-
Notifications
You must be signed in to change notification settings - Fork 18
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #191 from catenax-ng/release/v2.1.0-refactor-dpp-h…
…elm-template [ 8° ] - Release/v2.1.0 dpp helm template: Refactor dpp helm template
- Loading branch information
Showing
15 changed files
with
227 additions
and
36 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
| # digital-product-pass | ||
|
|
||
|    | ||
|    | ||
|
|
||
| A Helm chart for Tractus-X Digital Product Pass Kubernetes | ||
|
|
||
|
|
@@ -15,7 +15,7 @@ A Helm chart for Tractus-X Digital Product Pass Kubernetes | |
| | Key | Type | Default | Description | | ||
| |-----|------|---------|-------------| | ||
| | affinity | object | `{}` | | | ||
| | backend | object | `{"digitalTwinRegistry":{"endpoints":{"digitalTwin":"/shell-descriptors","search":"/lookup/shells","subModel":"/submodel-descriptors"},"temporaryStorage":{"enabled":true,"lifetime":12},"timeouts":{"digitalTwin":20,"negotiation":40,"search":10,"transfer":10}},"discovery":{"bpnDiscovery":{"key":"manufacturerPartId","path":"/api/v1.0/administration/connectors/bpnDiscovery/search"},"edcDiscovery":{"key":"bpn"},"hostname":""},"edc":{"apis":{"catalog":"/catalog/request","management":"/management/v2","negotiation":"/contractnegotiations","transfer":"/transferprocesses"},"delay":100,"hostname":"","participantId":"<Add participant id here>","xApiKey":"<Add API key here>"},"hostname":"localhost","image":{"pullPolicy":"Always","repository":"docker.io/tractusx/digital-product-pass-backend"},"imagePullSecrets":[],"ingress":{"enabled":false,"hosts":[{"host":"localhost","paths":[{"path":"/","pathType":"Prefix"}]}]},"irs":{"enabled":false,"hostname":""},"logging":{"level":{"root":"INFO","utils":"INFO"}},"maxRetries":5,"name":"dpp-backend","passport":{"aspects":["urn:bamm:io.catenax.generic.digital_product_passport:1.0.0#DigitalProductPassport","urn:bamm:io.catenax.battery.battery_pass:3.0.1#BatteryPass","urn:bamm:io.catenax.transmission.transmission_pass:1.0.0#TransmissionPass"]},"process":{"encryptionKey":""},"securityCheck":{"bpn":false,"edc":false},"serverPort":8888,"service":{"port":8888,"type":"ClusterIP"}}` | Backend configuration | | ||
| | backend | object | `{"digitalTwinRegistry":{"endpoints":{"digitalTwin":"/shell-descriptors","search":"/lookup/shells","subModel":"/submodel-descriptors"},"temporaryStorage":{"enabled":true,"lifetime":12},"timeouts":{"digitalTwin":20,"negotiation":40,"search":10,"transfer":10}},"discovery":{"bpnDiscovery":{"key":"manufacturerPartId","path":"/api/v1.0/administration/connectors/bpnDiscovery/search"},"edcDiscovery":{"key":"bpn"},"hostname":""},"edc":{"apis":{"catalog":"/catalog/request","management":"/management/v2","negotiation":"/contractnegotiations","transfer":"/transferprocesses"},"delay":100,"hostname":"","participantId":"<Add participant id here>","xApiKey":"<Add API key here>"},"hostname":"localhost","image":{"pullPolicy":"Always","repository":"docker.io/tractusx/digital-product-pass-backend"},"imagePullSecrets":[],"ingress":{"enabled":false,"hosts":[{"host":"localhost","paths":[{"path":"/","pathType":"Prefix"}]}]},"irs":{"enabled":false,"hostname":""},"logging":{"level":{"root":"INFO","utils":"INFO"}},"maxRetries":5,"name":"dpp-backend","passport":{"aspects":["urn:bamm:io.catenax.generic.digital_product_passport:1.0.0#DigitalProductPassport","urn:bamm:io.catenax.battery.battery_pass:3.0.1#BatteryPass","urn:bamm:io.catenax.transmission.transmission_pass:1.0.0#TransmissionPass"]},"podSecurityContext":{"fsGroup":3000,"runAsGroup":3000,"runAsUser":10000,"seccompProfile":{"type":"RuntimeDefault"}},"process":{"encryptionKey":""},"securityCheck":{"bpn":false,"edc":false},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"add":[],"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsGroup":3000,"runAsNonRoot":true,"runAsUser":10000},"serverPort":8888,"service":{"port":8888,"type":"ClusterIP"}}` | Backend configuration | | ||
