OTA-2064: Rename Proposal API to AgenticRun#1422
Open
jrangelramos wants to merge 4 commits into
Open
Conversation
The upstream lightspeed-agentic-operator renamed the Proposal CRD to AgenticRun (OLS-3295). Align CVO by renaming pkg/proposal to pkg/agenticrun and updating all references: types, functions, variables, log strings, env vars, integration tests, and the lightspeed prompt ConfigMap according to OTA-2064. Updates the lightspeed-agentic-operator/api dependency to pick up the renamed types. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
openshift-ci-robot
added
the
jira/valid-reference
Contributor
|
@jrangelramos: This pull request references OTA-2064 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (4)
🚧 Files skipped from review as they are similar to previous changes (3)
WalkthroughThe CVO lifecycle integration is migrated from Proposal resources to AgenticRun resources. The change updates CRD contracts, reconciliation and controller wiring, readiness prompts, dependency pins, scheme registration, unit tests, and end-to-end AgenticRun validation. ChangesAgenticRun lifecycle migration
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant CVO
participant AgenticRunController
participant KubernetesAPI
CVO->>AgenticRunController: Queue reconciliation
AgenticRunController->>KubernetesAPI: List AgenticRuns
AgenticRunController->>KubernetesAPI: Reconcile owned runs
AgenticRunController->>KubernetesAPI: Create missing AgenticRuns
AgenticRunController->>KubernetesAPI: Delete expired or irrelevant runs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 12 | ❌ 3❌ Failed checks (2 warnings, 1 inconclusive)
✅ Passed checks (12 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: jrangelramos The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
4 tasks
Re-sync CRD YAMLs from lightspeed-agentic-operator post-PR#285: - Replace proposals.yaml with agenticruns.yaml - Add new agenticrunapprovals.yaml CRD - Update analysisresults, agents, llmproviders, approvalpolicies CRDs - All CRDs carry OpenShift release annotations Rename test fixture resource names from proposal-* to run-*. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 11
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
install/0000_00_cluster-version-operator_45_lightspeed-crd-agenticruns.yaml (1)
231-240: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winUse the operator namespace consistently for required secrets.
Each outer description says secrets belong in the AgenticRun namespace, while its item description says the operator namespace.
install/0000_00_cluster-version-operator_45_lightspeed-crd-agenticruns.yaml#L231-L240: change the outer description to the operator namespace.install/0000_00_cluster-version-operator_45_lightspeed-crd-agenticruns.yaml#L648-L657: change the execution description likewise.install/0000_00_cluster-version-operator_45_lightspeed-crd-agenticruns.yaml#L1065-L1074: change the shared-tools description likewise.install/0000_00_cluster-version-operator_45_lightspeed-crd-agenticruns.yaml#L1442-L1451: change the verification description likewise.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@install/0000_00_cluster-version-operator_45_lightspeed-crd-agenticruns.yaml` around lines 231 - 240, Update the outer required-secrets descriptions to consistently state that Secrets must exist in the operator namespace, matching the nested SecretRequirement descriptions. Apply this wording to the AgenticRun requiredSecrets section at install/0000_00_cluster-version-operator_45_lightspeed-crd-agenticruns.yaml lines 231-240, execution at lines 648-657, shared-tools at lines 1065-1074, and verification at lines 1442-1451.install/0000_00_cluster-version-operator_47_lightspeed-crd-llmproviders.yaml (1)
4-8: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winAdd the required resource description annotation.
This install manifest lacks a
kubernetes.io/descriptionannotation.metadata: annotations: + kubernetes.io/description: Configures LLM provider backends used by AgenticRun agents.As per path instructions, “Use kubernetes.io/description annotations to explain the resource's purpose.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@install/0000_00_cluster-version-operator_47_lightspeed-crd-llmproviders.yaml` around lines 4 - 8, Add a kubernetes.io/description annotation to the metadata.annotations block of the install manifest, using a concise description of the LLMProviders resource’s purpose while preserving the existing annotations.Source: Path instructions
test/cvo/agenticrun.go (1)
91-99: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winVerify the newly installed approval CRDs.
