feat(rd-dev): replace development-operator overlay with rd-dev

[flacatus]

Merge development-operator overlay into rd-dev so rd-dev becomes the single overlay used for E2E/operator preview deployments.

• rd-dev/kustomization.yaml now inherits ../development and carries the strategic-merge deletes and pipeline-service patch previously owned by development-operator
• Add app-of-app-sets/rd-dev pointing ArgoCD root app at the rd-dev overlay
• Update hack/preview.sh and hack/bootstrap-cluster.sh to use rd-dev instead of development-operator when --operator-overlay is passed

development-operator overlay and its app-of-app-sets entry can be removed once CI validates this path.

[github-actions]

Kustomize Render Diff

Comparing c9a143904 → 78c5a8ae0

No render differences detected.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:00 PM UTC · Completed 5:16 PM UTC

Commit: ff40bac · View workflow run →

[qodo-for-redhat-appstudio]

PR Summary by Qodo

Consolidate operator previews on the rd-dev overlay

✨ Enhancement ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Makes rd-dev inherit development while replacing legacy ApplicationSets with operator-managed
 workloads.
• Adds an Argo CD root application targeting the consolidated rd-dev overlay.
• Routes operator preview workflows through rd-dev while preserving preview-specific behavior.

Diagram

graph TD
  FLAG["Operator flag"] --> SCRIPT["Preview scripts"] --> ROOT["Root application"] --> ARGO["Argo CD"] --> RD["rd-dev overlay"] --> DEV["Development base"]
  RD --> DELETE["Legacy deletes"]
  RD --> OP["Konflux operator"]

Loading

High-Level Assessment

Consolidating operator previews into rd-dev is the appropriate approach because it removes duplicate overlay composition while retaining the shared development graph. Keeping development-operator temporarily until CI validates rd-dev is safer than immediate deletion; a permanent alias would preserve unnecessary configuration duplication.

Files changed (8) +116 / -18

Enhancement (2) +24 / -16

kustomization.yamlMerge development operator behavior into rd-dev +10/-2

Merge development operator behavior into rd-dev

• Makes rd-dev inherit the development overlay, applies legacy ApplicationSet deletions, and patches pipeline-service for operator previews. Existing rd-dev proxy, shield, and operator resources remain included.

argo-cd-apps/overlays/rd-dev/kustomization.yaml

preview.shRoute operator preview behavior through rd-dev +14/-14

Route operator preview behavior through rd-dev

• Changes --operator-overlay resolution and all overlay-specific guards from development-operator to rd-dev. Selective deployment, OpenShift compatibility changes, optional components, operator readiness waits, and Pipelines as Code setup continue to run for the consolidated overlay.

hack/preview.sh

Documentation (1) +2 / -2

bootstrap-cluster.shDocument rd-dev as the operator preview overlay +2/-2

Document rd-dev as the operator preview overlay

• Updates bootstrap help text and examples so --operator-overlay is described as selecting rd-dev instead of development-operator.

hack/bootstrap-cluster.sh

Other (5) +90 / -0

change-source-path.yamlPoint the root application source at rd-dev +4/-0

Point the root application source at rd-dev

• Adds a JSON patch that redirects the Argo CD root application's source path to the rd-dev overlay.

argo-cd-apps/app-of-app-sets/rd-dev/change-source-path.yaml

change-target-namespace.yamlTarget the OpenShift GitOps namespace +4/-0

Target the OpenShift GitOps namespace

• Adds a JSON patch that sets the root application's destination namespace to openshift-gitops.

argo-cd-apps/app-of-app-sets/rd-dev/change-target-namespace.yaml

kustomization.yamlDefine the rd-dev root application customization +16/-0

Define the rd-dev root application customization

• Creates an app-of-app-sets customization from the shared base and applies rd-dev source and destination patches to the Argo CD Application.

argo-cd-apps/app-of-app-sets/rd-dev/kustomization.yaml

delete-legacy-konflux-member-appsets.yamlRemove superseded Konflux member ApplicationSets +62/-0

Remove superseded Konflux member ApplicationSets

• Adds strategic-merge deletions for nine legacy per-microservice ApplicationSets inherited from development. This prevents those workloads from running alongside their operator-managed replacements.

argo-cd-apps/overlays/rd-dev/delete-legacy-konflux-member-appsets.yaml

pipeline-service-operator-patch.yamlSelect the operator pipeline-service environment +4/-0

Select the operator pipeline-service environment

• Adds a targeted JSON patch that sets pipeline-service's generated environment to development-operator, preserving the operator-specific component selection.

argo-cd-apps/overlays/rd-dev/pipeline-service-operator-patch.yaml

[qodo-for-redhat-appstudio]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

1. Generated patch is not pushed ✓ Resolved 🐞 Bug ≡ Correctness

Description

When an old-OCP run or selective deployment creates the new rd-dev delete file, the wiring block
adds a reference to it but the later git commit -a does not stage this newly created untracked
file. The pushed preview branch therefore contains a kustomization referencing a missing patch,
causing Argo CD to fail to render the rd-dev root application.

Code

hack/preview.sh[R1105-1108]

+    if [ "$TARGET_PREVIEW_OVERLAY" = "rd-dev" ] && [ -s "$TARGET_DELETE_FILE" ]; then
+        rd_kust="$ROOT/argo-cd-apps/overlays/rd-dev/kustomization.yaml"
+        if ! grep -q "delete-applications.yaml" "$rd_kust"; then
+            yq -i '.patchesStrategicMerge += ["delete-applications.yaml"]' "$rd_kust"

Relevance

●●● Strong

The untracked generated patch would make the pushed overlay invalid; this is a concrete correctness
failure.

