Skip to content

Commit 351fb06

Browse files
authored
RHIDP-7723: Readonlyrootfilesystem release notes update (#1321)
* Added section * Incorporated Kim's suggestions * Incorporated Judy's comment
1 parent 14a0faf commit 351fb06

File tree

1 file changed

+54
-50
lines changed

1 file changed

+54
-50
lines changed

modules/release-notes/ref-release-notes-new-features.adoc

Lines changed: 54 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
1-
:_content-type: REFERENCE
2-
[id="new-features"]
3-
= New features
4-
5-
This section highlights new features in {product} {product-version}.
6-
7-
[id="feature-rhidp-3597"]
1+
:_content-type: REFERENCE
2+
[id="new-features"]
3+
= New features
4+
5+
This section highlights new features in {product} {product-version}.
6+
7+
[id="feature-rhidp-3597"]
88
== OpenTelemetry metrics support added to the Keycloak backend plugin
99

1010
With this update, the Keycloak backend plugin supports OpenTelemetry metrics, which monitors fetch operations and diagnoses potential issues.
@@ -24,23 +24,23 @@ backend_keycloak_fetch_data_batch_failure_count_total{taskInstanceId="df040f
2424
```
2525

2626
You can export metrics using any OpenTelemetry-compatible backend, such as **Prometheus**.
27-
28-
29-
[id="enhancement-rhidp-5039"]
27+
28+
29+
[id="enhancement-rhidp-5039"]
3030
== Enhanced session duration control and refresh token cookie policy
3131

3232
With this update, a new configurable field, `sessionDuration`, has been introduced in the supported authentication providers. This allows administrators to specify custom user session durations, enabling better control over session timeouts and enforced logouts. Additionally, the default maximum age of the refresh token cookie has been reduced to 400 days to align with the modern web browser policies.
3333

34-
For more information, see link:https://docs.redhat.com/en/documentation/red_hat_developer_hub/1.5/html-single/authentication_in_red_hat_developer_hub/index#idm140459408106672[Authentication in {product}].
35-
36-
[id="enhancement-rhidp-5211"]
34+
For more information, see link:https://docs.redhat.com/en/documentation/red_hat_developer_hub/1.5/html-single/authentication_in_red_hat_developer_hub/index#idm140459408106672[Authentication in {product}].
35+
36+
[id="enhancement-rhidp-5211"]
3737
== Support for custom version information on the settings page
3838

3939
{product} now supports the extension or replacement of version information on the settings page. This feature allows customers and partners to replace the version information on the settings page with their own versions.
4040

41-
42-
43-
[id="enhancement-rhidp-5987"]
41+
42+
43+
[id="enhancement-rhidp-5987"]
4444
== Updated Auditor Service
4545

4646
{product} {product-version} introduces an enhancement to the RBAC and Bulk Import plugins, enabling users to utilize Backstage's new Auditor service. The key features include: ​
@@ -58,9 +58,9 @@ The audit log is now backed by the `@backstage/backend-plugin-api` package.​
5858
The Bulk Import backend plugin and RBAC backend plugin emit audit events for various operations, with the events grouped logically by `eventId`.​
5959

6060

61-
62-
63-
[id="feature-rhidp-6158"]
61+
62+
63+
[id="feature-rhidp-6158"]
6464
== Renamed `Create` to `Self-service`
6565

6666
The term `Create` has been renamed to `Self-service` across key UI areas to better align with the self-service functionality provided through the Backstage scaffolder, enhancing clarity for users.
@@ -70,21 +70,21 @@ This change applies to the following areas:
7070
* Sidebar navigation
7171
* Global header
7272
* Catalog page
73-
* Scaffolder page
74-
75-
[id="feature-rhidp-6170"]
73+
* Scaffolder page
74+
75+
[id="feature-rhidp-6170"]
7676
== Enhanced plugin visibility in the Extensions catalog
7777

78-
With this update, the Extensions catalog now displays the default configuration of included plugins directly in {product}. This feature helps administrators better understand available plugins and their configuration options before enabling them. While plugin configurations are now visible, administrators still need to manually copy these configurations into their Helm Charts or Operator custom resource to install or configure a plugin.