The installation test omits
agenticrunapprovals.agentic.openshift.ioandapprovalpolicies.agentic.openshift.io, so this migration can pass even when either new CRD is absent.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/cvo/agenticrun.go` around lines 91 - 99, Update the CRD name list in the “should install light speed CRDs correctly” test to include agenticrunapprovals.agentic.openshift.io and approvalpolicies.agentic.openshift.io, so both approval CRDs are validated with the existing TechPreview and not-found assertions.
🧹 Nitpick comments (1)
install/0000_00_cluster-version-operator_47_lightspeed-crd-approvalpolicies.yaml (1)
4-8: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd the resource-purpose annotation.
This new install manifest lacks a
kubernetes.io/descriptionannotation.Proposed fix
metadata: annotations: + kubernetes.io/description: Configures default approval behavior for AgenticRun workflow stages.As per path instructions: “Use kubernetes.io/description annotations to explain the resource's purpose.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@install/0000_00_cluster-version-operator_47_lightspeed-crd-approvalpolicies.yaml` around lines 4 - 8, Add a kubernetes.io/description annotation under metadata.annotations in the cluster-version-operator approval policies manifest, with text explaining the resource’s purpose. Preserve the existing release and controller-gen annotations unchanged.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@install/0000_00_cluster-version-operator_45_lightspeed-crd-agenticrunapprovals.yaml`:
- Around line 4-9: Add a kubernetes.io/description annotation explaining the
purpose of the AgenticRunApproval resource in
install/0000_00_cluster-version-operator_45_lightspeed-crd-agenticrunapprovals.yaml
lines 4-9, the AgenticRun resource in
install/0000_00_cluster-version-operator_45_lightspeed-crd-agenticruns.yaml
lines 4-9, and the Agent resource in
install/0000_00_cluster-version-operator_46_lightspeed-crd-agents.yaml lines
4-9.
- Around line 144-177: Require the execution.option field in the execution
object and add update validation so execution-specific selections cannot change
after creation. Use the execution schema’s x-kubernetes-validations to preserve
the existing option and agent values whenever an old execution value exists,
while allowing them to be set initially; apply the same rule to the
corresponding execution schema section noted in the comment.
In `@install/0000_00_cluster-version-operator_45_lightspeed-crd-agenticruns.yaml`:
- Around line 30-44: Update both top-level AgenticRun examples in the CRD
description, including the additional occurrence, so each skill entry includes
the required paths field alongside its image. Ensure resources copied from
either example satisfy the current skill schema.
- Around line 1671-1673: Update the validation rule for analysisOutput to
require oldSelf.analysisOutput and self.analysisOutput to have matching
presence, then compare their values when present. Ensure both initially unset
and initially set values remain unchanged after creation.
In
`@install/0000_00_cluster-version-operator_47_lightspeed-crd-analysisresults.yaml`:
- Around line 417-445: Update the action object schema’s required list to
include command alongside description and type, ensuring every executable
remediation action provides a non-empty command. Keep the existing command field
validation unchanged and preserve the current action contract.
In
`@install/0000_00_cluster-version-operator_47_lightspeed-crd-approvalpolicies.yaml`:
- Around line 53-77: Update the ApprovalPolicy spec schema by removing
minProperties: 1 so spec: {} is accepted, and add the documented default value
of 1 to the maxAttempts property alongside its existing constraints.
In
`@install/0000_00_cluster-version-operator_47_lightspeed-crd-llmproviders.yaml`:
- Around line 88-106: Update the URL validation rules for the endpoint fields in
the Anthropic, AWS Bedrock, Azure OpenAI, Vertex AI, and OpenAI CRD sections to
require the `https` scheme instead of allowing `http` or `https`. Preserve the
existing hostname, userinfo, fragment, and length validations across each
corresponding `x-kubernetes-validations` block.
In `@pkg/agenticrun/controller_test.go`:
- Around line 574-579: Update the deletion verification loop over
tt.expectedDeleted to require kerrors.IsNotFound(err) rather than accepting any
non-nil error. Preserve the existing failure message and ensure unexpected
client or scheme errors cause the test to fail, matching the single-resource
deletion check.
