Procedure

1. For security, store your secrets as environment variables values in an OpenShift Container Platform secret, rather than in plain text in your configuration files. Collect all your secrets in the secrets.txt file, with one secret per line in KEY=value form.

   Enter your authentication secrets. :_mod-docs-content-type: SNIPPET

2. Author your custom app-config.yaml file. This is the main Developer Hub configuration file. You need a custom app-config.yaml file to avoid the Developer Hub installer to revert user edits during upgrades. When your custom app-config.yaml file is empty, Developer Hub is using default values.

   • To prepare a deployment with the Red Hat Developer Hub Operator on OpenShift Container Platform, you can start with an empty file.

   • To prepare a deployment with the Red Hat Developer Hub Helm chart, or on Kubernetes, enter the Developer Hub base URL in the relevant fields in your app-config.yaml file to ensure proper functionality of Developer Hub. The base URL is what a Developer Hub user sees in their browser when accessing Developer Hub. The relevant fields are baseUrl in the app and backend sections, and origin in the backend.cors subsection:

     Configuring the baseUrl in app-config.yaml:

     app:
       title: Red Hat Developer Hub
       baseUrl: https://<my_developer_hub_domain>
     
     backend:
       auth:
         externalAccess:
           - type: legacy
             options:
               subject: legacy-default-config
               secret: "${BACKEND_SECRET}"
       baseUrl: https://<my_developer_hub_domain>
       cors:
         origin: https://<my_developer_hub_domain>

   • Optionally, enter your configuration such as:

     • Authentication in Red Hat Developer Hub.
     • Authorization in Red Hat Developer Hub.
     • Customization.
     • Configure your OpenShift Container Platform integration.

3. Author your custom dynamic-plugins.yaml file to enable plugins. By default, Developer Hub enables a minimal plugin set, and disables plugins that require configuration or secrets, such as the GitHub repository discovery plugin and the Role-based access control (RBAC) plugin.

   Enable the GitHub repository discovery and the RBAC features:

   dynamic.plugins.yaml

   includes:
     - dynamic-plugins.default.yaml
   plugins:
     - package: ./dynamic-plugins/dist/backstage-plugin-catalog-backend-module-github
       disabled: false
     - package: ./dynamic-plugins/dist/backstage-community-plugin-rbac
       disabled: false

4. Provision your custom configuration files to your OpenShift Container Platform cluster.

   1. Create the <my-rhdh-project> {namespace} aimed at containing your Developer Hub instance.

      $ oc create namespace my-rhdh-project

   2. Create config maps for your app-config.yaml and dynamic-plugins.yaml files in the <my-rhdh-project> project.

      $ oc create configmap my-rhdh-app-config --from-file=app-config.yaml --namespace=my-rhdh-project
      $ oc create configmap dynamic-plugins-rhdh --from-file=dynamic-plugins.yaml --namespace=my-rhdh-project

      You can also create the config maps by using the web console.

   3. Provision your secrets.txt file to the my-rhdh-secrets secret in the <my-rhdh-project> project.

      $ oc create secret generic my-rhdh-secrets --from-file=secrets.txt --namespace=my-rhdh-project

      You can also create the secret by using the web console.

Procedure

1. Author your Backstage CR in a my-rhdh-custom-resource.yaml file to use your custom config maps and secrets.

   Minimal my-rhdh-custom-resource.yaml custom resource example:

   apiVersion: rhdh.redhat.com/v1alpha5
   kind: Backstage
   metadata:
     name: my-rhdh-custom-resource
   spec:
     application:
       appConfig:
         mountPath: /opt/app-root/src
         configMaps:
            - name: my-rhdh-app-config
       extraEnvs:
         secrets:
            - name: <my_product_secrets>
       extraFiles:
         mountPath: /opt/app-root/src
       route:
         enabled: true
     database:
       enableLocalDb: true

   my-rhdh-custom-resource.yaml custom resource example with dynamic plugins and RBAC policies config maps, and external PostgreSQL database secrets:

   apiVersion: rhdh.redhat.com/v1alpha5
   kind: Backstage
   metadata:
     name: <my-rhdh-custom-resource>
   spec:
     application:
       appConfig:
         mountPath: /opt/app-root/src
         configMaps:
            - name: my-rhdh-app-config
            - name: rbac-policies
       dynamicPluginsConfigMapName: dynamic-plugins-rhdh
       extraEnvs:
         secrets:
            - name: <my_product_secrets>
            - name: my-rhdh-database-secrets
       extraFiles:
         mountPath: /opt/app-root/src
         secrets:
           - name: my-rhdh-database-certificates-secrets
             key: postgres-crt.pem, postgres-ca.pem, postgres-key.key
       route:
         enabled: true
     database:
       enableLocalDb: false

   Mandatory fields

   No fields are mandatory. You can create an empty Backstage CR and run Developer Hub with the default configuration.

   Optional fields

   spec.application.appConfig.configMaps

   Enter your config map name list.

   Mount files in the my-rhdh-app-config config map:

   spec:
     application:
       appConfig:
         mountPath: /opt/app-root/src
         configMaps:
            - name: my-rhdh-app-config

   Mount files in the my-rhdh-app-config and rbac-policies config maps:

   spec:
     application:
       appConfig:
         mountPath: /opt/app-root/src
         configMaps:
            - name: my-rhdh-app-config
            - name: rbac-policies

   spec.application.extraEnvs.envs

   Optionally, enter your additional environment variables that are not secrets, such as your proxy environment variables.

   Inject your HTTP_PROXY, HTTPS_PROXY and NO_PROXY environment variables:

   spec:
     application:
       extraEnvs:
         envs:
           - name: HTTP_PROXY
             value: 'http://10.10.10.105:3128'
           - name: HTTPS_PROXY
             value: 'http://10.10.10.106:3128'
           - name: NO_PROXY
             value: 'localhost,example.org'

   spec.application.extraEnvs.secrets

   Enter your environment variables secret name list.

   Inject the environment variables in your Red Hat Developer Hub secret:

   spec:
     application:
       extraEnvs:
         secrets:
            - name: <my_product_secrets>

   Inject the environment variables in the Red Hat Developer Hub and my-rhdh-database-secrets secrets:

   spec:
     application:
       extraEnvs:
         secrets:
            - name: <my_product_secrets>
            - name: my-rhdh-database-secrets

   Note

   <my_product_secrets> is your preferred Developer Hub secret name, specifying the identifier for your secret configuration within Developer Hub.

   spec.application.extraFiles.secrets

   Enter your certificates files secret name and files list.

   Mount the postgres-crt.pem, postgres-ca.pem, and postgres-key.key files contained in the my-rhdh-database-certificates-secrets secret:

   spec:
     application:
       extraFiles:
         mountPath: /opt/app-root/src
         secrets:
           - name: my-rhdh-database-certificates-secrets
             key: postgres-crt.pem, postgres-ca.pem, postgres-key.key

   spec.database.enableLocalDb

   Enable or disable the local PostgreSQL database.

   Disable the local PostgreSQL database generation to use an external postgreSQL database:

   spec:
     database:
       enableLocalDb: false

   On a development environment, use the local PostgreSQL database:

   spec:
     database:
       enableLocalDb: true

   spec.deployment

   Optionally, enter your deployment configuration.

2. Apply your Backstage CR to start or update your Developer Hub instance:

   $ oc apply --filename=my-rhdh-custom-resource.yaml --namespace=my-rhdh-project

Procedure

1. Configure Helm to use your custom configuration files in Developer Hub.

   1. Go to the Helm tab to see the list of Helm releases.
   2. Click the overflow menu on the Helm release that you want to use and select Upgrade.
   3. Use the YAML view to edit the Helm configuration.

