Fix: Avoid Helm Conflict When User Creates Custom .npmrc Secret

[Fortune-Ndlovu]

Description of the change

This PR updated to always render the .npmrc Secret when orchestrator.enabled=true, allowing users to inject custom config via .Values.global.dynamic.npmrc.userConfig. We append the RH registry entry automatically to ensure orchestrator plugins can be loaded

Previously, if a Secret named <release_name>-dynamic-plugins-npmrc existed in the namespace (as documented), Helm would fail due to ownership conflicts. This fix uses the lookup function to detect if the Secret already exists and conditionally skips rendering it, allowing the deployment to proceed without errors while still supporting user-provided configuration.

Which issue(s) does this PR fix or relate to

https://issues.redhat.com/browse/RHDHBUGS-1464

How to test changes / Special notes to the reviewer

I have tested the bug and my solution in the comments, see https://issues.redhat.com/browse/RHDHBUGS-1464

Checklist

• For each Chart updated, version bumped in the corresponding Chart.yaml according to Semantic Versioning.
• For each Chart updated, variables are documented in the values.yaml and added to the corresponding README.md. The pre-commit utility can be used to generate the necessary content. Use pre-commit run -a to apply changes. The pre-commit Workflow will do this automatically for you if needed.
• JSON Schema template updated and re-generated the raw schema via the pre-commit hook.
• Tests pass using the Chart Testing tool and the ct lint command.
• If you updated the orchestrator-infra chart, make sure the versions of the Knative CRDs are aligned with the versions of the CRDs installed by the OpenShift Serverless operators declared in the values.yaml file. See Installing Knative Eventing and Knative Serving CRDs for more details.

Summary by Sourcery

Conditionally skip rendering the dynamic-plugins-npmrc Secret if it already exists to prevent Helm install failures due to ownership conflicts.

Bug Fixes:

• Skip creating the <release_name>-dynamic-plugins-npmrc Secret when one is already present to avoid installation errors.

Enhancements:

• Use the lookup Helm function to detect existing Secrets before rendering.
• Add Helm-managed labels and annotations to the dynamic-plugins-npmrc Secret template.

Summary by Sourcery

Prevent Helm ownership conflicts by using the lookup function to skip creating the dynamic-plugins-npmrc Secret when one exists, and bump chart version to 4.5.0.

Bug Fixes:

• Skip creating the dynamic-plugins-npmrc Secret when one already exists to avoid Helm install failures due to ownership conflicts.

Enhancements:

• Use the Helm lookup function to detect existing .npmrc Secrets before rendering.
• Add Helm-managed labels and annotations to the dynamic-plugins-npmrc Secret template.

Documentation:

• Update README badge to reflect chart version bump to 4.5.0.

Chores:

• Bump RHDH Backstage Helm chart version from 4.4.0 to 4.5.0.

Summary by Sourcery

Use Helm lookup to conditionally render the dynamic-plugins-npmrc Secret and avoid ownership conflicts with user-provided .npmrc secrets; update orchestrator plugin package references to fully qualified npm registry URLs; bump the Backstage chart to version 4.4.1.

Bug Fixes:

• Skip creating the dynamic-plugins-npmrc Secret when one already exists to prevent Helm installation failures due to ownership conflicts.

Enhancements:

• Switch orchestrator plugin package references from scope-based paths to explicit npm registry URLs.

Build:

• Bump Backstage Helm chart version to 4.4.1.

Documentation:

• Update README badge to reflect chart version 4.4.1.

[sourcery-ai]

Reviewer's Guide

This PR resolves Helm ownership conflicts by removing the unconditional .npmrc Secret template (relying on lookup for existing Secrets), updates all plugin package references to full Red Hat registry URLs (dropping scope prefixes), and bumps the chart version with corresponding README badge updates.

