WIP: Add MCP Inspector Tools

.dockerignore

@@ -0,0 +1,7 @@
+.git
+.claude
+node_modules
+dist
+coverage
+playwright-report
+test-results

Dockerfile

@@ -27,23 +27,26 @@ RUN test -f ./dist/plugin-manifest.json && \
     test -d ./dist/locales && \
     echo "All required files are present."
 
-# Stage 2: Runtime image on target architecture
-FROM registry.access.redhat.com/ubi9/ubi-minimal:latest
+# Stage 2: Build the small asset server and MCP relay on the target architecture.
+FROM golang:1.24 AS go-builder
+
+WORKDIR /usr/src/app
+COPY go.mod ./
+COPY cmd/plugin-server ./cmd/plugin-server
+RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /plugin-server ./cmd/plugin-server
 
-RUN microdnf module enable nginx:1.24 -y && \
-    microdnf install -y nginx && \
-    microdnf clean all
+# Stage 3: Runtime image on target architecture
+FROM registry.access.redhat.com/ubi9/ubi-minimal:latest
 
-RUN mkdir -p /var/cache/nginx /var/log/nginx /run && \
-    chown -R root:0 /var/cache/nginx /var/log/nginx /run /usr/share/nginx/html && \
-    chmod -R g+rwX /var/cache/nginx /var/log/nginx /run && \
-    chmod -R g+rX /usr/share/nginx/html
+RUN mkdir -p /usr/share/kuadrant-console-plugin && \
+    chown -R root:0 /usr/share/kuadrant-console-plugin && \
+    chmod -R g+rX /usr/share/kuadrant-console-plugin
 
-COPY --from=builder /usr/src/app/dist/ /usr/share/nginx/html/
-COPY entrypoint.sh /usr/share/nginx/html/entrypoint.sh
+COPY --from=builder /usr/src/app/dist/ /usr/share/kuadrant-console-plugin/
+COPY --from=go-builder /plugin-server /usr/local/bin/plugin-server
 
 ARG QUAY_IMAGE_EXPIRY="never"
 LABEL quay.expires-after=${QUAY_IMAGE_EXPIRY}
 
 USER 1001
-ENTRYPOINT ["/usr/share/nginx/html/entrypoint.sh"]
+ENTRYPOINT ["/usr/local/bin/plugin-server"]

Makefile

@@ -1,7 +1,10 @@
-.PHONY: oinc oinc-teardown
+.PHONY: oinc oinc-sync-plugin-proxy oinc-teardown
 
 oinc:
 	./start-local.sh
 
+oinc-sync-plugin-proxy:
+	./scripts/sync-console-plugin-proxy.sh
+
 oinc-teardown:
 	./scripts/teardown.sh

README.md

@@ -43,15 +43,25 @@ Navigate to <http://localhost:9000> and click "Kuadrant" in the left sidebar men
 
 [oinc](https://github.com/jasonmadigan/oinc) (OKD in a container) provides a lightweight OpenShift-compatible cluster locally with the console built in. This sets up a full environment with Kuadrant, Istio, cert-manager, and the OpenShift console, with hot reloading for plugin development.
 
-Prerequisites: [oinc](https://github.com/jasonmadigan/oinc), [kubectl](https://kubernetes.io/docs/tasks/tools/), Docker or podman, Node.js.
+Prerequisites: [oinc v0.4.6 or newer](https://github.com/jasonmadigan/oinc/releases/tag/v0.4.6), [kubectl](https://kubernetes.io/docs/tasks/tools/), Docker or podman, Node.js.
 
 ```bash
-make oinc          # create cluster + start plugin dev server with hot reload
-make oinc-teardown # tear it all down
+make oinc                   # create cluster + start plugin dev server with hot reload
+make oinc-sync-plugin-proxy # manually resync an operator-reconciled backend proxy
+make oinc-teardown          # tear it all down
 ```
 
 Console runs at http://localhost:9000, plugin at http://localhost:9001. If the cluster already exists, `make oinc` skips setup and just starts the plugin server.
 
