redhat-developer · JslYoon · Jun 25, 2026
@@ -166,8 +166,6 @@ runs:
           "--set route.enabled=false"
           "--set upstream.ingress.enabled=true"
           "--set global.host=rhdh.127.0.0.1.sslip.io"
-          "--set upstream.backstage.podSecurityContext.runAsUser=1001"
-          "--set upstream.backstage.podSecurityContext.runAsGroup=1001"
           "--set upstream.backstage.podSecurityContext.fsGroup=1001"
         )
         if [[ -n "$INPUT_EXTRA_HELM_ARGS" ]]; then

@@ -16,7 +16,7 @@ repos:
       - id: helm-dependency-update
         name: helm-dependency-update
         entry: helm dependency update charts/backstage/vendor/backstage/charts/backstage
-        language: unsupported
+        language: system
         pass_filenames: false
         files: charts/backstage/vendor/backstage/charts/backstage/Chart\.(ya?ml|lock)$
       - id: jsonschema-dereference

@@ -47,4 +47,4 @@ sources: []
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
 # Note that when this chart is published to https://github.com/openshift-helm-charts/charts
 # it will follow the RHDH versioning 1.y.z
-version: 5.12.4
+version: 5.12.5
@@ -1,7 +1,7 @@
 
 # RHDH Backstage Helm Chart for OpenShift
 
-![Version: 5.12.4](https://img.shields.io/badge/Version-5.12.4-informational?style=flat-square)
+![Version: 5.12.5](https://img.shields.io/badge/Version-5.12.5-informational?style=flat-square)
 ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 A Helm chart for deploying Red Hat Developer Hub, which is a Red Hat supported version of Backstage.
@@ -21,15 +21,15 @@ For the **Generally Available** version of this chart, see:
 
 | Name | Email | Url |
 | ---- | ------ | --- |
-| Red Hat |  | <https://redhat.com> |
+| Red Hat |  | https://redhat.com |
 
 ## TL;DR
 
 ```console
 helm repo add bitnami https://charts.bitnami.com/bitnami
 helm repo add redhat-developer https://redhat-developer.github.io/rhdh-chart
 
-helm install my-backstage redhat-developer/backstage --version 5.12.4
+helm install my-backstage redhat-developer/backstage --version 5.12.5
 ```
 
 ## Introduction
@@ -156,7 +156,7 @@ Kubernetes: `>= 1.27.0-0`
 
 | Repository | Name | Version |
 |------------|------|---------|
-| file://./vendor/backstage/charts/backstage/ | upstream(backstage) | 2.7.0 |
+| file://./vendor/backstage/charts/backstage/ | backstage | 2.7.0 |
 | https://charts.bitnami.com/bitnami | common | 2.39.0 |
 
 ## Values

@@ -185,7 +185,7 @@
                         "enabled": true,
                         "initContainer": {
                             "args": [
-                                "mkdir -p /tmp/data && echo 'Copying Lightspeed RAG data...' && cp -r /rag/vector_db /rag-content/ && cp -r /rag/embeddings_model /rag-content/ && echo 'Copy complete.'"
+                                "mkdir -p /tmp/data && echo 'Copying Lightspeed RAG data...' && cp -r --no-preserve=mode,ownership /rag/vector_db /rag-content/ && cp -r --no-preserve=mode,ownership /rag/embeddings_model /rag-content/ && mkdir -p /rag-content/vector_db/notebooks && chmod -R a+rwX /rag-content/embeddings_model && echo 'Copy complete.'"
                             ],
                             "command": [
                                 "sh",

@@ -135,8 +135,10 @@ global:
         - >-
           mkdir -p /tmp/data &&
           echo 'Copying Lightspeed RAG data...' &&
-          cp -r /rag/vector_db /rag-content/ &&
-          cp -r /rag/embeddings_model /rag-content/ &&
+          cp -r --no-preserve=mode,ownership /rag/vector_db /rag-content/ &&
+          cp -r --no-preserve=mode,ownership /rag/embeddings_model /rag-content/ &&
+          mkdir -p /rag-content/vector_db/notebooks &&
+          chmod -R a+rwX /rag-content/embeddings_model &&
           echo 'Copy complete.'
       env: []
       # -- Resource requests/limits for the Lightspeed RAG bootstrap init container.