In `@pkg/agenticrun/controller.go`:
- Around line 150-160: Move the Progressing condition check in the agentic run
sync flow so deleteAgenticRuns executes before any early return. When
cv.Status.Conditions indicates Progressing=True, continue garbage collection but
skip only creation and readiness collection; preserve the existing deletion
inputs and behavior.
- Around line 204-220: Update the expired-run replacement flow around expired
and deleteAgenticRun so it does not immediately call c.client.Create after a
successful deletion. Wait until the existing AgenticRun is confirmed absent, or
requeue the reconciliation and retry creation later, ensuring AlreadyExists from
deletion latency is not silently dropped.
In `@test/cvo/agenticrun.go`:
- Around line 125-137: Update the agentic run selection predicate inside the
wait.PollUntilContextTimeout callback to require both a CreationTimestamp after
now and a request containing the expected channel. Replace the current OR
relationship with an AND while preserving the existing polling and result
handling.
---
Outside diff comments:
In `@install/0000_00_cluster-version-operator_45_lightspeed-crd-agenticruns.yaml`:
- Around line 231-240: Update the outer required-secrets descriptions to
consistently state that Secrets must exist in the operator namespace, matching
the nested SecretRequirement descriptions. Apply this wording to the AgenticRun
requiredSecrets section at
install/0000_00_cluster-version-operator_45_lightspeed-crd-agenticruns.yaml
lines 231-240, execution at lines 648-657, shared-tools at lines 1065-1074, and
verification at lines 1442-1451.
In
`@install/0000_00_cluster-version-operator_47_lightspeed-crd-llmproviders.yaml`:
- Around line 4-8: Add a kubernetes.io/description annotation to the
metadata.annotations block of the install manifest, using a concise description
of the LLMProviders resource’s purpose while preserving the existing
annotations.
In `@test/cvo/agenticrun.go`:
- Around line 91-99: Update the CRD name list in the “should install light speed
CRDs correctly” test to include agenticrunapprovals.agentic.openshift.io and
approvalpolicies.agentic.openshift.io, so both approval CRDs are validated with
the existing TechPreview and not-found assertions.
---
Nitpick comments:
In
`@install/0000_00_cluster-version-operator_47_lightspeed-crd-approvalpolicies.yaml`:
- Around line 4-8: Add a kubernetes.io/description annotation under
metadata.annotations in the cluster-version-operator approval policies manifest,
with text explaining the resource’s purpose. Preserve the existing release and
controller-gen annotations unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: a0dcb222-7da4-4caa-843e-57303658e61a
⛔ Files ignored due to path filters (205)
go.sumis excluded by!**/*.sum,!go.sumvendor/github.com/fxamacker/cbor/v2/.golangci.ymlis excluded by!vendor/**,!**/vendor/**vendor/github.com/fxamacker/cbor/v2/README.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/fxamacker/cbor/v2/cache.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fxamacker/cbor/v2/decode.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fxamacker/cbor/v2/decode_map_utils.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fxamacker/cbor/v2/diagnose.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fxamacker/cbor/v2/doc.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fxamacker/cbor/v2/encode.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fxamacker/cbor/v2/simplevalue.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fxamacker/cbor/v2/stream.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fxamacker/cbor/v2/structfields.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fxamacker/cbor/v2/tag.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/fxamacker/cbor/v2/valid.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/lightspeed-agentic-operator/api/v1alpha1/agent_types.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/lightspeed-agentic-operator/api/v1alpha1/agenticolsconfig_types.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/lightspeed-agentic-operator/api/v1alpha1/agenticrun_analysis_types.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/lightspeed-agentic-operator/api/v1alpha1/agenticrun_status_types.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/lightspeed-agentic-operator/api/v1alpha1/agenticrun_types.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/lightspeed-agentic-operator/api/v1alpha1/agenticrunapproval_types.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/lightspeed-agentic-operator/api/v1alpha1/analysisresult_types.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/lightspeed-agentic-operator/api/v1alpha1/approvalpolicy_types.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/lightspeed-agentic-operator/api/v1alpha1/escalationresult_types.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/lightspeed-agentic-operator/api/v1alpha1/executionresult_types.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/lightspeed-agentic-operator/api/v1alpha1/llmprovider_types.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/lightspeed-agentic-operator/api/v1alpha1/result_types.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/lightspeed-agentic-operator/api/v1alpha1/shared_types.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/lightspeed-agentic-operator/api/v1alpha1/tools_types.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/lightspeed-agentic-operator/api/v1alpha1/verificationresult_types.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/openshift/lightspeed-agentic-operator/api/v1alpha1/zz_generated.deepcopy.gois excluded by!vendor/**,!**/vendor/**,!**/zz_generated*vendor/golang.org/x/net/html/entity.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/html/escape.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/html/foreign.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/html/iter.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/html/parse.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/html/render.