   4. Set the value of the upstream.backstage.extraAppConfig.configMapRef and upstream.backstage.extraAppConfig.filename parameters as follows:

      Helm configuration excerpt

      upstream:
        backstage:
          extraAppConfig:
            - configMapRef: my-rhdh-app-config
              filename: app-config.yaml

   5. Click Upgrade.

Procedure

1. Optional: Create a certificate secret to configure your PostgreSQL instance with a TLS connection:

   $ cat <<EOF | oc -n my-rhdh-project create -f -
   apiVersion: v1
   kind: Secret
   metadata:
    name: my-rhdh-database-certificates-secrets
   type: Opaque
   stringData:
    postgres-ca.pem: |-
     -----BEGIN CERTIFICATE-----
     <ca_certificate_key>
    postgres-key.key: |-
     -----BEGIN CERTIFICATE-----
     <tls_private_key>
    postgres-crt.pem: |-
     -----BEGIN CERTIFICATE-----
     <tls_certificate_key>
     # ...
   EOF

   Where:

   my-rhdh-database-certificates-secrets

   The certificate secret name.

   <ca_certificate_key>

   The CA certificate key.

   <tls_private_key>

   Optional: The TLS private key.

   <tls_certificate_key>

   Optional: The TLS certificate key.

2. Create a credential secret to connect to the PostgreSQL instance:

   $ cat <<EOF | oc -n my-rhdh-project create -f -
   apiVersion: v1
   kind: Secret
   metadata:
    name: my-rhdh-database-secrets
   type: Opaque
   stringData:
    POSTGRES_PASSWORD: <password>
    POSTGRES_PORT: "<db_port>"
    POSTGRES_USER: <username>
    POSTGRES_HOST: <db_host>
    PGSSLMODE: <ssl_mode>
    NODE_EXTRA_CA_CERTS: <abs_path_to_pem_file>
   EOF

   Where:

   my-rhdh-database-secrets

   The credential secret name.

   <password>

   The password to connect to your PostgreSQL instance.

   <db_port>

   Your PostgreSQL instance port number, such as 5432.

   <username>

   The user name to connect to your PostgreSQL instance.

   <db_host>

   Your PostgreSQL instance DNS or IP address.

   <ssl_mode>

   Optional: For TLS connections, the required SSL mode.

   <abs_path_to_pem_file>

   Optional: For TLS connections, the absolute path to the Privacy-Enhanced Mail (PEM) file, for example /opt/app-root/src/postgres-crt.pem.

3. Create your Backstage custom resource (CR):

   cat <<EOF | oc -n my-rhdh-project create -f -
   apiVersion: rhdh.redhat.com/v1alpha5
   kind: Backstage
   metadata:
     name: <backstage_instance_name>
   spec:
     database:
       enableLocalDb: false
     application:
       extraFiles:
         mountPath: <path>
         secrets:
           - name: my-rhdh-database-certificates-secrets
             key: postgres-crt.pem, postgres-ca.pem, postgres-key.key
       extraEnvs:
         secrets:
           - name: my-rhdh-database-secrets
           # ...

   Where:

   spec.database.enableLocalDb

   Set to false to disable creating local PostgreSQL instances.

   <path>

   The mount path for certificate files, for example /opt/app-root/src.

   my-rhdh-database-certificates-secrets

   The certificate secret name, required if you configure a TLS connection.

   key

   The key names as defined in the my-rhdh-database-certificates-secrets Secret.

   my-rhdh-database-secrets

   The credential secret name.

   Note

   The environment variables listed in the Backstage CR work with the Operator default configuration. If you have changed the Operator default configuration, you must reconfigure the Backstage CR accordingly.

4. Apply the Backstage CR to the namespace where you have deployed the Developer Hub instance.

Procedure

1. Optional: Create a certificate secret to configure your PostgreSQL instance with a TLS connection:

   $ cat <<EOF | oc -n <your_namespace> create -f -
   apiVersion: v1
   kind: Secret
   metadata:
    name: my-rhdh-database-certificates-secrets
   type: Opaque
   stringData:
    postgres-ca.pem: |-
     -----BEGIN CERTIFICATE-----
     <ca_certificate_key>
    postgres-key.key: |-
     -----BEGIN CERTIFICATE-----
     <tls_private_key>
    postgres-crt.pem: |-
     -----BEGIN CERTIFICATE-----
     <tls_certificate_key>
     # ...
   EOF

   Where:

   my-rhdh-database-certificates-secrets

   The certificate secret name.

