Chapter 7. Red Hat Developer Hub integration with Amazon Web Services (AWS) You can integrate your Red Hat Developer Hub application with Amazon Web Services (AWS), which can help you streamline your workflows within the AWS ecosystem. Integrating the Developer Hub resources with AWS provides access to a comprehensive suite of tools, services, and solutions. The integration with AWS requires the deployment of Developer Hub in Elastic Kubernetes Service (EKS) using one of the following methods: The Helm chart The Red Hat Developer Hub Operator 7.1. Monitoring and logging with Amazon Web Services (AWS) in Red Hat Developer Hub In the Red Hat Developer Hub, monitoring and logging are facilitated through Amazon Web Services (AWS) integration. With features like Amazon CloudWatch for real-time monitoring and Amazon Prometheus for comprehensive logging, you can ensure the reliability, scalability, and compliance of your Developer Hub application hosted on AWS infrastructure. This integration enables you to oversee, diagnose, and refine your applications in the Red Hat ecosystem, leading to an improved development and operational journey. 7.1.1. Monitoring with Amazon Prometheus Red Hat Developer Hub provides Prometheus metrics related to the running application. For more information about enabling or deploying Prometheus for EKS clusters, see Prometheus metrics in the Amazon documentation. To monitor Developer Hub using Amazon Prometheus , you need to create an Amazon managed service for the Prometheus workspace and configure the ingestion of the Developer Hub Prometheus metrics. For more information, see Create a workspace and Ingest Prometheus metrics to the workspace sections in the Amazon documentation. After ingesting Prometheus metrics into the created workspace, you can configure the metrics scraping to extract data from pods based on specific pod annotations. 7.1.1.1. Configuring annotations for monitoring You can configure the annotations for monitoring in both Helm deployment and Operator-backed deployment. Helm deployment To annotate the backstage pod for monitoring, update your values.yaml file as follows: upstream: backstage: # --- TRUNCATED --- podAnnotations: prometheus.io/scrape: 'true' prometheus.io/path: '/metrics' prometheus.io/port: '7007' prometheus.io/scheme: 'http' Operator-backed deployment Procedure As an administrator of the operator, edit the default configuration to add Prometheus annotations as follows: # Update OPERATOR_NS accordingly OPERATOR_NS=rhdh-operator kubectl edit configmap backstage-default-config -n "USD{OPERATOR_NS}" Find the deployment.yaml key in the ConfigMap and add the annotations to the spec.template.metadata.annotations field as follows: deployment.yaml: |- apiVersion: apps/v1 kind: Deployment # --- truncated --- spec: template: # --- truncated --- metadata: labels: rhdh.redhat.com/app: # placeholder for 'backstage-<cr-name>' # --- truncated --- annotations: prometheus.io/scrape: 'true' prometheus.io/path: '/metrics' prometheus.io/port: '7007' prometheus.io/scheme: 'http' # --- truncated --- Save your changes. Verification To verify if the scraping works: Use kubectl to port-forward the Prometheus console to your local machine as follows: kubectl --namespace=prometheus port-forward deploy/prometheus-server 9090 Open your web browser and navigate to http://localhost:9090 to access the Prometheus console. Monitor relevant metrics, such as process_cpu_user_seconds_total . 7.1.2. Logging with Amazon CloudWatch logs Logging within the Red Hat Developer Hub relies on the winston library . By default, logs at the debug level are not recorded. To activate debug logs, you must set the environment variable LOG_LEVEL to debug in your Red Hat Developer Hub instance. 7.1.2.1. Configuring the application log level You can configure the application log level in both Helm deployment and Operator-backed deployment. Helm deployment To update the logging level, add the environment variable LOG_LEVEL to your Helm chart's values.yaml file: upstream: backstage: # --- Truncated --- extraEnvVars: - name: LOG_LEVEL value: debug Operator-backed deployment You can modify the logging level by including the environment variable LOG_LEVEL in your custom resource as follows: spec: # Other fields omitted application: extraEnvs: envs: - name: LOG_LEVEL value: debug 7.1.2.2. Retrieving logs from Amazon CloudWatch The CloudWatch Container Insights are used to capture logs and metrics for Amazon EKS. For more information, see Logging for Amazon EKS documentation. To capture the logs and metrics, install the Amazon CloudWatch Observability EKS add-on in your cluster. Following the setup of Container Insights, you can access container logs using Logs Insights or Live Tail views. CloudWatch names the log group where all container logs are consolidated in the following manner: /aws/containerinsights/<ClusterName>/application Following is an example query to retrieve logs from the Developer Hub instance: fields @timestamp, @message, kubernetes.container_name | filter kubernetes.container_name in ["install-dynamic-plugins", "backstage-backend"] 7.2. Using Amazon Cognito as an authentication provider in Red Hat Developer Hub In this section, Amazon Cognito is an AWS service for adding an authentication layer to Developer Hub. You can sign in directly to the Developer Hub using a user pool or fedarate through a third-party identity provider. Although Amazon Cognito is not part of the core authentication providers for the Developer Hub, it can be integrated using the generic OpenID Connect (OIDC) provider. You can configure your Developer Hub in both Helm Chart and Operator-backed deployments. Prerequisites You have a User Pool or you have created a new one. For more information about user pools, see Amazon Cognito user pools documentation. Note Ensure that you have noted the AWS region where the user pool is located and the user pool ID. You have created an App Client within your user pool for integrating the hosted UI. For more information, see Setting up the hosted UI with the Amazon Cognito console . When setting up the hosted UI using the Amazon Cognito console, ensure to make the following adjustments: In the Allowed callback URL(s) section, include the URL https://<rhdh_url>/api/auth/oidc/handler/frame . Ensure to replace <rhdh_url> with your Developer Hub application's URL, such as, my.rhdh.example.com . Similarly, in the Allowed sign-out URL(s) section, add https://<rhdh_url> . Replace <rhdh_url> with your Developer Hub application's URL, such as my.rhdh.example.com . Under OAuth 2.0 grant types , select Authorization code grant to return an authorization code. Under OpenID Connect scopes , ensure to select at least the following scopes: OpenID Profile Email Helm deployment Procedure Edit or create your custom app-config-rhdh ConfigMap as follows: apiVersion: v1 kind: ConfigMap metadata: name: app-config-rhdh data: "app-config-rhdh.yaml": | # --- Truncated --- app: title: Red Hat Developer Hub signInPage: oidc auth: environment: production session: secret: USD{AUTH_SESSION_SECRET} providers: oidc: production: clientId: USD{AWS_COGNITO_APP_CLIENT_ID} clientSecret: USD{AWS_COGNITO_APP_CLIENT_SECRET} metadataUrl: USD{AWS_COGNITO_APP_METADATA_URL} callbackUrl: USD{AWS_COGNITO_APP_CALLBACK_URL} scope: 'openid profile email' prompt: auto Edit or create your custom secrets-rhdh Secret using the following template: apiVersion: v1 kind: Secret metadata: name: secrets-rhdh stringData: AUTH_SESSION_SECRET: "my super auth session secret - change me!!!" AWS_COGNITO_APP_CLIENT_ID: "my-aws-cognito-app-client-id" AWS_COGNITO_APP_CLIENT_SECRET: "my-aws-cognito-app-client-secret" AWS_COGNITO_APP_METADATA_URL: "https://cognito-idp.[region].amazonaws.com/[userPoolId]/.well-known/openid-configuration" AWS_COGNITO_APP_CALLBACK_URL: "https://[rhdh_dns]/api/auth/oidc/handler/frame" Add references of both the ConfigMap and Secret resources in your values.yaml file: upstream: backstage: image: pullSecrets: - rhdh-pull-secret podSecurityContext: fsGroup: 2000 extraAppConfig: - filename: app-config-rhdh.yaml configMapRef: app-config-rhdh extraEnvVarsSecrets: - secrets-rhdh Upgrade the Helm deployment: helm upgrade rhdh \ openshift-helm-charts/redhat-developer-hub \ [--version 1.2.6] \ --values /path/to/values.yaml Operator-backed deployment Add the following code to your app-config-rhdh ConfigMap: apiVersion: v1 kind: ConfigMap metadata: name: app-config-rhdh data: "app-config-rhdh.yaml": | # --- Truncated --- signInPage: oidc auth: # Production to disable guest user login environment: production # Providing an auth.session.secret is needed because the oidc provider requires session support. session: secret: USD{AUTH_SESSION_SECRET} providers: oidc: production: # See https://github.com/backstage/backstage/blob/master/plugins/auth-backend-module-oidc-provider/config.d.ts clientId: USD{AWS_COGNITO_APP_CLIENT_ID} clientSecret: USD{AWS_COGNITO_APP_CLIENT_SECRET} metadataUrl: USD{AWS_COGNITO_APP_METADATA_URL} callbackUrl: USD{AWS_COGNITO_APP_CALLBACK_URL} # Minimal set of scopes needed. Feel free to add more if needed. scope: 'openid profile email' # Note that by default, this provider will use the 'none' prompt which assumes that your are already logged on in the IDP. # You should set prompt to: # - auto: will let the IDP decide if you need to log on or if you can skip login when you have an active SSO session # - login: will force the IDP to always present a login form to the user prompt: auto Add the following code to your secrets-rhdh Secret: apiVersion: v1 kind: Secret metadata: name: secrets-rhdh stringData: # --- Truncated --- # TODO: Change auth session secret. AUTH_SESSION_SECRET: "my super auth session secret - change me!!!" # TODO: user pool app client ID AWS_COGNITO_APP_CLIENT_ID: "my-aws-cognito-app-client-id" # TODO: user pool app client Secret AWS_COGNITO_APP_CLIENT_SECRET: "my-aws-cognito-app-client-secret" # TODO: Replace region and user pool ID AWS_COGNITO_APP_METADATA_URL: "https://cognito-idp.[region].amazonaws.com/[userPoolId]/.well-known/openid-configuration" # TODO: Replace <rhdh_dns> AWS_COGNITO_APP_CALLBACK_URL: "https://[rhdh_dns]/api/auth/oidc/handler/frame" Ensure your Custom Resource contains references to both the app-config-rhdh ConfigMap and secrets-rhdh Secret: apiVersion: rhdh.redhat.com/v1alpha1 kind: Backstage metadata: # TODO: this the name of your Developer Hub instance name: my-rhdh spec: application: imagePullSecrets: - "rhdh-pull-secret" route: enabled: false appConfig: configMaps: - name: "app-config-rhdh" extraEnvs: secrets: - name: "secrets-rhdh" Optional: If you have an existing Developer Hub instance backed by the Custom Resource and you have not edited it, you can manually delete the Developer Hub deployment to recreate it using the operator. Run the following command to delete the Developer Hub deployment: kubectl delete deployment -l app.kubernetes.io/instance=<CR_NAME> Verification Navigate to your Developer Hub web URL and sign in using OIDC authentication, which prompts you to authenticate through the configured AWS Cognito user pool. Once logged in, access Settings and verify user details.