PR-#13490

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The delete handlers append to the path that the changed code documents as initially absent, making
it a new untracked file. Lines 1105-1108 then modify the tracked kustomization to reference that
file, but the only commit command is git commit -a, which commits tracked modifications without
adding new files.

hack/preview.sh[327-340]
hack/preview.sh[365-374]
hack/preview.sh[962-965]
hack/preview.sh[1103-1110]
hack/preview.sh[1137-1143]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The script creates `rd-dev/delete-applications.yaml` at runtime and adds it to the rd-dev kustomization, but the commit uses `git commit -a`. Git does not include a newly created untracked file with that option, leaving the pushed kustomization with a missing patch dependency.

## Issue Context
Ensure the generated delete file is staged before committing whenever it is wired into the kustomization. This can be done with an explicit `git add` for the generated file or by changing the commit preparation to include intended untracked generated files safely.

## Fix Focus Areas
- hack/preview.sh[1103-1111]
- hack/preview.sh[1137-1143]
- hack/preview.sh[327-340]
- hack/preview.sh[365-374]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Absent delete file aborts ✓ Resolved 🐞 Bug ≡ Correctness

Description

The new rd-dev path intentionally starts without delete-applications.yaml, but --grafana and
DEPLOY_ONLY both invoke yq on that path before the new wiring block can create or attach it.
Because the script runs with -e, operator previews using either supported option exit on the
missing file instead of deploying.

Code

hack/preview.sh[R964-965]

+# The file is absent initially; it is wired into rd-dev/kustomization.yaml dynamically
+# after configure_deploy_only / configure_kueue_for_ocp_version populate it.

Relevance

●●● Strong

Recent accepted repository reviews favor fixing deterministic script failures caused by invalid or
missing inputs.

PR-#13490

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The changed comments establish that the rd-dev target file does not initially exist and is only
considered for wiring after both configuration functions. The script uses Bash -e;
configure_deploy_only reads that absent path at line 330, while the earlier Grafana option edits
it at line 1076, so either command can terminate the script before lines 1103-1111 execute.

hack/preview.sh[1-2]
hack/preview.sh[318-330]
hack/preview.sh[962-965]
hack/preview.sh[1070-1077]
hack/preview.sh[1098-1111]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The rd-dev delete patch is intentionally absent at startup, but existing option handlers read it before any code creates it. With Bash error-exit enabled, `--operator-overlay` combined with `DEPLOY_ONLY` or `--grafana` terminates before deployment.

## Issue Context
`configure_deploy_only` reads the target file with `yq`, and the Grafana handler edits it with `yq -i`. Initialize the rd-dev target as an empty file before either handler executes, while keeping the later conditional wiring so an unused empty patch is not added to Kustomize.

## Fix Focus Areas
- hack/preview.sh[955-965]
- hack/preview.sh[318-340]
- hack/preview.sh[1070-1077]
- hack/preview.sh[1103-1111]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. Selective deployment breaks build ✓ Resolved 🐞 Bug ≡ Correctness

Description

For rd-dev, configure_deploy_only enumerates the complete rd-dev output but writes every generated
delete into the inherited development overlay's patch file. If DEPLOY_ONLY omits any rd-dev-only
ApplicationSet such as artifact-registry-proxy, that nested patch has no merge target and the
subsequent Kustomize build fails instead of deploying the selected applications.

Code

hack/preview.sh[R960-961]

+if [ "$TARGET_PREVIEW_OVERLAY" = "rd-dev" ]; then
    TARGET_DELETE_FILE="$ROOT/argo-cd-apps/overlays/development/delete-applications.yaml"

Relevance

●●● Strong

Concrete Kustomize target-missing build failure; reviewers accept fixes preventing invalid
inherited-overlay resource graphs.

PR-#11757
PR-#13239

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

configure_deploy_only builds the full target overlay and appends deletes for every unselected
result to TARGET_DELETE_FILE; the changed rd-dev branch points that file at the child development
overlay. The rd-dev kustomization adds four ApplicationSets only at its parent level, and the PR's
own delete-patch documentation confirms Kustomize requires each strategic-merge target to exist in
the graph where the patch is applied.

hack/preview.sh[320-340]
argo-cd-apps/overlays/development/kustomization.yaml[3-15]
argo-cd-apps/overlays/rd-dev/kustomization.yaml[6-14]
argo-cd-apps/overlays/rd-dev/delete-legacy-konflux-member-appsets.yaml[1-8]
argo-cd-apps/overlays/rd-dev/artifact-registry-proxy/artifact-registry-proxy-appset.yaml[1-4]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`DEPLOY_ONLY` writes delete patches for rd-dev-only ApplicationSets into `development/delete-applications.yaml`. Because that patch is evaluated inside the inherited development overlay, it cannot target resources added by the parent rd-dev overlay and Kustomize fails.

## Issue Context
Keep existing development-level mutations where needed, but place dynamically generated selective-deployment deletes in a patch file included by the top-level rd-dev kustomization so it can target both inherited and rd-dev-local ApplicationSets.

## Fix Focus Areas
- hack/preview.sh[320-340]
- hack/preview.sh[958-962]
- argo-cd-apps/overlays/rd-dev/kustomization.yaml[13-14]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

4. Failed refresh suppresses retries 🐞 Bug ☼ Reliability ⭐ New

Description

The soft-refresh patch ignores every failure but still records the Application as already refreshed.
A transient oc patch failure therefore prevents any later refresh attempt, leaving the Application
in Unknown until it recovers independently or the deployment times out.