   <ca_certificate_key>

   The CA certificate key.

   <tls_private_key>

   Optional: The TLS private key.

   <tls_certificate_key>

   Optional: The TLS certificate key.

2. Create a credential secret to connect to the PostgreSQL instance:

   $ cat <<EOF | oc -n <your_namespace> create -f -
   apiVersion: v1
   kind: Secret
   metadata:
    name: my-rhdh-database-secrets
   type: Opaque
   stringData:
    POSTGRES_PASSWORD: <password>
    POSTGRES_PORT: "<db_port>"
    POSTGRES_USER: <username>
    POSTGRES_HOST: <db_host>
    PGSSLMODE: <ssl_mode>
    NODE_EXTRA_CA_CERTS: <abs_path_to_pem_file>
   EOF

   Where:

   my-rhdh-database-secrets

   The credential secret name.

   <password>

   The password to connect to your PostgreSQL instance.

   <db_port>

   Your PostgreSQL instance port number, such as 5432.

   <username>

   The user name to connect to your PostgreSQL instance.

   <db_host>

   Your PostgreSQL instance DNS or IP address.

   <ssl_mode>

   Optional: For TLS connections, the required SSL mode.

   <abs_path_to_pem_file>

   Optional: For TLS connections, the absolute path to the Privacy-Enhanced Mail (PEM) file, for example /opt/app-root/src/postgres-crt.pem.

3. Configure your PostgreSQL instance in the Helm configuration file named values.yaml:

   # ...
   upstream:
     postgresql:
       enabled: false
       auth:
         existingSecret: my-rhdh-database-secrets
     backstage:
       appConfig:
         backend:
           database:
             connection:
               host: ${POSTGRES_HOST}
               port: ${POSTGRES_PORT}
               user: ${POSTGRES_USER}
               password: ${POSTGRES_PASSWORD}
               ssl:
                 rejectUnauthorized: true,
                 ca:
                   $file: /opt/app-root/src/postgres-ca.pem
                 key:
                   $file: /opt/app-root/src/postgres-key.key
                 cert:
                   $file: /opt/app-root/src/postgres-crt.pem
     extraEnvVarsSecrets:
       - my-rhdh-database-secrets
     extraEnvVars:
       - name: BACKEND_SECRET
         valueFrom:
           secretKeyRef:
             key: backend-secret
             name: '{{ include "janus-idp.backend-secret-name" $ }}'
     extraVolumeMounts:
       - mountPath: /opt/app-root/src/dynamic-plugins-root
         name: dynamic-plugins-root
       - mountPath: /opt/app-root/src/postgres-crt.pem
         name: postgres-crt
         subPath: postgres-crt.pem
       - mountPath: /opt/app-root/src/postgres-ca.pem
         name: postgres-ca
         subPath: postgres-ca.pem
       - mountPath: /opt/app-root/src/postgres-key.key
         name: postgres-key
         subPath: postgres-key.key
     extraVolumes:
       - ephemeral:
           volumeClaimTemplate:
             spec:
               accessModes:
                 - ReadWriteOnce
               resources:
                 requests:
                   storage: 1Gi
         name: dynamic-plugins-root
       - configMap:
           defaultMode: 420
           name: dynamic-plugins
           optional: true
         name: dynamic-plugins
       - name: dynamic-plugins-npmrc
         secret:
           defaultMode: 420
           optional: true
           secretName: '{{ printf "%s-dynamic-plugins-npmrc" .Release.Name }}'
       - name: postgres-crt
         secret:
           secretName: my-rhdh-database-certificates-secrets
           # ...

   Where:

   upstream.postgresql.enabled

   Set to false to disable the local PostgreSQL instance creation.

   upstream.postgresql.auth.existingSecret

   The credentials secret to inject into Backstage.

   upstream.backstage.appConfig.backend.database.connection

   The Backstage database connection parameters.

   upstream.backstage.extraEnvVarsSecrets

   The credentials secret to inject as environment variables into Backstage.

   extraVolumeMounts (postgres-crt, postgres-ca, postgres-key)

   Optional: Inject TLS certificate, CA certificate, and TLS private key into the Backstage container.

   extraVolumes (postgres-crt)

   The certificate secret name, required if you configure TLS.

