Image Mirror Support for Dynamic Plugins by gazarenkov · Pull Request #3601 · redhat-developer/rhdh-operator

gazarenkov · 2026-09-22T07:08:56Z

Description

Adds automatic OCI image mirroring for dynamic plugins, compatible with OpenShift ImageDigestMirrorSet (IDMS) format for air-gapped and disconnected environments.

Transparently rewrites plugin OCI references using mirror configuration:

plugins-mirror/mirrors.yaml

  imageDigestMirrors:
    - source: quay.io/rhdh
      mirrors:
        - registry.internal.corp:5000/rhdh

Original plugin reference:
package: oci://quay.io/rhdh/backstage-plugin-techdocs@sha256:abc123...
Automatically transformed to:
package: oci://registry.internal.corp:5000/rhdh/backstage-plugin-techdocs@sha256:abc123...

IDMS-compatible format: Same structure as OpenShift ImageDigestMirrorSet
Most-specific match: Longest source prefix wins (e.g., quay.io/foo/bar beats quay.io/foo)
OCI-only: Only transforms oci:// URLs; npm, HTTP, and file:// unchanged
Configuration: Read from $LOCALBIN/plugins-mirror/mirrors.yaml

Which issue(s) does this PR fix or relate to

https://redhat.atlassian.net/browse/RHIDP-15003

PR acceptance criteria

Tests
Documentation

How to test changes / Special notes to the reviewer

mirror plugins to your-registry.example.com/rhdh repo
Create a ConfigMap in the operator's namespace (e.g., rhdh-operator) like:

kubectl create configmap plugins-mirror -n rhdh-operator \
   --from-literal=mirrors.yaml='
 imageDigestMirrors:
   - source: quay.io/rhdh
     mirrors:
       - your-registry.example.com/rhdh

start operator
check status.plugins's urls

Container Images

Container images are built and pushed to Quay automatically when relevant files change.
Image links will be posted in a PR comment once the push completes.

rhdh-qodo-merge · 2026-09-22T07:09:43Z

PR Summary by Qodo

Add OCI Image Mirroring for Dynamic Plugins

✨ Enhancement 🐞 Bug fix 🧪 Tests 📝 Documentation ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Rewrites OCI dynamic-plugin references using optional, IDMS-compatible mirror configuration.
• Mounts mirror configuration across operator deployment, bundle, and distribution manifests.
• Documents air-gapped setup and tests matching, parsing, and non-OCI preservation.

Diagram

graph TD
  CM[("Mirror ConfigMap")] --> VM["Operator Mount"] --> SP["Spec Preprocessor"] --> MC["Mirror Rules"] --> DP["Plugin Processor"] --> PL["Package List"] --> PI["Plugin Installer"] --> MR[("Mirror Registry")]

High-Level Assessment

The following are alternative approaches to this PR:

1. Watch the ConfigMap through Kubernetes APIs

➕ Applies configuration changes without restarting the operator
➕ Supports validation and reconciliation when the ConfigMap changes
➖ Requires additional RBAC and watch lifecycle management
➖ Adds controller complexity for a rarely changing air-gap configuration

2. Read OpenShift ImageDigestMirrorSet resources directly

➕ Eliminates duplicate mirror configuration on OpenShift
➕ Tracks cluster-level mirror policy automatically
➖ Introduces an OpenShift-specific API dependency
➖ May unintentionally apply image-runtime policy to plugin-level fetching
➖ Reduces Kubernetes portability

Recommendation: Keep the optional mounted ConfigMap approach because it is portable, deployment-friendly, and reuses the familiar IDMS schema without depending on OpenShift APIs. A watched ConfigMap is the best future extension if restart-free updates become a requirement.