Code

hack/preview.sh[R684-685]

+                    oc patch applications.argoproj.io $app -n $ARGOCD_NAMESPACE --type merge -p='{"metadata": {"annotations":{"argocd.argoproj.io/refresh": "soft"}}}' 2>/dev/null || true
+                    unknown_refreshed="$unknown_refreshed $app"

Relevance

●●● Strong

Clear transient-failure bug; accepted history favors reliability fixes, with no close rejection
precedent.

PR-#13490

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The patch failure is discarded at line 684 and the app is unconditionally added to
unknown_refreshed at line 685. On later loop iterations, lines 680-681 interpret that entry as a
completed refresh and only warn, while the enclosing loop eventually exits with failure when its
timeout is reached.

hack/preview.sh[679-687]
hack/preview.sh[600-619]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The Unknown-state recovery path records an Application in `unknown_refreshed` even when the `oc patch` command fails. Subsequent polling iterations then suppress retries although no soft refresh was requested successfully.

## Issue Context
Keep the protection against refreshing an Application on every polling iteration, but distinguish a successful refresh from a failed attempt. Handle patch failure explicitly with bounded retry/backoff or leave the Application eligible for a later controlled retry, and log the failure.

## Fix Focus Areas
- hack/preview.sh[679-687]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

5. Unknown apps refresh continuously ✓ Resolved 🐞 Bug ➹ Performance

Description

Every application in an unrecognized Unknown state is now soft-refreshed on every 10-second
polling iteration, with no per-app cooldown or one-shot guard. A persistent render, authentication,
or configuration failure can therefore trigger up to 270 refresh requests per application during the
45-minute timeout, adding load to the Argo CD controller/repository services while they are already
unhealthy.

Code

hack/preview.sh[R678-680]

+                # Unknown without a recognised cause — soft-refresh and keep waiting.
+                log_warn "Application '$app' is in Unknown state, attempting soft refresh"
+                oc patch applications.argoproj.io $app -n $ARGOCD_NAMESPACE --type merge -p='{"metadata": {"annotations":{"argocd.argoproj.io/refresh": "soft"}}}' 2>/dev/null || true

Relevance

●●● Strong

Clear polling-loop performance issue; no close rejection precedent, and retry/load safeguards are
treated as valid review concerns.

PR-#13202

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The synchronization loop runs until the 2700-second timeout and sleeps only SYNC_INTERVAL=10
between checks; the added branch patches every still-Unknown application on each pass without
tracking prior attempts or enforcing a cooldown.

hack/preview.sh[11-15]
hack/preview.sh[599-606]
hack/preview.sh[654-685]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Applications that remain in an unrecognized `Unknown` state are soft-refreshed during every synchronization polling iteration. Since polling occurs every 10 seconds for up to 45 minutes, persistent failures can cause hundreds of unnecessary Argo CD refresh requests per application and increase load on already-failing services.

## Issue Context
The specialized `context deadline exceeded` path waits for the requested refresh to complete, but the generic Unknown-state path has no one-shot tracking, cooldown, or other rate limit. Preserve diagnostics and timeout behavior while preventing repeated refresh requests for the same persistent state.

## Fix Focus Areas
- hack/preview.sh[654-685]
- hack/preview.sh[11-15]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

6. Grafana remains deleted ✓ Resolved 🐞 Bug ≡ Correctness

Description

For rd-dev, --grafana now edits the newly touched local delete file, but the actual
monitoring-workload-grafana deletion is applied inside the inherited development overlay. The
command reports success while Grafana remains absent from the rendered rd-dev resources.

Code

hack/preview.sh[R964-968]

+# Touch it now so yq reads in configure_deploy_only / configure_kueue_for_ocp_version and
+# the --grafana handler never hit a missing-file error. The file stays empty unless those
+# handlers actually append content; only then is it wired into rd-dev/kustomization.yaml.
+if [ "$TARGET_PREVIEW_OVERLAY" = "rd-dev" ]; then
+    touch "$TARGET_DELETE_FILE"

Relevance

●●● Strong

Concrete overlay correctness defect; accepted history favors fixing generated configuration that
silently produces wrong behavior.

PR-#13490

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

rd-dev includes the already-rendered development overlay, whose strategic-merge file deletes the
Grafana ApplicationSet. The handler operates on TARGET_DELETE_FILE, which is the empty
rd-dev-local file created by the new code, so deleting a Grafana document there cannot undo the
inherited deletion.

hack/preview.sh[955-968]
hack/preview.sh[1074-1081]
argo-cd-apps/overlays/rd-dev/kustomization.yaml[6-14]
argo-cd-apps/overlays/development/kustomization.yaml[13-15]
argo-cd-apps/overlays/development/delete-applications.yaml[87-92]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The rd-dev `--grafana` path removes a document from an empty local delete file, while Grafana is deleted by the inherited development overlay. Consequently, the option succeeds without restoring the Grafana ApplicationSet.

## Issue Context
An outer strategic-merge patch cannot restore a resource already removed while rendering `../development`. For rd-dev, remove the Grafana deletion from the development overlay's delete file in the preview branch, while continuing to use the rd-dev-local file for newly generated deletes.

## Fix Focus Areas
- hack/preview.sh[964-968]
- hack/preview.sh[1074-1081]
- argo-cd-apps/overlays/development/delete-applications.yaml[87-92]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

View medium (1)

7. Stale deletes survive reruns ✓ Resolved 🐞 Bug ☼ Reliability

Description

Using touch preserves a non-empty untracked delete file left by an aborted preview run, while the
script's cleanliness check ignores untracked files. A later rd-dev run can therefore stage and
commit stale DEPLOY_ONLY or Kueue deletions even when those deletions were not requested this
time.

