WIP: Add MCP Inspector Tools

.dockerignore

@@ -0,0 +1,7 @@
+.git
+.claude
+node_modules
+dist
+coverage
+playwright-report
+test-results

Dockerfile

@@ -16,6 +16,7 @@ RUN yarn config set --home enableGlobalCache true
 WORKDIR /usr/src/app
 
 COPY package.json yarn.lock .yarnrc.yml ./
+COPY .yarn/patches ./.yarn/patches
 RUN YARN_ENABLE_SCRIPTS=false yarn install --immutable
 
 COPY . .
@@ -26,23 +27,26 @@ RUN test -f ./dist/plugin-manifest.json && \
     test -d ./dist/locales && \
     echo "All required files are present."
 
-# Stage 2: Runtime image on target architecture
-FROM registry.access.redhat.com/ubi9/ubi-minimal:latest
+# Stage 2: Build the small asset server and MCP relay on the target architecture.
+FROM golang:1.24 AS go-builder
+
+WORKDIR /usr/src/app
+COPY go.mod ./
+COPY cmd/plugin-server ./cmd/plugin-server
+RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /plugin-server ./cmd/plugin-server
 
-RUN microdnf module enable nginx:1.24 -y && \
-    microdnf install -y nginx && \
-    microdnf clean all
+# Stage 3: Runtime image on target architecture
+FROM registry.access.redhat.com/ubi9/ubi-minimal:latest
 
-RUN mkdir -p /var/cache/nginx /var/log/nginx /run && \
-    chown -R root:0 /var/cache/nginx /var/log/nginx /run /usr/share/nginx/html && \
-    chmod -R g+rwX /var/cache/nginx /var/log/nginx /run && \
-    chmod -R g+rX /usr/share/nginx/html
+RUN mkdir -p /usr/share/kuadrant-console-plugin && \
+    chown -R root:0 /usr/share/kuadrant-console-plugin && \
+    chmod -R g+rX /usr/share/kuadrant-console-plugin
 
-COPY --from=builder /usr/src/app/dist/ /usr/share/nginx/html/
-COPY entrypoint.sh /usr/share/nginx/html/entrypoint.sh
+COPY --from=builder /usr/src/app/dist/ /usr/share/kuadrant-console-plugin/
+COPY --from=go-builder /plugin-server /usr/local/bin/plugin-server
 
 ARG QUAY_IMAGE_EXPIRY="never"
 LABEL quay.expires-after=${QUAY_IMAGE_EXPIRY}
 
 USER 1001
-ENTRYPOINT ["/usr/share/nginx/html/entrypoint.sh"]
+ENTRYPOINT ["/usr/local/bin/plugin-server"]

Makefile

@@ -1,7 +1,10 @@
-.PHONY: oinc oinc-teardown
+.PHONY: oinc oinc-sync-plugin-proxy oinc-teardown
 
 oinc:
 	./start-local.sh
 
+oinc-sync-plugin-proxy:
+	./scripts/sync-console-plugin-proxy.sh
+
 oinc-teardown:
 	./scripts/teardown.sh

README.md

@@ -7,6 +7,7 @@ Based on https://github.com/openshift/console-plugin-template
 ## Screenshots
 
 ![Overview](docs/images/overview.gif)
+
 ## Running
 
 - Target a running OCP with `oc login`
@@ -46,11 +47,20 @@ Prerequisites: [oinc](https://github.com/jasonmadigan/oinc), [kubectl](https://k
 
 ```bash
 make oinc          # create cluster + start plugin dev server with hot reload
+make oinc-sync-plugin-proxy # sync an operator-reconciled backend proxy into dev Console
 make oinc-teardown # tear it all down
 ```
 
 Console runs at http://localhost:9000, plugin at http://localhost:9001. If the cluster already exists, `make oinc` skips setup and just starts the plugin server.
 
+OINC runs Console as a standalone development container, so it does not have
+the OpenShift Console operator to consume `ConsolePlugin.spec.proxy`. After a
+development Kuadrant Operator reconciles a plugin backend proxy, run
+`make oinc-sync-plugin-proxy` once (and again if the backend Service changes).
+This target is development glue only; the Kuadrant Operator remains the source
+of truth for production plugin resources. Set `OINC_BIN` if the development
+OINC binary is not on `PATH`.
+
 ### Option 3: Docker + VSCode Remote Container
 
 Make sure the
@@ -88,9 +98,15 @@ docker buildx build --platform linux/amd64,linux/arm64 -t quay.io/kuadrant/conso
 2. Run the image:
 
 ```bash
-docker run -it --rm -d -p 9001:80 quay.io/kuadrant/console-plugin:latest
+docker run -it --rm -d -p 9001:9443 \
+  -e KUBERNETES_INSECURE_SKIP_TLS_VERIFY=true \
+  quay.io/kuadrant/console-plugin:latest
 ```
 
