Merge branch 'main' into feature/get-dc-and-workspaces-by-id

charts/ror-webapp/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: ror-webapp
-description: ROR web
+description: ROR webapp
 
 type: application
 version: 0.1.0

charts/ror-webapp/templates/NOTES.txt

@@ -6,16 +6,16 @@
   {{- end }}
 {{- end }}
 {{- else if contains "NodePort" .Values.service.type }}
-  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "ror-admin.fullname" . }})
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "ror-webapp.fullname" . }})
   export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
   echo http://$NODE_IP:$NODE_PORT
 {{- else if contains "LoadBalancer" .Values.service.type }}
      NOTE: It may take a few minutes for the LoadBalancer IP to be available.
-           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "ror-admin.fullname" . }}'
-  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "ror-admin.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "ror-webapp.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "ror-webapp.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
   echo http://$SERVICE_IP:{{ .Values.service.port }}
 {{- else if contains "ClusterIP" .Values.service.type }}
-  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "ror-admin.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "ror-webapp.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
   export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
   echo "Visit http://127.0.0.1:8080 to use your application"
   kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT

charts/ror-webapp/templates/_helpers.tpl

@@ -1,7 +1,7 @@
 {{/*
 Expand the name of the chart.
 */}}
-{{- define "ror-admin.name" -}}
+{{- define "ror-webapp.name" -}}
 {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
@@ -10,7 +10,7 @@ Create a default fully qualified app name.
 We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
 If release name contains chart name it will be used as a full name.
 */}}
-{{- define "ror-admin.fullname" -}}
+{{- define "ror-webapp.fullname" -}}
 {{- if .Values.fullnameOverride }}
 {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
 {{- else }}
@@ -26,16 +26,16 @@ If release name contains chart name it will be used as a full name.
 {{/*
 Create chart name and version as used by the chart label.
 */}}
-{{- define "ror-admin.chart" -}}
+{{- define "ror-webapp.chart" -}}
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
 {{/*
 Common labels
 */}}
-{{- define "ror-admin.labels" -}}
-helm.sh/chart: {{ include "ror-admin.chart" . }}
-{{ include "ror-admin.selectorLabels" . }}
+{{- define "ror-webapp.labels" -}}
+helm.sh/chart: {{ include "ror-webapp.chart" . }}
+{{ include "ror-webapp.selectorLabels" . }}
 {{- if .Chart.AppVersion }}
 app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 {{- end }}
@@ -45,17 +45,17 @@ app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{/*
 Selector labels
 */}}
-{{- define "ror-admin.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "ror-admin.name" . }}
+{{- define "ror-webapp.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "ror-webapp.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
 
 {{/*
 Create the name of the service account to use
 */}}
-{{- define "ror-admin.serviceAccountName" -}}
+{{- define "ror-webapp.serviceAccountName" -}}
 {{- if .Values.serviceAccount.create }}
-{{- default (include "ror-admin.fullname" .) .Values.serviceAccount.name }}
+{{- default (include "ror-webapp.fullname" .) .Values.serviceAccount.name }}
 {{- else }}
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}

charts/ror-webapp/templates/configmap.yaml

@@ -1,13 +1,13 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: ror-web-cm-config
+  name: {{ include "ror-webapp.fullname" . }}-cm-config
 data:
   config.json: |
     {
       "auth": {
           "issuer": "{{ .Values.web.authUrl }}",
-          "clientId": "ror.sky.test.nhn.no",
+          "clientId": "{{ .Values.web.authClientId}}",
           "redirectUri": "/auth/callback",
           "scope": "profile email groups",
           "response_type": "id_token token",

charts/ror-webapp/templates/deployment.yaml

@@ -1,31 +1,31 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "ror-admin.fullname" . }}
+  name: {{ include "ror-webapp.fullname" . }}
   labels:
-    {{- include "ror-admin.labels" . | nindent 4 }}
+    {{- include "ror-webapp.labels" . | nindent 4 }}
 spec:
   {{- if not .Values.autoscaling.enabled }}
   replicas: {{ .Values.replicaCount }}
   {{- end }}
   revisionHistoryLimit: 2
   selector:
     matchLabels:
-      {{- include "ror-admin.selectorLabels" . | nindent 6 }}
+      {{- include "ror-webapp.selectorLabels" . | nindent 6 }}
   template:
     metadata:
       {{- with .Values.podAnnotations }}
       annotations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       labels:
-        {{- include "ror-admin.selectorLabels" . | nindent 8 }}
+        {{- include "ror-webapp.selectorLabels" . | nindent 8 }}
     spec:
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      serviceAccountName: {{ include "ror-admin.serviceAccountName" . }}
+      serviceAccountName: {{ include "ror-webapp.serviceAccountName" . }}
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
       containers:
@@ -38,6 +38,11 @@ spec:
             - mountPath: /app/assets/config/config.json
               name: json-configmap-volume
               subPath: config.json
+              {{- if .Values.web.nginxCM }}
+            - mountPath: /etc/nginx/conf.d/default.conf
+              name: nginx-cm
+              subPath: {{ .Values.web.nginxCM.subPath | default "default.conf"}}
+              {{- end }}
             - mountPath: /tmp
               name: tmp-volume
           ports:
@@ -69,6 +74,11 @@ spec:
       volumes:
         - name: json-configmap-volume
           configMap:
-            name: ror-web-cm-config
+            name: {{ include "ror-webapp.fullname" . }}-cm-config
+        {{- if .Values.web.nginxCM }}
+        - name: nginx-cm
+          configMap:
+            name: {{ .Values.web.nginxCM.name | default "nginx-cm" }}
+        {{- end }}
         - name: tmp-volume
           emptyDir: {}

charts/ror-webapp/templates/hpa.yaml

@@ -2,14 +2,14 @@
 apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
 metadata:
-  name: {{ include "ror-admin.fullname" . }}
+  name: {{ include "ror-webapp.fullname" . }}
   labels:
-    {{- include "ror-admin.labels" . | nindent 4 }}
+    {{- include "ror-webapp.labels" . | nindent 4 }}
 spec:
   scaleTargetRef:
     apiVersion: apps/v1
     kind: Deployment
-    name: {{ include "ror-admin.fullname" . }}
+    name: {{ include "ror-webapp.fullname" . }}
   minReplicas: {{ .Values.autoscaling.minReplicas }}
   maxReplicas: {{ .Values.autoscaling.maxReplicas }}
   metrics:
@@ -28,6 +28,6 @@ spec:
         target:
           type: Utilization
           averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
-        
+
     {{- end }}
 {{- end }}

charts/ror-webapp/templates/ingress-helsenett.yaml

@@ -3,48 +3,28 @@ kind: Ingress
 metadata:
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
-  name: admin-helsenett-ingress
+  name: {{ include "ror-webapp.fullname" . }}-ingress
 spec:
   ingressClassName: avi-ingress-class-helsenett
   rules:
-  - host: {{ .Values.web.host }}
-    http:
-      paths:
-      - backend:
-          service:
-            name: {{ include "ror-admin.fullname" . }}
-            port:
-              number: {{ .Values.service.port }}
-        path: {{ .Values.ingress.path }}
-        pathType: {{ .Values.ingress.pathType }}
+  {{- $outer := . -}}
+  {{- range $idx, $host := .Values.web.hosts }}
+  {{- with $outer }}
+    - host: {{ $host }}
+      http:
+        paths:
+        - backend:
+            service:
+              name: {{ include "ror-webapp.fullname" . }}
+              port:
+                number: {{ .Values.service.port }}
+          path: {{ .Values.ingress.path }}
+          pathType: {{ .Values.ingress.pathType }}
+  {{- end }}    
+  {{- end }}   
   tls:
-  - hosts:
-    - {{ .Values.web.host }}
-    secretName: nhn-ror-admin-tls
----
-apiVersion: ako.vmware.com/v1alpha1
-kind: HostRule
-metadata:
-  name: admin-allow-dcn-paw
-  namespace: {{ .Release.namespace}}
-spec:
-  virtualhost:
-    datascripts:
-    - expose-nhn-office-isp
-    - expose-nhn-office-client
-    - expose-nhn-office-devops
-    - expose-nsg-amk-paws
-    - expose-nhn-dc-any
-    - expose-nsg-cloud-paws
-    - expose-nsg-container-paws
-    - expose-nsg-soc-paws
-    - expose-nsg-mon-paws
-    - expose-nhn-office-devops
-    - expose-nsg-esm-paws
-    - bottom-deny-rule
-    fqdn:  ror.sky.test.nhn.no
-    analyticsProfile: NHN-System-Analytics-Profile
-    analyticsPolicy:
-        fullClientLogs:
-          enabled: false
-          throttle: DISABLED
+    - hosts:  
+  {{- range $idx, $host := .Values.web.hosts }}
+      - {{ $host }}
+  {{- end }}  
+      secretName: {{ include "ror-webapp.fullname" . }}-tls

