ACM-42568 Migrate the console backend to Go

[Ginxo]

• ACM-42589: Rename backend directory to backend-node

Move the existing Node.js console backend into backend-node/ and update repository references, build scripts, CI configs, and documentation so the renamed package remains the single backend entry point.

• ACM-42589: Add Go console backend with Node sidecar proxy

Introduce a Go public listener in backend/ that owns TLS, health probes, shared config, and auth helpers while reverse-proxying unmigrated routes to the existing Node implementation in backend-node/.

Strategy (executive summary)

This change follows a strangler-fig migration:

1. Free the backend path — the existing Node server was moved to backend-node/ so backend/ can host the new Go entry point without breaking historical paths for config, certs, and .env.
2. Dual-process local dev — Go listens on BACKEND_PORT (4000) as the browser-facing backend; Node runs as a sidecar on NODE_BACKEND_PORT (4001) for routes not yet ported.
3. Proxy-first cutover — Go registers only health endpoints natively; all other traffic is forwarded to the sidecar with the original URL (including /multicloud) so the Node router keeps working unchanged.
4. Shared runtime artifacts — backend/.env, backend/config/, and backend/certs/ remain the single source of truth; the sidecar reads them via ENV_FILE, CONFIG_DIR, and CERTS_DIR.
5. Incremental porting — new Go packages (internal/server, proxy, health, config, auth) establish the foundation; routes can migrate from Node to Go one at a time without frontend changes.

Root npm scripts, setup, and docs were updated for the Go + sidecar workflow.

• ACM-42589: Adopt golangci-lint for Go backend and fix initial findings

Replace go vet with golangci-lint in backend check/lint scripts, add a backend/.golangci.yml config, and introduce scripts/golangci-lint-backend.sh to install and run the linter. Fix the first lint findings: variable shadowing in main.go and server_test.go, and US spelling in the RBAC informer comment. Update AGENTS.md and Makefile.prow to include the new backend lint/check steps.

• ACM-42589: Validate RBAC event tokens via /api and skip logger wrapping for SSE

Replace the TokenReviewer-based auth in the RBAC events handler with a new ValidateUserToken helper that checks tokens by GET /api, matching the Node sidecar behavior and avoiding TokenReview failures for some identities. Also bypass the request logger response wrapper for /events/rbac so HTTP/2 can flush SSE events to EventSource.

• ACM-42589: Revert incomplete RBAC merge that breaks Go backend build

The RBAC event token validation commit referenced APIs from ACM-42589_roles (RESTConfig, WithRBACEvents, events/rbac) that are not on this branch, so go run ./cmd/console failed and the plugin proxy could not reach :4000.

• ACM-42589: Add Air live reload for Go backend development

Configure github.com/air-verse/air to rebuild and restart the Go console backend when cmd/ or internal/ files change. Add scripts/air-backend.sh to install Air if missing, wire it into npm run start:backend:go, and update AGENTS.md, .gitignore, and clean scripts for the new backend/tmp directory.

• Use named constants for Bearer authorization scheme prefix in token extraction

• Go to 1.26

• ACM-42589: Migrate ClusterRole watch to Go /events/rbac SSE (Cluster Page Delta - Discovered Cluster Initial implementation #47)

• ACM-42589: Migrate ClusterRole watch to Go /events/rbac SSE

Move vm-clusterroles ClusterRole watching from the Node sidecar to a dedicated Go SSE stream with per-user SSAR filtering, and wire the frontend to consume it via LoadRbacEvents while keeping Search-based role assignments on the sidecar.

• ACM-42589: Adopt golangci-lint for Go backend and fix initial findings

Replace go vet with golangci-lint in backend check/lint scripts, add a backend/.golangci.yml config, and introduce scripts/golangci-lint-backend.sh to install and run the linter. Fix the first lint findings: variable shadowing in main.go and server_test.go, and US spelling in the RBAC informer comment. Update AGENTS.md and Makefile.prow to include the new backend lint/check steps.