+The development flag lets the image serve its static assets outside a pod,
+where the Kubernetes service-account CA is not mounted. Do not use it for an
+in-cluster deployment.
+
 NOTE: If you have a Mac with Apple silicon, you will need to add the flag
 `--platform=linux/amd64` when building the image to target the correct platform
 to run in-cluster.
@@ -176,13 +192,14 @@ Update `settings.json` (File > Preferences > Settings):
 ```json
 "editor.formatOnSave": true
 ```
+
 ## Version matrix
 
 | kuadrant-console-plugin version | PatternFly version | Openshift console version | Dynamic Plugin SDK |
-|---------------------------------|--------------------|---------------------------|--------------------|
-|         v0.0.3 - v0.0.18        |          5         |          v4.17.x          |       v1.6.0       |
-|                TBD              |          5         |          v4.18.x          |       v1.8.0       |
-|                TBD              |          6         |          v4.19.x          |         TBD        |
+| ------------------------------- | ------------------ | ------------------------- | ------------------ |
+| v0.0.3 - v0.0.18                | 5                  | v4.17.x                   | v1.6.0             |
+| TBD                             | 5                  | v4.18.x                   | v1.8.0             |
+| TBD                             | 6                  | v4.19.x                   | TBD                |
 
 Openshift console is configured to share modules with its dynamic plugins (console plugins). For more information on versions and changes to the shared modules, please see the shared modules [documentation](https://www.npmjs.com/package/@openshift-console/dynamic-plugin-sdk?activeTab=readme)
 
@@ -236,4 +253,3 @@ Deletions are confirmed interactively in batches of 25.
 ## Troubleshooting
 
 For troubleshooting common issues, please see [TROUBLESHOOTING.md](TROUBLESHOOTING.md).
-

build/suite-router.sh

@@ -102,7 +102,7 @@ if echo "$CHANGED" | grep -qE "^src/components/(AttachedResources|gateway/Gatewa
 fi
 
 if echo "$CHANGED" | grep -qE "^src/components/mcp/"; then
-  SPECS="$SPECS mcp-setup-wizard.spec.ts mcp-overview.spec.ts"
+  SPECS="$SPECS mcp-setup-wizard.spec.ts mcp-overview.spec.ts mcp-inspector.spec.ts"
 fi
 
 # Detect test files that changed → run all tags (smoke + nightly) for those files only

charts/openshift-console-plugin/templates/consoleplugin.yaml

@@ -7,12 +7,21 @@ metadata:
     {{- include "openshift-console-plugin.labels" . | nindent 4 }}
 spec:
   displayName: {{ default (printf "%s Plugin" (include "openshift-console-plugin.name" .)) .Values.plugin.description }}
-  i18n: 
+  i18n:
     loadType: Preload
   backend:
     type: Service
     service:
       name: {{ template "openshift-console-plugin.name" . }}
       namespace: {{ .Release.Namespace }}
       port: {{ .Values.plugin.port }}
-      basePath: {{ .Values.plugin.basePath }}
+      basePath: {{ .Values.plugin.basePath }}
+  proxy:
+    - alias: backend
+      authorization: UserToken
+      endpoint:
+        type: Service
+        service:
+          name: {{ template "openshift-console-plugin.name" . }}
+          namespace: {{ .Release.Namespace }}
+          port: {{ .Values.plugin.port }}

charts/openshift-console-plugin/templates/deployment.yaml

@@ -20,7 +20,8 @@ spec:
         - name: {{ template "openshift-console-plugin.name" . }}
           image: {{ required "Plugin image must be specified!" .Values.plugin.image }}
           ports:
-            - containerPort: {{ .Values.plugin.port }}
+            - name: https
+              containerPort: {{ .Values.plugin.port }}
               protocol: TCP
           imagePullPolicy: {{ .Values.plugin.imagePullPolicy }}
           env:
@@ -30,6 +31,10 @@ spec:
               value: {{ .Values.plugin.topologyConfigMapNamespace | default "kuadrant-system" | quote }}
             - name: METRICS_WORKLOAD_SUFFIX
               value: {{ .Values.plugin.metricsWorkloadSuffix | default "-openshift-default" | quote }}
+            - name: TLS_CERTIFICATE_FILE
+              value: /var/cert/tls.crt
+            - name: TLS_KEY_FILE
+              value: /var/cert/tls.key
           {{- if and (.Values.plugin.securityContext.enabled) (.Values.plugin.containerSecurityContext) }}
           securityContext: {{ tpl (toYaml (omit .Values.plugin.containerSecurityContext "enabled")) $ | nindent 12 }}
           {{- end }}
@@ -39,19 +44,11 @@ spec:
             - name: {{ template "openshift-console-plugin.certificateSecret" . }}
               readOnly: true
               mountPath: /var/cert
-            - name: nginx-conf
-              readOnly: true
-              mountPath: /etc/nginx/nginx.conf
-              subPath: nginx.conf
       volumes:
         - name: {{ template "openshift-console-plugin.certificateSecret" . }}
           secret:
             secretName: {{ template "openshift-console-plugin.certificateSecret" . }}
             defaultMode: 420
-        - name: nginx-conf
-          configMap:
-            name: {{ template "openshift-console-plugin.name" . }}
-            defaultMode: 420
       restartPolicy: Always
       dnsPolicy: ClusterFirst
       {{- if and (.Values.plugin.securityContext.enabled) (.Values.plugin.podSecurityContext) }}