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/html/token.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http/httpproxy/proxy.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/README.mdis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/client_conn_pool.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/clientconn.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/config.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/frame.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/http2.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/server.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/server_common.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/server_wrap.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/transport.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/transport_common.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/transport_wrap.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/writesched.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/writesched_common.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/writesched_priority_rfc7540.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/writesched_priority_rfc9218.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/writesched_random.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/http2/writesched_roundrobin.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/go118.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/idna.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/idna9.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/pre_go118.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/punycode.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/tables10.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/tables11.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/tables12.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/tables13.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/tables15.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/tables17.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/tables9.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/trie12.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/idna/trie13.0.0.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/net/internal/httpcommon/request.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sync/errgroup/errgroup.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/plan9/syscall_plan9.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/affinity_linux.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/mkall.shis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/mkerrors.shis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/readv_unix.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/syscall_darwin.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/syscall_linux.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/syscall_linux_arm.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/syscall_linux_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/syscall_linux_loong64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/syscall_linux_riscv64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/syscall_openbsd.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_386.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_amd64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_arm.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_loong64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_s390x.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsyscall_linux.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.sis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.sis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.sis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.sis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.sis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.sis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.sis excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_386.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_amd64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_arm.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_loong64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mips.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mips64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mips64le.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_mipsle.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_ppc.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64le.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_s390x.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/zsysnum_linux_sparc64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_386.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_amd64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_arm.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_arm64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_loong64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mips.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mips64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_ppc.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_s390x.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/aliases.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/dll_windows.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/security_windows.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/syscall_windows.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/types_windows.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/sys/windows/zsyscall_windows.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/unicode/norm/forminfo.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/unicode/norm/iter.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/text/unicode/norm/normalize.gois excluded by!vendor/**,!**/vendor/**vendor/golang.org/x/tools/go/ast/edge/edge.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/alias.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_any.