Code

hack/preview.sh[R967-968]

+if [ "$TARGET_PREVIEW_OVERLAY" = "rd-dev" ]; then
+    touch "$TARGET_DELETE_FILE"

Relevance

●● Moderate

Plausible rerun reliability issue, but rejection evidence concerns a different mutation path and
does not decisively transfer.

PR-#13490

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The new initialization preserves existing content, the pre-run check only inspects tracked diffs,
and any resulting non-empty file is staged. The producer functions append deletions, so an
interrupted run can leave exactly the stale state consumed by the next invocation.

hack/preview.sh[964-968]
hack/preview.sh[1022-1034]
hack/preview.sh[329-340]
hack/preview.sh[1144-1150]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
A failed rd-dev preview can leave an untracked, populated `delete-applications.yaml`. The next run preserves it with `touch`, does not detect it in the tracked-only cleanliness check, and later stages its stale deletions.

## Issue Context
The generated file should contain only deletions produced by the current invocation. Validate the working tree, create the preview branch, and then explicitly initialize or truncate the generated file; alternatively clean it reliably on exit.

## Fix Focus Areas
- hack/preview.sh[964-968]
- hack/preview.sh[1022-1034]
- hack/preview.sh[1144-1148]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 3 rules

Tip of the day

💡 Did you know, you can ask Qodo to dismiss a finding you disagree with, with your reason on record

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Previous reviews

Review updated until commit 1b3642f

Results up to commit 660ac0a ⚖️ Balanced

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Selective deployment breaks build ✓ Resolved 🐞 Bug ≡ Correctness

Description

For rd-dev, configure_deploy_only enumerates the complete rd-dev output but writes every generated
delete into the inherited development overlay's patch file. If DEPLOY_ONLY omits any rd-dev-only
ApplicationSet such as artifact-registry-proxy, that nested patch has no merge target and the
subsequent Kustomize build fails instead of deploying the selected applications.

Code

hack/preview.sh[R960-961]

+if [ "$TARGET_PREVIEW_OVERLAY" = "rd-dev" ]; then
    TARGET_DELETE_FILE="$ROOT/argo-cd-apps/overlays/development/delete-applications.yaml"

Relevance

●●● Strong

Concrete Kustomize target-missing build failure; reviewers accept fixes preventing invalid
inherited-overlay resource graphs.

PR-#11757
PR-#13239

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

configure_deploy_only builds the full target overlay and appends deletes for every unselected
result to TARGET_DELETE_FILE; the changed rd-dev branch points that file at the child development
overlay. The rd-dev kustomization adds four ApplicationSets only at its parent level, and the PR's
own delete-patch documentation confirms Kustomize requires each strategic-merge target to exist in
the graph where the patch is applied.

hack/preview.sh[320-340]
argo-cd-apps/overlays/development/kustomization.yaml[3-15]
argo-cd-apps/overlays/rd-dev/kustomization.yaml[6-14]
argo-cd-apps/overlays/rd-dev/delete-legacy-konflux-member-appsets.yaml[1-8]
argo-cd-apps/overlays/rd-dev/artifact-registry-proxy/artifact-registry-proxy-appset.yaml[1-4]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`DEPLOY_ONLY` writes delete patches for rd-dev-only ApplicationSets into `development/delete-applications.yaml`. Because that patch is evaluated inside the inherited development overlay, it cannot target resources added by the parent rd-dev overlay and Kustomize fails.

## Issue Context
Keep existing development-level mutations where needed, but place dynamically generated selective-deployment deletes in a patch file included by the top-level rd-dev kustomization so it can target both inherited and rd-dev-local ApplicationSets.

## Fix Focus Areas
- hack/preview.sh[320-340]
- hack/preview.sh[958-962]
- argo-cd-apps/overlays/rd-dev/kustomization.yaml[13-14]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Results up to commit 4bd2bd8 ⚖️ Balanced

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Absent delete file aborts ✓ Resolved 🐞 Bug ≡ Correctness

Description

The new rd-dev path intentionally starts without delete-applications.yaml, but --grafana and
DEPLOY_ONLY both invoke yq on that path before the new wiring block can create or attach it.
Because the script runs with -e, operator previews using either supported option exit on the
missing file instead of deploying.

Code

hack/preview.sh[R964-965]

+# The file is absent initially; it is wired into rd-dev/kustomization.yaml dynamically
+# after configure_deploy_only / configure_kueue_for_ocp_version populate it.

Relevance

●●● Strong

Recent accepted repository reviews favor fixing deterministic script failures caused by invalid or
missing inputs.

PR-#13490

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The changed comments establish that the rd-dev target file does not initially exist and is only
considered for wiring after both configuration functions. The script uses Bash -e;
configure_deploy_only reads that absent path at line 330, while the earlier Grafana option edits
it at line 1076, so either command can terminate the script before lines 1103-1111 execute.

hack/preview.sh[1-2]
hack/preview.sh[318-330]
hack/preview.sh[962-965]
hack/preview.sh[1070-1077]
hack/preview.sh[1098-1111]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The rd-dev delete patch is intentionally absent at startup, but existing option handlers read it before any code creates it. With Bash error-exit enabled, `--operator-overlay` combined with `DEPLOY_ONLY` or `--grafana` terminates before deployment.

