Bug 2021297 - Dynamic Plugins: Console isn't honoring declared `@console/pluginAPI` dependency
Summary: Dynamic Plugins: Console isn't honoring declared `@console/pluginAPI` dependency
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Management Console
Version: 4.10
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
: 4.12.0
Assignee: Vojtech Szocs
QA Contact: Yadan Pei
Depends On:
Blocks: 2102335
TreeView+ depends on / blocked
Reported: 2021-11-08 18:28 UTC by Samuel Padgett
Modified: 2023-01-17 19:46 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
No end user impact.
Clone Of:
: 2102335 (view as bug list)
Last Closed: 2023-01-17 19:46:45 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Github openshift console-operator pull 659 0 None open Bug 2021297: Publish RELEASE_VERSION var into the console-config.yaml 2022-06-21 10:06:29 UTC
Github openshift console pull 11626 0 None open Bug 2021297: Implement dynamic plugin dependency resolution 2022-06-29 17:28:36 UTC
Red Hat Product Errata RHSA-2022:7399 0 None None None 2023-01-17 19:46:57 UTC

Description Samuel Padgett 2021-11-08 18:28:03 UTC
The console doesn't honor the `@console/pluginAPI` version range declared in the plugin manifest. This means console can load incompatible plugins, causing runtime errors and possibly breaking console functionality.


Console should inspect the version range and compare it to the OpenShift console version. If the versions don't match, the plugin should not be loaded. Likely this will require operator to pass the version to console on startup.

This is important for 4.10 since some operators might need to deliver multiple plugins and enable only the compatible versions as internal APIs have changed from 4.9 to 4.10.

Comment 2 Vojtech Szocs 2022-06-02 13:10:46 UTC
Note that the associated PR also covers resolving dependencies on other plugins, in addition to resolving dependency on Console itself (@console/pluginAPI).

Comment 4 Yadan Pei 2022-07-22 08:55:25 UTC
1. update console-demo-plugin manifest dependencies.@console/pluginAPI to semver version "~4.9.0"
$ git diff dynamic-demo-plugin/package.json
diff --git a/dynamic-demo-plugin/package.json b/dynamic-demo-plugin/package.json
index dd0e3a1436..01f985f454 100644
--- a/dynamic-demo-plugin/package.json
+++ b/dynamic-demo-plugin/package.json
@@ -66,7 +66,7 @@
       "projectOverview": "./utils/project-overview"
     "dependencies": {
-      "@console/pluginAPI": "*"
+      "@console/pluginAPI": "~4.9.0"
     "disableStaticPlugins": [

2. deploy and enable console-demo-plugin on a 4.12.0-0.nightly-2022-07-21-144610 cluster which has releaseVersion also set to 4.12.0-0.nightly-2022-07-21-144610
$ oc get cm console-config -n openshift-console -o yaml | grep releaseVersion
      releaseVersion: 4.12.0-0.nightly-2022-07-21-144610
3. monitor the logs in javascript console, we can see error messages:
Error while loading plugin console-demo-plugin from /api/plugins/console-demo-plugin/ u: Unmet dependency on Console plugin API:
@console/pluginAPI: required ~4.9.0, current 4.12.0-0.nightly-2022-07-21-144610

when `@console/pluingAPI` doesn't match openshift console version, the plugin will not be loaded

when we defines some dependencies not existing
$ git diff dynamic-demo-plugin/package.json
diff --git a/dynamic-demo-plugin/package.json b/dynamic-demo-plugin/package.json
index dd0e3a1436..34ff180eda 100644
--- a/dynamic-demo-plugin/package.json
+++ b/dynamic-demo-plugin/package.json
@@ -66,7 +66,8 @@
       "projectOverview": "./utils/project-overview"
     "dependencies": {
-      "@console/pluginAPI": "*"
+      "@console/pluginAPI": "=4.12.0-0.nightly-2022-07-21-144610",
+      "foo": "^1.0.0"
we can see errors in javascript console:

Error while loading plugin console-demo-plugin from /api/plugins/console-demo-plugin/ Error: Dependent plugins are not available: foo

Comment 7 errata-xmlrpc 2023-01-17 19:46:45 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.12.0 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.