Conversation
* ACM-42589: Rename backend directory to backend-node Move the existing Node.js console backend into backend-node/ and update repository references, build scripts, CI configs, and documentation so the renamed package remains the single backend entry point. Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> * ACM-42589: Add Go console backend with Node sidecar proxy Introduce a Go public listener in backend/ that owns TLS, health probes, shared config, and auth helpers while reverse-proxying unmigrated routes to the existing Node implementation in backend-node/. ## Strategy (executive summary) This change follows a strangler-fig migration: 1. **Free the backend path** — the existing Node server was moved to `backend-node/` so `backend/` can host the new Go entry point without breaking historical paths for config, certs, and `.env`. 2. **Dual-process local dev** — Go listens on `BACKEND_PORT` (4000) as the browser-facing backend; Node runs as a sidecar on `NODE_BACKEND_PORT` (4001) for routes not yet ported. 3. **Proxy-first cutover** — Go registers only health endpoints natively; all other traffic is forwarded to the sidecar with the original URL (including `/multicloud`) so the Node router keeps working unchanged. 4. **Shared runtime artifacts** — `backend/.env`, `backend/config/`, and `backend/certs/` remain the single source of truth; the sidecar reads them via `ENV_FILE`, `CONFIG_DIR`, and `CERTS_DIR`. 5. **Incremental porting** — new Go packages (`internal/server`, `proxy`, `health`, `config`, `auth`) establish the foundation; routes can migrate from Node to Go one at a time without frontend changes. Root npm scripts, setup, and docs were updated for the Go + sidecar workflow. Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> * ACM-42589: Adopt golangci-lint for Go backend and fix initial findings Replace go vet with golangci-lint in backend check/lint scripts, add a backend/.golangci.yml config, and introduce scripts/golangci-lint-backend.sh to install and run the linter. Fix the first lint findings: variable shadowing in main.go and server_test.go, and US spelling in the RBAC informer comment. Update AGENTS.md and Makefile.prow to include the new backend lint/check steps. Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * ACM-42589: Validate RBAC event tokens via /api and skip logger wrapping for SSE Replace the TokenReviewer-based auth in the RBAC events handler with a new ValidateUserToken helper that checks tokens by GET /api, matching the Node sidecar behavior and avoiding TokenReview failures for some identities. Also bypass the request logger response wrapper for /events/rbac so HTTP/2 can flush SSE events to EventSource. Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * ACM-42589: Revert incomplete RBAC merge that breaks Go backend build The RBAC event token validation commit referenced APIs from ACM-42589_roles (RESTConfig, WithRBACEvents, events/rbac) that are not on this branch, so go run ./cmd/console failed and the plugin proxy could not reach :4000. Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> * ACM-42589: Add Air live reload for Go backend development Configure github.com/air-verse/air to rebuild and restart the Go console backend when cmd/ or internal/ files change. Add scripts/air-backend.sh to install Air if missing, wire it into npm run start:backend:go, and update AGENTS.md, .gitignore, and clean scripts for the new backend/tmp directory. Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * Use named constants for Bearer authorization scheme prefix in token extraction Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * Go to 1.26 Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * ACM-42589: Migrate ClusterRole watch to Go /events/rbac SSE (#47) * ACM-42589: Migrate ClusterRole watch to Go /events/rbac SSE Move vm-clusterroles ClusterRole watching from the Node sidecar to a dedicated Go SSE stream with per-user SSAR filtering, and wire the frontend to consume it via LoadRbacEvents while keeping Search-based role assignments on the sidecar. Signed-off-by: Auto <auto@cursor.com> Co-authored-by: Cursor <cursoragent@cursor.com> * ACM-42589: Adopt golangci-lint for Go backend and fix initial findings Replace go vet with golangci-lint in backend check/lint scripts, add a backend/.golangci.yml config, and introduce scripts/golangci-lint-backend.sh to install and run the linter. Fix the first lint findings: variable shadowing in main.go and server_test.go, and US spelling in the RBAC informer comment. Update AGENTS.md and Makefile.prow to include the new backend lint/check steps. Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * ACM-42589: Validate RBAC event tokens via /api and skip logger wrapping for SSE Replace the TokenReviewer-based auth in the RBAC events handler with a new ValidateUserToken helper that checks tokens by GET /api, matching the Node sidecar behavior and avoiding TokenReview failures for some identities. Also bypass the request logger response wrapper for /events/rbac so HTTP/2 can flush SSE events to EventSource. Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * ACM-42589: Harden RBAC events SSE with per-user fallback and proxy passthrough - Refactor the RBAC events handler to accept an Authenticator interface and use APIAuth backed by GET /api. - Add a per-user ClusterRole list fallback when the shared informer store is empty. - Make informer cache-sync timeout non-fatal so SSE starts even without clusterrole watch rights. - Set no-store/no-transform SSE headers and X-Accel-Buffering: no. - Treat /events/rbac as an event-stream path and proxy /multicloud/events/rbac through the webpack dev server. Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * ACM-42589: Fix auth merge corruption breaking Go backend and RBAC SSE Restores RESTConfig to return *rest.Config, re-adds ValidateUserToken and NewTokenReviewer, and skips the request logger wrapper for /events/rbac so the backend compiles and role events stream correctly after merging ACM-42589. Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> * ACM-42589: Refactor frontend event streams into composable LoadDataAbstract abstraction Split the monolithic LoadData component into LoadEventsData and LoadRbacData, both built on a reusable LoadDataAbstract component. Extract shared event stream handling into useWatchEventStream and applyWatchEventsToCache hooks, replace LoadRbacEvents with LoadRbacData, and add unit tests for the new abstractions. Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> --------- Signed-off-by: Auto <auto@cursor.com> Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> --------- Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> Signed-off-by: Auto <auto@cursor.com> Co-authored-by: Cursor <cursoragent@cursor.com>
