From 1fc37e7a8ec4bb5ce6917956c8747bfac846124e Mon Sep 17 00:00:00 2001 From: malingatembo Date: Mon, 10 Aug 2026 15:26:32 +0200 Subject: [PATCH 1/8] Adapt install-openstack-lightspeed playbook to current operator Updated the playbook to work with the current OpenStack Lightspeed operator after org migration from openstack-lightspeed to openstack-k8s-operators. Changes: 1. Namespace: Changed default from openshift-lightspeed to openstack-lightspeed to match operator's suggested namespace in csv 2. CR creation: Added STEP 3 to create OpenStackLightspeed CR - Deploys the actual service (not just operator) - Configurable LLM parameters (endpoint, credentials, model) - Graceful timeout with ignore_errors for test environments 3. Kubeconfig fix: Resolved variable recursion bug on line 29 - Renamed cifmw_openshift_kubeconfig to kubeconfig_path - Prevents 'recursive loop detected' error Relates-To: OSPRH-33342" Signed-off-by: malingatembo --- .../install-openstack-lightspeed.yml | 45 +++++++++++++++++-- 1 file changed, 41 insertions(+), 4 deletions(-) diff --git a/hooks/playbooks/install-openstack-lightspeed.yml b/hooks/playbooks/install-openstack-lightspeed.yml index 7f7d6c6f9..924813c6a 100644 --- a/hooks/playbooks/install-openstack-lightspeed.yml +++ b/hooks/playbooks/install-openstack-lightspeed.yml @@ -19,16 +19,16 @@ connection: local vars: # OpenStack Lightspeed configuration - # Note: Installing in openshift-lightspeed namespace to ensure compatibility - openstack_lightspeed_namespace: "{{ cifmw_openstack_lightspeed_namespace | default('openshift-lightspeed') }}" + # Note: Using openstack-lightspeed namespace per operator's suggested namespace + openstack_lightspeed_namespace: "{{ cifmw_openstack_lightspeed_namespace | default('openstack-lightspeed') }}" openstack_lightspeed_operator_group: "{{ cifmw_openstack_lightspeed_operator_group | default('openstack-lightspeed-operator-group') }}" openstack_lightspeed_catalog_image: "{{ cifmw_openstack_lightspeed_catalog_image | default('quay.io/openstack-lightspeed/operator-catalog:latest') }}" openstack_lightspeed_catalog_name: "{{ cifmw_openstack_lightspeed_catalog_name | default('openstack-lightspeed-catalog') }}" # Kubeconfig path - use user-provided or default to CRC location - cifmw_openshift_kubeconfig: "{{ cifmw_openshift_kubeconfig | default(ansible_env.HOME ~ '/.crc/machines/crc/kubeconfig') }}" + kubeconfig_path: "{{ cifmw_openshift_kubeconfig | default(ansible_env.HOME ~ '/.crc/machines/crc/kubeconfig') }}" environment: - KUBECONFIG: "{{ cifmw_openshift_kubeconfig }}" + KUBECONFIG: "{{ kubeconfig_path }}" tasks: # STEP 1: Deploy OpenStack Lightspeed catalog @@ -121,8 +121,45 @@ retries: 30 delay: 10 + # STEP 3: Create OpenStackLightspeed CR to deploy the service + # Note: Uses configurable parameters for LLM integration + + - name: Create OpenStackLightspeed custom resource + kubernetes.core.k8s: + state: present + definition: + apiVersion: lightspeed.openstack.org/v1beta1 + kind: OpenStackLightspeed + metadata: + name: "{{ cifmw_openstack_lightspeed_cr_name | default('openstacklightspeed-sample') }}" + namespace: "{{ openstack_lightspeed_namespace }}" + spec: + llmCredentials: "{{ cifmw_openstack_lightspeed_llm_credentials | default('openstack-lightspeed-apitoken') }}" + llmEndpoint: "{{ cifmw_openstack_lightspeed_llm_endpoint | default('http://llm-provider:11434/v1') }}" + llmEndpointType: "{{ cifmw_openstack_lightspeed_llm_endpoint_type | default('openai') }}" + modelName: "{{ cifmw_openstack_lightspeed_model_name | default('llama3.1:8b') }}" + tlsCACertBundle: "{{ cifmw_openstack_lightspeed_tls_ca_cert_bundle | default('openstack-lightspeed-certs') }}" + + - name: Wait for OpenStackLightspeed CR to be ready + kubernetes.core.k8s_info: + api_version: lightspeed.openstack.org/v1beta1 + kind: OpenStackLightspeed + name: "{{ cifmw_openstack_lightspeed_cr_name | default('openstacklightspeed-sample') }}" + namespace: "{{ openstack_lightspeed_namespace }}" + register: osls_cr + until: + - osls_cr.resources is defined + - osls_cr.resources | length > 0 + - osls_cr.resources[0].status is defined + - osls_cr.resources[0].status.conditions is defined + - osls_cr.resources[0].status.conditions | selectattr('type', 'equalto', 'Ready') | selectattr('status', 'equalto', 'True') | list | length > 0 + retries: 60 + delay: 10 + ignore_errors: true + - name: Display deployment summary ansible.builtin.debug: msg: - "✓ OpenStack Lightspeed operator deployed in namespace: {{ openstack_lightspeed_namespace }}" + - "✓ OpenStack Lightspeed CR created: {{ cifmw_openstack_lightspeed_cr_name | default('openstacklightspeed-sample') }}" - "✓ OpenShift Lightspeed operator will be automatically managed by OpenStack Lightspeed" From 9ce2ff3355b9ffa7921d16bd56141a11f1127de2 Mon Sep 17 00:00:00 2001 From: malingatembo Date: Fri, 14 Aug 2026 14:47:57 +0200 Subject: [PATCH 2/8] Update LLM defaults to models corp endpoints Signed-off-by: malingatembo --- hooks/playbooks/install-openstack-lightspeed.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hooks/playbooks/install-openstack-lightspeed.yml b/hooks/playbooks/install-openstack-lightspeed.yml index 924813c6a..49c2d4778 100644 --- a/hooks/playbooks/install-openstack-lightspeed.yml +++ b/hooks/playbooks/install-openstack-lightspeed.yml @@ -135,9 +135,9 @@ namespace: "{{ openstack_lightspeed_namespace }}" spec: llmCredentials: "{{ cifmw_openstack_lightspeed_llm_credentials | default('openstack-lightspeed-apitoken') }}" - llmEndpoint: "{{ cifmw_openstack_lightspeed_llm_endpoint | default('http://llm-provider:11434/v1') }}" + llmEndpoint: "{{ cifmw_openstack_lightspeed_llm_endpoint | default('https://api.models.corp/v1/chat/completions') }}" llmEndpointType: "{{ cifmw_openstack_lightspeed_llm_endpoint_type | default('openai') }}" - modelName: "{{ cifmw_openstack_lightspeed_model_name | default('llama3.1:8b') }}" + modelName: "{{ cifmw_openstack_lightspeed_model_name | default('openai/gpt-oss-20b') }}" tlsCACertBundle: "{{ cifmw_openstack_lightspeed_tls_ca_cert_bundle | default('openstack-lightspeed-certs') }}" - name: Wait for OpenStackLightspeed CR to be ready From 9dbd6da877e3c22559dde79dbe0c294a9b1c312b Mon Sep 17 00:00:00 2001 From: malingatembo Date: Tue, 18 Aug 2026 15:06:28 +0200 Subject: [PATCH 3/8] Address feedback from lpiwowar Fixes the following 3 blocking issues 1. Remove hardcoded Downstream LLM configurations - Make llmEndpoint and modelName required variables - Update README to document these vars as REQUIRED 2. Add llm credentials secret creation - Create secret from cifmw_openstack_lightspeed_api_token when provided - Validate secret exists when variable not provided - Fail fast when secret missing ( with clear message ) 3. Add TLS certificate ConfigMap creation - Create ConfigMap from cifmw_openstack_lightspeed_ca_cert when provided - Validate ConfigMap exists when variable not provided - Fail early with clear error message if ConfigMap missing - Provides flexibility: either create via playbook or pre-create manually Signed-off-by: Malinga Tembo --- hooks/playbooks/README.md | 20 +++++-- .../install-openstack-lightspeed.yml | 58 +++++++++++++++++-- 2 files changed, 69 insertions(+), 9 deletions(-) diff --git a/hooks/playbooks/README.md b/hooks/playbooks/README.md index 93b2d71b8..0baa754c9 100644 --- a/hooks/playbooks/README.md +++ b/hooks/playbooks/README.md @@ -25,16 +25,26 @@ on removing "import_playbook" usage in ci-framework project. None ## install-openstack-lightspeed.yml -Installs OpenShift Lightspeed and OpenStack Lightspeed operators on CRC cluster. -This hook deploys both operators sequentially, setting up required namespaces, -operator groups, catalog sources, and subscriptions. +Installs OpenStack Lightspeed operator and creates the OpenStackLightspeed custom resource. +This hook deploys the operator, waits for it to be ready, then creates a CR to deploy the service. ### Input -* `cifmw_openstack_lightspeed_namespace`: (String) Namespace for OpenStack Lightspeed operator. Defaults to `openshift-lightspeed`. + +**Required variables:** +* `cifmw_openstack_lightspeed_llm_endpoint`: (String) **REQUIRED.** LLM service endpoint URL. Example: `https://your-llm-service/v1/chat/completions` +* `cifmw_openstack_lightspeed_model_name`: (String) **REQUIRED.** LLM model name. Example: `gpt-4`, `llama3.1:8b`, `granite-3.1-8b` + +**Optional variables:** +* `cifmw_openstack_lightspeed_namespace`: (String) Namespace for OpenStack Lightspeed operator. Defaults to `openstack-lightspeed`. * `cifmw_openstack_lightspeed_operator_group`: (String) OperatorGroup name for OpenStack Lightspeed. Defaults to `openstack-lightspeed-operator-group`. * `cifmw_openstack_lightspeed_catalog_image`: (String) Container image for OpenStack Lightspeed catalog source. Defaults to `quay.io/openstack-lightspeed/operator-catalog:latest`. * `cifmw_openstack_lightspeed_catalog_name`: (String) Name for OpenStack Lightspeed CatalogSource resource. Defaults to `openstack-lightspeed-catalog`. -* `cifmw_openshift_kubeconfig`: (String) Path to kubeconfig file for OpenShift cluster. Defaults to `{{ ansible_env.HOME }}/.crc/machines/crc/kubeconfig`. +* `cifmw_openstack_lightspeed_llm_endpoint_type`: (String) LLM endpoint API format. Defaults to `openai`. +* `cifmw_openstack_lightspeed_llm_credentials`: (String) Secret name containing LLM API token. Defaults to `openstack-lightspeed-apitoken`. +* `cifmw_openstack_lightspeed_api_token`: (String) LLM API token value. If provided, playbook creates the secret. If not provided, playbook validates secret exists. +* `cifmw_openstack_lightspeed_tls_ca_cert_bundle`: (String) ConfigMap name containing TLS CA certificates. Defaults to `openstack-lightspeed-certs`. +* `cifmw_openstack_lightspeed_ca_cert`: (String) TLS CA certificate content. If provided, playbook creates the ConfigMap. If not provided, playbook validates ConfigMap exists. +* `cifmw_openstack_lightspeed_cr_name`: (String) Name for OpenStackLightspeed CR. Defaults to `openstacklightspeed-sample`. ### Output None diff --git a/hooks/playbooks/install-openstack-lightspeed.yml b/hooks/playbooks/install-openstack-lightspeed.yml index 49c2d4778..dfacd3187 100644 --- a/hooks/playbooks/install-openstack-lightspeed.yml +++ b/hooks/playbooks/install-openstack-lightspeed.yml @@ -121,7 +121,53 @@ retries: 30 delay: 10 - # STEP 3: Create OpenStackLightspeed CR to deploy the service + # STEP 3: Create prerequisites (secrets and certificates) + + - name: Create LLM API token secret + kubernetes.core.k8s: + state: present + definition: + apiVersion: v1 + kind: Secret + metadata: + name: "{{ cifmw_openstack_lightspeed_llm_credentials | default('openstack-lightspeed-apitoken') }}" + namespace: "{{ openstack_lightspeed_namespace }}" + stringData: + apitoken: "{{ cifmw_openstack_lightspeed_api_token }}" + when: cifmw_openstack_lightspeed_api_token is defined + + - name: Verify LLM credentials secret exists + kubernetes.core.k8s_info: + kind: Secret + name: "{{ cifmw_openstack_lightspeed_llm_credentials | default('openstack-lightspeed-apitoken') }}" + namespace: "{{ openstack_lightspeed_namespace }}" + register: secret_check + failed_when: secret_check.resources | length == 0 + when: cifmw_openstack_lightspeed_api_token is not defined + + - name: Create TLS CA certificate bundle ConfigMap + kubernetes.core.k8s: + state: present + definition: + apiVersion: v1 + kind: ConfigMap + metadata: + name: "{{ cifmw_openstack_lightspeed_tls_ca_cert_bundle | default('openstack-lightspeed-certs') }}" + namespace: "{{ openstack_lightspeed_namespace }}" + data: + ca-bundle.crt: "{{ cifmw_openstack_lightspeed_ca_cert }}" + when: cifmw_openstack_lightspeed_ca_cert is defined + + - name: Verify TLS certificate bundle ConfigMap exists + kubernetes.core.k8s_info: + kind: ConfigMap + name: "{{ cifmw_openstack_lightspeed_tls_ca_cert_bundle | default('openstack-lightspeed-certs') }}" + namespace: "{{ openstack_lightspeed_namespace }}" + register: cert_check + failed_when: cert_check.resources | length == 0 + when: cifmw_openstack_lightspeed_ca_cert is not defined + + # STEP 4: Create OpenStackLightspeed CR to deploy the service # Note: Uses configurable parameters for LLM integration - name: Create OpenStackLightspeed custom resource @@ -134,10 +180,14 @@ name: "{{ cifmw_openstack_lightspeed_cr_name | default('openstacklightspeed-sample') }}" namespace: "{{ openstack_lightspeed_namespace }}" spec: - llmCredentials: "{{ cifmw_openstack_lightspeed_llm_credentials | default('openstack-lightspeed-apitoken') }}" - llmEndpoint: "{{ cifmw_openstack_lightspeed_llm_endpoint | default('https://api.models.corp/v1/chat/completions') }}" + # REQUIRED: LLM endpoint must be provided via cifmw_openstack_lightspeed_llm_endpoint + # Example: https://your-llm-service/v1/chat/completions + llmEndpoint: "{{ cifmw_openstack_lightspeed_llm_endpoint }}" llmEndpointType: "{{ cifmw_openstack_lightspeed_llm_endpoint_type | default('openai') }}" - modelName: "{{ cifmw_openstack_lightspeed_model_name | default('openai/gpt-oss-20b') }}" + # REQUIRED: Model name must be provided via cifmw_openstack_lightspeed_model_name + # Example: gpt-4, llama3.1:8b, granite-3.1-8b + modelName: "{{ cifmw_openstack_lightspeed_model_name }}" + llmCredentials: "{{ cifmw_openstack_lightspeed_llm_credentials | default('openstack-lightspeed-apitoken') }}" tlsCACertBundle: "{{ cifmw_openstack_lightspeed_tls_ca_cert_bundle | default('openstack-lightspeed-certs') }}" - name: Wait for OpenStackLightspeed CR to be ready From 97d20cc540e0aed9f98bb9f5ab231767a2d4049e Mon Sep 17 00:00:00 2001 From: malingatembo Date: Wed, 19 Aug 2026 12:13:29 +0200 Subject: [PATCH 4/8] Fixes blocking issue from review this pr: 1. removes CR wait task (fixes ignore_errors issue) - ci job calling this hook should now be responsible for waiting for full service health 2. Add no_log to secret creation 3. Add CA and URL download support Signed-off-by: Malinga Tembo --- hooks/playbooks/README.md | 5 +- .../install-openstack-lightspeed.yml | 48 +++++++++++-------- 2 files changed, 31 insertions(+), 22 deletions(-) diff --git a/hooks/playbooks/README.md b/hooks/playbooks/README.md index 0baa754c9..3a45e7974 100644 --- a/hooks/playbooks/README.md +++ b/hooks/playbooks/README.md @@ -26,7 +26,7 @@ None ## install-openstack-lightspeed.yml Installs OpenStack Lightspeed operator and creates the OpenStackLightspeed custom resource. -This hook deploys the operator, waits for it to be ready, then creates a CR to deploy the service. +This hook deploys the operator, waits for it to be ready, then creates a CR to deploy the service. The CI job calling this hook is responsible for waiting for full service health. ### Input @@ -43,7 +43,8 @@ This hook deploys the operator, waits for it to be ready, then creates a CR to d * `cifmw_openstack_lightspeed_llm_credentials`: (String) Secret name containing LLM API token. Defaults to `openstack-lightspeed-apitoken`. * `cifmw_openstack_lightspeed_api_token`: (String) LLM API token value. If provided, playbook creates the secret. If not provided, playbook validates secret exists. * `cifmw_openstack_lightspeed_tls_ca_cert_bundle`: (String) ConfigMap name containing TLS CA certificates. Defaults to `openstack-lightspeed-certs`. -* `cifmw_openstack_lightspeed_ca_cert`: (String) TLS CA certificate content. If provided, playbook creates the ConfigMap. If not provided, playbook validates ConfigMap exists. +* `cifmw_openstack_lightspeed_ca_cert_url`: (String) URL to download TLS CA certificate from. If provided, playbook downloads cert from URL and creates the ConfigMap. Example: `http://certs.corp.redhat.com/certs/Current-IT-Root-CAs.pem` +* `cifmw_openstack_lightspeed_ca_cert`: (String) TLS CA certificate content. If provided (and URL not provided), playbook creates the ConfigMap from this content. If neither URL nor content provided, playbook validates ConfigMap exists. * `cifmw_openstack_lightspeed_cr_name`: (String) Name for OpenStackLightspeed CR. Defaults to `openstacklightspeed-sample`. ### Output diff --git a/hooks/playbooks/install-openstack-lightspeed.yml b/hooks/playbooks/install-openstack-lightspeed.yml index dfacd3187..9168ae89e 100644 --- a/hooks/playbooks/install-openstack-lightspeed.yml +++ b/hooks/playbooks/install-openstack-lightspeed.yml @@ -135,6 +135,7 @@ stringData: apitoken: "{{ cifmw_openstack_lightspeed_api_token }}" when: cifmw_openstack_lightspeed_api_token is defined + no_log: true - name: Verify LLM credentials secret exists kubernetes.core.k8s_info: @@ -145,7 +146,27 @@ failed_when: secret_check.resources | length == 0 when: cifmw_openstack_lightspeed_api_token is not defined - - name: Create TLS CA certificate bundle ConfigMap + - name: Download TLS CA certificate from URL + ansible.builtin.uri: + url: "{{ cifmw_openstack_lightspeed_ca_cert_url }}" + return_content: true + register: ca_cert_download + when: cifmw_openstack_lightspeed_ca_cert_url is defined + + - name: Create TLS CA certificate bundle ConfigMap (from URL) + kubernetes.core.k8s: + state: present + definition: + apiVersion: v1 + kind: ConfigMap + metadata: + name: "{{ cifmw_openstack_lightspeed_tls_ca_cert_bundle | default('openstack-lightspeed-certs') }}" + namespace: "{{ openstack_lightspeed_namespace }}" + data: + ca-bundle.crt: "{{ ca_cert_download.content }}" + when: cifmw_openstack_lightspeed_ca_cert_url is defined + + - name: Create TLS CA certificate bundle ConfigMap (from content) kubernetes.core.k8s: state: present definition: @@ -156,7 +177,9 @@ namespace: "{{ openstack_lightspeed_namespace }}" data: ca-bundle.crt: "{{ cifmw_openstack_lightspeed_ca_cert }}" - when: cifmw_openstack_lightspeed_ca_cert is defined + when: + - cifmw_openstack_lightspeed_ca_cert is defined + - cifmw_openstack_lightspeed_ca_cert_url is not defined - name: Verify TLS certificate bundle ConfigMap exists kubernetes.core.k8s_info: @@ -165,7 +188,9 @@ namespace: "{{ openstack_lightspeed_namespace }}" register: cert_check failed_when: cert_check.resources | length == 0 - when: cifmw_openstack_lightspeed_ca_cert is not defined + when: + - cifmw_openstack_lightspeed_ca_cert is not defined + - cifmw_openstack_lightspeed_ca_cert_url is not defined # STEP 4: Create OpenStackLightspeed CR to deploy the service # Note: Uses configurable parameters for LLM integration @@ -190,23 +215,6 @@ llmCredentials: "{{ cifmw_openstack_lightspeed_llm_credentials | default('openstack-lightspeed-apitoken') }}" tlsCACertBundle: "{{ cifmw_openstack_lightspeed_tls_ca_cert_bundle | default('openstack-lightspeed-certs') }}" - - name: Wait for OpenStackLightspeed CR to be ready - kubernetes.core.k8s_info: - api_version: lightspeed.openstack.org/v1beta1 - kind: OpenStackLightspeed - name: "{{ cifmw_openstack_lightspeed_cr_name | default('openstacklightspeed-sample') }}" - namespace: "{{ openstack_lightspeed_namespace }}" - register: osls_cr - until: - - osls_cr.resources is defined - - osls_cr.resources | length > 0 - - osls_cr.resources[0].status is defined - - osls_cr.resources[0].status.conditions is defined - - osls_cr.resources[0].status.conditions | selectattr('type', 'equalto', 'Ready') | selectattr('status', 'equalto', 'True') | list | length > 0 - retries: 60 - delay: 10 - ignore_errors: true - - name: Display deployment summary ansible.builtin.debug: msg: From 4c0c896e76cb95f31374e233e00f7b1074ca27b8 Mon Sep 17 00:00:00 2001 From: malingatembo Date: Wed, 19 Aug 2026 13:25:55 +0200 Subject: [PATCH 5/8] Removed inline REQUIRED comments, feedback from lpiwowar --- hooks/playbooks/install-openstack-lightspeed.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/hooks/playbooks/install-openstack-lightspeed.yml b/hooks/playbooks/install-openstack-lightspeed.yml index 9168ae89e..75f2f9050 100644 --- a/hooks/playbooks/install-openstack-lightspeed.yml +++ b/hooks/playbooks/install-openstack-lightspeed.yml @@ -205,12 +205,8 @@ name: "{{ cifmw_openstack_lightspeed_cr_name | default('openstacklightspeed-sample') }}" namespace: "{{ openstack_lightspeed_namespace }}" spec: - # REQUIRED: LLM endpoint must be provided via cifmw_openstack_lightspeed_llm_endpoint - # Example: https://your-llm-service/v1/chat/completions llmEndpoint: "{{ cifmw_openstack_lightspeed_llm_endpoint }}" llmEndpointType: "{{ cifmw_openstack_lightspeed_llm_endpoint_type | default('openai') }}" - # REQUIRED: Model name must be provided via cifmw_openstack_lightspeed_model_name - # Example: gpt-4, llama3.1:8b, granite-3.1-8b modelName: "{{ cifmw_openstack_lightspeed_model_name }}" llmCredentials: "{{ cifmw_openstack_lightspeed_llm_credentials | default('openstack-lightspeed-apitoken') }}" tlsCACertBundle: "{{ cifmw_openstack_lightspeed_tls_ca_cert_bundle | default('openstack-lightspeed-certs') }}" From 7b0eb9a679b31f83b62d9392c551400e4e6df3f2 Mon Sep 17 00:00:00 2001 From: malingatembo Date: Wed, 19 Aug 2026 15:37:37 +0200 Subject: [PATCH 6/8] Fix CA cert URL example to HTTPS (resolves coderabbit issue) The example incorrectly showed HTTP. Updated to HTTPS and documented the requirement. In fact RH cert server uses HTTPS. Fixes coderabbit security concern. Signed-off-by: Malinga Tembo " --- hooks/playbooks/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hooks/playbooks/README.md b/hooks/playbooks/README.md index 3a45e7974..b893a258a 100644 --- a/hooks/playbooks/README.md +++ b/hooks/playbooks/README.md @@ -43,7 +43,7 @@ This hook deploys the operator, waits for it to be ready, then creates