diff --git a/.env.example b/.env.example
index ce2ac44..4ae081f 100644
--- a/.env.example
+++ b/.env.example
@@ -1,8 +1,6 @@
-
 export KEYCLOAK_CLIENT_SECRET=""
 export KEYCLOAK_CLIENT_ID=""
 export KEYCLOAK_REALM=""
 export KEYCLOAK_LOGIN_REALM=""
 export KEYCLOAK_METADATA_URL=""
 export KEYCLOAK_BASE_URL=""
-
diff --git a/Makefile b/Makefile
index 2676caf..dc0c6ff 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,7 @@
 NAMESPACE ?= rhdh
 VERSION ?= 1.9
 ORCH ?= false
+PLUGINS ?=
 USE_CONTAINER ?= false
 CATALOG_INDEX_TAG ?=
 RUNNER_IMAGE ?= quay.io/rhdh-community/rhdh-e2e-runner:main
@@ -12,6 +13,9 @@ DEPLOY_FLAGS = --namespace $(NAMESPACE)
 ifeq ($(ORCH),true)
 DEPLOY_FLAGS += --with-orchestrator
 endif
+ifneq ($(PLUGINS),)
+DEPLOY_FLAGS += --plugins $(PLUGINS)
+endif
 
 # ── Deploy ────────────────────────────────────────────────────────────────────
 
@@ -36,22 +40,32 @@ endif
 
 # ── Cleanup ───────────────────────────────────────────────────────────────────
 
-.PHONY: undeploy-helm undeploy-operator undeploy-infra clean
+.PHONY: undeploy-helm undeploy-operator undeploy-infra undeploy-plugins clean
 
-undeploy-helm: ## Uninstall Helm RHDH release
-	helm uninstall redhat-developer-hub -n $(NAMESPACE) || true
-	oc delete configmap app-config-rhdh -n $(NAMESPACE) --ignore-not-found
-	oc delete secret rhdh-secrets -n $(NAMESPACE) --ignore-not-found
+undeploy-helm: ## Uninstall Helm RHDH release and all cluster resources (PLUGINS=keycloak,lighthouse to also teardown plugin infra)
+ifdef PLUGINS
+	./teardown.sh helm --namespace $(NAMESPACE) --plugins $(PLUGINS)
+else
+	./teardown.sh helm --namespace $(NAMESPACE)
+endif
 
-undeploy-operator: ## Remove Operator RHDH deployment
-	oc delete backstage developer-hub -n $(NAMESPACE) --ignore-not-found
-	oc delete configmap app-config-rhdh dynamic-plugins -n $(NAMESPACE) --ignore-not-found
-	oc delete secret rhdh-secrets -n $(NAMESPACE) --ignore-not-found
+undeploy-operator: ## Remove Operator RHDH deployment and all cluster resources (PLUGINS=keycloak,lighthouse to also teardown plugin infra)
+ifdef PLUGINS
+	./teardown.sh operator --namespace $(NAMESPACE) --plugins $(PLUGINS)
+else
+	./teardown.sh operator --namespace $(NAMESPACE)
+endif
+
+undeploy-plugins: ## Teardown plugin infrastructure only, leave RHDH running (PLUGINS=keycloak,lighthouse)
+ifndef PLUGINS
+	$(error PLUGINS is required, e.g. make undeploy-plugins PLUGINS=keycloak,lighthouse)
+endif
+	TEARDOWN=true NAMESPACE=$(NAMESPACE) bash scripts/config-plugins.sh $(PLUGINS)
 
 undeploy-infra: ## Uninstall orchestrator infra chart
 	helm uninstall orchestrator-infra -n $(NAMESPACE) || true
 
-clean: ## Delete the entire namespace
+clean: ## Delete the entire namespace (removes everything)
 	oc delete project $(NAMESPACE) --ignore-not-found
 
 # ── Status ────────────────────────────────────────────────────────────────────
diff --git a/README.md b/README.md
index 1db72b2..58576a1 100644
--- a/README.md
+++ b/README.md
@@ -12,8 +12,8 @@ This project provides automated deployment scripts and configuration files to se
 - 📦 **Multiple Install Types**: Support for both Helm and Operator installation methods
 - 🔄 **Flexible Version Support**: Deploy any RHDH version (latest, semantic versions like 1.7, CI builds like 1.7-98-CI)
 - 🌐 **Cluster Information Sharing**: Automatic sharing of deployment URLs, OpenShift console access, and cluster credentials
-- 🔐 **Integrated Keycloak Authentication**: Automatic Keycloak deployment with pre-configured realm and test users
-- 👥 **Pre-configured Test Users**: Ready-to-use test accounts (test1, test2) with authentication setup
+- 🔐 **Flexible Authentication**: Guest login by default; optional Keycloak OIDC via `--plugins keycloak`
+- 👥 **Runtime Test Users**: Keycloak test users provisioned with a generated password stored in a cluster Secret
 - 🏠 **Local Deployment**: Support for local development and testing environments
 - ⚡ **Resource Management**: Automatic cleanup with configurable timers and resource limits
 - 🎯 **Instance Limits**: Maximum of two concurrent test instances to manage resource usage
@@ -28,17 +28,19 @@ Deploy test environments directly from Pull Requests using slash commands and te
 
 The bot supports flexible deployment commands directly from PR comments:
 
-```
+```bash
 /test deploy <install-type> <version> [duration]
 ```
 
 **Parameters:**
+
 - `install-type`: `helm` or `operator`
 - `version`: Version to deploy (see supported versions below)
 - `duration`: Optional cleanup timer (e.g., `4h`, `2.5h`)
 
 **Examples:**
-```
+
+```bash
 /test deploy helm 1.7 4h          # Deploy RHDH 1.7 with Helm, cleanup after 4 hours
 /test deploy operator 1.6 2.5h     # Deploy RHDH 1.6 with Operator, cleanup after 2.5 hours
 /test deploy helm 1.7            # Deploy latest CI version with Helm with defaut duration 3h
@@ -48,7 +50,8 @@ The bot supports flexible deployment commands directly from PR comments:
 ### How to Use PR Integration
 
 1. **Comment on any PR on rhdh-test-instance repo:**
-   ```
+
+   ```bash
    /test deploy helm 1.7 4h
    ```
 
@@ -56,7 +59,7 @@ The bot supports flexible deployment commands directly from PR comments:
 
 The bot provides comprehensive feedback through PR comments for eg:
 
-```
+```text
 🚀 Deployed RHDH version: 1.7 using helm
 
 🌐 RHDH URL: https://redhat-developer-hub-rhdh.apps.rhdh-4-17-us-east-2-kz69l.rhdh-qe.devcluster.openshift.com
@@ -70,15 +73,13 @@ The bot provides comprehensive feedback through PR comments for eg:
 ⏰ Cluster Availability: Next 1 hours
 ```
 
-
-
 ### Live Status of deploy Job
 
 **Prow Status:**
-https://prow.ci.openshift.org/?repo=redhat-developer%2Frhdh-test-instance&type=presubmit&job=pull-ci-redhat-developer-rhdh-test-instance-main-deploy
+<https://prow.ci.openshift.org/?repo=redhat-developer%2Frhdh-test-instance&type=presubmit&job=pull-ci-redhat-developer-rhdh-test-instance-main-deploy>
 
 **Job History:**
-https://prow.ci.openshift.org/job-history/gs/test-platform-results/pr-logs/directory/pull-ci-redhat-developer-rhdh-test-instance-main-deploy
+<https://prow.ci.openshift.org/job-history/gs/test-platform-results/pr-logs/directory/pull-ci-redhat-developer-rhdh-test-instance-main-deploy>
 
 ### Testing Custom Configurations via PRs
 
@@ -86,7 +87,8 @@ Users can deploy different configuration flavors by:
 
 1. **Creating a PR** with modified configuration files
 2. **Using bot commands** to deploy the PR's configuration:
-   ```
+
+   ```bash
    /test deploy helm 1.7 2h
    ```
 
@@ -102,28 +104,33 @@ For local development and testing environments, you can deploy RHDH directly to
 - `oc` CLI logged into your OpenShift cluster
 - `helm` CLI installed
 - `make` installed
-- `.env` file configured with Keycloak credentials (copy from `.env.example`)
+- `.env` file configured (copy from `.env.example`) — only needed if using Vault-based secrets locally
 
 ### Quick Start
 
 1. **Clone the repository:**
+
    ```bash
    git clone <repository-url>
    cd rhdh-test-instance
    ```
 
-2. **Configure environment:**
+2. **Configure environment (optional):**
+
    ```bash
    cp .env.example .env
-   # Edit .env with your Keycloak credentials
+   # Only needed for Vault-based local secrets
    ```
 
 3. **Deploy RHDH:**
+
    ```bash
-   make deploy-helm VERSION=1.9-190-CI
+   make deploy-helm VERSION=1.9-190-CI                          # Guest auth (default)
+   make deploy-helm VERSION=1.9-190-CI PLUGINS=keycloak         # With Keycloak OIDC
    ```
 
 4. **Access your RHDH instance:**
+
    ```bash
    make url
    ```
@@ -153,10 +160,23 @@ make deploy-operator VERSION=1.9 ORCH=true
 #### Cleanup
 
 ```bash
-make undeploy-helm                    # Remove Helm release
-make undeploy-operator                # Remove Operator deployment
-make undeploy-infra                   # Remove orchestrator infra chart
-make clean                            # Delete the entire namespace
+# Remove RHDH only (leave Keycloak/Lighthouse in place)
+make undeploy-helm
+make undeploy-operator
+
+# Remove RHDH and tear down plugin infrastructure
+make undeploy-helm PLUGINS=keycloak,lighthouse
+make undeploy-operator PLUGINS=keycloak
+
+# Tear down plugin infra only, leave RHDH running
+make undeploy-plugins PLUGINS=keycloak,lighthouse
+make undeploy-plugins PLUGINS=lighthouse
+
+# Remove orchestrator infra chart
+make undeploy-infra
+
+# Delete the entire namespace (removes everything)
+make clean
 ```
 
 #### Status and Debugging
@@ -167,18 +187,19 @@ make logs                             # Tail RHDH pod logs
 make url                              # Print RHDH URL
 ```
 
-#### Configuration
+#### Variables
 
 All make commands accept these variables:
 
-| Variable | Default | Description |
-|----------|---------|-------------|
-| `NAMESPACE` | `rhdh` | Target namespace |
-| `VERSION` | `1.9` | RHDH version (`1.9`, `1.9-190-CI`, or `next`) |
-| `ORCH` | `false` | Set to `true` to deploy with orchestrator support |
-| `USE_CONTAINER` | `false` | Set to `true` to run commands inside the e2e-runner container |
-| `CATALOG_INDEX_TAG` | auto | Catalog index image tag (defaults to major.minor from version, or `next`) |
-| `RUNNER_IMAGE` | `quay.io/rhdh-community/rhdh-e2e-runner:main` | Container image for `install-operator` |
+| Variable            | Default                                       | Description                                                               |
+| ------------------- | --------------------------------------------- | ------------------------------------------------------------------------- |
+| `NAMESPACE`         | `rhdh`                                        | Target namespace                                                          |
+| `VERSION`           | `1.9`                                         | RHDH version (`1.9`, `1.9-190-CI`, or `next`)                             |
+| `ORCH`              | `false`                                       | Set to `true` to deploy with orchestrator support                         |
+| `PLUGINS`           | _(empty)_                                     | Comma-separated plugins to deploy/teardown (e.g. `keycloak,lighthouse`)   |
+| `USE_CONTAINER`     | `false`                                       | Set to `true` to run commands inside the e2e-runner container             |
+| `CATALOG_INDEX_TAG` | auto                                          | Catalog index image tag (defaults to major.minor from version, or `next`) |
+| `RUNNER_IMAGE`      | `quay.io/rhdh-community/rhdh-e2e-runner:main` | Container image for `install-operator`                                    |
 
 > **Note:** `install-operator` requires you to be logged into the cluster via `oc login` on your host.
 > It automatically passes the session token to the e2e-runner container (needs Linux tools like `umoci`, `opm`, `skopeo`).
@@ -186,35 +207,55 @@ All make commands accept these variables:
 
 ### Direct Script Usage
 
-You can also use `deploy.sh` directly:
+You can also use `deploy.sh` and `teardown.sh` directly:
+
+**Deploy:**
 
 ```bash
-./deploy.sh <installation-method> <version> [--namespace <ns>] [--with-orchestrator]
+./deploy.sh <install-method> <version> [--namespace <ns>] [--with-orchestrator] [--plugins <list>]
 ```
 
-**Examples:**
 ```bash
 ./deploy.sh helm 1.9
 ./deploy.sh helm 1.9-190-CI
 ./deploy.sh helm next
 ./deploy.sh helm 1.9 --namespace rhdh-helm --with-orchestrator
+./deploy.sh helm 1.9 --plugins keycloak,lighthouse
 ./deploy.sh operator 1.9 --namespace rhdh-operator
 ./deploy.sh operator next --with-orchestrator
 ```
 
+**Teardown:**
+
+```bash
+./teardown.sh <install-method> [--namespace <ns>] [--plugins <list>] [--clean]
+```
+
+```bash
+./teardown.sh helm                                              # Remove RHDH only
+./teardown.sh helm --plugins keycloak,lighthouse               # Remove RHDH + plugin infra
+./teardown.sh helm --namespace rhdh-helm --plugins keycloak    # Remove from non-default namespace
+./teardown.sh operator --plugins keycloak,lighthouse
+./teardown.sh helm --clean                                      # Full wipe: delete entire namespace
+./teardown.sh helm --plugins keycloak,lighthouse --clean        # Teardown plugins then delete namespace
+```
+
+> **Note:** `--clean` deletes the entire namespace after teardown, removing all resources including image streams. Omit it when redeploying to the same namespace to preserve cached image streams and avoid registry rate limits.
+
 ### Accessing Your Local RHDH Instance
 
 After successful installation, access your RHDH instance at:
-```
+
+```text
 https://redhat-developer-hub-<namespace>.<cluster-router-base>
 ```
 
 ### Login Process
 
-1. Navigate to the RHDH URL
-2. Click "Sign In"
-3. Use one of the test users (test1/test1@123 or test2/test2@123)
-4. Explore the developer portal features
+1. Navigate to the RHDH URL (`make url` to print it)
+2. Click **Sign In**
+3. **Guest auth** (default): click **Enter** to sign in as `guest`
+4. **Keycloak auth** (when `--plugins keycloak` was used): sign in with any test user defined in `resources/keycloak/users.json` — see [Finding Keycloak Credentials](#finding-keycloak-credentials) below
 
 ## Configuration
 
@@ -223,18 +264,15 @@ https://redhat-developer-hub-<namespace>.<cluster-router-base>
 The main application configuration is stored in `config/app-config-rhdh.yaml`:
 
 ```yaml
-# Key configuration areas:
 app:
-  baseUrl: "${RHDH_BASE_URL}"
-  
+  baseUrl: '${RHDH_BASE_URL}'
+
 auth:
   environment: production
   providers:
-    oidc:
-      production:
-        metadataUrl: "${KEYCLOAK_METADATA_URL}"
-        clientId: "${KEYCLOAK_CLIENT_ID}"
-        clientSecret: "${KEYCLOAK_CLIENT_SECRET}"
+    guest:
+      dangerouslyAllowOutsideDevelopment: true
+signInPage: guest
 
 catalog:
   locations:
@@ -242,6 +280,8 @@ catalog:
       target: https://github.com/redhat-developer/rhdh/blob/main/catalog-entities/all.yaml
 ```
 
+When the `keycloak` plugin is enabled, an additional `pluginConfig` block within the Keycloak `dynamic-plugins.yaml` overlay switches authentication to OIDC, overriding the base guest config.
+
 ### Dynamic Plugins
 
 Configure dynamic plugins in `config/dynamic-plugins.yaml`:
@@ -272,40 +312,69 @@ upstream:
       - rhdh-secrets
 ```
 
-## Authentication with Keycloak
+## Authentication
 
-### Automatic Keycloak Deployment
+### Default: Guest Login
 
-The installation script automatically deploys Keycloak with:
-- Admin user: `admin` / `admin123`
-- Predefined realm: `rhdh`
-- Pre-configured OIDC client
-- Test users for development
+By default, RHDH is configured with the Guest provider so you can sign in immediately without any additional setup. A `guest` user entity is pre-registered in the catalog.
 
-### Test Users
+### Optional: Keycloak OIDC
 
-The following test users are created automatically:
+When you deploy with `--plugins keycloak`, Keycloak is automatically set up with an OIDC client and the sign-in page switches to OIDC. Test users and groups are created from `resources/keycloak/users.json` and `resources/keycloak/groups.json`.
 
-| Username | Password | Email | Role |
-|----------|----------|--------|------|
-| test1 | test1@123 | test1@example.com | User |
-| test2 | test2@123 | test2@example.com | User |
-
-### Keycloak Configuration
-
-Keycloak is configured with:
 - **Realm**: `rhdh`
 - **Client ID**: `rhdh-client`
+- **Test user password**: randomly generated at deploy time (see below)
 
-## Project Structure
+### Finding Keycloak Credentials
+
+After a successful Keycloak deployment, credentials are stored in a cluster Secret and also printed to the deploy log.
+
+**Via `oc`:**
+
+```bash
+# Print all credentials
+oc get secret keycloak-test-credentials -n rhdh -o jsonpath='{.data}' | \
+  jq 'to_entries[] | "\(.key): \(.value | @base64d)"' -r
 
+# Print only the shared user password
+oc get secret keycloak-test-credentials -n rhdh \
+  -o jsonpath='{.data.KEYCLOAK_USER_PASSWORD}' | base64 -d && echo
+
+# Print the username list
+oc get secret keycloak-test-credentials -n rhdh \
+  -o jsonpath='{.data.KEYCLOAK_USERNAMES}' | base64 -d && echo
+```
+
+**Via OpenShift Console:**
+
+Navigate to **Workloads > Secrets > `keycloak-test-credentials`** in your namespace and click **Reveal values**.
+
+**Secret keys:**
+
+| Key | Description |
+|---|---|
+| `KEYCLOAK_URL` | Keycloak base URL |
+| `KEYCLOAK_USERNAMES` | Comma-separated list of all test usernames (read from `users.json` at deploy time) |
+| `KEYCLOAK_USER_PASSWORD` | Shared password for all test users (generated at runtime — not hardcoded) |
+
+**Admin credentials** are stored by the Bitnami Helm chart itself in the `keycloak-keycloak` Secret in the same namespace:
+
+```bash
+oc get secret keycloak-keycloak -n rhdh \
+  -o jsonpath='{.data.admin-password}' | base64 -d && echo
 ```
+
+## Project Structure
+
+```directory
 rhdh-test-instance/
 ├── config/
-│   ├── app-config-rhdh.yaml                # Main RHDH configuration
-│   ├── dynamic-plugins.yaml                # Dynamic plugins configuration
+│   ├── app-config-rhdh.yaml                # Main RHDH configuration (guest auth by default)
+│   ├── dynamic-plugins.yaml                # Base dynamic plugins configuration
 │   ├── orchestrator-dynamic-plugins.yaml   # Orchestrator plugins (merged when ORCH=true)
-│   └── rhdh-secrets.yaml                   # Kubernetes secrets template
+│   ├── rbac-policies.yaml                  # RBAC policy ConfigMap
+│   └── rhdh-secrets.yaml                   # Reference template for rhdh-secrets Secret
 ├── helm/
 │   ├── deploy.sh                           # Helm deployment script
 │   └── value_file.yaml                     # Helm chart values
@@ -313,14 +382,25 @@ rhdh-test-instance/
 │   ├── install-operator.sh                 # One-time operator installation (runs in container)
 │   ├── deploy.sh                           # Operator instance deployment
 │   └── subscription.yaml                   # Backstage CR template
-├── utils/
-│   └── keycloak/
-│       ├── keycloak-deploy.sh              # Keycloak deployment script
-│       ├── keycloak-values.yaml            # Keycloak Helm values
-│       ├── rhdh-client.json               # Keycloak client configuration
-│       ├── users.json                     # Test users configuration
-│       └── groups.json                    # Groups configuration
-├── deploy.sh                               # Main entry point
+├── resources/
+│   ├── catalog-entities/                   # Catalog entity ConfigMaps (applied unconditionally)
+│   │   ├── components.yaml
+│   │   ├── operators.yaml
+│   │   ├── plugins.yaml
+│   │   ├── resources.yaml
+│   │   └── users.yaml                      # guest user entity
+│   ├── image-stream-imports/               # Pre-import images to avoid rate limits
+│   ├── keycloak/                           # Keycloak plugin resources and config
+│   ├── lighthouse/                         # Lighthouse plugin resources and config
+│   └── rhdh-script-examples/              # Demo workloads for Topology/Kubernetes views
+├── scripts/
+│   ├── config-plugins.sh                   # Plugin orchestration (round-robin setup/teardown)
+│   ├── setup-resources.sh                  # Shared cluster resource provisioning/teardown
+│   └── plugins/
+│       ├── config-keycloak-plugin.sh       # Keycloak deploy, realm/client/user setup
+│       └── config-lighthouse-plugin.sh     # Lighthouse deploy and URL injection
+├── deploy.sh                               # Main deploy entry point
+├── teardown.sh                             # Main teardown entry point
 ├── Makefile                                # Make targets
 ├── OWNERS                                  # Project maintainers
 └── README.md                               # This file
@@ -331,15 +411,15 @@ rhdh-test-instance/
 ### PR Deployments (Vault Integration)
 
 When using PR deployments, secrets are automatically pulled from vault at:
-https://vault.ci.openshift.org/ui/vault/secrets/kv/kv/list/selfservice/rhdh-test-instance/
+<https://vault.ci.openshift.org/ui/vault/secrets/kv/kv/list/selfservice/rhdh-test-instance/>
 
 These secrets are available as environment variables with the same name and can be used directly in Kubernetes secrets. From there, they can be referenced in `app-config-rhdh.yaml` or `dynamic-plugins.yaml` configurations.
 
