Merge branch 'main' into jirafix

Author: mwaykole

CONSTITUTION.md

@@ -79,8 +79,11 @@ All code MUST consider security implications.
 - Avoid running destructive commands without explicit user confirmation
 - Use detect-secrets and gitleaks pre-commit hooks to prevent secret leakage
 - Test code MUST NOT introduce vulnerabilities into the tested systems
+- JIRA ticket links are allowed in PRs and commit messages (our Jira is public)
+- Do NOT reference internal-only resources (Jenkins, Confluence, Slack threads) in code, PRs, or commit messages
+- Do NOT link embargoed or security-restricted (RH-employee-only) tickets
 
-**Rationale**: Tests interact with production-like clusters; security lapses can have real consequences.
+**Rationale**: Tests interact with production-like clusters; security lapses can have real consequences. This is a public repository — only reference publicly accessible resources.
 
 ## Test Development Standards
 

Dockerfile

@@ -13,7 +13,7 @@ ENV PATH="$PATH:$BIN_DIR"
 
 # Install system dependencies using dnf
 RUN dnf update -y \
-    && dnf install -y python3 python3-pip ssh gnupg curl gpg wget vim httpd-tools rsync openssl openssl-devel\
+    && dnf install -y python3 python3-pip ssh gnupg curl gpg wget vim httpd-tools rsync openssl openssl-devel skopeo\
     && dnf clean all \
     && rm -rf /var/cache/dnf
 
@@ -22,6 +22,10 @@ RUN curl -sSL "https://github.com/fullstorydev/grpcurl/releases/download/v1.9.2/
     && tar xvf /tmp/grpcurl_1.2.tar.gz --no-same-owner \
     && mv grpcurl /usr/bin/grpcurl
 
+# Install cosign
+RUN curl -sSL "https://github.com/sigstore/cosign/releases/download/v2.4.2/cosign-linux-amd64" --output /usr/bin/cosign \
+    && chmod +x /usr/bin/cosign
+
 RUN useradd -ms /bin/bash $USER
 USER $USER
 WORKDIR $HOME_DIR

OWNERS

@@ -3,8 +3,10 @@ approvers:
   - fege
   - jgarciao
   - lugi0
+  - mwaykole
 reviewers:
   - dbasunag
   - fege
   - jgarciao
   - lugi0
+  - mwaykole

tests/llama_stack/conftest.py

@@ -6,7 +6,7 @@
 import pytest
 from _pytest.fixtures import FixtureRequest
 from kubernetes.dynamic import DynamicClient
-from llama_stack_client import LlamaStackClient
+from llama_stack_client import APIError, LlamaStackClient
 from llama_stack_client.types.vector_store import VectorStore
 from ocp_resources.data_science_cluster import DataScienceCluster
 from ocp_resources.deployment import Deployment
@@ -73,59 +73,6 @@
 distribution_name = generate_random_name(prefix="llama-stack-distribution")
 
 
-def _cleanup_s3_files(
-    bucket_name: str,
-    endpoint_url: str,
-    region: str,
-    access_key_id: str,
-    secret_access_key: str,
-) -> None:
-    """
-    Clean up files from S3 bucket that were uploaded during tests.
-
-    Args:
-        bucket_name: S3 bucket name
-        endpoint_url: S3 endpoint URL
-        region: S3 region
-        access_key_id: AWS access key ID
-        secret_access_key: AWS secret access key
-    """
-
-    try:
-        import boto3
-        from botocore.exceptions import ClientError
-
-        s3_client = boto3.client(
-            service_name="s3",
-            endpoint_url=endpoint_url,
-            aws_access_key_id=access_key_id,
-            aws_secret_access_key=secret_access_key,
-            region_name=region,
-        )
-
-        response = s3_client.list_objects_v2(Bucket=bucket_name)
-
-        if "Contents" not in response:
-            LOGGER.info("No files found to clean up from S3")
-            return
-
-        # We only want to delete files that start with "file-"
-        for obj in response["Contents"]:
-            key = obj["Key"]
-            if key.startswith("file-"):
-                s3_client.delete_object(Bucket=bucket_name, Key=key)
-                LOGGER.debug(f"Deleted file from S3: {key}")
-
-        response = s3_client.list_objects_v2(Bucket=bucket_name)
-
-        if "Contents" not in response:
-            LOGGER.info("No files found to clean up from S3")
-            return
-
-    except ClientError as e:
-        LOGGER.warning(f"Failed to clean up S3 files: {e}")
-
-
 @pytest.fixture(scope="class")
 def enabled_llama_stack_operator(dsc_resource: DataScienceCluster) -> Generator[DataScienceCluster, Any, Any]:
     with update_components_in_dsc(
@@ -385,11 +332,6 @@ def unprivileged_llama_stack_distribution(
     enabled_llama_stack_operator: DataScienceCluster,
     request: FixtureRequest,
     llama_stack_server_config: dict[str, Any],
-    ci_s3_bucket_name: str,
-    ci_s3_bucket_endpoint: str,
-    ci_s3_bucket_region: str,
-    aws_access_key_id: str,
-    aws_secret_access_key: str,
     unprivileged_llama_stack_distribution_secret: Secret,
     unprivileged_postgres_deployment: Deployment,
     unprivileged_postgres_service: Service,
@@ -406,25 +348,6 @@ def unprivileged_llama_stack_distribution(
         lls_dist.wait_for_status(status=LlamaStackDistribution.Status.READY, timeout=600)
         yield lls_dist
 
