@sap/cds-dk 4.9.5 → 6.0.1

package/lib/k8s/connectivity/index.js

@@ -0,0 +1,74 @@
+const wrapFeature = require('../wrapFeature');
+
+module.exports = wrapFeature('connectivity', {
+    async extendChartDeployment(context, name, deployment, mergeSemantics) {
+        const model = await context.get('model');
+        const prefix = model.app.name;
+
+        deployment.additionalVolumes = deployment.additionalVolumes || [];
+        deployment.additionalVolumes.push(
+            {
+                name: "connectivity-secret",
+                volumeMount: {
+                    mountPath: "/bindings/connectivity",
+                    readOnly: true
+                },
+                projected: {
+                    sources: [
+                        {
+                            secret: {
+                                name: `${prefix}-connectivity-binding`,
+                                optional: false
+                            }
+                        },
+                        {
+                            secret: {
+                                name: `${prefix}-connectivity-binding`,
+                                optional: false,
+                                items: [
+                                    {
+                                        key: "token_service_url",
+                                        path: "url"
+                                    }
+                                ]
+                            }
+                        },
+                        {
+                            configMap: {
+                                name: `${prefix}-connectivity-proxy-info`,
+                                optional: false
+                            }
+                        }
+                    ]
+                }
+            }
+        );
+
+        mergeSemantics.existences.push({
+            ref: `{name}-additional-volumes`,
+            keyPath: [name, "additionalVolumes"],
+            constraints: [{
+                comparisonKeyPath: ["name"],
+                value: "connectivity-secret"
+            }]
+        });
+    },
+
+    async getChartCapabilities(context) {
+        const model = await context.get('model');
+        const prefix = model.app.name;
+
+        return {
+            connectivity: {
+                serviceOfferingName: 'connectivity',
+                servicePlanName: 'connectivity_proxy',
+                secretName: `${prefix}-connectivity-binding`,
+                configMapName: `${prefix}-connectivity-proxy-info`
+            }
+        }
+    },
+
+    async addToChart(builder) {
+        await builder.addAllTemplates(__dirname);
+    }
+});

package/lib/k8s/connectivity/templates/connectivity-binding.yaml

@@ -0,0 +1,9 @@
+{{- include "cap.sapcp.bindings" (merge
+        (dict "bindings"
+            (dict "binding"
+                (dict "serviceInstanceName" "connectivity")
+            )
+            "root" .
+            "name" "connectivity"
+        ) . )
+}}

package/lib/k8s/connectivity/templates/connectivity-proxy-info.yaml

@@ -0,0 +1,16 @@
+{{- $ := merge (dict "name" "connectivity-proxy-info") . }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-connectivity-proxy-info
+  namespace: {{ .Release.Namespace }}
+  labels: {{- include "cap.labels" $ | nindent 4 }}
+data:
+  .metadata: >-
+    {"credentialProperties":[{"name":"subaccount_id","format":"text"},{"name":"subaccount_subdomain","format":"text"},{"name":"token_service_domain","format":"text"},{"name":"token_service_url","format":"text"},{"name":"token_service_url_pattern","format":"text"},{"name":"token_service_url_pattern_tenant_key","format":"text"},{"name":"clientid","format":"text"},{"name":"credential-type","format":"text"},{"name":"xsappname","format":"text"},{"name":"clientsecret","format":"text"},{"name":"connectivity_service","format":"json"},{"name":"onpremise_proxy_host","format":"text"},{"name":"onpremise_proxy_http_port","format":"text"},{"name":"onpremise_proxy_host","format":"text"},{"name":"url","format":"text"}],"metaDataProperties":[{"name":"instance_name","format":"text"},{"name":"instance_guid","format":"text"},{"name":"plan","format":"text"},{"name":"label","format":"text"},{"name":"type","format":"text"},{"name":"tags","format":"json"}]}
+  onpremise_proxy_host: connectivity-proxy.kyma-system.svc.cluster.local
+  onpremise_proxy_http_port: "20003"
+  onpremise_proxy_ldap_port: "20001"
+  onpremise_proxy_port: "20003"
+  onpremise_proxy_rfc_port: "20001"
+  onpremise_socks5_proxy_port: "20004"

package/lib/k8s/connectivity/templates/connectivity.yaml

@@ -0,0 +1 @@
+{{- include "cap.service-instance" . }}

package/lib/k8s/deployment/index.js

@@ -0,0 +1,81 @@
+const fs = require('fs').promises;
+const Path = require('path');
+const { yaml } = require('../modules');
+
+class Deployment {
+    constructor({context, name, language}) {
+        this.context = context;
+        this.name = name;
+        this.language = language;
+    }
+
+    async getChartDeployments(context) {
+        const model = await context.get('model');
+
+        let bindings = {};
+        await context.forEach('getServiceBindings',
+            async plugin => bindings = {...bindings, ...await plugin.getServiceBindings(context)}
+        );
+
+        const language = this.language || model.language;
+        const memory = language === 'Java' ? '1G' : '500M';
+        const cpu = language === 'Java' ? '700m' : '100m';
+        const env = language === 'Java' ? {SPRING_PROFILES_ACTIVE: "cloud"} : undefined;
+
+        return {
+            [this.name]: {
+                bindings,
+                image: {
+                    repository: '<your-container-registry>/'+model.app.name+'-'+this.name,
+                    tag: 'latest'
+                },
+                env,
+                resources: {
+                    limits: {
+                        cpu,
+                        'ephemeral-storage': '1G',
+                        memory
+                    },
+                    requests: {
+                        cpu: '100m',
+                        'ephemeral-storage': '1G',
+                        memory
+                    }
+                },
+                health_check: {
+                    liveness: {
+                        path: '/'
+                    },
+                    readiness: {
+                        path: '/'
+                    }
+                }
+            }
+        }
+    }
+
+    async getChartDependencies() {
+        return [{
+            name: 'web-application',
+            alias: this.name,
+            version: await webApplicationChartVersion()
+        }]
+    }
+
+    async addToChart(builder) {
+        await builder.addSubchartFiles(webApplicationChartPath, 'web-application');
+        await builder.addChartFile(Path.join(__dirname, 'subchart-override', 'templates', '_web_application_helpers.tpl'), {fileName: Path.join('charts', 'web-application', 'templates', '_web_application_helpers.tpl')});
+    }
+}
+
+const webApplicationChartPath = process.env.WEB_APPLICATION_CHART || Path.join(__dirname, 'subchart');
+
+async function webApplicationChartVersion() {
+    const chartFilePath = Path.join(webApplicationChartPath, 'Chart.yaml');
+    const chartFile = await fs.readFile(chartFilePath, 'utf-8');
+    return yaml.parse(chartFile).version;
+}
+
+module.exports = function (context) {
+    return new Deployment({context, name: 'srv'});
+}

package/lib/k8s/deployment/subchart/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: web-application
+description: A Helm chart for web app
+
+type: application
+version: 0.1.0

package/lib/k8s/deployment/subchart/templates/_helpers.tpl

@@ -0,0 +1,156 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "web-application.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "web-application.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+*/}}
+{{- define "web-application.bindingName" -}}
+{{- printf "%s-%s" (include "web-application.fullname" .root ) .name }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "web-application.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "web-application.labels" -}}
+helm.sh/revision: {{ .Release.Revision | quote }}
+helm.sh/chart: {{ include "web-application.chart" . }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{ include "web-application.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "web-application.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "web-application.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- if .Values.global}}
+{{- if .Values.global.component }}
+app.kubernetes.io/component:{{ .Values.global.component }}
+{{- end }}
+{{- if .Values.global.partOf }}
+app.kubernetes.io/partOf: {{ .Values.global.partOf }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Define Host for the APIRule
+*/}}
+{{- define "web-application.exposeHost" -}}
+{{- if .Values.expose.host }}
+{{- .Values.expose.host }}
+{{- else }}
+{{- $name := (include "web-application.fullname" .) }}
+{{- if hasPrefix $name .Release.Namespace }}
+{{- .Release.Namespace }}
+{{- else }}
+{{- printf "%s-%s" $name .Release.Namespace | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Service Binding secret mounts
+*/}}
+{{- define "web-application.serviceMounts" -}}
+{{- range $name, $params := .Values.bindings }}
+- mountPath: /bindings/{{ $name }}/
+  name: "{{ $name }}-binding"
+  readOnly: true
+{{- end }}
+{{- end }}
+
+{{/*
+Service Binding secret volumes
+*/}}
+{{- define "web-application.serviceVolumes" -}}
+{{- range $name, $params := .Values.bindings }}
+{{- $secretName := (include "web-application.bindingName" (dict "root" $ "name" $name)) }}
+{{- if $params.fromSecret }}
+{{- $secretName = $params.fromSecret}}
+{{- else if $params.secretName }}
+{{- $secretName = $params.secretName }}
+{{- end }}
+- name: {{ $name }}-binding
+  secret:
+    secretName: {{ $secretName }}
+    items:
+    - key: label
+      path: metadata/label
+    - key: plan
+      path: metadata/plan
+    - key: tags
+      path: metadata/tags
+    - key: credentials
+      path: credentials
+{{- end }}
+{{- end }}
+
+{{/*
+Name of the imagePullSecret
+*/}}
+{{- define "web-application.imagePullSecretName" -}}
+{{ $ips := (dict "local" .Values.imagePullSecret "global" .Values.global.imagePullSecret) }}
+{{- if $ips.local.name }}
+{{- $ips.local.name }}
+{{- else if $ips.global.name }}
+{{- $ips.global.name }}
+{{- else if or $ips.local.dockerconfigjson $ips.global.dockerconfigjson }}
+{{- include "web-application.fullname" . }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create the name of a service instance.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as service insatnce name.
+*/}}
+{{- define "web-application.serviceInstanceName" -}}
+  {{- if .binding.serviceInstanceFullname }}
+    {{- if gt (len .binding.serviceInstanceFullname) 63 }}
+      {{- fail (printf "name exceeds 63 characters: '%s'" .binding.serviceInstanceFullname) }}
+    {{- end }}
+    {{- .binding.serviceInstanceFullname }}
+  {{- else }}
+    {{- $name := .binding.serviceInstanceName }}
+    {{- if not (hasPrefix .release $name)}}
+      {{- $name = printf "%s-%s" .release $name }}
+    {{- end }}
+    {{- if gt (len $name) 63 }}
+      {{- fail (printf "name exceeds 63 characters: '%s'" $name) }}
+    {{- end }}
+    {{- $name }}
+  {{- end }}
+{{- end }}

package/lib/k8s/deployment/subchart/templates/api-rule.yaml

@@ -0,0 +1,24 @@
+{{ if .Values.expose.enabled}}
+apiVersion: gateway.kyma-project.io/v1alpha1
+kind: APIRule
+metadata:
+  name: {{ include "web-application.fullname" . }}
+  labels: {{- include "web-application.labels" . | nindent 4 }}
+spec:
+  gateway: kyma-gateway.kyma-system.svc.cluster.local
+  rules:
+  - accessStrategies:
+    - handler: allow
+    methods:
+    - GET
+    - POST
+    - PUT
+    - PATCH
+    - DELETE
+    - HEAD
+    path: /.*
+  service:
+    host: {{ include "web-application.exposeHost" . }}
+    name: {{ include "web-application.fullname" . }}
+    port: {{ .Values.port }}
+{{ end }}

package/lib/k8s/deployment/subchart/templates/deployment.yaml

@@ -0,0 +1,110 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels: {{- include "web-application.labels" . | nindent 4 }}
+  name: {{ include "web-application.fullname" . }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels: {{- include "web-application.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels: {{- include "web-application.selectorLabels" . | nindent 8 }}
+    spec:
+      {{- if (include "web-application.imagePullSecretName" .) }}
+      imagePullSecrets:
+        - name: {{ include "web-application.imagePullSecretName" . }}
+      {{- end }}
+      automountServiceAccountToken: false
+      serviceAccountName: {{ .Values.serviceAccountName }}
+      containers:
+      - image: "{{ required ".Values.image.repository is required!" .Values.image.repository }}:{{ .Values.image.tag }}"
+        name: {{ include "web-application.name" . }}
+        ports:
+        - name: http
+          containerPort: {{ .Values.port }}
+          protocol: TCP
+        envFrom:
+        {{- range $secretName := .Values.envSecretNames }}
+        - secretRef:
+            name: {{ $secretName }}
+        {{- end }}
+        env:
+        {{- include "cap.web-application.env" . | indent 8 }}
+        {{- range $k, $v := .Values.env }}
+        - name: {{ $k }}
+          value: {{ tpl ($v | toString) $ | quote }}
+        {{- end }}
+        {{- if .Values.bindings }}
+        - name: SERVICE_BINDING_ROOT
+          value: /bindings
+        {{- end }}
+        - name: PORT
+          value: {{ .Values.port | quote }}
+        - name: TMPDIR
+          value: /tmp
+        livenessProbe:
+        {{- if .Values.health_check.liveness.path }}
+          httpGet:
+            path: {{ .Values.health_check.liveness.path }}
+            port: http
+        {{- else }}
+          tcpSocket:
+            port: {{ .Values.port }}
+        {{- end }}
+        readinessProbe:
+        {{- if .Values.health_check.readiness.path }}
+          httpGet:
+            path: {{ .Values.health_check.readiness.path }}
+            port: http
+        {{- else }}
+          tcpSocket:
+            port: {{ .Values.port }}
+        {{- end }}
+        startupProbe:
+        {{- if .Values.health_check.liveness.path }}
+          httpGet:
+            path: {{ .Values.health_check.liveness.path }}
+            port: http
+        {{- else }}
+          tcpSocket:
+            port: {{ .Values.port }}
+        {{- end }}
+          failureThreshold: {{ div (add1 .Values.startupTimeout) 2 }}
+          periodSeconds: 2
+        volumeMounts:
+        - name: tmp
+          mountPath: /tmp
+        {{- range $volume := .Values.additionalVolumes }}
+        - name: {{ $volume.name | quote }}
+          {{- toYaml $volume.volumeMount  | nindent 10 }}
+        {{- end }}
+        {{- include "cap.web-application.serviceMounts" . | nindent 8 }}
+        resources:
+          {{- toYaml .Values.resources | nindent 10 }}
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          privileged: false
+          readOnlyRootFilesystem: false
+      restartPolicy: Always
+      securityContext:
+        runAsNonRoot: true
+      {{- if .Values.ha.enabled }}
+      topologySpreadConstraints:
+      - labelSelector:
+          matchLabels: {{- include "web-application.selectorLabels" . | nindent 12 }}
+        maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: DoNotSchedule
+      {{- end }}
+      volumes:
+      - emptyDir: {}
+        name: tmp
+      {{- include "cap.web-application.serviceVolumes" . | nindent 6 }}
+      {{- range $volume := .Values.additionalVolumes }}
+      -
+        {{- omit $volume "volumeMount" | toYaml  | nindent 8 }}
+      {{- end }}