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_default.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_funcs.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_inlined.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_methods.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_time.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/errors.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/fields.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/fold.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/intern.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/internal.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonflags/flags.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonopts/options.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire/decode.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire/encode.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire/wire.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/alias.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/decode.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/doc.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/encode.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/errors.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/export.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/options.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/pools.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/quote.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/state.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/token.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/value.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/options.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/kube-openapi/pkg/schemaconv/openapi.gois excluded by!vendor/**,!**/vendor/**vendor/k8s.io/utils/ptr/OWNERSis excluded by!vendor/**,!**/vendor/**vendor/k8s.io/utils/ptr/ptr.gois excluded by!vendor/**,!**/vendor/**vendor/modules.txtis excluded by!vendor/**,!**/vendor/**vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/element.gois excluded by!vendor/**,!**/vendor/**vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/pathelementmap.gois excluded by!vendor/**,!**/vendor/**vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/serialize-pe.gois excluded by!vendor/**,!**/vendor/**vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/serialize.gois excluded by!vendor/**,!**/vendor/**vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/set.gois excluded by!vendor/**,!**/vendor/**vendor/sigs.k8s.io/structured-merge-diff/v6/schema/elements.gois excluded by!vendor/**,!**/vendor/**vendor/sigs.k8s.io/structured-merge-diff/v6/schema/equals.gois excluded by!vendor/**,!**/vendor/**vendor/sigs.k8s.io/structured-merge-diff/v6/schema/schemaschema.gois excluded by!vendor/**,!**/vendor/**vendor/sigs.k8s.io/structured-merge-diff/v6/typed/remove.gois excluded by!vendor/**,!**/vendor/**vendor/sigs.k8s.io/structured-merge-diff/v6/value/allocator.gois excluded by!vendor/**,!**/vendor/**vendor/sigs.k8s.io/structured-merge-diff/v6/value/jsontagutil.gois excluded by!vendor/**,!**/vendor/**vendor/sigs.k8s.io/structured-merge-diff/v6/value/reflectcache.gois excluded by!vendor/**,!**/vendor/**vendor/sigs.k8s.io/structured-merge-diff/v6/value/value.gois excluded by!vendor/**,!**/vendor/**
📒 Files selected for processing (19)
.openshift-tests-extension/openshift_payload_cluster-version-operator.jsongo.modinstall/0000_00_cluster-version-operator_45_lightspeed-crd-agenticrunapprovals.yamlinstall/0000_00_cluster-version-operator_45_lightspeed-crd-agenticruns.yamlinstall/0000_00_cluster-version-operator_46_lightspeed-crd-agents.yamlinstall/0000_00_cluster-version-operator_47_lightspeed-crd-analysisresults.yamlinstall/0000_00_cluster-version-operator_47_lightspeed-crd-approvalpolicies.yamlinstall/0000_00_cluster-version-operator_47_lightspeed-crd-llmproviders.yamlinstall/0000_00_cluster-version-operator_50_lightspeed-prompts.yamlpkg/agenticrun/analysis_schema.jsonpkg/agenticrun/controller.gopkg/agenticrun/controller_test.gopkg/cvo/availableupdates.gopkg/cvo/availableupdates_test.gopkg/cvo/cvo.gopkg/cvo/cvo_test.gopkg/cvo/status.gopkg/internal/schema.gotest/cvo/agenticrun.go
Comment on lines
+4
to
+9
| metadata: | ||
| annotations: | ||
| include.release.openshift.io/self-managed-high-availability: "true" | ||
| release.openshift.io/feature-set: TechPreviewNoUpgrade | ||
| controller-gen.kubebuilder.io/version: v0.19.0 | ||
| name: agenticrunapprovals.agentic.openshift.io |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Add the required resource description annotations.
install/0000_00_cluster-version-operator_45_lightspeed-crd-agenticrunapprovals.yaml#L4-L9: add akubernetes.io/descriptionannotation describing AgenticRunApproval.install/0000_00_cluster-version-operator_45_lightspeed-crd-agenticruns.yaml#L4-L9: add akubernetes.io/descriptionannotation describing AgenticRun.install/0000_00_cluster-version-operator_46_lightspeed-crd-agents.yaml#L4-L9: add akubernetes.io/descriptionannotation describing Agent.
As per path instructions, “Use kubernetes.io/description annotations to explain the resource's purpose.”
📍 Affects 3 files
install/0000_00_cluster-version-operator_45_lightspeed-crd-agenticrunapprovals.yaml#L4-L9(this comment)install/0000_00_cluster-version-operator_45_lightspeed-crd-agenticruns.yaml#L4-L9install/0000_00_cluster-version-operator_46_lightspeed-crd-agents.yaml#L4-L9
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@install/0000_00_cluster-version-operator_45_lightspeed-crd-agenticrunapprovals.yaml`
around lines 4 - 9, Add a kubernetes.io/description annotation explaining the
purpose of the AgenticRunApproval resource in
install/0000_00_cluster-version-operator_45_lightspeed-crd-agenticrunapprovals.yaml
lines 4-9, the AgenticRun resource in
install/0000_00_cluster-version-operator_45_lightspeed-crd-agenticruns.yaml
lines 4-9, and the Agent resource in
install/0000_00_cluster-version-operator_46_lightspeed-crd-agents.yaml lines
4-9.
