@sap/cds-dk 7.2.0 → 7.3.1

package/lib/init/template/helm/subcharts/service-instance/values.yaml

@@ -1,15 +1,43 @@
+# Will be used instead of the `.Chart.Name`, e.g. when generating the Deployment name.
+# nameOverride: foo
+
+# Will be used as an override for the `.fullname` helper function (i.e. `.Release.Name-.Chart.Name`).
+# fullnameOverride: foo
+
+# The name of the SAP BTP service offering.
 # serviceOfferingName: feature-flags
+
+# The plan to use for the service instance.
 # servicePlanName: plan-name
+
+# The name for the service instance in SAP BTP.
 # externalName: feature-flags-test
+
+# List of custom tags describing the ServiceInstance, will be copied to `ServiceBinding` secret in the key called `tags`.
 # customTags:
 #   - foo
 #   - bar
+
+# Some services support the provisioning of additional configuration parameters. For the list of supported parameters, check the documentation of the particular service offering.
 # parameters:
 #   key: val
+
+# Some services support the provisioning of additional configuration parameters. For the list of supported parameters, check the documentation of the particular service offering.
+# jsonParameters: {}
+
+# Kubernetes Secret as a parameters source.
 # parametersFrom:
+# https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#define-container-environment-variables-using-secret-data
 #   - secretKeyRef:
 #       name: my-secret
 #       key: secret-parameter
+# https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#define-container-environment-variables-using-configmap-data
 #   - configMapKeyRef:
 #       name: my-cm
 #       key: cm-parameter
+global:
+  sap:
+    _internal:
+      service-instance:
+        versions:
+          1.1.1: true

package/lib/init/template/helm/subcharts/web-application/Chart.yaml

@@ -1,8 +1,8 @@
 apiVersion: v2
-name: web-application
 description: A Helm chart for web app
-kubeVersion: ">= 1.21"
-type: application
-version: 0.1.0
+kubeVersion: '>= 1.21'
+name: web-application
 sources:
-- "https://github.tools.sap/unified-runtime/web-application"
+- https://github.tools.sap/unified-runtime/web-application
+type: application
+version: 1.8.0

package/lib/init/template/helm/subcharts/web-application/templates/_api.tpl

@@ -0,0 +1,60 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "web-application.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "web-application.fullname" -}}
+  {{- if .Values.fullnameOverride }}
+    {{- if gt (len .Values.fullnameOverride) 63 }}
+      {{- fail (printf "name exceeds 63 characters: '%s'" .Values.fullnameOverride) }}
+    {{- end }}
+    {{- .Values.fullnameOverride }}
+  {{- else }}
+    {{- $name := default .Chart.Name .Values.nameOverride }}
+    {{- if not (eq .Release.Name $name)}}
+      {{- $name = printf "%s-%s" .Release.Name $name }}
+    {{- end }}
+    {{- if gt (len $name) 63 }}
+      {{- fail (printf "name exceeds 63 characters: '%s'" $name) }}
+    {{- end }}
+    {{- $name }}
+  {{- end }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "web-application.labels" -}}
+helm.sh/revision: {{ .Release.Revision | quote }}
+helm.sh/chart: {{ include "web-application.internal.chart" . }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{ include "web-application.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "web-application.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "web-application.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- if .Values.global}}
+{{- if .Values.global.component }}
+app.kubernetes.io/component:{{ .Values.global.component }}
+{{- end }}
+{{- if .Values.global.partOf }}
+app.kubernetes.io/partOf: {{ .Values.global.partOf }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+

package/lib/init/template/helm/subcharts/web-application/templates/_helpers.tpl

@@ -1,37 +1,9 @@
-{{/*
-Expand the name of the chart.
-*/}}
-{{- define "web-application.internal.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
-{{- end }}
 
-{{/*
-Create a default fully qualified app name.
-We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
-If release name contains chart name it will be used as a full name.
-*/}}
-{{- define "web-application.internal.fullname" -}}
-  {{- if .Values.fullnameOverride }}
-    {{- if gt (len .Values.fullnameOverride) 63 }}
-      {{- fail (printf "name exceeds 63 characters: '%s'" .Values.fullnameOverride) }}
-    {{- end }}
-    {{- .Values.fullnameOverride }}
-  {{- else }}
-    {{- $name := default .Chart.Name .Values.nameOverride }}
-    {{- if not (eq .Release.Name $name)}}
-      {{- $name = printf "%s-%s" .Release.Name $name }}
-    {{- end }}
-    {{- if gt (len $name) 63 }}
-      {{- fail (printf "name exceeds 63 characters: '%s'" $name) }}
-    {{- end }}
-    {{- $name }}
-  {{- end }}
-{{- end }}
 
 {{/*
 */}}
 {{- define "web-application.internal.bindingName" -}}
-{{- printf "%s-%s" (include "web-application.internal.fullname" .root ) .name }}
+{{- printf "%s-%s" (include "web-application.fullname" .root ) .name }}
 {{- end }}
 
 {{/*
@@ -41,35 +13,6 @@ Create chart name and version as used by the chart label.
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
-{{/*
-Common labels
-*/}}
-{{- define "web-application.internal.labels" -}}
-helm.sh/revision: {{ .Release.Revision | quote }}
-helm.sh/chart: {{ include "web-application.internal.chart" . }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{ include "web-application.internal.selectorLabels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "web-application.internal.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "web-application.internal.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- if .Values.global}}
-{{- if .Values.global.component }}
-app.kubernetes.io/component:{{ .Values.global.component }}
-{{- end }}
-{{- if .Values.global.partOf }}
-app.kubernetes.io/partOf: {{ .Values.global.partOf }}
-{{- end }}
-{{- end }}
-{{- end }}
-
 {{/*
 Define Host for the APIRule
 */}}
@@ -77,7 +20,7 @@ Define Host for the APIRule
 {{- if .Values.expose.host }}
 {{- tpl .Values.expose.host . }}
 {{- else }}
-{{- $name := (include "web-application.internal.fullname" .) }}
+{{- $name := (include "web-application.fullname" .) }}
 {{- if hasPrefix $name .Release.Namespace }}
 {{- .Release.Namespace }}
 {{- else }}
@@ -87,10 +30,29 @@ Define Host for the APIRule
 {{- end }}
 
 {{/*
-Define the application uri which will be used for the VCAP_APPLICATION env variable
+Returns the TENANT_HOST_PATTERN if defined
+*/}}
+{{- define "web-application.internal.TENANT_HOST_PATTERN" -}}
+{{- if .Values.env }}
+  {{- if (kindIs "map" .Values.env) }}
+    {{- if (hasKey .Values.env "TENANT_HOST_PATTERN")  }}
+      {{-  .Values.env.TENANT_HOST_PATTERN }}
+    {{- end }}
+  {{- else }}
+    {{- range $i, $item := .Values.env }}
+      {{- if eq $item.name "TENANT_HOST_PATTERN"}}
+        {{- $item.value }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Define the application uri to be used for the VCAP_APPLICATION env variable
 */}}
 {{- define "web-application.internal.applicationUri" -}}
-{{- include "web-application.internal.fullname" . }}
+{{- include "web-application.fullname" . }}
 {{- end }}
 
 {{/*
@@ -133,7 +95,9 @@ Name of the imagePullSecret
 {{- else if $ips.global.name }}
 {{- $ips.global.name }}
 {{- else if or $ips.local.dockerconfigjson $ips.global.dockerconfigjson }}
-{{- include "web-application.internal.fullname" . }}
+{{- include "web-application.fullname" . }}
+{{- else }}
+{{- "image-pull-secret" }}
 {{- end }}
 {{- end }}
 
@@ -141,12 +105,12 @@ Name of the imagePullSecret
 Calculate the final image name
 */}}
 {{- define "web-application.internal.imageName" -}}
-{{- $tag := .Values.image.tag | default .Values.global.image.tag | default "latest" }}
-{{- $registry := .Values.image.registry | default .Values.global.image.registry }}
+{{- $tag := .image.tag | default .context.Values.global.image.tag | default "latest" }}
+{{- $registry := .image.registry | default .context.Values.global.image.registry }}
 {{- if $registry }}
-{{- $registry | trimSuffix "/" }}/{{ .Values.image.repository }}:{{ $tag }}
+{{- $registry | trimSuffix "/" | trimPrefix "https://" }}/{{ .image.repository | trimSuffix "/" }}:{{ $tag }}
 {{- else }}
-{{- .Values.image.repository }}:{{ $tag }}
+{{- .image.repository | trimSuffix "/" | trimPrefix "https://" }}:{{ $tag }}
 {{- end }}
 {{- end }}
 
@@ -177,18 +141,15 @@ If release name contains chart name it will be used as service instance name.
 {{- define "web-application.internal.processEnv" -}}
 {{- $result := dict }}
 {{- $variables := list }}
-{{- range $k, $v := .Values.env }}
+{{- range $k, $v := .env }}
   {{- $variable := dict }}
   {{/*
     We support two versions to provide environment variables: as an array and as a map
-
     env:
     - name: TEST
       value: X
-
     env:
       TEST: X
-
     Transform the map case into the array case:
   */}}
   {{- if (not (kindIs "map" $v)) }}
@@ -216,15 +177,15 @@ If release name contains chart name it will be used as service instance name.
   {{- $variables = append $variables $variable}}
 {{- end }}
 {{- $_ := set $result "vars" $variables }}
- {{- (fromYaml (tpl (toYaml $result) $)) | mustToJson }}
+ {{- (fromYaml (tpl (toYaml $result) .context)) | mustToJson }}
 {{- end }}
 
 {{- define "web-application.internal.processEnvFrom" -}}
 {{- $result := dict }}
 {{- $variables := list }}
-{{- range $envFrom := .Values.envFrom }}
+{{- range $envFrom := .envFrom }}
   {{- $variables = append $variables $envFrom }}
 {{- end }}
 {{- $_ := set $result "vars" $variables }}
-{{- (fromYaml (tpl (toYaml $result) $)) | mustToJson }}
+{{- (fromYaml (tpl (toYaml $result) .context)) | mustToJson }}
 {{- end }}

package/lib/init/template/helm/subcharts/web-application/templates/api-rule.yaml

@@ -2,13 +2,13 @@
 apiVersion: gateway.kyma-project.io/v1beta1
 kind: APIRule
 metadata:
-  name: {{ include "web-application.internal.fullname" . }}
-  labels: {{- include "web-application.internal.labels" . | nindent 4 }}
+  name: {{ include "web-application.fullname" . }}
+  labels: {{- include "web-application.labels" . | nindent 4 }}
 spec:
-  gateway: {{ .Values.expose.gateway }}
+  gateway: {{tpl .Values.expose.gateway $ }}
   host: {{ include "web-application.internal.exposeHost" . }}
   service:
-    name: {{ include "web-application.internal.fullname" . }}
+    name: {{ include "web-application.fullname" . }}
     port: {{ .Values.port }}
   rules:
     {{- toYaml .Values.expose.rules | nindent 6 }}

package/lib/init/template/helm/subcharts/web-application/templates/deployment.yaml

@@ -1,33 +1,46 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  labels: {{- include "web-application.internal.labels" . | nindent 4 }}
-  name: {{ include "web-application.internal.fullname" . }}
+  name: {{ include "web-application.fullname" . }}
+  labels: {{- include "web-application.labels" . | nindent 4 }}
+  {{- if or .Values.annotations.deployment }}
+  annotations:
+  {{- tpl (toYaml .Values.annotations.deployment) $ | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.replicaCount }}
   selector:
-    matchLabels: {{- include "web-application.internal.selectorLabels" . | nindent 6 }}
+    matchLabels: {{- include "web-application.selectorLabels" . | nindent 6 }}
   template:
     metadata:
-      labels: {{- include "web-application.internal.selectorLabels" . | nindent 8 }}
+      labels: {{- include "web-application.selectorLabels" . | nindent 8 }}
+      {{- if .Values.istio }}
+        sidecar.istio.io/inject: {{ .Values.istio.enabled | quote }}
+      {{ end }}
       annotations:
-        container.apparmor.security.beta.kubernetes.io/{{ include "web-application.internal.name" . }}: runtime/default
+        container.apparmor.security.beta.kubernetes.io/{{ include "web-application.name" . }}: runtime/default
+        {{- if or .Values.annotations.deployment }}
+        {{- tpl (toYaml .Values.annotations.deployment) $ | nindent 8 }}
+        {{- end }}
     spec:
       {{- if (include "web-application.internal.imagePullSecretName" .) }}
       imagePullSecrets:
         - name: {{ include "web-application.internal.imagePullSecretName" . }}
       {{- end }}
-      automountServiceAccountToken: false
-      serviceAccountName: {{ tpl (.Values.serviceAccountName | default (include "web-application.internal.fullname" .)) $ }}
+      automountServiceAccountToken: {{ ternary false true (empty (or .Values.rbac.rules .Values.rbac.role .Values.rbac.clusterRole)) }}
+      serviceAccountName: {{ tpl (.Values.serviceAccountName | default (include "web-application.fullname" .)) $ }}
       containers:
-      - image: {{ include "web-application.internal.imageName" . }}
-        name: {{ include "web-application.internal.name" . }}
+      - image: {{ include "web-application.internal.imageName" (dict "image" .Values.image "context" $) }}
+      {{- if ( or .Values.global.imagePullPolicy .Values.imagePullPolicy ) }}
+        imagePullPolicy: {{ .Values.imagePullPolicy |  default .Values.global.imagePullPolicy }}
+      {{- end }}
+        name: {{ include "web-application.name" . }}
         ports:
         - name: http
           containerPort: {{ .Values.port }}
           protocol: TCP
         envFrom:
-        {{- $envFromVars := (include "web-application.internal.processEnvFrom" . | fromJson) }}
+        {{- $envFromVars := (include "web-application.internal.processEnvFrom" (dict "envFrom" .Values.envFrom "context" $) | fromJson) }}
         {{- if not (eq (len $envFromVars.vars) 0) }}
         {{- $envFromVars.vars | toYaml | nindent 8}}
         {{- end }}
@@ -38,18 +51,26 @@ spec:
           value: {{ .Values.port | quote }}
         - name: TMPDIR
           value: /tmp
-        {{- $envVars := (include "web-application.internal.processEnv" $ | fromJson) }}
-        {{- if not (eq (len $envVars.vars) 0) }}
-        {{- $envVars.vars | toYaml | nindent 8}}
+        {{- if .Values.otlp.traces.enabled }}
+        - name: OTEL_EXPORTER_OTLP_TRACES_ENDPOINT
+          value: {{ .Values.otlp.traces.endpoint }}
+        {{- end }}
+        {{- if .Values.otlp.metrics.enabled }}
+        - name: OTEL_EXPORTER_OTLP_METRICS_ENDPOINT
+          value: {{ .Values.otlp.metrics.endpoint }}
         {{- end }}
+        {{- $envVars := (include "web-application.internal.processEnv" (dict "env" .Values.env "context" $) | fromJson) }}
         {{- if not $envVars.appName}}
         - name: APPLICATION_NAME
-          value: {{ include "web-application.internal.fullname" . }}
+          value: {{ include "web-application.fullname" . }}
         {{- end }}
         {{- if not $envVars.appURI}}
         - name: APPLICATION_URI
           value: {{ include "web-application.internal.applicationUri" . }}
         {{- end }}
+        {{- if not (eq (len $envVars.vars) 0) }}
+        {{- $envVars.vars | toYaml | nindent 8}}
+        {{- end }}
         livenessProbe:
         {{- if .Values.health.liveness.path }}
           httpGet:
@@ -97,17 +118,75 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsNonRoot: true
+          {{- if .Values.runAsUser }}
+          runAsUser: {{ .Values.runAsUser }}
+          {{- end }}
           readOnlyRootFilesystem: {{ .Values.readOnlyRootFilesystem | default false }}
           seccompProfile:
             type: RuntimeDefault
+      {{- range $key, $sidecar := .Values.sidecars }}
+      - image: {{ include "web-application.internal.imageName" (dict "image" $sidecar.image "context" $) }}
+      {{- if ( or $.Values.global.imagePullPolicy $sidecar.imagePullPolicy ) }}
+        imagePullPolicy: {{ $sidecar.imagePullPolicy |  default $.Values.global.imagePullPolicy }}
+      {{- end }}
+        name: {{ $key }}
+        envFrom:
+        {{- $envFromVars := (include "web-application.internal.processEnvFrom" (dict "envFrom" $sidecar.envFrom "context" $) | fromJson) }}
+        {{- if not (eq (len $envFromVars.vars) 0) }}
+        {{- $envFromVars.vars | toYaml | nindent 8}}
+        {{- end }}
+        env:
+        - name: SERVICE_BINDING_ROOT
+          value: /bindings
+        - name: TMPDIR
+          value: /tmp
+        {{- if $.Values.otlp.traces.enabled }}
+        - name: OTEL_EXPORTER_OTLP_TRACES_ENDPOINT
+          value: {{ $.Values.otlp.traces.endpoint }}
+        {{- end }}
+        {{- if $.Values.otlp.metrics.enabled }}
+        - name: OTEL_EXPORTER_OTLP_METRICS_ENDPOINT
+          value: {{ $.Values.otlp.metrics.endpoint }}
+        {{- end }}
+        {{- $envVars := (include "web-application.internal.processEnv" (dict "env" $sidecar.env "context" $) | fromJson) }}
+        {{- if not (eq (len $envVars.vars) 0) }}
+        {{- $envVars.vars | toYaml | nindent 8}}
+        {{- end }}
+        volumeMounts:
+        - name: tmp
+          mountPath: /tmp
+        - name: bindings-root
+          mountPath: /bindings
+        {{- range $volume := $.Values.additionalVolumes }}
+        - name: {{ $volume.name | quote }}
+          {{- toYaml $volume.volumeMount  | nindent 10 }}
+        {{- end }}
+        {{- include "web-application.internal.serviceMounts" $ | nindent 8 }}
+        {{- if $sidecar.resources }}
+        resources:
+          {{- toYaml $sidecar.resources | nindent 10 }}
+        {{- end }}
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          privileged: false
+          runAsNonRoot: true
+          {{- if $sidecar.runAsUser }}
+          runAsUser: {{ $sidecar.runAsUser }}
+          {{- end }}
+          readOnlyRootFilesystem: {{ $.Values.readOnlyRootFilesystem | default false }}
+          seccompProfile:
+            type: RuntimeDefault
+      {{- end }}
       restartPolicy: Always
       terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
-      securityContext:
-        runAsNonRoot: true
       topologySpreadConstraints:
       {{- range $constraint := .Values.availability.topologySpreadConstraints }}
       - labelSelector:
-          matchLabels: {{- include "web-application.internal.selectorLabels" $ | nindent 12 }}
+          matchLabels: {{- include "web-application.selectorLabels" $ | nindent 12 }}
         maxSkew: {{ $constraint.maxSkew }}
         topologyKey: {{ $constraint.topologyKey }}
         whenUnsatisfiable: {{ $constraint.whenUnsatisfiable }}

package/lib/init/template/helm/subcharts/web-application/templates/network-policy.yaml

@@ -2,8 +2,8 @@
 kind: NetworkPolicy
 apiVersion: networking.k8s.io/v1
 metadata:
-  name: {{ include "web-application.internal.fullname" . }}
-  labels: {{- include "web-application.internal.labels" . | nindent 4 }}
+  name: {{ include "web-application.fullname" . }}
+  labels: {{- include "web-application.labels" . | nindent 4 }}
 spec:
   ingress:
 {{- if .Values.expose.enabled }}
@@ -22,6 +22,22 @@ spec:
         port: {{ $port }}
       {{- end }}
 {{- end }}
+{{- if .Values.prometheus.enabled }}
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kyma-system
+    ports:
+      - protocol: TCP
+        port: {{ .Values.prometheus.port | default .Values.port }}
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kyma-system
+    ports:
+      - protocol: TCP
+        port: 15090
+{{- end }}
 {{- if .Values.networkSecurity.allowNamespaceInternal }}
   - from:
     - podSelector: {}
@@ -58,5 +74,5 @@ spec:
   policyTypes:
   - Ingress
   podSelector:
-    matchLabels: {{- include "web-application.internal.selectorLabels" . | nindent 6 }}
+    matchLabels: {{- include "web-application.selectorLabels" . | nindent 6 }}
 {{- end }}

package/lib/init/template/helm/subcharts/web-application/templates/pod-disruption-budget.yaml

@@ -1,9 +1,9 @@
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
-  name: {{ include "web-application.internal.fullname" . }}
-  labels: {{- include "web-application.internal.labels" . | nindent 4 }}
+  name: {{ include "web-application.fullname" . }}
+  labels: {{- include "web-application.labels" . | nindent 4 }}
 spec:
   maxUnavailable: {{ .Values.availability.podDisruptionBudget.maxUnavailable }}
   selector:
-    matchLabels: {{- include "web-application.internal.selectorLabels" . | nindent 6 }}
+    matchLabels: {{- include "web-application.selectorLabels" . | nindent 6 }}

package/lib/init/template/helm/subcharts/web-application/templates/rbac.yaml

@@ -0,0 +1,26 @@
+---
+{{- if .Values.rbac.rules }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels: {{- include "web-application.labels" . | nindent 4 }}
+  name: {{ include "web-application.fullname" . }}
+rules:
+{{- .Values.rbac.rules | toYaml | nindent 2}}
+---
+{{- end }}
+{{- if or .Values.rbac.rules .Values.rbac.role .Values.rbac.clusterRole }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels: {{- include "web-application.labels" . | nindent 4 }}
+  name: {{ include "web-application.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ tpl (default (include "web-application.fullname" .) .Values.serviceAccountName) . }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: {{ ternary "Role" "ClusterRole" (empty .Values.rbac.clusterRole) }}
+  name: {{ tpl (default (include "web-application.fullname" .) (default .Values.rbac.role .Values.rbac.clusterRole)) . }}
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}

package/lib/init/template/helm/subcharts/web-application/templates/secret.yaml

@@ -4,7 +4,7 @@ kind: Secret
 type: kubernetes.io/dockerconfigjson
 metadata:
   name: {{ include "web-application.internal.imagePullSecretName" . }}
-  labels: {{- include "web-application.internal.labels" . | nindent 4 }}
+  labels: {{- include "web-application.labels" . | nindent 4 }}
 data:
   .dockerconfigjson: {{ default .Values.global.imagePullSecret.dockerconfigjson .Values.imagePullSecret.dockerconfigjson }}
 {{- end }}

package/lib/init/template/helm/subcharts/web-application/templates/service-account.yaml

@@ -2,5 +2,5 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ include "web-application.internal.fullname" . }}
+  name: {{ include "web-application.fullname" . }}
 {{- end }}

package/lib/init/template/helm/subcharts/web-application/templates/service-binding.yaml

@@ -8,7 +8,7 @@ apiVersion: services.cloud.sap.com/v1
 kind: ServiceBinding
 metadata:
   name: {{ include "web-application.internal.bindingName" (dict "root" $ "name" $name) }}
-  labels: {{- include "web-application.internal.labels" $ | nindent 4 }}
+  labels: {{- include "web-application.labels" $ | nindent 4 }}
 spec:
   serviceInstanceName: {{include "web-application.internal.serviceInstanceName" (dict "binding" $mergedParams "root" $) }}
   secretKey: credentials

package/lib/init/template/helm/subcharts/web-application/templates/service.yaml

@@ -1,11 +1,29 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "web-application.internal.fullname" . }}
-  labels: {{- include "web-application.internal.labels" . | nindent 4 }}
+  name: {{ include "web-application.fullname" . }}
+  labels: {{- include "web-application.labels" . | nindent 4 }}
 spec:
   ports:
     - port: {{ .Values.port }}
       targetPort: {{ .Values.port }}
       protocol: TCP
-  selector: {{- include "web-application.internal.selectorLabels" . | nindent 4 }}
+  selector: {{- include "web-application.selectorLabels" . | nindent 4 }}
+{{- if .Values.prometheus.enabled }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "web-application.fullname" . }}-metrics
+  labels: {{- include "web-application.labels" . | nindent 4 }}
+  annotations:
+    prometheus.io/scrape: "true"
+    prometheus.io/path: {{ .Values.prometheus.path }}
+    prometheus.io/port: {{ .Values.prometheus.port | default .Values.port | quote }}
+spec:
+  ports:
+    - port: {{ .Values.prometheus.port | default .Values.port }}
+      targetPort: {{ .Values.prometheus.port | default .Values.port }}
+      protocol: TCP
+  selector: {{- include "web-application.selectorLabels" . | nindent 4 }}
+{{- end }}

package/lib/init/template/helm/subcharts/web-application/templates/virtual-service.yaml

@@ -0,0 +1,36 @@
+{{- if include "web-application.internal.TENANT_HOST_PATTERN" . -}}
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: {{ include "web-application.fullname" . }}-multitenancy
+  labels: {{- include "web-application.labels" . | nindent 4 }}
+spec:
+  gateways:
+    - {{ tpl (default .Values.expose.gateway .Values.expose.tenantGateway) $ }}
+  hosts:
+    - "*"
+  http:
+    - corsPolicy:
+        allowHeaders:
+          - Authorization
+          - Content-Type
+          - "*"
+        allowMethods:
+          - GET
+          - POST
+          - PUT
+          - DELETE
+          - PATCH
+        allowOrigins:
+          - regex: .*
+      match:
+        - uri:
+            regex: /.*
+          headers:
+            Host:
+              regex: {{ tpl (include "web-application.internal.TENANT_HOST_PATTERN" .) . }}
+      route:
+        - weight: 100
+          destination:
+            host: "{{ include "web-application.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local"
+{{- end }}