• ACM-42589: Validate RBAC event tokens via /api and skip logger wrapping for SSE

Replace the TokenReviewer-based auth in the RBAC events handler with a new ValidateUserToken helper that checks tokens by GET /api, matching the Node sidecar behavior and avoiding TokenReview failures for some identities. Also bypass the request logger response wrapper for /events/rbac so HTTP/2 can flush SSE events to EventSource.

• ACM-42589: Harden RBAC events SSE with per-user fallback and proxy passthrough

• Refactor the RBAC events handler to accept an Authenticator interface and use APIAuth backed by GET /api.
• Add a per-user ClusterRole list fallback when the shared informer store is empty.
• Make informer cache-sync timeout non-fatal so SSE starts even without clusterrole watch rights.
• Set no-store/no-transform SSE headers and X-Accel-Buffering: no.
• Treat /events/rbac as an event-stream path and proxy /multicloud/events/rbac through the webpack dev server.

• ACM-42589: Fix auth merge corruption breaking Go backend and RBAC SSE

Restores RESTConfig to return *rest.Config, re-adds ValidateUserToken and NewTokenReviewer, and skips the request logger wrapper for /events/rbac so the backend compiles and role events stream correctly after merging ACM-42589.

• ACM-42589: Refactor frontend event streams into composable LoadDataAbstract abstraction

Split the monolithic LoadData component into LoadEventsData and LoadRbacData, both built on a reusable LoadDataAbstract component. Extract shared event stream handling into useWatchEventStream and applyWatchEventsToCache hooks, replace LoadRbacEvents with LoadRbacData, and add unit tests for the new abstractions.

---

---

📝 Summary

Ticket Summary (Title):

Ticket Link:

Type of Change:

• 🐞 Bug Fix
• ✨ Feature
• 🔧 Refactor
• 💸 Tech Debt
• 🧪 Test-related
• 📄 Docs

---

✅ Checklist

General

• PR title follows the convention (e.g. ACM-12340 Fix bug with...)
• Code builds and runs locally without errors
• No console logs, commented-out code, or unnecessary files
• All commits are meaningful and well-labeled
• All new display strings are externalized for localization (English only)
• (Nice to have) JSDoc comments added for new functions and interfaces

If Feature

• UI/UX reviewed (if applicable)
• All acceptance criteria met
• Unit test coverage added or updated
• Relevant documentation or comments included

If Bugfix

• Root cause and fix summary are documented in the ticket (for future reference / errata)
• Fix tested thoroughly and resolves the issue
• Test(s) added to prevent regression

---

🗒️ Notes for Reviewers

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

Important

Review skipped

Too many files!

This PR contains 297 files, which is 197 over the limit of 100.

To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch.

Upgrade to a paid plan to raise the limit.

This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: f2d1e731-f8a5-44a0-a727-df639690550d

📥 Commits

Reviewing files that changed from the base of the PR and between 7b82905 and 6d55398.

⛔ Files ignored due to path filters (2)

• backend/go.sum is excluded by !**/*.sum
• backend/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (297)