79-
80-
[id="enhancement-rhidp-6173"]
78+
With this update, the Extensions catalog now displays the default configuration of included plugins directly in {product}. This feature helps administrators better understand available plugins and their configuration options before enabling them. While plugin configurations are now visible, administrators still need to manually copy these configurations into their Helm Charts or Operator custom resource to install or configure a plugin.
79+
80+
[id="enhancement-rhidp-6173"]
8181
== Simplify Operator-backed deployments on OpenShift with automatic `baseUrl` configuration
8282

8383
Previously, deploying {product-short} using the Operator required manually configuring the `baseUrl` settings in the custom app-config ConfigMap.
8484

85-
With this update, the Operator can now automatically compute the default application URL based on the OpenShift cluster ingress domain and the custom Route settings in the `Backstage` Custom Resource. It will then populate this as the default `baseUrl` in the app-config ConfigMap that it generates for the {product-short} instance. This functionality is specific to OpenShift. The Operator fills the following fields in the default app-config ConfigMap: `app.baseUrl`, `backend.baseUrl`, and `backend.cors.origin`. As a result, this eliminates the need to manually set such values for most Operator-backed deployments on OpenShift, though you can still override these settings in your custom app-config ConfigMap.
86-
87-
[id="enhancement-rhidp-6184"]
85+
With this update, the Operator can now automatically compute the default application URL based on the OpenShift cluster ingress domain and the custom Route settings in the `Backstage` Custom Resource. It will then populate this as the default `baseUrl` in the app-config ConfigMap that it generates for the {product-short} instance. This functionality is specific to OpenShift. The Operator fills the following fields in the default app-config ConfigMap: `app.baseUrl`, `backend.baseUrl`, and `backend.cors.origin`. As a result, this eliminates the need to manually set such values for most Operator-backed deployments on OpenShift, though you can still override these settings in your custom app-config ConfigMap.
86+
87+
[id="enhancement-rhidp-6184"]
8888
== New sidebar item visibility configuration
8989

9090
{product} now supports a clean and flexible way to hide sidebar items using a new enabled key in the sidebar menu configuration. If set to false, the specified sidebar item will no longer appear in the UI, while maintaining full backward compatibility with existing configurations.
@@ -128,44 +128,48 @@ app:
128128
logo: false # hides sidebar logo
129129
settings: false # hides settings item
130130
administration: false # hides administration item
131-
----
132-
133-
[id="feature-rhidp-6253"]
131+
----
132+
133+
[id="feature-rhidp-6253"]
134134
== {product-short} community plugins updated to Backstage 1.36
135135

136-
The {product-short} community plugins have been updated to Backstage version 1.36.
137-
138-
[id="feature-rhidp-6269"]
136+
The {product-short} community plugins have been updated to Backstage version 1.36.
137+
138+
[id="feature-rhidp-6269"]
139139
== Added a new RBAC conditional rule `IS_OWNER` to RBAC plugin
140140

141141
{product} introduces a new RBAC conditional rule, `IS_OWNER`, that allows administrators to assign ownership to roles and control access to the RBAC plugin. This enhancement enables more granular access control by allowing ownership-based filtering of roles, permission policies, and conditional policies.
142142

143143
This enhancement removes the resource type from the `policy.entity.create` permission, preventing conditional rules from being applied to the permission. You can update all permission policies that utilize the resource type `policy-entity` with the action `create` (for example `role:default/some_role, policy-entity, create, allow` to `role:default/some_role, policy.entity.create, create, allow`) to prevent degradation in the future.
