Skip to content

Commit f2f90bb

Browse files
gfenoygfenoy
committed
Helm chart version bump
Update to the nuxt-client image version 0.1.2 Update the security_service.py to set the tmpUrl only once Align the README.md with the Chart.yaml version
1 parent 17c1af2 commit f2f90bb

5 files changed

Lines changed: 103 additions & 27 deletions

File tree

‎zoo-project-dru/Chart.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ type: application
2323
# This is the chart version. This version number should be incremented each time you make changes
2424
# to the chart and its templates, including the app version.
2525
# Versions are expected to follow Semantic Versioning (https://semver.org/)
26-
version: 0.9.7
26+
version: 0.9.8
2727

2828
# This is the version number of the application being deployed. This version number should be
2929
# incremented each time you make changes to the application. Versions are not expected to
@@ -78,7 +78,9 @@ dependencies:
7878
annotations:
7979
artifacthub.io/changes: |
8080
- kind: changed
81-
description: "Update the ZOO-Project docker image to tag dru-ad6563d64c564268778263ad41fed9f9d18d07ca"
81+
description: "Update to the nuxt-client image version 0.1.2"
82+
- kind: changed
83+
description: "Update the security_service.py to set the tmpUrl only once"
8284
- kind: changed
8385
description: "Align the README.md with the Chart.yaml version"
8486

‎zoo-project-dru/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ To install the chart with the release name `my-zoo-project-dru`:
2424

2525
````bash
2626
helm repo add zoo-project https://zoo-project.github.io/charts/
27-
helm install my-zoo-project-dru zoo-project/zoo-project-dru --version 0.9.7
27+
helm install my-zoo-project-dru zoo-project/zoo-project-dru --version 0.9.8
2828
````
2929

3030
## Parameters
@@ -1069,7 +1069,7 @@ sensible defaults aligned to the UID/GID baked in the official upstream images:
10691069
| redis | 999 | 1000 | 1000 | matches `redis:*-alpine` |
10701070
| postgresql | 70 | 70 | 70 | matches `postgres:*-alpine` |
10711071
| kubeProxy | 65534 | 65534 | 65534 | `nobody`, readOnlyRootFilesystem enabled |
1072-
| webui | 1001 | 1001 | 1001 | `appuser` in `nuxt-client >= 0.1.1` |
1072+
| webui | 1000 | 1000 | 1000 | `node` in `nuxt-client >= 0.1.2` |
10731073

10741074
All container-level `securityContext` blocks set `allowPrivilegeEscalation: false`,
10751075
`runAsNonRoot: true` and drop all Linux capabilities (`capabilities.drop: [ALL]`).

‎zoo-project-dru/files/zoo-project/security_service.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ def securityIn(conf, inputs, outputs):
5656
if i.count("SERVICES_NAMESPACE"):
5757
if not(has_rpath):
5858
rPath += conf["renv"][i]
59+
conf["main"]["tmpUrl"]=conf["main"]["tmpUrl"].replace("/temp", "/"+conf["renv"][i]+"/temp")
5960
has_rpath=True
6061
if "auth_env" not in conf:
6162
conf["auth_env"] = {"user": conf["renv"][i], "cwd": rPath}
@@ -67,7 +68,6 @@ def securityIn(conf, inputs, outputs):
6768
# conf["lenv"]["cwd"]=rPath
6869
conf["zooServicesNamespace"] = {"namespace": conf["renv"][i], "cwd": rPath}
6970
conf["main"]["tmpPath"] = rPath + "/temp"
70-
conf["main"]["tmpUrl"]=conf["main"]["tmpUrl"].replace("/temp", "/"+conf["renv"][i]+"/temp")
7171
if i.count("QUERY_STRING") and conf["renv"][i].count("/package"):
7272
if conf["renv"]["HTTP_ACCEPT"] == "application/cwl+json":
7373
zoo.info("Conversion to cwl+json should happen in securityOut")

