Skip to content

Commit

Permalink
Merge pull request #103 from eclipse-tractusx/release/v1.7.0-alpha
Browse files Browse the repository at this point in the history
release(portal-1.7.0-alpha): merge in main
  • Loading branch information
evegufy authored Oct 5, 2023
2 parents e1fa701 + 909442a commit b8bb67a
Show file tree
Hide file tree
Showing 46 changed files with 2,280 additions and 817 deletions.
7 changes: 7 additions & 0 deletions .github/workflows/chart-release.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,13 @@ jobs:
helm repo add bitnami https://charts.bitnami.com/bitnami
helm dependency update
- name: Update helm dependencies for localdev
run: |
cd charts/localdev
helm repo add tractusx-dev https://eclipse-tractusx.github.io/charts/dev
helm repo add pgadmin4 https://helm.runix.net
helm dependency update
- name: Run chart-releaser
uses: helm/[email protected]

Check warning on line 67 in .github/workflows/chart-release.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 67 in .github/workflows/chart-release.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 67 in .github/workflows/chart-release.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 67 in .github/workflows/chart-release.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 67 in .github/workflows/chart-release.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
env:
Expand Down
151 changes: 151 additions & 0 deletions .github/workflows/localdev-chart-test.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,151 @@
###############################################################
# Copyright (c) 2021, 2023 Contributors to the Eclipse Foundation
#
# See the NOTICE file(s) distributed with this work for additional
# information regarding copyright ownership.
#
# This program and the accompanying materials are made available under the
# terms of the Apache License, Version 2.0 which is available at
# https://www.apache.org/licenses/LICENSE-2.0.
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
# SPDX-License-Identifier: Apache-2.0
###############################################################

name: LocalDev Lint and Test Chart

on:
push:
paths:
- 'charts/localdev/**'
branches: [main, dev]
pull_request:
paths:
- 'charts/localdev/**'
workflow_dispatch:
inputs:
node_image:
description: 'kindest/node image for k8s kind cluster'
# k8s version from 23.12 release
default: 'kindest/node:v1.26.6'
required: false
type: string
# upgrade_from:
# description: 'localdev chart version to upgrade from'
# default: '0.0.1'
# required: false
# type: string

jobs:
lint-test:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v3
with:
fetch-depth: 0

- name: Kubernetes KinD Cluster
uses: container-tools/kind-action@v2

Check warning on line 54 in .github/workflows/localdev-chart-test.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 54 in .github/workflows/localdev-chart-test.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 54 in .github/workflows/localdev-chart-test.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 54 in .github/workflows/localdev-chart-test.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
with:
version: v0.19.0
node_image: ${{ github.event.inputs.node_image || 'kindest/node:v1.26.6' }}

- name: Set up Helm
uses: azure/setup-helm@v3

Check warning on line 60 in .github/workflows/localdev-chart-test.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 60 in .github/workflows/localdev-chart-test.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 60 in .github/workflows/localdev-chart-test.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 60 in .github/workflows/localdev-chart-test.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 60 in .github/workflows/localdev-chart-test.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
with:
version: v3.10.3

# Setup python as a prerequisite for chart linting
- uses: actions/setup-python@v4
with:
python-version: '3.9'
check-latest: true

- name: Set up chart-testing
uses: helm/[email protected]

Check warning on line 71 in .github/workflows/localdev-chart-test.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 71 in .github/workflows/localdev-chart-test.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 71 in .github/workflows/localdev-chart-test.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 71 in .github/workflows/localdev-chart-test.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

- name: Run chart-testing (list-changed)
id: list-changed
run: |
changed=$(ct list-changed --target-branch ${{ github.event.repository.default_branch }})
if [[ -n "$changed" ]]; then
echo "changed=true" >> $GITHUB_OUTPUT
fi
# run chart linting
- name: Run chart-testing (lint)
run: ct lint --charts charts/localdev --config charts/chart-testing-config.yaml

- name: Enalbe TLS setup on KinD cluster
run: |
helm repo add jetstack https://charts.jetstack.io
helm repo update
helm install \
cert-manager jetstack/cert-manager \
--namespace default \
--version v1.13.0 \
--set installCRDs=true
kubectl apply -f - <<EOF
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: selfsigned-issuer
spec:
selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: my-selfsigned-ca
namespace: default
spec:
isCA: true
commonName: cx.local
secretName: root-secret
privateKey:
algorithm: RSA
size: 2048
issuerRef:
name: selfsigned-issuer
kind: ClusterIssuer
group: cert-manager.io
subject:
organizations:
- CX
countries:
- DE
provinces:
- Some-State
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: my-ca-issuer
spec:
ca:
secretName: root-secret
EOF
if: github.event_name != 'pull_request' || steps.list-changed.outputs.changed == 'true'

