feat(lightspeed): replace RAG init container with OKP deployment [RHIDP-16102]

Replace the RAG init container / FAISS vector store with an OKP (Offline
Knowledge Portal) Deployment, Service, and Route. Add platform-aware
config selection: OpenShift (or K8s with okp.ingress.host set) uses the
full OKP config; vanilla K8s uses the lightspeed-stack-no-okp.yaml
variant so LCORE does not crash without an OKP backend. Add OKP Ingress
support, imagePullSecrets, vector_store config, and align/pin the OKP and
LCORE (OGX) images. Swap Lightspeed plugins to Intelligent Assistant.
Add systemArgs/systemEnv for LCORE sidecar (HF_HOME, OTEL_SDK_DISABLED,
--synthesized-config-output). Sync vendored Lightspeed configs from
lightspeed-configs@main. Add docs/lightspeed.md with deployment
scenarios, vanilla K8s prerequisites, and OKP configuration reference.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 3 people

charts/rhdh/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 name: redhat-developer-hub
 type: application
-version: 1.0.2
+version: 1.1.0
 appVersion: 2.1.0
 annotations:
   artifacthub.io/category: integration-delivery

charts/rhdh/README.md

@@ -1,7 +1,7 @@
 
 # RHDH Helm Chart for OpenShift and Kubernetes
 
-![Version: 1.0.2](https://img.shields.io/badge/Version-1.0.2-informational?style=flat-square)
+![Version: 1.1.0](https://img.shields.io/badge/Version-1.1.0-informational?style=flat-square)
 ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 A Helm chart for deploying Red Hat Developer Hub, which is a Red Hat supported version of Backstage.
@@ -36,7 +36,7 @@ For the **Generally Available** version of this chart, see:
 helm repo add bitnami https://charts.bitnami.com/bitnami
 helm repo add redhat-developer https://redhat-developer.github.io/rhdh-chart
 