 **Access Requirements:**
+
 - To add or view vault secrets, ensure you have appropriate access
 - For access requests, reach out in #team-rhdh slack channel
 
 ### Local Deployments (.env Configuration)
 
 For local development, you can add secrets in a `.env` file and use them in your app-config or dynamic plugins configuration.
-
diff --git a/config/app-config-guest-auth.yaml b/config/app-config-guest-auth.yaml
new file mode 100644
index 0000000..9ebc38f
--- /dev/null
+++ b/config/app-config-guest-auth.yaml
@@ -0,0 +1,8 @@
+auth:
+  environment: development
+  providers:
+    guest:
+      development:
+        userEntityRef: user:default/guest
+        dangerouslyAllowOutsideDevelopment: true
+signInPage: guest
diff --git a/config/app-config-rhdh.yaml b/config/app-config-rhdh.yaml
index c4e9986..615598a 100644
--- a/config/app-config-rhdh.yaml
+++ b/config/app-config-rhdh.yaml
@@ -1,27 +1,22 @@
 app:
-  baseUrl: "${RHDH_BASE_URL}"
+  baseUrl: '${RHDH_BASE_URL}'
 backend:
-  baseUrl: "${RHDH_BASE_URL}"
+  baseUrl: '${RHDH_BASE_URL}'
   cors:
-    origin: "${RHDH_BASE_URL}"
+    origin: '${RHDH_BASE_URL}'
+  csp:
+    connect-src:
+      - "'self'"
+      - 'http:'
+      - 'https:'
+    img-src:
+      - "'self'"
+      - 'data:'
 
 auth:
   # see https://backstage.io/docs/auth/ to learn about auth providers
-  environment: production
   session:
-    secret: superSecretSecret 
-  providers:
-    oidc:
-      production:
-        metadataUrl: "${KEYCLOAK_METADATA_URL}"
-        clientId: "${KEYCLOAK_CLIENT_ID}"
-        clientSecret: "${KEYCLOAK_CLIENT_SECRET}"
-        prompt: auto
-        callbackUrl: "${RHDH_BASE_URL}/api/auth/oidc/handler/frame"
-        signIn:
-          resolvers:
-            - resolver: emailLocalPartMatchingUserEntityName
-signInPage: oidc
+    secret: '${SESSION_SECRET}'
 catalog:
   import:
     entityFilename: catalog-info.yaml
@@ -34,15 +29,13 @@ catalog:
       target: https://github.com/redhat-developer/rhdh/blob/main/catalog-entities/all.yaml
     - type: url
       target: https://github.com/redhat-developer/red-hat-developer-hub-software-templates/blob/main/templates.yaml
-  providers:
-    keycloakOrg:
-      default:
-        baseUrl: "${KEYCLOAK_BASE_URL}"
-        loginRealm: "${KEYCLOAK_LOGIN_REALM}"
-        realm: "${KEYCLOAK_REALM}"
-        clientId: "${KEYCLOAK_CLIENT_ID}"
-        clientSecret: "${KEYCLOAK_CLIENT_SECRET}"
-        schedule:
-          frequency: { minutes: 20 }
-          initialDelay: { seconds: 15 }
-          timeout: { minutes: 5 }
\ No newline at end of file
+    - type: file
+      target: ./catalog-entities/users.yaml
+    - type: file
+      target: ./catalog-entities/components.yaml
+    - type: file
+      target: ./catalog-entities/operators.yaml
+    - type: file
+      target: ./catalog-entities/resources.yaml
+    - type: file
+      target: ./catalog-entities/plugins.yaml
diff --git a/config/dynamic-plugins.yaml b/config/dynamic-plugins.yaml
index 1707b52..8af3c33 100644
--- a/config/dynamic-plugins.yaml
+++ b/config/dynamic-plugins.yaml
@@ -1,6 +1,5 @@
 includes:
   - dynamic-plugins.default.yaml
 plugins:
-  - package: ./dynamic-plugins/dist/backstage-community-plugin-catalog-backend-module-keycloak-dynamic
-    disabled: false
-  
\ No newline at end of file
+  - package: ./dynamic-plugins/dist/backstage-community-plugin-analytics-provider-segment
+    disabled: true
diff --git a/config/rbac-policies.yaml b/config/rbac-policies.yaml
new file mode 100644
index 0000000..6c7ee66
--- /dev/null
+++ b/config/rbac-policies.yaml
@@ -0,0 +1,32 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: rbac-policy
+  labels:
+    backstage.io/kubernetes-id: developer-hub
+data:
+  rbac-policy.csv: |
+    p, role:default/admin, catalog-entity, read, allow
+    p, role:default/admin, catalog.entity.create, create, allow
+
+    g, user:default/guest, role:default/admin
+
+    p, role:default/admin, catalog-entity, read, allow
+    p, role:default/admin, catalog.entity.create, create, allow
+
+    g, user:default/someuser, role:default/developer
+
+    g, user:default/ant-man, role:default/conditional-role
+  conditional-policy.yaml: |
+    result: CONDITIONAL
+    roleEntityRef: 'role:default/conditional-role'
+    pluginId: catalog
+    resourceType: catalog-entity
+    permissionMapping:
+      - read
+    conditions:
+      rule: IS_ENTITY_OWNER
+      resourceType: catalog-entity
+      params:
+        claims:
+          - $ownerRefs
diff --git a/config/rhdh-secrets.yaml b/config/rhdh-secrets.yaml
index 26085c3..ba1e324 100644
--- a/config/rhdh-secrets.yaml
+++ b/config/rhdh-secrets.yaml
@@ -10,4 +10,5 @@ stringData:
   KEYCLOAK_LOGIN_REALM: $KEYCLOAK_LOGIN_REALM
   KEYCLOAK_REALM: $KEYCLOAK_REALM
   KEYCLOAK_CLIENT_ID: $KEYCLOAK_CLIENT_ID
-  KEYCLOAK_CLIENT_SECRET: $KEYCLOAK_CLIENT_SECRET
\ No newline at end of file
+  KEYCLOAK_CLIENT_SECRET: $KEYCLOAK_CLIENT_SECRET
+  LIGHTHOUSE_URL: $LIGHTHOUSE_URL
diff --git a/deploy.sh b/deploy.sh
index 584e3d0..ae93be3 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -15,12 +15,14 @@ if [[ $# -lt 2 ]]; then
     echo "Options:"
     echo "  --namespace <ns>       Deploy to specified namespace (default: rhdh)"
     echo "  --with-orchestrator    Deploy with orchestrator support"
+    echo "  --plugins <list>       Deploy with plugins support (default: none)"
     echo "Examples:"
     echo "  $0 helm 1.5-171-CI"
     echo "  $0 helm next"
     echo "  $0 operator 1.5"
     echo "  $0 helm 1.9 --with-orchestrator"
     echo "  $0 helm 1.9 --namespace rhdh-helm --with-orchestrator"
+    echo "  $0 helm 1.9 --plugins keycloak,lighthouse"
     exit 1
 fi
 
@@ -40,6 +42,10 @@ while [[ $# -gt 0 ]]; do
             echo "Orchestrator support enabled"
             shift
             ;;
+        --plugins)
+            PLUGINS="$2"
+            shift 2
+            ;;
         *)
             echo "Error: Unknown option: $1"
             echo "Usage: $0 <installation-method> <version> [--namespace <ns>] [--with-orchestrator]"
@@ -61,20 +67,46 @@ fi
 [[ "${OPENSHIFT_CI}" != "true" ]] && source .env
 # source utils/utils.sh
 
-# Deploy Keycloak with users and roles.
-# comment this out if you don't want to deploy Keycloak or use your own Keycloak instance.
-source utils/keycloak/keycloak-deploy.sh $namespace
-
 # Create or switch to the specified namespace
 oc new-project "$namespace" || oc project "$namespace"
 
-# Create configmap with environment variables substituted
-oc create configmap app-config-rhdh \
-    --from-file="config/app-config-rhdh.yaml" \
-    --namespace="$namespace" \
-    --dry-run=client -o yaml | oc apply -f - --namespace="$namespace"
+# Resolve cluster router base and RHDH URL early so setup-resources.sh and
+# plugin scripts have them available (e.g. for creating the rhdh-secrets Secret).
+export CLUSTER_ROUTER_BASE
+CLUSTER_ROUTER_BASE=$(oc get route console -n openshift-console -o=jsonpath='{.spec.host}' | sed 's/^[^.]*\.//')
+if oc get route console -n openshift-console -o=jsonpath='{.spec.tls.termination}' 2>/dev/null | grep -q .; then
+    RHDH_PROTOCOL="https"
+else
+    RHDH_PROTOCOL="http"
+fi
+if [[ "$installation_method" == "helm" ]]; then
+    export RHDH_BASE_URL="${RHDH_PROTOCOL}://redhat-developer-hub-${namespace}.${CLUSTER_ROUTER_BASE}"
+else
+    export RHDH_BASE_URL="${RHDH_PROTOCOL}://backstage-developer-hub-${namespace}.${CLUSTER_ROUTER_BASE}"
+fi
+echo "RHDH URL: ${RHDH_BASE_URL}"
+
+# Apply cluster resources that are always present (catalog entities, RBAC
+# policies, app-config and dynamic-plugins ConfigMaps, image stream pre-imports,
+# demo workloads). Run before plugin scripts so all base config exists before
+# plugins append to it.
+export NAMESPACE="$namespace"
+source scripts/setup-resources.sh
+setup_resources
 
-export CLUSTER_ROUTER_BASE=$(oc get route console -n openshift-console -o=jsonpath='{.spec.host}' | sed 's/^[^.]*\.//')
+export IS_AUTH_ENABLED="${IS_AUTH_ENABLED:-false}"
+
+source scripts/config-plugins.sh
+if [[ -n "${PLUGINS:-}" ]]; then
+    main "$PLUGINS"
+fi
+
+# If no auth plugin set IS_AUTH_ENABLED=true, mount the guest auth ConfigMap.
+if [[ "${IS_AUTH_ENABLED}" != "true" ]]; then
+    export GUEST_AUTH_CONFIG_MAP_ENTRY="        - name: app-config-guest-auth"
+else
+    export GUEST_AUTH_CONFIG_MAP_ENTRY=""
+fi
 
 if [[ "$installation_method" == "helm" ]]; then
     source helm/deploy.sh "$namespace" "$version"
@@ -89,9 +121,9 @@ else
 fi
 
 # Wait for the deployment to be ready
-oc rollout status deployment -l 'app.kubernetes.io/instance in (redhat-developer-hub,developer-hub)' -n "$namespace" --timeout=500s || echo "Error: Timed out waiting for deployment to be ready."
+oc rollout status deployment -l 'app.kubernetes.io/instance in (redhat-developer-hub,developer-hub)' -n "$namespace" --timeout=500s || { echo "Error: Timed out waiting for deployment to be ready."; exit 1; }
 
 echo "
 RHDH_BASE_URL : 
 $RHDH_BASE_URL
-"
\ No newline at end of file
+"
diff --git a/helm/deploy.sh b/helm/deploy.sh
index 9795cad..84172a6 100755
--- a/helm/deploy.sh
+++ b/helm/deploy.sh
@@ -11,9 +11,6 @@ namespace="$1"
 version="$2"
 github=0 # by default don't use the Github repo unless the chart doesn't exist in the OCI registry
 
-# Get cluster router base
-export CLUSTER_ROUTER_BASE=$(oc get route console -n openshift-console -o=jsonpath='{.spec.host}' | sed 's/^[^.]*\.//')
-
 # Validate version and determine chart version
 if [[ "$version" =~ ^([0-9]+(\.[0-9]+)?)$ ]]; then
     CV=$(curl -s "https://quay.io/api/v1/repository/rhdh/chart/tag/?onlyActiveTags=true&limit=600" | jq -r '.tags[].name' | grep "^${version}-" | sort -V | tail -n 1)
@@ -44,18 +41,6 @@ fi
 
 echo "Using ${CHART_URL} to install Helm chart"
 
-# RHDH URL
-# Detect protocol based on cluster route TLS configuration
-if oc get route console -n openshift-console -o=jsonpath='{.spec.tls.termination}' 2>/dev/null | grep -q .; then
-    RHDH_PROTOCOL="https"
-else
-    RHDH_PROTOCOL="http"
-fi
-export RHDH_BASE_URL="${RHDH_PROTOCOL}://redhat-developer-hub-${namespace}.${CLUSTER_ROUTER_BASE}"
-
-# Apply secrets
-envsubst < config/rhdh-secrets.yaml | oc apply -f - --namespace="$namespace"
-
 # Install orchestrator infrastructure if requested
 if [[ "${WITH_ORCHESTRATOR}" == "1" ]]; then
     echo "Installing orchestrator infrastructure chart..."
@@ -83,13 +68,25 @@ if [[ "${WITH_ORCHESTRATOR}" == "1" ]]; then
     echo "Serverless operator pods are running."
 fi
 
-# Build dynamic plugins value file
+# Build dynamic plugins value file.
+# Read from the cluster ConfigMap seeded in deploy.sh and augmented by any
+# plugin setup scripts. Fall back to config/dynamic-plugins.yaml if the
+# ConfigMap is not available (e.g. standalone helm/deploy.sh execution).
 DYNAMIC_PLUGINS_FILE=$(mktemp)
 trap "rm -f $DYNAMIC_PLUGINS_FILE" EXIT
 echo "global:" > "$DYNAMIC_PLUGINS_FILE"
 echo "  dynamic:" >> "$DYNAMIC_PLUGINS_FILE"
 # Escape {{inherit}} for Helm's Go template engine: {{inherit}} -> {{ "{{inherit}}" }}
-sed -e 's/^/    /' -e 's/{{inherit}}/{{ "{{inherit}}" }}/g' config/dynamic-plugins.yaml >> "$DYNAMIC_PLUGINS_FILE"
+if oc get configmap dynamic-plugins --namespace "$namespace" &>/dev/null; then
+    oc get configmap dynamic-plugins \
+        --namespace "$namespace" \
+        -o jsonpath='{.data.dynamic-plugins\.yaml}' \
+        | sed -e 's/^/    /' -e 's/{{inherit}}/{{ "{{inherit}}" }}/g' \
+        >> "$DYNAMIC_PLUGINS_FILE"
+else
+    sed -e 's/^/    /' -e 's/{{inherit}}/{{ "{{inherit}}" }}/g' \
+        config/dynamic-plugins.yaml >> "$DYNAMIC_PLUGINS_FILE"
+fi
 
 # Build helm install arguments
 HELM_ARGS=(
@@ -106,8 +103,15 @@ if [[ "${WITH_ORCHESTRATOR}" == "1" ]]; then
     HELM_ARGS+=(--set orchestrator.enabled=true)
 fi
 
-# Install Helm chart
-helm install redhat-developer-hub "${CHART_URL}" --version "$CV" "${HELM_ARGS[@]}"
+if [[ "${IS_AUTH_ENABLED:-false}" != "true" ]]; then
+    HELM_ARGS+=(
+        --set "upstream.backstage.extraAppConfig[1].configMapRef=app-config-guest-auth"
+        --set "upstream.backstage.extraAppConfig[1].filename=app-config-guest-auth.yaml"
+    )
+fi
+
+# Install or upgrade Helm chart
+helm upgrade --install redhat-developer-hub "${CHART_URL}" --version "$CV" "${HELM_ARGS[@]}"
 
 # Scale down and up to ensure fresh pods (helm does not monitor config changes)
 oc scale deployment -l 'app.kubernetes.io/instance in (redhat-developer-hub,developer-hub)' --replicas=0 -n "$namespace"
diff --git a/helm/value_file.yaml b/helm/value_file.yaml
index fc8165c..564a38e 100644
--- a/helm/value_file.yaml
+++ b/helm/value_file.yaml
@@ -11,4 +11,88 @@ upstream:
       - configMapRef: app-config-rhdh
         filename: app-config-rhdh.yaml
     extraEnvVarsSecrets:
-      - rhdh-secrets
\ No newline at end of file
+      - rhdh-secrets
+    extraEnvVars: # need to look to see if these are required or not ...
+      - name: NODE_TLS_REJECT_UNAUTHORIZED
+        value: '0'
+      - name: SEGMENT_TEST_MODE
+        value: 'true'
+      - name: BACKEND_SECRET
+        valueFrom:
+          secretKeyRef:
+            key: backend-secret
+            name: '{{ include "rhdh.backend-secret-name" $ }}'
+      - name: POSTGRESQL_ADMIN_PASSWORD
+        valueFrom:
+          secretKeyRef:
+            key: postgres-password
+            name: '{{- include "rhdh.postgresql.secretName" . }}'
+    extraVolumeMounts:
+      - name: dynamic-plugins-root
+        mountPath: /opt/app-root/src/dynamic-plugins-root
+      - name: extensions-catalog
+        mountPath: /extensions
+      - name: temp
+        mountPath: /tmp
+      - name: rbac-policy
+        mountPath: /opt/app-root/src/rbac
+      - name: catalog-entities
+        mountPath: /opt/app-root/src/catalog-entities
+    extraVolumes:
+      # -- Ephemeral volume that will contain the dynamic plugins installed by the initContainer below at start.
+      - name: dynamic-plugins-root
+        ephemeral:
+          volumeClaimTemplate:
+            spec:
+              accessModes:
+                - ReadWriteOnce
+              resources:
+                requests:
+                  # -- Size of the volume that will contain the dynamic plugins. It should be large enough to contain all the plugins.
+                  storage: 5Gi
+      # Volume that will expose the `dynamic-plugins.yaml` file from the `dynamic-plugins` config map.
+      # The `dynamic-plugins` config map is created by the helm chart from the content of the `global.dynamic` field.
+      - name: dynamic-plugins
+        configMap:
+          defaultMode: 420
+          name: dynamic-plugins
+          optional: true
+      # Optional volume that allows exposing the `.npmrc` file (through a `dynamic-plugins-npmrc` secret)
+      # to be used when running `npm pack` during the dynamic plugins installation by the initContainer.
+      - name: dynamic-plugins-npmrc
+        secret:
+          defaultMode: 420
+          optional: true
+          secretName: '{{ printf "%s-dynamic-plugins-npmrc" .Release.Name }}'
+      # Optional volume that allows adding a container registry `auth.json` file (through a `dynamic-plugins-registry-auth` secret)
+      # to be used when installing plugins from secure container registries during the dynamic plugins installation by the initContainer.
+      - name: dynamic-plugins-registry-auth
+        secret:
+          defaultMode: 416
+          optional: true
+          secretName: '{{ printf "%s-dynamic-plugins-registry-auth" .Release.Name }}'
+      - name: npmcacache
+        emptyDir: {}
+      # -- Ephemeral volume used by the install-dynamic-plugins init container to extract catalog entities from the catalog index image.
+      # Mounted at the /extensions path in the backstage-backend main container for automatic discovery by the extension catalog backend providers.
+      - name: extensions-catalog
+        emptyDir: {}
+      - name: temp
+        emptyDir: {}
+      - name: rbac-policy
+        configMap:
+          defaultMode: 420
+          name: rbac-policy
+      - name: catalog-entities
+        projected:
+          sources:
+            - configMap:
+                name: users-config-map
+            - configMap:
+                name: operators-config-map
+            - configMap:
+                name: plugins-config-map
+            - configMap:
+                name: components-config-map
+            - configMap:
+                name: resources-config-map
diff --git a/operator/deploy.sh b/operator/deploy.sh
index bb71e80..0731a0a 100755
--- a/operator/deploy.sh
+++ b/operator/deploy.sh
@@ -54,28 +54,19 @@ else
 fi
 echo "Using catalog index tag: ${CATALOG_INDEX_TAG}"
 
-# Detect protocol based on cluster route TLS configuration
-if oc get route console -n openshift-console -o=jsonpath='{.spec.tls.termination}' 2>/dev/null | grep -q .; then
-    RHDH_PROTOCOL="https"
-else
-    RHDH_PROTOCOL="http"
-fi
-export RHDH_BASE_URL="${RHDH_PROTOCOL}://backstage-developer-hub-${namespace}.${CLUSTER_ROUTER_BASE}"
-
-# Apply secrets
-envsubst < config/rhdh-secrets.yaml | oc apply -f - --namespace="$namespace"
-
-# Create dynamic-plugins ConfigMap
+# The dynamic-plugins ConfigMap was seeded in deploy.sh from the base config
+# and may have been augmented by plugin setup scripts. Append orchestrator
+# plugin entries here if requested, then apply the Backstage CR.
 if [[ "${WITH_ORCHESTRATOR}" == "1" ]]; then
-    echo "Merging orchestrator plugins into dynamic-plugins configuration..."
-    ORCH_PLUGINS=$(cat config/orchestrator-dynamic-plugins.yaml | grep -A 100 '^plugins:' | tail -n +2)
-    oc create configmap dynamic-plugins \
-        --from-file=dynamic-plugins.yaml=<(cat config/dynamic-plugins.yaml; echo ""; echo "$ORCH_PLUGINS") \
-        --namespace="$namespace" \
-        --dry-run=client -o yaml | oc apply -f -
-else
+    echo "Merging orchestrator plugins into dynamic-plugins ConfigMap..."
+    ORCH_PLUGINS=$(grep -A 100 '^plugins:' config/orchestrator-dynamic-plugins.yaml | tail -n +2)
     oc create configmap dynamic-plugins \
-        --from-file="config/dynamic-plugins.yaml" \
+        --from-file=dynamic-plugins.yaml=<(
+            oc get configmap dynamic-plugins \
+                --namespace="$namespace" \
+                -o jsonpath='{.data.dynamic-plugins\.yaml}'
+            echo "$ORCH_PLUGINS"
+        ) \
         --namespace="$namespace" \
         --dry-run=client -o yaml | oc apply -f -
 fi
diff --git a/operator/subscription.yaml b/operator/subscription.yaml
index ed1cd55..74cea2f 100644
--- a/operator/subscription.yaml
+++ b/operator/subscription.yaml
@@ -7,9 +7,23 @@ spec:
     appConfig:
       configMaps:
         - name: app-config-rhdh
+${GUEST_AUTH_CONFIG_MAP_ENTRY}
       mountPath: /opt/app-root/src
     extraFiles:
       mountPath: /opt/app-root/src
+      configMaps:
+        - name: rbac-policy
+          mountPath: /opt/app-root/src/rbac
+        - name: users-config-map
+          mountPath: /opt/app-root/src/catalog-entities
+        - name: operators-config-map
+          mountPath: /opt/app-root/src/catalog-entities
+        - name: plugins-config-map
+          mountPath: /opt/app-root/src/catalog-entities
+        - name: components-config-map
+          mountPath: /opt/app-root/src/catalog-entities
+        - name: resources-config-map
+          mountPath: /opt/app-root/src/catalog-entities
     replicas: 1
     route:
       enabled: true
@@ -17,9 +31,13 @@ spec:
     extraEnvs:
       envs:
         - name: RHDH_BASE_URL
-          value: "${RHDH_BASE_URL}"
+          value: '${RHDH_BASE_URL}'
         - name: CATALOG_INDEX_IMAGE
-          value: "quay.io/rhdh/plugin-catalog-index:${CATALOG_INDEX_TAG}"
+          value: 'quay.io/rhdh/plugin-catalog-index:${CATALOG_INDEX_TAG}'
+        - name: NODE_TLS_REJECT_UNAUTHORIZED
+          value: '0'
+        - name: SEGMENT_TEST_MODE
+          value: 'true'
       secrets:
         - name: rhdh-secrets
   database:
diff --git a/resources/catalog-entities/components.yaml b/resources/catalog-entities/components.yaml
new file mode 100644
index 0000000..b38d448
--- /dev/null
+++ b/resources/catalog-entities/components.yaml
@@ -0,0 +1,178 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: components-config-map
+  labels:
+    backstage.io/kubernetes-id: developer-hub
+data:
+  components.yaml: |
+    apiVersion: backstage.io/v1alpha1
+    kind: Component
+    metadata:
+      name: developer-hub
+      description: List of resources deployed to openshift to be viewed through the kubernetes and topology plugins
+      annotations:
+        backstage.io/kubernetes-id: developer-hub
+        tekton.dev/cicd: "true"
+    spec:
+      type: service
+      system: integrations
+      lifecycle: qa
+      owner: fantastic-four
+    ---
+    # Demo Component 1: RHDH itself — scanned by the initial Lighthouse audit job.
+    # The lighthouse.io/website-url annotation tells the plugin which URL's audit
+    # history to display on the Overview page.
+    apiVersion: backstage.io/v1alpha1
+    kind: Component
+    metadata:
+      name: demo-lighthouse-rhdh
+      title: Demo Lighthouse — RHDH
+      description: >
+        Demo component showcasing the Lighthouse plugin using RHDH itself as the
+        audited website. The Lighthouse audit card on the Overview page shows the
+        latest performance, accessibility, best-practices, and SEO scores returned
+        by the self-hosted lighthouse-audit-service.
+      annotations:
+        # Required: the URL that was submitted to the lighthouse-audit-service.
+        # Must match the URL used in the initial scan job.
+        # See: https://github.com/backstage/community-plugins/tree/main/workspaces/lighthouse/plugins/lighthouse
+        lighthouse.io/website-url: ${RHDH_BASE_URL}
+
+        backstage.io/kubernetes-id: lighthouse-demo
+      tags:
+        - demo
+        - lighthouse
+        - performance
+        - accessibility
+      links:
+        - url: https://developer.chrome.com/docs/lighthouse/overview/
+          title: Lighthouse Documentation
+          icon: docs
+    spec:
+      type: website
+      lifecycle: experimental
+      owner: group:default/guardians-of-the-galaxy
+      dependencyOf:
+        - resource:default/lighthouse-instance
+    ---
+    # Demo Component 2: backstage.io — a publicly accessible website used to
+    # demonstrate that any external URL can be audited, not just the RHDH instance.
+    apiVersion: backstage.io/v1alpha1
+    kind: Component
+    metadata:
+      name: demo-lighthouse-website
+      title: Demo Lighthouse — Backstage.io
+      description: >
+        Demo component owned by the X-Men team that demonstrates auditing an
+        external public website with the Lighthouse plugin. Owned by a different
+        team than demo-lighthouse-rhdh to enable RBAC testing.
+      annotations:
+        lighthouse.io/website-url: https://janus-idp.io
+
+        backstage.io/kubernetes-id: lighthouse-demo
+      tags:
+        - demo
+        - lighthouse
+        - performance
+      links:
+        - url: https://developer.chrome.com/docs/lighthouse/overview/
+          title: Lighthouse Documentation
+          icon: docs
+    spec:
+      type: website
+      lifecycle: experimental
+      owner: group:default/x-men
+      dependencyOf:
+        - resource:default/lighthouse-instance
+    ---
+    # Demo Component 3: A third website component owned by a different team to demonstrate
+    # multi-team RBAC scenarios. No lighthouse.io/website-url annotation — shows that
+    # catalog components can exist alongside Lighthouse-annotated ones without triggering scans.
+    apiVersion: backstage.io/v1alpha1
+    kind: Component
+    metadata:
+      name: demo-lighthouse-docs
+      title: Demo Lighthouse — Docs Site
+      description: >
+        Demo component owned by the Avengers team. Provides a third ownership context for
+        multi-team RBAC testing alongside demo-lighthouse-rhdh and demo-lighthouse-website.
+        No Lighthouse annotation — demonstrates that the audit card only appears on components
+        that explicitly opt in via the lighthouse.io/website-url annotation.
+      annotations:
+        backstage.io/kubernetes-id: lighthouse-demo
+      tags:
+        - demo
+        - lighthouse
+        - catalog
+      links:
+        - url: https://developer.chrome.com/docs/lighthouse/overview/
+          title: Lighthouse Documentation
+          icon: docs
+    spec:
+      type: website
+      lifecycle: experimental
+      owner: group:default/avengers
+      dependencyOf:
+        - resource:default/lighthouse-instance
+    ---
+    # Plugin Component: Lighthouse RHDH plugin.
+    # Required so that the lighthouse-instance Resource's dependencyOf relation resolves.
+    apiVersion: backstage.io/v1alpha1
+    kind: Component
+    metadata:
+      name: backstage-community-plugin-lighthouse
+      title: Lighthouse Plugin
+      description: >
+        Backstage community Lighthouse plugin deployed in RHDH. Provides web performance
+        and accessibility audit views on component entity pages and a dedicated /lighthouse
+        catalog page, powered by the self-hosted lighthouse-audit-service running in the cluster.
+      annotations:
+        backstage.io/kubernetes-id: developer-hub
+      tags:
+        - plugin
+        - lighthouse
+        - performance
+        - accessibility
+      links:
+        - url: https://github.com/backstage/community-plugins/tree/main/workspaces/lighthouse
+          title: Plugin Repository
+          icon: github
+    spec:
+      type: plugin
+      lifecycle: experimental
+      system: integrations
+      owner: group:default/cluster-admins
+      dependsOn:
+        - resource:default/lighthouse-instance
+    ---
+    # Plugin Component: Keycloak catalog backend module.
+    # Required so that the keycloak and rhsso-operator Resources' dependencyOf relations resolve.
+    apiVersion: backstage.io/v1alpha1
+    kind: Component
+    metadata:
+      name: backstage-community-keycloak
+      title: Keycloak Catalog Module
+      description: >
+        Backstage community Keycloak catalog backend module deployed in RHDH. Ingests users and
+        groups from the Keycloak rhdh realm into the Backstage catalog, powering catalog ownership
+        and RBAC policies. Also configures the OIDC sign-in provider so users authenticate via
+        Keycloak.
+      annotations:
+        backstage.io/kubernetes-id: developer-hub
+      tags:
+        - plugin
+        - keycloak
+        - identity
+        - catalog
+      links:
+        - url: https://github.com/backstage/community-plugins/tree/main/workspaces/keycloak
+          title: Plugin Repository
+          icon: github
+    spec:
+      type: plugin
+      lifecycle: production
+      system: integrations
+      owner: group:default/cluster-admins
+      dependsOn:
+        - resource:default/keycloak
diff --git a/resources/catalog-entities/operators.yaml b/resources/catalog-entities/operators.yaml
new file mode 100644
index 0000000..9ecdab2
--- /dev/null
+++ b/resources/catalog-entities/operators.yaml
@@ -0,0 +1,278 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: operators-config-map
+  labels:
+    backstage.io/kubernetes-id: developer-hub
+data:
+  operators.yaml: |
+    # RHSSO and Keycloak
+    apiVersion: backstage.io/v1alpha1
+    kind: Resource
+    metadata:
+      name: rhsso-operator
+      title: Red Hat Single Sign-On Operator
+      description: Operator that is used to configure Red Hat Single Sign-On through the use of Keycloak for an OpenShift instance
+      annotations:
+        backstage.io/kubernetes-id: rhsso-operator
+        backstage.io/kubernetes-namespace: rhdh
+    spec:
+      type: operator
+      owner: cluster-admins
+      dependencyOf: component:default/backstage-community-keycloak
+      dependsOn: 
+        - resource:default/test-cluster
+    ---
+    apiVersion: backstage.io/v1alpha1
+    kind: Resource
+    metadata:
+      name: keycloak
+      title: Keycloak
+      description: Red Hat Single Sign-On Operator deployment of Keycloak
+      annotations:
+        backstage.io/kubernetes-id: keycloak
+        backstage.io/kubernetes-namespace: rhdh
+      links:
+        - url: https://www.keycloak.org/documentation
+          title: Documentation
+          icon: web
+    spec:
+      type: identity-provider
+      lifecycle: production
+      owner: cluster-admins
+      dependencyOf: component:default/backstage-community-keycloak
+      dependsOn: 
+        - resource:default/rhsso-operator
+    ---
+    # ACM, Multiclusterhub, search
+    apiVersion: backstage.io/v1alpha1
+    kind: Resource
+    metadata:
+      name: acm-operator
+      title: Advanced Cluster Manager for Kubernetes Operator
+      description: Operator that is used to configure the Advanced Cluster Manager for an OpenShift instance
+      annotations:
+        backstage.io/kubernetes-id: acm-operator
+        backstage.io/kubernetes-namespace: rhdh
+    spec:
+      type: operator
+      owner: cluster-admins
+      dependencyOf: component:default/backstage-community-ocm
+      dependsOn: 
+        - resource:default/test-cluster
+    ---
+    apiVersion: backstage.io/v1alpha1
+    kind: Resource
+    metadata:
+      name: search-operator
+      title: Search Operator
+      description: Operator that is used in conjuction with the Advanced Cluster Manager for an OpenShift instance
+      annotations:
+        backstage.io/kubernetes-id: search-operator
+        backstage.io/kubernetes-namespace: rhdh
+    spec:
+      type: operator
+      owner: cluster-admins
+      dependencyOf: component:default/backstage-community-ocm
+      dependsOn: 
+        - resource:default/test-cluster
+    ---
+    apiVersion: backstage.io/v1alpha1
+    kind: Resource
+    metadata:
+      name: multiclusterhub
+      title: MultiClusterHub
+      description: Advanced Cluster Manager deployment of the MultiClusterHub
+      annotations:
+        backstage.io/kubernetes-id: multiclusterhub
+        backstage.io/kubernetes-namespace: rhdh
+    spec:
+      type: operator
+      owner: cluster-admins
+      dependencyOf: component:default/backstage-community-ocm
+      dependsOn: 
+        - resource:default/acm-operator
+    ---
+    apiVersion: backstage.io/v1alpha1
+    kind: Resource
+    metadata:
+      name: pipelines-operator
+      title: Red Hat OpenShift Pipelines Operator
+      description: Operator that is used to configure Red Hat OpenShift Pipelines for an OpenShift instance
+      annotations:
+        backstage.io/kubernetes-id: pipelines-operator
+        backstage.io/kubernetes-namespace: openshift-operators
+    spec:
+      type: operator
+      owner: cluster-admins
+      dependencyOf: component:default/backstage-plugin-tekton-workspace
+      dependsOn: 
+        - resource:default/test-cluster
+    ---
+    # Nexus Repository Manager Operator
+    apiVersion: backstage.io/v1alpha1
+    kind: Resource
+    metadata:
+      name: nxrm-operator
+      title: Nexus Repository Manager Operator
+      description: Operator that is used to deploy and manage Sonatype Nexus Repository Manager instances
+      annotations:
+        backstage.io/kubernetes-id: nxrm-operator
+        backstage.io/kubernetes-namespace: rhdh
+    spec:
+      type: operator
+      owner: cluster-admins
+      dependencyOf: component:default/janus-idp-nexus-repository-manager
+      dependsOn: 
+        - resource:default/test-cluster
+    ---
+    apiVersion: backstage.io/v1alpha1
+    kind: Resource
+    metadata:
+      name: nexus-repo
+      title: Nexus Repository Manager
+      description: Nexus Repository Manager instance for artifact management
+      annotations:
+        backstage.io/kubernetes-id: nexus-repo
+        backstage.io/kubernetes-namespace: rhdh
+      links:
+        - url: https://help.sonatype.com/repomanager3
+          title: Documentation
+          icon: web
+    spec:
+      type: artifact-repository
+      lifecycle: production
+      owner: cluster-admins
+      dependencyOf: component:default/janus-idp-nexus-repository-manager
+      dependsOn: 
+        - resource:default/nxrm-operator
+    ---
+    # SonarQube Community Edition (no operator — plain Deployment)
+    apiVersion: backstage.io/v1alpha1
+    kind: Resource
+    metadata:
+      name: sonarqube-instance
+      title: SonarQube Community Edition
+      description: SonarQube CE instance for code quality and security analysis
+      annotations:
+        backstage.io/kubernetes-id: sonarqube-instance
+        backstage.io/kubernetes-namespace: rhdh
+      links:
+        - url: https://docs.sonarsource.com/sonarqube/latest/
+          title: Documentation
+          icon: web
+    spec:
+      type: code-quality-platform
+      lifecycle: production
+      owner: cluster-admins
+      dependencyOf:
+        - component:default/backstage-community-plugin-sonarqube
+      dependsOn:
+        - resource:default/test-cluster
+    ---
+    # ArgoCD Operator
+    apiVersion: backstage.io/v1alpha1
+    kind: Resource
+    metadata:
+      name: argocd-operator
+      title: ArgoCD Operator
+      description: Operator that is used to deploy and manage ArgoCD instances for GitOps continuous delivery
+      annotations:
+        backstage.io/kubernetes-id: argocd-operator
+        backstage.io/kubernetes-namespace: rhdh
+    spec:
+      type: operator
+      owner: cluster-admins
+      dependencyOf: component:default/roadiehq-argocd
+      dependsOn: 
+        - resource:default/test-cluster
+    ---
+    apiVersion: backstage.io/v1alpha1
+    kind: Resource
+    metadata:
+      name: argocd-instance
+      title: ArgoCD
+      description: ArgoCD instance for GitOps continuous delivery workflows
+      annotations:
+        backstage.io/kubernetes-id: argocd-instance
+        backstage.io/kubernetes-namespace: rhdh
+      links:
+        - url: https://argo-cd.readthedocs.io/
+          title: Documentation
+          icon: web
+    spec:
+      type: gitops-platform
+      lifecycle: production
+      owner: cluster-admins
+      dependencyOf: component:default/roadiehq-argocd
+      dependsOn:
+        - resource:default/argocd-operator
+    ---
+    # Jenkins LTS (plain Deployment — no operator)
+    apiVersion: backstage.io/v1alpha1
+    kind: Resource
+    metadata:
+      name: jenkins-instance
+      title: Jenkins LTS
+      description: Jenkins LTS CI/CD server for build history and pipeline integration with RHDH
+      annotations:
+        backstage.io/kubernetes-id: jenkins-instance
+        backstage.io/kubernetes-namespace: rhdh
+      links:
+        - url: https://www.jenkins.io/doc/
+          title: Documentation
+          icon: web
+    spec:
+      type: ci-platform
+      lifecycle: production
+      owner: cluster-admins
+      dependencyOf:
+        - component:default/backstage-community-plugin-jenkins
+      dependsOn:
+        - resource:default/test-cluster
+    ---
+    # JFrog Artifactory OSS Helm Chart
+    apiVersion: backstage.io/v1alpha1
+    kind: Resource
+    metadata:
+      name: jfrog-artifactory-instance
+      title: JFrog Artifactory OSS
+      description: JFrog Artifactory OSS artifact repository for container image registry integration with RHDH
+      annotations:
+        backstage.io/kubernetes-id: jfrog-artifactory-instance
+        backstage.io/kubernetes-namespace: rhdh
+      links:
+        - url: https://jfrog.com/help/r/jfrog-artifactory-documentation
+          title: Documentation
+          icon: web
+    spec:
+      type: artifact-registry
+      lifecycle: production
+      owner: cluster-admins
+      dependencyOf:
+        - component:default/backstage-community-plugin-jfrog-artifactory
+      dependsOn:
+        - resource:default/test-cluster
+    ---
+    # Lighthouse Audit Service (plain Deployment — no operator)
+    apiVersion: backstage.io/v1alpha1
+    kind: Resource
+    metadata:
+      name: lighthouse-instance
+      title: Lighthouse Audit Service
+      description: Self-hosted lighthouse-audit-service providing web performance and accessibility audit history for RHDH
+      annotations:
+        backstage.io/kubernetes-id: lighthouse-instance
+        backstage.io/kubernetes-namespace: rhdh
+      links:
+        - url: https://github.com/backstage/lighthouse-audit-service
+          title: Documentation
+          icon: web
+    spec:
+      type: audit-service
+      lifecycle: production
+      owner: cluster-admins
+      dependencyOf:
+        - component:default/backstage-community-plugin-lighthouse
+      dependsOn:
+        - resource:default/test-cluster
diff --git a/resources/catalog-entities/plugins.yaml b/resources/catalog-entities/plugins.yaml
new file mode 100644
index 0000000..2604012
--- /dev/null
+++ b/resources/catalog-entities/plugins.yaml
@@ -0,0 +1,20 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: plugins-config-map
+  labels:
+    backstage.io/kubernetes-id: developer-hub
+data:
+  plugins.yaml: |
+    apiVersion: backstage.io/v1alpha1
+    kind: Location
+    metadata:
+      name: plugin-locations
+      description: A collection of all plugin related catalog entities
+    spec:
+      type: url
+      targets:
+        - https://github.com/backstage/community-plugins/blob/main/workspaces/keycloak/plugins/catalog-backend-module-keycloak/catalog-info.yaml
+        - https://github.com/backstage/community-plugins/blob/main/workspaces/lighthouse/plugins/lighthouse/catalog-info.yaml
+        - https://github.com/backstage/community-plugins/blob/main/workspaces/sonarqube/plugins/sonarqube/catalog-info.yaml
+        - https://github.com/backstage/community-plugins/blob/main/workspaces/sonarqube/plugins/sonarqube-backend/catalog-info.yaml
diff --git a/resources/catalog-entities/resources.yaml b/resources/catalog-entities/resources.yaml
new file mode 100644
index 0000000..b943b49
--- /dev/null
+++ b/resources/catalog-entities/resources.yaml
@@ -0,0 +1,22 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: resources-config-map
+  labels:
+    backstage.io/kubernetes-id: developer-hub
+data:
+  resources.yaml: |
+    apiVersion: backstage.io/v1alpha1
+    kind: Resource
+    metadata:
+      name: minio
+      title: Minio
+      description: Open-source object storage server
+      annotations:
+        backstage.io/kubernetes-id: minio
+    spec:
+      type: object-storage
+      system: integrations
+      lifecycle: production
+      owner: avengers
+    ---
diff --git a/resources/catalog-entities/users.yaml b/resources/catalog-entities/users.yaml
new file mode 100644
index 0000000..f513e75
--- /dev/null
+++ b/resources/catalog-entities/users.yaml
@@ -0,0 +1,17 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: users-config-map
+  labels:
+    backstage.io/kubernetes-id: developer-hub
+data:
+  users.yaml: |
+    apiVersion: backstage.io/v1alpha1
+    kind: User
+    metadata:
+      name: guest
+      description: Default guest user for unauthenticated access
+    spec:
+      profile:
+        displayName: Guest User
+      memberOf: []
diff --git a/resources/image-stream-imports/alpine-import.yaml b/resources/image-stream-imports/alpine-import.yaml
new file mode 100644
index 0000000..437db5f
--- /dev/null
+++ b/resources/image-stream-imports/alpine-import.yaml
@@ -0,0 +1,22 @@
+apiVersion: image.openshift.io/v1
+kind: ImageStreamImport
+metadata:
+  name: internal-alpine
+spec:
+  import: true
+  images:
+    - from:
+        kind: DockerImage
+        name: alpine:latest
+      to:
+        name: latest
+      importPolicy:
+        insecure: false # Set to true if using an insecure registry
+---
+apiVersion: image.openshift.io/v1
+kind: ImageStream
+metadata:
+  name: internal-alpine
+spec:
+  lookupPolicy:
+    local: true # Ensure the image is resolved locally
diff --git a/resources/image-stream-imports/keycloak-legacy-import.yaml b/resources/image-stream-imports/keycloak-legacy-import.yaml
new file mode 100644
index 0000000..56d618c
--- /dev/null
+++ b/resources/image-stream-imports/keycloak-legacy-import.yaml
@@ -0,0 +1,22 @@
+apiVersion: image.openshift.io/v1
+kind: ImageStreamImport
+metadata:
+  name: internal-keycloak-legacy
+spec:
+  import: true
+  images:
+    - from:
+        kind: DockerImage
+        name: bitnamilegacy/keycloak:26.3.3-debian-12-r0
+      to:
+        name: latest
+      importPolicy:
+        insecure: false # Set to true if using an insecure registry
+---
+apiVersion: image.openshift.io/v1
+kind: ImageStream
+metadata:
+  name: internal-keycloak-legacy
+spec:
+  lookupPolicy:
+    local: true # Ensure the image is resolved locally
diff --git a/resources/image-stream-imports/lighthouse-import.yaml b/resources/image-stream-imports/lighthouse-import.yaml
new file mode 100644
index 0000000..51f3a3c
--- /dev/null
+++ b/resources/image-stream-imports/lighthouse-import.yaml
@@ -0,0 +1,48 @@
+apiVersion: image.openshift.io/v1
+kind: ImageStreamImport
+metadata:
+  name: internal-lighthouse-audit-service
+spec:
+  import: true
+  images:
+    - from:
+        kind: DockerImage
+        name: docker.io/spotify/lighthouse-audit-service:latest
+      to:
+        name: latest
+      importPolicy:
+        insecure: false
+---
+apiVersion: image.openshift.io/v1
+kind: ImageStream
+metadata:
+  name: internal-lighthouse-audit-service
+spec:
+  lookupPolicy:
+    local: true
+---
+# PostgreSQL 13 — used as the lighthouse-audit-service backing store.
+# bitnami/postgresql is hosted on Docker Hub, so we pre-import it to avoid
+# hitting registry rate limits.
+apiVersion: image.openshift.io/v1
+kind: ImageStreamImport
+metadata:
+  name: internal-postgres
+spec:
+  import: true
+  images:
+    - from:
+        kind: DockerImage
+        name: docker.io/postgres:13
+      to:
+        name: "13"
+      importPolicy:
+        insecure: false
+---
+apiVersion: image.openshift.io/v1
+kind: ImageStream
+metadata:
+  name: internal-postgres
+spec:
+  lookupPolicy:
+    local: true
diff --git a/resources/image-stream-imports/postgesql-legacy-import.yaml b/resources/image-stream-imports/postgesql-legacy-import.yaml
new file mode 100644
index 0000000..cd1fbe5
--- /dev/null
+++ b/resources/image-stream-imports/postgesql-legacy-import.yaml
@@ -0,0 +1,22 @@
+apiVersion: image.openshift.io/v1
+kind: ImageStreamImport
+metadata:
+  name: internal-postgresql-legacy
+spec:
+  import: true
+  images:
+    - from:
+        kind: DockerImage
+        name: bitnamilegacy/postgresql:17.6.0-debian-12-r4
+      to:
+        name: latest
+      importPolicy:
+        insecure: false # Set to true if using an insecure registry
+---
+apiVersion: image.openshift.io/v1
+kind: ImageStream
+metadata:
+  name: internal-postgresql-legacy
+spec:
+  lookupPolicy:
+    local: true # Ensure the image is resolved locally
diff --git a/resources/keycloak/dynamic-plugins.yaml b/resources/keycloak/dynamic-plugins.yaml
new file mode 100644
index 0000000..21f8c0b
--- /dev/null
+++ b/resources/keycloak/dynamic-plugins.yaml
@@ -0,0 +1,32 @@
+- package: 'oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/backstage-community-plugin-catalog-backend-module-keycloak:bs_1.45.3__3.16.0'
+  disabled: false
+  pluginConfig:
+    catalog:
+      providers:
+        keycloakOrg:
+          default:
+            baseUrl: '${KEYCLOAK_BASE_URL}'
+            loginRealm: '${KEYCLOAK_LOGIN_REALM}'
+            realm: '${KEYCLOAK_REALM}'
+            clientId: '${KEYCLOAK_CLIENT_ID}'
+            clientSecret: '${KEYCLOAK_CLIENT_SECRET}'
+            schedule:
+              frequency: { minutes: 20 }
+              initialDelay: { seconds: 15 }
+              timeout: { minutes: 5 }
+    auth:
+      environment: production
+      providers:
+        oidc:
+          production:
+            metadataUrl: '${KEYCLOAK_METADATA_URL}'
+            clientId: '${KEYCLOAK_CLIENT_ID}'
+            clientSecret: '${KEYCLOAK_CLIENT_SECRET}'
+            prompt: auto
+            callbackUrl: '${RHDH_BASE_URL}/api/auth/oidc/handler/frame'
+            signIn:
+              resolvers:
+                - resolver: emailLocalPartMatchingUserEntityName
+        guest:
+          dangerouslyAllowOutsideDevelopment: false
+    signInPage: oidc
diff --git a/resources/keycloak/groups.json b/resources/keycloak/groups.json
new file mode 100644
index 0000000..e30ea25
--- /dev/null
+++ b/resources/keycloak/groups.json
@@ -0,0 +1,9 @@
+[
+  {"name": "avengers"},
+  {"name": "defenders"},
+  {"name": "fantastic-four"},
+  {"name": "guardians-of-the-galaxy"},
+  {"name": "x-force"},
+  {"name": "x-men"},
+  {"name": "cluster-admins"}
+]
diff --git a/utils/keycloak/keycloak-values.yaml b/resources/keycloak/keycloak-values.yaml
similarity index 62%
rename from utils/keycloak/keycloak-values.yaml
rename to resources/keycloak/keycloak-values.yaml
index 27db0c6..f3de3f8 100644
--- a/utils/keycloak/keycloak-values.yaml
+++ b/resources/keycloak/keycloak-values.yaml
@@ -6,15 +6,18 @@ replicaCount: 1
 
 # Use Bitnami legacy repository (Bitnami images moved to bitnamilegacy as of Aug 2025)
 # Note: Legacy images are not updated/maintained. Consider migrating to official Keycloak image for long-term.
+# Images are pre-pulled into the cluster's internal registry via resources/image-stream-imports/
+# to avoid Docker Hub rate limits. The ${NAMESPACE} placeholder is substituted by the deploy script.
 image:
-  registry: docker.io
-  repository: bitnamilegacy/keycloak
-  tag: "26.3.3-debian-12-r0"
+  registry: image-registry.openshift-image-registry.svc:5000
+  repository: ${NAMESPACE}/internal-keycloak-legacy
+  tag: latest
   pullPolicy: IfNotPresent
 
 auth:
   adminUser: admin
-  adminPassword: admin123
+  existingSecret: keycloak-credentials
+  passwordSecretKey: admin-password
 
 service:
   type: ClusterIP
@@ -23,7 +26,7 @@ service:
 # OpenShift Route configuration
 route:
   enabled: true
-  host: ""  # Will be auto-generated by OpenShift
+  host: '' # Will be auto-generated by OpenShift
   tls:
     enabled: false
 
@@ -33,14 +36,15 @@ ingress:
 postgresql:
   enabled: true
   image:
-    registry: docker.io
-    repository: bitnamilegacy/postgresql
-    tag: "17.6.0-debian-12-r4"
+    registry: image-registry.openshift-image-registry.svc:5000
+    repository: ${NAMESPACE}/internal-postgresql-legacy
+    tag: latest
     pullPolicy: IfNotPresent
   auth:
-    postgresPassword: postgres123
+    existingSecret: keycloak-credentials
+    secretKeys:
+      userPasswordKey: password
     username: keycloak
-    password: keycloak123
     database: keycloak
   primary:
     resources:
@@ -65,18 +69,19 @@ resources:
 extraEnvVars:
   - name: KEYCLOAK_ADMIN
     value: admin
-  - name: KEYCLOAK_ADMIN_PASSWORD
-    value: admin123
   - name: KC_HOSTNAME_STRICT
-    value: "false"
+    value: 'false'
   - name: KC_HOSTNAME_STRICT_HTTPS
-    value: "false"
+    value: 'false'
   - name: KC_HTTP_ENABLED
-    value: "true"
+    value: 'true'
   - name: KC_PROXY
-    value: "edge"
+    value: 'edge'
   - name: JAVA_OPTS_APPEND
-    value: "-Djava.net.preferIPv4Stack=true -Xms256m -Xmx512m"
+    value: '-Djava.net.preferIPv4Stack=true -Xms256m -Xmx512m'
+
+# KEYCLOAK_ADMIN_PASSWORD is sourced from keycloak-credentials secret at runtime.
+extraEnvVarsSecret: keycloak-credentials
 
 # Increase probe timeouts for slower startup on resource-constrained clusters
 livenessProbe:
@@ -101,4 +106,4 @@ readinessProbe:
 #   - start-dev
 
 # Configuration is now handled by our REST API job in the deployment script
-# No keycloakConfigCli needed 
\ No newline at end of file
+# No keycloakConfigCli needed
diff --git a/utils/keycloak/rhdh-client.json b/resources/keycloak/rhdh-client.json
similarity index 96%
rename from utils/keycloak/rhdh-client.json
rename to resources/keycloak/rhdh-client.json
index 2f5ed39..027915b 100644
--- a/utils/keycloak/rhdh-client.json
+++ b/resources/keycloak/rhdh-client.json
@@ -9,13 +9,8 @@
   "enabled": true,
   "alwaysDisplayInConsole": false,
   "clientAuthenticatorType": "client-secret",
-  "secret": "rhdh-client-secret",
-  "redirectUris": [
-    "*"
-  ],
-  "webOrigins": [
-    "*"
-  ],
+  "redirectUris": [],
+  "webOrigins": [],
   "notBefore": 0,
   "bearerOnly": false,
   "consentRequired": false,
@@ -83,4 +78,4 @@
     "configure": true,
     "manage": true
   }
-}
\ No newline at end of file
+}
diff --git a/resources/keycloak/users.json b/resources/keycloak/users.json
new file mode 100644
index 0000000..ab56490
--- /dev/null
+++ b/resources/keycloak/users.json
@@ -0,0 +1,552 @@
+[
+  {
+    "username": "ant_man",
+    "firstName": "Scott",
+    "lastName": "Lang",
+    "email": "ant_man@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "fantastic-four"
+    ]
+  },
+  {
+    "username": "hulk",
+    "firstName": "Bruce",
+    "lastName": "Banner",
+    "email": "hulk@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "defenders"
+    ]
+  },
+  {
+    "username": "thor",
+    "firstName": "Thor",
+    "lastName": "Odinson",
+    "email": "thor@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "avengers"
+    ]
+  },
+  {
+    "username": "wasp",
+    "firstName": "Janet",
+    "lastName": "van Dyne",
+    "email": "wasp@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "defenders"
+    ]
+  },
+  {
+    "username": "captain_america",
+    "firstName": "Steve",
+    "lastName": "Rogers",
+    "email": "captain_america@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "avengers"
+    ]
+  },
+  {
+    "username": "hawkeye",
+    "firstName": "Clint",
+    "lastName": "Barton",
+    "email": "hawkeye@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "defenders"
+    ]
+  },
+  {
+    "username": "scarlet_witch",
+    "firstName": "Wanda",
+    "lastName": "Maximoff",
+    "email": "scarlet_witch@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "avengers"
+    ]
+  },
+  {
+    "username": "black_panther",
+    "firstName": "King",
+    "lastName": "T'Challa",
+    "email": "black_panther@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "avengers"
+    ]
+  },
+  {
+    "username": "vision",
+    "firstName": "Roy",
+    "lastName": "Thomas",
+    "email": "vision@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "avengers"
+    ]
+  },
+  {
+    "username": "mantis",
+    "firstName": "Mantis",
+    "lastName": "Brandt",
+    "email": "mantis@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "guardians-of-the-galaxy"
+    ]
+  },
+  {
+    "username": "beast",
+    "firstName": "Hank",
+    "lastName": "McCoy",
+    "email": "beast@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "x-men"
+    ]
+  },
+  {
+    "username": "captain_marvel",
+    "firstName": "Carol",
+    "lastName": "Danvers",
+    "email": "captain_marvel@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "avengers"
+    ]
+  },
+  {
+    "username": "she_hulk",
+    "firstName": "Susan",
+    "lastName": "Walters",
+    "email": "she_hulk@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "fantastic-four"
+    ]
+  },
+  {
+    "username": "thing",
+    "firstName": "Ben",
+    "lastName": "Grim",
+    "email": "thing@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "fantastic-four"
+    ]
+  },
+  {
+    "username": "spiderman",
+    "firstName": "Peter",
+    "lastName": "Parker",
+    "email": "spiderman@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "fantastic-four"
+    ]
+  },
+  {
+    "username": "valkyrie",
+    "firstName": "Brunnhilde",
+    "lastName": "of Asgard",
+    "email": "valkyrie@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "defenders"
+    ]
+  },
+  {
+    "username": "nova",
+    "firstName": "Frankie",
+    "lastName": "Raye",
+    "email": "nova@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "fantastic-four"
+    ]
+  },
+  {
+    "username": "storm",
+    "firstName": "Ororo",
+    "lastName": "Munroe",
+    "email": "storm@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "avengers"
+    ]
+  },
+  {
+    "username": "psylocke",
+    "firstName": "Elizabeth",
+    "lastName": "Braddock",
+    "email": "psylocke@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "x-men"
+    ]
+  },
+  {
+    "username": "penance",
+    "firstName": "Monet",
+    "lastName": "Clarisse",
+    "email": "penance@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "x-men"
+    ]
+  },
+  {
+    "username": "cable",
+    "firstName": "Nathan",
+    "lastName": "Christopher",
+    "email": "cable@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "x-men"
+    ]
+  },
+  {
+    "username": "iron_man",
+    "firstName": "Tony",
+    "lastName": "Stark",
+    "email": "iron_man@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "avengers"
+    ]
+  },
+  {
+    "username": "cyclops",
+    "firstName": "Scott",
+    "lastName": "Summers",
+    "email": "cyclops@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "x-men"
+    ]
+  },
+  {
+    "username": "gambit",
+    "firstName": "Remy",
+    "lastName": "LeBeau",
+    "email": "gambit@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "x-men"
+    ]
+  },
+  {
+    "username": "wolverine",
+    "firstName": "Logan",
+    "lastName": "Howlett",
+    "email": "wolverine@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "x-men"
+    ]
+  },
+  {
+    "username": "professor_x",
+    "firstName": "Charles",
+    "lastName": "Xavier",
+    "email": "professor_x@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "x-men"
+    ]
+  },
+  {
+    "username": "mister_fantastic",
+    "firstName": "Reed",
+    "lastName": "Richards",
+    "email": "mister_fantastic@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "fantastic-four"
+    ]
+  },
+  {
+    "username": "invisible_woman",
+    "firstName": "Sue",
+    "lastName": "Storm",
+    "email": "invisible_woman@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "fantastic-four"
+    ]
+  },
+  {
+    "username": "human_torch",
+    "firstName": "Johnny",
+    "lastName": "Storm",
+    "email": "human_torch@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "fantastic-four"
+    ]
+  },
+  {
+    "username": "starhawk",
+    "firstName": "Stakar",
+    "lastName": "of the House of Ogord",
+    "email": "starhawk@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "guardians-of-the-galaxy"
+    ]
+  },
+  {
+    "username": "star_lord",
+    "firstName": "Peter",
+    "lastName": "Quill",
+    "email": "star_lord@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "guardians-of-the-galaxy"
+    ]
+  },
+  {
+    "username": "gamora",
+    "firstName": "Gamora",
+    "lastName": "Titan",
+    "email": "gamora@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "guardians-of-the-galaxy"
+    ]
+  },
+  {
+    "username": "drax",
+    "firstName": "Arthur",
+    "lastName": "Douglas",
+    "email": "drax@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "guardians-of-the-galaxy"
+    ]
+  },
+  {
+    "username": "rocket_raccoon",
+    "firstName": "Rocket",
+    "lastName": "Raccoon",
+    "email": "rocket_raccoon@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "guardians-of-the-galaxy"
+    ]
+  },
+  {
+    "username": "adam_warlock",
+    "firstName": "Adam",
+    "lastName": "Warlock",
+    "email": "adam_warlock@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "guardians-of-the-galaxy"
+    ]
+  },
+  {
+    "username": "groot",
+    "firstName": "Groot",
+    "lastName": "Groot",
+    "email": "groot@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "guardians-of-the-galaxy"
+    ]
+  },
+  {
+    "username": "captain_britain",
+    "firstName": "Betsy",
+    "lastName": "Braddock",
+    "email": "captain_britain@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "x-force"
+    ]
+  },
+  {
+    "username": "deadpool",
+    "firstName": "Wade",
+    "lastName": "Wilson",
+    "email": "deadpool@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "x-force"
+    ]
+  },
+  {
+    "username": "colossus",
+    "firstName": "Piotr",
+    "lastName": "Rasputin",
+    "email": "colossus@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "x-force"
+    ]
+  },
+  {
+    "username": "domino",
+    "firstName": "Neena",
+    "lastName": "Thurman",
+    "email": "domino@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "x-force"
+    ]
+  },
+  {
+    "username": "x_23",
+    "firstName": "Laura",
+    "lastName": "Kinney",
+    "email": "x_23@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "x-force"
+    ]
+  },
+  {
+    "username": "marvel_girl",
+    "firstName": "Jean",
+    "lastName": "Grey",
+    "email": "marvel_girl@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "x-force"
+    ]
+  },
+  {
+    "username": "copycat",
+    "firstName": "Vanessa",
+    "lastName": "Carlysle",
+    "email": "copycat@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "x-force"
+    ]
+  },
+  {
+    "username": "bishop",
+    "firstName": "Lucas",
+    "lastName": "Bishop",
+    "email": "bishop@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "x-force"
+    ]
+  },
+  {
+    "username": "doctor_strange",
+    "firstName": "Stephen",
+    "lastName": "Strange",
+    "email": "doctor_strange@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "defenders"
+    ]
+  },
+  {
+    "username": "silver_surfer",
+    "firstName": "Norrin",
+    "lastName": "Radd",
+    "email": "silver_surfer@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "defenders"
+    ]
+  },
+  {
+    "username": "nighthawk",
+    "firstName": "Kyle",
+    "lastName": "Richmond",
+    "email": "nighthawk@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "defenders"
+    ]
+  },
+  {
+    "username": "power_man",
+    "firstName": "Victor",
+    "lastName": "Alvarez",
+    "email": "power_man@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "defenders"
+    ]
+  },
+  {
+    "username": "admin",
+    "firstName": "Admin",
+    "lastName": "Admin",
+    "email": "admin@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "cluster-admins"
+    ]
+  },
+  {
+    "username": "super_user",
+    "firstName": "Super",
+    "lastName": "User",
+    "email": "super_user@example.com",
+    "enabled": true,
+    "emailVerified": true,
+    "groups": [
+      "cluster-admins"
+    ]
+  }
+]
diff --git a/resources/lighthouse/dynamic-plugins.yaml b/resources/lighthouse/dynamic-plugins.yaml
new file mode 100644
index 0000000..70627c0
--- /dev/null
+++ b/resources/lighthouse/dynamic-plugins.yaml
@@ -0,0 +1,57 @@
+- package: oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/backstage-community-plugin-lighthouse:bs_1.45.3__0.16.0!backstage-community-plugin-lighthouse
+  disabled: false
+  pluginConfig:
+    dynamicPlugins:
+      frontend:
+        backstage-community.plugin-lighthouse:
+          appIcons:
+            - name: lighthouse
+              importName: LighthouseIcon
+          dynamicRoutes:
+            - path: /lighthouse
+              importName: LighthousePage
+              menuItem:
+                icon: lighthouse
+                text: menuItem.lighthouse
+                textKey: menuItem.lighthouse
+          mountPoints:
+            - mountPoint: entity.page.overview/cards
+              importName: EntityLastLighthouseAuditCard
+              config:
+                layout:
+                  gridColumnEnd:
+                    md: span 6
+                    xs: span 12
+                if:
+                  allOf:
+                    - isLighthouseAvailable
+- package: oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/backstage-community-plugin-lighthouse-backend:bs_1.45.3__0.17.0!backstage-community-plugin-lighthouse-backend
+  disabled: false
+  pluginConfig:
+    backend:
+      csp:
+        # Lighthouse HTML reports contain inline <script> blocks. Since the report
+        # is served through RHDH's proxy (same origin), RHDH's script-src applies
+        # to the iframe content. 'unsafe-inline' is required to render the report.
+        # All existing RHDH defaults are preserved here to avoid breaking them.
+        script-src:
+          - "'self'"
+          - "'unsafe-eval'"
+          - "'unsafe-inline'"
+    proxy:
+      endpoints:
+        /lighthouse:
+          target: '${LIGHTHOUSE_SVC_URL}'
+          changeOrigin: true
+          # Lighthouse's LighthouseRestApi uses plain fetch() with no Backstage
+          # identity token. 'dangerously-allow-unauthenticated' is required since
+          # the proxy defaults to credentials: require since Backstage 1.26.
+          credentials: dangerously-allow-unauthenticated
+
+    lighthouse:
+      baseUrl: ${LIGHTHOUSE_URL}
+      schedule:
+        frequency:
+          hours: 12
+        timeout:
+          minutes: 30
diff --git a/resources/lighthouse/lighthouse-deployment.yaml b/resources/lighthouse/lighthouse-deployment.yaml
new file mode 100644
index 0000000..8faa1b7
--- /dev/null
+++ b/resources/lighthouse/lighthouse-deployment.yaml
@@ -0,0 +1,186 @@
+# PostgreSQL database for lighthouse-audit-service
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: lighthouse-postgres-data
+  labels:
+    app: lighthouse-postgres
+    backstage.io/kubernetes-id: lighthouse-instance
+    app.kubernetes.io/part-of: lighthouse-instance
+spec:
+  accessModes: [ReadWriteOnce]
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: lighthouse-postgres
+  labels:
+    app: lighthouse-postgres
+    backstage.io/kubernetes-id: lighthouse-instance
+    app.kubernetes.io/part-of: lighthouse-instance
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: lighthouse-postgres
+  template:
+    metadata:
+      labels:
+        app: lighthouse-postgres
+        backstage.io/kubernetes-id: lighthouse-instance
+    spec:
+      containers:
+        - name: postgres
+          image: internal-postgres:13
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 5432
+          env:
+            - name: POSTGRES_USER
+              value: lighthouse
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: lighthouse-credentials
+                  key: password
+            - name: POSTGRES_DB
+              value: lighthouse
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          volumeMounts:
+            - name: postgres-data
+              mountPath: /var/lib/postgresql/data
+          readinessProbe:
+            exec:
+              command: [pg_isready, -U, lighthouse]
+            initialDelaySeconds: 10
+            periodSeconds: 5
+      volumes:
+        - name: postgres-data
+          persistentVolumeClaim:
+            claimName: lighthouse-postgres-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: lighthouse-postgres
+  labels:
+    app: lighthouse-postgres
+    backstage.io/kubernetes-id: lighthouse-instance
+    app.kubernetes.io/part-of: lighthouse-instance
+spec:
+  selector:
+    app: lighthouse-postgres
+  ports:
+    - port: 5432
+      targetPort: 5432
+---
+# Lighthouse audit service
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: lighthouse
+  labels:
+    app: lighthouse
+    backstage.io/kubernetes-id: lighthouse-instance
+    app.kubernetes.io/part-of: lighthouse-instance
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: lighthouse
+  template:
+    metadata:
+      labels:
+        app: lighthouse
+        backstage.io/kubernetes-id: lighthouse-instance
+        app.kubernetes.io/part-of: lighthouse-instance
+    spec:
+      containers:
+        - name: lighthouse
+          image: internal-lighthouse-audit-service:latest
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 3003
+          env:
+            - name: LAS_PORT
+              value: '3003'
+            - name: LAS_CORS
+              value: 'true'
+            - name: PGHOST
+              value: lighthouse-postgres
+            - name: PGPORT
+              value: '5432'
+            - name: PGUSER
+              value: lighthouse
+            - name: PGPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: lighthouse-credentials
+                  key: password
+            - name: PGDATABASE
+              value: lighthouse
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 500m
+              memory: 1Gi
+          readinessProbe:
+            httpGet:
+              path: /v1/websites
+              port: 3003
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            failureThreshold: 6
+          livenessProbe:
+            httpGet:
+              path: /v1/websites
+              port: 3003
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            failureThreshold: 3
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: lighthouse
+  labels:
+    app: lighthouse
+    backstage.io/kubernetes-id: lighthouse-instance
+    app.kubernetes.io/part-of: lighthouse-instance
+spec:
+  selector:
+    app: lighthouse
+  ports:
+    - port: 3003
+      targetPort: 3003
+---
+apiVersion: route.openshift.io/v1
+kind: Route
+metadata:
+  name: lighthouse
+  labels:
+    app: lighthouse
+    backstage.io/kubernetes-id: lighthouse-instance
+    app.kubernetes.io/part-of: lighthouse-instance
+spec:
+  tls:
+    termination: edge
+    insecureEdgeTerminationPolicy: Redirect
+  to:
+    kind: Service
+    name: lighthouse
+  port:
+    targetPort: 3003
diff --git a/resources/lighthouse/lighthouse-scan-job.yaml b/resources/lighthouse/lighthouse-scan-job.yaml
new file mode 100644
index 0000000..38a8c5f
--- /dev/null
+++ b/resources/lighthouse/lighthouse-scan-job.yaml
@@ -0,0 +1,64 @@
+# Runs a Lighthouse audit against <RHDH_URL> via the in-cluster audit service.
+# The config script patches <RHDH_URL> and <LIGHTHOUSE_SVC> before applying.
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: lighthouse-initial-scan
+spec:
+  # Clean up completed pods after 5 minutes
+  ttlSecondsAfterFinished: 300
+  template:
+    metadata:
+      labels:
+        app: lighthouse-scan
+        backstage.io/kubernetes-id: lighthouse-instance
+        app.kubernetes.io/part-of: lighthouse-instance
+    spec:
+      restartPolicy: OnFailure
+      containers:
+        - name: scan
+          image: internal-alpine:latest
+          imagePullPolicy: IfNotPresent
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 200m
+              memory: 128Mi
+          command:
+            - /bin/sh
+            - -c
+            - |
+              set -e
+
+              LIGHTHOUSE_SVC="<LIGHTHOUSE_SVC>"
+              RHDH_URL="<RHDH_URL>"
+              RHDH_READY_TIMEOUT=360   # 6 minutes — RHDH deploys after this job is submitted
+              RHDH_READY_INTERVAL=15
+
+              echo "Waiting for Lighthouse audit service at ${LIGHTHOUSE_SVC}..."
+              until wget -qO- "${LIGHTHOUSE_SVC}/v1/websites" >/dev/null 2>&1; do
+                echo "  not ready yet, retrying in 10s..."
+                sleep 10
+              done
+
+              echo "Waiting for RHDH to be reachable at ${RHDH_URL}..."
+              elapsed=0
+              until wget -q --no-check-certificate --spider "${RHDH_URL}/healthcheck" >/dev/null 2>&1; do
+                if [ "$elapsed" -ge "$RHDH_READY_TIMEOUT" ]; then
+                  echo "Warning: Timed out waiting for RHDH — submitting scan anyway."
+                  break
+                fi
+                echo "  RHDH not reachable yet, retrying in ${RHDH_READY_INTERVAL}s... (${elapsed}s elapsed)"
+                sleep "$RHDH_READY_INTERVAL"
+                elapsed=$((elapsed + RHDH_READY_INTERVAL))
+              done
+
+              echo "Submitting Lighthouse audit for: ${RHDH_URL}"
+              wget -qO- \
+                --header="Content-Type: application/json" \
+                --post-data="{\"url\":\"${RHDH_URL}\",\"options\":{\"lighthouseConfig\":{\"settings\":{\"emulatedFormFactor\":\"desktop\",\"chromeFlags\":\"--ignore-certificate-errors\"}}}}" \
+                "${LIGHTHOUSE_SVC}/v1/audits" \
+                && echo "Audit submitted successfully!" \
+                || { echo "Warning: Audit submission failed — service may not yet accept scans."; exit 0; }
diff --git a/resources/rhdh-script-examples/backstage-test.yaml b/resources/rhdh-script-examples/backstage-test.yaml
new file mode 100644
index 0000000..e707239
--- /dev/null
+++ b/resources/rhdh-script-examples/backstage-test.yaml
@@ -0,0 +1,39 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backstage-app
+  annotations:
+    app.openshift.io/vcs-uri: 'https://github.com/janus-idp/backstage-showcase'
+    app.openshift.io/vcs-ref: main
+  labels:
+    backstage.io/kubernetes-id: developer-hub
+    app.openshift.io/runtime: nodejs
+    app.kubernetes.io/part-of: rhdh-start-scripts
+
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: backstage-app