-        try:
-            env_vars = llama_stack_server_config.get("containerSpec", {}).get("env", [])
-            enable_s3 = any(env.get("name") == "ENABLE_S3" and env.get("value") == "s3" for env in env_vars)
-
-            if enable_s3:
-                try:
-                    _cleanup_s3_files(
-                        bucket_name=ci_s3_bucket_name,
-                        endpoint_url=ci_s3_bucket_endpoint,
-                        region=ci_s3_bucket_region,
-                        access_key_id=aws_access_key_id,
-                        secret_access_key=aws_secret_access_key,
-                    )
-                except Exception as e:  # noqa: BLE001
-                    LOGGER.warning(f"Failed to clean up S3 files: {e}")
-
-        except Exception as e:  # noqa: BLE001
-            LOGGER.warning(f"Failed to clean up S3 files: {e}")
-
 
 @pytest.fixture(scope="class")
 def llama_stack_distribution(
@@ -433,11 +356,6 @@ def llama_stack_distribution(
     enabled_llama_stack_operator: DataScienceCluster,
     request: FixtureRequest,
     llama_stack_server_config: dict[str, Any],
-    ci_s3_bucket_name: str,
-    ci_s3_bucket_endpoint: str,
-    ci_s3_bucket_region: str,
-    aws_access_key_id: str,
-    aws_secret_access_key: str,
     llama_stack_distribution_secret: Secret,
     postgres_deployment: Deployment,
     postgres_service: Service,
@@ -453,25 +371,6 @@ def llama_stack_distribution(
         lls_dist.wait_for_status(status=LlamaStackDistribution.Status.READY, timeout=600)
         yield lls_dist
 
-        try:
-            env_vars = llama_stack_server_config.get("containerSpec", {}).get("env", [])
-            enable_s3 = any(env.get("name") == "ENABLE_S3" and env.get("value") == "s3" for env in env_vars)
-
-            if enable_s3:
-                try:
-                    _cleanup_s3_files(
-                        bucket_name=ci_s3_bucket_name,
-                        endpoint_url=ci_s3_bucket_endpoint,
-                        region=ci_s3_bucket_region,
-                        access_key_id=aws_access_key_id,
-                        secret_access_key=aws_secret_access_key,
-                    )
-                except Exception as e:  # noqa: BLE001
-                    LOGGER.warning(f"Failed to clean up S3 files: {e}")
-
-        except Exception as e:  # noqa: BLE001
-            LOGGER.warning(f"Failed to clean up S3 files: {e}")
-
 
 def _get_llama_stack_distribution_deployment(
     client: DynamicClient,
@@ -642,11 +541,37 @@ def _create_llama_stack_client(
             http_client=http_client,
         )
         wait_for_llama_stack_client_ready(client=client)
+        existing_file_ids = {f.id for f in client.files.list().data}
+
         yield client
+
+        _cleanup_files(client=client, existing_file_ids=existing_file_ids)
     finally:
         http_client.close()
 
