Skip to content

ROX-33021: Add better DX to develop plugin against sensor-proxy#19463

Draft
dvail wants to merge 2 commits intomasterfrom
dv/ROX-33021-better-plugin-dev-via-sensor-proxy
Draft

ROX-33021: Add better DX to develop plugin against sensor-proxy#19463
dvail wants to merge 2 commits intomasterfrom
dv/ROX-33021-better-plugin-dev-via-sensor-proxy

Conversation

@dvail
Copy link
Contributor

@dvail dvail commented Mar 17, 2026 •
edited
Loading

Description

Adds a script that exposes sensor-proxy via LoadBalancer, a NetworkPolicy to allow external traffic, and a CronJob to auto-cleanup these resources after a short period of time. This script is called automatically when starting a local OpenShift console container for development against the console plugin.

Why do we want this

This allows plugin developers to start the console in dev mode and connect to an OpenShift cluster via the production network path, instead of directly to a publicly exposed central with a hard coded API token.

Benefits:

  1. Develop against the true e2e flow used in production
  2. Requests are authorized and scoped appropriately via sensor-proxy (using the API token results in incorrect data when simulating a plugin response)
  3. Reduces to a single start-ocp-console.sh script, without the need for additional env vars and configuration

User-facing documentation

Testing and quality

  • the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
  • CI results are inspected

Automated testing

  • added unit tests
  • added e2e tests
  • added regression tests
  • added compatibility tests
  • modified existing tests

How I validated my change

Verify that ./scripts/start-ocp-console.sh starts the local Console correctly and loads the dev version of the dynamic plugin.

Verify that data visible in the console plugin is correctly scoped to the cluster and namespace it belongs to.

Verify that the resources are created correctly, and are automatically cleaned up after the time limit with:

oc -n stackrox get cronjobs
oc -n stackrox get services
oc -n stackrox get networkpolicy

@dvail
Copy link
Contributor Author

dvail commented Mar 17, 2026

This change is part of the following stack:

Change managed by git-spice.

@openshift-ci
Copy link

openshift-ci bot commented Mar 17, 2026

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@rhacs-bot
Copy link
Contributor

rhacs-bot commented Mar 17, 2026

Images are ready for the commit at 067fd75.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.11.x-345-g067fd75c3e.

@codecov
Copy link

codecov bot commented Mar 17, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.32%. Comparing base (2654a0e) to head (067fd75).
⚠️ Report is 10 commits behind head on master.

Additional details and impacted files 
@@            Coverage Diff             @@
##           master   #19463      +/-   ##
==========================================
- Coverage   49.37%   49.32%   -0.05%     
==========================================
  Files        2713     2722       +9     
  Lines      204977   205171     +194     
==========================================
- Hits       101207   101201       -6     
- Misses      96242    96438     +196     
- Partials     7528     7532       +4
Flag Coverage Δ
go-unit-tests 49.32% <ø> (-0.05%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

dvail
dvail commented Mar 17, 2026
View reviewed changes
ui/apps/platform/webpack.ocp-plugin.config.js
Comment on lines -251 to -252
// Default to `/proxy/central` if not set
'process.env.ACS_PROXY_BASE_PATH': JSON.stringify(process.env.ACS_PROXY_BASE_PATH),
Copy link
Contributor Author

@dvail dvail Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since it is no longer recommended or necessary to bypass the proxy and route directly to central, there is no need to ever modify this base path.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area/ui do-not-merge/work-in-progress

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@dvail @rhacs-bot