OSAC-3438: enable metering in CaaS CI values

[omer-vishlitzky]

Summary

• Enable Kafka, metering-service, and echo-adapter in values/caas-ci/values.yaml
• Matches the existing values/vmaas-ci/values.yaml metering config
• Required for CaaS metering E2E tests (osac-test-infra#349)

Test plan

• CaaS CI deployment will install AMQ Streams operator, Kafka cluster, metering-service, and echo-adapter
• CaaS E2E metering tests pass (depends on osac-test-infra#349)

Assisted-by: Claude Code noreply@anthropic.com

Summary by CodeRabbit

• New Features
  • Enabled Kafka integration.
  • Added metering configuration with an echo adapter.
  • Added secure PostgreSQL connections using client certificates.

[openshift-ci-robot]

@omer-vishlitzky: This pull request references OSAC-3438 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Enable Kafka, metering-service, and echo-adapter in values/caas-ci/values.yaml
• Matches the existing values/vmaas-ci/values.yaml metering config
• Required for CaaS metering E2E tests (osac-test-infra#349)

Test plan

• CaaS CI deployment will install AMQ Streams operator, Kafka cluster, metering-service, and echo-adapter
• CaaS E2E metering tests pass (depends on osac-test-infra#349)

Assisted-by: Claude Code noreply@anthropic.com

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: omer-vishlitzky

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• osac-installer/OWNERS [omer-vishlitzky]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Walkthrough

The CaaS CI deployment values now enable Kafka and metering. Metering uses an always-pulled echo adapter image and PostgreSQL connection details from URL and TLS secrets.

Changes

CaaS CI infrastructure

Layer / File(s)	Summary
Kafka and metering deployment values osac-installer/values/caas-ci/values.yaml	Kafka and metering are enabled. The echo adapter uses an always-pulled image. Database connections use a URL and PostgreSQL client-certificate secrets.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• osac-project/osac#82: Enables and configures Kafka and metering values.
• osac-project/osac#236: Configures CaaS CI with Kafka, metering, and the echo adapter.

Suggested reviewers: eliorerz

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
No-Sensitive-Data-In-Logs	❌ Error	The PR enables metering in CaaS; its INFO logs emit the fulfillment address and Kafka brokers, including internal .svc.cluster.local hostnames.	Redact or omit address and broker fields from INFO logs. Log only connection status or safe identifiers.

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: enabling metering in the CaaS CI values.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	The diff adds enablement, image metadata, and references to Kubernetes Secrets only; it contains no literal API key, token, password, private key, embedded credentials, or long encoded secret.
No-Weak-Crypto	✅ Passed	The diff only enables Kafka/metering and references PostgreSQL TLS certificate files; it adds no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons.
No-Injection-Vectors	✅ Passed	The commit adds only static YAML values; the introduced block has no SQL concatenation, shell/eval/exec, pickle, unsafe YAML loading, os.system, or HTML injection.
Container-Privileges	✅ Passed	The patch adds only Kafka and metering values. Metering workloads set runAsNonRoot and allowPrivilegeEscalation=false; no privileged, host namespace, SYS_ADMIN, or root settings were introduced.
Ai-Attribution	✅ Passed	The PR and its introduced commit identify Claude Code use; the commit has an Assisted-by: Claude Code trailer and no AI Co-Authored-By trailer.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:50 PM UTC · Completed 8:03 PM UTC

Commit: 3fbacab · View workflow run →

[coderabbitai]

🧹 Nitpick comments (1)

osac-installer/values/caas-ci/values.yaml (1)

164-165: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Pin the echo-adapter image for reproducible CI.

tag: latest with pullPolicy: Always allows identical values to use different image bytes on different runs. This can make metering E2E results non-reproducible. Use an immutable digest or a unique build tag that cannot be retargeted.

Suggested value change

-      tag: latest
+      tag: "<immutable-build-tag>"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@osac-installer/values/caas-ci/values.yaml` around lines 164 - 165, Update the
echo-adapter image configuration near tag and pullPolicy to replace the mutable
latest tag with an immutable image digest or non-retargetable unique build tag,
ensuring CI runs always use identical image bytes.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@osac-installer/values/caas-ci/values.yaml`:
- Around line 164-165: Update the echo-adapter image configuration near tag and
pullPolicy to replace the mutable latest tag with an immutable image digest or
non-retargetable unique build tag, ensuring CI runs always use identical image
bytes.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 09d303c5-503a-4bd5-8b03-d1e1cfd3f4d8

📥 Commits

Reviewing files that changed from the base of the PR and between 13e8452 and 3fbacab.

📒 Files selected for processing (1)

• osac-installer/values/caas-ci/values.yaml

[fullsend-ai-review]

Review skipped — this PR is already merged.

The /fs-review command only reviews open pull requests.

_{Posted by fullsend post-review check}