feat!: introduce new standalone RHDH Chart [RHDHPLAN-1058] - #438
Open
Conversation
…ency Helm cannot merge lists, so when users set extraVolumes/extraEnvVars on the current chart, the entire default list is replaced — forcing them to copy-paste all system defaults just to add one item. This is a Day 2 maintenance burden that grows with every release. This new chart at charts/rhdh/ owns all Kubernetes templates directly and uses an "add, don't replace" pattern: system-required volumes, mounts, env vars, and init containers are hardcoded in the Deployment template, while user-provided values are always appended. Users can now add a volume without knowing or duplicating the system defaults. The values layout is flattened to match helm-create conventions (replicaCount, image, service at root level) — no more navigating global.*/upstream.backstage.* nesting to set basic options. Assisted-by: Claude
The new rhdh chart owns all Kubernetes templates directly and no longer depends on the upstream Backstage subchart, so the weekly sync workflow and its helper script are no longer needed. Assisted-by: Claude
rm3l
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…ove-helm-chart-configuration-experience-via-standalone-rhdh-helm-chart-without-backstage-subchart-dependency # Conflicts: # .github/workflows/sync-upstream-backstage.yaml
Assisted-by: Claude
Port test scenarios from charts/backstage/ci/ with key paths adjusted for the flat values layout. The custom-dynamic-pvc-claim-spec scenario is dropped because the new chart hardcodes the dynamic-plugins-root volume (user volumes are appended, not replaced). Assisted-by: Claude
Add global.imageRegistry, global.imagePullSecrets, and global.defaultStorageClass so they flow through to both the postgresql subchart and the rhdh chart's own templates. Image helpers now delegate to bitnami common's common.images.image, and imagePullSecrets are merged from both global and root-level sources. Lightspeed container images converted from strings to structured registry/repository/tag maps so global.imageRegistry applies uniformly to all containers. Also pins the test pod image to curl/curl:8.9.1 instead of latest, adds automountServiceAccountToken: false and ephemeral-storage requests to the test pod (SonarCloud findings). Assisted-by: Claude
The previous version (12.10.0) was far behind. The new version requires global.security.allowInsecureImages=true since we use a Fedora-based PostgreSQL image instead of the bitnami one. Assisted-by: Claude
Assisted-by: Claude
…ion-experience-via-standalone-rhdh-helm-chart-without-backstage-subchart-dependency
…ove-helm-chart-configuration-experience-via-standalone-rhdh-helm-chart-without-backstage-subchart-dependency # Conflicts: # .github/workflows/sync-upstream-backstage.yaml
…anch chart-testing's --upgrade flag checks out the target branch and tries to build dependencies for the chart there. For brand-new charts like charts/rhdh/ that do not exist on main yet, this causes helm dependency build to fail. Make --upgrade conditional: when a specific chart is tested, check whether its Chart.yaml exists on the target branch first. If not, skip the upgrade test and only run a fresh install. Also rename the backstageChartChanged output to orchestratorCrdsNeeded and include charts/rhdh so that Knative and SonataFlow CRDs are installed for both charts' orchestrator CI scenarios.
On vanilla K8s (KinD), there is no SCC to assign a common UID to all containers in a pod. Set fsGroup so shared volumes (e.g. RAG data) are group-writable across init containers and sidecars that may run as different UIDs. Also disable the route, which is not available on KinD.
Without a default appConfig, no app-config ConfigMap is created and the RHDH application lacks essential configuration (base URLs, CORS, database connection, backend auth), causing it to fail to start. Add a default appConfig matching the backstage chart, providing: - app.baseUrl and backend.baseUrl from rhdh.hostname - backend.cors.origin - backend.database.connection (postgres user, password from env var) - backend.auth.externalAccess (legacy service-to-service auth)
…ion-experience-via-standalone-rhdh-helm-chart-without-backstage-subchart-dependency
Accept incoming changes, bumping backstage chart to 6.2.1. Keep our deletion of sync-upstream-backstage.yaml.
…[RHIDP-14726] Align the rhdh chart with the backstage chart change from PR redhat-developer#453: use `enabled: true` instead of `disabled: false` for dynamic plugin entries in values, schema, CI files, and documentation. Assisted-by: Claude
…ack to 0.5.2 Use --no-preserve=mode,ownership when copying RAG data so the sidecar (UID 1001) can access files written by the init container (UID 65532). Pre-create the notebooks subdirectory and chmod the copied data to prevent PermissionError on vanilla Kubernetes. Also bump lightspeed-stack sidecar from 0.5.1 to 0.5.2. Refs: - redhat-developer#460 - redhat-developer#461 Assisted-by: Claude
The RAG init container permission fix (--no-preserve=mode,ownership + chmod) makes a shared UID unnecessary. Only fsGroup is needed, matching the backstage chart CI setup. Assisted-by: Claude
…on detection sonar.exclusions only covers bug/vulnerability analysis. Add sonar.cpd.exclusions to also exclude the backstage chart from the Copy-Paste Detector, fixing the duplication alert on rhdh-profile.py.