* ACM-42589: Migrate hub kube-apiserver proxy routes to Go Move /api, /apis, and /version passthrough from the Node sidecar to a new backend/internal/k8sproxy package in the Go public listener. The proxy uses the user's Bearer or cookie token, strips the /multicloud prefix for route matching, forwards an allowlist of request/response headers, and falls back to 502 Bad Gateway when the upstream cluster API is unreachable. Remove the corresponding Node proxy route and tests, and update AGENTS.md and ARCHITECTURE.md to reflect the migrated routes. Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * .editorconfig Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> --------- Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com>
Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com>
* Serve static plugin and SPA assets from the Go backend Move static file serving out of the Node sidecar into a new Go internal/static package. The Go listener now handles plugin assets, hashed JS/CSS, locales, and index.html with the same cache headers, CSP, and brotli/gzip negotiation previously provided by backend-node. - Add PUBLIC_FOLDER config and default to /app/public in images - Build the Go console binary in Containerfile.acm and Containerfile.mce - Remove backend-node/src/routes/serve.ts and its tests - Add scripts/console-entrypoint.sh to launch Go + Node sidecar Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * .editorconfig Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> --------- Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>
… backend (#49) * Migrate managed cluster, metrics, and VM proxy routes to Go backend Add Go handlers for /managedclusterproxy/*, /prometheus/*, /observability/*, and the /virtualmachines* family, moving them from the Node sidecar to the Go listener. Introduce internal/clusterproxy resolver, metricsproxy, mcproxy, and vmproxy packages, plus auth helpers for service CA TLS and request token validation. Update server routing, config env vars, and AGENTS.md to register and document the migrated stateless proxies. Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * .editorconfig Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * Add hubresources package and use dynamic client for MCE/MCH lookups Introduce backend/internal/hubresources with MCETargetNamespace and MCHFineGrainedRBAC helpers. Update clusterproxy.Resolver and vmproxy to use the Kubernetes dynamic client instead of manual HTTP/JSON requests when reading MultiClusterEngine and MultiClusterHub resources, and adjust tests to use the fake dynamic client. Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> --------- Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>
…o backend (#51) * ACM-42589: Migrate OAuth login, logout, and /configure discovery to Go backend Move standalone OAuth/OpenShift OAuth/OIDC login flow and token-endpoint discovery from the Node sidecar into the Go public listener. Adds `internal/oauth` with `/configure`, `/login`, `/login/callback`, and `/logout` handlers, OCM SSO client-credentials exchange in `internal/auth`, shared TLS/HTTP client helpers, and new env vars (`OAUTH2_*`, `OIDC_ISSUER_URL`, `FRONTEND_URL`). The Go server registers these routes under `/` and `/multicloud` in non-production, while production keeps OpenShift Console auth. Removes the corresponding Node routes and tests, updates `AGENTS.md` and architecture docs, and adjusts a frontend test helper. Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * .editorconfig Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * use the dynamic client-go Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> --------- Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com>
Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com>
* cors fix Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * Migrate auth check, user, and cluster-info routes to Go Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * check-hub-alignment.sh Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * generate-certs at setup.sh Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> --------- Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com>
…ry (#55) * cors fix Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * Implement informer cache with client-go SharedInformerFactory Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * hang issue fixed Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * restoring rm -rf backend/.env backend/certs/ && npm run setup && npm run ci:backend flow Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> --------- Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com>
* cors fix Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * Implement informer cache with client-go SharedInformerFactory Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * hang issue fixed Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * restoring rm -rf backend/.env backend/certs/ && npm run setup && npm run ci:backend flow Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * Implement SSE hub with per-user RBAC filtering Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * unauth-events - expected empty body, got "Unauthorized\n" fixed Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * pending tests implemented Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * merge conflict errors Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> --------- Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com>