package/lib/k8s/deployment/subchart/templates/network-policy.yaml

@@ -0,0 +1,16 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "web-application.fullname" . }}
+  labels: {{- include "web-application.labels" . | nindent 4 }}
+spec:
+  ingress:
+  - from:
+    - podSelector:
+        matchLabels:
+          app: istio-ingressgateway
+      namespaceSelector: {}
+  podSelector:
+    matchLabels: {{- include "web-application.selectorLabels" . | nindent 6 }}
+  policyTypes:
+  - Ingress

package/lib/k8s/deployment/subchart/templates/pod-disruption-budget.yaml

@@ -0,0 +1,11 @@
+{{- if .Values.ha.enabled }}
+apiVersion: policy/v1beta1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "web-application.fullname" . }}
+  labels: {{- include "web-application.labels" . | nindent 4 }}
+spec:
+  maxUnavailable: 10%
+  selector:
+    matchLabels: {{- include "web-application.selectorLabels" . | nindent 6 }}
+{{- end }}

package/lib/k8s/deployment/subchart/templates/secret.yaml

@@ -0,0 +1,10 @@
+{{ if or .Values.imagePullSecret.dockerconfigjson .Values.global.imagePullSecret.dockerconfigjson }}
+apiVersion: v1
+kind: Secret
+type: kubernetes.io/dockerconfigjson
+metadata:
+  name: {{ include "web-application.imagePullSecretName" . }}
+  labels: {{- include "web-application.labels" . | nindent 4 }}
+data:
+  .dockerconfigjson: {{ default .Values.global.imagePullSecret.dockerconfigjson .Values.imagePullSecret.dockerconfigjson }}
+{{- end -}}

package/lib/k8s/deployment/subchart/templates/service-binding.yaml

@@ -0,0 +1,27 @@
+{{- range $name, $params := .Values.bindings }}
+{{- if not $params.fromSecret }}
+---
+apiVersion: services.cloud.sap.com/v1
+kind: ServiceBinding
+metadata:
+  name: {{ include "web-application.bindingName" (dict "root" $ "name" $name) }}
+  labels: {{- include "web-application.labels" $ | nindent 4 }}
+spec:
+  serviceInstanceName: {{include "web-application.serviceInstanceName" (dict "binding" $params "release" $.Release.Name) }}
+  {{- if $params.externalName }}
+  externalName: {{ $params.externalName }}
+  {{- end }}
+  {{- if $params.secretName }}
+  secretName: {{ $params.secretName }}
+  {{- end }}
+  {{- if $params.parameters }}
+  parameters: {{ $params.parameters | toYaml | nindent 4 }}
+  {{- end }}
+  {{- if $params.parametersFrom }}
+  parametersFrom: {{ $params.parametersFrom | toYaml | nindent 4 }}
+  {{- end }}
+  {{- if $params.credentialsRotationPolicy }}
+  credentialsRotationPolicy: {{ $params.credentialsRotationPolicy | toYaml | nindent 4 }}
+  {{- end }}
+{{- end }}
+{{- end }}

package/lib/k8s/deployment/subchart/templates/service.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "web-application.fullname" . }}
+  labels: {{- include "web-application.labels" . | nindent 4 }}
+spec:
+  ports:
+    - port: {{ .Values.port }}
+      targetPort: {{ .Values.port }}
+      protocol: TCP
+  selector: {{- include "web-application.selectorLabels" . | nindent 4 }}

package/lib/k8s/deployment/subchart/values-lint.yaml

@@ -0,0 +1,8 @@
+image:
+  repository: default
+resources:
+  requests:
+    cpu: 250m
+    memory: 1G
+  limits:
+    memory: 1G