SonarCloud auto-analysis ignores sonar-project.properties and reads .sonarcloud.properties instead. Move the exclusions there and add sonar.cpd.exclusions to exclude the deprecated backstage chart from duplication detection. Remove the unused sonar-project.properties.
…or test pod Wire up global.imagePullSecrets via the rhdh.imagePullSecrets helper, make imagePullPolicy configurable via test.image.pullPolicy, and allow overriding the container securityContext via test.securityContext.
- Update orchestrator externalDB examples to use nested keys (externalDB.existingSecret/name/host/port) instead of flat keys - Show proper dynamicPlugins.plugins YAML structure in notifications example - Fix argsOverride/extraArgs descriptions not rendering in values table - Update test pod section to mention pullPolicy and securityContext - Fix typo: recieve -> receive
… K8s example - Document *Override fields (envOverride, commandOverride, etc.) as escape hatches from the "add, don't replace" pattern - Replace inaccurate "automatic hostname discovery" note with actual hostname derivation logic - Remove runAsUser/runAsGroup from vanilla Kubernetes example
The RUNNER_DEBUG gate in the test-charts action already adds --debug to ct when needed; having it hardcoded in ct-install.yaml caused noisy helm debug logs on every CI run.
Replace deprecated backstage chart paths and values structure with rhdh chart equivalents in docs, CONTRIBUTING.md, and orchestrator-software-templates.
The default appConfig.backend.database.connection now references
${POSTGRES_HOST}, ${POSTGRES_PORT}, and ${POSTGRES_USER} env vars
that the chart already injects. This eliminates the need for users
to duplicate externalDatabase connection info in appConfig overrides.
Simplify docs/external-db.md accordingly: remove the redundant
appConfig block, fix externalDatabase to use literal values instead
of env var references, and split secrets (password vs TLS env vars).
|
Member
Author
openshift-ci
Bot
requested review from
Fortune-Ndlovu,
gazarenkov,
kadel and
zdrapela
July 23, 2026 15:33
PR Summary by QodoIntroduce standalone RHDH Helm chart and deprecate legacy Backstage chart
AI Description
Diagram
High-Level Assessment
Files changed (55)
|
Code Review by Qodo
Context used✅ Cross-repo context Explored:
repo: redhat-developer/rhdh (sha: d090bd1a) Explored:
repo: redhat-developer/rhdh-plugins (sha: 83d8a479) Explored:
repo: redhat-developer/rhdh-must-gather (sha: b51bef59) 1. Backend secret rotates
|
rhdh-qodo-merge
Bot
added
documentation
Jdubrick
reviewed
Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of the change
This PR introduces a standalone
rhdhchart that aims to simplify the Helm Chart configuration experience. To do this, it needs to own all Kubernetes templates directly, removing the subchart dependency entirely. See RHDHPLAN-1058 and RHDHPLAN-869 for the full rationale.Design decisions
extraVolumes,extraEnv,extraInitContainers, etc. are always appended after system defaults so users never have to duplicate chart internals. When full control is needed,envOverride,argsOverride,commandOverride, andenvFromOverridereplace the system defaults entirely.lightspeed.*,orchestrator.*) with their own plugin lists, sidecar/init-container settings, and volume management; rather than requiring users to manually assemble dynamic plugin entries and extra containers.Backstage chart deprecation
The
backstagechart is markeddeprecated: trueand excluded from CI on main. It remains fully functional on release-1.y branches. Thesync-upstream-backstageworkflow is removed since there is no longer an upstream subchart to sync.CI and tooling alignment
rhdhinstead ofbackstage; duplication detection excludes the deprecated chart via.sonarcloud.properties.--debugflag fromct-install.yaml.helm-dependency-updatehook.Which issue(s) does this PR fix or relate to
ref RHDHPLAN-1058
How to test changes / Special notes to the reviewer
ct lint --charts charts/rhdhshould pass with no warnings.helm template test charts/rhdhshould render all resources without errors. Verify the dynamic-plugins ConfigMap contains onlyincludesandplugins(no leakedinitContainer,volume, etc.).charts/rhdh/ci/cover the main scenarios (default, lightspeed disabled, orchestrator enabled, custom PVC). Runct install --charts charts/rhdh --config ct-install.yamlon a KinD cluster..github/workflows/nightly.yaml; thediscover-chartsjob should produce{branch, chart}pairs respecting each branch'sct.yamlexclusions.backstageis still inct.yamland testable.A subsequent PR will add some detailed guidance (and maybe some tooling) to help migrate from the legacy chart to this one.
Checklist
Chart.yamlaccording to Semantic Versioning.values.yamland added to the corresponding README.md.pre-commithook.ct lintcommand.