4. Apply the configuration changes in your Helm configuration file named values.yaml:

   $ helm upgrade -n <your_namespace> <your_deploy_name> openshift-helm-charts/redhat-developer-hub -f values.yaml --version 1.9.0

Procedure

1. Configure port forwarding for the local PostgreSQL database pod by running the following command on a terminal:

   $ oc port-forward -n <your_namespace> <pgsql_pod_name> <forward_to_port>:<forward_from_port>

   Where:

2. The <pgsql_pod_name> variable denotes the name of a PostgreSQL pod with the format backstage-psql-<deployment_name>-<_index>.
3. The <forward_to_port> variable denotes the port of your choice to forward PostgreSQL data to.

4. The <forward_from_port> variable denotes the local PostgreSQL instance port, such as 5432.

   Example: Configuring port forwarding

   $ oc port-forward -n developer-hub backstage-psql-developer-hub-0 15432:5432

5. Make a copy of the following db_copy.sh script and edit the details based on your configuration:

   #!/bin/bash
   
   to_host=<db_service_host>
   to_port=5432
   to_user=postgres
   
   from_host=127.0.0.1
   from_port=15432
   from_user=postgres
   
   allDB=("backstage_plugin_app" "backstage_plugin_auth" "backstage_plugin_catalog" "backstage_plugin_permission" "backstage_plugin_scaffolder" "backstage_plugin_search")
   
   for db in ${!allDB[@]};
   do
     db=${allDB[$db]}
     echo Copying database: $db
     PGPASSWORD=$TO_PSW psql -h $to_host -p $to_port -U $to_user -c "create database $db;"
     pg_dump -h $from_host -p $from_port -U $from_user -d $db | PGPASSWORD=$TO_PSW psql -h $to_host -p $to_port -U $to_user -d $db
   done

   Where:

   to_host

   The destination hostname, for example <db_instance_name>.rds.amazonaws.com.

   to_port

   The destination port, such as 5432.

   to_user

   The destination server username, for example postgres.

   from_host

   The source hostname, such as 127.0.0.1.

   from_port

   The source port number, such as the <forward_to_port> variable.

   from_user

   The source server username, for example postgres.

   allDB

   Database names to import, in double quotes separated by spaces.

6. Create a destination database for copying the data:

   /bin/bash TO_PSW=<destination_db_password> /path/to/db_copy.sh

   Replace <destination_db_password> with the password to connect to the destination database.

   Note

   You can stop port forwarding when the copying of the data is complete. For more information about handling large databases and using the compression tools, see the Handling Large Databases section on the PostgreSQL website.

7. Reconfigure your Backstage custom resource (CR). For more information, see Configure an external PostgreSQL instance using the Operator.

8. Check that the following code is present at the end of your Backstage CR after reconfiguration:

   # ...
   spec:
     database:
       enableLocalDb: false
     application:
     # ...
       extraFiles:
         secrets:
           - name: my-rhdh-database-certificates-secrets
             key: postgres-crt.pem
       extraEnvs:
         secrets:
           - name: my-rhdh-database-secrets
   # ...

   Note

   Reconfiguring the Backstage CR deletes the corresponding StatefulSet and Pod objects, but does not delete the PersistenceVolumeClaim object. Use the following command to delete the local PersistenceVolumeClaim object:

   oc -n developer-hub delete pvc <local_psql_pvc_name>

   where, the <local_psql_pvc_name> variable is in the data-<psql_pod_name> format.

9. Apply the configuration changes.

Verification

1. Verify that your RHDH instance is running with the migrated data and does not contain the local PostgreSQL database by running the following command:

   oc get pods -n <your_namespace>

2. Check the output for the following details:
3. The backstage-developer-hub-xxx pod is in running state.

4. The backstage-psql-developer-hub-0 pod is not available.

   You can also verify these details by using the Topology view in the OpenShift Container Platform web console.

