From 06a17e021b32487b29646c42a0d53e44ee6da890 Mon Sep 17 00:00:00 2001
From: Gustavo Lira <guga.java@gmail.com>
Date: Wed, 18 Mar 2026 11:38:42 -0300
Subject: [PATCH 01/10] fix(ci): render Helm template escapes in operator
 dynamic plugins ConfigMap

The value files use Helm escaping for {{inherit}} tags:
{{ "{{" }}inherit{{ "}}" }}. Helm renders this automatically, but operator
deployments use create_dynamic_plugins_config() which extracts the YAML
directly without Helm rendering. The install-dynamic-plugins.py init
container then fails because it receives the raw Helm escape syntax
instead of {{inherit}}.

Add sed substitutions to strip the Helm escaping when generating the
dynamic plugins ConfigMap for operator deployments.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .ci/pipelines/utils.sh | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.ci/pipelines/utils.sh b/.ci/pipelines/utils.sh
index 399a4a6f8f..f80b475769 100755
--- a/.ci/pipelines/utils.sh
+++ b/.ci/pipelines/utils.sh
@@ -765,7 +765,10 @@ metadata:
   name: dynamic-plugins
 data:
   dynamic-plugins.yaml: |" > ${final_file}
-  yq '.global.dynamic' ${base_file} | sed -e 's/^/    /' -e 's/{{ "{{" }}inherit{{ "}}" }}/{{inherit}}/g' >> ${final_file}
+  # Render Helm template escapes: {{ "{{" }}inherit{{ "}}" }} -> {{inherit}}
+  # Value files use Helm escaping for {{inherit}} which Helm renders automatically,
+  # but operator deployments use these files directly without Helm rendering.
+  yq '.global.dynamic' ${base_file} | sed -e 's/^/    /' -e 's/{{ "{{" }}/{{/g' -e 's/{{ "}}" }}/}}/g' >> ${final_file}
 }
 
 create_conditional_policies_operator() {

From fbd8c0363efd53c66c747eb25ac957b24d20fa45 Mon Sep 17 00:00:00 2001
From: Gustavo Lira <guga.java@gmail.com>
Date: Wed, 18 Mar 2026 14:05:01 -0300
Subject: [PATCH 02/10] fix(ci): clean up orchestrator resources on K8s
 operator deployments

The RHDH operator's internal Helm chart creates orchestrator/SonataFlow
infrastructure (database jobs, platform resources) even on non-OpenShift
environments where it's not supported. This causes
CreateContainerConfigError on GKE/AKS/EKS because required secrets and
operators are not available.

Add cleanup_orchestrator_resources() that removes SonataFlow jobs and
resources after operator deployment on K8s. Called in all GKE, AKS, and
EKS operator deployment scripts for both showcase and showcase-rbac.

[skip-build]

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .../cluster/aks/aks-operator-deployment.sh    |  2 ++
 .../cluster/eks/eks-operator-deployment.sh    |  2 ++
 .../cluster/gke/gke-operator-deployment.sh    |  2 ++
 .ci/pipelines/utils.sh                        | 21 +++++++++++++++++++
 4 files changed, 27 insertions(+)

diff --git a/.ci/pipelines/cluster/aks/aks-operator-deployment.sh b/.ci/pipelines/cluster/aks/aks-operator-deployment.sh
index 1c255c03f3..341b7b6329 100644
--- a/.ci/pipelines/cluster/aks/aks-operator-deployment.sh
+++ b/.ci/pipelines/cluster/aks/aks-operator-deployment.sh
@@ -30,6 +30,7 @@ initiate_aks_operator_deployment() {
   setup_image_pull_secret "${namespace}" "rh-pull-secret" "${REGISTRY_REDHAT_IO_SERVICE_ACCOUNT_DOCKERCONFIGJSON}"
 
   deploy_rhdh_operator "${namespace}" "${DIR}/resources/rhdh-operator/rhdh-start_K8s.yaml"
+  cleanup_orchestrator_resources "${namespace}"
   patch_and_restart_aks_spot "${namespace}" "$RELEASE_NAME"
 
   apply_aks_operator_ingress "$namespace" "backstage-$RELEASE_NAME"
@@ -57,6 +58,7 @@ initiate_rbac_aks_operator_deployment() {
   setup_image_pull_secret "${namespace}" "rh-pull-secret" "${REGISTRY_REDHAT_IO_SERVICE_ACCOUNT_DOCKERCONFIGJSON}"
 
   deploy_rhdh_operator "${namespace}" "${DIR}/resources/rhdh-operator/rhdh-start-rbac_K8s.yaml"
+  cleanup_orchestrator_resources "${namespace}"
   patch_and_restart_aks_spot_rbac "${namespace}" "$RELEASE_NAME_RBAC"
 
   apply_aks_operator_ingress "$namespace" "backstage-$RELEASE_NAME_RBAC"
diff --git a/.ci/pipelines/cluster/eks/eks-operator-deployment.sh b/.ci/pipelines/cluster/eks/eks-operator-deployment.sh
index ead56d33b2..1b779d7b0c 100644
--- a/.ci/pipelines/cluster/eks/eks-operator-deployment.sh
+++ b/.ci/pipelines/cluster/eks/eks-operator-deployment.sh
@@ -28,6 +28,7 @@ initiate_eks_operator_deployment() {
   setup_image_pull_secret "${namespace}" "rh-pull-secret" "${REGISTRY_REDHAT_IO_SERVICE_ACCOUNT_DOCKERCONFIGJSON}"
 
   deploy_rhdh_operator "${namespace}" "${DIR}/resources/rhdh-operator/rhdh-start_K8s.yaml"
+  cleanup_orchestrator_resources "${namespace}"
 
   apply_eks_operator_ingress "$namespace" "backstage-$RELEASE_NAME"
 }
@@ -54,6 +55,7 @@ initiate_rbac_eks_operator_deployment() {
   setup_image_pull_secret "${namespace}" "rh-pull-secret" "${REGISTRY_REDHAT_IO_SERVICE_ACCOUNT_DOCKERCONFIGJSON}"
 
   deploy_rhdh_operator "${namespace}" "${DIR}/resources/rhdh-operator/rhdh-start-rbac_K8s.yaml"
+  cleanup_orchestrator_resources "${namespace}"
 
   apply_eks_operator_ingress "$namespace" "backstage-$RELEASE_NAME_RBAC"
 }
diff --git a/.ci/pipelines/cluster/gke/gke-operator-deployment.sh b/.ci/pipelines/cluster/gke/gke-operator-deployment.sh
index c279afd2ae..68a302fce1 100644
--- a/.ci/pipelines/cluster/gke/gke-operator-deployment.sh
+++ b/.ci/pipelines/cluster/gke/gke-operator-deployment.sh
@@ -33,6 +33,7 @@ initiate_gke_operator_deployment() {
   setup_image_pull_secret "${namespace}" "rh-pull-secret" "${REGISTRY_REDHAT_IO_SERVICE_ACCOUNT_DOCKERCONFIGJSON}"
 
   deploy_rhdh_operator "${namespace}" "${DIR}/resources/rhdh-operator/rhdh-start_K8s.yaml"
+  cleanup_orchestrator_resources "${namespace}"
 
   apply_gke_operator_ingress "$namespace" "backstage-$RELEASE_NAME"
 }
@@ -60,6 +61,7 @@ initiate_rbac_gke_operator_deployment() {
   setup_image_pull_secret "${namespace}" "rh-pull-secret" "${REGISTRY_REDHAT_IO_SERVICE_ACCOUNT_DOCKERCONFIGJSON}"
 
   deploy_rhdh_operator "${namespace}" "${DIR}/resources/rhdh-operator/rhdh-start-rbac_K8s.yaml"
+  cleanup_orchestrator_resources "${namespace}"
 
   apply_gke_operator_ingress "$namespace" "backstage-$RELEASE_NAME_RBAC"
 }
diff --git a/.ci/pipelines/utils.sh b/.ci/pipelines/utils.sh
index f80b475769..ae25cd1465 100755
--- a/.ci/pipelines/utils.sh
+++ b/.ci/pipelines/utils.sh
@@ -771,6 +771,27 @@ data:
   yq '.global.dynamic' ${base_file} | sed -e 's/^/    /' -e 's/{{ "{{" }}/{{/g' -e 's/{{ "}}" }}/}}/g' >> ${final_file}
 }
 
+# Clean up orchestrator/SonataFlow resources in non-OpenShift environments.
+# The RHDH operator's internal Helm chart may create orchestrator infrastructure
+# (SonataFlow jobs, deployments) even on K8s where it's not supported.
+# This function removes those resources to prevent deployment failures.
+cleanup_orchestrator_resources() {
+  local namespace=$1
+  log::info "Cleaning up orchestrator resources in namespace '$namespace' (not supported on K8s)..."
+
+  # Delete sonataflow database creation jobs that fail on K8s
+  set +e
+  kubectl delete jobs -n "$namespace" -l app.kubernetes.io/component=sonataflow 2> /dev/null
+  kubectl delete jobs -n "$namespace" --field-selector "metadata.name=create-sonataflow-database-${RELEASE_NAME}" 2> /dev/null
+  kubectl delete jobs -n "$namespace" --field-selector "metadata.name=create-sonataflow-database-${RELEASE_NAME_RBAC}" 2> /dev/null
+  # Delete any SonataFlow platform resources
+  kubectl delete sonataflowplatforms --all -n "$namespace" 2> /dev/null
+  kubectl delete sonataflows --all -n "$namespace" 2> /dev/null
+  set -e
+
+  log::info "Orchestrator cleanup complete for namespace '$namespace'"
+}
+
 create_conditional_policies_operator() {
   local destination_file=$1
   yq '.upstream.backstage.initContainers[0].command[2]' "${DIR}/value_files/values_showcase-rbac.yaml" | head -n -4 | tail -n +2 > $destination_file

From 24c96097246652e25ad27e0faa01cec8662e5ec8 Mon Sep 17 00:00:00 2001
From: Gustavo Lira <guga.java@gmail.com>
Date: Thu, 19 Mar 2026 10:30:37 -0300
Subject: [PATCH 03/10] fix(ci): wait for orchestrator resources before cleanup

The operator creates orchestrator resources asynchronously after the
Backstage CR is applied. The cleanup now polls for up to 60s for the
sonataflow jobs to appear before attempting deletion, instead of running
immediately when the resources may not exist yet.

Addresses review feedback: https://github.com/redhat-developer/rhdh/pull/4423#discussion_r2959696950

[skip-build]

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .ci/pipelines/utils.sh | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/.ci/pipelines/utils.sh b/.ci/pipelines/utils.sh
index ae25cd1465..f98a0af4ff 100755
--- a/.ci/pipelines/utils.sh
+++ b/.ci/pipelines/utils.sh
@@ -777,14 +777,25 @@ data:
 # This function removes those resources to prevent deployment failures.
 cleanup_orchestrator_resources() {
   local namespace=$1
+  local max_wait=${2:-60}
   log::info "Cleaning up orchestrator resources in namespace '$namespace' (not supported on K8s)..."
 
-  # Delete sonataflow database creation jobs that fail on K8s
+  # The operator creates orchestrator resources asynchronously after the Backstage
+  # CR is applied. Wait briefly for them to appear before attempting cleanup.
+  local elapsed=0
+  while [[ $elapsed -lt $max_wait ]]; do
+    if kubectl get jobs -n "$namespace" 2> /dev/null | grep -q "create-sonataflow-database"; then
+      log::info "Found sonataflow resources, proceeding with cleanup..."
+      break
+    fi
+    sleep 5
+    elapsed=$((elapsed + 5))
+  done
+
   set +e
   kubectl delete jobs -n "$namespace" -l app.kubernetes.io/component=sonataflow 2> /dev/null
   kubectl delete jobs -n "$namespace" --field-selector "metadata.name=create-sonataflow-database-${RELEASE_NAME}" 2> /dev/null
   kubectl delete jobs -n "$namespace" --field-selector "metadata.name=create-sonataflow-database-${RELEASE_NAME_RBAC}" 2> /dev/null
-  # Delete any SonataFlow platform resources
   kubectl delete sonataflowplatforms --all -n "$namespace" 2> /dev/null
   kubectl delete sonataflows --all -n "$namespace" 2> /dev/null
   set -e

From 2271553ce88b5ca1b850dbc38e3eff6ec4726730 Mon Sep 17 00:00:00 2001
From: Gustavo Lira <guga.java@gmail.com>
Date: Thu, 19 Mar 2026 14:40:58 -0300
Subject: [PATCH 04/10] fix(ci): disable orchestrator plugins in K8s RBAC diff
 value files

The RBAC diff files for AKS/EKS/GKE had `plugins: []` which left
orchestrator plugins from the base file enabled after merge. This
caused init containers to download unnecessary OCI plugins and the
operator to create sonataflow-database jobs that fail (missing
PostgreSQL secrets on K8s).

Add explicit orchestrator plugin disable entries to all K8s RBAC
diff files and fix cleanup_orchestrator_resources to match job names
by prefix instead of exact field-selector (jobs have random suffixes).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .ci/pipelines/utils.sh                                 | 10 ++++++++--
 .../value_files/diff-values_showcase-rbac_AKS.yaml     |  3 ++-
 .../value_files/diff-values_showcase-rbac_EKS.yaml     |  3 ++-
 .../value_files/diff-values_showcase-rbac_GKE.yaml     |  3 ++-
 4 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/.ci/pipelines/utils.sh b/.ci/pipelines/utils.sh
index f98a0af4ff..c54afdbf0f 100755
--- a/.ci/pipelines/utils.sh
+++ b/.ci/pipelines/utils.sh
@@ -794,8 +794,14 @@ cleanup_orchestrator_resources() {
 
   set +e
   kubectl delete jobs -n "$namespace" -l app.kubernetes.io/component=sonataflow 2> /dev/null
-  kubectl delete jobs -n "$namespace" --field-selector "metadata.name=create-sonataflow-database-${RELEASE_NAME}" 2> /dev/null
-  kubectl delete jobs -n "$namespace" --field-selector "metadata.name=create-sonataflow-database-${RELEASE_NAME_RBAC}" 2> /dev/null
+  # Delete sonataflow-database jobs by name prefix (job names include random suffixes)
+  local sonataflow_jobs
+  sonataflow_jobs=$(kubectl get jobs -n "$namespace" --no-headers -o custom-columns=":metadata.name" 2>/dev/null | grep "create-sonataflow-database" || true)
+  if [[ -n "$sonataflow_jobs" ]]; then
+    echo "$sonataflow_jobs" | while read -r job; do
+      kubectl delete job "$job" -n "$namespace" --ignore-not-found 2>/dev/null
+    done
+  fi
   kubectl delete sonataflowplatforms --all -n "$namespace" 2> /dev/null
   kubectl delete sonataflows --all -n "$namespace" 2> /dev/null
   set -e
diff --git a/.ci/pipelines/value_files/diff-values_showcase-rbac_AKS.yaml b/.ci/pipelines/value_files/diff-values_showcase-rbac_AKS.yaml
index 8e88328d4d..a6472cfb5e 100644
--- a/.ci/pipelines/value_files/diff-values_showcase-rbac_AKS.yaml
+++ b/.ci/pipelines/value_files/diff-values_showcase-rbac_AKS.yaml
@@ -180,4 +180,5 @@ upstream:
     enabled: true
     className: webapprouting.kubernetes.azure.com
     host: ""
-orchestrator: null
+orchestrator:
+  enabled: false
diff --git a/.ci/pipelines/value_files/diff-values_showcase-rbac_EKS.yaml b/.ci/pipelines/value_files/diff-values_showcase-rbac_EKS.yaml
index 445e37c084..700fb7222a 100644
--- a/.ci/pipelines/value_files/diff-values_showcase-rbac_EKS.yaml
+++ b/.ci/pipelines/value_files/diff-values_showcase-rbac_EKS.yaml
@@ -172,4 +172,5 @@ upstream:
       alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
       alb.ingress.kubernetes.io/ssl-redirect: "443"
       external-dns.alpha.kubernetes.io/hostname: $EKS_INSTANCE_DOMAIN_NAME
-orchestrator: null
+orchestrator:
+  enabled: false
diff --git a/.ci/pipelines/value_files/diff-values_showcase-rbac_GKE.yaml b/.ci/pipelines/value_files/diff-values_showcase-rbac_GKE.yaml
index 31f7008b81..a6c9568815 100644
--- a/.ci/pipelines/value_files/diff-values_showcase-rbac_GKE.yaml
+++ b/.ci/pipelines/value_files/diff-values_showcase-rbac_GKE.yaml
@@ -175,4 +175,5 @@ upstream:
       ingress.gcp.kubernetes.io/pre-shared-cert: ""
       networking.gke.io/v1beta1.FrontendConfig: rhdh-gke-ingress-security-config
     className: gce
-orchestrator: null
+orchestrator:
+  enabled: false

From e4a5daa0785e06933204862c346fe22c26c49b33 Mon Sep 17 00:00:00 2001
From: Gustavo Lira <guga.java@gmail.com>
Date: Thu, 19 Mar 2026 14:49:35 -0300
Subject: [PATCH 05/10] fix(ci): fix prettier formatting and add explicit
 return to cleanup function

Fix prettier code style in utils.sh and add explicit return statement
at the end of cleanup_orchestrator_resources (Sonar S7682).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .ci/pipelines/utils.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.ci/pipelines/utils.sh b/.ci/pipelines/utils.sh
index c54afdbf0f..6c998d4bf6 100755
--- a/.ci/pipelines/utils.sh
+++ b/.ci/pipelines/utils.sh
@@ -796,10 +796,10 @@ cleanup_orchestrator_resources() {
   kubectl delete jobs -n "$namespace" -l app.kubernetes.io/component=sonataflow 2> /dev/null
   # Delete sonataflow-database jobs by name prefix (job names include random suffixes)
   local sonataflow_jobs
-  sonataflow_jobs=$(kubectl get jobs -n "$namespace" --no-headers -o custom-columns=":metadata.name" 2>/dev/null | grep "create-sonataflow-database" || true)
+  sonataflow_jobs=$(kubectl get jobs -n "$namespace" --no-headers -o custom-columns=":metadata.name" 2> /dev/null | grep "create-sonataflow-database" || true)
   if [[ -n "$sonataflow_jobs" ]]; then
     echo "$sonataflow_jobs" | while read -r job; do
-      kubectl delete job "$job" -n "$namespace" --ignore-not-found 2>/dev/null
+      kubectl delete job "$job" -n "$namespace" --ignore-not-found 2> /dev/null
     done
   fi
   kubectl delete sonataflowplatforms --all -n "$namespace" 2> /dev/null
@@ -807,6 +807,7 @@ cleanup_orchestrator_resources() {
   set -e
 
   log::info "Orchestrator cleanup complete for namespace '$namespace'"
+  return 0
 }
 
 create_conditional_policies_operator() {

From d9e3d94399a19aec26bf5741e21762c31f32a4dc Mon Sep 17 00:00:00 2001
From: Gustavo Lira <guga.java@gmail.com>
Date: Thu, 19 Mar 2026 16:50:06 -0300
Subject: [PATCH 06/10] fix(ci): remove cleanup_orchestrator_resources from K8s
 operator deployments

The cleanup function deletes resources managed by the RHDH operator,
triggering reconciliation that creates a second ReplicaSet (double
rollout). On EKS this causes PostgreSQL EBS Multi-Attach errors
because the volume can't be reattached to a different node during
the rollout.

Since orchestrator plugins are now disabled in all K8s RBAC diff
files, the failing sonataflow-database jobs are harmless background
noise that don't block Backstage from starting.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .ci/pipelines/cluster/aks/aks-operator-deployment.sh | 2 --
 .ci/pipelines/cluster/eks/eks-operator-deployment.sh | 2 --
 .ci/pipelines/cluster/gke/gke-operator-deployment.sh | 2 --
 3 files changed, 6 deletions(-)

diff --git a/.ci/pipelines/cluster/aks/aks-operator-deployment.sh b/.ci/pipelines/cluster/aks/aks-operator-deployment.sh
index 341b7b6329..1c255c03f3 100644
--- a/.ci/pipelines/cluster/aks/aks-operator-deployment.sh
+++ b/.ci/pipelines/cluster/aks/aks-operator-deployment.sh
@@ -30,7 +30,6 @@ initiate_aks_operator_deployment() {
   setup_image_pull_secret "${namespace}" "rh-pull-secret" "${REGISTRY_REDHAT_IO_SERVICE_ACCOUNT_DOCKERCONFIGJSON}"
 
   deploy_rhdh_operator "${namespace}" "${DIR}/resources/rhdh-operator/rhdh-start_K8s.yaml"
-  cleanup_orchestrator_resources "${namespace}"
   patch_and_restart_aks_spot "${namespace}" "$RELEASE_NAME"
 
   apply_aks_operator_ingress "$namespace" "backstage-$RELEASE_NAME"
@@ -58,7 +57,6 @@ initiate_rbac_aks_operator_deployment() {
   setup_image_pull_secret "${namespace}" "rh-pull-secret" "${REGISTRY_REDHAT_IO_SERVICE_ACCOUNT_DOCKERCONFIGJSON}"
 
   deploy_rhdh_operator "${namespace}" "${DIR}/resources/rhdh-operator/rhdh-start-rbac_K8s.yaml"
-  cleanup_orchestrator_resources "${namespace}"
   patch_and_restart_aks_spot_rbac "${namespace}" "$RELEASE_NAME_RBAC"
 
   apply_aks_operator_ingress "$namespace" "backstage-$RELEASE_NAME_RBAC"
diff --git a/.ci/pipelines/cluster/eks/eks-operator-deployment.sh b/.ci/pipelines/cluster/eks/eks-operator-deployment.sh
index 1b779d7b0c..ead56d33b2 100644
--- a/.ci/pipelines/cluster/eks/eks-operator-deployment.sh
+++ b/.ci/pipelines/cluster/eks/eks-operator-deployment.sh
@@ -28,7 +28,6 @@ initiate_eks_operator_deployment() {
   setup_image_pull_secret "${namespace}" "rh-pull-secret" "${REGISTRY_REDHAT_IO_SERVICE_ACCOUNT_DOCKERCONFIGJSON}"
 
   deploy_rhdh_operator "${namespace}" "${DIR}/resources/rhdh-operator/rhdh-start_K8s.yaml"
-  cleanup_orchestrator_resources "${namespace}"
 
   apply_eks_operator_ingress "$namespace" "backstage-$RELEASE_NAME"
 }
@@ -55,7 +54,6 @@ initiate_rbac_eks_operator_deployment() {
   setup_image_pull_secret "${namespace}" "rh-pull-secret" "${REGISTRY_REDHAT_IO_SERVICE_ACCOUNT_DOCKERCONFIGJSON}"
 
   deploy_rhdh_operator "${namespace}" "${DIR}/resources/rhdh-operator/rhdh-start-rbac_K8s.yaml"
-  cleanup_orchestrator_resources "${namespace}"
 
   apply_eks_operator_ingress "$namespace" "backstage-$RELEASE_NAME_RBAC"
 }
diff --git a/.ci/pipelines/cluster/gke/gke-operator-deployment.sh b/.ci/pipelines/cluster/gke/gke-operator-deployment.sh
index 68a302fce1..c279afd2ae 100644
--- a/.ci/pipelines/cluster/gke/gke-operator-deployment.sh
+++ b/.ci/pipelines/cluster/gke/gke-operator-deployment.sh
@@ -33,7 +33,6 @@ initiate_gke_operator_deployment() {
   setup_image_pull_secret "${namespace}" "rh-pull-secret" "${REGISTRY_REDHAT_IO_SERVICE_ACCOUNT_DOCKERCONFIGJSON}"
 
   deploy_rhdh_operator "${namespace}" "${DIR}/resources/rhdh-operator/rhdh-start_K8s.yaml"
-  cleanup_orchestrator_resources "${namespace}"
 
   apply_gke_operator_ingress "$namespace" "backstage-$RELEASE_NAME"
 }
@@ -61,7 +60,6 @@ initiate_rbac_gke_operator_deployment() {
   setup_image_pull_secret "${namespace}" "rh-pull-secret" "${REGISTRY_REDHAT_IO_SERVICE_ACCOUNT_DOCKERCONFIGJSON}"
 
   deploy_rhdh_operator "${namespace}" "${DIR}/resources/rhdh-operator/rhdh-start-rbac_K8s.yaml"
-  cleanup_orchestrator_resources "${namespace}"
 
   apply_gke_operator_ingress "$namespace" "backstage-$RELEASE_NAME_RBAC"
 }

From 34a8ddfb1a8c2fadbc07b85c0773e19c2532ffc3 Mon Sep 17 00:00:00 2001
From: Gustavo Lira <guga.java@gmail.com>
Date: Thu, 19 Mar 2026 17:01:53 -0300
Subject: [PATCH 07/10] fix(ci): disable orchestrator chart on K8s helm
 deployments

Add --set orchestrator.enabled=false to all K8s helm upgrade commands
(AKS, EKS, GKE) to prevent the chart from creating sonataflow-database
jobs and other orchestrator infrastructure that is not supported on K8s.

The orchestrator: null in diff files gets removed by yq merge's
del(.. | select(. == null)), so the chart falls back to its default
(enabled: true). The --set flag takes highest precedence in Helm.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .ci/pipelines/cluster/aks/aks-helm-deployment.sh | 6 ++++--
 .ci/pipelines/cluster/eks/eks-helm-deployment.sh | 6 ++++--
 .ci/pipelines/cluster/gke/gke-helm-deployment.sh | 6 ++++--
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/.ci/pipelines/cluster/aks/aks-helm-deployment.sh b/.ci/pipelines/cluster/aks/aks-helm-deployment.sh
index 77be49ec78..12b487b7aa 100644
--- a/.ci/pipelines/cluster/aks/aks-helm-deployment.sh
+++ b/.ci/pipelines/cluster/aks/aks-helm-deployment.sh
@@ -31,7 +31,8 @@ initiate_aks_helm_deployment() {
     -f "/tmp/${HELM_CHART_K8S_MERGED_VALUE_FILE_NAME}" \
     --set global.host="${K8S_CLUSTER_ROUTER_BASE}" \
     --set upstream.backstage.image.repository="${QUAY_REPO}" \
-    --set upstream.backstage.image.tag="${TAG_NAME}"
+    --set upstream.backstage.image.tag="${TAG_NAME}" \
+    --set orchestrator.enabled=false
 }
 
 initiate_rbac_aks_helm_deployment() {
@@ -55,5 +56,6 @@ initiate_rbac_aks_helm_deployment() {
     -f "/tmp/${HELM_CHART_RBAC_K8S_MERGED_VALUE_FILE_NAME}" \
     --set global.host="${K8S_CLUSTER_ROUTER_BASE}" \
     --set upstream.backstage.image.repository="${QUAY_REPO}" \
-    --set upstream.backstage.image.tag="${TAG_NAME}"
+    --set upstream.backstage.image.tag="${TAG_NAME}" \
+    --set orchestrator.enabled=false
 }
diff --git a/.ci/pipelines/cluster/eks/eks-helm-deployment.sh b/.ci/pipelines/cluster/eks/eks-helm-deployment.sh
index db56b84e6c..aa1faddc90 100644
--- a/.ci/pipelines/cluster/eks/eks-helm-deployment.sh
+++ b/.ci/pipelines/cluster/eks/eks-helm-deployment.sh
@@ -30,7 +30,8 @@ initiate_eks_helm_deployment() {
     -f "/tmp/${HELM_CHART_K8S_MERGED_VALUE_FILE_NAME}" \
     --set global.host="${K8S_CLUSTER_ROUTER_BASE}" \
     --set upstream.backstage.image.repository="${QUAY_REPO}" \
-    --set upstream.backstage.image.tag="${TAG_NAME}"
+    --set upstream.backstage.image.tag="${TAG_NAME}" \
+    --set orchestrator.enabled=false
 }
 
 initiate_rbac_eks_helm_deployment() {
@@ -57,5 +58,6 @@ initiate_rbac_eks_helm_deployment() {
     -f "/tmp/${HELM_CHART_RBAC_K8S_MERGED_VALUE_FILE_NAME}" \
     --set global.host="${K8S_CLUSTER_ROUTER_BASE}" \
     --set upstream.backstage.image.repository="${QUAY_REPO}" \
-    --set upstream.backstage.image.tag="${TAG_NAME}"
+    --set upstream.backstage.image.tag="${TAG_NAME}" \
+    --set orchestrator.enabled=false
 }
diff --git a/.ci/pipelines/cluster/gke/gke-helm-deployment.sh b/.ci/pipelines/cluster/gke/gke-helm-deployment.sh
index 4799b84fdd..1b28d7a351 100644
--- a/.ci/pipelines/cluster/gke/gke-helm-deployment.sh
+++ b/.ci/pipelines/cluster/gke/gke-helm-deployment.sh
@@ -34,7 +34,8 @@ initiate_gke_helm_deployment() {
     --set global.host="${K8S_CLUSTER_ROUTER_BASE}" \
     --set upstream.backstage.image.repository="${QUAY_REPO}" \
     --set upstream.backstage.image.tag="${TAG_NAME}" \
-    --set upstream.ingress.annotations."ingress\.gcp\.kubernetes\.io/pre-shared-cert"="${GKE_CERT_NAME}"
+    --set upstream.ingress.annotations."ingress\.gcp\.kubernetes\.io/pre-shared-cert"="${GKE_CERT_NAME}" \
+    --set orchestrator.enabled=false
 }
 
 initiate_rbac_gke_helm_deployment() {
@@ -59,5 +60,6 @@ initiate_rbac_gke_helm_deployment() {
     --set global.host="${K8S_CLUSTER_ROUTER_BASE}" \
     --set upstream.backstage.image.repository="${QUAY_REPO}" \
     --set upstream.backstage.image.tag="${TAG_NAME}" \
-    --set upstream.ingress.annotations."ingress\.gcp\.kubernetes\.io/pre-shared-cert"="${GKE_CERT_NAME}"
+    --set upstream.ingress.annotations."ingress\.gcp\.kubernetes\.io/pre-shared-cert"="${GKE_CERT_NAME}" \
+    --set orchestrator.enabled=false
 }

From 4d0fc3a4656be42f5eac9fe6dcfc63147a36aede Mon Sep 17 00:00:00 2001
From: Gustavo Lira <guga.java@gmail.com>
Date: Thu, 19 Mar 2026 20:26:32 -0300
Subject: [PATCH 08/10] fix(ci): wait for operator rollout to stabilize on K8s
 deployments

The RHDH operator updates the Deployment spec multiple times after
the Backstage CR is applied, creating multiple ReplicaSets (double
rollout). Two competing pods cause 503 errors as they conflict on
the database.

Add wait_for_operator_rollout() that waits for the deployment to
exist and for kubectl rollout status to complete before proceeding,
ensuring only one ReplicaSet is active.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .../cluster/aks/aks-operator-deployment.sh    |  2 ++
 .../cluster/eks/eks-operator-deployment.sh    |  2 ++
 .../cluster/gke/gke-operator-deployment.sh    |  2 ++
 .ci/pipelines/utils.sh                        | 31 +++++++++++++++++++
 4 files changed, 37 insertions(+)

diff --git a/.ci/pipelines/cluster/aks/aks-operator-deployment.sh b/.ci/pipelines/cluster/aks/aks-operator-deployment.sh
index 1c255c03f3..17660a0cd0 100644
--- a/.ci/pipelines/cluster/aks/aks-operator-deployment.sh
+++ b/.ci/pipelines/cluster/aks/aks-operator-deployment.sh
@@ -30,6 +30,7 @@ initiate_aks_operator_deployment() {
   setup_image_pull_secret "${namespace}" "rh-pull-secret" "${REGISTRY_REDHAT_IO_SERVICE_ACCOUNT_DOCKERCONFIGJSON}"
 
   deploy_rhdh_operator "${namespace}" "${DIR}/resources/rhdh-operator/rhdh-start_K8s.yaml"
+  wait_for_operator_rollout "${namespace}" "backstage-${RELEASE_NAME}"
   patch_and_restart_aks_spot "${namespace}" "$RELEASE_NAME"
 
   apply_aks_operator_ingress "$namespace" "backstage-$RELEASE_NAME"
@@ -57,6 +58,7 @@ initiate_rbac_aks_operator_deployment() {
   setup_image_pull_secret "${namespace}" "rh-pull-secret" "${REGISTRY_REDHAT_IO_SERVICE_ACCOUNT_DOCKERCONFIGJSON}"
 
   deploy_rhdh_operator "${namespace}" "${DIR}/resources/rhdh-operator/rhdh-start-rbac_K8s.yaml"
+  wait_for_operator_rollout "${namespace}" "backstage-${RELEASE_NAME_RBAC}"
   patch_and_restart_aks_spot_rbac "${namespace}" "$RELEASE_NAME_RBAC"
 
   apply_aks_operator_ingress "$namespace" "backstage-$RELEASE_NAME_RBAC"
diff --git a/.ci/pipelines/cluster/eks/eks-operator-deployment.sh b/.ci/pipelines/cluster/eks/eks-operator-deployment.sh
index ead56d33b2..0a7eb11e21 100644
--- a/.ci/pipelines/cluster/eks/eks-operator-deployment.sh
+++ b/.ci/pipelines/cluster/eks/eks-operator-deployment.sh
@@ -28,6 +28,7 @@ initiate_eks_operator_deployment() {
   setup_image_pull_secret "${namespace}" "rh-pull-secret" "${REGISTRY_REDHAT_IO_SERVICE_ACCOUNT_DOCKERCONFIGJSON}"
 
   deploy_rhdh_operator "${namespace}" "${DIR}/resources/rhdh-operator/rhdh-start_K8s.yaml"
+  wait_for_operator_rollout "${namespace}" "backstage-${RELEASE_NAME}"
 
   apply_eks_operator_ingress "$namespace" "backstage-$RELEASE_NAME"
 }
@@ -54,6 +55,7 @@ initiate_rbac_eks_operator_deployment() {
   setup_image_pull_secret "${namespace}" "rh-pull-secret" "${REGISTRY_REDHAT_IO_SERVICE_ACCOUNT_DOCKERCONFIGJSON}"
 
   deploy_rhdh_operator "${namespace}" "${DIR}/resources/rhdh-operator/rhdh-start-rbac_K8s.yaml"
+  wait_for_operator_rollout "${namespace}" "backstage-${RELEASE_NAME_RBAC}"
 
   apply_eks_operator_ingress "$namespace" "backstage-$RELEASE_NAME_RBAC"
 }
diff --git a/.ci/pipelines/cluster/gke/gke-operator-deployment.sh b/.ci/pipelines/cluster/gke/gke-operator-deployment.sh
index c279afd2ae..248e4d87f9 100644
--- a/.ci/pipelines/cluster/gke/gke-operator-deployment.sh
+++ b/.ci/pipelines/cluster/gke/gke-operator-deployment.sh
@@ -33,6 +33,7 @@ initiate_gke_operator_deployment() {
   setup_image_pull_secret "${namespace}" "rh-pull-secret" "${REGISTRY_REDHAT_IO_SERVICE_ACCOUNT_DOCKERCONFIGJSON}"
 
   deploy_rhdh_operator "${namespace}" "${DIR}/resources/rhdh-operator/rhdh-start_K8s.yaml"
+  wait_for_operator_rollout "${namespace}" "backstage-${RELEASE_NAME}"
 
   apply_gke_operator_ingress "$namespace" "backstage-$RELEASE_NAME"
 }
@@ -60,6 +61,7 @@ initiate_rbac_gke_operator_deployment() {
   setup_image_pull_secret "${namespace}" "rh-pull-secret" "${REGISTRY_REDHAT_IO_SERVICE_ACCOUNT_DOCKERCONFIGJSON}"
 
   deploy_rhdh_operator "${namespace}" "${DIR}/resources/rhdh-operator/rhdh-start-rbac_K8s.yaml"
+  wait_for_operator_rollout "${namespace}" "backstage-${RELEASE_NAME_RBAC}"
 
   apply_gke_operator_ingress "$namespace" "backstage-$RELEASE_NAME_RBAC"
 }
diff --git a/.ci/pipelines/utils.sh b/.ci/pipelines/utils.sh
index 6c998d4bf6..81b1f9a6d2 100755
--- a/.ci/pipelines/utils.sh
+++ b/.ci/pipelines/utils.sh
@@ -810,6 +810,37 @@ cleanup_orchestrator_resources() {
   return 0
 }
 
+# Wait for the RHDH operator to finish reconciling and the deployment rollout to stabilize.
+# The operator may update the Deployment spec multiple times after the Backstage CR is applied,
+# causing multiple ReplicaSets. This function waits for the deployment to exist and for
+# the rollout to complete so only one ReplicaSet is active.
+wait_for_operator_rollout() {
+  local namespace=$1
+  local deployment_name=$2
+  local max_wait=${3:-180}
+
+  log::info "Waiting for deployment '$deployment_name' to be created in namespace '$namespace'..."
+  local elapsed=0
+  while [[ $elapsed -lt $max_wait ]]; do
+    if kubectl get deployment "$deployment_name" -n "$namespace" &> /dev/null; then
+      log::info "Deployment '$deployment_name' found, waiting for rollout to stabilize..."
+      break
+    fi
+    sleep 5
+    elapsed=$((elapsed + 5))
+  done
+
+  if ! kubectl get deployment "$deployment_name" -n "$namespace" &> /dev/null; then
+    log::warn "Deployment '$deployment_name' not found after ${max_wait}s, continuing..."
+    return 0
+  fi
+
+  # Wait for rollout to complete (operator may trigger multiple updates)
+  kubectl rollout status deployment/"$deployment_name" -n "$namespace" --timeout="${max_wait}s" 2> /dev/null || true
+  log::info "Deployment '$deployment_name' rollout stabilized"
+  return 0
+}
+
 create_conditional_policies_operator() {
   local destination_file=$1
   yq '.upstream.backstage.initContainers[0].command[2]' "${DIR}/value_files/values_showcase-rbac.yaml" | head -n -4 | tail -n +2 > $destination_file

From 89ad86f44dc5b3946c406cc695d223e54aa732e1 Mon Sep 17 00:00:00 2001
From: Gustavo Lira <guga.java@gmail.com>
Date: Fri, 20 Mar 2026 09:45:25 -0300
Subject: [PATCH 09/10] fix(ci): move orchestrator config to diff-values files
 and remove dead code

Move `orchestrator.enabled: false` from `--set` flags in helm commands
to the diff-values YAML files for all K8s platforms (EKS, AKS, GKE,
OSD-GCP, upgrade). This follows the existing pattern and makes the
configuration more readable and declarative.

Also removes the unused `cleanup_orchestrator_resources()` function.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .../cluster/aks/aks-helm-deployment.sh        |  6 +--
 .../cluster/eks/eks-helm-deployment.sh        |  6 +--
 .../cluster/gke/gke-helm-deployment.sh        |  6 +--
 .ci/pipelines/utils.sh                        | 39 -------------------
 .../diff-values_showcase-rbac_OSD-GCP.yaml    |  3 +-
 .../value_files/diff-values_showcase_AKS.yaml |  3 +-
 .../value_files/diff-values_showcase_EKS.yaml |  3 +-
 .../value_files/diff-values_showcase_GKE.yaml |  3 +-
 .../diff-values_showcase_OSD-GCP.yaml         |  3 +-
 .../diff-values_showcase_upgrade.yaml         |  3 +-
 10 files changed, 18 insertions(+), 57 deletions(-)

diff --git a/.ci/pipelines/cluster/aks/aks-helm-deployment.sh b/.ci/pipelines/cluster/aks/aks-helm-deployment.sh
index 12b487b7aa..77be49ec78 100644
--- a/.ci/pipelines/cluster/aks/aks-helm-deployment.sh
+++ b/.ci/pipelines/cluster/aks/aks-helm-deployment.sh
@@ -31,8 +31,7 @@ initiate_aks_helm_deployment() {
     -f "/tmp/${HELM_CHART_K8S_MERGED_VALUE_FILE_NAME}" \
     --set global.host="${K8S_CLUSTER_ROUTER_BASE}" \
     --set upstream.backstage.image.repository="${QUAY_REPO}" \
-    --set upstream.backstage.image.tag="${TAG_NAME}" \
-    --set orchestrator.enabled=false
+    --set upstream.backstage.image.tag="${TAG_NAME}"
 }
 
 initiate_rbac_aks_helm_deployment() {
@@ -56,6 +55,5 @@ initiate_rbac_aks_helm_deployment() {
     -f "/tmp/${HELM_CHART_RBAC_K8S_MERGED_VALUE_FILE_NAME}" \
     --set global.host="${K8S_CLUSTER_ROUTER_BASE}" \
     --set upstream.backstage.image.repository="${QUAY_REPO}" \
-    --set upstream.backstage.image.tag="${TAG_NAME}" \
-    --set orchestrator.enabled=false
+    --set upstream.backstage.image.tag="${TAG_NAME}"
 }
diff --git a/.ci/pipelines/cluster/eks/eks-helm-deployment.sh b/.ci/pipelines/cluster/eks/eks-helm-deployment.sh
index aa1faddc90..db56b84e6c 100644
--- a/.ci/pipelines/cluster/eks/eks-helm-deployment.sh
+++ b/.ci/pipelines/cluster/eks/eks-helm-deployment.sh
@@ -30,8 +30,7 @@ initiate_eks_helm_deployment() {
     -f "/tmp/${HELM_CHART_K8S_MERGED_VALUE_FILE_NAME}" \
     --set global.host="${K8S_CLUSTER_ROUTER_BASE}" \
     --set upstream.backstage.image.repository="${QUAY_REPO}" \
-    --set upstream.backstage.image.tag="${TAG_NAME}" \
-    --set orchestrator.enabled=false
+    --set upstream.backstage.image.tag="${TAG_NAME}"
 }
 
 initiate_rbac_eks_helm_deployment() {
@@ -58,6 +57,5 @@ initiate_rbac_eks_helm_deployment() {
     -f "/tmp/${HELM_CHART_RBAC_K8S_MERGED_VALUE_FILE_NAME}" \
     --set global.host="${K8S_CLUSTER_ROUTER_BASE}" \
     --set upstream.backstage.image.repository="${QUAY_REPO}" \
-    --set upstream.backstage.image.tag="${TAG_NAME}" \
-    --set orchestrator.enabled=false
+    --set upstream.backstage.image.tag="${TAG_NAME}"
 }
diff --git a/.ci/pipelines/cluster/gke/gke-helm-deployment.sh b/.ci/pipelines/cluster/gke/gke-helm-deployment.sh
index 1b28d7a351..4799b84fdd 100644
--- a/.ci/pipelines/cluster/gke/gke-helm-deployment.sh
+++ b/.ci/pipelines/cluster/gke/gke-helm-deployment.sh
@@ -34,8 +34,7 @@ initiate_gke_helm_deployment() {
     --set global.host="${K8S_CLUSTER_ROUTER_BASE}" \
     --set upstream.backstage.image.repository="${QUAY_REPO}" \
     --set upstream.backstage.image.tag="${TAG_NAME}" \
-    --set upstream.ingress.annotations."ingress\.gcp\.kubernetes\.io/pre-shared-cert"="${GKE_CERT_NAME}" \
-    --set orchestrator.enabled=false
+    --set upstream.ingress.annotations."ingress\.gcp\.kubernetes\.io/pre-shared-cert"="${GKE_CERT_NAME}"
 }
 
 initiate_rbac_gke_helm_deployment() {
@@ -60,6 +59,5 @@ initiate_rbac_gke_helm_deployment() {
     --set global.host="${K8S_CLUSTER_ROUTER_BASE}" \
     --set upstream.backstage.image.repository="${QUAY_REPO}" \
     --set upstream.backstage.image.tag="${TAG_NAME}" \
-    --set upstream.ingress.annotations."ingress\.gcp\.kubernetes\.io/pre-shared-cert"="${GKE_CERT_NAME}" \
-    --set orchestrator.enabled=false
+    --set upstream.ingress.annotations."ingress\.gcp\.kubernetes\.io/pre-shared-cert"="${GKE_CERT_NAME}"
 }
diff --git a/.ci/pipelines/utils.sh b/.ci/pipelines/utils.sh
index 81b1f9a6d2..1e499c5989 100755
--- a/.ci/pipelines/utils.sh
+++ b/.ci/pipelines/utils.sh
@@ -771,45 +771,6 @@ data:
   yq '.global.dynamic' ${base_file} | sed -e 's/^/    /' -e 's/{{ "{{" }}/{{/g' -e 's/{{ "}}" }}/}}/g' >> ${final_file}
 }
 
-# Clean up orchestrator/SonataFlow resources in non-OpenShift environments.
-# The RHDH operator's internal Helm chart may create orchestrator infrastructure
-# (SonataFlow jobs, deployments) even on K8s where it's not supported.
-# This function removes those resources to prevent deployment failures.
-cleanup_orchestrator_resources() {
-  local namespace=$1
-  local max_wait=${2:-60}
-  log::info "Cleaning up orchestrator resources in namespace '$namespace' (not supported on K8s)..."
-
-  # The operator creates orchestrator resources asynchronously after the Backstage
-  # CR is applied. Wait briefly for them to appear before attempting cleanup.
-  local elapsed=0
-  while [[ $elapsed -lt $max_wait ]]; do
-    if kubectl get jobs -n "$namespace" 2> /dev/null | grep -q "create-sonataflow-database"; then
-      log::info "Found sonataflow resources, proceeding with cleanup..."
-      break
-    fi
-    sleep 5
-    elapsed=$((elapsed + 5))
-  done
-
-  set +e
-  kubectl delete jobs -n "$namespace" -l app.kubernetes.io/component=sonataflow 2> /dev/null
-  # Delete sonataflow-database jobs by name prefix (job names include random suffixes)
-  local sonataflow_jobs
-  sonataflow_jobs=$(kubectl get jobs -n "$namespace" --no-headers -o custom-columns=":metadata.name" 2> /dev/null | grep "create-sonataflow-database" || true)
-  if [[ -n "$sonataflow_jobs" ]]; then
-    echo "$sonataflow_jobs" | while read -r job; do
-      kubectl delete job "$job" -n "$namespace" --ignore-not-found 2> /dev/null
-    done
-  fi
-  kubectl delete sonataflowplatforms --all -n "$namespace" 2> /dev/null
-  kubectl delete sonataflows --all -n "$namespace" 2> /dev/null
-  set -e
-
-  log::info "Orchestrator cleanup complete for namespace '$namespace'"
-  return 0
-}
-
 # Wait for the RHDH operator to finish reconciling and the deployment rollout to stabilize.
 # The operator may update the Deployment spec multiple times after the Backstage CR is applied,
 # causing multiple ReplicaSets. This function waits for the deployment to exist and for
diff --git a/.ci/pipelines/value_files/diff-values_showcase-rbac_OSD-GCP.yaml b/.ci/pipelines/value_files/diff-values_showcase-rbac_OSD-GCP.yaml
index 26cc072679..45265caf07 100644
--- a/.ci/pipelines/value_files/diff-values_showcase-rbac_OSD-GCP.yaml
+++ b/.ci/pipelines/value_files/diff-values_showcase-rbac_OSD-GCP.yaml
@@ -4,7 +4,8 @@
 # The only exception is global.dynamic.plugins, that gets merged with the base file.
 
 # Disable orchestrator for OSD-GCP due to infrastructure limitations
-orchestrator: null
+orchestrator:
+  enabled: false
 
 global:
   dynamic:
diff --git a/.ci/pipelines/value_files/diff-values_showcase_AKS.yaml b/.ci/pipelines/value_files/diff-values_showcase_AKS.yaml
index f0bd5c1728..4cab4f5322 100644
--- a/.ci/pipelines/value_files/diff-values_showcase_AKS.yaml
+++ b/.ci/pipelines/value_files/diff-values_showcase_AKS.yaml
@@ -58,4 +58,5 @@ upstream:
     enabled: true
     className: webapprouting.kubernetes.azure.com
     host: ""
-orchestrator: null
+orchestrator:
+  enabled: false
diff --git a/.ci/pipelines/value_files/diff-values_showcase_EKS.yaml b/.ci/pipelines/value_files/diff-values_showcase_EKS.yaml
index a10ff6046c..a02f41fefc 100644
--- a/.ci/pipelines/value_files/diff-values_showcase_EKS.yaml
+++ b/.ci/pipelines/value_files/diff-values_showcase_EKS.yaml
@@ -52,4 +52,5 @@ upstream:
       alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
       alb.ingress.kubernetes.io/ssl-redirect: "443"
       external-dns.alpha.kubernetes.io/hostname: $EKS_INSTANCE_DOMAIN_NAME
-orchestrator: null
+orchestrator:
+  enabled: false
diff --git a/.ci/pipelines/value_files/diff-values_showcase_GKE.yaml b/.ci/pipelines/value_files/diff-values_showcase_GKE.yaml
index af5d7ea7bf..0129443106 100644
--- a/.ci/pipelines/value_files/diff-values_showcase_GKE.yaml
+++ b/.ci/pipelines/value_files/diff-values_showcase_GKE.yaml
@@ -72,4 +72,5 @@ upstream:
       ingress.gcp.kubernetes.io/pre-shared-cert: ""
       networking.gke.io/v1beta1.FrontendConfig: rhdh-gke-ingress-security-config
     className: gce
-orchestrator: null
+orchestrator:
+  enabled: false
diff --git a/.ci/pipelines/value_files/diff-values_showcase_OSD-GCP.yaml b/.ci/pipelines/value_files/diff-values_showcase_OSD-GCP.yaml
index 68072eafb5..2b523290af 100644
--- a/.ci/pipelines/value_files/diff-values_showcase_OSD-GCP.yaml
+++ b/.ci/pipelines/value_files/diff-values_showcase_OSD-GCP.yaml
@@ -4,7 +4,8 @@
 # The only exception is global.dynamic.plugins, that gets merged with the base file.
 
 # Disable orchestrator for OSD-GCP due to infrastructure limitations
-orchestrator: null
+orchestrator:
+  enabled: false
 
 global:
   dynamic:
diff --git a/.ci/pipelines/value_files/diff-values_showcase_upgrade.yaml b/.ci/pipelines/value_files/diff-values_showcase_upgrade.yaml
index e89df06861..6d6c9b8016 100644
--- a/.ci/pipelines/value_files/diff-values_showcase_upgrade.yaml
+++ b/.ci/pipelines/value_files/diff-values_showcase_upgrade.yaml
@@ -1 +1,2 @@
-orchestrator: null
+orchestrator:
+  enabled: false

From 4cd1983e9d7c2b2a1d1ff2b46e7730de9a89f783 Mon Sep 17 00:00:00 2001
From: Gustavo Lira <guga.java@gmail.com>
Date: Tue, 24 Mar 2026 15:48:42 -0300
Subject: [PATCH 10/10] fix(ci): add wait_for_operator_rollout to
 ocp-operator.sh after each deploy

Address review comment from zdrapela on PR #4423: ocp-operator.sh was
missing wait_for_operator_rollout calls after deploy_rhdh_operator,
inconsistent with AKS/EKS/GKE scripts. Added the wait in all 5 call
sites across initiate_operator_deployments,
initiate_operator_deployments_osd_gcp, and
run_operator_runtime_config_change_tests to prevent the same race
condition on OCP deployments.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .ci/pipelines/jobs/ocp-operator.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.ci/pipelines/jobs/ocp-operator.sh b/.ci/pipelines/jobs/ocp-operator.sh
index bdd6f97ae4..97dd5c536e 100644
--- a/.ci/pipelines/jobs/ocp-operator.sh
+++ b/.ci/pipelines/jobs/ocp-operator.sh
@@ -22,6 +22,7 @@ initiate_operator_deployments() {
   oc apply -f /tmp/configmap-dynamic-plugins.yaml -n "${NAME_SPACE}"
   deploy_redis_cache "${NAME_SPACE}"
   deploy_rhdh_operator "${NAME_SPACE}" "${DIR}/resources/rhdh-operator/rhdh-start.yaml"
+  wait_for_operator_rollout "${NAME_SPACE}" "backstage-${RELEASE_NAME}"
   # TODO: https://issues.redhat.com/browse/RHDHBUGS-2184 fix orchestrator workflows deployment on operator
   # enable_orchestrator_plugins_op "${NAME_SPACE}"
   # deploy_orchestrator_workflows_operator "${NAME_SPACE}"
@@ -35,6 +36,7 @@ initiate_operator_deployments() {
   create_dynamic_plugins_config "${DIR}/value_files/${HELM_CHART_RBAC_VALUE_FILE_NAME}" "/tmp/configmap-dynamic-plugins-rbac.yaml"
   oc apply -f /tmp/configmap-dynamic-plugins-rbac.yaml -n "${NAME_SPACE_RBAC}"
   deploy_rhdh_operator "${NAME_SPACE_RBAC}" "${DIR}/resources/rhdh-operator/rhdh-start-rbac.yaml"
+  wait_for_operator_rollout "${NAME_SPACE_RBAC}" "backstage-${RELEASE_NAME_RBAC}"
   # TODO: https://issues.redhat.com/browse/RHDHBUGS-2184 fix orchestrator workflows deployment on operator
   # enable_orchestrator_plugins_op "${NAME_SPACE_RBAC}"
   # deploy_orchestrator_workflows_operator "${NAME_SPACE_RBAC}"
@@ -59,6 +61,7 @@ initiate_operator_deployments_osd_gcp() {
   oc apply -f /tmp/configmap-dynamic-plugins.yaml -n "${NAME_SPACE}"
   deploy_redis_cache "${NAME_SPACE}"
   deploy_rhdh_operator "${NAME_SPACE}" "${DIR}/resources/rhdh-operator/rhdh-start.yaml"
+  wait_for_operator_rollout "${NAME_SPACE}" "backstage-${RELEASE_NAME}"
 
   # Skip orchestrator plugins and workflows for OSD-GCP
   log::warn "Skipping orchestrator plugins and workflows deployment on OSD-GCP environment"
@@ -77,6 +80,7 @@ initiate_operator_deployments_osd_gcp() {
 
   oc apply -f /tmp/configmap-dynamic-plugins-rbac.yaml -n "${NAME_SPACE_RBAC}"
   deploy_rhdh_operator "${NAME_SPACE_RBAC}" "${DIR}/resources/rhdh-operator/rhdh-start-rbac.yaml"
+  wait_for_operator_rollout "${NAME_SPACE_RBAC}" "backstage-${RELEASE_NAME_RBAC}"
 
   # Skip orchestrator plugins and workflows for OSD-GCP RBAC
   log::warn "Skipping orchestrator plugins and workflows deployment on OSD-GCP RBAC environment"
@@ -88,6 +92,7 @@ run_operator_runtime_config_change_tests() {
   oc apply -f "$DIR/resources/postgres-db/dynamic-plugins-root-PVC.yaml" -n "${NAME_SPACE_RUNTIME}"
   create_app_config_map "$DIR/resources/postgres-db/rds-app-config.yaml" "${NAME_SPACE_RUNTIME}"
   deploy_rhdh_operator "${NAME_SPACE_RUNTIME}" "${DIR}/resources/rhdh-operator/rhdh-start-runtime.yaml"
+  wait_for_operator_rollout "${NAME_SPACE_RUNTIME}" "backstage-${RELEASE_NAME}"
   local runtime_url="https://backstage-${RELEASE_NAME}-${NAME_SPACE_RUNTIME}.${K8S_CLUSTER_ROUTER_BASE}"
   run_tests "${RELEASE_NAME}" "${NAME_SPACE_RUNTIME}" "${PW_PROJECT_SHOWCASE_RUNTIME}" "${runtime_url}"
 }