@@ -76,13 +76,22 @@ used with multiple versions of OpenShift Console but don't provide any backwards
7676
7777## OpenShift Console Versions vs SDK Versions
7878
79- Not all NPM packages are fully compatible with all versions of the Console. This table will help align
80- compatible versions of distributable SDK packages to versions of the OpenShift Console.
79+ Console plugin SDK packages follow a semver scheme where the major and minor version number indicates
80+ the earliest supported OCP Console version, and the patch version number indicates the release of that
81+ particular package.
82+
83+ During development, we will publish prerelease versions of plugin SDK packages, e.g. ` 4.19.0-prerelease.1 ` .
84+ Once the given Console version is released (GA), we will publish corresponding plugin SDK packages without
85+ the prerelease tag, e.g. ` 4.19.0 ` .
86+
87+ For older 1.x plugin SDK packages, refer to the following version compatibility table:
8188
8289| Console Version | SDK Package | Last Package Version |
8390| --------------- | ----------------------------------------------- | -------------------- |
84- | 4.17.x | ` @openshift-console/dynamic-plugin-sdk ` | Latest |
85- | | ` @openshift-console/dynamic-plugin-sdk-webpack ` | Latest |
91+ | 4.18.x | ` @openshift-console/dynamic-plugin-sdk ` | 1.8.0 |
92+ | | ` @openshift-console/dynamic-plugin-sdk-webpack ` | 1.3.0 |
93+ | 4.17.x | ` @openshift-console/dynamic-plugin-sdk ` | 1.6.0 |
94+ | | ` @openshift-console/dynamic-plugin-sdk-webpack ` | 1.2.0 |
8695| 4.16.x | ` @openshift-console/dynamic-plugin-sdk ` | 1.4.0 |
8796| | ` @openshift-console/dynamic-plugin-sdk-webpack ` | 1.1.1 |
8897| 4.15.x | ` @openshift-console/dynamic-plugin-sdk ` | 1.0.0 |
@@ -156,20 +165,20 @@ This section documents notable changes in the Console provided shared modules ac
156165
157166#### Console 4.19.x
158167
168+ - Removed PatternFly 4.x shared modules. Console now uses PatternFly 6.x and provides PatternFly 5.x
169+ styles for compatibility with existing plugins.
159170- Removed ` @fortawesome/font-awesome ` and ` openshift-logos-icon ` . Plugins should use PatternFly icons
160171 from ` @patternfly/react-icons ` instead. The ` fa-spin ` class remains but is deprecated and will be
161172 removed in the future. Plugins should provide their own CSS to spin icons if needed.
162- - Removed PatternFly 4.x shared modules.
163- - Upgraded PatternFly to v6.
164- - Removed styling for generic HTML heading elements (e.g., ` <h1> ` ). Use PatternFly components to achieve correct styling.
173+ - Removed styling for generic HTML heading elements (e.g., ` <h1> ` ). Use PatternFly components to achieve
174+ correct styling.
165175
166- ### PatternFly dynamic modules
176+ ### PatternFly 5+ dynamic modules
167177
168- Newer versions of ` @openshift-console/dynamic-plugin-sdk-webpack ` package (1.0.0 and higher) include
169- support for automatic detection and sharing of individual PatternFly 5.x dynamic modules.
178+ Newer versions of ` @openshift-console/dynamic-plugin-sdk-webpack ` package include support for automatic
179+ detection and sharing of individual PatternFly 5+ dynamic modules.
170180
171- Plugins using PatternFly 5.x dependencies should generally avoid non-index imports for any PatternFly
172- packages, for example:
181+ Plugins using PatternFly 5.x and newer should avoid non-index imports, for example:
173182
174183``` ts
175184// Do _not_ do this:
@@ -186,20 +195,47 @@ Console application uses [Content Security Policy](https://developer.mozilla.org
186195includes the document origin ` 'self' ` and Console webpack dev server when running off-cluster.
187196
188197All dynamic plugin assets _ should_ be loaded using ` /api/plugins/<plugin-name> ` Bridge endpoint which
189- matches the ` 'self' ` CSP source of Console application .
198+ matches the ` 'self' ` CSP source for all Console assets served via Bridge .
190199
191- See ` cspSources ` and ` cspDirectives ` in
192- [ ` pkg/server/server .go ` ] ( https://github.com/openshift/console/blob/master/pkg/server/server .go )
200+ Refer to ` BuildCSPDirectives ` function in
201+ [ ` pkg/utils/utils .go ` ] ( https://github.com/openshift/console/blob/master/pkg/utils/utils .go )
193202for details on the current Console CSP implementation.
194203
204+ Refer to [ Dynamic Plugins feature page] [ console-doc-feature-page ] section on Content Security Policy
205+ for more details.
206+
195207### Changes in Console CSP
196208
197- This section documents notable changes in the Console Content Security Policy.
209+ This section documents notable changes in the Console Content Security Policy implementation .
198210
199211#### Console 4.18.x
200212
201- Console CSP is deployed in report-only mode. CSP violations will be logged in the browser console
202- but the associated CSP directives will not be enforced.
213+ Console deploys CSP in report-only mode; CSP violations will be logged in the browser console
214+ and CSP violation data may be reported through telemetry service in production deployments.
215+
216+ In a future release, Console will begin enforcing CSP. To test your plugin with CSP, enable
217+ the ` ConsolePluginContentSecurityPolicy ` feature gate on a test cluster. This feature gate
218+ should ** not** be enabled on production clusters. Enabling this feature gate also allows you
219+ to set ` spec.contentSecurityPolicy ` in your ` ConsolePlugin ` resource to extend existing Console
220+ CSP directives, for example:
221+
222+ ``` yaml
223+ apiVersion : console.openshift.io/v1
224+ kind : ConsolePlugin
225+ metadata :
226+ name : cron-tab
227+ spec :
228+ displayName : ' Cron Tab'
229+ contentSecurityPolicy :
230+ - directive : ' ScriptSrc'
231+ values :
232+ - ' https://example1.com/'
233+ - ' https://example2.com/'
234+ ` ` `
235+
236+ #### Console 4.19.x
237+
238+ The CSP feature is enabled by default. CSP implementation remains in report-only mode.
203239
204240## Plugin metadata
205241
0 commit comments