Source: Path instructions
Comment on lines
+144
to
+177
| execution: | ||
| description: |- | ||
| execution contains approval parameters for the execution step. | ||
| Required when type is Execution. | ||
| minProperties: 1 | ||
| properties: | ||
| agent: | ||
| default: default | ||
| description: agent is the Agent CR for this step. Defaults | ||
| to "default". | ||
| maxLength: 253 | ||
| minLength: 1 | ||
| type: string | ||
| x-kubernetes-validations: | ||
| - message: 'must be a valid DNS subdomain: lowercase alphanumeric | ||
| characters, hyphens, and dots' | ||
| rule: '!format.dns1123Subdomain().validate(self).hasValue()' | ||
| maxAttempts: | ||
| description: |- | ||
| maxAttempts is the number of execution retry attempts approved | ||
| for this agentic run. Must not exceed ApprovalPolicy.spec.maxAttempts. | ||
| Defaults to 1 if unset. | ||
| format: int32 | ||
| maximum: 3 | ||
| minimum: 1 | ||
| type: integer | ||
| option: | ||
| description: |- | ||
| option is the 0-based index into the analysis options array | ||
| selecting which remediation approach to execute. | ||
| format: int32 | ||
| minimum: 0 | ||
| type: integer | ||
| type: object |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Require and freeze the selected execution option.
The schema accepts an Execution stage without execution.option, and later permits changing its option or agent. This allows execution to diverge from what was approved. Require option and make stage-specific parameters immutable once added.
Also applies to: 205-240
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@install/0000_00_cluster-version-operator_45_lightspeed-crd-agenticrunapprovals.yaml`
around lines 144 - 177, Require the execution.option field in the execution
object and add update validation so execution-specific selections cannot change
after creation. Use the execution schema’s x-kubernetes-validations to preserve
the existing option and agent values whenever an old execution value exists,
while allowing them to be set initially; apply the same rule to the
corresponding execution schema section noted in the comment.
Comment on lines
+30
to
+44
| description: "AgenticRun represents a unit of work managed by the agentic | ||
| platform.\nIt is the primary resource component teams and adapters interact | ||
| with.\n\nA AgenticRun defines the workflow shape inline: which steps run | ||
| and which\nagent handles each step. Analysis is always required. Omit execution\nand/or | ||
| verification to skip those steps.\n\nExample — analysis only (advisory):\n\n\tapiVersion: | ||
| agentic.openshift.io/v1alpha1\n\tkind: AgenticRun\n\tmetadata:\n\t name: | ||
| one-off-investigation\n\tspec:\n\t request: \"Investigate why pod foo is | ||
| crashlooping\"\n\t targetNamespaces:\n\t - lightspeed-demo\n\t tools:\n\t | ||
| \ skills:\n\t - image: registry.redhat.io/acs/acs-lightspeed-skills:latest\n\t | ||
| \ skills:\n\t - image: registry.redhat.io/acs/acs-agentic-skills:latest\n\t | ||
| \ analysis:\n\t agent: smart\n\nExample — full remediation (analyze → | ||
| execute → verify):\n\n\tapiVersion: agentic.openshift.io/v1alpha1\n\tkind: | ||
| Proposal\n\tmetadata:\n\t name: fix-nginx-cve-2024-1234\n\t namespace: | ||
| AgenticRun\n\tmetadata:\n\t name: fix-nginx-cve-2024-1234\n\t namespace: | ||
| stackrox\n\tspec:\n\t request: \"Fix CVE-2024-1234 in nginx:1.21\"\n\t | ||
| \ targetNamespaces:\n\t - lightspeed-demo\n\t tools:\n\t skills:\n\t | ||
| \ - image: registry.redhat.io/acs/acs-lightspeed-skills:latest\n\t requiredSecrets:\n\t | ||
| \ - image: registry.redhat.io/acs/acs-agentic-skills:latest\n\t requiredSecrets:\n\t |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Update the examples to include required skill paths.
Both top-level examples specify only a skill image, but paths is now required. Resources copied from these examples will be rejected.
Also applies to: 1269-1271
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@install/0000_00_cluster-version-operator_45_lightspeed-crd-agenticruns.yaml`
around lines 30 - 44, Update both top-level AgenticRun examples in the CRD
description, including the additional occurrence, so each skill entry includes
the required paths field alongside its image. Ensure resources copied from
either example satisfy the current skill schema.