| | backend.digitalTwinRegistry.temporaryStorage | object | `{"enabled":true,"lifetime":12}` | temporary storage of dDTRs for optimization | | ||
| | backend.digitalTwinRegistry.temporaryStorage.lifetime | int | `12` | lifetime of the temporaryStorage in hours | | ||
| | backend.digitalTwinRegistry.timeouts | object | `{"digitalTwin":20,"negotiation":40,"search":10,"transfer":10}` | timeouts for the digital twin registry async negotiation | | ||
|
|
@@ -36,9 +36,21 @@ A Helm chart for Tractus-X Digital Product Pass Kubernetes | |
| | backend.maxRetries | int | `5` | max retries for the backend services | | ||
| | backend.passport | object | `{"aspects":["urn:bamm:io.catenax.generic.digital_product_passport:1.0.0#DigitalProductPassport","urn:bamm:io.catenax.battery.battery_pass:3.0.1#BatteryPass","urn:bamm:io.catenax.transmission.transmission_pass:1.0.0#TransmissionPass"]}` | passport data transfer configuration | | ||
| | backend.passport.aspects | list | `["urn:bamm:io.catenax.generic.digital_product_passport:1.0.0#DigitalProductPassport","urn:bamm:io.catenax.battery.battery_pass:3.0.1#BatteryPass","urn:bamm:io.catenax.transmission.transmission_pass:1.0.0#TransmissionPass"]` | passport versions and aspects allowed | | ||
| | backend.podSecurityContext | object | `{"fsGroup":3000,"runAsGroup":3000,"runAsUser":10000,"seccompProfile":{"type":"RuntimeDefault"}}` | The [pod security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) defines privilege and access control settings for a Pod within the deployment | | ||
| | backend.podSecurityContext.fsGroup | int | `3000` | The owner for volumes and any files created within volumes will belong to this guid | | ||
| | backend.podSecurityContext.runAsGroup | int | `3000` | Processes within a pod will belong to this guid | | ||
| | backend.podSecurityContext.runAsUser | int | `10000` | Runs all processes within a pod with a special uid | | ||
| | backend.podSecurityContext.seccompProfile.type | string | `"RuntimeDefault"` | Restrict a Container's Syscalls with seccomp | | ||
| | backend.process | object | `{"encryptionKey":""}` | digital twin registry configuration | | ||
| | backend.process.encryptionKey | string | `""` | unique sha512 hash key used for the passport encryption | | ||
| | backend.securityCheck | object | `{"bpn":false,"edc":false}` | security configuration | | ||
| | backend.securityContext.allowPrivilegeEscalation | bool | `false` | Controls [Privilege Escalation](https://kubernetes.io/docs/concepts/security/pod-security-policy/#privilege-escalation) enabling setuid binaries changing the effective user ID | | ||
| | backend.securityContext.capabilities.add | list | `[]` | Specifies which capabilities to add to issue specialized syscalls | | ||
| | backend.securityContext.capabilities.drop | list | `["ALL"]` | Specifies which capabilities to drop to reduce syscall attack surface | | ||
| | backend.securityContext.readOnlyRootFilesystem | bool | `true` | Whether the root filesystem is mounted in read-only mode | | ||
| | backend.securityContext.runAsGroup | int | `3000` | The owner for volumes and any files created within volumes will belong to this guid | | ||
| | backend.securityContext.runAsNonRoot | bool | `true` | Requires the container to run without root privileges | | ||
| | backend.securityContext.runAsUser | int | `10000` | The container's process will run with the specified uid | | ||
| | backend.serverPort | int | `8888` | configuration of the spring boot server | | ||
| | backend.service.type | string | `"ClusterIP"` | [Service type](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types) to expose the running application on a set of Pods as a network service | | ||
| | frontend.api | object | `{"delay":1000,"max_retries":30,"timeout":90000}` | api timeouts | | ||
|
|
@@ -54,14 +66,26 @@ A Helm chart for Tractus-X Digital Product Pass Kubernetes | |
| | frontend.irs.maxWaitingTime | int | `30` | maximum waiting time to get the irs job status | | ||
| | frontend.irs.requestDelay | int | `30000` | request timeout delay | | ||
| | frontend.name | string | `"dpp-frontend"` | | | ||
| | frontend.podSecurityContext | object | `{"fsGroup":3000,"runAsGroup":3000,"runAsUser":10000,"seccompProfile":{"type":"RuntimeDefault"}}` | The [pod security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) defines privilege and access control settings for a Pod within the deployment | | ||
| | frontend.podSecurityContext.fsGroup | int | `3000` | The owner for volumes and any files created within volumes will belong to this guid | | ||
| | frontend.podSecurityContext.runAsGroup | int | `3000` | Processes within a pod will belong to this guid | | ||
| | frontend.podSecurityContext.runAsUser | int | `10000` | Runs all processes within a pod with a special uid | | ||
| | frontend.podSecurityContext.seccompProfile.type | string | `"RuntimeDefault"` | Restrict a Container's Syscalls with seccomp | | ||
| | frontend.portal.hostname | string | `""` | | | ||
| | frontend.securityContext.allowPrivilegeEscalation | bool | `false` | Controls [Privilege Escalation](https://kubernetes.io/docs/concepts/security/pod-security-policy/#privilege-escalation) enabling setuid binaries changing the effective user ID | | ||
| | frontend.securityContext.capabilities.add | list | `[]` | Specifies which capabilities to add to issue specialized syscalls | | ||
| | frontend.securityContext.capabilities.drop | list | `["ALL"]` | Specifies which capabilities to drop to reduce syscall attack surface | | ||
| | frontend.securityContext.readOnlyRootFilesystem | bool | `false` | Whether the root filesystem is mounted in read-only mode | | ||
| | frontend.securityContext.runAsGroup | int | `3000` | The owner for volumes and any files created within volumes will belong to this guid | | ||
| | frontend.securityContext.runAsNonRoot | bool | `true` | Requires the container to run without root privileges | | ||
| | frontend.securityContext.runAsUser | int | `10000` | The container's process will run with the specified uid | | ||
| | frontend.service.port | int | `8080` | | | ||
| | frontend.service.type | string | `"ClusterIP"` | [Service type](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types) to expose the running application on a set of Pods as a network service | | ||
| | frontend.supportContact.adminEmail | string | `"[email protected]"` | | | ||
| | name | string | `"digital-product-pass"` | | | ||
| | namespace | string | `""` | | | ||
| | nodeSelector | object | `{}` | | | ||
| | oauth | object | `{"appId":"","bpnCheck":{"bpn":"<Add participant id here>","enabled":false},"hostname":"","onLoad":"login-required","realm":"","roleCheck":{"enabled":false},"techUser":{"clientId":"<Add client id here>","clientSecret":"<Add client secret here>"}}` | oauth configuration | | ||
| | oauth | object | `{"appId":"<app-id>","bpnCheck":{"bpn":"<Add participant id here>","enabled":false},"hostname":"","onLoad":"login-required","realm":"<realm>","roleCheck":{"enabled":false},"techUser":{"clientId":"<Add client id here>","clientSecret":"<Add client secret here>"}}` | oauth configuration | | ||
| | oauth.bpnCheck | object | `{"bpn":"<Add participant id here>","enabled":false}` | configure here the bpn check for the application | | ||
| | oauth.bpnCheck.bpn | string | `"<Add participant id here>"` | this bpn needs to be included in the user login information when the check is enabled | | ||
| | oauth.hostname | string | `""` | url of the identity provider service | | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.