@@ -76,13 +76,22 @@ used with multiple versions of OpenShift Console but don't provide any backwards
7676
7777## OpenShift Console Versions vs SDK Versions
7878
79- Not all NPM packages are fully compatible with all versions of the Console. This table will help align
80- compatible versions of distributable SDK packages to versions of the OpenShift Console.
79+ Console plugin SDK packages follow a semver scheme where the major and minor version number indicates
80+ the earliest supported OCP Console version, and the patch version number indicates the release of that
81+ particular package.
82+
83+ During development, we will publish prerelease versions of plugin SDK packages, e.g. ` 4.19.0-prerelease.1 ` .
84+ Once the given Console version is released (GA), we will publish corresponding plugin SDK packages without
85+ the prerelease tag, e.g. ` 4.19.0 ` .
86+
87+ For older 1.x plugin SDK packages, refer to the following version compatibility table:
8188
8289| Console Version | SDK Package | Last Package Version |
8390| --------------- | ----------------------------------------------- | -------------------- |
84- | 4.17.x | ` @openshift-console/dynamic-plugin-sdk ` | Latest |
85- | | ` @openshift-console/dynamic-plugin-sdk-webpack ` | Latest |
91+ | 4.18.x | ` @openshift-console/dynamic-plugin-sdk ` | 1.8.0 |
92+ | | ` @openshift-console/dynamic-plugin-sdk-webpack ` | 1.3.0 |
93+ | 4.17.x | ` @openshift-console/dynamic-plugin-sdk ` | 1.6.0 |
94+ | | ` @openshift-console/dynamic-plugin-sdk-webpack ` | 1.2.0 |
8695| 4.16.x | ` @openshift-console/dynamic-plugin-sdk ` | 1.4.0 |
8796| | ` @openshift-console/dynamic-plugin-sdk-webpack ` | 1.1.1 |
8897| 4.15.x | ` @openshift-console/dynamic-plugin-sdk ` | 1.0.0 |
@@ -156,21 +165,21 @@ This section documents notable changes in the Console provided shared modules ac
156165
157166#### Console 4.19.x
158167
168+ - Removed PatternFly 4.x shared modules. Console now uses PatternFly 6.x and provides PatternFly 5.x
169+ styles for compatibility with existing plugins.
159170- Removed ` @fortawesome/font-awesome ` and ` openshift-logos-icon ` . Plugins should use PatternFly icons
160171 from ` @patternfly/react-icons ` instead. The ` fa-spin ` class remains but is deprecated and will be
161172 removed in the future. Plugins should provide their own CSS to spin icons if needed.
162- - Upgraded ` monaco-editor ` to version ` 0.52.2 ` .
163- - Removed PatternFly 4.x shared modules.
164- - Upgraded PatternFly to v6.
165- - Removed styling for generic HTML heading elements (e.g., ` <h1> ` ). Use PatternFly components to achieve correct styling.
173+ - Upgraded ` monaco-editor ` to version ` 0.51.0 ` .
174+ - Removed styling for generic HTML heading elements (e.g., ` <h1> ` ). Use PatternFly components to achieve
175+ correct styling.
166176
167- ### PatternFly dynamic modules
177+ ### PatternFly 5+ dynamic modules
168178
169- Newer versions of ` @openshift-console/dynamic-plugin-sdk-webpack ` package (1.0.0 and higher) include
170- support for automatic detection and sharing of individual PatternFly 5.x dynamic modules.
179+ Newer versions of ` @openshift-console/dynamic-plugin-sdk-webpack ` package include support for automatic
180+ detection and sharing of individual PatternFly 5+ dynamic modules.
171181
172- Plugins using PatternFly 5.x dependencies should generally avoid non-index imports for any PatternFly
173- packages, for example:
182+ Plugins using PatternFly 5.x and newer should avoid non-index imports, for example:
174183
175184``` ts
176185// Do _not_ do this:
@@ -187,20 +196,51 @@ Console application uses [Content Security Policy](https://developer.mozilla.org
187196includes the document origin ` 'self' ` and Console webpack dev server when running off-cluster.
188197
189198All dynamic plugin assets _ should_ be loaded using ` /api/plugins/<plugin-name> ` Bridge endpoint which
190- matches the ` 'self' ` CSP source of Console application .
199+ matches the ` 'self' ` CSP source for all Console assets served via Bridge .
191200
192- See ` cspSources ` and ` cspDirectives ` in
193- [ ` pkg/server/server .go ` ] ( https://github.com/openshift/console/blob/master/pkg/server/server .go )
201+ Refer to ` BuildCSPDirectives ` function in
202+ [ ` pkg/utils/utils .go ` ] ( https://github.com/openshift/console/blob/master/pkg/utils/utils .go )
194203for details on the current Console CSP implementation.
195204
205+ Refer to [ Dynamic Plugins feature page] [ console-doc-feature-page ] section on Content Security Policy
206+ for more details.
207+
196208### Changes in Console CSP
197209
198- This section documents notable changes in the Console Content Security Policy.
210+ This section documents notable changes in the Console Content Security Policy implementation .
199211
200212#### Console 4.18.x
201213
202- Console CSP is deployed in report-only mode. CSP violations will be logged in the browser console
203- but the associated CSP directives will not be enforced.
214+ Console CSP feature is disabled by default. To test your plugins with CSP, enable the
215+ ` ConsolePluginContentSecurityPolicy ` feature gate on a test cluster. This feature gate
216+ should ** not** be enabled on production clusters. Enabling this feature gate allows you
217+ to set ` spec.contentSecurityPolicy ` in your ` ConsolePlugin ` resource to extend existing
218+ CSP directives, for example:
219+
220+ ``` yaml
221+ apiVersion : console.openshift.io/v1
222+ kind : ConsolePlugin
223+ metadata :
224+ name : cron-tab
225+ spec :
226+ displayName : ' Cron Tab'
227+ contentSecurityPolicy :
228+ - directive : ' ScriptSrc'
229+ values :
230+ - ' https://example1.com/'
231+ - ' https://example2.com/'
232+ ` ` `
233+
234+ When enabled, Console CSP operates in report-only mode; CSP violations will be logged in
235+ the browser and CSP violation data will be reported through telemetry service in production
236+ deployments.
237+
238+ In a future release, Console will begin enforcing CSP. Consider testing and preparing your
239+ plugins now to avoid CSP related issues in future.
240+
241+ #### Console 4.19.x
242+
243+ The CSP feature is enabled by default. CSP implementation remains in report-only mode.
204244
205245## Plugin metadata
206246
0 commit comments