RHOAIENG-65524: feat(mcplifecycleoperator): integrate MCP Lifecycle Operator module

[matzew]

Add MCPLifecycleOperator as a module in the ODH operator, covering API types, module handler, monitoring, and wiring.

• Add MCPLifecycleOperator API types (CommonSpec, CommonStatus, DSC embedding) and GVK registration
• Implement module handler with DSC and Platform mode support
• Register module in main.go with manifest config
• Add PrometheusRules template and alerting unit tests
• Wire monitoring service to deploy module alerting rules
• Include generated deepcopy and API documentation

Ref: RHOAIENG-65524

Description

How Has This Been Tested?

Screenshot or short clip

Merge criteria

• You have read the contributors guide.
• Commit messages are meaningful - have a clear and concise summary and detailed explanation of what was changed and why.
• Pull Request contains a description of the solution, a link to the JIRA issue, and to any dependent or related Pull Request.
• Testing instructions have been added in the PR body (for PRs involving changes that are not immediately obvious).
• The developer has manually tested the changes and verified that the changes work
• The developer has run the integration test pipeline and verified that it passed successfully
• New RELATED_IMAGE mappings are listed in ODH-Build-Config and RHOAI-Build-Config (CI validates names against build-config repos). Include links to build-config PRs in the description.

E2E test suite update requirement

When bringing new changes to the operator code, such changes are by default required to be accompanied by extending and/or updating the E2E test suite accordingly.

To opt-out of this requirement:

1. Please inspect the opt-out guidelines, to determine if the nature of the PR changes allows for skipping this requirement
2. If opt-out is applicable, provide justification in the dedicated E2E update requirement opt-out justification section below
3. Check the checkbox below:

• Skip requirement to update E2E test suite for this PR

4. Submit/save these changes to the PR description. This will automatically trigger the check.

E2E update requirement opt-out justification

It seems that all existing E2E tests under tests/e2e/ are all for the (legacy) component controllers, not modules.

Summary by CodeRabbit

• New Features
  • Added MCP Lifecycle Operator as a managed cluster component with DSC configuration/status support and shared release/status types.
  • Registered the operator module, included its manifests, and added monitoring assets.
  • Added Prometheus alerting for the operator-not-running condition, with module-level alert rule management.
• Bug Fixes
  • Preserved MCP Lifecycle Operator spec/status data during deep-copy operations.
  • Fixed operator manifest path handling when provisioning and cleaning up disabled modules.
• Documentation
  • Updated the API overview with the new MCP Lifecycle Operator and DSC schemas.
• Tests
  • Added unit tests for the operator handler and monitoring alert rules.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Adds MCPLifecycleOperator API types and deepcopy methods, extends DataScienceCluster schemas and docs, registers the new module and GVK, rewrites module manifest paths, and wires module alerting rules into monitoring deployment.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

🚥 Pre-merge checks | ✅ 10

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: integrating the MCP Lifecycle Operator module.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Contribution Quality And Spam Detection	✅ Passed	No two-category spam signals; PR is cohesive, references RHOAIENG-65524, and adds tests/docs for the new module wiring.
No Hardcoded Secrets	✅ Passed	No hardcoded secrets found in added lines; only module wiring and manifest SHAs. No API key/password/token literals or creds URLs. CWE-798/CWE-259.
No Weak Cryptography	✅ Passed	No banned primitives or secret/token comparisons in touched files; no CWE-327/328/208 finding.
No Injection Vectors	✅ Passed	No added CWE-78/89/79/94/502 sink: new code uses trusted constants, no eval/exec/os.system/shell=True/yaml.load, and the shell additions are hardcoded.
No Privileged Containers	✅ Passed	No CWE-269/CWE-732 indicators in PR-scoped manifests/templates: no privileged:true, hostPID/network/IPC, allowPrivilegeEscalation, SYS_ADMIN, or root USER additions.
No Sensitive Data In Logs	✅ Passed	No new sensitive logging found; added error messages/logs only reference component/module names, not secrets or PII. CWE-532 not triggered.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign dayakar349 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[matzew]

RELATED_IMAGE_ODH_MCP_LIFECYCLE_MODULE_OPERATOR_CONTROLLER_IMAGE is not yet there

We are waiting on the actual build

[matzew]

This does not yet exist

[matzew]

will this eventually be "automated" ?

[lburgazzoli]

@MarianMacik can you look into this ?

[coderabbitai]

Actionable comments posted: 5

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/api-overview.md`:
- Around line 1201-1230: The markdown reference for ComponentRelease in the
MCPLifecycleOperatorCommonStatus table is broken because no matching anchor
exists in docs/api-overview.md. Update the docs entry that contains the releases
field so the ComponentRelease link points to a real heading or remove the link
if the type is not documented, using the MCPLifecycleOperatorCommonStatus and
ComponentRelease sections as the places to align.

