dbildungs-iam-server

dBildungsplattform · Nov 25, 2024 · f8c707d · f8c707d
1 parent d93811b
commit f8c707d
Show file tree

Hide file tree

Showing 9 changed files with 37 additions and 30 deletions.
diff --git a/automation/dbildungs-iam-server/Chart.lock b/automation/dbildungs-iam-server/Chart.lock
@@ -3,4 +3,4 @@ dependencies:
   repository: https://charts.bitnami.com/bitnami
   version: 20.3.0
 digest: sha256:a42635c8459b26a7c01fd2cfeeba7cbb250bef345be41c70b8bfcd0025379057
-generated: "2024-11-25T16:53:00.497156046Z"
+generated: "2024-11-25T17:25:53.146157103Z"
diff --git a/automation/dbildungs-iam-server/Chart.yaml b/automation/dbildungs-iam-server/Chart.yaml
@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: SPSH-1195
+appVersion: DBP-0000
 dependencies:
 - condition: redis.enabled
   name: redis
@@ -8,4 +8,4 @@ dependencies:
 description: dBildungs-IAM-server
 name: dbildungs-iam-server
 type: application
-version: 0.0.0-spsh-1195-20241125-1652
+version: 0.0.0-dbp-0000-20241125-1725
diff --git a/automation/dbildungs-iam-server/config/secrets.json b/automation/dbildungs-iam-server/config/secrets.json
@@ -5,4 +5,4 @@
     "REDIS": {
         "PASSWORD": "password"
     }
-}
+}
diff --git a/automation/dbildungs-iam-server/templates/_dbildungs-iam-server-envs.tpl b/automation/dbildungs-iam-server/templates/_dbildungs-iam-server-envs.tpl
@@ -86,6 +86,21 @@
               secretKeyRef:
                   name: {{ default .Values.auth.existingSecret .Values.auth.secretName }}
                   key: pi-user-realm
+          - name: SYSTEM_RENAME_WAITING_TIME_IN_SECONDS
+            valueFrom:
+              secretKeyRef:
+                  name: {{ default .Values.auth.existingSecret .Values.auth.secretName }}
+                  key: system-rename-waiting-time-in-seconds
+          - name: SYSTEM_STEP_UP_TIMEOUT_IN_SECONDS
+            valueFrom:
+              secretKeyRef:
+                  name: {{ default .Values.auth.existingSecret .Values.auth.secretName }}
+                  key: system-step-up-timeout-in-seconds
+          - name: SYSTEM_STEP_UP_TIMEOUT_ENABLED
+            valueFrom:
+              secretKeyRef:
+                  name: {{ default .Values.auth.existingSecret .Values.auth.secretName }}
+                  key: system-step-up-timeout-enabled
           - name: REDIS_PASSWORD
             valueFrom:
               secretKeyRef:

diff --git a/automation/dbildungs-iam-server/templates/backend-servicemonitor.yaml b/automation/dbildungs-iam-server/templates/backend-servicemonitor.yaml
@@ -1,8 +1,8 @@
-{{ if .Values.backend.serviceMonitor.enabled }}
+{{if .Values.backend.serviceMonitor.enabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: {{ template "common.names.name" . }}
+  name: {{ template "common.names.name" . }}-backend
   namespace: {{ template "common.names.namespace" . }}
   labels:
     {{- include "common.labels" . | nindent 4 }}
@@ -13,11 +13,9 @@ spec:
       - {{ include "common.names.namespace" . | quote }}
   selector:
     matchLabels:
-      app.kubernetes.io/name: {{ template "common.names.name" . }}
+      app.kubernetes.io/name: {{ template "common.names.name" . }}-backend
       app.kubernetes.io/component: server-backend
   endpoints:
     - port: {{ (index .Values.backend.serviceMonitor.endpoints 0).port }}
-      path: {{ .Values.backend.serviceMonitor.path }}
-      interval: {{ .Values.backend.serviceMonitor.interval }}
 {{ end }}
 
diff --git a/automation/dbildungs-iam-server/templates/configmap.yaml b/automation/dbildungs-iam-server/templates/configmap.yaml
@@ -21,6 +21,3 @@ data:
   LDAP_OEFFENTLICHE_SCHULEN_DOMAIN: "{{ .Values.ldap.oeffentlicheSchulenDomain }}"
   LDAP_ERSATZSCHULEN_DOMAIN: "{{ .Values.ldap.ersatzschulenDomain }}"
   STATUS_REDIRECT_URL: "{{ .Values.status.url }}"
-  SYSTEM_RENAME_WAITING_TIME_IN_SECONDS: "{{ .Values.backend.env.renameWaitingTimeInSeconds }}"
-  SYSTEM_STEP_UP_TIMEOUT_ENABLED: "{{ .Values.backend.env.stepUpTimeoutEnabled }}"
-  SYSTEM_STEP_UP_TIMEOUT_IN_SECONDS: "{{ .Values.backend.env.stepUpTimeoutInSeconds }}"
diff --git a/automation/dbildungs-iam-server/templates/cronjob.yaml b/automation/dbildungs-iam-server/templates/cronjob.yaml
@@ -22,10 +22,9 @@ spec:
             image: "{{ $.Values.cronjobs.image.repository }}:{{ $.Values.cronjobs.image.tag }}"
             imagePullPolicy: {{ $.Values.cronjobs.image.pullPolicy | default "Always"}}
             securityContext:
-              # not yet possible since we need to install some tools
-              # privileged: false
-              # runAsUser: 1000
-              # runAsNonRoot: true
+              privileged: false
+              runAsUser: 1000
+              runAsNonRoot: true
               capabilities:
                 drop:
                   - ALL
@@ -52,11 +51,8 @@ spec:
               - "sh"
               - "-c"
               - |
-                  mkdir /scripts &&
-                  cp /scripts_tmp/*.sh /scripts/ &&
-                  chmod +x /scripts/*.sh &&
-                  touch /var/log/cron.log &&
-                  chmod 644 /var/log/cron.log &&
+                  touch /tmp/log/cron.log &&
+                  chmod 644 /tmp/log/cron.log &&
                   cd {{ $.Values.cronjobs.scriptDir }} &&
                   bash {{ $job_options.script }}
             volumeMounts:
@@ -65,7 +61,8 @@ spec:
                 subPath: jwks.json
                 readOnly: true
               - name: script-volume
-                mountPath: /scripts_tmp
+                mountPath: /scripts
+                defaultMode: 0555
                 readOnly: false
             ports:
             - containerPort: {{ $.Values.cronjobs.port }}

diff --git a/automation/dbildungs-iam-server/templates/secret.yaml b/automation/dbildungs-iam-server/templates/secret.yaml
@@ -22,6 +22,9 @@ data:
   pi-admin-password: {{ .Values.auth.pi_admin_password }}
   pi-user-resolver: {{ .Values.auth.pi_user_resolver }}
   pi-user-realm: {{ .Values.auth.pi_user_realm }}
+  system-rename-waiting-time-in-seconds: {{ .Values.auth.system_rename_waiting_time_in_seconds }}
+  system-step-up-timeout-in-seconds: {{ .Values.auth.system_step_up_timeout_in_seconds }}
+  system-step-up-enabled: {{ .Values.auth.system_step_up_enabled }}
   secrets-json: {{ .Values.auth.secrets_json }}
   redis-password: {{ .Values.auth.redis_password }}
 {{- end }}
diff --git a/automation/dbildungs-iam-server/values.yaml b/automation/dbildungs-iam-server/values.yaml
@@ -50,6 +50,9 @@ auth:
   pi_admin_password: ''
   pi_user_resolver: ''
   pi_user_realm: ''
+  system_rename_waiting_time_in_seconds: ''
+  system_step_up_timeout_in_seconds: ''
+  system_step_up_timeout_enabled: ''
   redis_password: ''
 
 backend:
@@ -111,8 +114,6 @@ backend:
       http: 80
   serviceMonitor:
     enabled: true
-    path: "/metrics"
-    interval: 30s
     endpoints:
       - port: 'web'
   extraEnvVars: []
@@ -126,10 +127,6 @@ backend:
       subPath: secrets-json
       name: secret-volume
   extraVolumeMounts: []
-  env:
-    renameWaitingTimeInSeconds: 3
-    stepUpTimeoutInSeconds: 900
-    stepUpTimeoutEnabled: 'false'
 
 redis:
   enabled: true
@@ -175,8 +172,8 @@ status:
 cronjobs:
   enabled: true
   image:
-    tag: DBP-1083-latest
-    repository: ghcr.io/hpi-schul-cloud/cron-tools
+    tag: '1.1.0'
+    repository: docker.io/schulcloud/cron-tools
     pullPolicy: IfNotPresent
   port: 5656
   keycloakTokenUrl: '/realms/SPSH/protocol/openid-connect/token'