chore: merge dev in main

.github/workflows/portal-chart-test.yaml

@@ -64,18 +64,19 @@ jobs:
       - name: Run chart-testing (lint)
         run: ct lint --charts charts/portal --config charts/chart-testing-config.yaml
 
-      # install the chart to the kind cluster and run helm test
-      # define charts to test with the --charts parameter
-      - name: Run chart-testing (install)
-        run: ct install --charts charts/portal --config charts/chart-testing-config.yaml
+      - name: Run helm install
+        run: |
+          helm repo add bitnami https://charts.bitnami.com/bitnami
+          helm repo add tractusx-dev https://eclipse-tractusx.github.io/charts/dev
+          helm install portal charts/portal --namespace install --create-namespace
         if: github.event_name != 'pull_request' || steps.list-changed.outputs.changed == 'true'
 
         # Upgrade the released portal chart version with the locally available chart
       - name: Run helm upgrade
         run: |
           helm repo add bitnami https://charts.bitnami.com/bitnami
           helm repo add tractusx-dev https://eclipse-tractusx.github.io/charts/dev
-          helm install portal tractusx-dev/portal --version ${{ github.event.inputs.upgrade_from || '1.3.0' }}
+          helm install portal tractusx-dev/portal --version ${{ github.event.inputs.upgrade_from || '1.3.0' }} --namespace upgrade --create-namespace
           helm dependency update charts/portal
-          helm upgrade portal charts/portal
+          helm upgrade portal charts/portal --namespace upgrade
         if: github.event_name != 'pull_request' || steps.list-changed.outputs.changed == 'true'

charts/portal/templates/cronjob-backend-portal-maintenance.yaml

@@ -1,4 +1,4 @@
 ###############################################################
 # Copyright (c) 2021, 2023 Contributors to the Eclipse Foundation
 #
 # See the NOTICE file(s) distributed with this work for additional
@@ -31,7 +31,11 @@
           containers:
           - name: {{ .Values.backend.portalmaintenance.name }}
             securityContext:
-              {{- toYaml .Values.securityContext | nindent 16 }}
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop:
+                - ALL
+              runAsNonRoot: true
             image: "{{ .Values.backend.portalmaintenance.image.name }}:{{ .Values.backend.portalmaintenance.image.portalmaintenancetag | default .Chart.AppVersion }}"
             imagePullPolicy: "Always"
             env:
@@ -57,3 +61,5 @@
             - name: http
               containerPort: {{ .Values.portContainer }}
               protocol: TCP
+            resources:
+              {{- toYaml .Values.backend.portalmaintenance.resources | nindent 14 }}