## Issue Context
`configure_deploy_only` reads the target file with `yq`, and the Grafana handler edits it with `yq -i`. Initialize the rd-dev target as an empty file before either handler executes, while keeping the later conditional wiring so an unused empty patch is not added to Kustomize.

## Fix Focus Areas
- hack/preview.sh[955-965]
- hack/preview.sh[318-340]
- hack/preview.sh[1070-1077]
- hack/preview.sh[1103-1111]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Generated patch is not pushed ✓ Resolved 🐞 Bug ≡ Correctness

Description

When an old-OCP run or selective deployment creates the new rd-dev delete file, the wiring block
adds a reference to it but the later git commit -a does not stage this newly created untracked
file. The pushed preview branch therefore contains a kustomization referencing a missing patch,
causing Argo CD to fail to render the rd-dev root application.

Code

hack/preview.sh[R1105-1108]

+    if [ "$TARGET_PREVIEW_OVERLAY" = "rd-dev" ] && [ -s "$TARGET_DELETE_FILE" ]; then
+        rd_kust="$ROOT/argo-cd-apps/overlays/rd-dev/kustomization.yaml"
+        if ! grep -q "delete-applications.yaml" "$rd_kust"; then
+            yq -i '.patchesStrategicMerge += ["delete-applications.yaml"]' "$rd_kust"

Relevance

●●● Strong

The untracked generated patch would make the pushed overlay invalid; this is a concrete correctness
failure.

PR-#13490

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The delete handlers append to the path that the changed code documents as initially absent, making
it a new untracked file. Lines 1105-1108 then modify the tracked kustomization to reference that
file, but the only commit command is git commit -a, which commits tracked modifications without
adding new files.

hack/preview.sh[327-340]
hack/preview.sh[365-374]
hack/preview.sh[962-965]
hack/preview.sh[1103-1110]
hack/preview.sh[1137-1143]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The script creates `rd-dev/delete-applications.yaml` at runtime and adds it to the rd-dev kustomization, but the commit uses `git commit -a`. Git does not include a newly created untracked file with that option, leaving the pushed kustomization with a missing patch dependency.

## Issue Context
Ensure the generated delete file is staged before committing whenever it is wired into the kustomization. This can be done with an explicit `git add` for the generated file or by changing the commit preparation to include intended untracked generated files safely.

## Fix Focus Areas
- hack/preview.sh[1103-1111]
- hack/preview.sh[1137-1143]
- hack/preview.sh[327-340]
- hack/preview.sh[365-374]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Results up to commit 9db6086 ⚖️ Balanced

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Grafana remains deleted ✓ Resolved 🐞 Bug ≡ Correctness

Description

For rd-dev, --grafana now edits the newly touched local delete file, but the actual
monitoring-workload-grafana deletion is applied inside the inherited development overlay. The
command reports success while Grafana remains absent from the rendered rd-dev resources.

Code

hack/preview.sh[R964-968]

+# Touch it now so yq reads in configure_deploy_only / configure_kueue_for_ocp_version and
+# the --grafana handler never hit a missing-file error. The file stays empty unless those
+# handlers actually append content; only then is it wired into rd-dev/kustomization.yaml.
+if [ "$TARGET_PREVIEW_OVERLAY" = "rd-dev" ]; then
+    touch "$TARGET_DELETE_FILE"

Relevance

●●● Strong

Concrete overlay correctness defect; accepted history favors fixing generated configuration that
silently produces wrong behavior.

PR-#13490

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

rd-dev includes the already-rendered development overlay, whose strategic-merge file deletes the
Grafana ApplicationSet. The handler operates on TARGET_DELETE_FILE, which is the empty
rd-dev-local file created by the new code, so deleting a Grafana document there cannot undo the
inherited deletion.

hack/preview.sh[955-968]
hack/preview.sh[1074-1081]
argo-cd-apps/overlays/rd-dev/kustomization.yaml[6-14]
argo-cd-apps/overlays/development/kustomization.yaml[13-15]
argo-cd-apps/overlays/development/delete-applications.yaml[87-92]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The rd-dev `--grafana` path removes a document from an empty local delete file, while Grafana is deleted by the inherited development overlay. Consequently, the option succeeds without restoring the Grafana ApplicationSet.

## Issue Context
An outer strategic-merge patch cannot restore a resource already removed while rendering `../development`. For rd-dev, remove the Grafana deletion from the development overlay's delete file in the preview branch, while continuing to use the rd-dev-local file for newly generated deletes.

## Fix Focus Areas
- hack/preview.sh[964-968]
- hack/preview.sh[1074-1081]
- argo-cd-apps/overlays/development/delete-applications.yaml[87-92]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Stale deletes survive reruns ✓ Resolved 🐞 Bug ☼ Reliability

Description

Using touch preserves a non-empty untracked delete file left by an aborted preview run, while the
script's cleanliness check ignores untracked files. A later rd-dev run can therefore stage and
commit stale DEPLOY_ONLY or Kueue deletions even when those deletions were not requested this
time.

Code

hack/preview.sh[R967-968]

+if [ "$TARGET_PREVIEW_OVERLAY" = "rd-dev" ]; then
+    touch "$TARGET_DELETE_FILE"

Relevance

●● Moderate

Plausible rerun reliability issue, but rejection evidence concerns a different mutation path and
does not decisively transfer.

PR-#13490

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The new initialization preserves existing content, the pre-run check only inspects tracked diffs,
and any resulting non-empty file is staged. The producer functions append deletions, so an
interrupted run can leave exactly the stale state consumed by the next invocation.

hack/preview.sh[964-968]
hack/preview.sh[1022-1034]
hack/preview.sh[329-340]
hack/preview.sh[1144-1150]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
A failed rd-dev preview can leave an untracked, populated `delete-applications.yaml`. The next run preserves it with `touch`, does not detect it in the tracked-only cleanliness check, and later stages its stale deletions.

