hyrax 3.0.1 → 3.3.0

data/chart/hyrax/templates/deployment.yaml

@@ -21,6 +21,9 @@ spec:
         {{- include "hyrax.selectorLabels" . | nindent 8 }}
     spec:
       initContainers:
+        {{- if .Values.solrPreSetupInitContainer }}
+        {{- toYaml .Values.solrPreSetupInitContainer | nindent 8 }}
+        {{- end }}
         {{- if .Values.loadSolrConfigSet }}
         - name: load-solr-config
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
@@ -30,6 +33,12 @@ spec:
                 name: {{ include "hyrax.fullname" . }}-env
             - secretRef:
                 name: {{ include "hyrax.fullname" . }}
+            {{- if .Values.solrExistingSecret }}
+            - secretRef:
+                name: {{ .Values.solrExistingSecret }}
+            {{- end }}
+          env:
+            {{- toYaml .Values.extraEnvVars | nindent 12 }}
           command:
             - sh
             - -c
@@ -37,6 +46,10 @@ spec:
               solrcloud-upload-configset.sh /app/samvera/hyrax-webapp/solr/conf &&
               solrcloud-assign-configset.sh
         {{- end }}
+        {{- if .Values.dbPreSetupInitContainer }}
+        {{- toYaml .Values.dbPreSetupInitContainer | nindent 8 }}
+        {{- end }}
+        {{- if not .Values.skipDbMigrateSeed }}
         - name: db-setup
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
@@ -45,10 +58,23 @@ spec:
                 name: {{ include "hyrax.fullname" . }}-env
             - secretRef:
                 name: {{ template "hyrax.fullname" . }}
+            {{- if .Values.solrExistingSecret }}
+            - secretRef:
+                name: {{ .Values.solrExistingSecret }}
+            {{- end }}
+            {{- with .Values.extraEnvFrom }}
+              {{- toYaml . | nindent 12 }}
+            {{- end }}
+          env:
+            {{- toYaml .Values.extraEnvVars | nindent 12 }}
           command:
             - sh
             - -c
             - db-migrate-seed.sh
+        {{- end }}
+        {{- if .Values.extraInitContainers }}
+        {{- toYaml .Values.extraInitContainers | nindent 8 }}
+        {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
@@ -67,6 +93,15 @@ spec:
                 name: {{ include "hyrax.fullname" . }}-env
             - secretRef:
                 name: {{ template "hyrax.fullname" . }}
+            {{- if .Values.solrExistingSecret }}
+            - secretRef:
+                name: {{ .Values.solrExistingSecret }}
+            {{- end }}
+            {{- with .Values.extraEnvFrom }}
+              {{- toYaml . | nindent 12 }}
+            {{- end }}
+          env:
+            {{- toYaml .Values.extraEnvVars | nindent 12 }}
           ports:
             - name: http
               containerPort: 3000
@@ -106,8 +141,18 @@ spec:
             - name: uploads
               subPath: uploads
               mountPath: /app/samvera/uploads
+            {{- if .Values.applicationExistingClaim }}
+            - name: application
+              mountPath: /app/samvera/hyrax-webapp
+            {{- end }}
+            {{- with .Values.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
+          {{- with .Values.extraContainerConfiguration }}
+          {{- toYaml . | nindent 10 }}
+          {{- end }}
       volumes:
         - name: "branding"
           {{- if and .Values.brandingVolume.enabled .Values.brandingVolume.existingClaim }}
@@ -139,6 +184,14 @@ spec:
           {{ else }}
           emptyDir: {}
           {{ end }}
+        {{- if .Values.applicationExistingClaim }}
+        - name: "application"
+          persistentVolumeClaim:
+            claimName: {{ .Values.applicationExistingClaim }}
+        {{- end }}
+        {{- with .Values.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

data/chart/hyrax/templates/derivatives-pvc.yaml

@@ -6,9 +6,9 @@ metadata:
   labels:
     {{- include "hyrax.labels" . | nindent 4 }}
 spec:
-  accessModes:
-    - ReadWriteMany
+  {{ include "hyrax.sharedPvcAccessModes" . | nindent 2 }}
   resources:
     requests:
       storage: {{ .Values.derivativesVolume.size }}
+  storageClassName: {{ .Values.derivativesVolume.storageClass }}
 {{- end }}