Files changed (13) +504 / -6

Enhancement (4) +101 / -0

spec_preprocessor.goLoad mirror rules during specification preprocessing +6/-0

Load mirror rules during specification preprocessing
• Reads the mounted mirror configuration into external model configuration. Invalid or unreadable configuration now stops preprocessing with contextual errors.
internal/controller/spec_preprocessor.go

dynamic-plugins-mirror.goImplement IDMS-compatible OCI mirror resolution +90/-0

Implement IDMS-compatible OCI mirror resolution
• Defines mirror configuration models, reads mirrors.yaml from the mounted path, and rewrites OCI references using the longest matching source prefix and first mirror.
pkg/model/dynamic-plugins-mirror.go

dynamic-plugins.goRewrite enabled OCI plugin packages through configured mirrors +4/-0

Rewrite enabled OCI plugin packages through configured mirrors
• Applies mirror resolution before enabled plugin references are recorded and written to the plugin installer package list.
pkg/model/dynamic-plugins.go

externalconfig.goCarry mirror configuration in the external model +1/-0

Carry mirror configuration in the external model
• Adds parsed image mirror rules to ExternalConfig so dynamic-plugin model generation can access them.
pkg/model/externalconfig.go

Bug fix (1) +15 / -2

oci.goMake insecure OCI fetching use plain HTTP references +15/-2

Make insecure OCI fetching use plain HTTP references

• Tracks insecure mode on the fetcher and parses references with name.Insecure. WithInsecure now enables HTTP registry access in addition to skipping TLS verification.

pkg/fetcher/oci.go

Refactor (1) +0 / -2

deployment.goPreserve the plugin installer image pull policy +0/-2

Preserve the plugin installer image pull policy
• Removes the temporary override that forced dynamic-plugin init containers to use PullAlways.
pkg/model/deployment.go

Tests (1) +267 / -0

dynamic-plugins-mirror_test.goTest mirror matching and configuration parsing +267/-0

Test mirror matching and configuration parsing
• Covers absent and malformed configuration, OCI-only rewriting, digest references, longest-prefix selection, empty mirrors, and first-mirror behavior.
pkg/model/dynamic-plugins-mirror_test.go

Documentation (1) +84 / -0

admin.mdDocument dynamic-plugin registry mirroring +84/-0

Document dynamic-plugin registry mirroring

• Explains ConfigMap setup, IDMS-compatible matching behavior, restart requirements, verification, and reuse of existing OpenShift IDMS configuration.

docs/admin.md

Other (5) +37 / -2

backstage-operator.clusterserviceversion.yamlMount optional mirror configuration in the Backstage operator bundle +8/-1

Mount optional mirror configuration in the Backstage operator bundle
• Adds a read-only /plugins-mirror mount backed by the optional plugin-registry-mirror ConfigMap. Regenerates the bundle creation timestamp.
bundle/backstage.io/manifests/backstage-operator.clusterserviceversion.yaml

backstage-operator.clusterserviceversion.yamlMount optional mirror configuration in the RHDH operator bundle +8/-1

Mount optional mirror configuration in the RHDH operator bundle
• Adds the mirror ConfigMap volume and read-only operator mount to the RHDH ClusterServiceVersion. Regenerates the bundle creation timestamp.
bundle/rhdh/manifests/backstage-operator.clusterserviceversion.yaml

deployment.yamlExpose plugin mirror configuration to the operator manager +7/-0

Expose plugin mirror configuration to the operator manager
• Defines an optional plugin-registry-mirror ConfigMap volume and mounts it read-only at /plugins-mirror.
config/manager/deployment.yaml

install.yamlInclude mirror configuration in the Backstage install manifest +7/-0

Include mirror configuration in the Backstage install manifest
• Propagates the optional mirror ConfigMap volume and mount into the generated Backstage installation manifest.
dist/backstage.io/install.yaml

install.yamlInclude mirror configuration in the RHDH install manifest +7/-0

Include mirror configuration in the RHDH install manifest
• Propagates the optional mirror ConfigMap volume and mount into the generated RHDH installation manifest.
dist/rhdh/install.yaml

rhdh-qodo-merge · 2026-09-22T07:12:32Z

Code Review by Qodo

🐞 Bugs (2) 📘 Rule violations (1) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. ~~Sibling plugins use wrong mirrors~~ ✓ Resolved 🔗 Cross-repo conflict ≡ Correctness

Description

ApplyMirror uses strings.HasPrefix without validating OCI registry or repository boundaries, so
sources such as quay.io, quay.io/foo, or the Orchestrator frontend repository also match
distinct hosts, repositories, and sibling -backend or -form-widgets artifacts. When those
separately published plugins are enabled, the partial prefix is replaced and the incorrect reference
flows into the installer package list and plugin status.