- name: Run helm install
run: |
helm repo add tractusx-dev https://eclipse-tractusx.github.io/charts/dev
helm repo add pgadmin4 https://helm.runix.net
helm install local charts/localdev
if: github.event_name != 'pull_request' || steps.list-changed.outputs.changed == 'true'

# # Upgrade the released localdev chart version with the locally available chart
# - name: Run helm upgrade
# run: |
# helm repo add tractusx-dev https://eclipse-tractusx.github.io/charts/dev
# helm repo add pgadmin4 https://helm.runix.net
# helm install local tractusx-dev/localdev --version ${{ github.event.inputs.upgrade_from || '0.0.1' }} --namespace upgrade --create-namespace
# helm dependency update charts/localdev
# helm upgrade local charts/localdev --namespace upgrade
# if: github.event_name != 'pull_request' || steps.list-changed.outputs.changed == 'true'
12 changes: 6 additions & 6 deletions .github/workflows/portal-chart-test.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -31,14 +31,14 @@ on:
inputs:
node_image:
description: 'kindest/node image for k8s kind cluster'
# k8s version from 3.1 release
default: 'kindest/node:v1.24.6'
# k8s version to support
default: 'kindest/node:v1.26.6'
required: false
type: string
upgrade_from:
description: 'portal chart version to upgrade from'
# portal version from 3.1 release
default: '1.3.0'
# portal version from 23.09 release
default: '1.6.0'
required: false
type: string

Expand All @@ -55,7 +55,7 @@ jobs:
uses: container-tools/kind-action@v2

Check warning on line 55 in .github/workflows/portal-chart-test.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 55 in .github/workflows/portal-chart-test.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 55 in .github/workflows/portal-chart-test.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 55 in .github/workflows/portal-chart-test.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 55 in .github/workflows/portal-chart-test.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
with:
version: v0.19.0
node_image: ${{ github.event.inputs.node_image || 'kindest/node:v1.24.6' }}
node_image: ${{ github.event.inputs.node_image || 'kindest/node:v1.26.6' }}

- name: Set up Helm
uses: azure/setup-helm@v3

Check warning on line 61 in .github/workflows/portal-chart-test.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 61 in .github/workflows/portal-chart-test.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 61 in .github/workflows/portal-chart-test.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 61 in .github/workflows/portal-chart-test.yaml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
Expand Down Expand Up @@ -95,7 +95,7 @@ jobs:
run: |
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo add tractusx-dev https://eclipse-tractusx.github.io/charts/dev
helm install portal tractusx-dev/portal --version ${{ github.event.inputs.upgrade_from || '1.3.0' }} --namespace upgrade --create-namespace
helm install portal tractusx-dev/portal --version ${{ github.event.inputs.upgrade_from || '1.6.0' }} --namespace upgrade --create-namespace
helm dependency update charts/portal
helm upgrade portal charts/portal --namespace upgrade
if: github.event_name != 'pull_request' || steps.list-changed.outputs.changed == 'true'
3 changes: 2 additions & 1 deletion .gitignore
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
### Helm ###
# Chart dependencies
# Chart dependencies and local install
**/charts/*.tgz
Chart.lock
**/values-local.yaml

### Visual Studio Code ###
.vscode/
28 changes: 28 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,34 @@

New features, fixed bugs, known defects and other noteworthy changes to each release of the Catena-X Portal helm chart.


## 1.7.0-alpha

### Change

* changed to new container images
* portal-assets: v1.6.1
* portal-frontend: v1.7.0-alpha
* portal-frontend-registration: v1.5.1
* portal-backend: v1.7.0-alpha
* remove deprecated ingress annotation 'kubernetes.io/ingress.class' and changed to ingress.ClassName

* portal-backend:
* enabled and/or extended config in particular for network2network (N2N) and onboarding service provider (OSP)
* updated bpdm api path
* enabled config of DOTNET_ENVIRONMENT
* enabled config of JWTBEAREROPTIONS_REQUIREHTTPSMETADATA
* set database healthchecks in default values file

### Bugfix

* fixed escaping of secret values: quotes added

### Technical Support

* updated k8s version and version to upgrade from for helm test workflow
* updated Security.md

## 1.6.0

### Change
Expand Down
Loading

0 comments on commit b8bb67a

Please sign in to comment.