feat: Add wso2-agentic-engineer module - #219
Conversation
|
Warning Review limit reached
More reviews will be available in 42 minutes and 28 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughAdds the ChangesWSO2 Agentic Engineer Module
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@wso2-agentic-engineer/README.md`:
- Line 239: The README.md documentation at the line mentioning Thunder admin
credentials with default `admin/admin` does not include an explicit warning that
these are only for local/dev environments. Modify the credential documentation
to explicitly scope the default `admin/admin` credentials to local and
development setups only, and add a clear production warning that credentials
must be rotated and changed for any production deployment to meet security
requirements.
In `@wso2-agentic-engineer/values/asdlc-platform.yaml`:
- Around line 35-40: Replace the hardcoded default values for the Thunder client
secrets in the configuration file. Specifically, change the `adminClientSecret`
and `systemClientSecret` fields under the Thunder configuration section from
their current hardcoded values ("openchoreo-system-app-secret" and
"asdlc-system-client-secret") to placeholder values that clearly indicate
operators must provide their own values, such as "<CHANGE_ME>" or similar
convention that makes the required action obvious for production deployments.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 8e7d9b1f-0092-4c5d-ae7b-e7e3d7bd7960
📒 Files selected for processing (3)
wso2-agentic-engineer/README.mdwso2-agentic-engineer/module.yamlwso2-agentic-engineer/values/asdlc-platform.yaml
senithkay
changed the title
senithkay
changed the title
…nt secret Signed-off-by: Senith Uthsara <senithkarunarathneu@gmail.com>
LakshanSS
left a comment
LakshanSS
left a comment
There was a problem hiding this comment.
Thanks for the contribution, @senithkay and welcome, great first PR!
DCO Remediation Commit for Senith Uthsara <senithkarunarathneu@gmail.com> I, Senith Uthsara <senithkarunarathneu@gmail.com>, hereby add my Signed-off-by to this commit: b8a43d9 Signed-off-by: Senith Uthsara <senithkarunarathneu@gmail.com>
5985b0b to
01bce6e
Compare
|
Updated the PR to reflect new task signing key auto generation when non provided |
|
Hi @senithkay, thanks for the contribution! Since this is a new module addition, could you open a discussion at https://github.com/openchoreo/openchoreo/discussions so others can weigh in as well? A few things I noted in the PR in the meantime:
Feel free to reach out with any questions! |
Signed-off-by: Senith Uthsara <senithkarunarathneu@gmail.com>
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
wso2-agentic-engineer/values/asdlc-platform.yaml (2)
106-111: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winAvoid hard-coding the default Thunder admin endpoint twice.
Lines 109-111 ignore the configurable
thunder.adminURLabove and pin the sub-chart tothunder-service.thunder.svc.cluster.local:8090. Any install that moves Thunder or renames the Service will update one section and still fail here.Suggested patch
idp: issuer: "<THUNDER_PUBLIC_URL>" jwksURL: "<THUNDER_PUBLIC_URL>/oauth2/jwks" - jwksInternalURL: "http://thunder-service.thunder.svc.cluster.local:8090/oauth2/jwks" - tokenURL: "http://thunder-service.thunder.svc.cluster.local:8090/oauth2/token" - adminURL: "http://thunder-service.thunder.svc.cluster.local:8090" + jwksInternalURL: "<THUNDER_ADMIN_URL>/oauth2/jwks" + tokenURL: "<THUNDER_ADMIN_URL>/oauth2/token" + adminURL: "<THUNDER_ADMIN_URL>"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@wso2-agentic-engineer/values/asdlc-platform.yaml` around lines 106 - 111, The idp URLs are hard-coded to the Thunder Service DNS instead of using the configurable Thunder admin endpoint. Update the idp block to derive jwksInternalURL, tokenURL, and adminURL from the existing thunder.adminURL value (or a single shared base value) so the sub-chart stays consistent when Thunder is moved or renamed. Use the idp keys and the thunder.adminURL setting to locate and refactor the duplicated endpoint references.
79-84: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy liftPostgreSQL credentials still leak through Helm values.