Code

pkg/model/dynamic-plugins-mirror.go[46]
+		if strings.HasPrefix(ociRef, m.Source) {

Relevance

●●● Strong
Boundary-sensitive OCI reference parsing bugs are accepted when textual matching can target the
wrong artifact.
PR-#3215

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The cited implementation performs an unrestricted textual prefix match, replaces that same partial
prefix, and passes the transformed value into dynamic-plugin processing before packages.txt and
plugin status are constructed. The rhdh-plugins contract includes separately published OCI
repositories whose names share the Orchestrator frontend repository as a textual prefix, while
examples such as quay.io versus quay.io.example and quay.io/foo versus quay.io/foobar show
that the same logic also crosses registry and repository boundaries.
pkg/model/dynamic-plugins-mirror.go[44-58]
pkg/model/dynamic-plugins.go[172-177]
pkg/model/dynamic-plugins-mirror.go[37-58]
pkg/model/dynamic-plugins.go[172-178]
pkg/model/dynamic-plugins.go[168-180]
internal/controller/backstage_status.go[222-229]
External repo: redhat-developer/rhdh-plugins, workspaces/orchestrator/docs/dynamic-plugin-installation.md [12-14]
External repo: redhat-developer/rhdh-plugins, workspaces/orchestrator/docs/dynamic-plugin-installation.md [45-49]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`ApplyMirror` treats arbitrary string prefixes as mirror-source matches, allowing a rule intended for one OCI registry, namespace, or repository to rewrite distinct hosts, similarly named repositories, and separately published sibling plugin artifacts. The resulting incorrect references are consumed by installation and exposed in plugin status.

## Fix Focus Areas
- pkg/model/dynamic-plugins-mirror.go[37-59]
- pkg/model/dynamic-plugins-mirror_test.go[12-132]

## Recommended Fix
Parse or normalize the OCI source and package reference and compare registry and repository path components rather than unrestricted raw prefixes. Match only an exact source or a reference that continues at a valid OCI boundary appropriate to the parsed reference, then replace only that validated prefix. Add table-driven tests proving that `quay.io/foo` does not match `quay.io/foobar`, `quay.io` does not match `quay.io.example`, and `backstage-plugin-orchestrator` does not match `backstage-plugin-orchestrator-backend` or its other sibling repositories; also cover exact repositories, namespaces, tags or digests, and registry ports so valid matches continue to work while unrelated references remain unchanged.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

2. ~~Registry credentials travel unencrypted~~ ✓ Resolved 🐞 Bug ⛨ Security

Description

OCIFetcher.Fetch passes name.Insecure whenever WithInsecure is selected, changing an option
exposed to callers as a certificate-verification bypass into plain HTTP while still attaching the
configured keychain. Catalogs or plugins that set skipTLSVerify or INSECURE for an authenticated
HTTPS registry consequently use an unencrypted connection, while HTTPS-only registries stop working.

Code

pkg/fetcher/oci.go[R118-121]

+	if c.insecure {
+		// Use HTTP protocol and allow insecure registries
+		imgRef, err = name.ParseReference(ref, name.Insecure)
+	} else {

Relevance

●●● Strong
Recent fetcher security findings fixing silent or unsafe registry behavior were accepted.
PR-#3422
PR-#3466

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
Both public caller-facing controls describe skipping TLS verification, but the changed fetch path
explicitly selects HTTP and still supplies registry authentication through
remote.WithAuthFromKeychain.
pkg/fetcher/oci.go[51-62]
pkg/fetcher/oci.go[116-134]
api/v1alpha5/devhubplugincatalog_types.go[31-34]
cmd/plugin-fetch/main.go[20-25]
pkg/catalog/processor.go[119-127]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The existing certificate-verification bypass now marks registry references for plain HTTP, exposing authenticated requests and breaking HTTPS-only registries.