Comment on lines
+1671
to
+1673
| - message: analysisOutput is immutable once set | ||
| rule: '!has(oldSelf.analysisOutput) || (has(self.analysisOutput) && | ||
| self.analysisOutput == oldSelf.analysisOutput)' |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
rg -n -C5 'analysisOutput|oldSelf\.analysisOutput' . \
--glob '*.go' --glob '*.yaml' --glob '*.json'Repository: openshift/cluster-version-operator
Length of output: 24764
Make analysisOutput immutable from creation. The current rule still allows an update from unset to set, so a run created without analysisOutput can be changed later despite the field contract saying it is fixed at creation. Require old/new presence to match before comparing values.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@install/0000_00_cluster-version-operator_45_lightspeed-crd-agenticruns.yaml`
around lines 1671 - 1673, Update the validation rule for analysisOutput to
require oldSelf.analysisOutput and self.analysisOutput to have matching
presence, then compare their values when present. Ensure both initially unset
and initially set values remain unchanged after creation.
Comment on lines
+417
to
+445
| command: | ||
| description: |- | ||
| command is the exact executable bash command using kubectl or oc | ||
| (e.g., "kubectl set image deployment/foo container=registry/foo:v1.3 -n production"). | ||
| Must be a concrete command that can be copy-pasted and run. | ||
| Maximum 4096 characters. | ||
| maxLength: 4096 | ||
| minLength: 1 | ||
| type: string | ||
| description: | ||
| description: |- | ||
| description is a Markdown-formatted explanation of what this command | ||
| does and why (e.g., "Increase memory limit from 256Mi to 512Mi"). | ||
| Maximum 4096 characters. | ||
| maxLength: 4096 | ||
| minLength: 1 | ||
| type: string | ||
| type: | ||
| description: |- | ||
| type is the action phase category: "pre-check", "mutation", "wait", | ||
| or "post-check". Free-form string to allow agents to express | ||
| domain-specific action types. Must be 1-256 characters. | ||
| maxLength: 256 | ||
| minLength: 1 | ||
| type: string | ||
| required: | ||
| - description | ||
| - type | ||
| type: object |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Require a command for every executable remediation action.
Line 442 omits command from required, allowing actions without the executable command promised by the schema. Require it, or revise the action contract and downstream executor to support commandless actions.
Proposed fix
required:
+ - command
- description
- type📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| command: | |
| description: |- | |
| command is the exact executable bash command using kubectl or oc | |
| (e.g., "kubectl set image deployment/foo container=registry/foo:v1.3 -n production"). | |
| Must be a concrete command that can be copy-pasted and run. | |
| Maximum 4096 characters. | |
| maxLength: 4096 | |
| minLength: 1 | |
| type: string | |
| description: | |
| description: |- | |
| description is a Markdown-formatted explanation of what this command | |
| does and why (e.g., "Increase memory limit from 256Mi to 512Mi"). | |
| Maximum 4096 characters. | |
| maxLength: 4096 | |
| minLength: 1 | |
| type: string | |
| type: | |
| description: |- | |
| type is the action phase category: "pre-check", "mutation", "wait", | |
| or "post-check". Free-form string to allow agents to express | |
| domain-specific action types. Must be 1-256 characters. | |
| maxLength: 256 | |
| minLength: 1 | |
| type: string | |
| required: | |
| - description | |
| - type | |
| type: object | |
| command: | |
| description: |- | |
| command is the exact executable bash command using kubectl or oc | |
| (e.g., "kubectl set image deployment/foo container=registry/foo:v1.3 -n production"). | |
| Must be a concrete command that can be copy-pasted and run. | |
| Maximum 4096 characters. | |
| maxLength: 4096 | |
| minLength: 1 | |
| type: string | |
| description: | |
| description: |- | |
| description is a Markdown-formatted explanation of what this command | |
| does and why (e.g., "Increase memory limit from 256Mi to 512Mi"). | |
| Maximum 4096 characters. | |
| maxLength: 4096 | |
| minLength: 1 | |
| type: string | |
| type: | |
| description: |- | |
| type is the action phase category: "pre-check", "mutation", "wait", | |
| or "post-check". Free-form string to allow agents to express | |
| domain-specific action types. Must be 1-256 characters. | |
| maxLength: 256 | |
| minLength: 1 | |
| type: string | |
| required: | |
| - command | |
| - description | |
| - type | |
| type: object |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@install/0000_00_cluster-version-operator_47_lightspeed-crd-analysisresults.yaml`
around lines 417 - 445, Update the action object schema’s required list to
include command alongside description and type, ensuring every executable
remediation action provides a non-empty command. Keep the existing command field
validation unchanged and preserve the current action contract.