Class diagram for Helm Secret rendering logic update

classDiagram
    class HelmChart {
        +values
        +templates
        +render()
    }
    class SecretTemplate {
        +name
        +namespace
        +stringData
        +render()
    }
    class LookupFunction {
        +lookup(resourceType, name, namespace)
    }
    HelmChart --> SecretTemplate : uses
    HelmChart --> LookupFunction : uses
    SecretTemplate <.. LookupFunction : conditional rendering

Loading

Flow diagram for conditional .npmrc Secret creation in Helm

flowchart TD
    A[Start Helm install/upgrade] --> B{Is orchestrator.enabled?}
    B -- No --> Z[Skip .npmrc Secret]
    B -- Yes --> C{Does Secret <release>-dynamic-plugins-npmrc exist?}
    C -- Yes --> D[Skip rendering Secret]
    C -- No --> E[Render .npmrc Secret with RH registry entry]
    D --> F[Continue deployment]
    E --> F
    Z --> F
    F[Deployment proceeds without Helm ownership conflict]

Loading

File-Level Changes

Change	Details	Files
Remove static .npmrc Secret rendering to avoid Helm ownership conflicts	Deleted the unconditional Secret YAML block for <release_name>-dynamic-plugins-npmrc Rely on Helm's lookup function (implicitly) for conditional Secret creation	charts/backstage/templates/dynamic-plugins-configmap.yaml
Standardize plugin package references to full Red Hat registry URLs	Removed @redhat scope prefix from package fields Replaced shorthand package names with https://npm.registry.redhat.com/...tgz URLs Kept existing integrity hashes unchanged	charts/backstage/templates/_partials.tpl
Bump chart version and update README badge	Updated version from 4.4.0 to 4.4.1 in Chart.yaml Refreshed the version badge in README.md to 4.4.1	charts/backstage/Chart.yaml charts/backstage/README.md

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey @Fortune-Ndlovu - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[Fortune-Ndlovu]

@sourcery-ai review

[sourcery-ai]

Hey @Fortune-Ndlovu - I've reviewed your changes - here's some feedback:

• Add a minHelmVersion: ">=3.1.0" entry to Chart.yaml since the lookup function is only available in Helm v3.1+.
• Consider introducing a values.yaml flag (e.g. dynamicPlugins.createNpmrcSecret) to allow users to explicitly enable or disable secret creation instead of relying solely on lookup.
• Include a brief inline comment in the dynamic-plugins-configmap.yaml template explaining why the lookup call is used to skip secret creation when a custom secret already exists.

Prompt for AI Agents

Please address the comments from this code review:
## Overall Comments
- Add a `minHelmVersion: ">=3.1.0"` entry to Chart.yaml since the lookup function is only available in Helm v3.1+.
- Consider introducing a `values.yaml` flag (e.g. `dynamicPlugins.createNpmrcSecret`) to allow users to explicitly enable or disable secret creation instead of relying solely on lookup.
- Include a brief inline comment in the `dynamic-plugins-configmap.yaml` template explaining why the `lookup` call is used to skip secret creation when a custom secret already exists.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[rm3l]

/cherry-pick release-1.7

[openshift-cherrypick-robot]

@rm3l: once the present PR merges, I will cherry-pick it on top of release-1.7 in a new PR and assign it to you.

Details

In response to this:

/cherry-pick release-1.7

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Fortune-Ndlovu]

@sourcery-ai review

[sourcery-ai]

Hey @Fortune-Ndlovu - I've reviewed your changes - here's some feedback:

• I don’t see the lookup-based conditional for the npmrc Secret in your templates—ensure you’ve added the Helm lookup logic to detect and skip existing Secrets rather than simply removing the block.
• Consider making the Red Hat NPM registry base URL a configurable value in values.yaml instead of hardcoding full URLs in each package declaration so you can support alternate registries more easily.
• Your PR summary mentions bumping the chart version to 4.5.0 but Chart.yaml is updated to 4.4.1—please align the version number for consistency.

Prompt for AI Agents

Please address the comments from this code review:
## Overall Comments
- I don’t see the lookup-based conditional for the npmrc Secret in your templates—ensure you’ve added the Helm `lookup` logic to detect and skip existing Secrets rather than simply removing the block.
- Consider making the Red Hat NPM registry base URL a configurable value in values.yaml instead of hardcoding full URLs in each package declaration so you can support alternate registries more easily.
- Your PR summary mentions bumping the chart version to 4.5.0 but Chart.yaml is updated to 4.4.1—please align the version number for consistency.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[rm3l]

/lgtm

[openshift-cherrypick-robot]

@rm3l: new pull request created: #190

Details

In response to this:

/cherry-pick release-1.7

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.