## Fix Focus Areas
- pkg/fetcher/oci.go[51-62]
- pkg/fetcher/oci.go[116-134]
- api/v1alpha5/devhubplugincatalog_types.go[31-34]
- cmd/plugin-fetch/main.go[20-25]

## Recommended Fix
Preserve HTTPS for `WithInsecure` by configuring only `InsecureSkipVerify` and parsing references normally. If plain HTTP registries must be supported, add a separate explicit option and configuration field for that behavior.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

3. ~~Plugin installation runs stale code~~ ✓ Resolved 🐞 Bug ☼ Reliability

Description

BackstageDeployment.addToModel still replaces the dynamic-plugin init-container image with
RELATED_IMAGE_plugin_installer, but no longer forces PullAlways, leaving the deployment
template’s IfNotPresent policy in effect. Because the bundled operator supplies the mutable
rhdh-plugin-installer:next tag, recreating a pod on a node where that tag is cached can install
plugins with an older installer instead of retrieving the updated image.

Code

pkg/model/deployment.go[L128-129]

-			// TODO temporarily until stabilize
-			b.podSpec().InitContainers[i].ImagePullPolicy = corev1.PullAlways

Relevance

●● Moderate
Stale mutable installer images are a credible reliability issue, but no close precedent confirms
this exact policy choice.
PR-#2000
PR-#3289

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The deployment model replaces the init-container image during operator processing but, after the
policy assignment was deleted, leaves its pull policy unchanged. The default deployment template
sets that policy to IfNotPresent, while the shipped RHDH CSV configures the replacement image with
the mutable :next tag, establishing that a cached image can be reused after the tag is updated.
pkg/model/deployment.go[106-130]
config/profile/rhdh/default-config/deployment.yaml[48-58]
bundle/rhdh/manifests/backstage-operator.clusterserviceversion.yaml[340-350]
pkg/model/deployment.go[119-130]
config/profile/rhdh/default-config/deployment.yaml[49-57]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The operator-selected dynamic-plugin installer image inherits the deployment template’s `IfNotPresent` policy even though the bundled related image uses a mutable `:next` tag. Nodes can therefore reuse an outdated cached installer after the tag is updated and a pod is recreated.

## Fix Focus Areas
- pkg/model/deployment.go[113-130]
- config/profile/rhdh/default-config/deployment.yaml[49-57]
- pkg/model/deployment_test.go[52-75]

## Recommended Fix
Restore `corev1.PullAlways` when operator dynamic-plugin processing replaces the init-container image, or ship and select an immutable digest instead. Add a deployment-model test asserting that the selected installer container has the resulting pull policy.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

4. Empty mirror entries break plugin installs 🐞 Bug ☼ Reliability

Description

readMirrorConfigFromFile accepts empty source and mirror strings, while ApplyMirror checks only
the mirror slice length before replacing the source with its first value. A configuration containing
mirrors: [""] therefore emits a malformed package such as oci:///rhdh/plugin:1.0 into the
installer input instead of rejecting the configuration.

Code

pkg/model/dynamic-plugins-mirror.go[R55-58]

+	// Apply the most specific mirror
+	if bestMatch != nil && len(bestMatch.Mirrors) > 0 {
+		mirrored := strings.Replace(ociRef, bestMatch.Source, bestMatch.Mirrors[0], 1)
+		return "oci://" + mirrored

Relevance

●●● Strong
Malformed configuration should be rejected before generating installer input; validation fixes in
nearby model code are accepted.
PR-#3098
PR-#3215

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
YAML is returned without semantic validation, the first mirror is used solely based on slice length,
and the resulting package string is appended verbatim to the generated package list.
pkg/model/dynamic-plugins-mirror.go[55-58]
pkg/model/dynamic-plugins-mirror.go[75-89]
pkg/model/dynamic-plugins.go[172-178]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Syntactically valid YAML containing empty mirror values is accepted and converted into invalid OCI package references.

## Fix Focus Areas
- pkg/model/dynamic-plugins-mirror.go[75-89]
- pkg/model/dynamic-plugins-mirror.go[44-58]
- pkg/model/dynamic-plugins-mirror_test.go[145-247]

## Recommended Fix
Validate every configured source and mirror after unmarshalling, rejecting empty or malformed values with a descriptive configuration error. Add tests for empty sources, empty first mirrors, and whitespace-only values.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

5. Example installs leave mirroring off 📘 Rule violation ✧ Quality

Description

config/manager/deployment.yaml adds a plugin-registry-mirror ConfigMap volume, but neither that
manifest set nor either generated install bundle defines the ConfigMap. Applying these bundles
succeeds only because the reference is optional, so the operator starts without mirrors.yaml until
users create an undeclared dependency.