charts/portal/templates/cronjob-backend-processes.yaml

@@ -1,4 +1,4 @@
 ###############################################################
 # Copyright (c) 2021, 2023 Contributors to the Eclipse Foundation
 #
 # See the NOTICE file(s) distributed with this work for additional
@@ -32,7 +32,11 @@
           containers:
           - name: {{ .Values.backend.processesworker.name }}
             securityContext:
-              {{- toYaml .Values.securityContext | nindent 16 }}
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop:
+                - ALL
+              runAsNonRoot: true
             image: "{{ .Values.backend.processesworker.image.name }}:{{ .Values.backend.processesworker.image.processesworkertag | default .Chart.AppVersion }}"
             imagePullPolicy: "Always"
             env:
@@ -68,13 +72,17 @@
             - name: "CONNECTIONSTRINGS__PROVISIONINGDB"
               value: "Server={{ .Values.externalDatabase.host }};Database={{ .Values.externalDatabase.database }};Port={{ .Values.externalDatabase.port }};User Id={{ .Values.externalDatabase.provisioningUser }};Password=$(PROVISIONING_PASSWORD);Ssl Mode={{ .Values.backend.dbConnection.sslMode }};"
             {{- end }}
-            - name: "APPLICATIONACTIVATION__APPLICATIONAPPROVALINITIALROLES__Cl2-CX-Portal__0"
+            - name: "APPLICATIONACTIVATION__APPLICATIONAPPROVALINITIALROLES__0__CLIENTID"
+              value: "{{ .Values.backend.clients.portal }}"
+            - name: "APPLICATIONACTIVATION__APPLICATIONAPPROVALINITIALROLES__0__USERROLENAMES__0"
               value: "{{ .Values.backend.processesworker.applicationActivation.applicationApprovalInitialRoles.portal.role0 }}"
             - name: "APPLICATIONACTIVATION__CLIENTTOREMOVEROLESONACTIVATION__0"
               value: "{{ .Values.backend.processesworker.applicationActivation.clientToRemoveRolesOnActivation.client0 }}"
             - name: "APPLICATIONACTIVATION__BASEPORTALADDRESS"
               value: "{{ .Values.portalAddress }}{{ .Values.backend.portalHomePath }}"
-            - name: "APPLICATIONACTIVATION__COMPANYADMINROLES__Cl1-CX-Registration__0"
+            - name: "APPLICATIONACTIVATION__COMPANYADMINROLES__0__CLIENTID"
+              value: "{{ .Values.backend.clients.registration }}"
+            - name: "APPLICATIONACTIVATION__COMPANYADMINROLES__0__USERROLENAMES__0"
               value: "{{ .Values.backend.processesworker.applicationActivation.applicationApprovalInitialRoles.registration.role0 }}"
             - name: "APPLICATIONACTIVATION__WELCOMENOTIFICATIONTYPEIDS__0"
               value: "{{ .Values.backend.processesworker.applicationActivation.welcomeNotificationTypeIds.type0 }}"
@@ -130,6 +138,8 @@
               value: "{{ .Values.portalBackendAddress }}{{ .Values.backend.processesworker.clearinghouse.callbackPath }}"
             - name: "APPLICATIONCHECKLIST__CUSTODIAN__BASEADDRESS"
               value: "{{ .Values.custodianAddress }}"
+            - name: "APPLICATIONCHECKLIST__CUSTODIAN__MEMBERSHIPERRORMESSAGE"
+              value: "{{ .Values.backend.processesworker.custodian.membershipErrorMessage }}"
             - name: "APPLICATIONCHECKLIST__CUSTODIAN__CLIENTID"
               value: "{{ .Values.backend.processesworker.custodian.clientId }}"
             - name: "APPLICATIONCHECKLIST__CUSTODIAN__CLIENTSECRET"
@@ -219,7 +229,9 @@
               value: "{{ .Values.backend.provisioning.centralRealm }}"
             - name: "PROVISIONING__CENTRALREALMID"
               value: "{{ .Values.backend.provisioning.centralRealmId }}"
-            - name: "PROVISIONING__INVITEDUSERINITIALROLES__Cl1-CX-Registration__0"
+            - name: "PROVISIONING__INVITEDUSERINITIALROLES__0__CLIENTID"
+              value: "{{ .Values.backend.clients.registration }}"
+            - name: "PROVISIONING__INVITEDUSERINITIALROLES__0__USERROLENAMES__0"
               value: "{{ .Values.backend.provisioning.invitedUserInitialRoles.registration }}"
             - name: "PROVISIONING__SHAREDREALM__SMTPSERVER__AUTH"
               value: "{{ .Values.backend.provisioning.sharedRealm.smtpServer.auth }}"
@@ -244,13 +256,21 @@
               value: "{{ .Values.backend.provisioning.sharedRealmClient.clientId }}"
             - name: "OFFERSUBSCRIPTIONPROCESS__BASEPORTALADDRESS"
               value: "{{ .Values.portalAddress }}{{ .Values.backend.portalHomePath }}"
-            - name: "OFFERSUBSCRIPTIONPROCESS__SERVICEACCOUNTROLES__technical_roles_management__0"
+            - name: "OFFERSUBSCRIPTIONPROCESS__SERVICEACCOUNTROLES__0__CLIENTID"
+              value: "{{ .Values.backend.clients.technicalRolesManagement }}"
+            - name: "OFFERSUBSCRIPTIONPROCESS__SERVICEACCOUNTROLES__0__USERROLENAMES__0"
               value: "{{ .Values.backend.processesworker.offerSubscriptionProcess.serviceAccountRoles.role0 }}"
-            - name: "OFFERSUBSCRIPTIONPROCESS__SERVICEMANAGERROLES__Cl2-CX-Portal__0"
+            - name: "OFFERSUBSCRIPTIONPROCESS__SERVICEMANAGERROLES__0__CLIENTID"
+              value: "{{ .Values.backend.clients.portal }}"
+            - name: "OFFERSUBSCRIPTIONPROCESS__SERVICEMANAGERROLES__0__USERROLENAMES__0"
               value: "{{ .Values.backend.processesworker.offerSubscriptionProcess.serviceManagerRoles.role0 }}"
-            - name: "OFFERSUBSCRIPTIONPROCESS__ITADMINROLES__Cl2-CX-Portal__0"
+            - name: "OFFERSUBSCRIPTIONPROCESS__ITADMINROLES__0__CLIENTID"
+              value: "{{ .Values.backend.clients.portal }}"
+            - name: "OFFERSUBSCRIPTIONPROCESS__ITADMINROLES__0__USERROLENAMES__0"
               value: "{{ .Values.backend.processesworker.offerSubscriptionProcess.itAdminRoles.role0 }}"
-            - name: "OFFERPROVIDER__SERVICEMANAGERROLES__Cl2-CX-Portal__0"
+            - name: "OFFERPROVIDER__SERVICEMANAGERROLES__0__CLIENTID"
+              value: "{{ .Values.backend.clients.portal }}"
+            - name: "OFFERPROVIDER__SERVICEMANAGERROLES__0__USERROLENAMES__0"
               value: "{{ .Values.backend.processesworker.offerprovider.serviceManagerRoles.role0 }}"
             - name: "OFFERPROVIDER__CLIENTID"
               value: "{{ .Values.backend.processesworker.offerprovider.clientId }}"
@@ -273,3 +293,5 @@
             - name: http
               containerPort: {{ .Values.portContainer }}
               protocol: TCP
+            resources:
+              {{- toYaml .Values.backend.processesworker.resources | nindent 14 }}