In `@get_all_manifests.sh`:
- Line 36: The manifest source entry for mcplifecycleoperator points to the
wrong repository name even though the pinned SHA and config path belong to
opendatahub-io/opendatahub-operator; update the repository identifier in
get_all_manifests.sh so the source string uses
opendatahub-io/opendatahub-operator with the existing commit and config path,
and verify the manifest fetch target still resolves correctly.

In
`@internal/controller/components/mcplifecycleoperator/monitoring/mcplifecycleoperator-prometheusrules.tmpl.yaml`:
- Line 4: The PrometheusRule resource name in
mcplifecycleoperator-prometheusrules.tmpl.yaml does not match the cleanup
contract, so the generated rule is not removed correctly. Update the name used
by the template to follow the same <component>-prometheusrules naming pattern
expected by the cleanup logic, and make sure the mcplifecycleoperator monitoring
rule identifier stays consistent with the delete path.
- Line 12: The Prometheus alert selector is using the display name “MCP
Lifecycle Operator” instead of the canonical job identity, which can cause false
alerts. Update the `expr` in `mcplifecycleoperator-prometheusrules.tmpl.yaml` to
match the actual job label used by the `mcplifecycleoperator` component, and
keep the existing absent/up logic intact while replacing the non-canonical
`job=~` matcher with the correct identity.

In `@internal/controller/services/monitoring/monitoring_controller_actions.go`:
- Line 420: The ManagementState field is currently allowed to be omitted, which
lets it default to an empty value and fall into the controller’s cleanup path.
Update the ManagementState definition in api/common/types.go to either enforce
an explicit value or add the kubebuilder default marker so omitted CRs resolve
to Managed. Keep the Enum=Managed;Removed constraint and ensure the controller
logic that treats non-Managed states as cleanup-triggering no longer receives a
zero value from json:"managementState,omitempty".

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 9fdbb704-ba58-49fd-a294-7e259ea2afe4

📥 Commits

Reviewing files that changed from the base of the PR and between 64e69a0 and 5ae67b6.

📒 Files selected for processing (16)

• api/components/v1alpha1/mcplifecycleoperator_types.go
• api/components/v1alpha1/zz_generated.deepcopy.go
• api/datasciencecluster/v2/datasciencecluster_types.go
• api/datasciencecluster/v2/zz_generated.deepcopy.go
• build/manifests-config.yaml
• cmd/main.go
• docs/api-overview.md
• get_all_manifests.sh
• internal/controller/components/components.go
• internal/controller/components/mcplifecycleoperator/monitoring/mcplifecycleoperator-alerting.unit-tests.yaml
• internal/controller/components/mcplifecycleoperator/monitoring/mcplifecycleoperator-prometheusrules.tmpl.yaml
• internal/controller/modules/mcplifecycleoperator/handler.go
• internal/controller/modules/mcplifecycleoperator/handler_test.go
• internal/controller/modules/modules_controller_actions.go
• internal/controller/services/monitoring/monitoring_controller_actions.go
• pkg/cluster/gvk/gvk.go

[matzew]

I think we must wait until opendatahub-io/ODH-Build-Config#2461 merges.

[matzew]

/retest

[matzew]

I think the "Red Hat Konflux / odh-operator-ci-on-pull-request" failed, b/c it's looking for odh-mcp-lifecycle-module-operator but can't find it. Related to RHOAIENG-70904

[matzew]

/test opendatahub-operator-rhoai-e2e

[MarianMacik]

@davidebianchi what do you think? Do we need to execite xks e2e?

[davidebianchi]

Yes, we are improving the check but should run before merging the PR. By the way, e2e are failing now for a component failure, so it needs to be fixed to have e2e passing.

[creydr]

To https://github.com/opendatahub-io/odh-build-metadata.git
 ! [rejected]          main -> main (fetch first)
error: failed to push some refs to 'https://github.com/opendatahub-io/odh-build-metadata.git'
hint: Updates were rejected because the remote contains work that you do not
hint: have locally. This is usually caused by another repository pushing to
hint: the same ref. If you want to integrate the remote changes, use
hint: 'git pull' before pushing again.

/retest odh-operator-ci-on-pull-request

[openshift-ci]

@creydr: The /retest command does not accept any targets.
The following commands are available to trigger required jobs:

/test opendatahub-operator-e2e

/test opendatahub-operator-rhoai-e2e

The following commands are available to trigger optional jobs:

/test images

Use /test all to run all jobs.

Details

In response to this:

To https://github.com/opendatahub-io/odh-build-metadata.git
! [rejected]          main -> main (fetch first)
error: failed to push some refs to 'https://github.com/opendatahub-io/odh-build-metadata.git'
hint: Updates were rejected because the remote contains work that you do not
hint: have locally. This is usually caused by another repository pushing to
hint: the same ref. If you want to integrate the remote changes, use
hint: 'git pull' before pushing again.

/retest odh-operator-ci-on-pull-request

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@matzew: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/opendatahub-operator-rhoai-e2e	5b8c28c	link	true	/test opendatahub-operator-rhoai-e2e
ci/prow/opendatahub-operator-e2e	5b8c28c	link	true	/test opendatahub-operator-e2e

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.