Procedure

1. Perform one of the following steps based on your role:

2. As an administrator, set the proxy information in the Operator’s default ConfigMap file:

   1. Search for a ConfigMap file named backstage-default-config in the default namespace rhdh-operator and open it.
   2. Find the deployment.yaml key.

   3. Set the value of the HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables in the Deployment spec as shown in the following example:

      Example: Setting proxy variables in a ConfigMap file

      # ...
        deployment.yaml: |-
          apiVersion: apps/v1
          kind: Deployment
          spec:
            template:
              spec:
                # ...
                initContainers:
                  - name: install-dynamic-plugins
                    # ...
                    env:
                      - name: NPM_CONFIG_USERCONFIG
                        value: /opt/app-root/src/.npmrc.dynamic-plugins
                      - name: HTTP_PROXY
                        value: 'http://10.10.10.105:3128'
                      - name: HTTPS_PROXY
                        value: 'http://10.10.10.106:3128'
                      - name: NO_PROXY
                        value: 'localhost,example.org'
                    # ...
                containers:
                  - name: backstage-backend
                    # ...
                    env:
                      - name: APP_CONFIG_backend_listen_port
                        value: "7007"
                      - name: HTTP_PROXY
                        value: 'http://10.10.10.105:3128'
                      - name: HTTPS_PROXY
                        value: 'http://10.10.10.106:3128'
                      - name: NO_PROXY
                        value: 'localhost,example.org'

3. As a developer, set the proxy information in your Backstage CR file as shown in the following example:

   Example: Setting proxy variables in a CR file

   spec:
     # ...
     application:
       extraEnvs:
         envs:
           - name: HTTP_PROXY
             value: 'http://10.10.10.105:3128'
           - name: HTTPS_PROXY
             value: 'http://10.10.10.106:3128'
           - name: NO_PROXY
             value: 'localhost,example.org'

4. Save the configuration changes.

Procedure

1. Set the proxy information in your Helm configuration file:

   upstream:
     backstage:
       extraEnvVars:
         - name: HTTP_PROXY
           value: '<http_proxy_url>'
         - name: HTTPS_PROXY
           value: '<https_proxy_url>'
         - name: NO_PROXY
           value: '<no_proxy_settings>'

   Where,

   <http_proxy_url>

   Denotes a variable that you must replace with the HTTP proxy URL.

   <https_proxy_url>

   Denotes a variable that you must replace with the HTTPS proxy URL.

   <no_proxy_settings>

   Denotes a variable that you must replace with comma-separated URLs, which you want to exclude from proxying, for example, <example1>.com,<example2>.com.

   Example: Setting proxy variables by using the Helm Chart

   upstream:
     backstage:
       extraEnvVars:
         - name: HTTP_PROXY
           value: 'http://10.10.10.105:3128'
         - name: HTTPS_PROXY
           value: 'http://10.10.10.106:3128'
         - name: NO_PROXY
           value: 'localhost,example.org'

2. Save the configuration changes.

Procedure

1. Create the persistent volume definition and save it to a file, such as pvc.yaml. For example:

   kind: PersistentVolumeClaim
   apiVersion: v1
   metadata:
     name: dynamic-plugins-root
   spec:
     accessModes:
       - ReadWriteOnce
     resources:
       requests:
         storage: 5Gi

   Note

   This example uses ReadWriteOnce as the access mode which prevents many replicas from sharing the PVC across different nodes. To run many replicas on different nodes, depending on your storage driver, you must use an access mode such as ReadWriteMany.

2. To apply this PVC to your cluster, run the following command:

   $ oc apply -f pvc.yaml

3. Replace the default dynamic-plugins-root volume with a PVC named dynamic-plugins-root. For example:

   apiVersion: rhdh.redhat.com/v1alpha5
   kind: Backstage
   metadata:
     name: developer-hub
   spec:
     deployment:
       patch:
         spec:
           template:
             spec:
               volumes:
                 - $patch: replace
                   name: dynamic-plugins-root
                   persistentVolumeClaim:
                     claimName: dynamic-plugins-root

   Note

   To avoid adding a new volume, you must use the $patch: replace directive.