charts/portal/templates/deployment-backend-administration.yaml

@@ -1,4 +1,4 @@
 ###############################################################
 # Copyright (c) 2021, 2023 Contributors to the Eclipse Foundation
 #
 # See the NOTICE file(s) distributed with this work for additional
@@ -36,7 +36,11 @@
       containers:
       - name: {{ .Values.backend.administration.name }}
         securityContext:
-          {{- toYaml .Values.securityContext | nindent 12 }}
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          runAsNonRoot: true
         image: "{{ .Values.backend.administration.image.name }}:{{ .Values.backend.administration.image.administrationservicetag | default .Chart.AppVersion }}"
         imagePullPolicy: "Always"
         env:
@@ -126,7 +130,9 @@
         - name: "APPLICATIONCHECKLIST__CLEARINGHOUSE__USERNAME"
           value: "{{ .Values.backend.placeholder }}"
         - name: "APPLICATIONCHECKLIST__CLEARINGHOUSE__CALLBACKURL"
-          value: "{{ .Values.portalBackendAddress }}{{ .Values.backend.processesworker.clearinghouse.callbackPath }}"
+          value: "{{ .Values.portalBackendAddress }}{{ .Values.backend.processesworker.clearinghouse.callbackPath }}"  
+        - name: "APPLICATIONCHECKLIST__CUSTODIAN__MEMBERSHIPERRORMESSAGE"
+          value: "{{ .Values.backend.processesworker.custodian.membershipErrorMessage }}"
         - name: "APPLICATIONCHECKLIST__CUSTODIAN__BASEADDRESS"
           value: "{{ .Values.custodianAddress }}"
         - name: "APPLICATIONCHECKLIST__CUSTODIAN__CLIENTID"
@@ -231,7 +237,9 @@
           value: "{{ .Values.backend.administration.identityProviderAdmin.csvSettings.headerUserId }}"
         - name: "IDENTITYPROVIDERADMIN__CSVSETTINGS__SEPARATOR"
           value: "{{ .Values.backend.administration.identityProviderAdmin.csvSettings.separator }}"
-        - name: "INVITATION__INVITEDUSERINITIALROLES__Cl1-CX-Registration__0"
+        - name: "INVITATION__INVITEDUSERINITIALROLES__0__CLIENTID"
+          value: "{{ .Values.backend.clients.registration }}"
+        - name: "INVITATION__INVITEDUSERINITIALROLES__0__USERROLENAMES__0"
           value: "{{ .Values.backend.administration.invitation.invitedUserInitialRoles.role0 }}"
         - name: "INVITATION__REGISTRATIONAPPADDRESS"
           value: "{{ .Values.portalAddress }}{{ .Values.backend.registration.portalRegistrationPath }}"
@@ -288,7 +296,9 @@
           value: "{{ .Values.backend.provisioning.centralRealm }}"
         - name: "PROVISIONING__CENTRALREALMID"
           value: "{{ .Values.backend.provisioning.centralRealmId }}"
-        - name: "PROVISIONING__INVITEDUSERINITIALROLES__Cl1-CX-Registration__0"
+        - name: "PROVISIONING__INVITEDUSERINITIALROLES__0__CLIENTID"
+          value: "{{ .Values.backend.clients.registration }}"
+        - name: "PROVISIONING__INVITEDUSERINITIALROLES__0__USERROLENAMES__0"
           value: "{{ .Values.backend.provisioning.invitedUserInitialRoles.registration }}"
         - name: "PROVISIONING__SHAREDREALM__SMTPSERVER__AUTH"
           value: "{{ .Values.backend.provisioning.sharedRealm.smtpServer.auth }}"
@@ -321,9 +331,11 @@
           value: "{{ .Values.backend.administration.userManagement.companyUserStatusIds.status0 }}"
         - name: "USERMANAGEMENT__COMPANYUSERSTATUSIDS__1"
           value: "{{ .Values.backend.administration.userManagement.companyUserStatusIds.status1 }}"
-        - name: "USERMANAGEMENT__USERADMINROLES__Cl2-CX-Portal__0"
+        - name: "USERMANAGEMENT__USERADMINROLES__0__CLIENTID"
+          value: "{{ .Values.backend.clients.portal }}"
+        - name: "USERMANAGEMENT__USERADMINROLES__0__USERROLENAMES__0"
           value: "{{ .Values.backend.administration.userManagement.userAdminRoles.role0 }}"
-        - name: "USERMANAGEMENT__USERADMINROLES__Cl2-CX-Portal__1"
+        - name: "USERMANAGEMENT__USERADMINROLES__0__USERROLENAMES__1"
           value: "{{ .Values.backend.administration.userManagement.userAdminRoles.role1 }}"
         - name: "USERMANAGEMENT__PORTAL__BASEPORTALADDRESS"
           value: "{{ .Values.portalAddress }}{{ .Values.backend.portalHomePath }}"
@@ -364,7 +376,7 @@
           successThreshold: {{ .Values.readinessProbe.successThreshold }}
           failureThreshold: {{ .Values.readinessProbe.failureThreshold }}
         resources:
-          {{- toYaml .Values.resources | nindent 12 }}
+          {{- toYaml .Values.backend.administration.resources | nindent 10 }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}