Comment on lines
+88
to
+106
| url: | ||
| description: |- | ||
| url is an optional override for the Anthropic API endpoint. | ||
| Only needed for custom deployments or API proxies. | ||
| Must be a valid HTTP or HTTPS URL with a hostname. Paths and query | ||
| parameters are allowed. Fragments and userinfo are not permitted. | ||
| Maximum 2048 characters. | ||
| maxLength: 2048 | ||
| minLength: 1 | ||
| type: string | ||
| x-kubernetes-validations: | ||
| - message: must use http or https scheme | ||
| rule: isURL(self) && url(self).getScheme() in ['http', 'https'] | ||
| - message: must include a hostname | ||
| rule: isURL(self) && url(self).getHostname() != '' | ||
| - message: userinfo is not allowed in URL | ||
| rule: '!self.contains(''@'')' | ||
| - message: fragments are not allowed in URL | ||
| rule: '!self.contains(''#'')' |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Require HTTPS for endpoints that receive provider credentials.
Every override currently accepts plaintext HTTP. These clients authenticate using API keys or cloud credentials, so an HTTP endpoint can expose them in transit. Restrict the scheme to https, or provide a narrowly scoped, explicit development-only exception.
-- message: must use http or https scheme
- rule: isURL(self) && url(self).getScheme() in ['http', 'https']
+- message: must use https scheme
+ rule: isURL(self) && url(self).getScheme() == 'https'Apply this to Anthropic, AWS Bedrock, Azure OpenAI, Vertex AI, and OpenAI endpoint fields.
Also applies to: 147-165, 207-245, 312-330, 361-379
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@install/0000_00_cluster-version-operator_47_lightspeed-crd-llmproviders.yaml`
around lines 88 - 106, Update the URL validation rules for the endpoint fields
in the Anthropic, AWS Bedrock, Azure OpenAI, Vertex AI, and OpenAI CRD sections
to require the `https` scheme instead of allowing `http` or `https`. Preserve
the existing hostname, userinfo, fragment, and length validations across each
corresponding `x-kubernetes-validations` block.
- Run GC before Progressing early return so stale runs are cleaned up during upgrades - Skip creation after deleting expired run instead of risking AlreadyExists race; next reconcile loop will create the replacement - Use kerrors.IsNotFound in test deletion assertion instead of accepting any error - Add agenticrunapprovals and approvalpolicies to CRD install test - Use AND instead of OR for run selection predicate in e2e test to avoid matching stale runs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Run hack/update-test-metadata.sh after renaming the e2e test from "should create proposals" to "should create agentic runs". Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Contributor
|
@jrangelramos: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Member
|
/test e2e-agnostic-ovn-techpreview-serial-2of3 e2e-agnostic-ovn-techpreview-serial-3of3 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The upstream
lightspeed-agentic-operatorrenamed theProposalCRD toAgenticRun(OLS-3295). This PR aligns CVO with that rename (OTA-2064):pkg/proposal/topkg/agenticrun/and updated all types, functions, variables, constants, env vars, log strings, and commentstest/cvo/proposal.gototest/cvo/agenticrun.goand updated integration test referencespkg/cvo/files (cvo.go,status.go,availableupdates.goand their tests) to use the new package and namingpkg/internal/schema.goimport aliaslightspeed-agentic-operator/apidependency to pick up the renamed upstream typesTest plan
go build ./...passesgo test ./pkg/agenticrun/...passesgo test ./pkg/cvo/...passesgo test ./pkg/internal/...passes🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Improvements
Tests