Enable plugin dependencies

Makefile

@@ -161,12 +161,14 @@ fmt: goimports ## Format the code using goimports
 
 .PHONY: test
 test: manifests generate fmt vet envtest $(LOCALBIN) ## Run tests. We need LOCALBIN=$(LOCALBIN) to get correct default-config path
-	mkdir -p $(LOCALBIN)/default-config && rm -fr $(LOCALBIN)/default-config/* && cp config/profile/$(PROFILE)/default-config/* $(LOCALBIN)/default-config
+	mkdir -p $(LOCALBIN)/default-config && rm -fr $(LOCALBIN)/default-config/* && cp -r config/profile/$(PROFILE)/default-config/* $(LOCALBIN)/default-config
+	mkdir -p $(LOCALBIN)/plugin-deps && rm -fr $(LOCALBIN)/plugin-deps/* && cp -r config/profile/$(PROFILE)/plugin-deps/* $(LOCALBIN)/plugin-deps 2>/dev/null || :
 	LOCALBIN=$(LOCALBIN) KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" go test $(PKGS) -coverprofile cover.out
 
 .PHONY: integration-test
 integration-test: ginkgo manifests generate fmt vet envtest $(LOCALBIN) ## Run integration_tests. We need LOCALBIN=$(LOCALBIN) to get correct default-config path
-	mkdir -p $(LOCALBIN)/default-config && rm -fr $(LOCALBIN)/default-config/* && cp config/profile/$(PROFILE)/default-config/* $(LOCALBIN)/default-config
+	mkdir -p $(LOCALBIN)/default-config && rm -fr $(LOCALBIN)/default-config/* && cp -r config/profile/$(PROFILE)/default-config/* $(LOCALBIN)/default-config
+	mkdir -p $(LOCALBIN)/plugin-deps && rm -fr $(LOCALBIN)/plugin-deps/* && cp -r config/profile/$(PROFILE)/plugin-deps/* $(LOCALBIN)/plugin-deps 2>/dev/null || :
 	LOCALBIN=$(LOCALBIN) KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" $(GINKGO) -v -r $(ARGS) integration_tests
 
 # After this time, Ginkgo will emit progress reports, so we can get visibility into long-running tests.
@@ -218,9 +220,8 @@ build: manifests generate fmt vet ## Build manager binary.
 
 .PHONY: run
 run: manifests generate fmt vet $(LOCALBIN) ## Run a controller from your host.
-	mkdir -p $(LOCALBIN)/default-config/
-	rm -fr $(LOCALBIN)/default-config/*
-	cp config/profile/$(PROFILE)/default-config/* $(LOCALBIN)/default-config/
+	mkdir -p $(LOCALBIN)/default-config/ &&	rm -fr $(LOCALBIN)/default-config/* && cp -r config/profile/$(PROFILE)/default-config/* $(LOCALBIN)/default-config/
+	mkdir -p $(LOCALBIN)/plugin-deps/ &&	rm -fr $(LOCALBIN)/plugin-deps/* && cp -r config/profile/$(PROFILE)/plugin-deps/* $(LOCALBIN)/plugin-deps/ 2>/dev/null || :
 	go run -C $(LOCALBIN) ../cmd/main.go
 
 # by default images expire from quay registry after 14 days
@@ -363,6 +364,22 @@ deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in
 undeploy: kustomize ## Undeploy controller from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
 	$(KUSTOMIZE) build config/profile/$(PROFILE) | $(KUBECTL) delete --ignore-not-found=$(ignore-not-found) -f -
 
+.PHONY: plugin-infra
+plugin-infra:
+	@if [ -d "config/profile/$(PROFILE)/plugin-infra" ]; then \
+		$(KUSTOMIZE) build config/profile/$(PROFILE)/plugin-infra | $(KUBECTL) apply -f -; \
+	else \
+		echo "Directory config/profile/$(PROFILE)/plugin-infra does not exist."; \
+	fi
+
+.PHONY: plugin-infra-undeploy
+plugin-infra-undeploy:
+	@if [ -d "config/profile/$(PROFILE)/plugin-infra" ]; then \
+		$(KUSTOMIZE) build config/profile/$(PROFILE)/plugin-infra | $(KUBECTL) delete -f -; \
+	else \
+		echo "Directory config/profile/$(PROFILE)/plugin-infra does not exist."; \
+	fi
+
 ##@ OLM Deployment
 