+oinc runs Console as a standalone development container, so it does not have
+the OpenShift Console operator to consume `ConsolePlugin.spec.proxy`. When the
+Kuadrant Operator has reconciled a proxy, `make oinc` automatically translates
+it into the standalone Console configuration. Use
+`make oinc-sync-plugin-proxy` to resync manually if the backend Service changes
+while the development environment is already running. This is development glue
+only; the Kuadrant Operator remains the source of truth for production plugin
+resources. Set `OINC_BIN` if the required oinc binary is not on `PATH`.
+
 ### Option 3: Docker + VSCode Remote Container
 
 Make sure the
@@ -89,9 +99,15 @@ docker buildx build --platform linux/amd64,linux/arm64 -t quay.io/kuadrant/conso
 2. Run the image:
 
 ```bash
-docker run -it --rm -d -p 9001:80 quay.io/kuadrant/console-plugin:latest
+docker run -it --rm -d -p 9001:9443 \
+  -e KUBERNETES_INSECURE_SKIP_TLS_VERIFY=true \
+  quay.io/kuadrant/console-plugin:latest
 ```
 
+The development flag lets the image serve its static assets outside a pod,
+where the Kubernetes service-account CA is not mounted. Do not use it for an
+in-cluster deployment.
+
 NOTE: If you have a Mac with Apple silicon, you will need to add the flag
 `--platform=linux/amd64` when building the image to target the correct platform
 to run in-cluster.

build/suite-router.sh

@@ -102,7 +102,7 @@ if echo "$CHANGED" | grep -qE "^src/components/(AttachedResources|gateway/Gatewa
 fi
 
 if echo "$CHANGED" | grep -qE "^src/components/mcp/"; then
-  SPECS="$SPECS mcp-setup-wizard.spec.ts mcp-overview.spec.ts mcp-wizard.spec.ts mcp-resource-pages.spec.ts"
+  SPECS="$SPECS mcp-setup-wizard.spec.ts mcp-overview.spec.ts mcp-wizard.spec.ts mcp-resource-pages.spec.ts mcp-inspector.spec.ts"
 fi
 
 # Detect test files that changed → run all tags (smoke + nightly) for those files only

charts/openshift-console-plugin/templates/consoleplugin.yaml

@@ -7,12 +7,21 @@ metadata:
     {{- include "openshift-console-plugin.labels" . | nindent 4 }}
 spec:
   displayName: {{ default (printf "%s Plugin" (include "openshift-console-plugin.name" .)) .Values.plugin.description }}
-  i18n: 
+  i18n:
     loadType: Preload
   backend:
     type: Service
     service:
       name: {{ template "openshift-console-plugin.name" . }}
       namespace: {{ .Release.Namespace }}
       port: {{ .Values.plugin.port }}
-      basePath: {{ .Values.plugin.basePath }}
+      basePath: {{ .Values.plugin.basePath }}
+  proxy:
+    - alias: backend
+      authorization: UserToken
+      endpoint:
+        type: Service
+        service:
+          name: {{ template "openshift-console-plugin.name" . }}
+          namespace: {{ .Release.Namespace }}
+          port: {{ .Values.plugin.port }}

charts/openshift-console-plugin/templates/deployment.yaml

@@ -20,7 +20,8 @@ spec:
         - name: {{ template "openshift-console-plugin.name" . }}
           image: {{ required "Plugin image must be specified!" .Values.plugin.image }}
           ports:
-            - containerPort: {{ .Values.plugin.port }}
+            - name: https
+              containerPort: {{ .Values.plugin.port }}
               protocol: TCP
           imagePullPolicy: {{ .Values.plugin.imagePullPolicy }}
           env:
@@ -30,6 +31,10 @@ spec:
               value: {{ .Values.plugin.topologyConfigMapNamespace | default "kuadrant-system" | quote }}
             - name: METRICS_WORKLOAD_SUFFIX
               value: {{ .Values.plugin.metricsWorkloadSuffix | default "-openshift-default" | quote }}
+            - name: TLS_CERTIFICATE_FILE
+              value: /var/cert/tls.crt
+            - name: TLS_KEY_FILE
+              value: /var/cert/tls.key
           {{- if and (.Values.plugin.securityContext.enabled) (.Values.plugin.containerSecurityContext) }}
           securityContext: {{ tpl (toYaml (omit .Values.plugin.containerSecurityContext "enabled")) $ | nindent 12 }}
           {{- end }}
@@ -39,19 +44,11 @@ spec:
             - name: {{ template "openshift-console-plugin.certificateSecret" . }}
               readOnly: true
               mountPath: /var/cert
-            - name: nginx-conf
-              readOnly: true
-              mountPath: /etc/nginx/nginx.conf
-              subPath: nginx.conf
       volumes:
         - name: {{ template "openshift-console-plugin.certificateSecret" . }}
           secret:
             secretName: {{ template "openshift-console-plugin.certificateSecret" . }}
             defaultMode: 420
-        - name: nginx-conf
-          configMap:
-            name: {{ template "openshift-console-plugin.name" . }}
-            defaultMode: 420
       restartPolicy: Always
       dnsPolicy: ClusterFirst
       {{- if and (.Values.plugin.securityContext.enabled) (.Values.plugin.podSecurityContext) }}