• .dockerignore
• .editorconfig
• .github/workflows/backend-upgrade.yml
• .tekton/console-acm-51-pull-request.yaml
• .tekton/console-acm-51-push.yaml
• .tekton/console-acm-52-pull-request.yaml
• .tekton/console-acm-52-push.yaml
• .tekton/console-mce-mce-51-pull-request.yaml
• .tekton/console-mce-mce-51-push.yaml
• .tekton/console-mce-mce-52-pull-request.yaml
• .tekton/console-mce-mce-52-push.yaml
• .tool-versions
• .vscode/launch.json
• AGENTS.md
• CONTRIBUTING.md
• Containerfile.acm
• Containerfile.mce
• Makefile.prow
• README.md
• backend/.air.toml
• backend/.gitignore
• backend/.golangci.yml
• backend/.vscode/launch.json
• backend/AGENTS.md
• backend/README.md
• backend/cmd/console/main.go
• backend/eslint.config.mjs
• backend/go.mod
• backend/internal/aggregate/appset.go
• backend/internal/aggregate/argo.go
• backend/internal/aggregate/argo_test.go
• backend/internal/aggregate/clusters.go
• backend/internal/aggregate/engine.go
• backend/internal/aggregate/engine_test.go
• backend/internal/aggregate/fuse.go
• backend/internal/aggregate/fuse_test.go
• backend/internal/aggregate/handler.go
• backend/internal/aggregate/handler_test.go
• backend/internal/aggregate/helper_test.go
• backend/internal/aggregate/lister.go
• backend/internal/aggregate/ocp.go
• backend/internal/aggregate/pages.go
• backend/internal/aggregate/pagination.go
• backend/internal/aggregate/pushmodel.go
• backend/internal/aggregate/rbac.go
• backend/internal/aggregate/rbac_test.go
• backend/internal/aggregate/status.go
• backend/internal/aggregate/status_test.go
• backend/internal/aggregate/transform.go
• backend/internal/aggregate/transform_test.go
• backend/internal/aggregate/types.go
• backend/internal/ansibletower/ansibletower.go
• backend/internal/ansibletower/ansibletower_test.go
• backend/internal/auth/auth.go
• backend/internal/auth/auth_test.go
• backend/internal/auth/ocm.go
• backend/internal/auth/ocm_test.go
• backend/internal/auth/tls.go
• backend/internal/auth/tls_test.go
• backend/internal/clusterinfo/clusterinfo.go
• backend/internal/clusterinfo/clusterinfo_test.go
• backend/internal/clusterproxy/resolver.go
• backend/internal/clusterproxy/resolver_test.go
• backend/internal/config/config.go
• backend/internal/config/config_test.go
• backend/internal/cors/cors.go
• backend/internal/cors/cors_test.go
• backend/internal/events/hub/access.go
• backend/internal/events/hub/access_test.go
• backend/internal/events/hub/encode.go
• backend/internal/events/hub/encode_test.go
• backend/internal/events/hub/event.go
• backend/internal/events/hub/frame.go
• backend/internal/events/hub/frame_test.go
• backend/internal/events/hub/handler.go
• backend/internal/events/hub/handler_test.go
• backend/internal/events/hub/hub.go
• backend/internal/events/hub/hub_test.go
• backend/internal/events/hub/parity_test.go
• backend/internal/events/hub/snapshot.go
• backend/internal/events/hub/snapshot_test.go
• backend/internal/events/rbac/access.go
• backend/internal/events/rbac/handler.go
• backend/internal/events/rbac/handler_test.go
• backend/internal/events/rbac/informer.go
• backend/internal/events/rbac/list.go
• backend/internal/events/rbac/list_test.go
• backend/internal/events/rbac/store.go
• backend/internal/health/health.go
• backend/internal/health/health_test.go
• backend/internal/hubresources/components.go
• backend/internal/hubresources/components_test.go
• backend/internal/hubresources/hubresources.go
• backend/internal/hubresources/hubresources_test.go
• backend/internal/informers/factory.go
• backend/internal/informers/factory_test.go
• backend/internal/informers/gvr.go
• backend/internal/informers/gvr_test.go
• backend/internal/informers/handler.go
• backend/internal/informers/handler_test.go
• backend/internal/informers/retry.go
