fix(nemo_guardrails):Revert MCP Gateway integration with NeMo Guardrails

[christinaexyou]

Summary

The MCP Gateway integration created a dependency on Inference Payload Processing's (IPP) NeMo BBR plugins which will soon be replaced. If MCPGateway is defined on the NemoGuardrailsPodTemplate without a custom deployment of the BBR plugin, it will cause theNeMo Guardrails server deployment to fail.

Fix: remove controllers/nemo_guardrails/envoy_filter.go, controllers/nemo_guardrails/mcp_gateway.go, controllers/nemo_guardrails/mcp_gateway_test.go, controllers/nemo_guardrails/templates/envoy-filter.tmpl.yaml and related changes on other files.

This reverts commit 9b9abea. Resolves RHAISTRAT-2379

Summary by CodeRabbit

• Removed Features
  • Removed MCP Gateway configuration and status reporting from NemoGuardrails resources.
  • Removed BBR plugin status reporting.
  • Removed automatic EnvoyFilter and MCP Gateway discovery, management, and cleanup.
  • Removed the EnvoyFilter used to transform streaming responses.
• Access Changes
  • Removed controller permissions for Gateway, MCP Gateway Extension, and EnvoyFilter resources.
• Status Updates
  • NemoGuardrails status now focuses on readiness, completion, and lifecycle phase information.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d988f0a5-c1dd-4a7f-9e27-c6d23ee02d09

📥 Commits

Reviewing files that changed from the base of the PR and between ddc0b8f and 3925f81.

📒 Files selected for processing (11)

• api/nemo_guardrails/v1alpha1/nemoguardrails_types.go
• api/nemo_guardrails/v1alpha1/zz_generated.deepcopy.go
• config/components/nemo-guardrails/crd/trustyai.opendatahub.io_nemoguardrails.yaml
• config/components/nemo-guardrails/rbac/manager-rbac.yaml
• controllers/nemo_guardrails/envoy_filter.go
• controllers/nemo_guardrails/mcp_gateway.go
• controllers/nemo_guardrails/mcp_gateway_test.go
• controllers/nemo_guardrails/nemoguardrail_controller.go
• controllers/nemo_guardrails/status.go
• controllers/nemo_guardrails/templates/envoy-filter.tmpl.yaml
• policy/clusterrole.rego

💤 Files with no reviewable changes (9)

• config/components/nemo-guardrails/rbac/manager-rbac.yaml
• controllers/nemo_guardrails/mcp_gateway_test.go
• controllers/nemo_guardrails/mcp_gateway.go
• controllers/nemo_guardrails/templates/envoy-filter.tmpl.yaml
• controllers/nemo_guardrails/envoy_filter.go
• policy/clusterrole.rego
• controllers/nemo_guardrails/nemoguardrail_controller.go
• config/components/nemo-guardrails/crd/trustyai.opendatahub.io_nemoguardrails.yaml
• api/nemo_guardrails/v1alpha1/zz_generated.deepcopy.go

---

📝 Walkthrough

Walkthrough

The change removes MCP Gateway and BBR plugin API fields, status handling, reconciliation, EnvoyFilter resources, templates, tests, RBAC permissions, and policy allowlist entries from the Nemo Guardrails operator.

Changes

MCP Gateway integration removal

Layer / File(s)	Summary
Remove MCP Gateway API and CRD fields api/nemo_guardrails/v1alpha1/nemoguardrails_types.go, api/nemo_guardrails/v1alpha1/zz_generated.deepcopy.go, config/components/nemo-guardrails/crd/...	The API types, generated deep-copy methods, and CRD schema no longer define MCP Gateway or BBR plugin configuration and status fields.
Remove integration reconciliation and status persistence controllers/nemo_guardrails/nemoguardrail_controller.go, controllers/nemo_guardrails/status.go, controllers/nemo_guardrails/envoy_filter.go, controllers/nemo_guardrails/mcp_gateway.go, controllers/nemo_guardrails/mcp_gateway_test.go, controllers/nemo_guardrails/templates/envoy-filter.tmpl.yaml	The controller no longer discovers gateways or BBR plugins, manages EnvoyFilters, retries integration checks, or persists related status. Related implementation, template, and test files were deleted.
Remove integration permissions config/components/nemo-guardrails/rbac/manager-rbac.yaml, policy/clusterrole.rego	RBAC declarations and the policy allowlist no longer grant access to Gateways, MCPGatewayExtensions, or EnvoyFilters.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• trustyai-explainability/trustyai-service-operator#735: Added the MCP Gateway and EnvoyFilter API, reconciliation, status, RBAC, and template implementations removed by this change.

Suggested reviewers: m-misiura, robgeada

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the primary change: reverting the MCP Gateway integration with NeMo Guardrails.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: m-misiura

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@christinaexyou: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/trustyai-service-operator-e2e	6b150ea	link	true	/test trustyai-service-operator-e2e

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.