OLS-3858: Scope analysis identity to its run namespace

[waveywaves]

Summary

• Create a UID-qualified runtime identity for each AgenticRun analysis phase.
• Bind read access only in the AgenticRun namespace, with supplemental pods/log permission.
• Prevent targetNamespaces from widening analysis access and grant no Secret or Result write permission.
• Retain the identity while analysis is active, then revoke it before later phases with retryable terminal and finalizer cleanup.
• Document the scoped identity model and regenerate operator RBAC.

Test plan

• make manifests
• make test
• make vet
• make api-lint
• make build

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign joaofula for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• New Features
  • Added isolated, per-run identities for analysis operations.
  • Analysis now uses namespace-scoped, read-only access, including pod logs.
  • Tokens are not automatically mounted for analysis identities.
• Security
  • Improved separation between analysis, execution, verification, and escalation access.
  • Added automatic cleanup of temporary analysis permissions after completion.
• Bug Fixes
  • Cleanup failures now trigger retries to help prevent leftover access permissions.
• Documentation
  • Updated RBAC documentation to describe the revised access model.

Walkthrough

The operator now creates a scoped analysis ServiceAccount for each AgenticRun, uses it for analysis, and removes its RBAC resources after analysis or terminal run events. Specifications and RBAC documentation describe the separate identities.

Changes

Per-run analysis identity

Layer / File(s)	Summary
Identity provisioning and RBAC controller/agenticrun/analysis_identity.go, controller/agenticrun/analysis_identity_test.go, controller/agenticrun/reconciler.go	The controller creates deterministic ServiceAccounts with disabled token automounting, namespace-scoped view access, and pods/log access. Creation is idempotent. Cleanup ignores missing resources and wraps other errors.
Analysis integration and cleanup controller/agenticrun/handlers.go, controller/agenticrun/reconciler.go, controller/agenticrun/reconciler_test.go, controller/agenticrun/analysis_identity_test.go	Analysis and revision handling ensure the identity before calling Agent.Analyze. The generated ServiceAccount is passed to the agent. Cleanup failures trigger logging and retry behavior.
Sandbox identity documentation .ai/spec/what/sandbox-execution.md, docs/rbac.md	The specification and RBAC documentation define separate per-run analysis and execution identities, shared verification and escalation access, namespace limits, token mounting, and cleanup requirements.

Sequence Diagram(s)

sequenceDiagram
  participant AgenticRun
  participant ensureAnalysisIdentity
  participant Agent
  participant cleanupAnalysisIdentity
  participant KubernetesAPI
  AgenticRun->>ensureAnalysisIdentity: ensure analysis identity
  ensureAnalysisIdentity-->>AgenticRun: return ServiceAccount name
  AgenticRun->>Agent: Analyze with scoped ServiceAccount
  Agent-->>AgenticRun: return analysis result
  AgenticRun->>cleanupAnalysisIdentity: clean up after analysis or terminal event
  cleanupAnalysisIdentity->>KubernetesAPI: delete analysis RBAC and ServiceAccount
  KubernetesAPI-->>cleanupAnalysisIdentity: return deletion result

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 12.50% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the main change: scoping the analysis identity to the AgenticRun namespace.
Description check	✅ Passed	The description directly explains the scoped analysis identity, access restrictions, cleanup behavior, documentation, and validation steps.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

Hi @waveywaves. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.ai/spec/what/sandbox-execution.md:
- Around line 100-102: Choose one execution identity contract and apply it
consistently: either make execution ServiceAccount usage conditional on
requested RBAC rules, or update the controller to always provision and use
executionSAName(run), including when no RBAC rules are present. Update the
execution identity requirements in .ai/spec/what/sandbox-execution.md lines
100-102 and the isolation summary and Execution row in docs/rbac.md lines
130-138 to describe the same behavior; both documentation sites require changes.
- Line 55: Reconcile the analysis Result RBAC requirements across Rule 8a, Rule
36a, and the constraint near the Result permission statement: exclude analysis
from the shared lightspeed-agent Result-writer requirement, and ensure the
per-run analysis identity remains unable to write Results. If analysis must
publish a Result, define the separately enforced expected-result-name writer
path required by Rule 20a rather than granting namespace-wide Result
permissions.

In `@docs/rbac.md`:
- Around line 109-112: Update the “Dynamic analysis identity (per-AgenticRun)”
documentation to state that the identity is also deleted when analysis is
suspended, and that cleanup failures trigger reconciliation retry/requeue.
Preserve the existing post-analysis and terminal/finalizer cleanup details.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 11d93f3c-59ba-4c7c-8ca6-25ee9430d62a

📥 Commits

Reviewing files that changed from the base of the PR and between 547d20d and 58daa44.

⛔ Files ignored due to path filters (1)

• config/rbac/role.yaml is excluded by !config/rbac/role.yaml

📒 Files selected for processing (7)

• .ai/spec/what/sandbox-execution.md
• controller/agenticrun/analysis_identity.go
• controller/agenticrun/analysis_identity_test.go
• controller/agenticrun/handlers.go
• controller/agenticrun/reconciler.go
• controller/agenticrun/reconciler_test.go
• docs/rbac.md

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift/lightspeed-agentic-sandbox (manual)

[openshift-ci-robot]

@waveywaves: This pull request references OLS-3858 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Create a UID-qualified runtime identity for each AgenticRun analysis phase.
• Bind read access only in the AgenticRun namespace, with supplemental pods/log permission.
• Prevent targetNamespaces from widening analysis access and grant no Secret or Result write permission.
• Retain the identity while analysis is active, then revoke it before later phases with retryable terminal and finalizer cleanup.
• Document the scoped identity model and regenerate operator RBAC.

Test plan

• make manifests
• make test
• make vet
• make api-lint
• make build

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.