• backend/internal/informers/retry_test.go
• backend/internal/informers/sink.go
• backend/internal/informers/sink_test.go
• backend/internal/informers/specs.go
• backend/internal/informers/specs_test.go
• backend/internal/informers/store.go
• backend/internal/informers/store_test.go
• backend/internal/informers/transform.go
• backend/internal/informers/transform_test.go
• backend/internal/k8sproxy/k8sproxy.go
• backend/internal/k8sproxy/k8sproxy_test.go
• backend/internal/log/log.go
• backend/internal/mcproxy/mcproxy.go
• backend/internal/mcproxy/mcproxy_test.go
• backend/internal/metricsproxy/metricsproxy.go
• backend/internal/metricsproxy/metricsproxy_test.go
• backend/internal/oauth/oauth.go
• backend/internal/oauth/oauth_test.go
• backend/internal/oauth/revoke.go
• backend/internal/oauth/revoke_test.go
• backend/internal/oauth/token.go
• backend/internal/outbound/transport.go
• backend/internal/placementdebug/ca.go
• backend/internal/placementdebug/ca_test.go
• backend/internal/placementdebug/placementdebug.go
• backend/internal/placementdebug/placementdebug_test.go
• backend/internal/rosa/rosa.go
• backend/internal/rosa/rosa_test.go
• backend/internal/searchapi/discovery.go
• backend/internal/searchapi/searchapi.go
• backend/internal/searchapi/searchapi_test.go
• backend/internal/searchproxy/inject.go
• backend/internal/searchproxy/proxy.go
• backend/internal/searchproxy/proxy_test.go
• backend/internal/searchproxy/ws.go
• backend/internal/server/server.go
• backend/internal/server/server_test.go
• backend/internal/static/public/README
• backend/internal/static/static.go
• backend/internal/static/static_test.go
• backend/internal/upgraderisks/upgraderisks.go
• backend/internal/upgraderisks/upgraderisks_test.go
• backend/internal/user/user.go
• backend/internal/user/user_test.go
• backend/internal/vmproxy/handler.go
• backend/internal/vmproxy/handler_test.go
• backend/internal/vmproxy/hub.go
• backend/internal/vmproxy/hub_test.go
• backend/internal/vmproxy/kubevirt.go
• backend/internal/vmproxy/kubevirt_test.go
• backend/internal/vmproxy/units.go
• backend/internal/vmproxy/units_test.go
• backend/internal/vmproxy/usage.go
• backend/internal/vmproxy/usage_test.go
• backend/package.json
• backend/src/app.ts
• backend/src/lib/agent.ts
• backend/src/lib/authenticated.ts
• backend/src/lib/batch-promise-all.ts
• backend/src/lib/body-parser.ts
• backend/src/lib/compression.ts
• backend/src/lib/config.ts
• backend/src/lib/cookies.ts
• backend/src/lib/cors.ts
• backend/src/lib/delay.ts
• backend/src/lib/fetch-retry.ts
• backend/src/lib/fileWatch.ts
• backend/src/lib/getServiceToken.ts
• backend/src/lib/gigantic.ts
• backend/src/lib/json-request.ts
• backend/src/lib/logger.ts
• backend/src/lib/main.ts
• backend/src/lib/managed-cluster-addon.ts
• backend/src/lib/memory.ts
• backend/src/lib/multi-cluster-engine.ts
• backend/src/lib/multi-cluster-hub.ts
• backend/src/lib/noop.ts
• backend/src/lib/pagination.ts
• backend/src/lib/placementDebugCAWatch.ts
• backend/src/lib/random-string.ts
• backend/src/lib/request-retry.ts
• backend/src/lib/respond.ts
• backend/src/lib/search.ts
• backend/src/lib/server-side-events.ts
• backend/src/lib/server.ts
• backend/src/lib/serviceAccountToken.ts
• backend/src/lib/tlsProfileWatch.ts
• backend/src/lib/token.ts
• backend/src/lib/virtual-machine.ts
• backend/src/resources/resource-list.ts
• backend/src/resources/resource.ts
• backend/src/resources/route.ts
• backend/src/resources/secret.ts
• backend/src/resources/status.ts
• backend/src/resources/watch-options.ts
• backend/src/routes/aggregator.ts
• backend/src/routes/aggregators/appSetData.ts
• backend/src/routes/aggregators/applications.ts
• backend/src/routes/aggregators/applicationsArgo.ts
