@sap/cds-dk 6.6.2 → 6.7.1

package/lib/init/template/helm/subcharts/web-application/templates/deployment.yaml

@@ -32,10 +32,8 @@ spec:
         {{- $envFromVars.vars | toYaml | nindent 8}}
         {{- end }}
         env:
-        {{- if .Values.bindings }}
         - name: SERVICE_BINDING_ROOT
           value: /bindings
-        {{- end }}
         - name: PORT
           value: {{ .Values.port | quote }}
         - name: TMPDIR
@@ -52,40 +50,40 @@ spec:
         - name: APPLICATION_URI
           value: {{ include "web-application.applicationUri" . }}
         {{- end }}
-        {{- $health := .Values.health_check | default .Values.health }}
         livenessProbe:
-        {{- if $health.liveness.path }}
+        {{- if .Values.health.liveness.path }}
           httpGet:
-            path: {{ $health.liveness.path }}
+            path: {{ .Values.health.liveness.path }}
             port: http
         {{- else }}
           tcpSocket:
             port: {{ .Values.port }}
         {{- end }}
         readinessProbe:
-        {{- if $health.readiness.path }}
+        {{- if .Values.health.readiness.path }}
           httpGet:
-            path: {{ $health.readiness.path }}
+            path: {{ .Values.health.readiness.path }}
             port: http
         {{- else }}
           tcpSocket:
             port: {{ .Values.port }}
         {{- end }}
         startupProbe:
-        {{- if $health.liveness.path }}
+        {{- if .Values.health.liveness.path }}
           httpGet:
-            path: {{ $health.liveness.path }}
+            path: {{ .Values.health.liveness.path }}
             port: http
         {{- else }}
           tcpSocket:
             port: {{ .Values.port }}
         {{- end }}
-          {{- $startupTimeout := .Values.startupTimeout | default .Values.startupTimeoutSeconds }}
-          failureThreshold: {{ div (add1  $startupTimeout) 2 }}
+          failureThreshold: {{ div (add1  .Values.startupTimeoutSeconds) 2 }}
           periodSeconds: 2
         volumeMounts:
         - name: tmp
           mountPath: /tmp
+        - name: bindings-root
+          mountPath: /bindings
         {{- range $volume := .Values.additionalVolumes }}
         - name: {{ $volume.name | quote }}
           {{- toYaml $volume.volumeMount  | nindent 10 }}
@@ -99,14 +97,13 @@ spec:
             drop:
             - ALL
           privileged: false
-          readOnlyRootFilesystem: false
+          readOnlyRootFilesystem: {{ .Values.readOnlyRootFilesystem | default false }}
           seccompProfile:
             type: RuntimeDefault
       restartPolicy: Always
       terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
       securityContext:
         runAsNonRoot: true
-      {{- if (include "web-application.ha" .) }}
       topologySpreadConstraints:
       {{- range $constraint := .Values.availability.topologySpreadConstraints }}
       - labelSelector:
@@ -115,10 +112,11 @@ spec:
         topologyKey: {{ $constraint.topologyKey }}
         whenUnsatisfiable: {{ $constraint.whenUnsatisfiable }}
       {{- end }}
-      {{- end }}
       volumes:
       - emptyDir: {}
         name: tmp
+      - emptyDir: {}
+        name: bindings-root
       {{- include "web-application.serviceVolumes" . | nindent 6 }}
       {{- range $volume := .Values.additionalVolumes }}
       -

package/lib/init/template/helm/subcharts/web-application/templates/network-policy.yaml

@@ -1,18 +1,41 @@
-apiVersion: networking.k8s.io/v1
+{{- if .Values.networkSecurity.enabled -}}
 kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
 metadata:
   name: {{ include "web-application.fullname" . }}
   labels: {{- include "web-application.labels" . | nindent 4 }}
 spec:
   ingress:
+{{- if .Values.expose.enabled }}
   - from:
     - podSelector:
         matchLabels:
           app: istio-ingressgateway
       namespaceSelector:
         matchLabels:
-          name: istio-system
-  podSelector:
-    matchLabels: {{- include "web-application.selectorLabels" . | nindent 6 }}
+          kubernetes.io/metadata.name: istio-system
+{{- end }}
+{{- if .Values.networkSecurity.allowNamespaceInternal }}
+  - from:
+    - podSelector: {}
+{{- end }}
+{{- range $netRule := .Values.networkSecurity.ingress }}
+  - from:
+    -
+    {{- if $netRule.namespace }}
+      namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: {{ tpl $netRule.namespace $ }}
+    {{- end }}
+    {{- if $netRule.podLabelsSelector }}
+      podSelector:
+        matchLabels: {{ tpl ($netRule.podLabelsSelector | toYaml) $ | nindent 10 }}
+    {{- else }}
+      podSelector: {}
+    {{- end }}
+{{- end }}
   policyTypes:
   - Ingress
+  podSelector:
+    matchLabels: {{- include "web-application.selectorLabels" . | nindent 6 }}
+{{- end }}

package/lib/init/template/helm/subcharts/web-application/templates/pod-disruption-budget.yaml

@@ -1,4 +1,3 @@
-{{- if (include "web-application.ha" .) }}
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
@@ -8,4 +7,3 @@ spec:
   maxUnavailable: {{ .Values.availability.podDisruptionBudget.maxUnavailable }}
   selector:
     matchLabels: {{- include "web-application.selectorLabels" . | nindent 6 }}
-{{- end }}

package/lib/init/template/helm/subcharts/web-application/templates/secret.yaml

@@ -1,4 +1,4 @@
-{{ if or .Values.imagePullSecret.dockerconfigjson .Values.global.imagePullSecret.dockerconfigjson }}
+{{- if or .Values.imagePullSecret.dockerconfigjson .Values.global.imagePullSecret.dockerconfigjson -}}
 apiVersion: v1
 kind: Secret
 type: kubernetes.io/dockerconfigjson
@@ -7,4 +7,4 @@ metadata:
   labels: {{- include "web-application.labels" . | nindent 4 }}
 data:
   .dockerconfigjson: {{ default .Values.global.imagePullSecret.dockerconfigjson .Values.imagePullSecret.dockerconfigjson }}
-{{- end -}}
+{{- end }}

package/lib/init/template/helm/subcharts/web-application/templates/service-account.yaml

@@ -1,6 +1,6 @@
-{{if not .Values.serviceAccountName}}
+{{- if not .Values.serviceAccountName -}}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "web-application.fullname" . }}
-{{end}}
+{{- end }}

package/lib/init/template/helm/subcharts/web-application/templates/service-binding.yaml

@@ -1,5 +1,8 @@
-{{- range $name, $params := .Values.bindings }}
-{{- if not $params.fromSecret }}
+{{- $bindings := omit .Values.bindings "defaultProperties" -}}
+{{- range $name, $params := $bindings }}
+{{- $defaultProperties := deepCopy $.Values.bindings.defaultProperties -}}
+{{- $mergedParams := (deepCopy $params | mergeOverwrite $defaultProperties ) -}}
+{{- if not $mergedParams.fromSecret }}
 ---
 apiVersion: services.cloud.sap.com/v1
 kind: ServiceBinding
@@ -7,22 +10,22 @@ metadata:
   name: {{ include "web-application.bindingName" (dict "root" $ "name" $name) }}
   labels: {{- include "web-application.labels" $ | nindent 4 }}
 spec:
-  serviceInstanceName: {{include "web-application.serviceInstanceName" (dict "binding" $params "root" $) }}
+  serviceInstanceName: {{include "web-application.serviceInstanceName" (dict "binding" $mergedParams "root" $) }}
   secretKey: credentials
-  {{- if $params.externalName }}
-  externalName: {{ $params.externalName }}
+  {{- if $mergedParams.externalName }}
+  externalName: {{ $mergedParams.externalName }}
   {{- end }}
-  {{- if $params.secretName }}
-  secretName: {{ tpl $params.secretName $ }}
+  {{- if $mergedParams.secretName }}
+  secretName: {{ tpl $mergedParams.secretName $ }}
   {{- end }}
-  {{- if $params.parameters }}
-  parameters: {{ $params.parameters | toYaml | nindent 4 }}
+  {{- if $mergedParams.parameters }}
+  parameters: {{ $mergedParams.parameters | toYaml | nindent 4 }}
   {{- end }}
-  {{- if $params.parametersFrom }}
-  parametersFrom: {{ tpl ($params.parametersFrom | toYaml) $ | nindent 4 }}
+  {{- if $mergedParams.parametersFrom }}
+  parametersFrom: {{ tpl ($mergedParams.parametersFrom | toYaml) $ | nindent 4 }}
   {{- end }}
-  {{- if $params.credentialsRotationPolicy }}
-  credentialsRotationPolicy: {{ $params.credentialsRotationPolicy | toYaml | nindent 4 }}
+  {{- if $mergedParams.credentialsRotationPolicy }}
+  credentialsRotationPolicy: {{ $mergedParams.credentialsRotationPolicy | toYaml | nindent 4 }}
   {{- end }}
 {{- end }}
 {{- end }}

package/lib/init/template/helm/subcharts/web-application/templating.md

@@ -20,17 +20,24 @@ env:
       name: my-configmap-{{ .Release.Name }}
       key: my-key
 envFrom:
-- configMapRef:
-    name: my-configmap1-{{ .Release.Name }}
-- secretRef:
+  - configMapRef:
+      name: my-configmap1-{{ .Release.Name }}
+  - secretRef:
     name: my-secret-ref1-{{ .Release.Name }}
 additionalVolumes:
-- name: my-volume
-  secret:
-    secretName: my-secret-{{ .Release.Name }}
-  volumeMount:
-    mountPath: /etc/mysecret
-    readOnly: true
+  - name: my-volume
+    secret:
+      secretName: my-secret-{{ .Release.Name }}
+    volumeMount:
+      mountPath: /etc/mysecret
+      readOnly: true
+expose:
+  host: "{{ .Release.Name }}-app"
+networkSecurity:
+  ingress:
+    - namespace: "{{ .Release.Namespace }}"
+      podLabelsSelector:
+        app: "{{ .Release.Name }}-my-app"
 bindings:
   hana:
     serviceInstanceName: hana-{{ .Release.Name }}