Chapter 2. Breaking changes

Previously, the Topology plugin used topology.view.read permission to control access. Users were unable to configure Topology permissions using the RBAC UI. With this update, users can configure Kubernetes plugin permissions using the RBAC UI, which now governs the access to the Topology plugin. You can now use Kubernetes plugin permissions kubernetes.clusters.read, kubernetes.resources.read and kubernetes.proxy for the Topology plugin, as the Topology-specific permission topology.view.read is removed.

If you are using a CSV permission file, update the following lines:

p, role:default/topology-viewer, topology.view.read, read, allow
p, role:default/topology-viewer, kubernetes.proxy, use, allow

p, role:default/topology-viewer, kubernetes.clusters.read, read, allow
p, role:default/topology-viewer, kubernetes.resources.read, read, allow
p, role:default/topology-viewer, kubernetes.proxy, use, allow

The Auditor format, including audit fields and event names, and IDs, has been updated to align with the new Auditor service conventions defined by the upstream Backstage Auditor Service. Filtering queries based on the old format may fail to work as expected.

Red Hat Developer Hub 1.6 introduces the Backstage Audit Log Service, which replaces the custom audit logging system. This is a significant structural and behavioral change to how audit events are generated and consumed.

The key changes introduced by this transition include the following:

Previously, the Tekton plugin used tekton.view.read permission to control access. Users were unable to configure Tekton permissions using the RBAC UI. With this update, users can configure Kubernetes plugin permissions using the RBAC UI, which now governs the access to the Tekton plugin. You can now use Kubernetes plugin permissions kubernetes.clusters.read, kubernetes.resources.read and kubernetes.proxy for the Tekton plugin, as the Tekton-specific permission tekton.view.read is removed.

If you are using a CSV permission file, update the following lines:

p, role:default/tekton-viewer, tekton.view.read, read, allow
p, role:default/tekton-viewer, kubernetes.proxy, use, allow

p, role:default/tekton-viewer, kubernetes.clusters.read, read, allow
p, role:default/tekton-viewer, kubernetes.resources.read, read, allow
p, role:default/tekton-viewer, kubernetes.proxy, use, allow