• backend/src/routes/aggregators/applicationsOCP.ts
• backend/src/routes/aggregators/applicationsPushModel.ts
• backend/src/routes/aggregators/statuses.ts
• backend/src/routes/aggregators/utils.ts
• backend/src/routes/ansibletower.ts
• backend/src/routes/apiPaths.ts
• backend/src/routes/clusterVersion.ts
• backend/src/routes/configure.ts
• backend/src/routes/events.ts
• backend/src/routes/hub.ts
• backend/src/routes/hypershift-status.ts
• backend/src/routes/liveness.ts
• backend/src/routes/managedClusterProxy.ts
• backend/src/routes/metricsProxy.ts
• backend/src/routes/multiClusterEngineComponents.ts
• backend/src/routes/multiClusterHubComponents.ts
• backend/src/routes/oauth.ts
• backend/src/routes/operatorCheck.ts
• backend/src/routes/placementDebug.ts
• backend/src/routes/proxy.ts
• backend/src/routes/readiness.ts
• backend/src/routes/rosaWizardApi.ts
• backend/src/routes/search.ts
• backend/src/routes/serve.ts
• backend/src/routes/upgrade-risks-prediction.ts
• backend/src/routes/username.ts
• backend/src/routes/userpreference.ts
• backend/src/routes/virtualMachineProxy.ts
• backend/test/app.test.ts
• backend/test/jest-setup.ts
• backend/test/lib/agent.test.ts
• backend/test/lib/batch-promise-all.test.ts
• backend/test/lib/compression.test.ts
• backend/test/lib/fileWatch.test.ts
• backend/test/lib/getServiceToken.test.ts
• backend/test/lib/placementDebugCAWatch.test.ts
• backend/test/lib/tlsProfileWatch.test.ts
• backend/test/mock-request.ts
• backend/test/routes/aggregator.test.ts
• backend/test/routes/aggregators/applications.test.ts
• backend/test/routes/aggregators/applicationsArgoMergePush.test.ts
• backend/test/routes/aggregators/applicationsPushModel.test.ts
• backend/test/routes/aggregators/utils.test.ts
• backend/test/routes/ansibletower.test.ts
• backend/test/routes/apiPath.test.ts
• backend/test/routes/clusterVersion.test.ts
• backend/test/routes/configure.test.ts
• backend/test/routes/events.test.ts
• backend/test/routes/hub.test.ts
• backend/test/routes/hypershift-status.test.ts
• backend/test/routes/liveness.test.ts
• backend/test/routes/managedClusterProxy.test.ts
• backend/test/routes/metricsProxy.test.ts
• backend/test/routes/operatorCheck.test.ts
• backend/test/routes/ping.test.ts
• backend/test/routes/placementDebug.test.ts
• backend/test/routes/proxy.test.ts
• backend/test/routes/readiness.test.ts
• backend/test/routes/rosaWizardApi.test.ts
• backend/test/routes/search.test.ts
• backend/test/routes/searchWebSocket.test.ts
• backend/test/routes/serve.test.ts
• backend/test/routes/upgrade-risks-prediction.test.ts
• backend/test/routes/username.test.ts
• backend/test/routes/userpreference.test.ts
• backend/test/routes/virtualMachineProxy.test.ts
• backend/test/tsconfig.json
• backend/tsconfig.build.json
• backend/tsconfig.json
• docs/ARCHITECTURE.md
• docs/RESOURCES.md
• frontend/src/components/LoadData.tsx
• frontend/src/components/LoadDataAbstract.test.tsx
• frontend/src/components/LoadDataAbstract.tsx
• frontend/src/components/LoadEventsData.tsx
• frontend/src/components/LoadPluginData.test.tsx
• frontend/src/components/LoadRbacData.test.tsx
• frontend/src/components/LoadRbacData.tsx
• frontend/src/hooks/applyWatchEventsToCache.test.ts
• frontend/src/hooks/applyWatchEventsToCache.ts
• frontend/src/hooks/useWatchEventStream.test.ts
• frontend/src/hooks/useWatchEventStream.ts
• frontend/src/lib/test-event-source.ts
• frontend/src/resources/utils/resource-request.ts
• frontend/webpack.config.ts
• lint-staged.config.js
• package.json
• scripts/air-backend.sh
• scripts/check-hub-alignment.sh
• scripts/console-entrypoint.sh
• scripts/copyright-fix.ts
• scripts/copyright.ts
• scripts/generate-backend-certs.sh
• scripts/golangci-lint-backend.sh
• setup.sh
• sonar-project.properties
• start-ocp-console.sh