Commands:
upstream: backstage: # --- TRUNCATED --- podAnnotations: prometheus.io/scrape: 'true' prometheus.io/path: '/metrics' prometheus.io/port: '7007' prometheus.io/scheme: 'http'
Update OPERATOR_NS accordingly OPERATOR_NS=rhdh-operator edit configmap backstage-default-config -n "USD{OPERATOR_NS}"
deployment.yaml: |- apiVersion: apps/v1 kind: Deployment # --- truncated --- spec: template: # --- truncated --- metadata: labels: rhdh.redhat.com/app: # placeholder for 'backstage-<cr-name>' # --- truncated --- annotations: prometheus.io/scrape: 'true' prometheus.io/path: '/metrics' prometheus.io/port: '7007' prometheus.io/scheme: 'http' # --- truncated ---
--namespace=prometheus port-forward deploy/prometheus-server 9090
upstream: backstage: # --- Truncated --- extraEnvVars: - name: LOG_LEVEL value: debug
spec: # Other fields omitted application: extraEnvs: envs: - name: LOG_LEVEL value: debug
fields @timestamp, @message, kubernetes.container_name | filter kubernetes.container_name in ["install-dynamic-plugins", "backstage-backend"]
apiVersion: v1 kind: ConfigMap metadata: name: app-config-rhdh data: "app-config-rhdh.yaml": | # --- Truncated --- app: title: Red Hat Developer Hub signInPage: oidc auth: environment: production session: secret: USD{AUTH_SESSION_SECRET} providers: oidc: production: clientId: USD{AWS_COGNITO_APP_CLIENT_ID} clientSecret: USD{AWS_COGNITO_APP_CLIENT_SECRET} metadataUrl: USD{AWS_COGNITO_APP_METADATA_URL} callbackUrl: USD{AWS_COGNITO_APP_CALLBACK_URL} scope: 'openid profile email' prompt: auto
apiVersion: v1 kind: Secret metadata: name: secrets-rhdh stringData: AUTH_SESSION_SECRET: "my super auth session secret - change me!!!" AWS_COGNITO_APP_CLIENT_ID: "my-aws-cognito-app-client-id" AWS_COGNITO_APP_CLIENT_SECRET: "my-aws-cognito-app-client-secret" AWS_COGNITO_APP_METADATA_URL: "https://cognito-idp.[region].amazonaws.com/[userPoolId]/.well-known/openid-configuration" AWS_COGNITO_APP_CALLBACK_URL: "https://[rhdh_dns]/api/auth/oidc/handler/frame"
upstream: backstage: image: pullSecrets: - rhdh-pull-secret podSecurityContext: fsGroup: 2000 extraAppConfig: - filename: app-config-rhdh.yaml configMapRef: app-config-rhdh extraEnvVarsSecrets: - secrets-rhdh
helm upgrade rhdh openshift-helm-charts/redhat-developer-hub [--version 1.2.6] --values /path/to/values.yaml
apiVersion: v1 kind: ConfigMap metadata: name: app-config-rhdh data: "app-config-rhdh.yaml": | # --- Truncated --- signInPage: oidc auth: # Production to disable guest user login environment: production # Providing an auth.session.secret is needed because the oidc provider requires session support. session: secret: USD{AUTH_SESSION_SECRET} providers: oidc: production: # See https://github.com/backstage/backstage/blob/master/plugins/auth-backend-module-oidc-provider/config.d.ts clientId: USD{AWS_COGNITO_APP_CLIENT_ID} clientSecret: USD{AWS_COGNITO_APP_CLIENT_SECRET} metadataUrl: USD{AWS_COGNITO_APP_METADATA_URL} callbackUrl: USD{AWS_COGNITO_APP_CALLBACK_URL} # Minimal set of scopes needed. Feel free to add more if needed. scope: 'openid profile email' # Note that by default, this provider will use the 'none' prompt which assumes that your are already logged on in the IDP. # You should set prompt to: # - auto: will let the IDP decide if you need to log on or if you can skip login when you have an active SSO session # - login: will force the IDP to always present a login form to the user prompt: auto
apiVersion: v1 kind: Secret metadata: name: secrets-rhdh stringData: # --- Truncated --- # TODO: Change auth session secret. AUTH_SESSION_SECRET: "my super auth session secret - change me!!!" # TODO: user pool app client ID AWS_COGNITO_APP_CLIENT_ID: "my-aws-cognito-app-client-id" # TODO: user pool app client Secret AWS_COGNITO_APP_CLIENT_SECRET: "my-aws-cognito-app-client-secret" # TODO: Replace region and user pool ID AWS_COGNITO_APP_METADATA_URL: "https://cognito-idp.[region].amazonaws.com/[userPoolId]/.well-known/openid-configuration" # TODO: Replace <rhdh_dns> AWS_COGNITO_APP_CALLBACK_URL: "https://[rhdh_dns]/api/auth/oidc/handler/frame"
apiVersion: rhdh.redhat.com/v1alpha1 kind: Backstage metadata: # TODO: this the name of your Developer Hub instance name: my-rhdh spec: application: imagePullSecrets: - "rhdh-pull-secret" route: enabled: false appConfig: configMaps: - name: "app-config-rhdh" extraEnvs: secrets: - name: "secrets-rhdh"
delete deployment -l app.kubernetes.io/instance=<CR_NAME>