feat: enable DCR authentication for Lightspeed MCP servers

- Add custom Lightspeed OCI images with DCR support (dcr-0.4.0)
- Configure MCP server with auth: dcr in values.yaml
- Enable experimentalDynamicClientRegistration
- Add @backstage/plugin-auth for OAuth2 consent page

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: maysunfaisal

charts/rhdh/templates/rbac-policy-configmap.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: rbac-policy
+  namespace: {{ .Release.Namespace }}
+data:
+  rbac-policy.csv: |
+    p, role:default/mcp-admin, catalog.entity.read, read, allow
+    p, role:default/mcp-admin, catalog.entity.create, create, allow
+    p, role:default/mcp-admin, catalog.entity.delete, delete, allow
+    p, role:default/mcp-admin, catalog.entity.refresh, update, allow
+    p, role:default/mcp-admin, catalog.location.read, read, allow
+    p, role:default/mcp-admin, catalog.location.create, create, allow
+    p, role:default/mcp-admin, scaffolder.task.create, create, allow
+    p, role:default/mcp-admin, scaffolder.task.read, read, allow
+    p, role:default/mcp-admin, lightspeed.chat.read, read, allow
+    p, role:default/mcp-admin, lightspeed.chat.create, create, allow
+    p, role:default/mcp-admin, lightspeed.chat.delete, delete, allow
+    p, role:default/mcp-admin, lightspeed.chat.update, update, allow
+    p, role:default/mcp-admin, lightspeed.mcp.read, read, allow
+    p, role:default/mcp-admin, lightspeed.mcp.manage, update, allow
+    p, role:default/mcp-admin, lightspeed.notebooks.use, update, allow
+    g, user:default/mfaisal, role:default/mcp-admin

charts/rhdh/values.yaml

@@ -4,6 +4,24 @@ global:
     includes:
       - "dynamic-plugins.default.yaml"
     plugins:
+      ##### Disable upstream lightspeed (replaced by custom DCR builds) #####
+      - package: oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/red-hat-developer-hub-backstage-plugin-lightspeed:bs_1.49.4__2.8.5
+        disabled: true
+      - package: oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/red-hat-developer-hub-backstage-plugin-lightspeed-backend:bs_1.49.4__2.8.5
+        disabled: true
+
+      ##### OAuth2 consent page plugin (required for DCR) #####
+      - package: oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/backstage-plugin-auth:pr_2498__0.1.6
+        disabled: false
+        pluginConfig:
+          dynamicPlugins:
+            frontend:
+              backstage.plugin-auth:
+                dynamicRoutes:
+                  - path: /oauth2
+                    importName: Router
+                    module: PluginRoot
+
       ##### Custom sign in page plugin #####
       - package: oci://quay.io/redhat-ai-dev/rolling-demo-customized-sign-in-page:v0.1.1
         disabled: false
@@ -319,7 +337,7 @@ global:
   lightspeed:
     enabled: true
     plugins:
-      - package: oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/red-hat-developer-hub-backstage-plugin-lightspeed:bs_1.49.4__2.8.5
+      - package: oci://quay.io/maysunfaisal/rhdh-plugin-lightspeed:dcr-0.6.0!red-hat-developer-hub-backstage-plugin-lightspeed
         disabled: false
         pluginConfig:
           dynamicPlugins:
@@ -346,7 +364,7 @@ global:
                     config:
                       id: lightspeed
                       priority: 100
-      - package: oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/red-hat-developer-hub-backstage-plugin-lightspeed-backend:bs_1.49.4__2.8.5
+      - package: oci://quay.io/maysunfaisal/rhdh-plugin-lightspeed-backend:dcr-0.6.0!red-hat-developer-hub-backstage-plugin-lightspeed-backend
         disabled: false
     secret:
       create: false
@@ -403,6 +421,10 @@ backstage:
               licensedUsers: 50
         auth:
           environment: production
+          experimentalDynamicClientRegistration:
+            enabled: true
+            allowedRedirectUriPatterns:
+              - '*'
           session:
             secret: "${BACKEND_SECRET}"
           providers:
@@ -541,15 +563,22 @@ backstage:
                     - resolver: emailMatchingUserEntityProfileEmail
         lightspeed:
           notebooks:
-            enabled: true
+            enabled: false
             queryDefaults:
-              model: ${NOTEBOOKS_QUERY_MODEL}
-              provider_id: ${NOTEBOOKS_QUERY_PROVIDER_ID}
+              model: "${NOTEBOOKS_QUERY_MODEL}"
+              provider_id: "${NOTEBOOKS_QUERY_PROVIDER_ID}"
           mcpServers:
             - name: mcp-integration-tools
-              token: ${MCP_TOKEN}
+              auth: dcr
         mcpActions:
           namespacedToolNames: false
+        permission:
+          enabled: true
+          rbac:
+            policies-csv-file: /opt/app-root/src/rbac-policy.csv
+            admin:
+              users:
+                - name: user:default/mfaisal
         integrations:
           github:
             - apps:
@@ -656,6 +685,10 @@ backstage:
       extraVolumeMounts:
         - name: dynamic-plugins-root
           mountPath: /opt/app-root/src/dynamic-plugins-root
+        - name: rbac-policy
+          mountPath: /opt/app-root/src/rbac-policy.csv
+          subPath: rbac-policy.csv
+          readOnly: true
         # tmp backstage volume for scaffolder tasks
         - name: backstage-tmp
           mountPath: /tmp
@@ -686,6 +719,9 @@ backstage:
           emptyDir: {}
         - name: extensions-catalog
           emptyDir: {}
+        - name: rbac-policy
+          configMap:
+            name: rbac-policy
       initContainers:
         - name: install-dynamic-plugins
           image: '{{ include "backstage.image" . }}'

scripts/setup-secrets.sh

@@ -28,10 +28,12 @@ SECRET_NAME="llama-stack-secrets"
 log "Creating $SECRET_NAME secret..."
 kubectl create secret generic "$SECRET_NAME" \
     --namespace="$RHDH_NAMESPACE" \
-    --from-literal=ENABLE_VLLM="true" \
+    --from-literal=ENABLE_VLLM="${ENABLE_VLLM:-}" \
+    --from-literal=ENABLE_OPENAI="${ENABLE_OPENAI:-}" \
     --from-literal=ENABLE_VALIDATION="true" \
-    --from-literal=VLLM_URL="$VLLM_URL" \
-    --from-literal=VLLM_API_KEY="$VLLM_API_KEY" \
+    --from-literal=VLLM_URL="${VLLM_URL:-}" \
+    --from-literal=VLLM_API_KEY="${VLLM_API_KEY:-}" \
+    --from-literal=OPENAI_API_KEY="${OPENAI_API_KEY:-}" \
     --from-literal=VALIDATION_PROVIDER="$VALIDATION_PROVIDER" \
     --from-literal=VALIDATION_MODEL_NAME="$VALIDATION_MODEL_NAME" \
     --from-literal=NOTEBOOKS_QUERY_PROVIDER_ID="$NOTEBOOKS_QUERY_PROVIDER_ID" \