Lines 79-84 keep the DB password in
postgres.auth.password, and the examplepostgres.urlembedsuser:pass@.... Both paths end up inhelm get values/ release history, so this template still bypasses the secret-store model documented below. Please switch the chart contract to consume a Secret/ExternalSecret reference instead of raw DB credentials.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@wso2-agentic-engineer/values/asdlc-platform.yaml` around lines 79 - 84, The postgres values contract still exposes credentials via postgres.auth.password and the example postgres.url, so update the chart to stop accepting raw DB secrets in values and instead reference an existing Secret or ExternalSecret for connection details. Adjust the Helm template and any consumers to read the PostgreSQL password/URL from that secret-backed reference, and remove the inline credential fields from the asdlc-platform values schema while keeping identifiers like postgres, postgres.auth, and postgres.url aligned with the new secret-based flow.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@wso2-agentic-engineer/README.md`:
- Around line 232-239: The `postgres.auth.password` value is currently
documented as a plain Helm release value, unlike the
`wso2-ae-platform.secrets.*` entries, so it bypasses the
PushSecret/OpenBao/ExternalSecret flow. Update the README and associated secret
configuration to move this password into the same secret-store pattern as the
other credentials, using the `postgres.auth.password` setting only via a
Kubernetes Secret or external secret reference so it is not exposed through
`helm get values`.
- Around line 51-52: Update the README secret-management docs to stop presenting
OpenBao as the mandatory backend and instead describe ESO as the required
prerequisite with a compatible `ClusterSecretStore` backend for production. In
the prerequisites and secret-management sections, rephrase the guidance around
the `ClusterSecretStore` flow generically using the existing ESO-related
wording, then move the OpenBao-specific setup and examples into a collapsible
“Example: OpenBao” subsection. Keep the references centered on the README’s
prerequisites/secret-management text so the wording clearly distinguishes
dev/k3d OpenBao usage from production backends supported by ESO.
- Around line 103-106: The README’s Secret Management guidance conflicts with
the install instructions because it says secrets never appear in Helm values
while the table still tells users to place sensitive fields like
githubClientSecret and postgres.auth.password in values.yaml. Reconcile the
documentation by updating the installation flow to keep all sensitive values out
of values.yaml and reference only pre-seeded OpenBao/ESO-managed secrets, or
explicitly distinguish which entries in the install table are non-sensitive
placeholders versus secrets that must be created out of band; make sure the
Secret Management section and the installation table tell the same story.
In `@wso2-agentic-engineer/values/asdlc-platform.yaml`:
- Around line 87-95: The production seeding guidance conflicts with the
ServiceAccount-based OpenBao auth model by instructing operators to use a static
BAO_TOKEN and kubectl exec into openbao-0. Update the seeding instructions in
the OpenBao guidance section so they use the same Kubernetes ServiceAccount /
ClusterSecretStore flow described by openbao.auth, authRole, serviceAccountName,
and serviceAccountNamespace, and remove any token-based OpenBao-specific steps
from the operator path.
---
Outside diff comments:
In `@wso2-agentic-engineer/values/asdlc-platform.yaml`:
- Around line 106-111: The idp URLs are hard-coded to the Thunder Service DNS
instead of using the configurable Thunder admin endpoint. Update the idp block
to derive jwksInternalURL, tokenURL, and adminURL from the existing
thunder.adminURL value (or a single shared base value) so the sub-chart stays
consistent when Thunder is moved or renamed. Use the idp keys and the
thunder.adminURL setting to locate and refactor the duplicated endpoint
references.
- Around line 79-84: The postgres values contract still exposes credentials via
postgres.auth.password and the example postgres.url, so update the chart to stop
accepting raw DB secrets in values and instead reference an existing Secret or
ExternalSecret for connection details. Adjust the Helm template and any
consumers to read the PostgreSQL password/URL from that secret-backed reference,
and remove the inline credential fields from the asdlc-platform values schema
while keeping identifiers like postgres, postgres.auth, and postgres.url aligned
with the new secret-based flow.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 8a5927a4-5313-414a-beec-c077a78bc430
📒 Files selected for processing (2)
wso2-agentic-engineer/README.mdwso2-agentic-engineer/values/asdlc-platform.yaml
| # Address of the OpenBao instance in your cluster. | ||
| # Auth is handled via Kubernetes ServiceAccount (no static token needed). | ||
| # Override openbao.authRole / serviceAccountName / serviceAccountNamespace only | ||
| # if your OpenBao uses a non-default role or service account. | ||
| openbao: | ||
| addr: "http://openbao.openbao.svc.cluster.local:8200" | ||
| # authRole: "openchoreo-secret-writer-role" # default | ||
| # serviceAccountName: "external-secrets-openbao" # default | ||
| # serviceAccountNamespace: "openbao" # default |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Production seeding guidance reintroduces static OpenBao tokens.
