Pulse Operator // AI SRE for OpenShift

// WHAT THE OPERATOR MANAGES

One CR. Seven reconcilers. Zero manual wiring.

Agent ALWAYS ON

ClusterRole with configurable RBAC scope, WS token Secret (32-char hex, never rotated), 1Gi memory PVC (gated — Deployment only starts after PVC is Bound), Deployment + Service.

PostgreSQL DATA SAFE

UBI 9 postgresql-15 StatefulSet with RHSCL env vars. pg-data PVC is retained on CR delete — data survives operator upgrades. Headless + ClusterIP Services. pg-auth Secret generated once.

UI + OAuth Proxy AUTO-DETECT

nginx Deployment serving the React SPA. oauth-proxy sidecar with TLS on :8443. Route hostname auto-detected from cluster ingress config. OAuthClient redirect URI patched after Route is admitted.

Monitoring OPTIONAL

ServiceMonitor targeting agent /metrics. PrometheusRule with PulseAgentDown, PulsePostgreSQLDown, and PulseUIDown alert rules. Toggle with monitoring.enabled: true.

MCP Server OPTIONAL

Model Context Protocol server for extending the agent with custom tools. Deployed as a separate Deployment + Service. Toggle with agent.mcp.enabled: true.

Network Policies ALWAYS ON

UI ingress restricted to OCP router + Prometheus only. PostgreSQL ingress restricted to agent pods only. Zero trust by default — NetworkPolicy created for every CR.

Cluster Auto-Detection

On first reconcile: reads ingress domain from ingresses.config.openshift.io/cluster, oauth-proxy image digest from ImageStream, ACM availability from namespace existence. Cached with sync.Once — zero API calls after warmup.

Finalizer SAFE DELETE

pulse.ai/cleanup finalizer removes all cluster-scoped resources (ClusterRole, ClusterRoleBinding, OAuthClient) when the CR is deleted. No orphans, ever.

// QUICK START — OLM

Install via OLM so the operator appears in Installed Operators and gets auto-upgrades.

# 1. Add the CatalogSource
oc apply -f - <<EOF
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: pulse-operator-catalog
  namespace: openshift-marketplace
spec:
  sourceType: grpc
  image: quay.io/amobrem/pulse-operator-catalog:latest
  displayName: Pulse Operator
EOF

# 2. Create namespace + AI backend secret
oc new-project openshiftpulse
oc create secret generic gcp-sa-key --from-file=key.json=./sa-key.json -n openshiftpulse

# 3. Subscribe
oc apply -f - <<EOF
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: pulse-operator
  namespace: openshiftpulse
spec:
  channel: alpha
  name: pulse-operator
  source: pulse-operator-catalog
  sourceNamespace: openshift-marketplace
EOF

# 4. Deploy your Pulse instance
oc apply -f - <<EOF
apiVersion: pulse.ai/v1alpha1
kind: OpenShiftPulse
metadata:
  name: pulse
  namespace: openshiftpulse
spec:
  vertexAI:
    projectId: my-gcp-project
    region: us-east5
    credentialSecret: gcp-sa-key
  agent:
    image: quay.io/amobrem/pulse-agent:latest
    trustLevel: 2
    mcp:
      enabled: true
  monitoring:
    enabled: true
EOF

# 5. Get your Pulse URL
oc get route -n openshiftpulse -o jsonpath='{.items[0].spec.host}'
    

// TRUST LEVELS

Progressive autonomy. You decide how much the agent can act without asking.

0

Observe

Read-only. Answers questions, no actions.

1

Suggest

Proposes actions, user approves each one.

2

Confirm

Default. One confirmation per action.

3

Auto-Safe

Low-risk auto-fix. One batch confirm.

4

Autonomous

Full auto. No confirmation required.

// ARCHITECTURE

Operator layout. Every managed resource is CR-scoped — multiple CRs coexist on the same cluster.

pulse-operator-system/pulse-operator-manager (1 replica, leader-elected) └── OpenShiftPulseReconciler ├── pulse.ai/cleanup finalizer ← removes cluster-scoped resources on CR delete │ ├── AgentReconciler │ ├── {ns}/{name}-openshift-sre-agent (ServiceAccount + ClusterRole + ClusterRoleBinding) │ ├── {ns}/{name}-ws-token (Secret — random 32-char hex) │ ├── {ns}/{name}-openshift-sre-agent-memory (PVC 1Gi RWO — gates Deployment) │ └── {ns}/{name}-openshift-sre-agent (Deployment + Service :8080) │ ├── PostgreSQLReconciler │ ├── {ns}/{name}-pg-auth (Secret — POSTGRESQL_* RHSCL vars) │ ├── {ns}/{name}-openshift-sre-agent-postgresql (StatefulSet + pg-data PVC) │ └── {ns}/{name}-openshift-sre-agent-postgresql[-headless] (Services) │ ├── UIReconciler │ ├── {ns}/{name}-openshiftpulse (ServiceAccount + ClusterRole) │ ├── {ns}/{name}-oauth-secrets (Secret — client-secret + cookie-secret) │ ├── {ns}/{name}-nginx (ConfigMap — nginx.conf, root /opt/app-root/src) │ ├── {ns}/{name}-openshiftpulse (Deployment: nginx + oauth-proxy TLS :8443) │ ├── {ns}/{name}-openshiftpulse (Route — reencrypt, OCP assigns hostname) │ └── openshiftpulse-{ns}-{name} (OAuthClient — cluster-scoped) │ ├── MonitoringReconciler [spec.monitoring.enabled] │ ├── {ns}/{name}-openshift-sre-agent (ServiceMonitor → /metrics) │ └── {ns}/{name}-openshiftpulse (PrometheusRule — 3 alert rules) │ ├── MCPReconciler [spec.agent.mcp.enabled] │ └── {ns}/{name}-mcp-server (Deployment + Service :8001) │ └── NetworkPolicyReconciler ├── {ns}/{name}-openshiftpulse (UI: ingress router + Prometheus only) └── {ns}/{name}-pg-access (PG: ingress from agent pods only)