## Issue Context
The generated file should contain only deletions produced by the current invocation. Validate the working tree, create the preview branch, and then explicitly initialize or truncate the generated file; alternatively clean it reliably on exit.

## Fix Focus Areas
- hack/preview.sh[964-968]
- hack/preview.sh[1022-1034]
- hack/preview.sh[1144-1148]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Results up to commit e989904 ⚖️ Balanced

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Unknown apps refresh continuously ✓ Resolved 🐞 Bug ➹ Performance

Description

Every application in an unrecognized Unknown state is now soft-refreshed on every 10-second
polling iteration, with no per-app cooldown or one-shot guard. A persistent render, authentication,
or configuration failure can therefore trigger up to 270 refresh requests per application during the
45-minute timeout, adding load to the Argo CD controller/repository services while they are already
unhealthy.

Code

hack/preview.sh[R678-680]

+                # Unknown without a recognised cause — soft-refresh and keep waiting.
+                log_warn "Application '$app' is in Unknown state, attempting soft refresh"
+                oc patch applications.argoproj.io $app -n $ARGOCD_NAMESPACE --type merge -p='{"metadata": {"annotations":{"argocd.argoproj.io/refresh": "soft"}}}' 2>/dev/null || true

Relevance

●●● Strong

Clear polling-loop performance issue; no close rejection precedent, and retry/load safeguards are
treated as valid review concerns.

PR-#13202

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The synchronization loop runs until the 2700-second timeout and sleeps only SYNC_INTERVAL=10
between checks; the added branch patches every still-Unknown application on each pass without
tracking prior attempts or enforcing a cooldown.

hack/preview.sh[11-15]
hack/preview.sh[599-606]
hack/preview.sh[654-685]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Applications that remain in an unrecognized `Unknown` state are soft-refreshed during every synchronization polling iteration. Since polling occurs every 10 seconds for up to 45 minutes, persistent failures can cause hundreds of unnecessary Argo CD refresh requests per application and increase load on already-failing services.

## Issue Context
The specialized `context deadline exceeded` path waits for the requested refresh to complete, but the generic Unknown-state path has no one-shot tracking, cooldown, or other rate limit. Preserve diagnostics and timeout behavior while preventing repeated refresh requests for the same persistent state.

## Fix Focus Areas
- hack/preview.sh[654-685]
- hack/preview.sh[11-15]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[fullsend-ai-review]

Review

Findings

High

• [stale-reference] components/konflux-operator/README.md:80 — Documentation references development-operator Argo overlay in the --operator-overlay description, but this flag now selects the rd-dev overlay. A developer following the README would expect development-operator to be the active overlay.
  Remediation: Update to reference rd-dev instead of development-operator.

Medium

• [stale-reference] components/konflux-operator/ci/openshift-overlay-e2e/README.md:1 — Title and content reference development-operator overlay, which is now effectively replaced by rd-dev for E2E deployments.
  Remediation: Update the title and content to reference rd-dev.

• [architectural-coherence] argo-cd-apps/overlays/rd-dev/kustomization.yaml — The rd-dev overlay is repurposed from a standalone overlay (previously patches: [] with comment "No patches until onboarded") to a development-inheriting overlay with strategic-merge deletes and pipeline-service patches, but lacks a header comment explaining its new role.
  Remediation: Add a header comment similar to development-operator explaining that rd-dev is the canonical overlay for E2E/operator preview deployments.

• [production-pr-missing-risk-assessment] PR has environment/production, prod/needs-approval, and infra/hold-production labels. AGENTS.md requires production PRs include a ## Risk Assessment section (level, what could go wrong, rollback plan, blast radius). The PR body does not contain one.
  Remediation: Add a Risk Assessment section per skills/risk-assessment.md, or remove the production labels if this PR does not affect production clusters.

Low

• [stale-reference] components/konflux-operator/ci/openshift-overlay-e2e/install.sh:2 — Comment references development-operator overlay.
• [stale-reference] components/konflux-operator/ci/openshift-overlay-e2e/install.sh:31 — Log message references development-operator overlay.
• [stale-reference] hack/deploy-argocd.sh:242 — Log message in configure_operator_overlay_health_customizations references development-operator overlay.
• [naming-convention] argo-cd-apps/app-of-app-sets/rd-dev/ — Patch file naming (change-source-path.yaml) and flat directory structure differ from the rd-staging pattern (patches/source-path-patch.yaml in a patches/ subdirectory).
• [missing-authorization] No linked Jira issue for a non-trivial architectural change. Consider linking an issue or adding context in the PR body.
• [scope-creep] hack/preview.sh — PR includes operational improvements beyond the overlay rename (skip_apps_pattern, unknown_refreshed tracking, dynamic delete-applications.yaml wiring, Grafana dual-overlay handling). These appear necessary for rd-dev but are not called out in the PR description.
• [incomplete-transition] The old development-operator overlay remains on disk. The PR body acknowledges this is intentional pending CI validation. Consider creating a follow-up issue to track cleanup.
• [naming-clarity] The rd-dev abbreviation is not defined in project docs.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

Medium

• [scope-creep] hack/preview.sh:621 — The PR introduces two behavioral changes not mentioned in the title or body: (1) skip_apps_pattern="container-image-proxy" silently excludes a non-healthy app from the sync-readiness check for all overlays, and (2) a new unknown_refreshed mechanism changes Unknown-state ArgoCD app handling from fail-with-error to soft-refresh-once-then-warn. These are operational changes to the deploy loop beyond the overlay rename.
  Remediation: Document both changes in the PR description. Consider splitting them into a separate PR.