charts/ror-webapp/templates/rolebinding.yaml

@@ -1,11 +1,11 @@
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ include "ror-admin.fullname" . }}-rolebindings
+  name: {{ include "ror-webapp.fullname" . }}-rolebindings
 roleRef:
   kind: ClusterRole
   name: psp:vmware-system-restricted #Kan erstattes med: "psp:vmware-system-privileged" for root access
   apiGroup: rbac.authorization.k8s.io
 subjects:
 - kind: ServiceAccount
-  name: {{ include "ror-admin.serviceAccountName" . }}
+  name: {{ include "ror-webapp.serviceAccountName" . }}

charts/ror-webapp/templates/service.yaml

@@ -1,9 +1,9 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "ror-admin.fullname" . }}
+  name: {{ include "ror-webapp.fullname" . }}
   labels:
-    {{- include "ror-admin.labels" . | nindent 4 }}
+    {{- include "ror-webapp.labels" . | nindent 4 }}
 spec:
   type: {{ .Values.service.type }}
   ports:
@@ -12,4 +12,4 @@ spec:
       protocol: TCP
       name: http
   selector:
-    {{- include "ror-admin.selectorLabels" . | nindent 4 }}
+    {{- include "ror-webapp.selectorLabels" . | nindent 4 }}

charts/ror-webapp/templates/serviceaccount.yaml

@@ -2,9 +2,9 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ include "ror-admin.serviceAccountName" . }}
+  name: {{ include "ror-webapp.serviceAccountName" . }}
   labels:
-    {{- include "ror-admin.labels" . | nindent 4 }}
+    {{- include "ror-webapp.labels" . | nindent 4 }}
   {{- with .Values.serviceAccount.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}

charts/ror-webapp/templates/tests/test-connection.yaml

@@ -1,15 +1,15 @@
 apiVersion: v1
 kind: Pod
 metadata:
-  name: "{{ include "ror-admin.fullname" . }}-test-connection"
+  name: "{{ include "ror-webapp.fullname" . }}-test-connection"
   labels:
-    {{- include "ror-admin.labels" . | nindent 4 }}
+    {{- include "ror-webapp.labels" . | nindent 4 }}
   annotations:
     "helm.sh/hook": test
 spec:
   containers:
     - name: wget
       image: busybox
       command: ['wget']
-      args: ['{{ include "ror-admin.fullname" . }}:{{ .Values.service.port }}']
+      args: ['{{ include "ror-webapp.fullname" . }}:{{ .Values.service.port }}']
   restartPolicy: Never

charts/ror-webapp/values.yaml

@@ -1,11 +1,22 @@
-# Default values for ror-admin.
+# Default values for ror-webapp.
 # This is a YAML-formatted file.
 # Declare variables to be passed into your templates.
 enabled: true
 web:
-  host: ror.sky.test.nhn.no
-  apiUrl: https://api.ror.sky.test.nhn.no
-  authUrl: https://auth.sky.nhn.no/dex
+  # hosts is a list of hosts that the webapp should be available on
+  hosts: 
+    - host.ror.io
+  # apiUrl is the url of the ror api
+  apiUrl: https://api.ror.io
+  # authUrl is the url of the auth server
+  authUrl: https://auth.ror.io/dex
+  # authClientId is the client id of the application registered in the auth server
+  authClientId: clientId
+  # ConfigMap for nginx
+  # nginxCM:
+  #   name: nginx-cm
+  #   subPath: default.conf
+  nginxCM: []
 replicaCount: 3
 image:
   repository: ghcr.io/norskhelsenett/ror-webapp

nginx/http_prod.conf

@@ -44,7 +44,6 @@ server {
 
     add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
     add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload';
-    add_header Expect-CT "max-age=86400, enforce, report-uri=\"https://ror.sky.test.nhn.no\"" always;
     add_header Referrer-Policy 'same-origin';
     add_header X-Content-Type-Options "nosniff" always;
     add_header X-XSS-Protection "0" always;

src/app/core/services/config.service.ts

@@ -69,7 +69,7 @@ export class ConfigService {
     if (environment.production) {
       config.auth.clientId = 'ror.sky.test.nhn.no';
       config.auth.issuer = 'https://auth.sky.nhn.no/dex';
-      config.rorApi = 'https://ror.sky.nhn.no';
+      config.rorApi = 'https://api.ror.nhn.no';
       config.auth.requireHttps = true;
       config.auth.strictDiscoveryDocumentValidation = true;
     }