data/chart/hyrax/templates/ingress.yaml

@@ -1,10 +1,11 @@
 {{- if .Values.ingress.enabled -}}
 {{- $fullName := include "hyrax.fullname" . -}}
 {{- $svcPort := .Values.service.port -}}
-{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
+{{- $beta := semverCompare "<1.19-0" (default .Capabilities.KubeVersion.Version .Values.kubeVersion) -}}
+{{- if $beta }}
 apiVersion: networking.k8s.io/v1beta1
-{{- else -}}
-apiVersion: extensions/v1beta1
+{{- else }}
+apiVersion: networking.k8s.io/v1
 {{- end }}
 kind: Ingress
 metadata:
@@ -32,10 +33,18 @@ spec:
       http:
         paths:
           {{- range .paths }}
-          - path: {{ . }}
+          - path: {{ .path  }}
+            pathType: {{ .pathType | default "ImplementationSpecific" }}
             backend:
+              {{- if $beta }}
               serviceName: {{ $fullName }}
               servicePort: {{ $svcPort }}
+              {{- else }}
+              service:
+                name: {{ $fullName }}
+                port:
+                  number: {{ $svcPort }}
+              {{- end }}
           {{- end }}
     {{- end }}
   {{- end }}

data/chart/hyrax/templates/secrets.yaml

@@ -7,7 +7,15 @@ metadata:
 type: Opaque
 data:
   SECRET_KEY_BASE: {{ randAlphaNum 20 | b64enc | quote }}
+  DB_PASSWORD: {{ include "hyrax.postgresql.password" . | b64enc }}
   DATABASE_URL: {{ printf "postgresql://%s:%s@%s/%s?pool=5" ( include "hyrax.postgresql.username" . ) ( include "hyrax.postgresql.password" . ) ( include "hyrax.postgresql.host" . ) ( include "hyrax.postgresql.database" . ) | b64enc }}
+  {{- if .Values.minio.enabled }}
+  MINIO_ACCESS_KEY: {{ .Values.minio.accessKey.password | b64enc}}
+  MINIO_SECRET_KEY: {{ .Values.minio.secretKey.password | b64enc}}
+  {{- end }}
+  {{- if not .Values.solrExistingSecret }}
+  SOLR_ADMIN_PASSWORD: {{ include "hyrax.solr.password" . | b64enc }}
+  {{- end }}
   {{- if .Values.redis.enabled }}
   REDIS_PASSWORD: {{ .Values.redis.password | b64enc}}
   SIDEKIQ_REDIS_URL: {{ include "hyrax.redis.url" . | b64enc }}

data/chart/hyrax/templates/uploads-pvc.yaml

@@ -6,9 +6,9 @@ metadata:
   labels:
     {{- include "hyrax.labels" . | nindent 4 }}
 spec:
-  accessModes:
-    - ReadWriteMany
+  {{ include "hyrax.sharedPvcAccessModes" . | nindent 2 }}
   resources:
     requests:
       storage: {{ .Values.uploadsVolume.size }}
+  storageClassName: {{ .Values.uploadsVolume.storageClass }}
 {{- end }}

data/chart/hyrax/values.yaml

@@ -10,33 +10,99 @@ image:
   # Overrides the image tag whose default is the chart appVersion.
   tag: ""
 
+# use true to skip loading Hyrax engine database seed file
+skipHyraxEngineSeed: false
+# use true to skip running the `db-setup` initContainer
+# this may be desirable for downstream chart users to customize their database setup
+skipDbMigrateSeed: false
+
 # use false to skip the configset management init container
 loadSolrConfigSet: true
 # the host and auth details for an external solr service;
 #   ignored if `solr.enabled` is true
+solrExistingSecret: ""
 externalSolrHost: ""
 externalSolrUser: ""
 externalSolrPassword: ""
 externalSolrCollection: "hyrax"
 
+# additional environment variables, evaluated as a template. e.g.
+#
+#  extraEnvVars:
+#    - name: RAILS_SERVE_STATIC_FILES
+#      value: "1"
+#    - name: GOOGLE_OAUTH_APP_NAME
+#      value: "my_hyrax_app"
+extraEnvVars: []
+
+## Extra init containers
+## Example
+##
+## extraInitContainers:
+##   - name: do-something
+##     image: busybox
+##     command: ['echo', 'Hello, Hyrax.']
+##
+extraInitContainers: []
+
+# Extra envFrom (secrets/configmaps)
+# Example
+#
+# extraEnvFrom:
+#   - configMapRef:
+#       name: existingConfigMap
+#   - secretRef:
+#       name: existingSecret
+#
+extraEnvFrom: []
+
+# Extra container spec configuration
+# Example: (enabling pry debugging for local development)
+# Note: with this enabled, one can `kubectl attach` to a running container with a binding.pry breakpoint
+#
+#extraContainerConfiguration:
+# stdin: true
+# tty: true
+extraContainerConfiguration: []
+
+# an existing volume containing a Hyrax-based application
+# must be a ReadWriteMany volume if worker is enabled
+applicationExistingClaim: ""
+
 brandingVolume:
   enabled: true
+  # the name of an existing volume claim; must be an ReadWriteMany volume
   existingClaim: ""
   size: 2Gi
   storageClass: ""
 
 derivativesVolume:
   enabled: true
+  # the name of an existing volume claim; must be an ReadWriteMany volume
   existingClaim: ""
   size: 10Gi
   storageClass: ""
 
 uploadsVolume:
   enabled: true
+  # the name of an existing volume claim; must be an ReadWriteMany volume
   existingClaim: ""
   size: 20Gi
   storageClass: ""
 
+# additional volumes and volume mounts, evaluated as a template, e.g.
+#
+#  extraVolumeMounts
+#    - name: local-app
+#      mountPath: /app/samvera/hyrax-webapp
+#  extraVolumes:
+#    - name: local-app
+#      hostPath:
+#        path: /src
+#        type: DirectoryOrCreate
+extraVolumeMounts: []
+extraVolumes: []
+
 # configuration for an external/existing fcrepo service;
 #   ignored if `fcrepo.enabled` is true
 externalFcrepoHost: ""
@@ -93,7 +159,9 @@ ingress:
     # kubernetes.io/tls-acme: "true"
   hosts:
     - host: hyrax.local
-      paths: []
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
   tls: []
 
 livenessProbe:
@@ -117,11 +185,15 @@ readinessProbe:
 resources: {}
 
 worker:
+  enabled: true
   replicaCount: 3
   image:
     repository: samveralabs/dassie-worker
     pullPolicy: IfNotPresent
     tag: ""
+  extraInitContainers: []
+  extraVolumeMounts: []
+  extraVolumes: []
   imagePullSecrets: []
   podSecurityContext: {}
   nodeSelector: {}
@@ -142,6 +214,16 @@ fcrepo:
 memcached:
   enabled: false
 
+minio:
+  enabled: false
+  accessKey:
+    password: hyrax-access-key
+  secretKey:
+    password: hyrax-secret-key
+  persistence:
+    enabled: false
+  # defaultBuckets: bucketOne;bucketTwo
+
 postgresql:
   enabled: true
   image:
@@ -164,7 +246,7 @@ solr:
   enabled: true
   image:
     repository: bitnami/solr
-    tag: 8.8.1
+    tag: 8.11.1
   authentication:
     enabled: true
     adminUsername: admin

data/config/brakeman.ignore

@@ -68,7 +68,7 @@
       "file": "app/controllers/hyrax/users_controller.rb",
       "line": 38,
       "link": "http://brakemanscanner.org/docs/warning_types/sql_injection/",
-      "code": "::User.where(*base_query).where(\"#{Hydra.config.user_key_field} like lower(?) OR display_name like lower(?)\", (nil or ((\"%\" + query.downcase) + \"%\")), (nil or ((\"%\" + query.downcase) + \"%\"))).registered.where(\"#{Hydra.config.user_key_field} not in (?)\", [::User.batch_user_key, ::User.audit_user_key])",
+      "code": "::User.where(*base_query).where(\"#{Hydra.config.user_key_field} like lower(?) OR display_name like lower(?)\", (nil or ((\"%\" + query.downcase) + \"%\")), (nil or ((\"%\" + query.downcase) + \"%\"))).registered.where(\"#{Hydra.config.user_key_field} not in (?)\", [::User.system_user_key, ::User.batch_user_key, ::User.audit_user_key])",
       "render_path": null,
       "location": {
         "type": "method",
@@ -88,7 +88,7 @@
       "file": "app/models/concerns/hyrax/user.rb",
       "line": 27,
       "link": "http://brakemanscanner.org/docs/warning_types/sql_injection/",
-      "code": "where(\"#{Hydra.config.user_key_field} not in (?)\", [::User.batch_user_key, ::User.audit_user_key])",
+      "code": "where(\"#{Hydra.config.user_key_field} not in (?)\", [::User.system_user_key, ::User.batch_user_key, ::User.audit_user_key])",
       "render_path": null,
       "location": {
         "type": "method",