-helm install my-rhdh redhat-developer/redhat-developer-hub --version 1.0.2
+helm install my-rhdh redhat-developer/redhat-developer-hub --version 1.1.0
 ```
 
 ## Introduction
@@ -243,7 +243,7 @@ Kubernetes: `>= 1.31.0-0`
 | image.digest | Overrides the image tag with an image digest. | string | `""` |
 | imagePullSecrets | Secrets for pulling images from private registries (merged with global.imagePullSecrets). | list | `[]` |
 | ingress | Kubernetes Ingress configuration. | object | `{"annotations":{},"className":"","enabled":false,"hosts":[{"host":"{{ .Values.host }}","paths":[{"path":"/","pathType":"ImplementationSpecific"}]}],"tls":[]}` |
-| lightspeed | Built-in Lightspeed AI feature configuration. | object | `{"config":{"profile":{"existingConfigMap":{"key":"","name":""}},"server":{"existingConfigMap":{"key":"","name":""}},"stack":{"existingConfigMap":{"key":"","name":""}}},"core":{"argsOverride":[],"commandOverride":[],"extraArgs":[],"extraEnv":[],"extraVolumeMounts":[],"image":{"digest":"","registry":"quay.io","repository":"lightspeed-core/lightspeed-stack","tag":"0.6.2"},"imagePullPolicy":"IfNotPresent","resources":{"limits":{"cpu":"1000m","memory":"2Gi"},"requests":{"cpu":"100m","memory":"512Mi"}},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}},"enabled":true,"existingSecret":"","plugins":[{"enabled":true,"package":"oci://registry.access.redhat.com/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed:{{ \"{{inherit}}\" }}"},{"enabled":true,"package":"oci://registry.access.redhat.com/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend:{{ \"{{inherit}}\" }}"}],"ragInit":{"argsOverride":[],"commandOverride":[],"extraArgs":[],"extraEnv":[],"extraVolumeMounts":[],"image":{"digest":"","registry":"quay.io","repository":"redhat-ai-dev/rag-content","tag":"release-1.10-lls-0.5.0-8c231a3b5177f12fff9db042dfa4091d8f2f26b3"},"imagePullPolicy":"IfNotPresent","resources":{"limits":{"cpu":"100m","memory":"500Mi"},"requests":{"cpu":"50m","memory":"150Mi"}},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}},"runtimeVolume":{"emptyDir":{},"persistentVolumeClaim":{},"type":"emptyDir"}}` |
+| lightspeed | Built-in Lightspeed AI feature configuration. | object | `{"config":{"profile":{"existingConfigMap":{"key":"","name":""}},"server":{"existingConfigMap":{"key":"","name":""}},"stack":{"existingConfigMap":{"key":"","name":""}}},"core":{"argsOverride":[],"commandOverride":[],"extraArgs":[],"extraEnv":[],"extraVolumeMounts":[],"image":{"digest":"","registry":"quay.io","repository":"lightspeed-core/lightspeed-stack","tag":"dev-20260811-0da4b12"},"imagePullPolicy":"IfNotPresent","resources":{"limits":{"cpu":"1000m","memory":"2Gi"},"requests":{"cpu":"100m","memory":"512Mi"}},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}},"systemArgs":["--synthesized-config-output","/tmp/.generated/run.yaml"],"systemEnv":[{"name":"HF_HOME","value":"/tmp/hf_cache"},{"name":"OTEL_SDK_DISABLED","value":"true"}]},"enabled":true,"existingSecret":"","okp":{"chunkFilterQuery":"product:*developer_hub*","httpd":{"compressed":"true","encrypt":"false","serverName":"localhost"},"image":{"digest":"","pullPolicy":"IfNotPresent","registry":"registry.redhat.io","repository":"offline-knowledge-portal/rhokp-rhel9","tag":"1.2.10-1786628394"},"imagePullSecrets":[],"ingress":{"annotations":{},"className":"","enabled":true,"host":"","tls":{"enabled":false,"secretName":""}},"replicaCount":1,"resources":{"limits":{"cpu":"2","memory":"4Gi"},"requests":{"cpu":"200m","memory":"2Gi"}},"route":{"enabled":true,"tls":{"insecureEdgeTerminationPolicy":"Allow","termination":"edge"}},"service":{"type":"ClusterIP"},"solr":{"hostBind":"0.0.0.0","memory":"1g"}},"plugins":[{"enabled":true,"package":"oci://quay.io/rhdh/red-hat-developer-hub-backstage-plugin-intelligent-assistant:{{ \"{{inherit}}\" }}","pluginConfig":{"dynamicPlugins":{"frontend":{"red-hat-developer-hub.backstage-plugin-intelligent-assistant":{"dynamicRoutes":[{"importName":"LightspeedPage","module":"Legacy","path":"/intelligent-assistant"}],"mountPoints":[{"importName":"LightspeedFAB","module":"Legacy","mountPoint":"application/listener"},{"importName":"LightspeedDrawerProvider","module":"Legacy","mountPoint":"application/provider"},{"config":{"id":"intelligent-assistant"},"importName":"LightspeedDrawerStateExposer","module":"Legacy","mountPoint":"application/internal/drawer-state"},{"config":{"id":"intelligent-assistant","priority":100},"importName":"LightspeedChatContainer","module":"Legacy","mountPoint":"application/internal/drawer-content"}],"translationResources":[{"importName":"lightspeedTranslations","module":"Alpha","ref":"intelligentAssistantTranslationRef"}]}}}}},{"enabled":true,"package":"oci://quay.io/rhdh/red-hat-developer-hub-backstage-plugin-intelligent-assistant-backend:{{ \"{{inherit}}\" }}"}],"runtimeVolume":{"emptyDir":{},"persistentVolumeClaim":{},"type":"emptyDir"}}` |
 | lightspeed.config | Configuration files mounted into the sidecar. By default, the chart creates ConfigMaps from bundled source files. Set existingConfigMap to use a pre-existing ConfigMap instead. | object | `{"profile":{"existingConfigMap":{"key":"","name":""}},"server":{"existingConfigMap":{"key":"","name":""}},"stack":{"existingConfigMap":{"key":"","name":""}}}` |
 | lightspeed.config.profile | Python profile with prompt templates (rhdh-profile.py). | object | `{"existingConfigMap":{"key":"","name":""}}` |
 | lightspeed.config.profile.existingConfigMap | Use an existing ConfigMap instead of the bundled default. | object | Created from bundled rhdh-profile.py |
@@ -257,16 +257,14 @@ Kubernetes: `>= 1.31.0-0`
 | lightspeed.config.stack.existingConfigMap | Use an existing ConfigMap instead of the bundled default. | object | Created from bundled lightspeed-stack.yaml |
 | lightspeed.config.stack.existingConfigMap.key | Key within the ConfigMap that holds the file content. Defaults to the bundled filename (lightspeed-stack.yaml) if not set. | string | `""` |
 | lightspeed.config.stack.existingConfigMap.name | Name of the existing ConfigMap. | string | `""` |
-| lightspeed.core | Lightspeed Core sidecar container. | object | `{"argsOverride":[],"commandOverride":[],"extraArgs":[],"extraEnv":[],"extraVolumeMounts":[],"image":{"digest":"","registry":"quay.io","repository":"lightspeed-core/lightspeed-stack","tag":"0.6.2"},"imagePullPolicy":"IfNotPresent","resources":{"limits":{"cpu":"1000m","memory":"2Gi"},"requests":{"cpu":"100m","memory":"512Mi"}},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}}` |
+| lightspeed.core | Lightspeed Core sidecar container. | object | `{"argsOverride":[],"commandOverride":[],"extraArgs":[],"extraEnv":[],"extraVolumeMounts":[],"image":{"digest":"","registry":"quay.io","repository":"lightspeed-core/lightspeed-stack","tag":"dev-20260811-0da4b12"},"imagePullPolicy":"IfNotPresent","resources":{"limits":{"cpu":"1000m","memory":"2Gi"},"requests":{"cpu":"100m","memory":"512Mi"}},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}},"systemArgs":["--synthesized-config-output","/tmp/.generated/run.yaml"],"systemEnv":[{"name":"HF_HOME","value":"/tmp/hf_cache"},{"name":"OTEL_SDK_DISABLED","value":"true"}]}` |
 | lightspeed.core.argsOverride | Override the container's default args. Leave empty to use the image defaults. | list | `[]` |
 | lightspeed.core.commandOverride | Override the container's default command. Leave empty to use the image entrypoint. | list | `[]` |
 | lightspeed.core.extraArgs | Extra arguments appended after the default arguments. Ignored when argsOverride is set. | list | `[]` |
 | lightspeed.existingSecret | Name of an existing Secret to inject via envFrom into the lightspeed-core container. If empty, no secret is mounted. Expected keys (all optional — only set the ones for the providers you use):   ENABLE_VLLM, VLLM_URL, VLLM_API_KEY, VLLM_MAX_TOKENS, VLLM_TLS_VERIFY,   ENABLE_OPENAI, OPENAI_API_KEY,   ENABLE_VERTEX_AI, VERTEX_AI_PROJECT, VERTEX_AI_LOCATION, GOOGLE_APPLICATION_CREDENTIALS,   ENABLE_OLLAMA, OLLAMA_URL,   ENABLE_VALIDATION, VALIDATION_PROVIDER, VALIDATION_MODEL_NAME,   LLAMA_STACK_LOGGING See files/lightspeed/secret.example.yaml for a reference template. | string | `""` |
-| lightspeed.plugins | Lightspeed dynamic plugin packages. | list | `[{"enabled":true,"package":"oci://registry.access.redhat.com/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed:{{ \"{{inherit}}\" }}"},{"enabled":true,"package":"oci://registry.access.redhat.com/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend:{{ \"{{inherit}}\" }}"}]` |
