@sap/cds-dk 6.7.0 → 6.7.2

package/CHANGELOG.md

@@ -7,19 +7,33 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/).
 
-## Version 6.7.0 - 2023-03-29
+## Version 6.7.2 - 2023-04-27
 
 ### Added
 
-- `cds upgrade` enables upgrading a tenant subscribed to a multitenant SaaS app to the latest base model.
+- Added option `--skip-verification` to command `cds migrate`. It skips the extension verification to save memory. Requires `@sap/cds-mtxs@1.7.3`.
 
 ### Fixed
 
-- `cds watch`'s livereload feature may now use a local IPv6 address (`::1`) instead of always `localhost`. This is usually the case on Node.js 17 or higher.
-- In all but `cds compile` errors where not handled correctly, especially compiler errors not displayed in human readable format.
-- `cds init` creates project sample files correctly.
-- CLI commands w/ unknown arguments (`cds --foo`) clearly fail again with a proper error message
-- Reduce console output in case of multitenancy-related command failures.
+- Swagger UI no longer fails with an error `Value of 'namespaceAndName' parameter must be in the following format: <namespace>.<name>`
+
+## Version 6.7.1 - 2023-04-19
+
+### Changed
+
+- `cds init` uses latest Maven Java archetype version 1.33.1 for creating Java projects.
+- Bump `@sap/cds` to 6.7.1
+- Bump `@sap/cds-mtxs` to 1.7.2
+
+### Fixed
+
+- Compatibility with @sap/cds versions >= 4.5 and < 6.2: avoid runtime errors with debugging disabled.
+
+## Version 6.7.0 - 2023-03-28
+
+### Added
+
+- `cds upgrade` enables upgrading a tenant subscribed to a multitenant SaaS app to the latest base model.
 
 ### Changed
 
@@ -30,6 +44,14 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/).
 - `cds subscribe` and `cds unsubscribe` no longer require a username in case @sap/cds-mtxs is configured with dummy auth.
 - `cds subscribe` and `cds unsubscribe` now rely on @sap/cds-mtxs (version 1.7.0 or higher).
 
+### Fixed
+
+- `cds watch`'s livereload feature may now use a local IPv6 address (`::1`) instead of always `localhost`. This is usually the case on Node.js 17 or higher.
+- In all but `cds compile` errors where not handled correctly, especially compiler errors not displayed in human readable format.
+- `cds init` creates project sample files correctly.
+- CLI commands w/ unknown arguments (`cds --foo`) clearly fail again with a proper error message
+- Reduce console output in case of multitenancy-related command failures.
+
 ## Version 6.6.2 - 2023-03-22
 
 ### Fixed

package/bin/migrate.js

@@ -1,11 +1,11 @@
 module.exports = Object.assign(migrate, {
     options: ['--directory', '--tag', '--tagRule'],
     shortcuts: ['-d'],
-    flags: ['--dry', '--force', '--cleanup', '--resolve-bindings'],
+    flags: ['--dry', '--force', '--skip-verification', '--cleanup', '--resolve-bindings'],
     help: `
 # SYNOPSIS
 
-    *cds migrate* <tenant1|"*">[,<tenant2>] [-d <directory>] [--tag <tag>] [--tagRule <tag rule>] [--dry] [--force]
+    *cds migrate* <tenant1|"*">[,<tenant2>] [-d <directory>] [--tag <tag>] [--tagRule <tag rule>] [--dry] [--force] [--skip-verification]
 
     Migrate extensions created with @sap/cds-mtx to extensions for @sap/cds-mtxs
 
@@ -33,6 +33,10 @@ module.exports = Object.assign(migrate, {
 
         Do a dry-run only. Only run a verification of the extension migration.
 
+    *--skip-verification
+
+        Skip verification step. Does not check for potential deployment differences.
+
     *--cleanup* (beta)
 
         Removes all metadata containers created by @sap/cds-mtx.

package/lib/cds.js

@@ -7,6 +7,18 @@ const cds = module.exports = _local ('@sap/cds')
 cds._log = _local ('@sap/cds/bin/utils/log')
 cds._local = _local
 
+if (/^(4\.[56]|5|6\.[01])\b/.test(cds.version)) {
+  // cds.debug may return false as of @sap/cds@(>=4.5 && < 6.2).
+  // Patch this to be able to call `cds.debug(label)?.(message)`.
+  // REVISIT remove once we no longer support these versions
+  Object.defineProperty(cds, 'debug', {
+    value: function cds_debug_patched (module, options) {
+      const L = cds.log (module, options)
+      if (L._debug) return L.debug
+    }
+  })
+}
+
 function _resolve (id) {
   return require.resolve (id, {paths:[
     process.cwd(), // project-local module is preferred

package/lib/compile/openapi/csdl2openapi.js

@@ -59,6 +59,8 @@ module.exports.csdl2openapi = function (
         maxLevels: maxLevels = 5
     } = {}
 ) {
+    // as preProcess below mutates the csdl, copy it before, to avoid side-effects on the caller side
+    csdl = JSON.parse(JSON.stringify(csdl))
     serviceRoot = serviceRoot || (scheme + '://' + host + basePath);
     const queryOptionPrefix = csdl.$Version <= '4.0' ? '$' : '';
     const typesToInline = {}; // filled in schema() and used in inlineTypes()

package/lib/init/constants.js

@@ -1,6 +1,6 @@
 const os = require('os');
 
-const MAVEN_ARCHETYPE_VERSION = '1.32.1';
+const MAVEN_ARCHETYPE_VERSION = '1.33.1';
 
 const constants = {
     IS_WIN: (os.platform() === 'win32'),

package/lib/init/template/helm/subcharts/web-application/templates/_helpers.tpl

@@ -11,16 +11,21 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
 If release name contains chart name it will be used as a full name.
 */}}
 {{- define "web-application.fullname" -}}
-{{- if .Values.fullnameOverride }}
-{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
-{{- else }}
-{{- $name := default .Chart.Name .Values.nameOverride }}
-{{- if contains $name .Release.Name }}
-{{- .Release.Name | trunc 63 | trimSuffix "-" }}
-{{- else }}
-{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end }}
+  {{- if .Values.fullnameOverride }}
+    {{- if gt (len .Values.fullnameOverride) 63 }}
+      {{- fail (printf "name exceeds 63 characters: '%s'" .Values.fullnameOverride) }}
+    {{- end }}
+    {{- .Values.fullnameOverride }}
+  {{- else }}
+    {{- $name := default .Chart.Name .Values.nameOverride }}
+    {{- if not (eq .Release.Name $name)}}
+      {{- $name = printf "%s-%s" .Release.Name $name }}
+    {{- end }}
+    {{- if gt (len $name) 63 }}
+      {{- fail (printf "name exceeds 63 characters: '%s'" $name) }}
+    {{- end }}
+    {{- $name }}
+  {{- end }}
 {{- end }}
 
 {{/*
@@ -70,7 +75,7 @@ Define Host for the APIRule
 */}}
 {{- define "web-application.exposeHost" -}}
 {{- if .Values.expose.host }}
-{{- .Values.expose.host }}
+{{- tpl .Values.expose.host . }}
 {{- else }}
 {{- $name := (include "web-application.fullname" .) }}
 {{- if hasPrefix $name .Release.Namespace }}
@@ -92,7 +97,8 @@ Define the application uri which will be used for the VCAP_APPLICATION env varia
 Service Binding secret mounts
 */}}
 {{- define "web-application.serviceMounts" -}}
-{{- range $name, $params := .Values.bindings }}
+{{- $bindings := omit .Values.bindings "defaultProperties" -}}
+{{- range $name, $params := $bindings }}
 - mountPath: /bindings/{{ $name }}/
   name: "{{ $name }}"
   readOnly: true
@@ -103,7 +109,8 @@ Service Binding secret mounts
 Service Binding secret volumes
 */}}
 {{- define "web-application.serviceVolumes" -}}
-{{- range $name, $params := .Values.bindings }}
+{{- $bindings := omit .Values.bindings "defaultProperties" -}}
+{{- range $name, $params := $bindings }}
 {{- $secretName := (include "web-application.bindingName" (dict "root" $ "name" $name)) }}
 {{- if $params.fromSecret }}
 {{- $secretName = $params.fromSecret}}
@@ -173,7 +180,7 @@ If release name contains chart name it will be used as service instance name.
 {{- range $k, $v := .Values.env }}
   {{- $variable := dict }}
   {{/*
-    We support two versions to provide environment varialbes: as an array and as a map
+    We support two versions to provide environment variables: as an array and as a map
 
     env:
     - name: TEST
@@ -215,26 +222,9 @@ If release name contains chart name it will be used as service instance name.
 {{- define "web-application.processEnvFrom" -}}
 {{- $result := dict }}
 {{- $variables := list }}
-{{- range $secretName := .Values.envSecretNames }}
-  {{- $variable := dict }}
-  {{- $_ := set $variable "name" $secretName -}}
-  {{- $variables = append $variables (dict "secretRef" $variable)}}
-{{- end }}
 {{- range $envFrom := .Values.envFrom }}
   {{- $variables = append $variables $envFrom }}
 {{- end }}
 {{- $_ := set $result "vars" $variables }}
 {{- (fromYaml (tpl (toYaml $result) $)) | mustToJson }}
 {{- end }}
-
-{{- define "web-application.ha" -}}
-{{- $ha := true }}
-{{- if hasKey .Values "ha"}}
-  {{- if hasKey .Values.ha "enabled" }}
-    {{- $ha = .Values.ha.enabled }}
-  {{- end }}
-{{- end }}
-{{- if $ha }}
-true
-{{- end}}
-{{- end }}

package/lib/init/template/helm/subcharts/web-application/templates/api-rule.yaml

@@ -1,4 +1,4 @@
-{{ if .Values.expose.enabled}}
+{{- if .Values.expose.enabled -}}
 apiVersion: gateway.kyma-project.io/v1beta1
 kind: APIRule
 metadata:
@@ -11,14 +11,5 @@ spec:
     name: {{ include "web-application.fullname" . }}
     port: {{ .Values.port }}
   rules:
-  - accessStrategies:
-    - handler: allow
-    methods:
-    - GET
-    - POST
-    - PUT
-    - PATCH
-    - DELETE
-    - HEAD
-    path: /.*
-{{ end }}
+    {{- toYaml .Values.expose.rules | nindent 6 }}
+{{- end }}

package/lib/init/template/helm/subcharts/web-application/templates/deployment.yaml

@@ -32,10 +32,8 @@ spec:
         {{- $envFromVars.vars | toYaml | nindent 8}}
         {{- end }}
         env:
-        {{- if .Values.bindings }}
         - name: SERVICE_BINDING_ROOT
           value: /bindings
-        {{- end }}
         - name: PORT
           value: {{ .Values.port | quote }}
         - name: TMPDIR
@@ -52,40 +50,40 @@ spec:
         - name: APPLICATION_URI
           value: {{ include "web-application.applicationUri" . }}
         {{- end }}
-        {{- $health := .Values.health_check | default .Values.health }}
         livenessProbe:
-        {{- if $health.liveness.path }}
+        {{- if .Values.health.liveness.path }}
           httpGet:
-            path: {{ $health.liveness.path }}
+            path: {{ .Values.health.liveness.path }}
             port: http
         {{- else }}
           tcpSocket:
             port: {{ .Values.port }}
         {{- end }}
         readinessProbe:
-        {{- if $health.readiness.path }}
+        {{- if .Values.health.readiness.path }}
           httpGet:
-            path: {{ $health.readiness.path }}
+            path: {{ .Values.health.readiness.path }}
             port: http
         {{- else }}
           tcpSocket:
             port: {{ .Values.port }}
         {{- end }}
         startupProbe:
-        {{- if $health.liveness.path }}
+        {{- if .Values.health.liveness.path }}
           httpGet:
-            path: {{ $health.liveness.path }}
+            path: {{ .Values.health.liveness.path }}
             port: http
         {{- else }}
           tcpSocket:
             port: {{ .Values.port }}
         {{- end }}
-          {{- $startupTimeout := .Values.startupTimeout | default .Values.startupTimeoutSeconds }}
-          failureThreshold: {{ div (add1  $startupTimeout) 2 }}
+          failureThreshold: {{ div (add1  .Values.startupTimeoutSeconds) 2 }}
           periodSeconds: 2
         volumeMounts:
         - name: tmp
           mountPath: /tmp
+        - name: bindings-root
+          mountPath: /bindings
         {{- range $volume := .Values.additionalVolumes }}
         - name: {{ $volume.name | quote }}
           {{- toYaml $volume.volumeMount  | nindent 10 }}
@@ -99,14 +97,13 @@ spec:
             drop:
             - ALL
           privileged: false
-          readOnlyRootFilesystem: false
+          readOnlyRootFilesystem: {{ .Values.readOnlyRootFilesystem | default false }}
           seccompProfile:
             type: RuntimeDefault
       restartPolicy: Always
       terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
       securityContext:
         runAsNonRoot: true
-      {{- if (include "web-application.ha" .) }}
       topologySpreadConstraints:
       {{- range $constraint := .Values.availability.topologySpreadConstraints }}
       - labelSelector:
@@ -115,10 +112,11 @@ spec:
         topologyKey: {{ $constraint.topologyKey }}
         whenUnsatisfiable: {{ $constraint.whenUnsatisfiable }}
       {{- end }}
-      {{- end }}
       volumes:
       - emptyDir: {}
         name: tmp
+      - emptyDir: {}
+        name: bindings-root
       {{- include "web-application.serviceVolumes" . | nindent 6 }}
       {{- range $volume := .Values.additionalVolumes }}
       -

package/lib/init/template/helm/subcharts/web-application/templates/network-policy.yaml

@@ -1,18 +1,41 @@
-apiVersion: networking.k8s.io/v1
+{{- if .Values.networkSecurity.enabled -}}
 kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
 metadata:
   name: {{ include "web-application.fullname" . }}
   labels: {{- include "web-application.labels" . | nindent 4 }}
 spec:
   ingress:
+{{- if .Values.expose.enabled }}
   - from:
     - podSelector:
         matchLabels:
           app: istio-ingressgateway
       namespaceSelector:
         matchLabels:
-          name: istio-system
-  podSelector:
-    matchLabels: {{- include "web-application.selectorLabels" . | nindent 6 }}
+          kubernetes.io/metadata.name: istio-system
+{{- end }}
+{{- if .Values.networkSecurity.allowNamespaceInternal }}
+  - from:
+    - podSelector: {}
+{{- end }}
+{{- range $netRule := .Values.networkSecurity.ingress }}
+  - from:
+    -
+    {{- if $netRule.namespace }}
+      namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: {{ tpl $netRule.namespace $ }}
+    {{- end }}
+    {{- if $netRule.podLabelsSelector }}
+      podSelector:
+        matchLabels: {{ tpl ($netRule.podLabelsSelector | toYaml) $ | nindent 10 }}
+    {{- else }}
+      podSelector: {}
+    {{- end }}
+{{- end }}
   policyTypes:
   - Ingress
+  podSelector:
+    matchLabels: {{- include "web-application.selectorLabels" . | nindent 6 }}
+{{- end }}

package/lib/init/template/helm/subcharts/web-application/templates/pod-disruption-budget.yaml

@@ -1,4 +1,3 @@
-{{- if (include "web-application.ha" .) }}
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
@@ -8,4 +7,3 @@ spec:
   maxUnavailable: {{ .Values.availability.podDisruptionBudget.maxUnavailable }}
   selector:
     matchLabels: {{- include "web-application.selectorLabels" . | nindent 6 }}
-{{- end }}

package/lib/init/template/helm/subcharts/web-application/templates/secret.yaml

@@ -1,4 +1,4 @@
-{{ if or .Values.imagePullSecret.dockerconfigjson .Values.global.imagePullSecret.dockerconfigjson }}
+{{- if or .Values.imagePullSecret.dockerconfigjson .Values.global.imagePullSecret.dockerconfigjson -}}
 apiVersion: v1
 kind: Secret
 type: kubernetes.io/dockerconfigjson
@@ -7,4 +7,4 @@ metadata:
   labels: {{- include "web-application.labels" . | nindent 4 }}
 data:
   .dockerconfigjson: {{ default .Values.global.imagePullSecret.dockerconfigjson .Values.imagePullSecret.dockerconfigjson }}
-{{- end -}}
+{{- end }}

package/lib/init/template/helm/subcharts/web-application/templates/service-account.yaml

@@ -1,6 +1,6 @@
-{{if not .Values.serviceAccountName}}
+{{- if not .Values.serviceAccountName -}}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "web-application.fullname" . }}
-{{end}}
+{{- end }}

package/lib/init/template/helm/subcharts/web-application/templates/service-binding.yaml

@@ -1,5 +1,8 @@
-{{- range $name, $params := .Values.bindings }}
-{{- if not $params.fromSecret }}
+{{- $bindings := omit .Values.bindings "defaultProperties" -}}
+{{- range $name, $params := $bindings }}
+{{- $defaultProperties := deepCopy $.Values.bindings.defaultProperties -}}
+{{- $mergedParams := (deepCopy $params | mergeOverwrite $defaultProperties ) -}}
+{{- if not $mergedParams.fromSecret }}
 ---
 apiVersion: services.cloud.sap.com/v1
 kind: ServiceBinding
@@ -7,22 +10,22 @@ metadata:
   name: {{ include "web-application.bindingName" (dict "root" $ "name" $name) }}
   labels: {{- include "web-application.labels" $ | nindent 4 }}
 spec:
-  serviceInstanceName: {{include "web-application.serviceInstanceName" (dict "binding" $params "root" $) }}
+  serviceInstanceName: {{include "web-application.serviceInstanceName" (dict "binding" $mergedParams "root" $) }}
   secretKey: credentials
-  {{- if $params.externalName }}
-  externalName: {{ $params.externalName }}
+  {{- if $mergedParams.externalName }}
+  externalName: {{ $mergedParams.externalName }}
   {{- end }}
-  {{- if $params.secretName }}
-  secretName: {{ tpl $params.secretName $ }}
+  {{- if $mergedParams.secretName }}
+  secretName: {{ tpl $mergedParams.secretName $ }}
   {{- end }}
-  {{- if $params.parameters }}
-  parameters: {{ $params.parameters | toYaml | nindent 4 }}
+  {{- if $mergedParams.parameters }}
+  parameters: {{ $mergedParams.parameters | toYaml | nindent 4 }}
   {{- end }}
-  {{- if $params.parametersFrom }}
-  parametersFrom: {{ tpl ($params.parametersFrom | toYaml) $ | nindent 4 }}
+  {{- if $mergedParams.parametersFrom }}
+  parametersFrom: {{ tpl ($mergedParams.parametersFrom | toYaml) $ | nindent 4 }}
   {{- end }}
-  {{- if $params.credentialsRotationPolicy }}
-  credentialsRotationPolicy: {{ $params.credentialsRotationPolicy | toYaml | nindent 4 }}
+  {{- if $mergedParams.credentialsRotationPolicy }}
+  credentialsRotationPolicy: {{ $mergedParams.credentialsRotationPolicy | toYaml | nindent 4 }}
   {{- end }}
 {{- end }}
 {{- end }}

package/lib/init/template/helm/subcharts/web-application/templating.md

@@ -20,17 +20,24 @@ env:
       name: my-configmap-{{ .Release.Name }}
       key: my-key
 envFrom:
-- configMapRef:
-    name: my-configmap1-{{ .Release.Name }}
-- secretRef:
+  - configMapRef:
+      name: my-configmap1-{{ .Release.Name }}
+  - secretRef:
     name: my-secret-ref1-{{ .Release.Name }}
 additionalVolumes:
-- name: my-volume
-  secret:
-    secretName: my-secret-{{ .Release.Name }}
-  volumeMount:
-    mountPath: /etc/mysecret
-    readOnly: true
+  - name: my-volume
+    secret:
+      secretName: my-secret-{{ .Release.Name }}
+    volumeMount:
+      mountPath: /etc/mysecret
+      readOnly: true
+expose:
+  host: "{{ .Release.Name }}-app"
+networkSecurity:
+  ingress:
+    - namespace: "{{ .Release.Namespace }}"
+      podLabelsSelector:
+        app: "{{ .Release.Name }}-my-app"
 bindings:
   hana:
     serviceInstanceName: hana-{{ .Release.Name }}