@@ -12,7 +12,7 @@ A Helm chart for running the RHDH Must-Gather diagnostic tool on Kubernetes
 
 | Name | Email | Url |
 | ---- | ------ | --- |
-| Red Hat |  | <https://redhat.com> |
+| Red Hat |  | https://redhat.com |
 
 ## Source Code
 
@@ -108,7 +108,7 @@ The command removes all the Kubernetes resources associated with the chart and d
 | Key | Description | Type | Default |
 |-----|-------------|------|---------|
 | affinity | Affinity rules for pod scheduling | object | `{}` |
-| dataHolder | Runs alongside the gather container and stays alive so you can exec in and retrieve the output. | object | `{"resources":{"limits":{"cpu":"100m","ephemeral-storage":"64Mi","memory":"128Mi"},"requests":{"cpu":"50m","ephemeral-storage":"32Mi","memory":"64Mi"}}}` |
+| dataHolder | Data holder container configuration -- Runs alongside the gather container and stays alive so you can exec in and retrieve the output. | object | `{"resources":{"limits":{"cpu":"100m","ephemeral-storage":"64Mi","memory":"128Mi"},"requests":{"cpu":"50m","ephemeral-storage":"32Mi","memory":"64Mi"}}}` |
 | dataHolder.resources | Resource requests and limits for the data-holder container | object | `{"limits":{"cpu":"100m","ephemeral-storage":"64Mi","memory":"128Mi"},"requests":{"cpu":"50m","ephemeral-storage":"32Mi","memory":"64Mi"}}` |
 | fullnameOverride |  | string | `""` |
 | gather | Gather script configuration | object | `{"clusterInfo":false,"cmdTimeout":"30","extraArgs":[],"extraEnvVars":[],"heapDump":{"bufferSize":"","enabled":false,"instances":"","method":"","remoteDir":"","timeout":""},"logLevel":"info","namespaces":[],"since":"","sinceTime":"","withHelm":true,"withIngress":true,"withNamespaceInspect":true,"withOperator":true,"withOrchestrator":true,"withPlatform":true,"withRoute":true,"withSecrets":false}` |
@@ -123,7 +123,7 @@ The command removes all the Kubernetes resources associated with the chart and d
 | gather.heapDump.remoteDir | Directory in container where heap dumps are written for SIGUSR2 method. Must be writable inside the gather container. | string | `""` |
 | gather.heapDump.timeout | Timeout in seconds for heap dump collection | string | `""` |
 | gather.logLevel | Log level: info, INFO, debug, DEBUG, trace, TRACE | string | `"info"` |
-| gather.namespaces | Example: ["rhdh-prod", "rhdh-staging"] | list | `[]` |
+| gather.namespaces | Limit collection to specific namespaces (only effective when rbac.scope is "cluster"). -- Ignored when rbac.scope is "namespace" (collection is restricted to the release namespace). -- Example: ["rhdh-prod", "rhdh-staging"] | list | `[]` |
 | gather.since | Relative time for log collection (e.g., "2h", "30m") | string | `""` |
 | gather.sinceTime | Absolute timestamp for log collection (RFC3339 format) | string | `""` |
 | gather.withOperator | Collection features (enabled by default; set to false to skip) | bool | `true` |
@@ -143,20 +143,21 @@ The command removes all the Kubernetes resources associated with the chart and d
 | podSecurityContext | Pod security context | object | `{"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}` |
 | rbac | RBAC configuration | object | `{"create":true,"rules":{"backstages":true,"ingresses":true,"knative":true,"olm":true,"platform":true,"routes":true,"sonataflow":true},"scope":"cluster"}` |
 | rbac.create | Create RBAC resources (Role/ClusterRole and bindings) | bool | `true` |
-| rbac.rules | a rule here does not require disabling the corresponding gather.with* flag. | object | `{"backstages":true,"ingresses":true,"knative":true,"olm":true,"platform":true,"routes":true,"sonataflow":true}` |
