
create_secret to use server-side apply with the e2e-provisioner field manager
when applying the generated Secret manifest, replacing the current client-side
oc apply invocation while preserving the existing secret generation and
namespace behavior.
Source: MCP tools
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
file='tests/e2e-prow/rhoai/pipeline-konflux.sh'
printf '%s\n' '--- target file outline ---'
if command -v ast-grep >/dev/null 2>&1; then
ast-grep outline "$file" || true
fi
printf '%s\n' '--- create_secret and cleanup references ---'
rg -n -C 8 'create_secret|faiss-vector-store-secret|rag-data|NAMESPACE|ownerReferences|owner-reference|delete' "$file"
printf '%s\n' '--- related files and references ---'
rg -n -C 3 'pipeline-konflux|faiss-vector-store-secret|create_secret|rag-data' tests README.md .github 2>/dev/null || trueRepository: lightspeed-core/lightspeed-stack
Length of output: 40086
🏁 Script executed:
#!/bin/bash
set -eu
file='tests/e2e-prow/rhoai/pipeline-konflux.sh'
printf '%s\n' '--- create_secret and lifecycle references ---'
rg -n -C 8 'create_secret|faiss-vector-store-secret|rag-data|NAMESPACE|ownerReferences|owner-reference|delete' "$file"
printf '%s\n' '--- related repository references ---'
rg -n -C 3 'pipeline-konflux|faiss-vector-store-secret|create_secret|rag-data' tests README.md .github 2>/dev/null || trueRepository: lightspeed-core/lightspeed-stack
Length of output: 40006
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- target pipeline and service script ---'
sed -n '1,125p' tests/e2e-prow/rhoai/pipeline-konflux.sh
sed -n '1,90p' tests/e2e-prow/rhoai/pipeline-services-konflux.sh
printf '%s\n' '--- CI/job/owner candidates ---'
rg -n -C 5 'kind: (Job|Deployment|Pod|CronJob)|ownerReferences|generateName:|pipeline-konflux.sh|NAMESPACE=.*e2e-rhoai|e2e-rhoai-dsc' \
.github tests config 2>/dev/null || true
printf '%s\n' '--- cleanup candidates ---'
rg -n -C 4 'oc (delete|apply).*secret|delete.*namespace|trap|cleanup|teardown|ownerReferences' \
tests/e2e-prow .github 2>/dev/null || true
printf '%s\n' '--- all Secret creation commands in the target pipeline ---'
rg -n -C 2 'oc create secret|create_secret ' tests/e2e-prow/rhoai/pipeline-konflux.shRepository: lightspeed-core/lightspeed-stack
Length of output: 49407
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re
path = Path("tests/e2e-prow/rhoai/pipeline-konflux.sh")
text = path.read_text()
secret_commands = []
for match in re.finditer(r'(?ms)^\s*(?:create_secret\b.*|oc create secret\b.*?(?:\n\s+.*?\\\n)*\s*--dry-run=client -o yaml \| oc apply -f -|oc create secret\b.*?(?:\n\s+.*?\\\n)*$)', text):
command = " ".join(line.strip().rstrip("\\") for line in match.group(0).splitlines())
secret_commands.append(command)
print("secret-command-count:", len(secret_commands))
for i, command in enumerate(secret_commands, 1):
print(f"{i}: {command}")
print("ownerReferences-present-in-target:", "ownerReferences" in text)
print("namespace-created-only-if-missing:",
'oc get ns "$NAMESPACE"' in text and '|| oc create namespace "$NAMESPACE"' in text)
print("namespace-deletion-present:", bool(re.search(r'oc\s+delete\s+namespace', text)))
print("secret-deletion-present:", bool(re.search(r'oc\s+delete\s+secret', text)))