a CR to d * `cifmw_openstack_lightspeed_llm_credentials`: (String) Secret name containing LLM API token. Defaults to `openstack-lightspeed-apitoken`. * `cifmw_openstack_lightspeed_api_token`: (String) LLM API token value. If provided, playbook creates the secret. If not provided, playbook validates secret exists. * `cifmw_openstack_lightspeed_tls_ca_cert_bundle`: (String) ConfigMap name containing TLS CA certificates. Defaults to `openstack-lightspeed-certs`. -* `cifmw_openstack_lightspeed_ca_cert_url`: (String) URL to download TLS CA certificate from. If provided, playbook downloads cert from URL and creates the ConfigMap. Example: `http://certs.corp.redhat.com/certs/Current-IT-Root-CAs.pem` +* `cifmw_openstack_lightspeed_ca_cert_url`: (String) URL to download TLS CA certificate from. If provided, playbook downloads cert from URL and creates the ConfigMap. Example: `https://certs.corp.redhat.com/certs/Current-IT-Root-CAs.pem` * `cifmw_openstack_lightspeed_ca_cert`: (String) TLS CA certificate content. If provided (and URL not provided), playbook creates the ConfigMap from this content. If neither URL nor content provided, playbook validates ConfigMap exists. * `cifmw_openstack_lightspeed_cr_name`: (String) Name for OpenStackLightspeed CR. Defaults to `openstacklightspeed-sample`. From 7a8915dd39c3adcdc841d8d0bba01665c7a8a4c3 Mon Sep 17 00:00:00 2001 From: malingatembo Date: Fri, 21 Aug 2026 08:59:36 +0200 Subject: [PATCH 7/8] Add no_log to secret verification and merge ConfigMap tasks Per lpiwowar feedback: - Add no_log to secret verification task (prevent token leak with -vvvv) - Merge two ConfigMap creation tasks into one with conditional logic Signed-off-by: Malinga Tembo --- .../install-openstack-lightspeed.yml | 23 ++++--------------- 1 file changed, 5 insertions(+), 18 deletions(-) diff --git a/hooks/playbooks/install-openstack-lightspeed.yml b/hooks/playbooks/install-openstack-lightspeed.yml index 75f2f9050..069d2d871 100644 --- a/hooks/playbooks/install-openstack-lightspeed.yml +++ b/hooks/playbooks/install-openstack-lightspeed.yml @@ -145,6 +145,7 @@ register: secret_check failed_when: secret_check.resources | length == 0 when: cifmw_openstack_lightspeed_api_token is not defined + no_log: true - name: Download TLS CA certificate from URL ansible.builtin.uri: @@ -153,7 +154,7 @@ register: ca_cert_download when: cifmw_openstack_lightspeed_ca_cert_url is defined - - name: Create TLS CA certificate bundle ConfigMap (from URL) + - name: Create TLS CA certificate bundle ConfigMap kubernetes.core.k8s: state: present definition: @@ -163,23 +164,9 @@ name: "{{ cifmw_openstack_lightspeed_tls_ca_cert_bundle | default('openstack-lightspeed-certs') }}" namespace: "{{ openstack_lightspeed_namespace }}" data: - ca-bundle.crt: "{{ ca_cert_download.content }}" - when: cifmw_openstack_lightspeed_ca_cert_url is defined - - - name: Create TLS CA certificate bundle ConfigMap (from content) - kubernetes.core.k8s: - state: present - definition: - apiVersion: v1 - kind: ConfigMap - metadata: - name: "{{ cifmw_openstack_lightspeed_tls_ca_cert_bundle | default('openstack-lightspeed-certs') }}" - namespace: "{{ openstack_lightspeed_namespace }}" - data: - ca-bundle.crt: "{{ cifmw_openstack_lightspeed_ca_cert }}" - when: - - cifmw_openstack_lightspeed_ca_cert is defined - - cifmw_openstack_lightspeed_ca_cert_url is not defined + ca-bundle.crt: >- + {{ ca_cert_download.content if cifmw_openstack_lightspeed_ca_cert_url is defined else cifmw_openstack_lightspeed_ca_cert }} + when: cifmw_openstack_lightspeed_ca_cert_url is defined or cifmw_openstack_lightspeed_ca_cert is defined - name: Verify TLS certificate bundle ConfigMap exists kubernetes.core.k8s_info: From 9c76c36ff7c9790157d61264e1c2e645c0600739 Mon Sep 17 00:00:00 2001 From: Jan Cervenka Date: Tue, 25 Aug 2026 13:27:42 +0200 Subject: [PATCH 8/8] Add resources required to run lightspeed-tests test-operator expects a ConfigMap and two secrets to exists before it will start executing a test suite. We create the expected dummy resources with not data to satisfy the requirement. test-operator is using the default ServiceAccount to run this test. We need to create a ClusterRole and ClusterRoleBinding to grant the default SA access to the Lightspeed service. Signed-off-by: Jan Cervenka --- .../install-openstack-lightspeed.yml | 84 +++++++++++++++++++ 1 file changed, 84 insertions(+) diff --git a/hooks/playbooks/install-openstack-lightspeed.yml b/hooks/playbooks/install-openstack-lightspeed.yml index 069d2d871..b5c25ec18 100644 --- a/hooks/playbooks/install-openstack-lightspeed.yml +++ b/hooks/playbooks/install-openstack-lightspeed.yml @@ -76,6 +76,35 @@ metadata: name: "{{ openstack_lightspeed_namespace }}" + - name: Create ClusterRole for Lightspeed tests + kubernetes.core.k8s: + state: present + definition: + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRole + metadata: + name: "lightspeed-test-role" + rules: + - nonResourceURLs: ["/ls-access"] + verbs: ["get"] + + - name: Create ClusterRoleBinding for Lightspeed tests + kubernetes.core.k8s: + state: present + definition: + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRoleBinding + metadata: + name: "lightspeed-test-role-binding" + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: "lightspeed-test-role" + subjects: + - kind: ServiceAccount + name: "default" + namespace: "{{ openstack_lightspeed_namespace }}" + - name: Create OperatorGroup for OpenStack Lightspeed kubernetes.core.k8s: state: present @@ -179,6 +208,61 @@ - cifmw_openstack_lightspeed_ca_cert is not defined - cifmw_openstack_lightspeed_ca_cert_url is not defined + - name: Create test-operator dummy config ConfigMap + kubernetes.core.k8s: + state: present + definition: + apiVersion: v1 + kind: ConfigMap + metadata: + name: "test-operator-dummy-config" + namespace: "{{ openstack_lightspeed_namespace }}" + labels: + app: "lightspeed-tests" + persistent: "true" + managed-by: "test-operator" + data: + clouds.yaml: | + # Dummy file - not used by lightspeed tests + # Required by test-operator but lightspeed tests don't need OpenStack + + - name: Create test-operator dummy secret + kubernetes.core.k8s: + state: present + definition: + apiVersion: v1 + kind: Secret + metadata: + name: "test-operator-dummy-secret" + namespace: "{{ openstack_lightspeed_namespace }}" + labels: + app: "lightspeed-tests" + persistent: "true" + managed-by: "test-operator" + type: Opaque + stringData: + secure.yaml: | + # Dummy file - not used by lightspeed tests + # Required by test-operator but lightspeed tests don't need OpenStack + + - name: Create dataplane-ansible-ssh-private-key-secret + kubernetes.core.k8s: + state: present + definition: + apiVersion: v1 + kind: Secret + metadata: + name: "dataplane-ansible-ssh-private-key-secret" + namespace: "{{ openstack_lightspeed_namespace }}" + labels: + app: "lightspeed-tests" + persistent: "true" + managed-by: "test-operator" + type: Opaque + stringData: + ssh-privatekey: | + # Dummy SSH key - not used by lightspeed tests + # STEP 4: Create OpenStackLightspeed CR to deploy the service # Note: Uses configurable parameters for LLM integration