• [stale-reference] components/konflux-operator/README.md:80 — Line 80 still refers to the overlay as development-operator, but hack/preview.sh now uses rd-dev when --operator-overlay is passed. After merge, this documentation will be inaccurate.
  Remediation: Update to reference rd-dev.

Low

• [missing-authorization] No linked Jira issue for a non-trivial change. Per AGENTS.md, commits should carry a Jira ID prefix.

• [naming-convention] argo-cd-apps/app-of-app-sets/rd-dev/kustomization.yaml:6 — Uses flat patch files (change-source-path.yaml) rather than the patches/ subdirectory convention used by siblings rd-staging and rd-production.

• [stale-reference] components/konflux-operator/ci/openshift-overlay-e2e/README.md:1 — Title references development-operator overlay; the preview script now targets rd-dev.

• [scope-precision] hack/preview.sh — skip_apps_pattern is defined unconditionally inside deploy_and_wait_for_argocd, filtering container-image-proxy for all overlays rather than scoping to rd-dev only.

• [incomplete-migration] Residual development-operator references exist in hack/deploy-argocd.sh, infra-tools/internal/detector/detector.go, and components/konflux-operator/ci/openshift-overlay-e2e/install.sh. The detector.go mapping may need an rd-dev entry to correctly identify the environment.

• [naming-coherence] hack/preview.sh — The --operator-overlay flag name retains old terminology now that it maps to rd-dev.

Previous run (2)

Review

Findings

Medium

• [unconditional skip in shared function] hack/preview.sh — The skip_apps_pattern="container-image-proxy" variable in deploy_and_wait_for_argocd() is applied unconditionally regardless of which overlay is active. While currently harmless for the development overlay (container-image-proxy is only deployed by rd-dev, so grep -v won't match anything), the pattern is a raw substring match against the full oc get apps output. Any future application whose name contains the substring container-image-proxy (e.g., my-container-image-proxy-v2) would also be silently skipped. Additionally, the variable is not scoped to the rd-dev overlay.
  Remediation: Gate the skip pattern on the rd-dev overlay (e.g., local skip_apps_pattern=""; [ "$TARGET_PREVIEW_OVERLAY" = "rd-dev" ] && skip_apps_pattern="container-image-proxy") or use exact-name matching instead of substring grep.

Low

• [stale-reference] components/konflux-operator/ci/openshift-overlay-e2e/install.sh:31 — Log message still says "development-operator overlay" but --operator-overlay now deploys rd-dev. The script behavior is correct but the log message will be misleading after this PR merges.
• [missing-authorization] — PR lacks a linked Jira issue for a non-trivial structural change (8 files, overlay consolidation). Per CLAUDE.md commit conventions, a Jira ID (KFLUXINFRA-NNNN) is expected.
• [scope-creep] hack/preview.sh — PR body describes the overlay replacement but does not enumerate the additional behavioral changes introduced: skip_apps_pattern addition in deploy_and_wait_for_argocd() and modified delete file handling for rd-dev. Consider updating the PR description to document these implementation details.

Previous run (3)

Review

Findings

Medium

• [stale-reference] components/konflux-operator/ci/openshift-overlay-e2e/install.sh:2 — E2E install script comment (line 2) and echo (line 31) still reference "development-operator" but hack/bootstrap-cluster.sh --operator-overlay now maps to rd-dev. Functionally correct but misleading during CI debugging.

• [stale-overlay-reference] components/konflux-operator/ci/openshift-overlay-e2e/README.md:1 — Title reads "development-operator overlay E2E" but the E2E pipeline now uses the rd-dev overlay.

• [stale-overlay-reference] components/konflux-operator/README.md:80 — Describes --operator-overlay as using the "development-operator Argo overlay" when it now uses rd-dev.

Low

• [scope-alignment] PR title says "replace" but development-operator is intentionally kept during the transition. The PR body documents this as a phased migration — consider updating the title to reflect the phased approach (e.g., "add rd-dev overlay to supersede development-operator").

• [stale-reference] hack/deploy-argocd.sh:242 — Log message "Configuring Konflux CR health check for development-operator overlay" references the old overlay name.

• [stale-reference] hack/argocd-operator-overlay-health-checks.yaml:2 — Comment says "Applied only for development-operator bootstrap" when the overlay is now rd-dev.

• [file-organization] argo-cd-apps/app-of-app-sets/rd-dev/kustomization.yaml — Patch files placed directly in root with change-*.yaml naming, while rd-staging/rd-production use a patches/ subdirectory. Follows the development-operator pattern being migrated from.

• [documentation] argo-cd-apps/app-of-app-sets/rd-dev/kustomization.yaml — Missing header comment explaining the purpose of this app-of-app-set (development-operator has one).

• [outdated-comment] components/multi-platform-controller-rd/README.md:12 — Comment says "until rd-dev is wired" but this PR wires rd-dev up.

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 5:53 PM UTC · Ended 5:57 PM UTC

Commit: 0b3839f · View workflow run →

[qodo-for-redhat-appstudio]

Code review by qodo was updated up to the latest commit 4bd2bd8

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 5:58 PM UTC · Ended 6:02 PM UTC

Commit: 0b3839f · View workflow run →

[qodo-for-redhat-appstudio]

Code review by qodo was updated up to the latest commit 9db6086

[konflux-ci-qe-bot]

🤖 Pipeline Failure Analysis

Category: Timeout

The pipeline failed due to a timeout during the AppStudio operator overlay installation because the trust-manager-in-cluster-local ArgoCD application remained in an OutOfSync state with a pending resource.