Code

config/manager/deployment.yaml[R119-122]

+        - name: mirror-config
+          configMap:
+            name: plugin-registry-mirror
+            optional: true

Relevance

●●● Strong
Manifest completeness is an explicit repository rule; referenced optional ConfigMaps should be
declared in example bundles.
ⓘ Recommendations generated based on similar findings in past PRs

Evidence
Compliance rule 1 requires ConfigMaps referenced by volume definitions to have a corresponding stub
in the same manifest set. The new deployment, CSV, and generated installation definitions all
reference plugin-registry-mirror, while the repository contains no matching ConfigMap manifest
outside the standalone documentation example.
Rule 1: Include all dependent Kubernetes resources in example manifests
config/manager/deployment.yaml[119-122]
dist/backstage.io/install.yaml[3115-3118]
dist/rhdh/install.yaml[4567-4570]
bundle/backstage.io/manifests/backstage-operator.clusterserviceversion.yaml[310-313]
bundle/rhdh/manifests/backstage-operator.clusterserviceversion.yaml[423-426]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The operator deployment and generated installation bundles reference `plugin-registry-mirror`, but the corresponding ConfigMap is absent from those manifest sets.

## Fix Focus Areas
- config/manager/deployment.yaml[119-122]
- dist/backstage.io/install.yaml[3115-3118]
- dist/rhdh/install.yaml[4567-4570]
- bundle/backstage.io/manifests/backstage-operator.clusterserviceversion.yaml[310-313]
- bundle/rhdh/manifests/backstage-operator.clusterserviceversion.yaml[423-426]

## Recommended Fix
Add a namespaced `plugin-registry-mirror` ConfigMap manifest containing a clearly documented placeholder `mirrors.yaml`, such as `imageDigestMirrors: []`, to each applicable installation set. Update the source manifests first and regenerate the distribution and bundle artifacts so every deployment reference has a corresponding resource.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

6. Backstage operators do not restart 🐞 Bug ⚙ Maintainability

Description

The new mirroring instructions hard-code the RHDH deployment and namespace in the rollout command
despite stating that backstage-system is also supported. Users of the Backstage distribution have
a backstage-operator deployment in backstage-system, so that command fails and the required
restart does not load their mirror configuration.

Code

docs/admin.md[R119-123]

+2. Restart the operator pod to load the configuration:
+
+```bash
+kubectl rollout restart deployment rhdh-operator -n rhdh-operator
+```

Relevance

●●● Strong
Documentation corrections for distribution-specific commands and namespaces are consistently
accepted.
PR-#3312
PR-#1827

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The added text names both supported namespaces but only provides the RHDH deployment command. The
generated installers prove that the Backstage variant uses a different deployment name and
namespace.
docs/admin.md[88-123]
dist/backstage.io/install.yaml[3008-3020]
dist/rhdh/install.yaml[4439-4450]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

Issue description
The mirroring documentation supports both Backstage and RHDH operator namespaces but supplies only the RHDH rollout command. Backstage-distribution users cannot restart their actual operator by following this procedure.

Fix Focus Areas
- docs/admin.md[88-123]
- dist/backstage.io/install.yaml[3008-3020]
- dist/rhdh/install.yaml[4439-4450]

Recommended Fix
Replace the hard-coded rollout command with instructions that select the installed operator deployment and namespace, or show separate commands for `backstage-operator` in `backstage-system` and `rhdh-operator` in `rhdh-operator`.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Context sources

⚠️ Tickets: not configured — ticket URL found in PR but could not be fetched — check ticket provider credentials

✅ Compliance rules (platform): 18 rules

✅ Cross-repo context — repo relationships

Explored: repo: redhat-appstudio/backstage-community-plugins (sha: 7eb22666)

Explored: repo: redhat-developer/rhdh (sha: f940cef5)

Explored: repo: redhat-developer/rhdh-plugins (sha: 436e7247)

Review mode: 🧠 Deep: This introduces security-sensitive OCI registry behavior and configuration-driven URL rewriting across multiple runtime paths and deployment manifests, with several independent edge cases that warrant redundant review.

