[release-1.4] feat: avoid dynamic-plugins writing conflicts (#2351)

* Avoid dynamic-plugins writing conflicts

* add SIGTERM handling

* add manual lock remove doc

* Update docker/install-dynamic-plugins.py

Co-authored-by: Armel Soro <[email protected]>

* Fix link to aap-backend plugin

This was deprecated in janus-idp/backstage-plugins#2628

---------

Co-authored-by: gazarenkov <[email protected]>
Co-authored-by: Armel Soro <[email protected]>
Co-authored-by: Armel Soro <[email protected]>

Author: 3 people

docker/install-dynamic-plugins.py

@@ -25,6 +25,10 @@
 import subprocess
 import base64
 import binascii
+import atexit
+import time
+import signal
+
 # This script is used to install dynamic plugins in the Backstage application,
 # and is available in the container image to be called at container initialization,
 # for example in an init container when using Kubernetes.
@@ -181,8 +185,39 @@ def verify_package_integrity(plugin: dict, archive: str, working_directory: str)
     if hash_digest != output.decode('utf-8').strip():
       raise InstallException(f'{package}: The hash of the downloaded package {output.decode("utf-8").strip()} does not match the provided integrity hash {hash_digest} provided in the configuration file')
 
+# Create the lock file, so that other instances of the script will wait for this one to finish
+def create_lock(lock_file_path):
+    while True:
+      try:
+        with open(lock_file_path, 'x'):
+          print(f"======= Created lock file: {lock_file_path}")
+          return
+      except FileExistsError:
+        wait_for_lock_release(lock_file_path)
+
+# Remove the lock file
+def remove_lock(lock_file_path):
+   os.remove(lock_file_path)
+   print(f"======= Removed lock file: {lock_file_path}")
+
+# Wait for the lock file to be released
+def wait_for_lock_release(lock_file_path):
+   print("======= Waiting for lock release...", flush=True)
+   while True:
+     if not os.path.exists(lock_file_path):
+       break
+     time.sleep(1)
+   print("======= Lock released.")
+
 def main():
+
     dynamicPluginsRoot = sys.argv[1]
+
+    lock_file_path = os.path.join(dynamicPluginsRoot, 'install-dynamic-plugins.lock')
+    atexit.register(remove_lock, lock_file_path)
+    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit(0))
+    create_lock(lock_file_path)
+
     maxEntrySize = int(os.environ.get('MAX_ENTRY_SIZE', 20000000))
     skipIntegrityCheck = os.environ.get("SKIP_INTEGRITY_CHECK", "").lower() == "true"
 

docs/dynamic-plugins/export-derived-package.md

@@ -43,7 +43,7 @@ If you are developing your own plugin that is going to be used as a dynamic plug
 To be compatible with the showcase dynamic plugin support, and used as dynamic plugins, existing plugins must be based on, or compatible with, the new backend system, as well as rebuilt with a dedicated CLI command.
 
 The new backend system standard entry point (created using `createBackendPlugin()` or `createBackendModule()`) should be exported as the default export of either the main package or of an `alpha` package (if the new backend support is still provided as `alpha` APIs). This doesn't add any additional requirement on top of the standard plugin development guidelines of the new backend system.
-For a practical example of a dynamic plugin entry point built upon the new backend system, please refer to the [Janus plugins repository](https://github.com/janus-idp/backstage-plugins/blob/main/plugins/aap-backend/src/module.ts#L25).
+For a practical example of a dynamic plugin entry point built upon the new backend system, please refer to the [Janus plugins repository](https://github.com/janus-idp/backstage-plugins/blob/release-1.4/plugins/aap-backend/src/module.ts#L25).
 
 The dynamic export mechanism identifies private, non-backstage dependencies, and sets the `bundleDependencies` field in the `package.json` file for them, so that the dynamic plugin package can be published as a self-contained package, along with its private dependencies bundled in a private `node_modules` folder.
 

docs/dynamic-plugins/installing-plugins.md

@@ -119,3 +119,19 @@ When using RHDH Helm Chart you can just name the Secret using following pattern
 When using the Operator ....
 
 //TODO
+
+### Storage of Dynamic Plugins
+
+The directory where dynamic plugins are located is mounted as a volume to the _install-dynamic-plugins_ init container and the _backstage-backend_ container. The _install-dynamic-plugins_ init container is responsible for downloading and extracting the plugins into this directory. Depending on the deployment method, the directory is mounted as an ephemeral or persistent volume. In the latter case, the volume can be shared between several Pods, and the plugins installation script is also responsible for downloading and extracting the plugins only once, avoiding conflicts.
+
+**Important Note:** If _install-dynamic-plugins_ init container was killed with SIGKILL signal (for example in a case of OOM) the script is not able to remove the lock file and the next time the Pod starts, it will be waiting for the lock release. You can see the following message in the logs for all the Pods:
+
+```console
+oc logs -n <namespace-name> -f backstage-<backstage-name>-<pod-suffix> -c install-dynamic-plugins
+======= Waiting for lock release...
+```
+In such a case, you can delete the lock file manually from any of the Pods:
+
+```console
+oc exec -n <namespace-name> deploy/backstage-<backstage-name> -c install-dynamic-plugins -- rm -f /dynamic-plugins-root/dynamic-plugins.lock
+```