 # It has to be the same namespace as ./config/default/kustomization.yaml -> namespace

bundle/backstage.io/manifests/backstage-default-config_v1_configmap.yaml

@@ -177,7 +177,7 @@ data:
         spec:
           containers:
             - name: backstage-backend
-              image: ghcr.io/backstage/backstage:1.28.4
+              image: ghcr.io/backstage/backstage:1.38.1
               imagePullPolicy: IfNotPresent
               command:
                 - "node"

bundle/backstage.io/manifests/backstage-operator.clusterserviceversion.yaml

@@ -35,7 +35,7 @@ metadata:
           }
         }
       ]
-    createdAt: "2025-04-25T07:39:51Z"
+    createdAt: "2025-05-12T12:54:39Z"
     description: Backstage Operator
     operators.operatorframework.io/builder: operator-sdk-v1.37.0
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v4
@@ -250,6 +250,8 @@ spec:
                 volumeMounts:
                 - mountPath: /default-config
                   name: default-config
+                - mountPath: /plugin-deps
+                  name: plugin-deps
               securityContext:
                 runAsNonRoot: true
               serviceAccountName: backstage-controller-manager
@@ -258,6 +260,10 @@ spec:
               - configMap:
                   name: backstage-default-config
                 name: default-config
+              - configMap:
+                  name: plugin-deps
+                  optional: true
+                name: plugin-deps
       permissions:
       - rules:
         - apiGroups:

bundle/rhdh/manifests/backstage-operator.clusterserviceversion.yaml

@@ -39,7 +39,7 @@ metadata:
     categories: Developer Tools
     certified: "true"
     containerImage: registry.redhat.io/rhdh/rhdh-rhel9-operator:1.7
-    createdAt: "2025-04-25T07:39:52Z"
+    createdAt: "2025-05-12T12:54:40Z"
     description: Red Hat Developer Hub is a Red Hat supported version of Backstage.
       It comes with pre-built plug-ins and configuration settings, supports use of
       an external database, and can help streamline the process of setting up a self-managed
@@ -302,6 +302,8 @@ spec:
                 volumeMounts:
                 - mountPath: /default-config
                   name: default-config
+                - mountPath: /plugin-deps
+                  name: plugin-deps
               securityContext:
                 runAsNonRoot: true
               serviceAccountName: rhdh-controller-manager
@@ -310,6 +312,10 @@ spec:
               - configMap:
                   name: rhdh-default-config
                 name: default-config
+              - configMap:
+                  name: rhdh-plugin-deps
+                  optional: true
+                name: plugin-deps
       permissions:
       - rules:
         - apiGroups:

bundle/rhdh/manifests/rhdh-default-config_v1_configmap.yaml

@@ -238,6 +238,8 @@ data:
               env:
                 - name: NPM_CONFIG_USERCONFIG
                   value: /opt/app-root/src/.npmrc.dynamic-plugins
+                - name: MAX_ENTRY_SIZE
+                  value: "30000000"
               volumeMounts:
                 - mountPath: /dynamic-plugins-root
                   name: dynamic-plugins-root
@@ -348,28 +350,72 @@ data:
           securityContext:
             # any group id
             fsGroup: 1001
-  dynamic-plugins.yaml: |-
+  dynamic-plugins.yaml: |
+    #apiVersion: v1
+    #kind: ConfigMap
+    #metadata:
+    #  name: default-dynamic-plugins #  must be the same as (deployment.yaml).spec.template.spec.volumes.name.dynamic-plugins-conf.configMap.name
+    #data:
+    #  "dynamic-plugins.yaml": |
+    #    ###########################################################################################################
+    #    # /!\ WARNING
+    #    #
+    #    # This is the default dynamic plugins configuration file created and managed by the Operator for your CR.
+    #    # Do NOT edit this manually in the Cluster, as your changes will be overridden by the Operator upon the
+    #    # next reconciliation.
+    #    # If you want to customize the dynamic plugins, you should create your own dynamic-plugins ConfigMap
+    #    # and reference it in your CR.
+    #    # See https://docs.redhat.com/en/documentation/red_hat_developer_hub/1.4/html/installing_and_viewing_plugins_in_red_hat_developer_hub/rhdh-installing-rhdh-plugins_title-plugins-rhdh-about#proc-config-dynamic-plugins-rhdh-operator_rhdh-installing-rhdh-plugins
+    #    # for more details or https://github.com/redhat-developer/rhdh-operator/blob/main/examples/rhdh-cr.yaml
+    #    # for an example.
+    #    ###########################################################################################################
+    #    includes:
+    #      - dynamic-plugins.default.yaml
+    #    plugins: []
+    #---
     apiVersion: v1
     kind: ConfigMap
     metadata:
-      name: default-dynamic-plugins #  must be the same as (deployment.yaml).spec.template.spec.volumes.name.dynamic-plugins-conf.configMap.name
+      name: default-dynamic-plugins
     data:
-      "dynamic-plugins.yaml": |
-        ###########################################################################################################
-        # /!\ WARNING
-        #
-        # This is the default dynamic plugins configuration file created and managed by the Operator for your CR.
-        # Do NOT edit this manually in the Cluster, as your changes will be overridden by the Operator upon the
-        # next reconciliation.
-        # If you want to customize the dynamic plugins, you should create your own dynamic-plugins ConfigMap
-        # and reference it in your CR.
-        # See https://docs.redhat.com/en/documentation/red_hat_developer_hub/1.4/html/installing_and_viewing_plugins_in_red_hat_developer_hub/rhdh-installing-rhdh-plugins_title-plugins-rhdh-about#proc-config-dynamic-plugins-rhdh-operator_rhdh-installing-rhdh-plugins
-        # for more details or https://github.com/redhat-developer/rhdh-operator/blob/main/examples/rhdh-cr.yaml
-        # for an example.
-        ###########################################################################################################
+      dynamic-plugins.yaml: |
         includes:
           - dynamic-plugins.default.yaml
-        plugins: []
+        plugins:
+          - disabled: true
+            package: "https://github.com/rhdhorchestrator/orchestrator-plugins-internal-release/releases/download/v1.5.1/backstage-plugin-orchestrator-1.5.1.tgz"
+            integrity: sha512-7VOe+XGTUzrdO/av0DNHbydOjB3Lo+XdCs6fj3JVODLP7Ypd3GXHf/nssYxG5ZYC9F1t9MNeguE2bZOB6ckqTA==
+            pluginConfig:
+              dynamicPlugins:
+                  frontend:
+                    red-hat-developer-hub.backstage-plugin-orchestrator:
+                      appIcons:
+                        - importName: OrchestratorIcon
+                          module: OrchestratorPlugin
+                          name: orchestratorIcon
+                      dynamicRoutes:
+                        - importName: OrchestratorPage
+                          menuItem:
+                            icon: orchestratorIcon
+                            text: Orchestrator
+                          module: OrchestratorPlugin
+                          path: /orchestrator
+          - disabled: true
+            package: "https://github.com/rhdhorchestrator/orchestrator-plugins-internal-release/releases/download/v1.5.1/backstage-plugin-orchestrator-backend-dynamic-1.5.1.tgz"
+            integrity: sha512-VIenFStdq9QvvmgmEMG8O7b2wqIebvEcqNeJ9SWZ8jen9t+efTK6D3Rde74LQ1no1QaHLx8RoxNCOuTUEF8O/g==
+            pluginConfig:
+              orchestrator:
+                dataIndexService:
+                  url: http://sonataflow-platform-data-index-service
+            dependencies:
+              - ref: sonataflow
+          - disabled: true
+            package: "https://github.com/rhdhorchestrator/orchestrator-plugins-internal-release/releases/download/v1.5.1/backstage-plugin-scaffolder-backend-module-orchestrator-dynamic-1.5.1.tgz"
+            integrity: sha512-bnVQjVsUZ470Vgm2kd5Lo/bVa2fF0q4GufBDc/8oTQsnP3zZJQqKFvFElBTCjY76RqkECydlvZ1UFybSzvockQ==
+            pluginConfig:
+              orchestrator:
+                dataIndexService:
+                  url: http://sonataflow-platform-data-index-service
   route.yaml: |-
     apiVersion: route.openshift.io/v1
     kind: Route

bundle/rhdh/manifests/rhdh-plugin-deps_v1_configmap.yaml

@@ -0,0 +1,121 @@
+apiVersion: v1
+data:
+  sonataflow.yaml: |
+    apiVersion: networking.k8s.io/v1
+    kind: NetworkPolicy
+    metadata:
+      name: allow-knative-to-sonataflow-and-workflows # hardcoded
+    spec:
+      podSelector: {}
+      ingress:
+        - from:
+            - namespaceSelector:
+                matchLabels:
+                  # Allow knative events to be delivered to workflows.
+                  kubernetes.io/metadata.name: knative-eventing
+            - namespaceSelector:
+                matchLabels:
+                  # Allow auxiliary knative function for workflow (such as m2k-save-transformation)
+                  kubernetes.io/metadata.name: knative-serving
+    ---
+    # NetworkPolicy to unblock incoming traffic to the namespace
+    apiVersion: networking.k8s.io/v1
+    kind: NetworkPolicy
+    metadata:
+      name: allow-external-communication # hardcoded
+    spec:
+      podSelector: {}
+      ingress:
+        - from:
+            - namespaceSelector:
+                matchLabels:
+                  # Allow knative events to be delivered to workflows.
+                  policy-group.network.openshift.io/ingress: ""
+    ---
+    apiVersion: networking.k8s.io/v1
+    kind: NetworkPolicy
+    metadata:
+      name: allow-intra-network # hardcoded
+    spec:
+      # Apply this policy to all pods in the namespace
+      podSelector: {}
+      # Specify policy type as 'Ingress' to control incoming traffic rules
+      policyTypes:
+        - Ingress
+      ingress:
+        - from:
+            # Allow ingress from any pod within the same namespace
+            - podSelector: {}
+    ---
+    # NetworkPolicy to allow openshift-user-workload-monitoring pods to access all pods within the workflow's namespace
+    apiVersion: networking.k8s.io/v1
+    kind: NetworkPolicy
+    metadata:
+      name: allow-monitoring-to-sonataflow-and-workflows # hardcoded
+    spec:
+      # Apply this policy to all pods in the namespace
+      podSelector: {}
+      # Specify policy type as 'Ingress' to control incoming traffic rules
+      policyTypes:
+        - Ingress
+      ingress:
+        - from:
+            - namespaceSelector:
+                matchLabels:
+                  # Allow openshift-user-workload-monitoring pods to access the workflow.
+                  kubernetes.io/metadata.name: openshift-user-workload-monitoring
+    ---
+    apiVersion: operator.knative.dev/v1beta1
+    kind: KnativeEventing
+    metadata:
+      name: knative-eventing
+      namespace: knative-eventing
+    spec:
+      Registry: {}
+    ---
+    apiVersion: operator.knative.dev/v1beta1
+    kind: KnativeServing
+    metadata:
+      name: knative-serving
+      namespace: knative-serving
+    spec:
+      controller-custom-certs:
+        name: ""
+        type: ""
+      registry: {}
+    ---
+    apiVersion: sonataflow.org/v1alpha08
+    kind: SonataFlowPlatform
+    metadata:
+      name: sonataflow-platform
+    spec:
+      monitoring:
+        enabled: true
+      services:
+        dataIndex:
+          enabled: true
+          persistence:
+            postgresql:
+              secretRef:
+                name: backstage-psql-secret-{{backstage-name}}
+                userKey: POSTGRES_USER
+                passwordKey: POSTGRES_PASSWORD
+              serviceRef:
+                name: backstage-psql-{{backstage-name}}
+                namespace: {{backstage-ns}}
+                databaseName: backstage_plugin_orchestrator
+        jobService:
+          enabled: true
+          persistence:
+            postgresql:
+              secretRef:
+                name: backstage-psql-secret-{{backstage-name}}
+                userKey: POSTGRES_USER
+                passwordKey: POSTGRES_PASSWORD
+              serviceRef:
+                name: backstage-psql-{{backstage-name}}
+                namespace: {{backstage-ns}}
+                databaseName: backstage_plugin_orchestrator
+kind: ConfigMap
+metadata:
+  name: rhdh-plugin-deps

config/manager/deployment.yaml

@@ -95,9 +95,16 @@ spec:
           volumeMounts:
             - mountPath: /default-config
               name: default-config
+            - mountPath: /plugin-deps
+              name: plugin-deps
+
       serviceAccountName: controller-manager
       terminationGracePeriodSeconds: 10
       volumes:
         - name: default-config
           configMap:
             name: default-config
+        - name: plugin-deps
+          configMap:
+            name: plugin-deps
+            optional: true

config/profile/backstage.io/default-config/deployment.yaml

@@ -14,7 +14,7 @@ spec:
     spec:
       containers:
         - name: backstage-backend
-          image: ghcr.io/backstage/backstage:1.28.4
+          image: ghcr.io/backstage/backstage:1.38.1
           imagePullPolicy: IfNotPresent
           command:
             - "node"

config/profile/backstage.io/kustomization.yaml

@@ -1,14 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
-# Adds namespace to all resources.
 namespace: backstage-system
 
-# Value of this field is prepended to the
-# names of all resources, e.g. a deployment named
-# "wordpress" becomes "alices-wordpress".
-# Note that it should also match with the prefix (text before '-') of the namespace
-# field above.
 namePrefix: backstage-
 
 resources:

config/profile/rhdh/default-config/deployment.yaml

@@ -62,6 +62,8 @@ spec:
           env:
             - name: NPM_CONFIG_USERCONFIG
               value: /opt/app-root/src/.npmrc.dynamic-plugins
+            - name: MAX_ENTRY_SIZE
+              value: "30000000"
           volumeMounts:
             - mountPath: /dynamic-plugins-root
               name: dynamic-plugins-root