[oadp-1.3] OADP-8450: Add readiness probes and service accounts to CLI download server

[NicholasYancey]

Why the changes were made

The Telco certification lifecycle-readiness-probe, access-control-pod-service-account, and access-control-pod-role-bindings checks fail because the oadp-cli-server container (deployed to serve CLI binary downloads via ConsoleCLIDownload) has no ReadinessProbe defined and uses the default service account.

This PR adds a ReadinessProbe and LivenessProbe to the container, creates a dedicated ServiceAccount (openshift-adp-cli-server), and backfills both onto any already-running Deployments on operator upgrade.

Backport of #2306 to oadp-1.3. The VMDP server does not exist in this branch so only CLI changes are included.

Jira link: https://redhat.atlassian.net/browse/OADP-8450

How to test the changes made

Deploy the operator from this branch:

make deploy

Confirm the download-server Deployment now has probes defined:

oc -n openshift-adp get deploy openshift-adp-oadp-cli-server \
  -o jsonpath='{.spec.template.spec.containers[0].readinessProbe}{"\n"}'

Should return a populated httpGet probe object, not empty.

Confirm the pod uses the dedicated service account:

oc -n openshift-adp get pod -l app=oadp-cli \
  -o jsonpath='{.items[0].spec.serviceAccountName}{"\n"}'

Should return openshift-adp-cli-server.

Confirm the pod reports Ready:

oc get pods -n openshift-adp -l app=oadp-cli

READY column should show 1/1.

[openshift-ci-robot]

@NicholasYancey: This pull request references OADP-8450 which is a valid jira issue.

Details

In response to this:

Why the changes were made

The Telco certification lifecycle-readiness-probe, access-control-pod-service-account, and access-control-pod-role-bindings checks fail because the oadp-cli-server container (deployed to serve CLI binary downloads via ConsoleCLIDownload) has no ReadinessProbe defined and uses the default service account.

This PR adds a ReadinessProbe and LivenessProbe to the container, creates a dedicated ServiceAccount (openshift-adp-cli-server), and backfills both onto any already-running Deployments on operator upgrade.

Backport of #2306 to oadp-1.3. The VMDP server does not exist in this branch so only CLI changes are included.

Jira link: https://redhat.atlassian.net/browse/OADP-8450

How to test the changes made

Deploy the operator from this branch:

make deploy

Confirm the download-server Deployment now has probes defined:

oc -n openshift-adp get deploy openshift-adp-oadp-cli-server \
 -o jsonpath='{.spec.template.spec.containers[0].readinessProbe}{"\n"}'

Should return a populated httpGet probe object, not empty.

Confirm the pod uses the dedicated service account:

oc -n openshift-adp get pod -l app=oadp-cli \
 -o jsonpath='{.items[0].spec.serviceAccountName}{"\n"}'

Should return openshift-adp-cli-server.

Confirm the pod reports Ready:

oc get pods -n openshift-adp -l app=oadp-cli

READY column should show 1/1.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 3b83b855-1fd9-48f6-8bc2-41d0a411ea4c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

❌ Patch coverage is 0% with 75 lines in your changes missing coverage. Please review.
✅ Project coverage is 29.03%. Comparing base (c575673) to head (ccf51db).

⚠️ Current head ccf51db differs from pull request most recent head 0ac8a8f

Please upload reports for the commit 0ac8a8f to get more accurate results.

Files with missing lines	Patch %	Lines
controllers/cli_download_controller.go	0.00%	75 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##           oadp-1.3    #2310      +/-   ##
============================================
- Coverage     29.46%   29.03%   -0.44%     
============================================
  Files            30       30              
  Lines          4812     4884      +72     
============================================
  Hits           1418     1418              
- Misses         3228     3300      +72     
  Partials        166      166              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[openshift-ci]

@NicholasYancey: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[shubham-pampattiwar]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: NicholasYancey, shubham-pampattiwar, sseago

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [shubham-pampattiwar,sseago]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment