feat(lightspeed): replace RAG init container with OKP deployment

config/profile/rhdh/default-config/flavours/intelligent-assistant/deployment.yaml

@@ -3,29 +3,20 @@ kind: Deployment
 spec:
   template:
     spec:
-      initContainers:
-        - name: init-rag-data
-          image: quay.io/redhat-ai-dev/rag-content:release-1.10-lls-0.5.0
-          command:
-            - "sh"
-            - "-c"
-            - "echo 'Copying RAG data...'; cp -r --no-preserve=mode,ownership /rag/. /data/ && mkdir -p /data/vector_db/notebooks && chmod -R a+rwX /data/embeddings_model /data/vector_db && echo 'Copy complete.'"
-          resources:
-            requests:
-              memory: 150Mi
-              cpu: 50m
-            limits:
-              memory: 500Mi
-              cpu: 100m
-          volumeMounts:
-            - mountPath: /data
-              name: rag-data-volume
-
       containers:
         # Lightspeed Core Backend
         - name: lightspeed-core
-          image: quay.io/lightspeed-core/lightspeed-stack:0.5.3
+          image: quay.io/lightspeed-core/lightspeed-stack:dev-20260811-0da4b12
           imagePullPolicy: Always
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
           ports:
             - containerPort: 8080
               name: lcs-backend
@@ -37,16 +28,18 @@ spec:
             limits:
               cpu: 1000m
               memory: 2Gi
+          args:
+            - "--synthesized-config-output"
+            - "/tmp/.generated/run.yaml"
+          env:
+            - name: HF_HOME
+              value: /tmp/hf_cache
+            - name: OTEL_SDK_DISABLED
+              value: "true"
           volumeMounts:
-            - mountPath: /tmp/data/feedback
-              name: shared-storage
-            - mountPath: /rag-content
-              name: rag-data-volume
-            - mountPath: /tmp              # Add this to make /tmp writable
-              name: temp
+            - mountPath: /tmp
+              name: lightspeed-data
 
       volumes:
-        - name: shared-storage
-          emptyDir: { }
-        - name: rag-data-volume
+        - name: lightspeed-data
           emptyDir: { }

config/profile/rhdh/default-config/flavours/intelligent-assistant/dynamic-plugins.yaml

@@ -6,8 +6,38 @@ data:
   dynamic-plugins.yaml: |
     plugins:
       # Intelligent Assistant Plugins
-      - package: oci://quay.io/rhdh/red-hat-developer-hub-backstage-plugin-intelligent-assistant:{{inherit}}
+      - package: ref://red-hat-developer-hub-backstage-plugin-intelligent-assistant
         enabled: true
+        pluginConfig:
+          dynamicPlugins:
+            frontend:
+              red-hat-developer-hub.backstage-plugin-intelligent-assistant:
+                translationResources:
+                  - importName: lightspeedTranslations
+                    module: Alpha
+                    ref: intelligentAssistantTranslationRef
+                dynamicRoutes:
+                  - path: /intelligent-assistant
+                    importName: LightspeedPage
+                    module: Legacy
+                mountPoints:
+                  - mountPoint: application/listener
+                    importName: LightspeedFAB
+                    module: Legacy
+                  - mountPoint: application/provider
+                    importName: LightspeedDrawerProvider
+                    module: Legacy
+                  - mountPoint: application/internal/drawer-state
+                    importName: LightspeedDrawerStateExposer
+                    module: Legacy
+                    config:
+                      id: intelligent-assistant
+                  - mountPoint: application/internal/drawer-content
+                    importName: LightspeedChatContainer
+                    module: Legacy
+                    config:
+                      id: intelligent-assistant
+                      priority: 100
 
-      - package: oci://quay.io/rhdh/red-hat-developer-hub-backstage-plugin-intelligent-assistant-backend:{{inherit}}
+      - package: ref://red-hat-developer-hub-backstage-plugin-intelligent-assistant-backend
         enabled: true

config/profile/rhdh/default-config/flavours/intelligent-assistant/okp-deployment.yaml

@@ -0,0 +1,61 @@
+# OKP (Offline Knowledge Portal) standalone Deployment.
+# name/labels/selector are set by the operator at runtime (per Backstage CR); the values
+# below are placeholders. The image ref is intentionally declared here (not in Go source)
+# so midstream digest-pinning can resolve it in the generated bundle ConfigMap.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: lightspeed-okp
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: lightspeed-okp
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: lightspeed-okp
+    spec:
+      # OKP serves docs (Solr + httpd) and needs no Kubernetes API access.
+      automountServiceAccountToken: false
+      containers:
+        - name: okp
+          image: registry.redhat.io/offline-knowledge-portal/rhokp-rhel9:1.2.10-1786628394
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
+          ports:
+            - name: httpd
+              containerPort: 8080
+              protocol: TCP
+            - name: solr
+              containerPort: 8983
+              protocol: TCP
+          env:
+            - name: SOLR_JAVA_MEM
+              value: "-Xms1g -Xmx1g"
+            - name: SOLR_HOST_BIND
+              value: "0.0.0.0"
+            # The OKP image's httpd config reads these exact names
+            # (config/httpd conf.d: ServerName ${MIMIR_HTTPD_SERVER_NAME},
+            # Define compressed_${COMPRESSED}_encrypt_${ENCRYPT}); the
+            # HTTPD_-prefixed names are ignored. Matches rhdh-chart.
+            - name: MIMIR_HTTPD_SERVER_NAME
+              value: "localhost"
+            - name: COMPRESSED
+              value: "true"
+            - name: ENCRYPT
+              value: "false"
+          resources:
+            requests:
+              cpu: 200m
+              memory: 2Gi
+            limits:
+              cpu: "2"
+              memory: 4Gi

config/profile/rhdh/default-config/flavours/intelligent-assistant/okp-route.yaml

@@ -0,0 +1,16 @@
+# OKP (Offline Knowledge Portal) standalone OpenShift Route.
+# name/labels and spec.to.name are set by the operator at runtime (per Backstage CR).
+# Applied on OpenShift only.
+apiVersion: route.openshift.io/v1
+kind: Route
+metadata:
+  name: lightspeed-okp
+spec:
+  to:
+    kind: Service
+    name: lightspeed-okp
+  port:
+    targetPort: httpd
+  tls:
+    termination: edge
+    insecureEdgeTerminationPolicy: Allow

config/profile/rhdh/default-config/flavours/intelligent-assistant/okp-service.yaml

@@ -0,0 +1,19 @@
+# OKP (Offline Knowledge Portal) standalone ClusterIP Service.
+# name/labels/selector are set by the operator at runtime (per Backstage CR).
+apiVersion: v1
+kind: Service
+metadata:
+  name: lightspeed-okp
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: lightspeed-okp
+  ports:
+    - name: httpd
+      port: 8080
+      targetPort: httpd
+      protocol: TCP
+    - name: solr
+      port: 8983
+      targetPort: solr
+      protocol: TCP

config/profile/rhdh/kustomization.yaml

@@ -53,6 +53,9 @@ configMapGenerator:
   - default-config/flavours/intelligent-assistant/configmap-files.yaml
   - default-config/flavours/intelligent-assistant/deployment.yaml
   - default-config/flavours/intelligent-assistant/dynamic-plugins.yaml
+  - default-config/flavours/intelligent-assistant/okp-deployment.yaml
+  - default-config/flavours/intelligent-assistant/okp-service.yaml
+  - default-config/flavours/intelligent-assistant/okp-route.yaml
   name: flavour-intelligent-assistant-config
 - files:
   - default-config/flavours/orchestrator/metadata.yaml