Lines 87-95 say OpenBao auth is handled via Kubernetes ServiceAccount, but Lines 146-150 tell operators to kubectl exec into openbao-0 with BAO_TOKEN=<token>. That contradicts the declared auth model and keeps the production path OpenBao-specific instead of ClusterSecretStore-agnostic.
Also applies to: 146-150
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@wso2-agentic-engineer/values/asdlc-platform.yaml` around lines 87 - 95, The
production seeding guidance conflicts with the ServiceAccount-based OpenBao auth
model by instructing operators to use a static BAO_TOKEN and kubectl exec into
openbao-0. Update the seeding instructions in the OpenBao guidance section so
they use the same Kubernetes ServiceAccount / ClusterSecretStore flow described
by openbao.auth, authRole, serviceAccountName, and serviceAccountNamespace, and
remove any token-based OpenBao-specific steps from the operator path.
There was a problem hiding this comment.
Thunder dependency and OpenBao dependency — We acknowledge both concerns and agree they should be decoupled. For now we are keeping Thunder and OpenBao as explicit prerequisites while we work through the right abstraction
There was a problem hiding this comment.
@senithkay, thanks for the clarification — keeping Thunder and OpenBao as explicit prerequisites in this PR is a reasonable scoping decision while the abstraction is still being worked out.
My remaining concern is narrower than the dependency itself: the docs/comments should be internally consistent. If the current operator flow still requires manual OpenBao seeding with BAO_TOKEN, then the note around Line 87-Line 95 probably shouldn’t say “no static token needed,” since that reads as if the token-based path is not part of the supported setup.
So I’m good with deferring the decoupling, but I’d still recommend aligning the wording so operators don’t get mixed signals. If you want, I can also help turn the Thunder/OpenBao decoupling into a follow-up issue for after #219.
(•ᴗ•)っ🥕
🧠 Learnings used
Learnt from: ruks
Repo: openchoreo/community-modules PR: 22
File: observability-logs-moesif/helm/values.yaml:118-124
Timestamp: 2026-03-12T13:54:17.645Z
Learning: In observability-logs-moesif/helm/values.yaml, the Fluent Bit initContainer set-volume-ownership runs chown -R 10000:10000 /var/lib/fluent-bit/db on a hostPath volume. The previous use of privileged: true was due to capabilites.drop: [ALL] removing CAP_CHOWN. Replace the full privileges with a least-privilege config: keep capabilities.drop: [ALL] but add back only CAP_CHOWN via capabilities.add: ["CHOWN"]. This avoids granting full node privileges while still allowing the required chown operation. Apply this change specifically in the initContainer spec that performs volume ownership, ensuring the container remains non-privileged except for the explicitly required CHOWN capability.
Signed-off-by: Senith Uthsara <senithkarunarathneu@gmail.com>
Signed-off-by: Senith Uthsara <senithkarunarathneu@gmail.com>
3 participants
Purpose
Adds the WSO2 Agentic Engineer as a new OpenChoreo community module. WSO2 Agentic Engineer is a spec-driven, AI-enhanced software development lifecycle platform that installs on an existing OpenChoreo cluster,
wiring into the control plane, data plane, and workflow plane.
Approach
Added
wso2-agentic-engineer/module directory containing:README.md— full installation guide with quick-start for local k3d and production install stepsvalues/asdlc-platform.yaml— pre-configured values template with<PLACEHOLDER>format for production deploymentsThe module installs via a single Helm chart (
oci://ghcr.io/wso2/wso2-agentic-engineer-bundle) published to GHCR. It reuses OpenChoreo's existing Thunder instance for identity, registers OAuth clients via apost-install bootstrap job.
Related Issues
N/A
Checklist
values/asdlc-platform.yamlserves as the install sampleRemarks
values/asdlc-platform.yamlSummary by CodeRabbit
Release Notes
Documentation
Chores