@sap/cds-dk 6.4.0 → 6.5.0

package/lib/init/template/helm/{subchart → subcharts/web-application}/templates/_helpers.tpl

@@ -112,7 +112,7 @@ Service Binding secret volumes
 {{- end }}
 - name: {{ $name }}
   secret:
-    secretName: {{ $secretName }}
+    secretName: {{ tpl $secretName $ }}
 {{- end }}
 {{- end }}
 
@@ -146,66 +146,73 @@ Calculate the final image name
 {{/*
 Create the name of a service instance.
 We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
-If release name contains chart name it will be used as service insatnce name.
+If release name contains chart name it will be used as service instance name.
 */}}
 {{- define "web-application.serviceInstanceName" -}}
+  {{- $name := "" }}
   {{- if .binding.serviceInstanceFullname }}
     {{- if gt (len .binding.serviceInstanceFullname) 63 }}
       {{- fail (printf "name exceeds 63 characters: '%s'" .binding.serviceInstanceFullname) }}
     {{- end }}
-    {{- .binding.serviceInstanceFullname }}
+    {{- $name = .binding.serviceInstanceFullname }}
   {{- else }}
-    {{- $name := .binding.serviceInstanceName }}
-    {{- if not (hasPrefix .release $name)}}
-      {{- $name = printf "%s-%s" .release $name }}
+    {{- $name = .binding.serviceInstanceName }}
+    {{- if not (hasPrefix .root.Release.Name $name)}}
+      {{- $name = printf "%s-%s" .root.Release.Name $name }}
     {{- end }}
     {{- if gt (len $name) 63 }}
       {{- fail (printf "name exceeds 63 characters: '%s'" $name) }}
     {{- end }}
-    {{- $name }}
   {{- end }}
+  {{- tpl $name .root }}
 {{- end }}
 
 {{- define "web-application.processEnv" -}}
 {{- $result := dict }}
 {{- $variables := list }}
-{{- range $k, $v := . }}
+{{- range $k, $v := .Values.env }}
   {{- $variable := dict }}
-  {{- if (kindIs "string" $k) }}
-    {{- if eq "APPLICATION_NAME" $k }}
-      {{- $_ := set $result "appName" true }}
-    {{- end }}
-    {{- if eq "APPLICATION_URI" $k }}
-      {{- $_ := set $result "appURI" true }}
-    {{- end }}
-    {{- $_ := set $variable "name" $k -}}
-    {{- if (kindIs "map" $v)}}
-    {{- $_ := set $variable "valueFrom" $v}}
-    {{- else }}
-    {{- $_ := set $variable "value" ($v | toString) }}
-    {{- end }}
+  {{/*
+    We support two versions to provide environment varialbes: as an array and as a map
+
+    env:
+    - name: TEST
+      value: X
+
+    env:
+      TEST: X
+
+    Transform the map case into the array case:
+  */}}
+  {{- if (not (kindIs "map" $v)) }}
+    {{- $v = (dict "value" $v) }}
+  {{- end }}
+  {{- if (kindIs "string" $k) }} {{/* $k will be the array index (therefore int) in the array case */}}
+    {{- $_ := (set $v "name" $k) }}
+  {{- end }}
+
+  {{/* we have defaults for APPLICATION_NAME and APPLICATION_URI, but only want to provide them, if the users has no explicit values. */}}
+  {{- if eq "APPLICATION_NAME" $v.name }}
+    {{- $_ := set $result "appName" true }}
+  {{- end }}
+  {{- if eq "APPLICATION_URI" $v.name }}
+    {{- $_ := set $result "appURI" true }}
+  {{- end }}
+
+  {{/* Translate into K8s struct */}}
+  {{- $_ := set $variable "name" $v.name }}
+  {{- if $v.value }}
+    {{- $_ := set $variable "value" ($v.value | toString) }}
   {{- else }}
-    {{- if eq "APPLICATION_NAME" $v.name }}
-      {{- $_ := set $result "appName" true }}
-    {{- end }}
-    {{- if eq "APPLICATION_URI" $v.name }}
-      {{- $_ := set $result "appURI" true }}
-    {{- end }}
-    {{- $_ := set $variable "name" $v.name }}
-    {{- if $v.value }}
-      {{- $_ := set $variable "value" ($v.value | toString)}}
-    {{- else }}
-      {{- $_ := set $variable "valueFrom" (omit $v "name")}}
-    {{- end }}
+    {{- $_ := set $variable "valueFrom" (omit $v "name")}}
   {{- end }}
   {{- $variables = append $variables $variable}}
 {{- end }}
 {{- $_ := set $result "vars" $variables }}
-{{- $result | mustToJson }}
+ {{- (fromYaml (tpl (toYaml $result) $)) | mustToJson }}
 {{- end }}
 
 {{- define "web-application.processEnvFrom" -}}
-{{- $ := . -}}
 {{- $result := dict }}
 {{- $variables := list }}
 {{- range $secretName := .Values.envSecretNames }}
@@ -214,21 +221,20 @@ If release name contains chart name it will be used as service insatnce name.
   {{- $variables = append $variables (dict "secretRef" $variable)}}
 {{- end }}
 {{- range $envFrom := .Values.envFrom }}
-  {{- if hasKey $envFrom "configMapRef" }}
-    {{- if and (hasKey $envFrom.configMapRef "tpl") ($envFrom.configMapRef.tpl) }}
-    {{- $name := (tpl $envFrom.configMapRef.name $) }}
-    {{- $_ := set $envFrom.configMapRef "name" $name }}
-    {{- end }}
-    {{- $_ := unset $envFrom.configMapRef "tpl" }}
-  {{- else }}
-    {{- if and (hasKey $envFrom.secretRef "tpl") ($envFrom.secretRef.tpl) }}
-    {{- $name := (tpl $envFrom.secretRef.name $) }}
-    {{- $_ := set $envFrom.secretRef "name" $name }}
-    {{- end }}
-    {{- $_ := unset $envFrom.secretRef "tpl" }}
-  {{- end }}
   {{- $variables = append $variables $envFrom }}
 {{- end }}
 {{- $_ := set $result "vars" $variables }}
-{{- $result | mustToJson }}
-{{- end }}
+{{- (fromYaml (tpl (toYaml $result) $)) | mustToJson }}
+{{- end }}
+
+{{- define "web-application.ha" -}}
+{{- $ha := true }}
+{{- if hasKey .Values "ha"}}
+  {{- if hasKey .Values.ha "enabled" }}
+    {{- $ha = .Values.ha.enabled }}
+  {{- end }}
+{{- end }}
+{{- if $ha }}
+true
+{{- end}}
+{{- end }}

package/lib/init/template/helm/{subchart → subcharts/web-application}/templates/api-rule.yaml

@@ -5,7 +5,7 @@ metadata:
   name: {{ include "web-application.fullname" . }}
   labels: {{- include "web-application.labels" . | nindent 4 }}
 spec:
-  gateway: kyma-gateway.kyma-system.svc.cluster.local
+  gateway: {{ .Values.expose.gateway }}
   host: {{ include "web-application.exposeHost" . }}
   service:
     name: {{ include "web-application.fullname" . }}

package/lib/init/template/helm/{subchart → subcharts/web-application}/templates/deployment.yaml

@@ -10,13 +10,15 @@ spec:
   template:
     metadata:
       labels: {{- include "web-application.selectorLabels" . | nindent 8 }}
+      annotations:
+        container.apparmor.security.beta.kubernetes.io/{{ include "web-application.name" . }}: runtime/default
     spec:
       {{- if (include "web-application.imagePullSecretName" .) }}
       imagePullSecrets:
         - name: {{ include "web-application.imagePullSecretName" . }}
       {{- end }}
       automountServiceAccountToken: false
-      serviceAccountName: {{ .Values.serviceAccountName }}
+      serviceAccountName: {{ tpl (.Values.serviceAccountName | default (include "web-application.fullname" .)) $ }}
       containers:
       - image: {{ include "web-application.imageName" . }}
         name: {{ include "web-application.name" . }}
@@ -38,7 +40,7 @@ spec:
           value: {{ .Values.port | quote }}
         - name: TMPDIR
           value: /tmp
-        {{- $envVars := (include "web-application.processEnv" .Values.env | fromJson) }}
+        {{- $envVars := (include "web-application.processEnv" $ | fromJson) }}
         {{- if not (eq (len $envVars.vars) 0) }}
         {{- $envVars.vars | toYaml | nindent 8}}
         {{- end }}
@@ -78,7 +80,8 @@ spec:
           tcpSocket:
             port: {{ .Values.port }}
         {{- end }}
-          failureThreshold: {{ div (add1 .Values.startupTimeout) 2 }}
+          {{- $startupTimeout := .Values.startupTimeout | default .Values.startupTimeoutSeconds }}
+          failureThreshold: {{ div (add1  $startupTimeout) 2 }}
           periodSeconds: 2
         volumeMounts:
         - name: tmp
@@ -100,15 +103,18 @@ spec:
           seccompProfile:
             type: RuntimeDefault
       restartPolicy: Always
+      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
       securityContext:
         runAsNonRoot: true
-      {{- if .Values.ha.enabled }}
+      {{- if (include "web-application.ha" .) }}
       topologySpreadConstraints:
+      {{- range $constraint := .Values.availability.topologySpreadConstraints }}
       - labelSelector:
-          matchLabels: {{- include "web-application.selectorLabels" . | nindent 12 }}
-        maxSkew: 1
-        topologyKey: kubernetes.io/hostname
-        whenUnsatisfiable: DoNotSchedule
+          matchLabels: {{- include "web-application.selectorLabels" $ | nindent 12 }}
+        maxSkew: {{ $constraint.maxSkew }}
+        topologyKey: {{ $constraint.topologyKey }}
+        whenUnsatisfiable: {{ $constraint.whenUnsatisfiable }}
+      {{- end }}
       {{- end }}
       volumes:
       - emptyDir: {}
@@ -116,5 +122,5 @@ spec:
       {{- include "web-application.serviceVolumes" . | nindent 6 }}
       {{- range $volume := .Values.additionalVolumes }}
       -
-        {{- omit $volume "volumeMount" | toYaml  | nindent 8 }}
+        {{- tpl (omit $volume "volumeMount" | toYaml) $ | nindent 8 }}
       {{- end }}

package/lib/init/template/helm/{subchart → subcharts/web-application}/templates/pod-disruption-budget.yaml

@@ -1,11 +1,11 @@
-{{- if .Values.ha.enabled }}
+{{- if (include "web-application.ha" .) }}
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: {{ include "web-application.fullname" . }}
   labels: {{- include "web-application.labels" . | nindent 4 }}
 spec:
-  maxUnavailable: 10%
+  maxUnavailable: {{ .Values.availability.podDisruptionBudget.maxUnavailable }}
   selector:
     matchLabels: {{- include "web-application.selectorLabels" . | nindent 6 }}
 {{- end }}

package/lib/init/template/helm/subcharts/web-application/templates/service-account.yaml

@@ -0,0 +1,6 @@
+{{if not .Values.serviceAccountName}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "web-application.fullname" . }}
+{{end}}

package/lib/init/template/helm/{subchart → subcharts/web-application}/templates/service-binding.yaml

@@ -7,18 +7,19 @@ metadata:
   name: {{ include "web-application.bindingName" (dict "root" $ "name" $name) }}
   labels: {{- include "web-application.labels" $ | nindent 4 }}
 spec:
-  serviceInstanceName: {{include "web-application.serviceInstanceName" (dict "binding" $params "release" $.Release.Name) }}
+  serviceInstanceName: {{include "web-application.serviceInstanceName" (dict "binding" $params "root" $) }}
+  secretKey: credentials
   {{- if $params.externalName }}
   externalName: {{ $params.externalName }}
   {{- end }}
   {{- if $params.secretName }}
-  secretName: {{ $params.secretName }}
+  secretName: {{ tpl $params.secretName $ }}
   {{- end }}
   {{- if $params.parameters }}
   parameters: {{ $params.parameters | toYaml | nindent 4 }}
   {{- end }}
   {{- if $params.parametersFrom }}
-  parametersFrom: {{ $params.parametersFrom | toYaml | nindent 4 }}
+  parametersFrom: {{ tpl ($params.parametersFrom | toYaml) $ | nindent 4 }}
   {{- end }}
   {{- if $params.credentialsRotationPolicy }}
   credentialsRotationPolicy: {{ $params.credentialsRotationPolicy | toYaml | nindent 4 }}

package/lib/init/template/helm/subcharts/web-application/templating.md

@@ -0,0 +1,44 @@
+# Templating Values
+
+This functionality is enabled only for some of the templates provided by this helm chart. The feature itself comes with some performance costs that you should keep in mind. More details on this feature can be found in the official [documentation](https://helm.sh/docs/howto/charts_tips_and_tricks/#using-the-tpl-function).
+
+The following values can be used in the template:
+
+1. [Global values](https://helm.sh/docs/chart_template_guide/subcharts_and_globals/)
+2. Values passed to the chart directly
+3. [Built-in objects](https://helm.sh/docs/chart_template_guide/builtin_objects/) 
+
+Here's a full list of values with examples, where you can use templates:
+
+```yaml
+serviceAccountName: my-service-account-{{ .Release.Name }}
+env:
+  - name: key1
+    value: value1-{{ .Release.Name }}
+  - name: key2
+    configMapKeyRef:
+      name: my-configmap-{{ .Release.Name }}
+      key: my-key
+envFrom:
+- configMapRef:
+    name: my-configmap1-{{ .Release.Name }}
+- secretRef:
+    name: my-secret-ref1-{{ .Release.Name }}
+additionalVolumes:
+- name: my-volume
+  secret:
+    secretName: my-secret-{{ .Release.Name }}
+  volumeMount:
+    mountPath: /etc/mysecret
+    readOnly: true
+bindings:
+  hana:
+    serviceInstanceName: hana-{{ .Release.Name }}
+    secretName: hana-secret-{{ .Release.Name }}
+    parametersFrom:
+      - secretKeyRef:
+          key: my-key
+          name: test-RELEASE-NAME
+  serviceManager:
+    fromSecret: manual-secret-{{ .Release.Name }}
+```