+  template:
+    metadata:
+      labels:
+        app: backstage-app
+        backstage.io/kubernetes-id: developer-hub
+    spec:
+      containers:
+        - name: alpine
+          image: internal-alpine:latest
+          imagePullPolicy: IfNotPresent
+          command:
+            - /bin/sh
+          args:
+            - -c
+            - 'tail -f /dev/null'
+          resources:
+            requests:
+              cpu: 5m
+              memory: 10Mi
+            limits:
+              cpu: 10m
+              memory: 20Mi
diff --git a/scripts/config-plugins.sh b/scripts/config-plugins.sh
new file mode 100644
index 0000000..2868576
--- /dev/null
+++ b/scripts/config-plugins.sh
@@ -0,0 +1,189 @@
+#!/bin/bash
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+for file in "${DIR}"/plugins/*.sh; do source "$file"; done
+
+# =============================================================================
+# Shared helper: append a plugin's dynamic-plugins YAML to the cluster
+# ConfigMap that was seeded in deploy.sh before plugin scripts ran.
+# Both the current content and the new entries are concatenated so that
+# multiple plugins can call this safely in sequence.
+# =============================================================================
+_append_plugin_dynamic_config() {
+  local plugin_yaml_file="$1"
+  local plugin_name="${2:-plugin}"
+
+  echo "Appending ${plugin_name} dynamic-plugins config to cluster ConfigMap..."
+  oc create configmap dynamic-plugins \
+    --from-file=dynamic-plugins.yaml=<(
+      oc get configmap dynamic-plugins \
+        --namespace="${NAMESPACE}" \
+        -o jsonpath='{.data.dynamic-plugins\.yaml}' \
+        | sed 's/^plugins: \[\]/plugins:/'
+      sed 's/^/  /' "${plugin_yaml_file}"
+    ) \
+    --namespace="${NAMESPACE}" \
+    --dry-run=client -o yaml | oc apply -f - --namespace="${NAMESPACE}"
+}
+
+# =============================================================================
+# Setup/Teardown Functions for Each Category
+# =============================================================================
+
+declare -A CATEGORY_SETUP_FUNCTIONS=(
+  [KEYCLOAK]="deploy_keycloak config_secrets_for_keycloak_plugins create_users_and_groups_keycloak apply_keycloak_labels"
+  # [TEKTON]="deploy_tekon deploy_pipelines apply_tekton_labels"
+  # [OCM]="deploy_acm config_secrets_for_ocm_plugins deploy_multicluster_hub apply_ocm_labels"
+  # [3SCALE]="copy_3scale_files deploy_3scale deploy_minio deploy_3scale_resources"
+  # [NEXUS]="deploy_nexus wait_for_nexus_operator_and_deploy_instance wait_for_nexus_instance config_secrets_for_nexus_plugins apply_nexus_labels populate_nexus_demo_data register_nexus_demo_catalog_entities"
+  # [ARGOCD]="deploy_argocd wait_for_argocd_operator_and_deploy_instance wait_for_argocd_instance_and_deploy_demo_applications config_secrets_for_argocd_plugins apply_argocd_labels register_argocd_demo_catalog_entities"
+  # [KUBERNETES]="config_secrets_for_kubernetes_plugins"
+  # [SONARQUBE]="deploy_sonarqube wait_for_sonarqube_and_populate_demo_data config_secrets_for_sonarqube_plugins apply_sonarqube_labels register_sonarqube_demo_catalog_entities"
+  # [TECHDOCS]="copy_techdocs_files deploy_techdocs_minio wait_for_minio_and_create_techdocs_bucket config_secrets_for_techdocs_plugins publish_techdocs_demo_docs register_techdocs_demo_catalog_entities"
+  # [NOTIFICATIONS]="config_secrets_for_notifications_plugins populate_notifications_demo_data register_notifications_demo_catalog_entities"
+  # [JENKINS]="deploy_jenkins wait_for_jenkins_and_populate_demo_data config_secrets_for_jenkins_plugins apply_jenkins_labels register_jenkins_demo_catalog_entities"
+  # [JFROG_ARTIFACTORY]="deploy_jfrog_artifactory wait_for_jfrog_and_populate_demo_data config_secrets_for_jfrog_artifactory_plugins apply_jfrog_artifactory_labels register_jfrog_artifactory_demo_catalog_entities"
+  [LIGHTHOUSE]="deploy_lighthouse config_secrets_for_lighthouse_plugins apply_lighthouse_labels run_lighthouse_initial_scan"
+)
+
+declare -A CATEGORY_TEARDOWN_FUNCTIONS=(
+  [KEYCLOAK]="uninstall_keycloak"
+  # [TEKTON]="uninstall_tekton"
+  # [OCM]="uninstall_acm"
+  # [3SCALE]="uninstall_3scale"
+  # [NEXUS]="uninstall_nexus"
+  # [ARGOCD]="uninstall_argocd"
+  # [KUBERNETES]=":"
+  # [SONARQUBE]="uninstall_sonarqube"
+  # [TECHDOCS]="uninstall_techdocs"
+  # [NOTIFICATIONS]="uninstall_notifications"
+  # [JENKINS]="uninstall_jenkins"
+  # [JFROG_ARTIFACTORY]="uninstall_jfrog_artifactory"
+  [LIGHTHOUSE]="uninstall_lighthouse"
+)
+
+# =============================================================================
+# Primary: resolve categories from a comma-separated plugin name list
+# =============================================================================
+# Plugin names are normalized: trimmed, uppercased, hyphens replaced with
+# underscores. This means "keycloak", "KEYCLOAK", "lighthouse",
+# "jfrog-artifactory", and "3scale" all resolve correctly.
+# An unknown name emits a warning and is skipped rather than aborting.
+# =============================================================================
+
+resolve_categories_from_plugins() {
+  local plugins_list="$1"
+  local -A categories_found=()
+
+  IFS=',' read -ra plugin_names <<< "$plugins_list"
+  for name in "${plugin_names[@]}"; do
+    local category
+    category=$(echo "$name" | tr -d '[:space:]' | tr '[:lower:]' '[:upper:]' | tr '-' '_')
+
+    if [[ -n "${CATEGORY_SETUP_FUNCTIONS[$category]+x}" ]]; then
+      categories_found["$category"]=1
+      echo "  ✓ Requested: $category"
+    else
+      echo "  ✗ Warning: Unknown plugin '${name}' (normalized: ${category}) — skipping"
+    fi
+  done
+
+  ENABLED_CATEGORIES=("${!categories_found[@]}")
+}
+
+
+# =============================================================================
+# Execute setup or teardown functions
+# =============================================================================
+
+execute_category_functions() {
+  local function_map_name="$1"
+  declare -n function_map="$function_map_name"
+  
+  if [[ ${#ENABLED_CATEGORIES[@]} -eq 0 ]]; then
+    echo "No plugins requiring cluster resources detected."
+    return 0
+  fi
+  
+  # Track current step for round-robin execution
+  declare -A current_step_index
+  for category in "${ENABLED_CATEGORIES[@]}"; do
+    current_step_index["$category"]=0
+  done
+
+  # Round-robin execution
+  local all_complete=false
+  while [[ "$all_complete" == "false" ]]; do
+    all_complete=true
+    for category in "${ENABLED_CATEGORIES[@]}"; do
+      local functions="${function_map[$category]}"
+      local steps=($functions)
+      local step_index=${current_step_index[$category]}
+
+      if [[ $step_index -lt ${#steps[@]} ]]; then
+        local step="${steps[$step_index]}"
+        if [[ "$step" != ":" ]]; then
+          echo ""
+          echo "[$category] Executing: $step"
+          $step
+        fi
+        current_step_index["$category"]=$((step_index + 1))
+        all_complete=false
+      fi
+    done
+  done
+}
+
+# =============================================================================
+# Main Entry Point
+# =============================================================================
+# Usage (from deploy.sh):   source scripts/config-plugins.sh; main "$PLUGINS"
+# Usage (standalone):       ./scripts/config-plugins.sh keycloak,lighthouse
+#
+# $1 — required comma-separated plugin names, e.g. "keycloak,lighthouse"
+#      Each plugin script appends its resources/*/dynamic-plugins.yaml to the
+#      cluster's dynamic-plugins ConfigMap via _append_plugin_dynamic_config.
+# =============================================================================
+main() {
+  local plugins_arg="${1:-}"
+
+  echo ""
+  echo "=============================================="
+  echo "Plugin Configuration"
+  echo "=============================================="
+
+  if [[ -z "$plugins_arg" ]]; then
+    echo "No plugins specified. Pass a comma-separated list, e.g: keycloak,lighthouse"
+    return 0
+  fi
+
+  echo "Resolving plugins: ${plugins_arg}"
+  echo ""
+  resolve_categories_from_plugins "$plugins_arg"
+
+  if [[ ${#ENABLED_CATEGORIES[@]} -eq 0 ]]; then
+    echo "No recognised plugins to configure."
+    return 0
+  fi
+
+  echo ""
+  echo "Categories to configure: ${ENABLED_CATEGORIES[*]}"
+  echo ""
+
+  if [[ "${TEARDOWN:-false}" == "true" ]]; then
+    echo "Running teardown..."
+    execute_category_functions "CATEGORY_TEARDOWN_FUNCTIONS"
+  else
+    echo "Running setup..."
+    execute_category_functions "CATEGORY_SETUP_FUNCTIONS"
+  fi
+
+  echo ""
+  echo "=============================================="
+  echo "Plugin configuration complete."
+  echo "=============================================="
+}
+
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+    main "$@"
+fi
diff --git a/scripts/plugins/config-keycloak-plugin.sh b/scripts/plugins/config-keycloak-plugin.sh
new file mode 100644
index 0000000..f405a7e
--- /dev/null
+++ b/scripts/plugins/config-keycloak-plugin.sh
@@ -0,0 +1,509 @@
+#!/bin/bash
+
+# =============================================================================
+# Keycloak Plugin Configuration
+# =============================================================================
+# This script deploys and configures Keycloak (via Bitnami Helm chart) and
+# provisions the OIDC client, realm, and user/group data needed by the
+# Keycloak catalog backend plugin.
+#
+# Functions are structured for efficient round-robin execution:
+#   1. deploy_keycloak                     — Install Helm chart + create Route (quick)
+#   2. config_secrets_for_keycloak_plugins — Wait for readiness, then create realm/client/
+#                                            roles, write secrets, register plugin overlay
+#   3. create_users_and_groups_keycloak    — Provision groups and users via API
+#   4. apply_keycloak_labels               — Label resources for the K8s plugin
+#
+# Readiness polling is embedded at the top of config_secrets_for_keycloak_plugins
+# rather than as a standalone step. This keeps the round-robin loop doing useful
+# work on other plugins instead of burning a full turn on a pure wait.
+#
+# Uses plain HTTP for the Keycloak route to avoid self-signed certificate issues
+# when RHDH (Node.js) connects to Keycloak's OIDC endpoints.
+# =============================================================================
+
+_KEYCLOAK_RELEASE_NAME="keycloak"
+_KEYCLOAK_CLIENT_FILE="${PWD}/resources/keycloak/rhdh-client.json"
+_KEYCLOAK_USERS_FILE="${PWD}/resources/keycloak/users.json"
+_KEYCLOAK_GROUPS_FILE="${PWD}/resources/keycloak/groups.json"
+_KEYCLOAK_VALUES_FILE="${PWD}/resources/keycloak/keycloak-values.yaml"
+
+# Shared state set by config_secrets_for_keycloak_plugins and consumed by
+# create_users_and_groups_keycloak. Declared here so they are always in scope
+# when the file is sourced by config-plugins.sh.
+KEYCLOAK_URL=""
+ADMIN_TOKEN=""
+
+# =============================================================================
+# Helper: Keycloak REST API wrapper
+# Prefixed to avoid collisions when sourced alongside other plugin scripts.
+# =============================================================================
+_keycloak_api_call() {
+  local method=$1
+  local url=$2
+  local data=$3
+  local description=$4
+  local response http_code body
+
+  if [[ -n "$data" ]]; then
+    response=$(curl -sk -w "\n%{http_code}" -X "$method" "$url" \
+      -H "Authorization: Bearer ${ADMIN_TOKEN}" \
+      -H "Content-Type: application/json" \
+      -d "$data")
+  else
+    response=$(curl -sk -w "\n%{http_code}" -X "$method" "$url" \
+      -H "Authorization: Bearer ${ADMIN_TOKEN}" \
+      -H "Content-Type: application/json")
+  fi
+
+  http_code=$(echo "$response" | tail -1)
+  body=$(echo "$response" | sed '$d')
+
+  if [[ "$method" == "GET" ]] || [[ "$http_code" -lt 400 ]]; then
+    echo "$body"
+    return 0
+  fi
+
+  # 409 Conflict is acceptable for idempotent create operations.
+  if [[ "$http_code" == "409" ]]; then
+    echo "Warning: ${description} — already exists (continuing)" >&2
+    echo "$body"
+    return 0
+  fi
+
+  echo "Error: ${description} failed (HTTP ${http_code}): ${body}" >&2
+  return 1
+}
+
+
+# =============================================================================
+# Step 1: Deploy Keycloak (quick action — no waiting)
+# =============================================================================
+deploy_keycloak() {
+  echo "Creating namespace ${NAMESPACE}..."
+  oc create namespace "${NAMESPACE}" --dry-run=client -o yaml | oc apply -f -
+
+  # Generate Keycloak credentials only on first run — skip if the secret already
+  # exists so that re-runs against a live Keycloak never rotate passwords that
+  # the running instance depends on.
+  if oc get secret keycloak-credentials --namespace="${NAMESPACE}" &>/dev/null; then
+    echo "keycloak-credentials already exists — skipping generation."
+  else
+    echo "Generating keycloak-credentials Secret..."
+    local kc_admin_password kc_db_password kc_client_secret
+    kc_admin_password=$(LC_ALL=C tr -dc 'A-Za-z0-9' </dev/urandom | head -c 24)
+    kc_db_password=$(LC_ALL=C tr -dc 'A-Za-z0-9' </dev/urandom | head -c 24)
+    kc_client_secret=$(LC_ALL=C tr -dc 'A-Za-z0-9' </dev/urandom | head -c 32)
+
+    oc create secret generic keycloak-credentials \
+      --from-literal=admin-password="${kc_admin_password}" \
+      --from-literal=KEYCLOAK_ADMIN_PASSWORD="${kc_admin_password}" \
+      --from-literal=postgres-password="${kc_db_password}" \
+      --from-literal=password="${kc_db_password}" \
+      --from-literal=client-secret="${kc_client_secret}" \
+      --namespace="${NAMESPACE}"
+  fi
+
+  echo "Adding Bitnami Helm repository..."
+  helm repo add bitnami https://charts.bitnami.com/bitnami --force-update
+  helm repo update
+
+  echo "Deploying Keycloak via Helm..."
+  helm upgrade --install "${_KEYCLOAK_RELEASE_NAME}" bitnami/keycloak \
+    --namespace "${NAMESPACE}" \
+    --values <(envsubst < "${_KEYCLOAK_VALUES_FILE}")
+
+  echo "Creating OpenShift Route (HTTP, no TLS)..."
+  oc apply -f - --namespace="${NAMESPACE}" <<EOF
+apiVersion: route.openshift.io/v1
+kind: Route
+metadata:
+  name: ${_KEYCLOAK_RELEASE_NAME}
+  namespace: ${NAMESPACE}
+  labels:
+    app.kubernetes.io/name: keycloak
+    app.kubernetes.io/instance: ${_KEYCLOAK_RELEASE_NAME}
+spec:
+  to:
+    kind: Service
+    name: ${_KEYCLOAK_RELEASE_NAME}
+    weight: 100
+  port:
+    targetPort: http
+  wildcardPolicy: None
+EOF
+
+  echo "Keycloak deployment applied!"
+}
+
+# =============================================================================
+# Step 2: Create realm/client/roles and write plugin secrets
+#         (waits for Keycloak readiness internally before proceeding)
+# =============================================================================
+config_secrets_for_keycloak_plugins() {
+  echo "Configuring Keycloak realm, client, and plugin secrets..."
+
+  if [[ ! -f "${_KEYCLOAK_CLIENT_FILE}" ]]; then
+    echo "Error: Client file not found: ${_KEYCLOAK_CLIENT_FILE}"
+    return 1
+  fi
+  jq empty "${_KEYCLOAK_CLIENT_FILE}" 2>/dev/null || {
+    echo "Error: Invalid JSON in ${_KEYCLOAK_CLIENT_FILE}"
+    return 1
+  }
+
+  # ---- Wait for StatefulSet ----
+  echo "Waiting for Keycloak StatefulSet to become ready..."
+  SECONDS=0
+  while true; do
+    local ready
+    ready=$(oc get statefulset "${_KEYCLOAK_RELEASE_NAME}" \
+      --namespace="${NAMESPACE}" \
+      -o jsonpath='{.status.readyReplicas}' 2>/dev/null)
+    [[ "${ready}" == "1" ]] && echo "Keycloak StatefulSet is ready!" && break
+    if [[ $SECONDS -ge ${TIMEOUT:-300} ]]; then
+      echo "Warning: Timeout waiting for Keycloak StatefulSet — continuing anyway."
+      break
+    fi
+    echo "  Keycloak not ready yet (readyReplicas=${ready:-0}). Retrying in ${INTERVAL:-15}s..."
+    sleep "${INTERVAL:-15}"
+  done
+
+  local keycloak_host
+  keycloak_host=$(oc get route "${_KEYCLOAK_RELEASE_NAME}" \
+    --namespace="${NAMESPACE}" \
+    -o jsonpath='{.spec.host}' 2>/dev/null)
+
+  if [[ -z "$keycloak_host" ]]; then
+    echo "Error: Could not determine Keycloak route URL."
+    return 1
+  fi
+
+  # Populate the globals consumed by create_users_and_groups_keycloak.
+  KEYCLOAK_URL="http://${keycloak_host}"
+
+  # ---- Wait for Keycloak API ----
+  local check_url="${KEYCLOAK_URL}/realms/master"
+  echo "Waiting for Keycloak API at ${check_url}..."
+  SECONDS=0
+  while true; do
+    local http_status
+    http_status=$(curl -sk -o /dev/null -w "%{http_code}" "$check_url" 2>/dev/null || echo "000")
+    if [[ "$http_status" == "200" ]]; then
+      echo "Keycloak API is ready!"
+      break
+    fi
+    if [[ $SECONDS -ge ${TIMEOUT:-300} ]]; then
+      echo "Warning: Timeout waiting for Keycloak API (last status: ${http_status}) — continuing anyway."
+      break
+    fi
+    echo "  Waiting for API... (status: ${http_status})"
+    sleep "${INTERVAL:-15}"
+  done
+
+  echo "Getting admin token..."
+  local kc_admin_password
+  kc_admin_password=$(oc get secret keycloak-credentials \
+    --namespace="${NAMESPACE}" \
+    -o jsonpath='{.data.admin-password}' | base64 -d)
+
+  local token_response token_http_code token_body
+  token_response=$(curl -sk -w "\n%{http_code}" -X POST \
+    "${KEYCLOAK_URL}/realms/master/protocol/openid-connect/token" \
+    -d "username=admin&password=${kc_admin_password}&grant_type=password&client_id=admin-cli")
+  token_http_code=$(echo "$token_response" | tail -1)
+  token_body=$(echo "$token_response" | sed '$d')
+
+  if [[ "$token_http_code" -ge 400 ]]; then
+    echo "Error: Failed to get admin token (HTTP ${token_http_code}): ${token_body}"
+    return 1
+  fi
+
+  ADMIN_TOKEN=$(echo "$token_body" | jq -r '.access_token // empty')
+  if [[ -z "${ADMIN_TOKEN}" ]]; then
+    echo "Error: Failed to parse admin token."
+    return 1
+  fi
+
+  echo "Creating realm 'rhdh'..."
+  _keycloak_api_call POST "${KEYCLOAK_URL}/admin/realms" \
+    '{"realm":"rhdh","enabled":true,"displayName":"RHDH Realm"}' \
+    "Create realm" >/dev/null
+
+  echo "Creating OIDC client..."
+  : "${RHDH_BASE_URL:?RHDH_BASE_URL must be set — cannot build OIDC redirect URI}"
+  local rhdh_redirect_uri="${RHDH_BASE_URL}/api/auth/oidc/handler/frame"
+  local kc_client_secret
+  kc_client_secret=$(oc get secret keycloak-credentials \
+    --namespace="${NAMESPACE}" \
+    -o jsonpath='{.data.client-secret}' | base64 -d)
+
+  _keycloak_api_call POST "${KEYCLOAK_URL}/admin/realms/rhdh/clients" \
+    "$(jq -c \
+        --arg secret "${kc_client_secret}" \
+        --arg redirect_uri "${rhdh_redirect_uri}" \
+        '.secret = $secret | .redirectUris = [$redirect_uri] | .webOrigins = [$redirect_uri]' \
+        "${_KEYCLOAK_CLIENT_FILE}")" \
+    "Create client" >/dev/null
+
+  local service_account_id realm_mgmt_id roles
+
+  service_account_id=$(_keycloak_api_call GET \
+    "${KEYCLOAK_URL}/admin/realms/rhdh/users?username=service-account-rhdh-client" \
+    "" "Get service account" | jq -r '.[0].id // empty')
+
+  if [[ -z "$service_account_id" ]]; then
+    echo "Error: Service account not found — was the client created with serviceAccountsEnabled?"
+    return 1
+  fi
+
+  realm_mgmt_id=$(_keycloak_api_call GET \
+    "${KEYCLOAK_URL}/admin/realms/rhdh/clients?clientId=realm-management" \
+    "" "Get realm-management client" | jq -r '.[0].id // empty')
+
+  if [[ -z "$realm_mgmt_id" ]]; then
+    echo "Error: realm-management client not found."
+    return 1
+  fi
+
+  roles=$(_keycloak_api_call GET \
+    "${KEYCLOAK_URL}/admin/realms/rhdh/clients/${realm_mgmt_id}/roles" \
+    "" "Get roles" | \
+    jq -c '[.[] | select(.name == "view-authorization" or .name == "manage-authorization" or .name == "view-users")]')
+
+  if [[ -z "$roles" || "$roles" == "[]" ]]; then
+    echo "Error: Required service account roles not found."
+    return 1
+  fi
+
+  echo "Assigning service account roles..."
+  _keycloak_api_call POST \
+    "${KEYCLOAK_URL}/admin/realms/rhdh/users/${service_account_id}/role-mappings/clients/${realm_mgmt_id}" \
+    "$roles" "Assign service account roles" >/dev/null
+
+  # Export for use by deploy.sh and any downstream scripts.
+  export KEYCLOAK_CLIENT_SECRET="${kc_client_secret}"
+  export KEYCLOAK_CLIENT_ID="rhdh-client"
+  export KEYCLOAK_REALM="rhdh"
+  export KEYCLOAK_LOGIN_REALM="rhdh"
+  export KEYCLOAK_METADATA_URL="${KEYCLOAK_URL}/realms/rhdh"
+  export KEYCLOAK_BASE_URL="${KEYCLOAK_URL}"
+
+  oc patch secret rhdh-secrets -n "${NAMESPACE}" \
+    --type=merge -p "{\"stringData\":{
+      \"KEYCLOAK_BASE_URL\":\"${KEYCLOAK_URL}\",
+      \"KEYCLOAK_METADATA_URL\":\"${KEYCLOAK_URL}/realms/rhdh\",
+      \"KEYCLOAK_CLIENT_ID\":\"rhdh-client\",
+      \"KEYCLOAK_CLIENT_SECRET\":\"${kc_client_secret}\",
+      \"KEYCLOAK_REALM\":\"rhdh\",
+      \"KEYCLOAK_LOGIN_REALM\":\"rhdh\"}}"
+
+  export IS_AUTH_ENABLED=true
+
+  _append_plugin_dynamic_config "${PWD}/resources/keycloak/dynamic-plugins.yaml" "Keycloak"
+
+  echo "Keycloak plugin secrets and overlay configured!"
+}
+
+# =============================================================================
+# Step 4: Create groups and users in the rhdh realm
+# =============================================================================
+create_users_and_groups_keycloak() {
+  echo "Creating Keycloak groups and users..."
+
+  # Generate a single random password for all test users at runtime.
+  # Alphanumeric-only avoids shell-quoting and JSON-escaping issues.
+  export USER_PASSWORD
+  USER_PASSWORD=$(LC_ALL=C tr -dc 'A-Za-z0-9' </dev/urandom | head -c 16)
+
+  # Re-fetch the admin token here — the token obtained in
+  # config_secrets_for_keycloak_plugins may have expired by the time this
+  # function runs (default Keycloak token lifetime is 60s, and with hundreds
+  # of users the loop takes longer than that).
+  local kc_admin_password
+  kc_admin_password=$(oc get secret keycloak-credentials \
+    --namespace="${NAMESPACE}" \
+    -o jsonpath='{.data.admin-password}' | base64 -d)
+
+  local token_response
+  token_response=$(curl -sk -w "\n%{http_code}" -X POST \
+    "${KEYCLOAK_URL}/realms/master/protocol/openid-connect/token" \
+    -d "username=admin&password=${kc_admin_password}&grant_type=password&client_id=admin-cli")
+
+  local token_http_code token_body
+  token_http_code=$(echo "$token_response" | tail -1)
+  token_body=$(echo "$token_response" | sed '$d')
+
+  if [[ "$token_http_code" -ge 400 ]]; then
+    echo "Error: Failed to refresh admin token (HTTP ${token_http_code}): ${token_body}"
+    return 1
+  fi
+
+  ADMIN_TOKEN=$(echo "$token_body" | jq -r '.access_token // empty')
+  if [[ -z "${ADMIN_TOKEN}" ]]; then
+    echo "Error: Failed to parse refreshed admin token."
+    return 1
+  fi
+  echo "Admin token refreshed."
+
+  if [[ -f "${_KEYCLOAK_GROUPS_FILE}" ]]; then
+    jq empty "${_KEYCLOAK_GROUPS_FILE}" 2>/dev/null || {
+      echo "Warning: Invalid JSON in ${_KEYCLOAK_GROUPS_FILE} — skipping groups."
+    }
+    echo "Creating groups..."
+    jq -r '.[].name' "${_KEYCLOAK_GROUPS_FILE}" | while read -r group; do
+      _keycloak_api_call POST "${KEYCLOAK_URL}/admin/realms/rhdh/groups" \
+        "{\"name\":\"${group}\"}" \
+        "Create group '${group}'" >/dev/null \
+        && echo "  Created group: ${group}" \
+        || echo "  Warning: Failed to create group: ${group}"
+    done
+  fi
+
+  if [[ -f "${_KEYCLOAK_USERS_FILE}" ]]; then
+    jq empty "${_KEYCLOAK_USERS_FILE}" 2>/dev/null || {
+      echo "Warning: Invalid JSON in ${_KEYCLOAK_USERS_FILE} — skipping users."
+      return 0
+    }
+    echo "Creating users..."
+    jq -c '.[]' "${_KEYCLOAK_USERS_FILE}" | while read -r user_json; do
+      local username user_payload groups user_id
+      username=$(echo "$user_json" | jq -r '.username')
+      groups=$(echo "$user_json" | jq -r '.groups // [] | join(",")')
+      # Inject the runtime-generated password; credentials are not stored in users.json.
+      user_payload=$(echo "$user_json" | jq -c --arg pw "${USER_PASSWORD}" \
+        'del(.groups) | .credentials = [{"type":"password","value":$pw,"temporary":false}]')
+
+      if ! _keycloak_api_call POST "${KEYCLOAK_URL}/admin/realms/rhdh/users" \
+          "$user_payload" "Create user '${username}'" >/dev/null; then
+        echo "  Warning: Failed to create user: ${username}"
+        continue
+      fi
+      echo "  Created user: ${username}"
+
+      if [[ -n "$groups" ]]; then
+        user_id=$(_keycloak_api_call GET \
+          "${KEYCLOAK_URL}/admin/realms/rhdh/users?username=${username}" \
+          "" "Get user ID" | jq -r '.[0].id // empty')
+
+        [[ -z "$user_id" ]] && echo "    Warning: Could not find user ID for ${username}" && continue
+
+        for group in $(echo "$groups" | tr ',' ' '); do
+          local group_id
+          group_id=$(_keycloak_api_call GET \
+            "${KEYCLOAK_URL}/admin/realms/rhdh/groups?search=${group}" \
+            "" "Get group ID" | jq -r '.[0].id // empty')
+
+          [[ -z "$group_id" ]] && echo "    Warning: Group '${group}' not found" && continue
+
+          _keycloak_api_call PUT \
+            "${KEYCLOAK_URL}/admin/realms/rhdh/users/${user_id}/groups/${group_id}" \
+            "" "Add ${username} to group ${group}" >/dev/null \
+            && echo "    Added to group: ${group}" \
+            || echo "    Warning: Failed to add ${username} to group: ${group}"
+        done
+      fi
+    done
+  fi
+
+  echo "Users and groups created!"
+
+  # Store test credentials in a cluster Secret so they can be retrieved after
+  # deployment via: oc get secret keycloak-test-credentials -n <namespace>
+  # All users share the same runtime-generated password; usernames come directly
+  # from users.json so there is nothing hardcoded here.
+  local usernames
+  usernames=$(jq -r '.[].username' "${_KEYCLOAK_USERS_FILE}" | paste -sd ',' -)
+
+  oc create secret generic keycloak-test-credentials \
+    --from-literal=KEYCLOAK_URL="${KEYCLOAK_BASE_URL}" \
+    --from-literal=KEYCLOAK_USERNAMES="${usernames}" \
+    --from-literal=KEYCLOAK_USER_PASSWORD="${USER_PASSWORD}" \
+    --namespace="${NAMESPACE}" \
+    --dry-run=client -o yaml | oc apply -f -
+
+  echo ""
+  echo "  Keycloak test users:  ${usernames}"
+  echo "  Shared password:      (stored in secret keycloak-test-credentials)"
+  echo "  Admin credentials:    see secret keycloak-credentials (key: admin-password) in namespace ${NAMESPACE}"
+  echo ""
+}
+
+# =============================================================================
+# Step 5: Apply backstage.io/kubernetes-id labels
+# =============================================================================
+apply_keycloak_labels() {
+  echo "Applying Kubernetes labels for Keycloak resources..."
+
+  declare -A patterns=(
+    ["keycloak"]="backstage.io/kubernetes-id=keycloak"
+  )
+
+  local resource_types=("pods" "deployments" "replicasets" "services" "routes" "statefulsets")
+
+  for resource in "${resource_types[@]}"; do
+    for pattern in "${!patterns[@]}"; do
+      local label="${patterns[$pattern]}"
+      oc get "$resource" -n "${NAMESPACE}" --no-headers \
+        -o custom-columns=":metadata.name" 2>/dev/null \
+        | grep "$pattern" \
+        | xargs -I {} oc label "$resource" {} "$label" --overwrite \
+            -n "${NAMESPACE}" 2>/dev/null || true
+    done
+  done
+
+  echo "Keycloak labels applied!"
+}
+
+# =============================================================================
+# Teardown
+# =============================================================================
+uninstall_keycloak() {
+  echo "Uninstalling Keycloak..."
+
+  helm uninstall "${_KEYCLOAK_RELEASE_NAME}" --namespace "${NAMESPACE}" 2>/dev/null || true
+  oc delete route "${_KEYCLOAK_RELEASE_NAME}" --namespace "${NAMESPACE}" 2>/dev/null || true
+  oc delete secret keycloak-credentials --namespace "${NAMESPACE}" 2>/dev/null || true
+  oc delete secret keycloak-test-credentials --namespace "${NAMESPACE}" 2>/dev/null || true
+  # StatefulSet PVCs are not deleted by Helm uninstall — remove explicitly so
+  # a subsequent deploy does not conflict with the leftover volume.
+  oc delete pvc "data-${_KEYCLOAK_RELEASE_NAME}-postgresql-0" \
+    --namespace "${NAMESPACE}" 2>/dev/null || true
+
+  echo "Keycloak uninstalled!"
+}
+
+# =============================================================================
+# Main (standalone execution)
+# =============================================================================
+main() {
+  if [[ ! -f "${PWD}/.env" ]]; then
+    echo "Error: .env file not found. Copy .env.example to .env and fill in your values."
+    exit 1
+  fi
+  source "${PWD}/.env"
+
+  echo "=============================================="
+  echo "Configuring Keycloak Plugin"
+  echo "=============================================="
+
+  deploy_keycloak
+  config_secrets_for_keycloak_plugins
+  create_users_and_groups_keycloak
+  apply_keycloak_labels
+
+  echo ""
+  echo "=============================================="
+  echo "URL:        ${KEYCLOAK_URL}"
+  echo "Admin:      admin"
+  echo "Realm:      rhdh"
+  echo "User pass:  (stored in secret keycloak-test-credentials)"
+  echo "Keycloak configuration complete!"
+  echo "=============================================="
+
+  exit "${OVERALL_RESULT:-0}"
+}
+
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+  main
+fi
diff --git a/scripts/plugins/config-lighthouse-plugin.sh b/scripts/plugins/config-lighthouse-plugin.sh
new file mode 100644
index 0000000..af8927a
--- /dev/null
+++ b/scripts/plugins/config-lighthouse-plugin.sh
@@ -0,0 +1,203 @@
+#!/bin/bash
+
+# =============================================================================
+# Lighthouse Plugin Configuration
+# =============================================================================
+# This script deploys and configures resources required for the Lighthouse
+# plugin. It deploys a self-hosted lighthouse-audit-service instance backed
+# by an in-cluster PostgreSQL database, runs an initial scan against the RHDH
+# instance, and registers demo catalog entities.
+#
+# Functions are structured for efficient round-robin execution:
+#   1. deploy_lighthouse                     — Deploy the audit service + Postgres (quick)
+#   2. config_secrets_for_lighthouse_plugins — Wait for readiness, then inject URL
+#                                              into rhdh-secrets and plugin overlay ConfigMap
+#   3. apply_lighthouse_labels               — Label resources for the K8s plugin
+#   4. run_lighthouse_initial_scan           — Submit initial scan using RHDH_BASE_URL
+#
+# Readiness polling is embedded at the top of config_secrets_for_lighthouse_plugins
+# rather than as a standalone step. This keeps the round-robin loop doing useful
+# work on other plugins instead of burning a full turn on a pure wait.
+#
+# RHDH_BASE_URL is exported by deploy.sh before any plugin scripts run.
+# =============================================================================
+
+# =============================================================================
+# Step 1: Deploy the Lighthouse audit service (quick action)
+# =============================================================================
+deploy_lighthouse() {
+  echo "Deploying Lighthouse audit service..."
+
+  # Generate Lighthouse DB credentials only on first run.
+  if oc get secret lighthouse-credentials --namespace="${NAMESPACE}" &>/dev/null; then
+    echo "lighthouse-credentials already exists — skipping generation."
+  else
+    echo "Generating lighthouse-credentials Secret..."
+    local lh_db_password
+    lh_db_password=$(LC_ALL=C tr -dc 'A-Za-z0-9' </dev/urandom | head -c 24)
+
+    oc create secret generic lighthouse-credentials \
+      --from-literal=password="${lh_db_password}" \
+      --namespace="${NAMESPACE}"
+  fi
+
+  oc apply -f "$PWD/resources/lighthouse/lighthouse-deployment.yaml" \
+    --namespace="${NAMESPACE}"
+  echo "Lighthouse deployment applied!"
+}
+
+# =============================================================================
+# Step 1b: Run initial scan against the RHDH instance.
+# =============================================================================
+run_lighthouse_initial_scan() {
+  if [[ "${POPULATE_DEMO_DATA:-true}" == "false" ]]; then
+    echo "Demo data disabled — skipping initial Lighthouse scan."
+    return 0
+  fi
+
+  local RHDH_URL="${RHDH_BASE_URL:-}"
+  if [[ -z "${RHDH_URL}" ]]; then
+    echo "Warning: RHDH_BASE_URL not set — skipping initial scan."
+    return 0
+  fi
+
+  echo "Running initial Lighthouse scan against: ${RHDH_URL}"
+
+  # Delete any leftover scan job from a previous run so oc apply succeeds.
+  oc delete job lighthouse-initial-scan \
+    --namespace="${NAMESPACE}" 2>/dev/null || true
+
+  LIGHTHOUSE_SVC="http://lighthouse.${NAMESPACE}.svc.cluster.local:3003"
+  sed \
+    -e "s|<RHDH_URL>|${RHDH_URL}|g" \
+    -e "s|<LIGHTHOUSE_SVC>|${LIGHTHOUSE_SVC}|g" \
+    "$PWD/resources/lighthouse/lighthouse-scan-job.yaml" \
+    | oc apply -f - --namespace="${NAMESPACE}"
+
+  echo "Lighthouse scan job submitted — it will complete in the background once RHDH is up."
+}
+
+# =============================================================================
+# Step 2: Configure the plugin overlay (inject the in-cluster service URL)
+#         (waits for Lighthouse readiness internally before proceeding)
+# =============================================================================
+config_secrets_for_lighthouse_plugins() {
+  echo "Configuring Lighthouse plugin overlay..."
+
+  # ---- Wait for Lighthouse deployment ----
+  echo "Waiting for Lighthouse audit service to become ready..."
+  SECONDS=0
+  while true; do
+    local ready
+    ready=$(oc get deployment lighthouse \
+      --namespace="${NAMESPACE}" \
+      -o jsonpath='{.status.readyReplicas}' 2>/dev/null)
+    [[ "${ready}" == "1" ]] && echo "Lighthouse audit service is ready!" && break
+    if [[ $SECONDS -ge ${TIMEOUT:-300} ]]; then
+      echo "Warning: Timeout waiting for Lighthouse to become ready — continuing anyway."
+      break
+    fi
+    echo "  Lighthouse not ready yet (readyReplicas=${ready:-0}). Retrying in ${INTERVAL:-15}s..."
+    sleep "${INTERVAL:-15}"
+  done
+
+  local lighthouse_route_host
+  lighthouse_route_host=$(oc get route lighthouse \
+    --namespace="${NAMESPACE}" \
+    -o jsonpath='{.spec.host}' 2>/dev/null)
+
+  # Route through the RHDH backend proxy so plain browser fetch() calls never
+  # hit the Lighthouse service directly (avoids browser TLS cert trust issues).
+  # The proxy target uses the in-cluster HTTP service — no TLS needed there.
+  # LIGHTHOUSE_SVC_URL is also used by the initial scan job.
+  export LIGHTHOUSE_SVC_URL="http://lighthouse.${NAMESPACE}.svc.cluster.local:3003"
+  export LIGHTHOUSE_URL="${RHDH_BASE_URL}/api/proxy/lighthouse"
+
+  if [[ -z "${lighthouse_route_host}" ]]; then
+    echo "Warning: Could not resolve Lighthouse route host."
+  fi
+  echo "Note: LIGHTHOUSE_URL set to RHDH proxy path; LIGHTHOUSE_SVC_URL set to in-cluster service."
+
+  oc patch secret rhdh-secrets -n "${NAMESPACE}" \
+    --type=merge -p "{\"stringData\":{\"LIGHTHOUSE_URL\":\"${LIGHTHOUSE_URL}\",\"LIGHTHOUSE_SVC_URL\":\"${LIGHTHOUSE_SVC_URL}\"}}"
+
+  _append_plugin_dynamic_config "${PWD}/resources/lighthouse/dynamic-plugins.yaml" "Lighthouse"
+
+  echo "Lighthouse plugin overlay applied!"
+}
+
+# =============================================================================
+# Step 3: Apply backstage.io/kubernetes-id labels
+# =============================================================================
+apply_lighthouse_labels() {
+  echo "Applying Kubernetes labels for Lighthouse resources..."
+
+  declare -A patterns=(
+    ["lighthouse"]="backstage.io/kubernetes-id=lighthouse-instance"
+  )
+
+  resource_types=("pods" "deployments" "replicasets" "services" "routes" "statefulsets")
+
+  for resource in "${resource_types[@]}"; do
+    for pattern in "${!patterns[@]}"; do
+      label="${patterns[$pattern]}"
+      oc get "$resource" -n "${NAMESPACE}" --no-headers \
+        -o custom-columns=":metadata.name" 2>/dev/null \
+        | grep "$pattern" \
+        | xargs -I {} oc label "$resource" {} "$label" --overwrite \
+            -n "${NAMESPACE}" 2>/dev/null || true
+    done
+  done
+
+  echo "Labels applied successfully!"
+}
+
+# =============================================================================
+# Teardown
+# =============================================================================
+uninstall_lighthouse() {
+  echo "Uninstalling Lighthouse resources..."
+
+  # Catalog entity ConfigMaps are owned by setup-resources.sh and cleaned up
+  # by teardown_resources. Only Lighthouse-specific infrastructure is removed
+  # here.
+  oc delete job lighthouse-initial-scan \
+    --namespace="${NAMESPACE}" 2>/dev/null || true
+  oc delete -f "$PWD/resources/lighthouse/lighthouse-deployment.yaml" \
+    --namespace="${NAMESPACE}" 2>/dev/null || true
+  oc delete secret lighthouse-credentials \
+    --namespace="${NAMESPACE}" 2>/dev/null || true
+
+  echo "Lighthouse uninstalled!"
+}
+
+# =============================================================================
+# Main (standalone execution)
+# =============================================================================
+main() {
+  if [[ ! -f "${PWD}/.env" ]]; then
+    echo "Error: .env file not found. Copy .env.example to .env and fill in your values."
+    exit 1
+  fi
+  source "${PWD}/.env"
+
+  echo "=============================================="
+  echo "Configuring Lighthouse Plugin"
+  echo "=============================================="
+
+  deploy_lighthouse
+  config_secrets_for_lighthouse_plugins
+  apply_lighthouse_labels
+  run_lighthouse_initial_scan
+
+  echo ""
+  echo "=============================================="
+  echo "Lighthouse configuration complete!"
+  echo "=============================================="
+
+  exit "${OVERALL_RESULT:-0}"
+}
+
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+  main
+fi
diff --git a/scripts/setup-resources.sh b/scripts/setup-resources.sh
new file mode 100755
index 0000000..c388153
--- /dev/null
+++ b/scripts/setup-resources.sh
@@ -0,0 +1,284 @@
+#!/bin/bash
+
+# =============================================================================
+# setup-resources.sh — Cluster resource provisioning for RHDH test instances
+#
+# Applies resources that are always present regardless of which plugins are
+# enabled. Running this before plugin configuration ensures:
+#   - The catalog is populated from the start (not empty on first login)
+#   - Image streams are pre-imported to avoid Docker Hub rate limits
+#   - RBAC policies and demo resources are in place before RHDH starts
+#
+# Catalog entities are registered unconditionally. Even when a backing
+# plugin/service is not deployed, having its entities present keeps the
+# catalog usable for browsing, RBAC testing, and demo purposes. Plugin
+# scripts are responsible for their own infrastructure (deployments, secrets,
+# scans) but should not own catalog metadata — that lives here.
+#
+# Usage (from deploy.sh):  source scripts/setup-resources.sh; setup_resources
+# Usage (standalone):      NAMESPACE=rhdh ./scripts/setup-resources.sh
+# =============================================================================
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+ROOT_DIR="$(dirname "$DIR")"
+
+# =============================================================================
+# RHDH Secrets
+#
+# Create (or idempotently update) the rhdh-secrets Secret with the base URL
+# that is known at deploy time. Plugin scripts patch in their own keys later
+# (e.g. KEYCLOAK_* from config-keycloak-plugin.sh, LIGHTHOUSE_URL from
+# config-lighthouse-plugin.sh) using `oc patch secret rhdh-secrets`.
+#
+# All keys from the full secret schema are initialised here so that the
+# Secret always has a consistent shape. Empty values are replaced by plugin
+# scripts as they configure their respective services.
+# =============================================================================
+create_rhdh_secrets() {
+  echo ""
+  echo "Creating rhdh-secrets Secret..."
+
+  : "${RHDH_BASE_URL:?RHDH_BASE_URL must be set before setup-resources.sh runs}"
+
+  if oc get secret rhdh-secrets --namespace="${NAMESPACE}" &>/dev/null; then
+    # Secret already exists — only update RHDH_BASE_URL so the URL stays
+    # current without rotating SESSION_SECRET or clearing plugin-owned keys.
+    oc patch secret rhdh-secrets -n "${NAMESPACE}" --type=merge \
+      -p "{\"stringData\":{\"RHDH_BASE_URL\":\"${RHDH_BASE_URL}\"}}"
+    echo "rhdh-secrets already exists — updated RHDH_BASE_URL only."
+  else
+    # Generate a random session secret at deploy time so it is never hardcoded.
+    local session_secret
+    session_secret=$(LC_ALL=C tr -dc 'A-Za-z0-9' </dev/urandom | head -c 32)
+
+    oc create secret generic rhdh-secrets \
+      --from-literal=RHDH_BASE_URL="${RHDH_BASE_URL}" \
+      --from-literal=SESSION_SECRET="${session_secret}" \
+      --from-literal=KEYCLOAK_BASE_URL="${KEYCLOAK_BASE_URL:-}" \
+      --from-literal=KEYCLOAK_METADATA_URL="${KEYCLOAK_METADATA_URL:-}" \
+      --from-literal=KEYCLOAK_LOGIN_REALM="${KEYCLOAK_LOGIN_REALM:-}" \
+      --from-literal=KEYCLOAK_REALM="${KEYCLOAK_REALM:-}" \
+      --from-literal=KEYCLOAK_CLIENT_ID="${KEYCLOAK_CLIENT_ID:-}" \
+      --from-literal=KEYCLOAK_CLIENT_SECRET="${KEYCLOAK_CLIENT_SECRET:-}" \
+      --from-literal=LIGHTHOUSE_URL="${LIGHTHOUSE_URL:-}" \
+      --from-literal=LIGHTHOUSE_SVC_URL="${LIGHTHOUSE_SVC_URL:-}" \
+      --namespace="${NAMESPACE}"
+
+    echo "rhdh-secrets created!"
+  fi
+}
+
+# =============================================================================
+# Catalog Entities
+#
+# Apply all catalog entity ConfigMaps unconditionally so the catalog is
+# populated regardless of which plugins are enabled. All files in
+# resources/catalog-entities/ are pre-wrapped ConfigMaps and applied directly.
+#
+# Entities are organised by Backstage kind, not by plugin:
+#   components.yaml — Component entities (services, websites, etc.)
+#   operators.yaml  — operator/infrastructure Resource entities
+#   resources.yaml  — general Resource entities (storage, etc.)