 
+def _cleanup_files(client: LlamaStackClient, existing_file_ids: set[str]) -> None:
+    """Delete files created during test execution via the LlamaStack files API.
+
+    Only deletes files whose IDs were not present before the test ran,
+    avoiding interference with other test sessions.
+
+    Args:
+        client: The LlamaStackClient used during the test
+        existing_file_ids: File IDs that existed before the test started
+    """
+    try:
+        for file in client.files.list().data:
+            if file.id not in existing_file_ids:
+                try:
+                    client.files.delete(file_id=file.id)
+                    LOGGER.debug(f"Deleted file: {file.id}")
+                except APIError as e:
+                    LOGGER.warning(f"Failed to delete file {file.id}: {e}")
+    except APIError as e:
+        LOGGER.warning(f"Failed to clean up files: {e}")
+
+
 @pytest.fixture(scope="class")
 def unprivileged_llama_stack_client(
     unprivileged_llama_stack_test_route: Route,

tests/model_registry/mcp_servers/config/test_invalid_yaml.py

@@ -37,7 +37,8 @@
 )
 @pytest.mark.usefixtures("mcp_invalid_yaml_configmap_patch")
 class TestMCPServerInvalidYAML:
-    """RHOAIENG-51582: Tests for graceful handling of invalid YAML sources (TC-LOAD-007, TC-LOAD-008)."""
+    """
+    Tests for graceful handling of invalid YAML sources (TC-LOAD-007, TC-LOAD-008)."""
 
     def test_valid_servers_loaded_despite_invalid_source(
         self: Self,

tests/model_registry/mcp_servers/config/test_multi_source.py

@@ -13,7 +13,7 @@
 
 @pytest.mark.usefixtures("mcp_multi_source_configmap_patch")
 class TestMCPServerMultiSource:
-    """RHOAIENG-51582: Tests for loading MCP servers from multiple YAML sources (TC-LOAD-002)."""
+    """Tests for loading MCP servers from multiple YAML sources (TC-LOAD-002)."""
 
     def test_all_servers_from_multiple_sources_loaded(
         self: Self,

tests/model_registry/mcp_servers/config/test_named_queries.py

@@ -11,7 +11,7 @@
 
 @pytest.mark.usefixtures("mcp_servers_configmap_patch")
 class TestMCPServerNamedQueries:
-    """RHOAIENG-52375: Tests for MCP server named query functionality."""
+    """Tests for MCP server named query functionality."""
 
     @pytest.mark.parametrize(
         "named_query, expected_custom_properties",

tests/model_registry/mcp_servers/search/test_filtering.py

@@ -11,7 +11,7 @@
 
 @pytest.mark.usefixtures("mcp_servers_configmap_patch")
 class TestMCPServerFiltering:
-    """RHOAIENG-51584: Tests for MCP server filterQuery functionality."""
+    """Tests for MCP server filterQuery functionality."""
 
     @pytest.mark.parametrize(
         "filter_query, expected_count, expected_name, field_check",
@@ -24,6 +24,7 @@ class TestMCPServerFiltering:
                 id="by_provider",
             ),
             pytest.param("tags='math'", 1, CALCULATOR_SERVER_NAME, None, id="by_tags"),
+            pytest.param("license='BSD 3-Clause'", 1, "file-manager", ("license", "BSD 3-Clause"), id="by_license"),
         ],
     )
     def test_filter_by_field(
@@ -35,7 +36,7 @@ def test_filter_by_field(
         expected_name: str,
         field_check: tuple[str, str] | None,
     ):
-        """TC-API-003, TC-API-005: Test filtering MCP servers by provider and tags."""
+        """TC-API-003, TC-API-005, TC-API-009: Test filtering MCP servers by provider, tags, and license."""
         response = execute_get_command(
             url=f"{mcp_catalog_rest_urls[0]}mcp_servers",
             headers=model_registry_rest_headers,

tests/model_registry/mcp_servers/search/test_ordering.py

@@ -10,9 +10,8 @@
 
 @pytest.mark.usefixtures("mcp_servers_configmap_patch")
 class TestMCPServerOrdering:
-    """RHOAIENG-51584: Tests for MCP server ordering functionality."""
+    """Tests for MCP server ordering functionality."""
 
-    @pytest.mark.xfail(reason="RHOAIENG-52448: sortOrder/orderBy not working, fix in PR #2367")
     @pytest.mark.parametrize(
         "sort_order",
         [

tests/model_registry/mcp_servers/test_data_integrity.py

@@ -15,7 +15,7 @@
 
 @pytest.mark.usefixtures("mcp_servers_configmap_patch")
 class TestMCPServerLoading:
-    """RHOAIENG-51582: Tests for loading MCP servers from YAML into the catalog (TC-LOAD-001)."""
+    """Tests for loading MCP servers from YAML into the catalog (TC-LOAD-001)."""
 
     def test_mcp_servers_loaded(
         self: Self,