Procedure

1. In the Backstage Custom Resource (CR) file, set spec.deployment to use the optional StatefulSet as a resource kind. For example:

   apiVersion: rhdh.redhat.com/v1alpha5
   kind: Backstage
   metadata:
     name: <CR_name>
   ...
   spec:
    deployment:
     kind: StatefulSet
     patch:
      spec:
        replicas: 2
        template:
          spec:
            volumes:
              - $patch: replace
                name: dynamic-plugins-root
                persistentVolumeClaim:
                  claimName: dynamic-plugins-root
        volumeClaimTemplates:
          - apiVersion: v1
            kind: PersistentVolumeClaim
            metadata:
              name: dynamic-plugins-root
            spec:
              accessModes:
                - ReadWriteOnce
              resources:
                requests:
                  storage: 1Gi

   Note

   Using StatefulSet with a single replica can lead to downtime, while the application deletes the old pod and creates a new pod.

2. Wait a few minutes until the Operator reconciles the CR and the StatefulSet resource is ready.

3. If you are updating an existing CR, remove the earlier Deployment resource from the cluster:

   oc delete deployment -l app.kubernetes.io/instance=<CR_name>

   Note

   The same requirement applies for changing the resource kind from StatefulSet to Deployment. You must manually delete the resource created before from the cluster, because the Operator does not automatically remove the legacy resource.

Procedure

1. Create the persistent volume definition. For example:

   kind: PersistentVolumeClaim
   apiVersion: v1
   metadata:
     name: dynamic-plugins-root
   spec:
     accessModes:
       - ReadWriteOnce
     resources:
       requests:
         storage: 5Gi

   Note

   This example uses ReadWriteOnce as the access mode which prevents many replicas from sharing the PVC across different nodes. To run many replicas on different nodes, depending on your storage driver, you must use an access mode such as ReadWriteMany.

2. To apply this PVC to your cluster, run the following command:

   $ oc apply -f pvc.yaml

3. Configure the Helm chart to use the PVC. For example:

   upstream:
     backstage:
       extraVolumes:
         - name: dynamic-plugins-root
           persistentVolumeClaim:
             claimName: dynamic-plugins-root
         - name: dynamic-plugins
           configMap:
             defaultMode: 420
             name: '{{ printf "%s-dynamic-plugins" .Release.Name }}'
             optional: true
         - name: dynamic-plugins-npmrc
           secret:
             defaultMode: 420
             optional: true
             secretName: '{{ printf "%s-dynamic-plugins-npmrc" .Release.Name }}'
         - name: dynamic-plugins-registry-auth
           secret:
             defaultMode: 416
             optional: true
             secretName: '{{ printf "%s-dynamic-plugins-registry-auth" .Release.Name }}'
         - name: npmcacache
           emptyDir: {}
         - name: temp
           emptyDir: {}

   Note

   When you configure the Helm chart to use the PVC, you must also include the extraVolumes section defined in the default Helm chart values.

Procedure

1. For extraEnvVars, add the following content to your values.yaml file:

   extraEnvVars:
         - name: BACKEND_SECRET
           valueFrom:
             secretKeyRef:
               key: backend-secret
               name: '{{ include "janus-idp.backend-secret-name" $ }}'
         - name: POSTGRESQL_ADMIN_PASSWORD
           valueFrom:
             secretKeyRef:
               key: postgres-password
               name: '{{- include "janus-idp.postgresql.secretName" . }}'

2. For extraVolumeMounts, add the following content to your values.yaml file:

   extraVolumeMounts:
         - name: dynamic-plugins-root
           mountPath: /opt/app-root/src/dynamic-plugins-root
         - name: temp
           mountPath: /tmp

3. For extraVolume, add the following content to your values.yaml file:

   extraVolumes:
         - name: dynamic-plugins-root
           ephemeral:
             volumeClaimTemplate:
               spec:
                 accessModes:
                   - ReadWriteOnce
                 resources:
                   requests:
                     storage: 5Gi