+#   plugins.yaml    — Location entities pointing at upstream plugin catalog-info
+#
+# Adding entities for a new plugin means adding them to the appropriate file
+# for their Backstage kind rather than creating a new per-plugin ConfigMap.
+# =============================================================================
+apply_catalog_entities() {
+  echo ""
+  echo "Applying catalog entity ConfigMaps..."
+
+  local catalog_dir="${ROOT_DIR}/resources/catalog-entities"
+
+  for yaml_file in "${catalog_dir}"/*.yaml; do
+    echo "  Applying: $(basename "$yaml_file")"
+    envsubst '${RHDH_BASE_URL}' < "${yaml_file}" | oc apply -f - --namespace="${NAMESPACE}"
+  done
+
+  echo "Catalog entities applied!"
+}
+
+# =============================================================================
+# RHDH ConfigMaps
+#
+# Create (or idempotently update) the app-config-rhdh and dynamic-plugins
+# ConfigMaps from their source files in config/. These must exist before
+# plugin scripts run since _append_plugin_dynamic_config reads dynamic-plugins.
+# =============================================================================
+apply_rhdh_configmaps() {
+  echo ""
+  echo "Applying RHDH ConfigMaps..."
+
+  oc create configmap app-config-rhdh \
+    --from-file="${ROOT_DIR}/config/app-config-rhdh.yaml" \
+    --namespace="${NAMESPACE}" \
+    --dry-run=client -o yaml | oc apply -f - --namespace="${NAMESPACE}"
+
+  oc create configmap app-config-guest-auth \
+    --from-file="${ROOT_DIR}/config/app-config-guest-auth.yaml" \
+    --namespace="${NAMESPACE}" \
+    --dry-run=client -o yaml | oc apply -f - --namespace="${NAMESPACE}"
+
+  oc create configmap dynamic-plugins \
+    --from-file="${ROOT_DIR}/config/dynamic-plugins.yaml" \
+    --namespace="${NAMESPACE}" \
+    --dry-run=client -o yaml | oc apply -f - --namespace="${NAMESPACE}"
+
+  echo "RHDH ConfigMaps applied!"
+}
+
+# =============================================================================
+# RBAC Policies
+#
+# Apply the RBAC policy ConfigMap that ships with the repo. This is always
+# applied so that test users and roles are available from the first login,
+# independent of which plugins are enabled.
+# =============================================================================
+apply_rbac_policies() {
+  echo ""
+  echo "Applying RBAC policies..."
+
+  oc apply -f "${ROOT_DIR}/config/rbac-policies.yaml" \
+    --namespace="${NAMESPACE}"
+
+  echo "RBAC policies applied!"
+}
+
+# =============================================================================
+# Image Stream Imports
+#
+# Pre-import container images from external registries to avoid rate-limit
+# failures during plugin deployment. Applied before plugin scripts run so the
+# images are cached in the cluster registry by the time they are needed.
+# =============================================================================
+apply_image_stream_imports() {
+  echo ""
+  echo "Applying image stream imports..."
+
+  local image_stream_dir="${ROOT_DIR}/resources/image-stream-imports"
+
+  if [[ ! -d "$image_stream_dir" ]] || [[ -z "$(ls -A "$image_stream_dir" 2>/dev/null)" ]]; then
+    echo "  No image stream imports found — skipping."
+    return 0
+  fi
+
+  for yaml_file in "${image_stream_dir}"/*.yaml; do
+    local name
+    name=$(basename "$yaml_file")
+    echo "  Applying: ${name}"
+    oc apply -f "${yaml_file}" --namespace="${NAMESPACE}" || \
+      echo "  Warning: Failed to apply ${name} — continuing."
+  done
+
+  echo "Image stream imports applied!"
+}
+
+# =============================================================================
+# Demo Resources
+#
+# Deploy lightweight example workloads that populate the Topology and
+# Kubernetes plugin views. These are applied with graceful error handling
+# since they are non-critical and some may depend on images that are still
+# being imported (e.g. internal-alpine).
+# =============================================================================
+apply_demo_resources() {
+  echo ""
+  echo "Applying demo resources..."
+
+  local examples_dir="${ROOT_DIR}/resources/rhdh-script-examples"
+
+  if [[ ! -d "$examples_dir" ]] || [[ -z "$(ls -A "$examples_dir" 2>/dev/null)" ]]; then
+    echo "  No demo resources found — skipping."
+    return 0
+  fi
+
+  for yaml_file in "${examples_dir}"/*.yaml; do
+    local name
+    name=$(basename "$yaml_file")
+    echo "  Applying: ${name}"
+    oc apply -f "${yaml_file}" --namespace="${NAMESPACE}" || \
+      echo "  Warning: Failed to apply ${name} — continuing."
+  done
+
+  echo "Demo resources applied!"
+}
+
+# =============================================================================
+# Teardown
+#
+# Removes all resources created by setup_resources. Called during cleanup.
+# =============================================================================
+teardown_resources() {
+  echo ""
+  echo "=============================================="
+  echo "Resource Teardown"
+  echo "=============================================="
+
+  local catalog_dir="${ROOT_DIR}/resources/catalog-entities"
+
+  echo "Removing rhdh-secrets Secret..."
+  oc delete secret rhdh-secrets --namespace="${NAMESPACE}" 2>/dev/null || true
+
+  echo "Removing RHDH ConfigMaps..."
+  oc delete configmap app-config-rhdh app-config-guest-auth dynamic-plugins \
+    --namespace="${NAMESPACE}" 2>/dev/null || true
+
+  echo "Removing catalog entity ConfigMaps..."
+  for yaml_file in "${catalog_dir}"/*.yaml; do
+    oc delete -f "${yaml_file}" --namespace="${NAMESPACE}" 2>/dev/null || true
+  done
+
+  echo "Removing RBAC policy ConfigMap..."
+  oc delete -f "${ROOT_DIR}/config/rbac-policies.yaml" \
+    --namespace="${NAMESPACE}" 2>/dev/null || true
+
+
+  echo "Removing demo resources..."
+  local examples_dir="${ROOT_DIR}/resources/rhdh-script-examples"
+  if [[ -d "$examples_dir" ]]; then
+    for yaml_file in "${examples_dir}"/*.yaml; do
+      oc delete -f "${yaml_file}" --namespace="${NAMESPACE}" 2>/dev/null || true
+    done
+  fi
+
+  echo ""
+  echo "=============================================="
+  echo "Resource teardown complete."
+  echo "=============================================="
+}
+
+# =============================================================================
+# Main Entry Point
+# =============================================================================
+setup_resources() {
+  echo ""
+  echo "=============================================="
+  echo "Resource Setup"
+  echo "=============================================="
+
+  create_rhdh_secrets
+  apply_rhdh_configmaps
+  apply_catalog_entities
+  apply_rbac_policies
+  apply_image_stream_imports
+  apply_demo_resources
+
+  echo ""
+  echo "=============================================="
+  echo "Resource setup complete."
+  echo "=============================================="
+}
+
+main() {
+  : "${NAMESPACE:?NAMESPACE must be set. Export it or pass it: NAMESPACE=rhdh ./scripts/setup-resources.sh}"
+
+  if [[ "${TEARDOWN:-false}" == "true" ]]; then
+    teardown_resources
+  else
+    setup_resources
+  fi
+}
+
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+  main
+fi
diff --git a/teardown.sh b/teardown.sh
new file mode 100755
index 0000000..0cae5bb
--- /dev/null
+++ b/teardown.sh
@@ -0,0 +1,127 @@
+#!/bin/bash
+set -e
+
+# =============================================================================
+# teardown.sh — Remove an RHDH test instance and associated cluster resources
+#
+# Tears down the RHDH deployment, shared cluster resources (catalog ConfigMaps,
+# RBAC, image streams, demo workloads, rhdh-secrets), and optionally plugin
+# infrastructure (Keycloak, Lighthouse).
+#
+# Usage:
+#   ./teardown.sh <install-method> [--namespace <ns>] [--plugins <list>]
+#
+# Install methods: helm, operator
+# Options:
+#   --namespace <ns>     Namespace to clean up (default: rhdh)
+#   --plugins <list>     Comma-separated plugins to also teardown (e.g. keycloak,lighthouse)
+#
+# Examples:
+#   ./teardown.sh helm
+#   ./teardown.sh helm --namespace rhdh-helm --plugins keycloak,lighthouse
+#   ./teardown.sh operator --plugins keycloak
+# =============================================================================
+
+# Default values
+namespace="rhdh"
+installation_method=""
+PLUGINS=""
+CLEAN=false
+
+if [[ $# -lt 1 ]]; then
+    echo "Usage: $0 <install-method> [--namespace <ns>] [--plugins <list>] [--clean]"
+    echo "Install methods: helm, operator"
+    echo "Options:"
+    echo "  --namespace <ns>     Namespace to clean up (default: rhdh)"
+    echo "  --plugins <list>     Comma-separated plugin infra to teardown (e.g. keycloak,lighthouse)"
+    echo "  --clean              Delete the entire namespace after teardown (full wipe)"
+    echo "Examples:"
+    echo "  $0 helm"
+    echo "  $0 helm --namespace rhdh-helm --plugins keycloak,lighthouse"
+    echo "  $0 operator --plugins keycloak"
+    echo "  $0 helm --clean"
+    exit 1
+fi
+
+installation_method="$1"
+shift
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --namespace)
+            namespace="$2"
+            shift 2
+            ;;
+        --plugins)
+            PLUGINS="$2"
+            shift 2
+            ;;
+        --clean)
+            CLEAN=true
+            shift
+            ;;
+        *)
+            echo "Error: Unknown option: $1"
+            exit 1
+            ;;
+    esac
+done
+
+if [[ "$installation_method" != "helm" && "$installation_method" != "operator" ]]; then
+    echo "Error: Install method must be 'helm' or 'operator'"
+    exit 1
+fi
+
+[[ "${OPENSHIFT_CI}" != "true" ]] && source .env
+
+export NAMESPACE="$namespace"
+
+echo ""
+echo "=============================================="
+echo "Tearing down RHDH (${installation_method}) in namespace: ${namespace}"
+echo "=============================================="
+
+# ---------------------------------------------------------------------------
+# Step 1: Tear down plugin infrastructure (Keycloak, Lighthouse, etc.)
+#         Do this first while the namespace still exists.
+# ---------------------------------------------------------------------------
+if [[ -n "${PLUGINS}" ]]; then
+    echo ""
+    echo "Tearing down plugin infrastructure: ${PLUGINS}"
+    source scripts/config-plugins.sh
+    TEARDOWN=true main "${PLUGINS}"
+fi
+
+# ---------------------------------------------------------------------------
+# Step 2: Remove the RHDH deployment itself.
+# ---------------------------------------------------------------------------
+echo ""
+echo "Removing RHDH deployment..."
+if [[ "$installation_method" == "helm" ]]; then
+    helm uninstall redhat-developer-hub -n "$namespace" || true
+    # StatefulSet PVCs are not deleted by Helm uninstall — remove explicitly so
+    # a subsequent deploy does not conflict with the leftover volume.
+    oc delete pvc data-redhat-developer-hub-postgresql-0 \
+        -n "$namespace" --ignore-not-found
+else
+    oc delete backstage developer-hub -n "$namespace" --ignore-not-found
+fi
+
+# ---------------------------------------------------------------------------
+# Step 3: Tear down shared cluster resources (catalog ConfigMaps, RBAC,
+#         image streams, demo resources, rhdh-secrets Secret).
+# ---------------------------------------------------------------------------
+source scripts/setup-resources.sh
+teardown_resources
+
+echo ""
+echo "=============================================="
+echo "Teardown complete."
+echo "=============================================="
+
+if [[ "${CLEAN}" == "true" ]]; then
+    echo ""
+    echo "--clean specified: deleting namespace ${namespace}..."
+    oc delete project "$namespace" --ignore-not-found
+    echo "Namespace ${namespace} deleted."
+fi
diff --git a/utils/keycloak/groups.json b/utils/keycloak/groups.json
deleted file mode 100644
index 9d8bd91..0000000
--- a/utils/keycloak/groups.json
+++ /dev/null
@@ -1,5 +0,0 @@
-[
-  {"name": "developers"},
-  {"name": "admins"},
-  {"name": "viewers"}
-]
diff --git a/utils/keycloak/keycloak-deploy.sh b/utils/keycloak/keycloak-deploy.sh
deleted file mode 100755
index 7a047e3..0000000
--- a/utils/keycloak/keycloak-deploy.sh
+++ /dev/null
@@ -1,213 +0,0 @@
-#!/bin/bash
-set -e
-
-# Check for required dependencies
-command -v jq >/dev/null 2>&1 || { echo "Error: jq is required but not installed"; exit 1; }
-command -v oc >/dev/null 2>&1 || { echo "Error: oc (OpenShift CLI) is required but not installed"; exit 1; }
-
-NAMESPACE=${1:-rhdh-keycloak}
-USERS_FILE=${2:-utils/keycloak/users.json}
-GROUPS_FILE=${3:-utils/keycloak/groups.json}
-CLIENT_FILE="utils/keycloak/rhdh-client.json"
-KEYCLOAK_RELEASE_NAME="keycloak"
-
-# Helper function for API calls with error checking
-api_call() {
-  local method=$1
-  local url=$2
-  local data=$3
-  local description=$4
-
-  if [ -n "$data" ]; then
-    RESPONSE=$(curl -sk -w "\n%{http_code}" -X "$method" "$url" \
-      -H "Authorization: Bearer $ADMIN_TOKEN" \
-      -H "Content-Type: application/json" \
-      -d "$data")
-  else
-    RESPONSE=$(curl -sk -w "\n%{http_code}" -X "$method" "$url" \
-      -H "Authorization: Bearer $ADMIN_TOKEN" \
-      -H "Content-Type: application/json")
-  fi
-
-  HTTP_CODE=$(echo "$RESPONSE" | tail -1)
-  BODY=$(echo "$RESPONSE" | sed '$d')
-
-  if [ "$method" = "GET" ] || [ "$HTTP_CODE" -lt 400 ]; then
-    echo "$BODY"
-    return 0
-  fi
-
-  # 409 Conflict is acceptable for create operations (already exists)
-  if [ "$HTTP_CODE" = "409" ]; then
-    echo "Warning: $description - already exists (continuing)" >&2
-    echo "$BODY"
-    return 0
-  fi
-
-  echo "Error: $description failed (HTTP $HTTP_CODE): $BODY" >&2
-  return 1
-}
-
-# Validate JSON files exist and are valid
-[ ! -f "$CLIENT_FILE" ] && echo "Error: Client configuration file not found: $CLIENT_FILE" && exit 1
-jq empty "$CLIENT_FILE" 2>/dev/null || { echo "Error: Invalid JSON in $CLIENT_FILE"; exit 1; }
-[ -f "$USERS_FILE" ] && { jq empty "$USERS_FILE" 2>/dev/null || { echo "Error: Invalid JSON in $USERS_FILE"; exit 1; }; }
-[ -f "$GROUPS_FILE" ] && { jq empty "$GROUPS_FILE" 2>/dev/null || { echo "Error: Invalid JSON in $GROUPS_FILE"; exit 1; }; }
-
-# Create namespace and deploy Keycloak
-echo "Creating namespace $NAMESPACE..."
-oc create namespace $NAMESPACE --dry-run=client -o yaml | oc apply -f -
-
-echo "Adding Bitnami Helm repository..."
-helm repo add bitnami https://charts.bitnami.com/bitnami
-helm repo update
-
-echo "Deploying Keycloak..."
-helm upgrade --install $KEYCLOAK_RELEASE_NAME bitnami/keycloak \
-  --namespace $NAMESPACE \
-  --values utils/keycloak/keycloak-values.yaml
-
-echo "Waiting for Keycloak rollout..."
-oc rollout status statefulset/keycloak -n $NAMESPACE --timeout=5m
-
-# Use plain HTTP route for Keycloak to avoid self-signed certificate issues
-# when RHDH (Node.js) connects to Keycloak's OIDC endpoints
-KEYCLOAK_PROTOCOL="http"
-
-# Create OpenShift Route (plain HTTP, no TLS)
-echo "Creating OpenShift Route (protocol: $KEYCLOAK_PROTOCOL)..."
-cat <<EOF | kubectl apply -f -
-apiVersion: route.openshift.io/v1
-kind: Route
-metadata:
-  name: $KEYCLOAK_RELEASE_NAME
-  namespace: $NAMESPACE
-  labels:
-    app.kubernetes.io/name: keycloak
-    app.kubernetes.io/instance: $KEYCLOAK_RELEASE_NAME
-spec:
-  to:
-    kind: Service
-    name: $KEYCLOAK_RELEASE_NAME
-    weight: 100
-  port:
-    targetPort: http
-  wildcardPolicy: None
-EOF
-
-KEYCLOAK_URL="${KEYCLOAK_PROTOCOL}://$(oc get route keycloak -n $NAMESPACE -o jsonpath='{.spec.host}')"
-[ -z "$KEYCLOAK_URL" ] || [ "$KEYCLOAK_URL" = "${KEYCLOAK_PROTOCOL}://" ] && echo "Error: Failed to get Keycloak route" && exit 1
-echo "Keycloak URL: $KEYCLOAK_URL"
-
-# Wait for Keycloak API to be ready (check for HTTP 200, not just connection)
-echo "Waiting for Keycloak API..."
-TIMEOUT=300
-ELAPSED=0
-while true; do
-  HTTP_STATUS=$(curl -sk -o /dev/null -w "%{http_code}" "$KEYCLOAK_URL/realms/master" 2>/dev/null || echo "000")
-  if [ "$HTTP_STATUS" = "200" ]; then
-    break
-  fi
-  sleep 5
-  ELAPSED=$((ELAPSED + 5))
-  if [ $ELAPSED -ge $TIMEOUT ]; then
-    echo "Error: Keycloak API not ready after 5 minutes (last status: $HTTP_STATUS)"
-    exit 1
-  fi
-  echo "  Waiting... (status: $HTTP_STATUS)"
-done
-
-# Get admin token
-TOKEN_RESPONSE=$(curl -sk -w "\n%{http_code}" -X POST "$KEYCLOAK_URL/realms/master/protocol/openid-connect/token" \
-  -d "username=admin&password=admin123&grant_type=password&client_id=admin-cli")
-TOKEN_HTTP_CODE=$(echo "$TOKEN_RESPONSE" | tail -1)
-TOKEN_BODY=$(echo "$TOKEN_RESPONSE" | sed '$d')
-[ "$TOKEN_HTTP_CODE" -ge 400 ] && echo "Error: Failed to get admin token (HTTP $TOKEN_HTTP_CODE): $TOKEN_BODY" && exit 1
-ADMIN_TOKEN=$(echo "$TOKEN_BODY" | jq -r '.access_token // empty')
-[ -z "$ADMIN_TOKEN" ] && echo "Error: Failed to parse admin token" && exit 1
-
-# Create realm and client
-echo "Creating realm 'rhdh'..."
-api_call POST "$KEYCLOAK_URL/admin/realms" \
-  '{"realm":"rhdh","enabled":true,"displayName":"RHDH Realm"}' \
-  "Create realm" >/dev/null
-
-echo "Creating client..."
-api_call POST "$KEYCLOAK_URL/admin/realms/rhdh/clients" \
-  "$(jq -c '.' "$CLIENT_FILE")" \
-  "Create client" >/dev/null
-
-# Get IDs for role assignment
-SERVICE_ACCOUNT_ID=$(api_call GET "$KEYCLOAK_URL/admin/realms/rhdh/users?username=service-account-rhdh-client" "" "Get service account" | \
-  jq -r '.[0].id // empty')
-[ -z "$SERVICE_ACCOUNT_ID" ] && echo "Error: Service account not found" && exit 1
-
-REALM_MGMT_ID=$(api_call GET "$KEYCLOAK_URL/admin/realms/rhdh/clients?clientId=realm-management" "" "Get realm-management client" | \
-  jq -r '.[0].id // empty')
-[ -z "$REALM_MGMT_ID" ] && echo "Error: realm-management client not found" && exit 1
-
-ROLES=$(api_call GET "$KEYCLOAK_URL/admin/realms/rhdh/clients/$REALM_MGMT_ID/roles" "" "Get roles" | \
-  jq -c '[.[] | select(.name == "view-authorization" or .name == "manage-authorization" or .name == "view-users")]')
-[ -z "$ROLES" ] || [ "$ROLES" = "[]" ] && echo "Error: Required roles not found" && exit 1
-
-echo "Assigning service account roles..."
-api_call POST "$KEYCLOAK_URL/admin/realms/rhdh/users/$SERVICE_ACCOUNT_ID/role-mappings/clients/$REALM_MGMT_ID" \
-  "$ROLES" \
-  "Assign roles" >/dev/null
-
-# Create groups
-if [ -f "$GROUPS_FILE" ]; then
-  echo "Creating groups..."
-  jq -r '.[].name' "$GROUPS_FILE" | while read -r group; do
-    api_call POST "$KEYCLOAK_URL/admin/realms/rhdh/groups" \
-      "{\"name\":\"$group\"}" \
-      "Create group '$group'" >/dev/null && echo "  Created group: $group" || echo "  Warning: Failed to create group: $group"
-  done
-fi
-
-# Create users
-if [ -f "$USERS_FILE" ]; then
-  echo "Creating users..."
-
-  jq -c '.[]' "$USERS_FILE" | while read -r user_json; do
-    username=$(echo "$user_json" | jq -r '.username')
-    groups=$(echo "$user_json" | jq -r '.groups // [] | join(",")')
-    user_payload=$(echo "$user_json" | jq -c 'del(.groups)')
-
-    if ! api_call POST "$KEYCLOAK_URL/admin/realms/rhdh/users" "$user_payload" "Create user '$username'" >/dev/null; then
-      echo "  Warning: Failed to create user: $username"
-      continue
-    fi
-    echo "  Created user: $username"
-
-    # Add user to groups
-    if [ -n "$groups" ]; then
-      USER_ID=$(api_call GET "$KEYCLOAK_URL/admin/realms/rhdh/users?username=$username" "" "Get user ID" | \
-        jq -r '.[0].id // empty')
-      [ -z "$USER_ID" ] && echo "    Warning: Could not get user ID, skipping groups" && continue
-
-      for group in $(echo "$groups" | tr ',' ' '); do
-        GROUP_ID=$(api_call GET "$KEYCLOAK_URL/admin/realms/rhdh/groups?search=$group" "" "Get group ID" | \
-          jq -r '.[0].id // empty')
-        [ -z "$GROUP_ID" ] && echo "    Warning: Group '$group' not found" && continue
-        api_call PUT "$KEYCLOAK_URL/admin/realms/rhdh/users/$USER_ID/groups/$GROUP_ID" "" "Add to group" >/dev/null \
-          && echo "    Added to group: $group" || echo "    Warning: Failed to add to group: $group"
-      done
-    fi
-  done
-fi
-
-echo ""
-echo "========================================="
-echo "Keycloak deployment complete"
-echo "========================================="
-echo "URL: $KEYCLOAK_URL"
-echo "Admin: admin/admin123"
-echo "Realm: rhdh"
-
-export KEYCLOAK_CLIENT_SECRET="rhdh-client-secret"
-export KEYCLOAK_CLIENT_ID="rhdh-client"
-export KEYCLOAK_REALM="rhdh"
-export KEYCLOAK_LOGIN_REALM="rhdh"
-export KEYCLOAK_METADATA_URL="$KEYCLOAK_URL/realms/rhdh"
-export KEYCLOAK_BASE_URL="$KEYCLOAK_URL"
diff --git a/utils/keycloak/users.json b/utils/keycloak/users.json
deleted file mode 100644
index 9e0e34a..0000000
--- a/utils/keycloak/users.json
+++ /dev/null
@@ -1,22 +0,0 @@
-[
-  {
-    "username": "test1",
-    "enabled": true,
-    "email": "test1@example.com",
-    "firstName": "Test",
-    "lastName": "User1",
-    "emailVerified": true,
-    "credentials": [{"type": "password", "value": "test1@123", "temporary": false}],
-    "groups": ["developers"]
-  },
-  {
-    "username": "test2",
-    "enabled": true,
-    "email": "test2@example.com",
-    "firstName": "Test",
-    "lastName": "User2",
-    "emailVerified": true,
-    "credentials": [{"type": "password", "value": "test2@123", "temporary": false}],
-    "groups": ["developers"]
-  }
-]