Tip of the day

💡 Did you know, you can keep summaries lean with Finding overflow, which tucks the rest behind 'View more'

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

rhdh-qodo-merge · 2026-09-22T07:12:42Z

Important

The /generate_labels command by Qodo is sunsetting on the 1st of October 2026 and will no longer be available. We recommend switching to the latest Qodo review capabilities. Learn more

github-actions · 2026-09-22T07:12:54Z

✅ PR images built and pushed successfully!

Images are available for testing (expires in 7 days):

Image	Full tag	PR tag
Operator	`quay.io/rhdh-community/operator:2.0.0-pr-3601-a7857b9`	`quay.io/rhdh-community/operator:2.0.0-pr-3601`
Bundle	`quay.io/rhdh-community/operator-bundle:2.0.0-pr-3601-a7857b9`	`quay.io/rhdh-community/operator-bundle:2.0.0-pr-3601`
Catalog	`quay.io/rhdh-community/operator-catalog:2.0.0-pr-3601-a7857b9`	`quay.io/rhdh-community/operator-catalog:2.0.0-pr-3601`

codecov · 2026-09-22T07:14:04Z

Codecov Report

❌ Patch coverage is 79.36508% with 13 lines in your changes missing coverage. Please review.
✅ Project coverage is 60.35%. Comparing base (618a8d9) to head (768db9b).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/fetcher/oci.go	50.00%	6 Missing ⚠️
cmd/plugin-fetch/main.go	0.00%	3 Missing ⚠️
internal/controller/spec_preprocessor.go	33.33%	1 Missing and 1 partial ⚠️
pkg/catalog/processor.go	0.00%	1 Missing ⚠️
pkg/model/dynamic-plugins-mirror.go	97.61%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3601      +/-   ##
==========================================
+ Coverage   60.00%   60.35%   +0.35%     
==========================================
  Files          51       52       +1     
  Lines        3560     3620      +60     
==========================================
+ Hits         2136     2185      +49     
- Misses       1230     1240      +10     
- Partials      194      195       +1

Flag	Coverage Δ
nightly	`?`
unittests	`60.35% <79.36%> (+0.35%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
pkg/model/deployment.go	`81.22% <100.00%> (ø)`
pkg/model/dynamic-plugins.go	`80.09% <100.00%> (+0.09%)`	⬆️
pkg/model/externalconfig.go	`42.10% <ø> (ø)`
pkg/catalog/processor.go	`36.76% <0.00%> (ø)`
pkg/model/dynamic-plugins-mirror.go	`97.61% <97.61%> (ø)`
internal/controller/spec_preprocessor.go	`35.25% <33.33%> (-0.04%)`	⬇️
cmd/plugin-fetch/main.go	`10.95% <0.00%> (-0.16%)`	⬇️
pkg/fetcher/oci.go	`59.55% <50.00%> (-0.45%)`	⬇️

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

github-actions · 2026-09-22T10:38:09Z

✅ PR images built and pushed successfully!

Images are available for testing (expires in 7 days):

Image	Full tag	PR tag
Operator	`quay.io/rhdh-community/operator:2.0.0-pr-3601-232704e`	`quay.io/rhdh-community/operator:2.0.0-pr-3601`
Bundle	`quay.io/rhdh-community/operator-bundle:2.0.0-pr-3601-232704e`	`quay.io/rhdh-community/operator-bundle:2.0.0-pr-3601`
Catalog	`quay.io/rhdh-community/operator-catalog:2.0.0-pr-3601-232704e`	`quay.io/rhdh-community/operator-catalog:2.0.0-pr-3601`

github-actions · 2026-09-22T12:11:52Z

✅ PR images built and pushed successfully!

Images are available for testing (expires in 7 days):

Image	Full tag	PR tag
Operator	`quay.io/rhdh-community/operator:2.0.0-pr-3601-74393a1`	`quay.io/rhdh-community/operator:2.0.0-pr-3601`
Bundle	`quay.io/rhdh-community/operator-bundle:2.0.0-pr-3601-74393a1`	`quay.io/rhdh-community/operator-bundle:2.0.0-pr-3601`
Catalog	`quay.io/rhdh-community/operator-catalog:2.0.0-pr-3601-74393a1`	`quay.io/rhdh-community/operator-catalog:2.0.0-pr-3601`

sonarqubecloud · 2026-09-23T13:56:11Z

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

github-actions · 2026-09-23T13:58:01Z

✅ PR images built and pushed successfully!

Images are available for testing (expires in 7 days):

Image	Full tag	PR tag
Operator	`quay.io/rhdh-community/operator:2.1.0-pr-3601-768db9b`	`quay.io/rhdh-community/operator:2.1.0-pr-3601`
Bundle	`quay.io/rhdh-community/operator-bundle:2.1.0-pr-3601-768db9b`	`quay.io/rhdh-community/operator-bundle:2.1.0-pr-3601`
Catalog	`quay.io/rhdh-community/operator-catalog:2.1.0-pr-3601-768db9b`	`quay.io/rhdh-community/operator-catalog:2.1.0-pr-3601`

gazarenkov added 4 commits September 21, 2026 10:51

mirrors

7c96f1b

mirrors

0fe363d

mirrors

4c1bfe0

bundle

a7857b9

gazarenkov requested a review from a team as a code owner September 22, 2026 07:08

openshift-ci Bot requested review from rm3l and subhashkhileri September 22, 2026 07:09

rhdh-qodo-merge Bot reviewed Sep 22, 2026

View reviewed changes

Comment thread pkg/fetcher/oci.go

Comment thread pkg/model/deployment.go

Comment thread pkg/model/dynamic-plugins-mirror.go Outdated

rhdh-qodo-merge Bot added documentation Improvements or additions to documentation enhancement New feature or request Tests labels Sep 22, 2026

fix

232704e

fix

5ead3ab

openshift-ci Bot added the needs-rebase label Sep 22, 2026

Merge branch 'main' into plugin-mirror

74393a1

openshift-ci Bot removed the needs-rebase label Sep 22, 2026

zdrapela mentioned this pull request Sep 23, 2026

fix(ci): override stale RELATED_IMAGE_backstage digest in the operator CSV redhat-developer/rhdh#5435

Merged

Merge branch 'main' into plugin-mirror

768db9b

Navigation Menu

Image Mirror Support for Dynamic Plugins - #3601

Image Mirror Support for Dynamic Plugins#3601
gazarenkov wants to merge 8 commits into
redhat-developer:mainfrom
gazarenkov:plugin-mirror

gazarenkov commented Sep 22, 2026 •

edited

Loading

Uh oh!

rhdh-qodo-merge Bot commented Sep 22, 2026

Uh oh!

rhdh-qodo-merge Bot commented Sep 22, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rhdh-qodo-merge Bot commented Sep 22, 2026

Uh oh!

github-actions Bot commented Sep 22, 2026

Uh oh!

codecov Bot commented Sep 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 22, 2026

Uh oh!

github-actions Bot commented Sep 22, 2026

Uh oh!

sonarqubecloud Bot commented Sep 23, 2026

Uh oh!

github-actions Bot commented Sep 23, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

gazarenkov commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Which issue(s) does this PR fix or relate to

PR acceptance criteria

How to test changes / Special notes to the reviewer

Container Images

Uh oh!

rhdh-qodo-merge Bot commented Sep 22, 2026

PR Summary by Qodo

Uh oh!

rhdh-qodo-merge Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rhdh-qodo-merge Bot commented Sep 22, 2026

Uh oh!

github-actions Bot commented Sep 22, 2026

Uh oh!

codecov Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Sep 22, 2026

Uh oh!

github-actions Bot commented Sep 22, 2026

Uh oh!

sonarqubecloud Bot commented Sep 23, 2026

Quality Gate passed

Uh oh!

github-actions Bot commented Sep 23, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

gazarenkov commented Sep 22, 2026 •

edited

Loading

rhdh-qodo-merge Bot commented Sep 22, 2026 •

edited

Loading

codecov Bot commented Sep 22, 2026 •

edited

Loading