-| lightspeed.ragInit | RAG data bootstrap init container. | object | `{"argsOverride":[],"commandOverride":[],"extraArgs":[],"extraEnv":[],"extraVolumeMounts":[],"image":{"digest":"","registry":"quay.io","repository":"redhat-ai-dev/rag-content","tag":"release-1.10-lls-0.5.0-8c231a3b5177f12fff9db042dfa4091d8f2f26b3"},"imagePullPolicy":"IfNotPresent","resources":{"limits":{"cpu":"100m","memory":"500Mi"},"requests":{"cpu":"50m","memory":"150Mi"}},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}}` |
-| lightspeed.ragInit.argsOverride | Override the default arguments for the RAG init container. | list | `[]` |
-| lightspeed.ragInit.commandOverride | Override the default command for the RAG init container. | list | `[]` |
-| lightspeed.ragInit.extraArgs | Extra arguments appended after the default arguments. Ignored when argsOverride is set. | list | `[]` |
+| lightspeed.okp | OKP (Offline Knowledge Portal) configuration. Deploys an OKP instance for document retrieval when lightspeed is enabled. | object | `{"chunkFilterQuery":"product:*developer_hub*","httpd":{"compressed":"true","encrypt":"false","serverName":"localhost"},"image":{"digest":"","pullPolicy":"IfNotPresent","registry":"registry.redhat.io","repository":"offline-knowledge-portal/rhokp-rhel9","tag":"1.2.10-1786628394"},"imagePullSecrets":[],"ingress":{"annotations":{},"className":"","enabled":true,"host":"","tls":{"enabled":false,"secretName":""}},"replicaCount":1,"resources":{"limits":{"cpu":"2","memory":"4Gi"},"requests":{"cpu":"200m","memory":"2Gi"}},"route":{"enabled":true,"tls":{"insecureEdgeTerminationPolicy":"Allow","termination":"edge"}},"service":{"type":"ClusterIP"},"solr":{"hostBind":"0.0.0.0","memory":"1g"}}` |
+| lightspeed.okp.imagePullSecrets | Image pull secrets for the OKP container image. Required on vanilla Kubernetes to authenticate with registry.redhat.io. Not needed on OpenShift where the cluster-wide pull secret covers Red Hat registries. | list | `[]` |
+| lightspeed.plugins | Intelligent Assistant dynamic plugin packages. | list | `[{"enabled":true,"package":"oci://quay.io/rhdh/red-hat-developer-hub-backstage-plugin-intelligent-assistant:{{ \"{{inherit}}\" }}","pluginConfig":{"dynamicPlugins":{"frontend":{"red-hat-developer-hub.backstage-plugin-intelligent-assistant":{"dynamicRoutes":[{"importName":"LightspeedPage","module":"Legacy","path":"/intelligent-assistant"}],"mountPoints":[{"importName":"LightspeedFAB","module":"Legacy","mountPoint":"application/listener"},{"importName":"LightspeedDrawerProvider","module":"Legacy","mountPoint":"application/provider"},{"config":{"id":"intelligent-assistant"},"importName":"LightspeedDrawerStateExposer","module":"Legacy","mountPoint":"application/internal/drawer-state"},{"config":{"id":"intelligent-assistant","priority":100},"importName":"LightspeedChatContainer","module":"Legacy","mountPoint":"application/internal/drawer-content"}],"translationResources":[{"importName":"lightspeedTranslations","module":"Alpha","ref":"intelligentAssistantTranslationRef"}]}}}}},{"enabled":true,"package":"oci://quay.io/rhdh/red-hat-developer-hub-backstage-plugin-intelligent-assistant-backend:{{ \"{{inherit}}\" }}"}]` |
 | lightspeed.runtimeVolume | Writable scratch volume for the sidecar (/tmp). | object | `{"emptyDir":{},"persistentVolumeClaim":{},"type":"emptyDir"}` |
 | lightspeed.runtimeVolume.type | Volume type: "emptyDir" or "persistentVolumeClaim". | string | `"emptyDir"` |
 | livenessProbe | Liveness probe configuration. | object | `{"failureThreshold":3,"httpGet":{"path":"/.backstage/health/v1/liveness","port":"backend","scheme":"HTTP"},"periodSeconds":10,"successThreshold":1,"timeoutSeconds":4}` |

charts/rhdh/ci/with-lightspeed-service-host-values.yaml

@@ -0,0 +1,17 @@
+# CI: test lightspeed with SERVICE_HOST override and OKP disabled.
+# The chart features under test (deployment, config, probes, etc.) don't depend on actual plugins.
+dynamicPlugins:
+  includes: []
+lightspeed:
+  plugins: []
+  core:
+    extraEnv:
+      - name: SERVICE_HOST
+        value: "0.0.0.0"
+  okp:
+    route:
+      enabled: false
+    ingress:
+      enabled: false
+orchestrator:
+  plugins: []