📋 Technical Details

Immediate Cause

The redhat-appstudio-operator-overlay-install step timed out after 1 hour because the ArgoCD application trust-manager-in-cluster-local failed to achieve a synchronized state, reporting as OutOfSync with one pending resource. This stalled the progression of the overall Konflux application deployment.

Contributing Factors

Despite the trust-manager-in-cluster-local application being reported as Healthy, its persistent OutOfSync status and the presence of a pending resource prevented the completion of all required ArgoCD application synchronizations necessary for the installation process. The system waited for applications to become ready for the entire timeout duration.

Impact

The inability of the trust-manager-in-cluster-local ArgoCD application to fully synchronize blocked the successful bootstrap of Konflux applications. This halted the entire AppStudio operator overlay installation, causing the appstudio-operator-overlay-e2e-tests to fail before any functional tests could be executed.

🔍 Evidence

appstudio-operator-overlay-e2e-tests/redhat-appstudio-operator-overlay-install

Category: timeout
Root Cause: The installation timed out because the trust-manager-in-cluster-local ArgoCD application remained in an OutOfSync state with 1 pending resource, preventing the overall deployment of Konflux applications from completing.

Logs:

artifacts/appstudio-operator-overlay-e2e-tests/redhat-appstudio-operator-overlay-install/build-log.txt

[2026-08-27 12:14:24] [STEP] Waiting for all ArgoCD applications to sync and become healthy
[2026-08-27 12:14:24] [INFO] Timeout: 2700 seconds (45 minutes)
[2026-08-27 12:14:24] [PROGRESS] Applications: 37/39 ready | 1 pending (0m 0s elapsed)
[2026-08-27 12:14:24] [INFO] Pending: trust-manager-in-cluster-local

artifacts/appstudio-operator-overlay-e2e-tests/redhat-appstudio-operator-overlay-install/build-log.txt

[2026-08-27 12:16:31] [INFO]   ├─ App: trust-manager-in-cluster-local
[2026-08-27 12:16:32] [INFO]   │  ├─ Sync Status: OutOfSync
[2026-08-27 12:16:32] [INFO]   │  ├─ Health Status: Healthy
[2026-08-27 12:16:32] [INFO]   │  ├─ Out-of-sync resources: 1
[2026-08-27 12:16:32] [INFO]   │  └─ Message: No message

artifacts/appstudio-operator-overlay-e2e-tests/redhat-appstudio-operator-overlay-install/build-log.txt

{"component":"entrypoint","file":"sigs.k8s.io/prow/pkg/entrypoint/run.go:178","func":"sigs.k8s.io/prow/pkg/entrypoint.Options.ExecuteProcess","level":"error","msg":"Process did not finish before 1h0m0s timeout","severity":"error","time":"2026-08-27T12:56:52Z"}

---

Analysis powered by prow-failure-analysis | Build: 2092939012648996864

[qodo-for-redhat-appstudio]

Code review by qodo was updated up to the latest commit 400a357

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:03 PM UTC · Completed 6:23 PM UTC

Commit: 0b3839f · View workflow run →

[flacatus]

/test ?

[qodo-for-redhat-appstudio]

Unsupported PR languages

[flacatus]

/test appstudio-operator-overlay-e2e-tests

[flacatus]

/test ?

[qodo-for-redhat-appstudio]

Unsupported PR languages

[flacatus]

/test appstudio-e2e-tests

[qodo-for-redhat-appstudio]

Unsupported PR languages

[flacatus]

@enkeefe00 can we remove prod labels?

[eedri]

Risk Assessment

AI calculated Risk — based on code changes and PR description.
Override this by adding your own ## Risk Assessment section to the PR description.

Risk Level: Medium
Description: This PR consolidates development overlays by making rd-dev inherit from development and applying strategic merges to delete several legacy ApplicationSets, along with updating deployment scripts. The change involves complex Kustomize inheritance and multiple resource deletions, which, despite targeting preview environments, carries a medium risk of breaking E2E deployments or introducing subtle configuration issues.
Rollback: Revert this PR.

[enkeefe00]

@enkeefe00 can we remove prod labels?

I don't want to approve/merge this until we can see the new e2e tests running successfully.

[flacatus]

/test appstudio-e2e-tests

[qodo-for-redhat-appstudio]

Unsupported PR languages

[flacatus]

Not sure if i understand why… but lets do it ..

[flacatus]

the e2e failure is not related with this PR…

[flacatus]

/test appstudio-e2e-tests

[qodo-for-redhat-appstudio]

Unsupported PR languages

[flacatus]

/test appstudio-e2e-tests

Attempt 3. All other attempts were success

[qodo-for-redhat-appstudio]

Unsupported PR languages

[qodo-for-redhat-appstudio]

No code changes since the last review — review skipped

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 11:36 AM UTC · Completed 11:55 AM UTC

Commit: c9a1439 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $6.54

[fullsend-ai-review]

See the review comment for full details.

[flacatus]

/test appstudio-e2e-tests

[qodo-for-redhat-appstudio]

Unsupported PR languages

[flacatus]

/test appstudio-operator-overlay-e2e-tests

I retest wrong test

[qodo-for-redhat-appstudio]

Unsupported PR languages

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: enkeefe00, flacatus

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [enkeefe00]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment