@sap/cds-dk 7.3.0 → 7.3.2

package/lib/init/template/helm/subcharts/service-instance/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
-name: service-instance
 description: A Helm chart for creating service instances on btp-service-operator
-type: application
-version: 0.1.0
+name: service-instance
 sources:
-- "https://github.tools.sap/unified-runtime/service-instance"
+- https://github.tools.sap/unified-runtime/service-instance
+type: application
+version: 1.1.1

package/lib/init/template/helm/subcharts/service-instance/templates/serviceinstance.yaml

@@ -16,7 +16,7 @@ spec:
   {{- if or .Values.parameters .Values.jsonParameters }}
   {{- $parameters := .Values.parameters | default (dict) }}
   {{- $jsonParameters := .Values.jsonParameters | default "{}" }}
-  parameters: {{- $jsonParameters | fromJson | merge $parameters | toYaml | nindent 4 }}
+  parameters: {{- tpl ($jsonParameters | fromJson | merge $parameters | toYaml) $ | nindent 4 }}
   {{- end }}
   {{- if .Values.parametersFrom }}
   parametersFrom: {{ tpl (.Values.parametersFrom | toYaml) $ | nindent 4}}

package/lib/init/template/helm/subcharts/service-instance/values.schema.json

@@ -11,45 +11,35 @@
         "global": {
             "$id": "#/properties/global",
             "type": "object",
-            "title": "Helm global values",
-            "description": "For more information, see https://helm.sh/docs/chart_template_guide/subcharts_and_globals/#global-chart-values",
             "x-ignore-untested": true
         },
         "nameOverride": {
             "$id": "#/properties/nameOverride",
-            "title": "Chart name override",
-            "description": "Will be used instead of the `.Chart.Name`, e.g. when generating the Deployment name.",
             "type": "string",
             "pattern": "[0-9a-z][0-9a-z-.]*"
         },
         "fullnameOverride": {
             "$id": "#/properties/fullnameOverride",
-            "title": "Override for the `.fullname` helper function.",
-            "description": "Will be used as an override for the `.fullname` helper function (i.e. `.Release.Name-.Chart.Name`).",
             "type": "string",
             "pattern": "[0-9a-z][0-9a-z-.]*"
         },
         "serviceOfferingName": {
             "$id": "#/properties/serviceOfferingName",
-            "description": "The name of the SAP BTP service offering.",
             "type": "string",
             "pattern": "[0-9a-z][0-9a-z-.]*"
         },
         "servicePlanName": {
             "$id": "#/properties/servicePlanName",
-            "description": "The plan to use for the service instance.",
             "type": "string",
             "pattern": "[0-9a-z][0-9a-z-.]*"
         },
         "externalName": {
             "$id": "#/properties/externalName",
-            "description": "The name for the service instance in SAP BTP.",
             "type": "string",
             "pattern": "[0-9a-z][0-9a-z-.]*"
         },
         "customTags": {
             "$id": "#/properties/customTags",
-            "description": "List of custom tags describing the ServiceInstance, will be copied to `ServiceBinding` secret in the key called `tags`.",
             "type": "array",
             "uniqueItems": true,
             "items": {
@@ -58,27 +48,22 @@
         },
         "parameters": {
             "$id": "#/properties/parameters",
-            "description": "Some services support the provisioning of additional configuration parameters. For the list of supported parameters, check the documentation of the particular service offering.",
             "type": "object"
         },
         "jsonParameters": {
             "$id": "#/properties/jsonParameters",
-            "description": "Some services support the provisioning of additional configuration parameters. For the list of supported parameters, check the documentation of the particular service offering.",
             "type": "string"
         },
         "parametersFrom": {
             "$id": "#/properties/parametersFrom",
-            "description": "List of sources to populate parameters.",
             "type": "array",
             "uniqueItems": true,
             "items": {
                 "type": "object",
-                "description": "Kubernetes Secret as a parameters source.",
                 "additionalProperties": false,
                 "properties": {
                     "secretKeyRef": {
                         "type": "object",
-                        "description": "Kubernetes Secret as a parameters source.",
                         "additionalProperties": false,
                         "required": [
                             "name",
@@ -86,11 +71,9 @@
                         ],
                         "properties": {
                             "name": {
-                                "description": "Name of a Secret.",
                                 "type": "string"
                             },
                             "key": {
-                                "description": "Key in that Secret, which contains a string that represents the json to include in the set of parameters to be sent to the broker.",
                                 "type": "string"
                             }
                         }

package/lib/init/template/helm/subcharts/service-instance/values.yaml

@@ -1,15 +1,43 @@
+# Will be used instead of the `.Chart.Name`, e.g. when generating the Deployment name.
+# nameOverride: foo
+
+# Will be used as an override for the `.fullname` helper function (i.e. `.Release.Name-.Chart.Name`).
+# fullnameOverride: foo
+
+# The name of the SAP BTP service offering.
 # serviceOfferingName: feature-flags
+
+# The plan to use for the service instance.
 # servicePlanName: plan-name
+
+# The name for the service instance in SAP BTP.
 # externalName: feature-flags-test
+
+# List of custom tags describing the ServiceInstance, will be copied to `ServiceBinding` secret in the key called `tags`.
 # customTags:
 #   - foo
 #   - bar
+
+# Some services support the provisioning of additional configuration parameters. For the list of supported parameters, check the documentation of the particular service offering.
 # parameters:
 #   key: val
+
+# Some services support the provisioning of additional configuration parameters. For the list of supported parameters, check the documentation of the particular service offering.
+# jsonParameters: {}
+
+# Kubernetes Secret as a parameters source.
 # parametersFrom:
+# https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#define-container-environment-variables-using-secret-data
 #   - secretKeyRef:
 #       name: my-secret
 #       key: secret-parameter
+# https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#define-container-environment-variables-using-configmap-data
 #   - configMapKeyRef:
 #       name: my-cm
 #       key: cm-parameter
+global:
+  sap:
+    _internal:
+      service-instance:
+        versions:
+          1.1.1: true

package/lib/init/template/helm/subcharts/web-application/Chart.yaml

@@ -1,8 +1,8 @@
 apiVersion: v2
-name: web-application
 description: A Helm chart for web app
-kubeVersion: ">= 1.21"
-type: application
-version: 0.1.0
+kubeVersion: '>= 1.21'
+name: web-application
 sources:
-- "https://github.tools.sap/unified-runtime/web-application"
+- https://github.tools.sap/unified-runtime/web-application
+type: application
+version: 1.8.0

package/lib/init/template/helm/subcharts/web-application/templates/_api.tpl

@@ -0,0 +1,60 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "web-application.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "web-application.fullname" -}}
+  {{- if .Values.fullnameOverride }}
+    {{- if gt (len .Values.fullnameOverride) 63 }}
+      {{- fail (printf "name exceeds 63 characters: '%s'" .Values.fullnameOverride) }}
+    {{- end }}
+    {{- .Values.fullnameOverride }}
+  {{- else }}
+    {{- $name := default .Chart.Name .Values.nameOverride }}
+    {{- if not (eq .Release.Name $name)}}
+      {{- $name = printf "%s-%s" .Release.Name $name }}
+    {{- end }}
+    {{- if gt (len $name) 63 }}
+      {{- fail (printf "name exceeds 63 characters: '%s'" $name) }}
+    {{- end }}
+    {{- $name }}
+  {{- end }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "web-application.labels" -}}
+helm.sh/revision: {{ .Release.Revision | quote }}
+helm.sh/chart: {{ include "web-application.internal.chart" . }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{ include "web-application.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "web-application.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "web-application.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- if .Values.global}}
+{{- if .Values.global.component }}
+app.kubernetes.io/component:{{ .Values.global.component }}
+{{- end }}
+{{- if .Values.global.partOf }}
+app.kubernetes.io/partOf: {{ .Values.global.partOf }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+

package/lib/init/template/helm/subcharts/web-application/templates/_helpers.tpl

@@ -1,37 +1,9 @@
-{{/*
-Expand the name of the chart.
-*/}}
-{{- define "web-application.internal.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
-{{- end }}
 
-{{/*
-Create a default fully qualified app name.
-We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
-If release name contains chart name it will be used as a full name.
-*/}}
-{{- define "web-application.internal.fullname" -}}
-  {{- if .Values.fullnameOverride }}
-    {{- if gt (len .Values.fullnameOverride) 63 }}
-      {{- fail (printf "name exceeds 63 characters: '%s'" .Values.fullnameOverride) }}
-    {{- end }}
-    {{- .Values.fullnameOverride }}
-  {{- else }}
-    {{- $name := default .Chart.Name .Values.nameOverride }}
-    {{- if not (eq .Release.Name $name)}}
-      {{- $name = printf "%s-%s" .Release.Name $name }}
-    {{- end }}
-    {{- if gt (len $name) 63 }}
-      {{- fail (printf "name exceeds 63 characters: '%s'" $name) }}
-    {{- end }}
-    {{- $name }}
-  {{- end }}
-{{- end }}
 
 {{/*
 */}}
 {{- define "web-application.internal.bindingName" -}}
-{{- printf "%s-%s" (include "web-application.internal.fullname" .root ) .name }}
+{{- printf "%s-%s" (include "web-application.fullname" .root ) .name }}
 {{- end }}
 
 {{/*
@@ -41,35 +13,6 @@ Create chart name and version as used by the chart label.
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
-{{/*
-Common labels
-*/}}
-{{- define "web-application.internal.labels" -}}
-helm.sh/revision: {{ .Release.Revision | quote }}
-helm.sh/chart: {{ include "web-application.internal.chart" . }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{ include "web-application.internal.selectorLabels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "web-application.internal.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "web-application.internal.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- if .Values.global}}
-{{- if .Values.global.component }}
-app.kubernetes.io/component:{{ .Values.global.component }}
-{{- end }}
-{{- if .Values.global.partOf }}
-app.kubernetes.io/partOf: {{ .Values.global.partOf }}
-{{- end }}
-{{- end }}
-{{- end }}
-
 {{/*
 Define Host for the APIRule
 */}}
@@ -77,7 +20,7 @@ Define Host for the APIRule
 {{- if .Values.expose.host }}
 {{- tpl .Values.expose.host . }}
 {{- else }}
-{{- $name := (include "web-application.internal.fullname" .) }}
+{{- $name := (include "web-application.fullname" .) }}
 {{- if hasPrefix $name .Release.Namespace }}
 {{- .Release.Namespace }}
 {{- else }}
@@ -87,10 +30,29 @@ Define Host for the APIRule
 {{- end }}
 
 {{/*
-Define the application uri which will be used for the VCAP_APPLICATION env variable
+Returns the TENANT_HOST_PATTERN if defined
+*/}}
+{{- define "web-application.internal.TENANT_HOST_PATTERN" -}}
+{{- if .Values.env }}
+  {{- if (kindIs "map" .Values.env) }}
+    {{- if (hasKey .Values.env "TENANT_HOST_PATTERN")  }}
+      {{-  .Values.env.TENANT_HOST_PATTERN }}
+    {{- end }}
+  {{- else }}
+    {{- range $i, $item := .Values.env }}
+      {{- if eq $item.name "TENANT_HOST_PATTERN"}}
+        {{- $item.value }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Define the application uri to be used for the VCAP_APPLICATION env variable
 */}}
 {{- define "web-application.internal.applicationUri" -}}
-{{- include "web-application.internal.fullname" . }}
+{{- include "web-application.fullname" . }}
 {{- end }}
 
 {{/*
@@ -133,7 +95,9 @@ Name of the imagePullSecret
 {{- else if $ips.global.name }}
 {{- $ips.global.name }}
 {{- else if or $ips.local.dockerconfigjson $ips.global.dockerconfigjson }}
-{{- include "web-application.internal.fullname" . }}
+{{- include "web-application.fullname" . }}
+{{- else }}
+{{- "image-pull-secret" }}
 {{- end }}
 {{- end }}
 
@@ -141,12 +105,12 @@ Name of the imagePullSecret
 Calculate the final image name
 */}}
 {{- define "web-application.internal.imageName" -}}
-{{- $tag := .Values.image.tag | default .Values.global.image.tag | default "latest" }}
-{{- $registry := .Values.image.registry | default .Values.global.image.registry }}
+{{- $tag := .image.tag | default .context.Values.global.image.tag | default "latest" }}
+{{- $registry := .image.registry | default .context.Values.global.image.registry }}
 {{- if $registry }}
-{{- $registry | trimSuffix "/" }}/{{ .Values.image.repository }}:{{ $tag }}
+{{- $registry | trimSuffix "/" | trimPrefix "https://" }}/{{ .image.repository | trimSuffix "/" }}:{{ $tag }}
 {{- else }}
-{{- .Values.image.repository }}:{{ $tag }}
+{{- .image.repository | trimSuffix "/" | trimPrefix "https://" }}:{{ $tag }}
 {{- end }}
 {{- end }}
 
@@ -177,18 +141,15 @@ If release name contains chart name it will be used as service instance name.
 {{- define "web-application.internal.processEnv" -}}
 {{- $result := dict }}
 {{- $variables := list }}
-{{- range $k, $v := .Values.env }}
+{{- range $k, $v := .env }}
   {{- $variable := dict }}
   {{/*
     We support two versions to provide environment variables: as an array and as a map
-
     env:
     - name: TEST
       value: X
-
     env:
       TEST: X
-
     Transform the map case into the array case:
   */}}
   {{- if (not (kindIs "map" $v)) }}
@@ -216,15 +177,15 @@ If release name contains chart name it will be used as service instance name.
   {{- $variables = append $variables $variable}}
 {{- end }}
 {{- $_ := set $result "vars" $variables }}
- {{- (fromYaml (tpl (toYaml $result) $)) | mustToJson }}
+ {{- (fromYaml (tpl (toYaml $result) .context)) | mustToJson }}
 {{- end }}
 
 {{- define "web-application.internal.processEnvFrom" -}}
 {{- $result := dict }}
 {{- $variables := list }}
-{{- range $envFrom := .Values.envFrom }}
+{{- range $envFrom := .envFrom }}
   {{- $variables = append $variables $envFrom }}
 {{- end }}
 {{- $_ := set $result "vars" $variables }}
-{{- (fromYaml (tpl (toYaml $result) $)) | mustToJson }}
+{{- (fromYaml (tpl (toYaml $result) .context)) | mustToJson }}
 {{- end }}

package/lib/init/template/helm/subcharts/web-application/templates/api-rule.yaml

@@ -2,13 +2,13 @@
 apiVersion: gateway.kyma-project.io/v1beta1
 kind: APIRule
 metadata:
-  name: {{ include "web-application.internal.fullname" . }}
-  labels: {{- include "web-application.internal.labels" . | nindent 4 }}
+  name: {{ include "web-application.fullname" . }}
+  labels: {{- include "web-application.labels" . | nindent 4 }}
 spec:
-  gateway: {{ .Values.expose.gateway }}
+  gateway: {{tpl .Values.expose.gateway $ }}
   host: {{ include "web-application.internal.exposeHost" . }}
   service:
-    name: {{ include "web-application.internal.fullname" . }}
+    name: {{ include "web-application.fullname" . }}
     port: {{ .Values.port }}
   rules:
     {{- toYaml .Values.expose.rules | nindent 6 }}

package/lib/init/template/helm/subcharts/web-application/templates/deployment.yaml

@@ -1,33 +1,46 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  labels: {{- include "web-application.internal.labels" . | nindent 4 }}
-  name: {{ include "web-application.internal.fullname" . }}
+  name: {{ include "web-application.fullname" . }}
+  labels: {{- include "web-application.labels" . | nindent 4 }}
+  {{- if or .Values.annotations.deployment }}
+  annotations:
+  {{- tpl (toYaml .Values.annotations.deployment) $ | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.replicaCount }}
   selector:
-    matchLabels: {{- include "web-application.internal.selectorLabels" . | nindent 6 }}
+    matchLabels: {{- include "web-application.selectorLabels" . | nindent 6 }}
   template:
     metadata:
-      labels: {{- include "web-application.internal.selectorLabels" . | nindent 8 }}
+      labels: {{- include "web-application.selectorLabels" . | nindent 8 }}
+      {{- if .Values.istio }}
+        sidecar.istio.io/inject: {{ .Values.istio.enabled | quote }}
+      {{ end }}
       annotations:
-        container.apparmor.security.beta.kubernetes.io/{{ include "web-application.internal.name" . }}: runtime/default
+        container.apparmor.security.beta.kubernetes.io/{{ include "web-application.name" . }}: runtime/default
+        {{- if or .Values.annotations.deployment }}
+        {{- tpl (toYaml .Values.annotations.deployment) $ | nindent 8 }}
+        {{- end }}
     spec:
       {{- if (include "web-application.internal.imagePullSecretName" .) }}
       imagePullSecrets:
         - name: {{ include "web-application.internal.imagePullSecretName" . }}
       {{- end }}
-      automountServiceAccountToken: false
-      serviceAccountName: {{ tpl (.Values.serviceAccountName | default (include "web-application.internal.fullname" .)) $ }}
+      automountServiceAccountToken: {{ ternary false true (empty (or .Values.rbac.rules .Values.rbac.role .Values.rbac.clusterRole)) }}
+      serviceAccountName: {{ tpl (.Values.serviceAccountName | default (include "web-application.fullname" .)) $ }}
       containers:
-      - image: {{ include "web-application.internal.imageName" . }}
-        name: {{ include "web-application.internal.name" . }}
+      - image: {{ include "web-application.internal.imageName" (dict "image" .Values.image "context" $) }}
+      {{- if ( or .Values.global.imagePullPolicy .Values.imagePullPolicy ) }}
+        imagePullPolicy: {{ .Values.imagePullPolicy |  default .Values.global.imagePullPolicy }}
+      {{- end }}
+        name: {{ include "web-application.name" . }}
         ports:
         - name: http
           containerPort: {{ .Values.port }}
           protocol: TCP
         envFrom:
-        {{- $envFromVars := (include "web-application.internal.processEnvFrom" . | fromJson) }}
+        {{- $envFromVars := (include "web-application.internal.processEnvFrom" (dict "envFrom" .Values.envFrom "context" $) | fromJson) }}
         {{- if not (eq (len $envFromVars.vars) 0) }}
         {{- $envFromVars.vars | toYaml | nindent 8}}
         {{- end }}
@@ -38,18 +51,26 @@ spec:
           value: {{ .Values.port | quote }}
         - name: TMPDIR
           value: /tmp
-        {{- $envVars := (include "web-application.internal.processEnv" $ | fromJson) }}
-        {{- if not (eq (len $envVars.vars) 0) }}
-        {{- $envVars.vars | toYaml | nindent 8}}
+        {{- if .Values.otlp.traces.enabled }}
+        - name: OTEL_EXPORTER_OTLP_TRACES_ENDPOINT
+          value: {{ .Values.otlp.traces.endpoint }}
+        {{- end }}
+        {{- if .Values.otlp.metrics.enabled }}
+        - name: OTEL_EXPORTER_OTLP_METRICS_ENDPOINT
+          value: {{ .Values.otlp.metrics.endpoint }}
         {{- end }}
+        {{- $envVars := (include "web-application.internal.processEnv" (dict "env" .Values.env "context" $) | fromJson) }}
         {{- if not $envVars.appName}}
         - name: APPLICATION_NAME
-          value: {{ include "web-application.internal.fullname" . }}
+          value: {{ include "web-application.fullname" . }}
         {{- end }}
         {{- if not $envVars.appURI}}
         - name: APPLICATION_URI
           value: {{ include "web-application.internal.applicationUri" . }}
         {{- end }}
+        {{- if not (eq (len $envVars.vars) 0) }}
+        {{- $envVars.vars | toYaml | nindent 8}}
+        {{- end }}
         livenessProbe:
         {{- if .Values.health.liveness.path }}
           httpGet:
@@ -97,17 +118,75 @@ spec:
             drop:
             - ALL
           privileged: false
+          runAsNonRoot: true
+          {{- if .Values.runAsUser }}
+          runAsUser: {{ .Values.runAsUser }}
+          {{- end }}
           readOnlyRootFilesystem: {{ .Values.readOnlyRootFilesystem | default false }}
           seccompProfile:
             type: RuntimeDefault
+      {{- range $key, $sidecar := .Values.sidecars }}
+      - image: {{ include "web-application.internal.imageName" (dict "image" $sidecar.image "context" $) }}
+      {{- if ( or $.Values.global.imagePullPolicy $sidecar.imagePullPolicy ) }}
+        imagePullPolicy: {{ $sidecar.imagePullPolicy |  default $.Values.global.imagePullPolicy }}
+      {{- end }}
+        name: {{ $key }}
+        envFrom:
+        {{- $envFromVars := (include "web-application.internal.processEnvFrom" (dict "envFrom" $sidecar.envFrom "context" $) | fromJson) }}
+        {{- if not (eq (len $envFromVars.vars) 0) }}
+        {{- $envFromVars.vars | toYaml | nindent 8}}
+        {{- end }}
+        env:
+        - name: SERVICE_BINDING_ROOT
+          value: /bindings
+        - name: TMPDIR
+          value: /tmp
+        {{- if $.Values.otlp.traces.enabled }}
+        - name: OTEL_EXPORTER_OTLP_TRACES_ENDPOINT
+          value: {{ $.Values.otlp.traces.endpoint }}
+        {{- end }}
+        {{- if $.Values.otlp.metrics.enabled }}
+        - name: OTEL_EXPORTER_OTLP_METRICS_ENDPOINT
+          value: {{ $.Values.otlp.metrics.endpoint }}
+        {{- end }}
+        {{- $envVars := (include "web-application.internal.processEnv" (dict "env" $sidecar.env "context" $) | fromJson) }}
+        {{- if not (eq (len $envVars.vars) 0) }}
+        {{- $envVars.vars | toYaml | nindent 8}}
+        {{- end }}
+        volumeMounts:
+        - name: tmp
+          mountPath: /tmp
+        - name: bindings-root
+          mountPath: /bindings
+        {{- range $volume := $.Values.additionalVolumes }}
+        - name: {{ $volume.name | quote }}
+          {{- toYaml $volume.volumeMount  | nindent 10 }}
+        {{- end }}
+        {{- include "web-application.internal.serviceMounts" $ | nindent 8 }}
+        {{- if $sidecar.resources }}
+        resources:
+          {{- toYaml $sidecar.resources | nindent 10 }}
+        {{- end }}
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          privileged: false
+          runAsNonRoot: true
+          {{- if $sidecar.runAsUser }}
+          runAsUser: {{ $sidecar.runAsUser }}
+          {{- end }}
+          readOnlyRootFilesystem: {{ $.Values.readOnlyRootFilesystem | default false }}
+          seccompProfile:
+            type: RuntimeDefault
+      {{- end }}
       restartPolicy: Always
       terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
-      securityContext:
-        runAsNonRoot: true
       topologySpreadConstraints:
       {{- range $constraint := .Values.availability.topologySpreadConstraints }}
       - labelSelector:
-          matchLabels: {{- include "web-application.internal.selectorLabels" $ | nindent 12 }}
+          matchLabels: {{- include "web-application.selectorLabels" $ | nindent 12 }}
         maxSkew: {{ $constraint.maxSkew }}
         topologyKey: {{ $constraint.topologyKey }}
         whenUnsatisfiable: {{ $constraint.whenUnsatisfiable }}

package/lib/init/template/helm/subcharts/web-application/templates/network-policy.yaml

@@ -2,8 +2,8 @@
 kind: NetworkPolicy
 apiVersion: networking.k8s.io/v1
 metadata:
-  name: {{ include "web-application.internal.fullname" . }}
-  labels: {{- include "web-application.internal.labels" . | nindent 4 }}
+  name: {{ include "web-application.fullname" . }}
+  labels: {{- include "web-application.labels" . | nindent 4 }}
 spec:
   ingress:
 {{- if .Values.expose.enabled }}
@@ -22,6 +22,22 @@ spec:
         port: {{ $port }}
       {{- end }}
 {{- end }}
+{{- if .Values.prometheus.enabled }}
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kyma-system
+    ports:
+      - protocol: TCP
+        port: {{ .Values.prometheus.port | default .Values.port }}
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kyma-system
+    ports:
+      - protocol: TCP
+        port: 15090
+{{- end }}
 {{- if .Values.networkSecurity.allowNamespaceInternal }}
   - from:
     - podSelector: {}
@@ -58,5 +74,5 @@ spec:
   policyTypes:
   - Ingress
   podSelector:
-    matchLabels: {{- include "web-application.internal.selectorLabels" . | nindent 6 }}
+    matchLabels: {{- include "web-application.selectorLabels" . | nindent 6 }}
 {{- end }}

package/lib/init/template/helm/subcharts/web-application/templates/pod-disruption-budget.yaml

@@ -1,9 +1,9 @@
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
-  name: {{ include "web-application.internal.fullname" . }}
-  labels: {{- include "web-application.internal.labels" . | nindent 4 }}
+  name: {{ include "web-application.fullname" . }}
+  labels: {{- include "web-application.labels" . | nindent 4 }}
 spec:
   maxUnavailable: {{ .Values.availability.podDisruptionBudget.maxUnavailable }}
   selector:
-    matchLabels: {{- include "web-application.internal.selectorLabels" . | nindent 6 }}
+    matchLabels: {{- include "web-application.selectorLabels" . | nindent 6 }}