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands.}

[Ginxo]

/hold

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Ginxo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [Ginxo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Ginxo]

test execution snapshot for today's status

$ ./run-catalog.sh 
Backend: https://localhost:4000
Building test binary...
Running full catalog (TestCatalogAgainstBackend)...
--- FAIL: TestCatalogAgainstBackend (26.89s)
    contract_test.go:48: backend=https://localhost:4000 cases=73 mode=assert
    --- FAIL: TestCatalogAgainstBackend/cors-options-dev (0.00s)
        contract_test.go:65: status 401, want one of [200]; body=
    --- FAIL: TestCatalogAgainstBackend/cors-options-dev/multicloud (0.00s)
        contract_test.go:65: status 401, want one of [200]; body=
FAIL

════════════════════════════════════════════════════
 Contract test summary
════════════════════════════════════════════════════
 Executed: 107
 OK: 82
 SOFT (skipped): 23
 FAIL: 2
════════════════════════════════════════════════════
 Failed:
   cors-options-dev — status 401, want one of [200]; body=
   cors-options-dev/multicloud — status 401, want one of [200]; body=
 Soft skips (optional upstream missing):
   metrics-observability-query — status 502 is in softStatuses
   metrics-observability-query/multicloud — status 502 is in softStatuses
   mcp-hub-namespaces — status 502 is in softStatuses
   mcp-hub-namespaces/multicloud — status 502 is in softStatuses
   vm-resource-usage — status 500 is in softStatuses
   vm-resource-usage/multicloud — status 500 is in softStatuses
   serve-plugin-manifest — status 404 is in softStatuses
   serve-plugin-manifest/multicloud — status 404 is in softStatuses
   mcp-websocket-watch — websocket dial: websocket: bad handshake (status 502)
   placement-debug — status 500 is in softStatuses
   placement-debug/multicloud — status 500 is in softStatuses
   rosa-aws-account-ids — status 500 is in softStatuses
   rosa-aws-account-ids/multicloud — status 500 is in softStatuses
   rosa-billing-accounts — status 500 is in softStatuses
   rosa-oidc-configs — status 500 is in softStatuses
   rosa-regions — status 500 is in softStatuses
   rosa-cluster-name-check — status 500 is in softStatuses
   rosa-sts-role-arns — status 500 is in softStatuses
   rosa-vpcs — status 500 is in softStatuses
   rosa-sts-ocm-role — status 500 is in softStatuses
   rosa-sts-user-role — status 500 is in softStatuses
   rosa-openshift-versions — status 500 is in softStatuses
   rosa-machine-types — status 500 is in softStatuses
2 case(s) failed — migration gate not green.

working on solving those issues
@fxiang1

[openshift-ci]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@Ginxo: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/images	6d55398	link	true	/test images
ci/prow/pr-image-mirror	6d55398	link	true	/test pr-image-mirror
ci/prow/pr-image-mirror-mce	6d55398	link	true	/test pr-image-mirror-mce
ci/prow/check	6d55398	link	true	/test check
ci/prow/unit-tests-sonarcloud	6d55398	link	true	/test unit-tests-sonarcloud

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[Ginxo]

closed in favour of #6842