‎zoo-project-dru/templates/dp-webui.yaml‎

Lines changed: 72 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -55,11 +55,74 @@ spec:
5555
securityContext:
5656
{{- toYaml . | nindent 12 }}
5757
{{- end }}
58-
command: [ "/bin/sh","-c" ]
59-
# Run npm run build and then npm run start everytime the container starts
60-
args: [ "npm run build ; npm run start" ]
58+
{{- with .Values.webui.command }}
59+
command:
60+
{{- toYaml . | nindent 12 }}
61+
{{- end }}
62+
{{- with .Values.webui.args }}
63+
args:
64+
{{- toYaml . | nindent 12 }}
65+
{{- end }}
6166
image: "{{ .Values.webui.image.repository }}:{{ .Values.webui.image.tag | default .Chart.AppVersion }}"
6267
imagePullPolicy: {{ .Values.webui.image.pullPolicy }}
68+
env:
69+
- name: HOST
70+
value: "0.0.0.0"
71+
- name: PORT
72+
value: {{ .Values.webui.port | quote }}
73+
- name: NITRO_HOST
74+
value: "0.0.0.0"
75+
- name: NITRO_PORT
76+
value: {{ .Values.webui.port | quote }}
77+
# Nuxt 3 runtimeConfig.public.<KEY> is overridden at runtime by env
78+
# var NUXT_PUBLIC_<KEY>. We keep the original names too because some
79+
# libs (nuxt-auth, sidebase) read AUTH_ORIGIN / NEXTAUTH_URL directly
80+
# from process.env.
81+
- name: NUXT_PUBLIC_NUXT_ZOO_BASEURL
82+
value: {{ $hosturl | quote }}
83+
- name: NUXT_ZOO_BASEURL
84+
value: {{ $hosturl | quote }}
85+
- name: NUXT_PUBLIC_NUXT_OIDC_ISSUER
86+
value: {{ .Values.webui.oidc.issuer | quote }}
87+
- name: NUXT_OIDC_ISSUER
88+
value: {{ .Values.webui.oidc.issuer | quote }}
89+
- name: NUXT_PUBLIC_NUXT_OIDC_CLIENT_ID
90+
value: {{ .Values.webui.oidc.clientId | quote }}
91+
- name: NUXT_OIDC_CLIENT_ID
92+
value: {{ .Values.webui.oidc.clientId | quote }}
93+
{{- with .Values.webui.oidc.clientSecret }}
94+
- name: NUXT_OIDC_CLIENT_SECRET
95+
value: {{ . | quote }}
96+
{{- end }}
97+
- name: NUXT_PUBLIC_AUTH_ORIGIN
98+
value: {{ .Values.webui.url | quote }}
99+
- name: AUTH_ORIGIN
100+
value: {{ .Values.webui.url | quote }}
101+
- name: NUXT_PUBLIC_NEXTAUTH_URL
102+
value: {{ .Values.webui.url | quote }}
103+
- name: NEXTAUTH_URL
104+
value: {{ .Values.webui.url | quote }}
105+
- name: NUXT_BASE_URL
106+
value: {{ .Values.webui.url | quote }}
107+
- name: NUXT_AUTH_SECRET
108+
value: {{ default "client_secret_basic" .Values.webui.authSecret | quote }}
109+
- name: NUXT_PUBLIC_ZOO_OGCAPI_REQUIRES_BEARER_TOKEN
110+
value: {{ default "true" .Values.webui.requiresBearerToken | quote }}
111+
- name: ZOO_OGCAPI_REQUIRES_BEARER_TOKEN
112+
value: {{ default "true" .Values.webui.requiresBearerToken | quote }}
113+
- name: NUXT_PUBLIC_SUBSCRIBERURL
114+
value: "http://{{ .Release.Name }}-service/cgi-bin/publish.py"
115+
- name: SUBSCRIBERURL
116+
value: "http://{{ .Release.Name }}-service/cgi-bin/publish.py"
117+
- name: NODE_TLS_REJECT_UNAUTHORIZED
118+
value: {{ default "0" .Values.webui.nodeTlsRejectUnauthorized | quote }}
119+
{{- with .Values.webui.extraEnv }}
120+
{{- toYaml . | nindent 12 }}
121+
{{- end }}
122+
{{- with .Values.webui.envFrom }}
123+
envFrom:
124+
{{- toYaml . | nindent 12 }}
125+
{{- end }}
63126
ports:
64127
- name: webui-http
65128
containerPort: {{ .Values.webui.port }}
@@ -81,20 +144,16 @@ spec:
81144
timeoutSeconds: 15
82145
failureThreshold: 3
83146
resources: {}
147+
{{- with .Values.webui.volumeMounts }}
84148
volumeMounts:
85-
- name: bin-config
86-
mountPath: /usr/src/app/.env
87-
subPath: env_nuxt.sample
88-
- name: bin-config
89-
mountPath: /usr/src/app/env_sample
90-
subPath: env_nuxt.sample
149+
{{- toYaml . | nindent 12 }}
150+
{{- end }}
91151

92152
restartPolicy: Always
153+
{{- with .Values.webui.volumes }}
93154
volumes:
94-
- name: bin-config
95-
configMap:
96-
name: {{ .Release.Name }}-bin-config
97-
defaultMode: 0777
155+
{{- toYaml . | nindent 8 }}
156+
{{- end }}
98157

99158
status: {}
100159
{{- end }}

‎zoo-project-dru/values.yaml‎

Lines changed: 24 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -602,21 +602,36 @@ webui:
602602
image:
603603
repository: zooproject/nuxt-client
604604
pullPolicy: IfNotPresent
605-
tag: 0.1.1
605+
tag: 0.1.2
606+
# Override container command/args. Defaults to image CMD which runs
607+
# `node .output/server/index.mjs` for the multi-stage slim image.
608+
command: []
609+
args: []
610+
# Optional Nuxt runtime config — read from process.env at server startup.
611+
authSecret: ""
612+
requiresBearerToken: "true"
613+
nodeTlsRejectUnauthorized: "0"
614+
# Extra env vars and envFrom (Secrets/ConfigMaps) appended to the webui container.
615+
extraEnv: []
616+
envFrom: []
617+
# Optional volume mounts/volumes. Empty by default — the slim image
618+
# does not need the bin-config ConfigMap (env vars passed via env:).
619+
volumeMounts: []
620+
volumes: []
606621
enforce: false
607-
# Pod-level security context for the webui pod
608-
# The nuxt-client >= 0.1.1 image runs as 'appuser' (uid 1001, gid 1001) and
609-
# /usr/src/app is owned by that user, so no init copy is required.
622+
# Pod-level security context for the webui pod.
623+
# The slim multi-stage nuxt-client image runs as the built-in `node`
624+
# user (uid 1000, gid 1000); /usr/src/app/.output is owned by it.
610625
podSecurityContext:
611626
runAsNonRoot: true
612-
runAsUser: 1001
613-
runAsGroup: 1001
614-
fsGroup: 1001
627+
runAsUser: 1000
628+
runAsGroup: 1000
629+
fsGroup: 1000
615630
# Container-level security context for the webui container
616631
securityContext:
617632
runAsNonRoot: true
618-
runAsUser: 1001
619-
runAsGroup: 1001
633+
runAsUser: 1000
634+
runAsGroup: 1000
620635
allowPrivilegeEscalation: false
621636
capabilities:
622637
drop:

0 commit comments

Comments
 (0)