# This verifier only inspects the command construction. It does not contact a cluster
# or execute repository code.
for i, command in enumerate(secret_commands, 1):
print(f"command-{i}-contains-ownerReferences:", "ownerReferences" in command)
PYRepository: lightspeed-core/lightspeed-stack
Length of output: 16775
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- target pipeline and service script ---'
sed -n '1,125p' tests/e2e-prow/rhoai/pipeline-konflux.sh
sed -n '1,90p' tests/e2e-prow/rhoai/pipeline-services-konflux.sh
printf '%s\n' '--- CI/job/owner candidates ---'
rg -n -C 5 'kind: (Job|Deployment|Pod|CronJob)|ownerReferences|generateName:|pipeline-konflux.sh|NAMESPACE=.*e2e-rhoai|e2e-rhoai-dsc' \
.github tests config 2>/dev/null || true
printf '%s\n' '--- cleanup candidates ---'
rg -n -C 4 'oc (delete|apply).*secret|delete.*namespace|trap|cleanup|teardown|ownerReferences' \
tests/e2e-prow .github 2>/dev/null || true
printf '%s\n' '--- all Secret creation commands ---'
rg -n -C 2 'oc create secret|create_secret ' tests/e2e-prow/rhoai/pipeline-konflux.shRepository: lightspeed-core/lightspeed-stack
Length of output: 49384
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re
path = Path("tests/e2e-prow/rhoai/pipeline-konflux.sh")
text = path.read_text()
print("ownerReferences-present-in-target:", "ownerReferences" in text)
print("namespace-created-only-if-missing:",
'oc get ns "$NAMESPACE"' in text and '|| oc create namespace "$NAMESPACE"' in text)
print("namespace-deletion-present:", bool(re.search(r'oc\s+delete\s+namespace', text)))
print("secret-deletion-present:", bool(re.search(r'oc\s+delete\s+secret', text)))
for line_no, line in enumerate(text.splitlines(), 1):
if "create_secret " in line or "oc create secret " in line:
print(f"{line_no}: {line.strip()}")
PYRepository: lightspeed-core/lightspeed-stack
Length of output: 1037
Assign a run-scoped owner to every Secret, or delete them during teardown.
The default $NAMESPACE persists, and this script does not delete the namespace or its Secrets. Create a same-namespace owner resource and set its UID in metadata.ownerReferences for all generated Secrets. Otherwise, enforce explicit cleanup. Optional Secrets can remain after later runs when their inputs are absent.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tests/e2e-prow/rhoai/pipeline-konflux.sh` around lines 68 - 73, Update
create_secret so every generated Secret receives a run-scoped same-namespace
owner reference using the owner resource’s UID, or add teardown that explicitly
deletes all generated Secrets. Ensure optional Secrets are also removed or owned
when their inputs are absent, preventing stale resources across runs.
Sources: Coding guidelines, MCP tools
| oc delete configmap rag-data -n "$NAMESPACE" --ignore-not-found | ||
| oc create configmap rag-data -n "$NAMESPACE" \ | ||
| --from-file=kv_store.db.gz=/tmp/kv_store.db.gz |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Use a unique temporary path for the RAG archive.
If another process can write /tmp, the predictable /tmp/kv_store.db.gz path allows a symlink or TOCTOU attack. The shell redirection can overwrite an attacker-selected path. Create the archive with mktemp and remove it with an EXIT trap.
Proposed fix
+tmp_dir="$(mktemp -d)"
+trap 'rm -rf "$tmp_dir"' EXIT
-gzip -c "$RAG_DB_PATH" > /tmp/kv_store.db.gz
+gzip -c "$RAG_DB_PATH" > "$tmp_dir/kv_store.db.gz"
- --from-file=kv_store.db.gz=/tmp/kv_store.db.gz
+ --from-file=kv_store.db.gz="$tmp_dir/kv_store.db.gz"🧰 Tools
🪛 ast-grep (0.45.1)
[warning] 225-225: Writing to or reading from a hardcoded, predictable path under /tmp is vulnerable to symlink and TOCTOU attacks: a local attacker can pre-create the file (or a symlink pointing elsewhere) and hijack or corrupt the contents. Generate a unique, unpredictable temporary file with mktemp instead, e.g. tmpfile="$(mktemp)" (or mktemp -d for directories) and reference "$tmpfile".
Context: /tmp/kv_store.db.gz
Note: [CWE-377] Insecure Temporary File.
(predictable-tmp-file-bash)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tests/e2e-prow/rhoai/pipeline-konflux.sh` around lines 223 - 225, Replace the
predictable /tmp/kv_store.db.gz archive path in the pipeline script with a
unique file created via mktemp, update the archive creation and configmap upload
commands to use that path, and register an EXIT trap to remove it after
completion or failure.
Source: Linters/SAST tools
2 participants
Description
Type of change
pyproject.toml+uv.lock]requirements.*.txtfor Konflux]Tools used to create PR
Identify any AI code assistants used in this PR (for transparency and review context)
Related Tickets & Documents
Checklist before requesting a review
Testing
Summary by CodeRabbit
Bug Fixes
Chores
pyarrowpackage.