feat(#3668): update boost app-config and load-secrets for local dev (#3669)

* feat(#3668): update boost app-config and load-secrets for local dev

Align app-config.yaml with the config structure expected by boost
backend plugins after merging the frontend scaffold (#3645) and
Kagenti auth (#3661) PRs:

- Remove stale boost.model and boost.entityProviders sections
- Add boost.security.adminUsers for dev admin panel access
- Add boost.providers.llamastack.defaultModel field
- Rename LLAMASTACK_BASE_URL env var to BOOST_LLAMA_STACK_URL
- Add boost.providers.kagenti.defaultAgent
- Add boost.kagenti.baseUrl, namespace, and dev convenience flags
  (showAllNamespaces, skipTlsVerify, verboseStreamLogging)

Update load-secrets.sh with best-effort Llama Stack route discovery
via OGX operator labels (ogx.io/watch, managed-by, part-of). The
discovery warns on failure and exports BOOST_LLAMA_STACK_URL.

Closes #3668

* fix(boost): conditional export and bash best practices for load-secrets.sh

- Guard BOOST_LLAMA_STACK_URL export with [[ -n ]] check so an empty
  value does not override the localhost fallback in app-config.yaml
- Use [[ instead of [ for conditional tests (shellcheck/sonarcloud)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(boost): use [[ in remaining conditional test in load-secrets.sh

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: fullsend-code <278716306+fullsend-ai-coder[bot]@users.noreply.github.com>
Co-authored-by: gabemontero <gmontero@redhat.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: 3 people

workspaces/boost/app-config.yaml

@@ -63,30 +63,27 @@ catalog:
 boost:
   security:
     mode: 'development-only-no-auth'
-
-  model:
-    baseUrl: ${BOOST_MODEL_BASE_URL:-http://localhost:8080/v1}
-    name: ${BOOST_MODEL:-default}
+    adminUsers:
+      - 'user:default/admin'
+      - 'user:default/guest'
 
   providers:
     llamastack:
-      baseUrl: ${LLAMASTACK_BASE_URL:-http://localhost:8321}
-
+      baseUrl: ${BOOST_LLAMA_STACK_URL:-http://localhost:8321}
+      defaultModel: ${BOOST_MODEL:-default}
     kagenti:
       baseUrl: ${KAGENTI_BASE_URL:-http://localhost:8080}
+      defaultAgent: default
       namespaces:
         - ${KAGENTI_NAMESPACE:-default}
 
   kagenti:
+    baseUrl: ${KAGENTI_BASE_URL:-http://localhost:8080}
+    namespace: ${KAGENTI_NAMESPACE:-default}
     auth:
       tokenEndpoint: ${KAGENTI_TOKEN_ENDPOINT:-}
       clientId: ${KAGENTI_CLIENT_ID:-}
       clientSecret: ${KAGENTI_CLIENT_SECRET:-}
-
-  entityProviders:
-    kagenti:
-      baseUrl: ${KAGENTI_BASE_URL:-http://localhost:8080}
-      namespaces:
-        - ${KAGENTI_NAMESPACE:-default}
-      agentRefreshIntervalSeconds: 300
-      toolRefreshIntervalSeconds: 300
+    showAllNamespaces: true
+    skipTlsVerify: true
+    verboseStreamLogging: true

workspaces/boost/scripts/load-secrets.sh

@@ -21,7 +21,7 @@ _load_field() {
     echo "  WARNING: failed to read $1 from secret ${NAMESPACE}/${SECRET_NAME}" >&2
     return 1
   }
-  if [ -z "${val}" ]; then
+  if [[ -z "${val}" ]]; then
     echo "  WARNING: $1 is empty in secret ${NAMESPACE}/${SECRET_NAME}" >&2
     return 1
   fi
@@ -37,8 +37,38 @@ BOOST_MODEL=$(_load_field AUGMENT_MODEL)                        || { echo "Abort
 
 unset -f _load_field
 
+# Discover Llama Stack route via OGX operator labels (best-effort)
+_discover_llama_stack_route() {
+  local route_host=""
+  local label
+  for label in "ogx.io/watch=true" \
+               "app.kubernetes.io/managed-by=ogx-operator" \
+               "app.kubernetes.io/part-of=ogx"; do
+    route_host=$(kubectl get routes --all-namespaces \
+      -l "$label" \
+      -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.host}{"\n"}{end}' 2>/dev/null \
+      | grep -i "llama" \
+      | head -1 \
+      | awk '{print $2}')
+    if [[ -n "$route_host" ]]; then
+      echo "https://${route_host}"
+      return 0
+    fi
+  done
+  return 1
+}
+
+BOOST_LLAMA_STACK_URL=$(_discover_llama_stack_route) || {
+  echo "  WARNING: no Llama Stack route found via OGX labels — set BOOST_LLAMA_STACK_URL manually" >&2
+}
+
+unset -f _discover_llama_stack_route
+
 export KAGENTI_CLIENT_SECRET KAGENTI_CLIENT_ID KAGENTI_TOKEN_ENDPOINT
 export KAGENTI_BASE_URL KAGENTI_NAMESPACE BOOST_MODEL
+if [[ -n "$BOOST_LLAMA_STACK_URL" ]]; then
+  export BOOST_LLAMA_STACK_URL
+fi
 export NODE_TLS_REJECT_UNAUTHORIZED=0
 
 echo "Loaded: KAGENTI_BASE_URL=$KAGENTI_BASE_URL"
@@ -47,5 +77,6 @@ echo "Loaded: KAGENTI_CLIENT_ID=$KAGENTI_CLIENT_ID"
 echo "Loaded: KAGENTI_CLIENT_SECRET=<set>"
 echo "Loaded: KAGENTI_TOKEN_ENDPOINT=$KAGENTI_TOKEN_ENDPOINT"
 echo "Loaded: BOOST_MODEL=$BOOST_MODEL"
+echo "Loaded: BOOST_LLAMA_STACK_URL=${BOOST_LLAMA_STACK_URL:-<not discovered>}"
 echo "Set:    NODE_TLS_REJECT_UNAUTHORIZED=0 (for self-signed OpenShift route certs)"
 echo "Ready — launch the debugger in this shell."