data/config/features.rb

@@ -44,6 +44,9 @@ Flipflop.configure do
     feature :cache_work_iiif_manifest,
             default: false,
             description: "Use Rails.cache to cache the JSON document for IIIF manifests"
+    feature :read_only,
+            default: false,
+            description: "Put the system into read-only mode. Deposits, edits, approvals and anything that makes a change to the data will be disabled."
   rescue Flipflop::StrategyError, Flipflop::FeatureError => err
     Rails.logger.warn "Ignoring #{err}: #{err.message}"
   end

data/config/i18n-tasks.yml

@@ -85,9 +85,9 @@ search:
   ## See this example of a custom scanner: https://github.com/glebm/i18n-tasks/wiki/A-custom-scanner-example
 
 ## Google Translate
-# translation:
+#  translation:
 #   # Get an API key and set billing info at https://code.google.com/apis/console to use Google Translate
-#   api_key: "AbC-dEf5"
+ #   api_key: "AbC-dEf5"
 
 ## Do not consider these keys missing:
 # ignore_missing:

data/config/initializers/1_healthz.rb

@@ -15,6 +15,7 @@ begin
   require 'hyrax/health_checks'
 
   OkComputer::Registry.register 'solr', Hyrax::HealthChecks::SolrCheck.new
+  OkComputer::Registry.register 'migrations', OkComputer::ActiveRecordMigrationsCheck.new
 
   # check cache
   if ENV['MEMCACHED_HOST']

data/config/initializers/listeners.rb

@@ -1,13 +1,14 @@
 # frozen_string_literal: true
 
 Hyrax.publisher.subscribe(Hyrax::Listeners::AclIndexListener.new)
-Hyrax.publisher.subscribe(Hyrax::Listeners::ActiveFedoraAclIndexListener.new)
-Hyrax.publisher.subscribe(Hyrax::Listeners::MemberCleanupListener.new)
-Hyrax.publisher.subscribe(Hyrax::Listeners::MetadataIndexListener.new)
+Hyrax.publisher.subscribe(Hyrax::Listeners::ActiveFedoraAclIndexListener.new) unless Hyrax.config.disable_wings
 Hyrax.publisher.subscribe(Hyrax::Listeners::BatchNotificationListener.new)
-Hyrax.publisher.subscribe(Hyrax::Listeners::ObjectLifecycleListener.new)
+Hyrax.publisher.subscribe(Hyrax::Listeners::FileMetadataListener.new)
 Hyrax.publisher.subscribe(Hyrax::Listeners::FileSetLifecycleListener.new)
 Hyrax.publisher.subscribe(Hyrax::Listeners::FileSetLifecycleNotificationListener.new)
+Hyrax.publisher.subscribe(Hyrax::Listeners::MemberCleanupListener.new)
+Hyrax.publisher.subscribe(Hyrax::Listeners::MetadataIndexListener.new)
+Hyrax.publisher.subscribe(Hyrax::Listeners::ObjectLifecycleListener.new)
 Hyrax.publisher.subscribe(Hyrax::Listeners::ProxyDepositListener.new)
 Hyrax.publisher.subscribe(Hyrax::Listeners::TrophyCleanupListener.new)
 Hyrax.publisher.subscribe(Hyrax::Listeners::WorkflowListener.new)

data/config/initializers/valkryrie_storage.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+Valkyrie::StorageAdapter.register(
+  Valkyrie::Storage::Disk.new(base_path: Hyrax.config.branding_path,
+                              path_generator: Hyrax::ValkyrieSimplePathGenerator),
+  :branding_disk
+)