144-
145-
146-
[id="feature-rhidp-6555"]
144+
145+
146+
[id="feature-rhidp-6555"]
147147
== Support for high availability in {aks-brand-name}
148148

149149
{product} now supports high availability setups in {aks-brand-name} ({aks-short}). This enhancement allows the deployment to scale beyond a single replica, ensuring the application remains operational and accessible even in the event of failures or disruptions.
150150

151-
For more information, see link:https://docs.redhat.com/en/documentation/red_hat_developer_hub/1.5/html-single/configuring_red_hat_developer_hub/index#HighAvailability[_Configuring high availability in Red Hat Developer Hub_].
152-
153-
[id="feature-rhidp-6764"]
151+
For more information, see link:https://docs.redhat.com/en/documentation/red_hat_developer_hub/1.5/html-single/configuring_red_hat_developer_hub/index#HighAvailability[_Configuring high availability in Red Hat Developer Hub_].
152+
153+
[id="feature-rhidp-6764"]
154154
== Added `@backstage/plugin-scaffolder-backend-module-github` plugin for {product-short}
155155

156-
{product} now supports the `@backstage/plugin-scaffolder-backend-module-github` plugin, enabling GitHub Actions within software templates. With this integration, you can securely create and manage repositories, open pull requests, trigger GitHub Actions workflows, and more, all directly from the software template. This plugin empowers users to automate GitHub interactions and workflows with ease.
157-
158-
[id="enhancement-rhidp-6882"]
156+
{product} now supports the `@backstage/plugin-scaffolder-backend-module-github` plugin, enabling GitHub Actions within software templates. With this integration, you can securely create and manage repositories, open pull requests, trigger GitHub Actions workflows, and more, all directly from the software template. This plugin empowers users to automate GitHub interactions and workflows with ease.
157+
158+
[id="enhancement-rhidp-6882"]
159159
== Default OIDC sign-in resolver updated
160160

161-
With this update, the default resolver for OIDC sign-in is set to `oidcSubClaimMatchingKeycloakUserId` to enhance security. This resolver is now also available as a configurable option under the sign-in resolver settings.
162-
163-
[id="feature-rhidp-7424"]
161+
With this update, the default resolver for OIDC sign-in is set to `oidcSubClaimMatchingKeycloakUserId` to enhance security. This resolver is now also available as a configurable option under the sign-in resolver settings.
162+
163+
[id="feature-rhidp-7424"]
164164
== New dynamic plugin for Kubernetes scaffolder actions
165165

166166
With this update, {product-short} introduces the @backstage-community/plugin-scaffolder-backend-module-kubernetes plugin as a dynamic plugin, enabling Backstage template actions for Kubernetes. Currently, it includes the create-namespace action. This dynamic plugin is disabled by default.
167167

168-
For more information, see link:https://docs.redhat.com/en/documentation/red_hat_developer_hub/{product-version}/html-single/configuring_dynamic_plugins/index#con-Kubernetes-custom-actions_title-plugins-rhdh-configure[Kubernetes custom actions in {product}].
169-
170-
171-
168+
For more information, see link:https://docs.redhat.com/en/documentation/red_hat_developer_hub/{product-version}/html-single/configuring_dynamic_plugins/index#con-Kubernetes-custom-actions_title-plugins-rhdh-configure[Kubernetes custom actions in {product}].
169+
170+
[id="enhancement-rhidp-7723"]
171+
== `readOnlyRootFilesystem` enabled by default
172+
173+
Previously, when you deployed {product-short} using the Operator, you had to specify a `patch` for the `deployment` in your `{product-custom-resource-type}` custom resource (CR) that applied the `readOnlyRootFilesystem` option to the `securityContext` section in the {product-short} backend container. When you deployed using the Helm chart, you had to specify `readOnlyRootFilesystem: true` in the `containerSecurityContext` section.
174+
175+
With this release, the `readOnlyRootFilesystem` option is enabled by default for the initContainer and the backend container.

0 commit comments

Comments
 (0)