fix(lightspeed): fix rag-content folder ownership in init container

[rm3l]

manual cherry-pick of #449

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rhdh-qodo-merge]

Qodo is busy working

Check back in a few minutes. Qodo's code review agents are on it.

[rhdh-qodo-merge]

PR Summary by Qodo

Fix Lightspeed RAG init container ownership/permissions for /rag-content notebooks

🐞 Bug fix ⚙️ Configuration changes 📝 Documentation 🕐 10-20 Minutes

AI Description

• Preserve writable permissions when copying Lightspeed RAG assets into /rag-content on EKS/AKS.
• Pre-create /rag-content/vector_db/notebooks and chmod vector_db/model paths before sidecar starts.
• Bump Helm chart version and align CI/test chart securityContext overrides.

Diagram

graph TD
  A["Helm values (Lightspeed RAG)"] --> B["RAG init container"] --> C[("/rag-content volume")] --> D["llama-stack sidecar"]
  B --> E["Copy RAG assets"] --> C
  B --> F["Create notebooks dir"] --> C
  B --> G["chmod a+rwX"] --> C
  D --> H["Write faiss_store.db"] --> C
  subgraph Legend
    direction LR
    _cfg["Config"] ~~~ _pod["Container"] ~~~ _vol[("Volume")]
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Rely on pod securityContext (runAsUser/runAsGroup/fsGroup) only

• ➕ Avoids chmod/changing permissions broadly
• ➕ Centralizes access control via Kubernetes security context
• ➖ Behavior varies by platform/storage driver; does not reliably fix EKS/AKS volume ownership gaps
• ➖ Doesn't address missing notebooks directory creation

2. Use init container chown to a specific UID/GID (least-privilege)

• ➕ More restrictive than a+rwX/777-style permissions
• ➕ Makes ownership explicit and predictable
• ➖ Requires knowing the runtime UID/GID contract across images and deployments
• ➖ chown can be slow on large volumes and may require elevated privileges/capabilities

Recommendation: Keep the PR’s approach: copying without preserving mode/ownership, explicitly creating the notebooks directory, and chmodding the target paths is a pragmatic cross-platform fix for EKS/AKS where fsGroup defaults don’t match OCP behavior. If tightening permissions becomes a requirement later, consider a targeted chown/chmod to the runtime UID/GID rather than a+rwX, but that likely needs stronger guarantees about the sidecar’s execution identity.

Files changed (5) +8 / -8

Bug fix (2) +5 / -3

values.schema.jsonFix Lightspeed RAG init container args for permissions and notebooks path +1/-1

Fix Lightspeed RAG init container args for permissions and notebooks path

• Updates the init container command to copy RAG assets without preserving mode/ownership, pre-create /rag-content/vector_db/notebooks, and chmod the relevant directories. Prevents PermissionError when the sidecar later writes the FAISS store on EKS/AKS.

charts/backstage/values.schema.json

values.yamlMake RAG bootstrap copy writable and create notebooks directory +4/-2

Make RAG bootstrap copy writable and create notebooks directory

• Adjusts the default init container script to use cp --no-preserve=mode,ownership, create the notebooks subdirectory, and chmod vector_db/embeddings_model for write access. Addresses cross-platform volume ownership differences that cause runtime writes to fail.

charts/backstage/values.yaml

Documentation (1) +2 / -2

README.mdUpdate README version references to 6.1.2 +2/-2

Update README version references to 6.1.2

• Updates the version badge and install command examples to match the new chart version. Keeps documentation consistent with the released chart metadata.

charts/backstage/README.md

Other (2) +1 / -3

action.ymlStop forcing runAsUser/runAsGroup in chart test action +0/-2

Stop forcing runAsUser/runAsGroup in chart test action

• Removes CI Helm overrides for runAsUser and runAsGroup while retaining fsGroup. This aligns test deployments with the expected security context behavior and reduces assumptions about fixed UIDs.

.github/actions/test-charts/action.yml

Chart.yamlBump Backstage chart version to 6.1.2 +1/-1

Bump Backstage chart version to 6.1.2

• Increments the Helm chart version to reflect the included fix. No functional template changes are made in this file beyond versioning.

charts/backstage/Chart.yaml