+| rbac.rules | Control which API-group rules are included in the Role/ClusterRole. -- Disable a rule if the installing user cannot grant those permissions -- (Kubernetes requires you to already hold any permission you grant). -- The gather script handles missing permissions gracefully, so disabling -- a rule here does not require disabling the corresponding gather.with* flag. | object | `{"backstages":true,"ingresses":true,"knative":true,"olm":true,"platform":true,"routes":true,"sonataflow":true}` |
 | rbac.rules.backstages | rhdh.redhat.com — Backstage custom resources | bool | `true` |
 | rbac.rules.ingresses | networking.k8s.io — Ingresses, NetworkPolicies | bool | `true` |
 | rbac.rules.knative | operator.knative.dev, operator.serverless.openshift.io — Knative/Serverless | bool | `true` |
 | rbac.rules.olm | operators.coreos.com — OLM resources (subscriptions, CSVs, etc.) | bool | `true` |
 | rbac.rules.platform | config.openshift.io — ClusterVersions, Infrastructures (cluster scope only) | bool | `true` |
 | rbac.rules.routes | route.openshift.io — OpenShift Routes | bool | `true` |
 | rbac.rules.sonataflow | sonataflow.org — SonataFlow custom resources | bool | `true` |
+| rbac.scope | Scope of the RBAC role: "cluster" creates a ClusterRole with cluster-wide read access; -- "namespace" creates a namespace-scoped Role limited to the release namespace only -- (gather.namespaces is ignored; collection is restricted to the release namespace) | string | `"cluster"` |
 | resources | Resource requests and limits for the gather container | object | `{"limits":{"cpu":"500m","ephemeral-storage":"128Mi","memory":"512Mi"},"requests":{"cpu":"100m","ephemeral-storage":"64Mi","memory":"128Mi"}}` |
 | securityContext | Container security context | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]}}` |
 | serviceAccount | Service account configuration | object | `{"annotations":{},"name":"","tokenExpirationSeconds":3600}` |
 | serviceAccount.annotations | Annotations to add to the service account | object | `{}` |
-| serviceAccount.name | If not set, a name is generated using the fullname template. | string | `""` |
-| serviceAccount.tokenExpirationSeconds | into the gather init container (minimum 600). | int | `3600` |
+| serviceAccount.name | The name of the service account to use. -- If not set, a name is generated using the fullname template. | string | `""` |
+| serviceAccount.tokenExpirationSeconds | Expiration (in seconds) for the bound service account token projected -- into the gather init container (minimum 600). | int | `3600` |
 | strategy | Deployment strategy | object | `{"type":"Recreate"}` |
 | test | Helm test configuration | object | `{"enabled":true,"image":{"digest":"","pullPolicy":"","registry":"docker.io","repository":"bitnami/kubectl","tag":"latest"}}` |
 | test.enabled | Enable the Helm test | bool | `true` |

@@ -10,7 +10,7 @@ Helm chart to deploy the Orchestrator solution's required infrastructure suite o
 
 | Name | Email | Url |
 | ---- | ------ | --- |
-| Red Hat Developer Hub Team |  | <https://github.com/redhat-developer/rhdh-chart> |
+| Red Hat Developer Hub Team |  | https://github.com/redhat-developer/rhdh-chart |
 
 ## Source Code
 

@@ -10,7 +10,7 @@ A Helm chart to install Openshift GitOps and Openshift Pipelines, which are requ
 
 | Name | Email | Url |
 | ---- | ------ | --- |
-| Red Hat Developer Hub Team |  | <https://github.com/redhat-developer/rhdh-chart> |
+| Red Hat Developer Hub Team |  | https://github.com/redhat-developer/rhdh-chart |
 
 ## Source Code
 

@@ -10,7 +10,7 @@ This Helm chart deploys the Orchestrator Software Templates for Red Hat Develope
 
 | Name | Email | Url |
 | ---- | ------ | --- |
-| Red Hat Developer Hub Team |  | <https://github.com/redhat-developer/rhdh-chart> |
+| Red Hat Developer Hub Team |  | https://github.com/redhat-developer/rhdh-chart |
 
 ## Source Code