* ACM-42600 Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * Feng's proposal already applied Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> --------- Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com>
* ACM-42600 Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * ACM-42601 Migrate search proxy and WebSocket relay to Go Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> --------- Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com>
* ACM-42600 Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * ACM-42601 Migrate search proxy and WebSocket relay to Go Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * ACM-42602 Migrate long-tail routes to Go Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> --------- Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com>
* ACM-42600 Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * ACM-42601 Migrate search proxy and WebSocket relay to Go Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * ACM-42602 Migrate long-tail routes to Go Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * ACM-42603 Decommission Node.js backend Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * tektone gomod path Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * config.DisableEvents Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * Change Containerfile.[a|e]cm file go image to registry.ci.openshift.org/stolostron/builder:go1.26-linux and move line to the top Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> --------- Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com>
* ACM-42600 Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * ACM-42601 Migrate search proxy and WebSocket relay to Go Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * ACM-42602 Migrate long-tail routes to Go Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * ACM-42603 Decommission Node.js backend Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * performance improvements Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> * Additional backend performance improvements: cache list calls, reuse SSAR clients, prefetch RBAC checks, and serve cluster info from informer cache Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com> --------- Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com>
Signed-off-by: fxiang1 <fxiang@redhat.com>
Signed-off-by: fxiang1 <fxiang@redhat.com>
|
Skipping CI for Draft Pull Request. |
|
Important Review skippedToo many files! This PR contains 297 files, which is 197 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (297)
You can disable this status message by setting the Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Ginxo The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com>
Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com>
@Ginxo I'm concerned about this. I think the code needs to be subject to CodeRabbit reviews. |
|
Tip For best results, initiate chat on the files or code changes.
CodeRabbit could not start a review of PR
To enable a review, split the migration into PRs with 100 files or fewer, or increase the file limit through the plan. Then add credits or enable usage-based reviews. After both conditions are met, comment 🐇 You are interacting with an AI system. |
Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com>
Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com>
My proposal is to keep this as it is, keep this one up to date, wait for QE report and as soon we have the green from them, I can break this PR into pieces like we do on my fork (see https://github.com/Ginxo/console/pulls?q=is%3Apr+state%3Aclosed+reviewed-by%3Afxiang1). Wdyt? CC @almen-ng @fxiang1 @evelinec @Randy424 |
|
Tip For best results, initiate chat on the files or code changes.
Keep PR Before requesting CodeRabbit review, also make sure that usage credits or metered capacity are available. The file-count limit and the capacity limit must both be resolved. For the split PRs, group changes by backend area where possible, such as server/bootstrap, authentication, aggregation, events, proxies, and CI/container changes. Include the related tests in the same PR as each implementation area. You are interacting with an AI system. |
I wonder if this is because Kike doesn't have a CodeRabbit license? The 'Advanced' plan file limit should be 300.
|
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain⚙️ CodeRabbit configuration inspected Length of output: 6792
The Comment image shows that the current Advanced limit is 300 files per review. The status for PR I cannot confirm that Ginxo lacks a license from this data. The review status also reports insufficient usage capacity, which is a separate account-level restriction. An organization administrator should check the entitlement and run metadata for Run ID
🐇🔎 You are interacting with an AI system. |
a couple of more files and I'm out even with advance license 😅 |
|
Tip For best results, initiate chat on the files or code changes.
The reported 100-file limit is inconsistent with that entitlement. The insufficient usage-capacity message is separate and can still block the review. An organization administrator should verify the effective entitlement for 🐇🔎 You are interacting with an AI system. |
Signed-off-by: fxiang1 <fxiang@redhat.com>
Signed-off-by: Enrique Mingorance Cano <ginxaco@gmail.com>
|
@Ginxo: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |


📝 Summary
Ticket Summary (Title):
Migrate the console backend to Go - Create PR
Ticket Link:
https://redhat.atlassian.net/browse/ACM-45223
Migration Metadata
2026-08-25T19:49:46.000Z41c4ac82026-09-14T17:41:22.000Zlatest update 5018d72 atBackend updates since migration started
2026-08-25T17:14:12.000Z2026-08-31T19:30:38.000Z2026-08-31T20:54:05.000Z2026-09-03T13:56:35.000Z2026-09-08T15:28:19.000Z2026-09-15T13:48:52.000Z2026-09-15T14:47:06.000Z2026-09-15T19:46:31.000Z