frontend.yaml

{{ $isProd := contains "prod" $ocEnv }}
###########################################
###               Frontend              ###
###########################################
#   Frontend Deployment
kind: Deployment
apiVersion: apps/v1
metadata:
  name: {{ .Values.environment }}-frontend
  namespace: {{ .Values.licensePlate }}-{{ .Values.environment }}
  labels:
    app.kubernetes.io/part-of: {{ .Values.environment }}
    app.openshift.io/runtime: nginx
  annotations:
    image.openshift.io/triggers: |-
      [
        {
          "from": {
            "kind": "ImageStreamTag",
            "namespace": "{{ .Values.licensePlate }}-tools",
            "name": "{{ .Values.appName }}-frontend:{{ .Values.imageTag }}"
          },
          "fieldPath": "spec.template.spec.containers[0].image"
        }
      ]
spec:
  replicas: {{ .Values.frontend.replicaCount }}
  selector:
    matchLabels:
      name: {{ .Values.environment }}-frontend
      app: {{ .Values.appName }}
  template:
    metadata:
      labels:
        name: {{ .Values.environment }}-frontend
        app: {{ .Values.appName }}
      annotations:
        rollme: {{ randAlphaNum 5 | quote }}
        prometheus.io/scrape: 'true'
        prometheus.io/port: '8088'
        prometheus.io/path: {{ .Values.servletContextPath }}
    spec:
      containers:
        - name: {{ .Values.environment }}-frontend
          image: >-
            image-registry.openshift-image-registry.svc:5000/{{ .Values.licensePlate }}-tools/prime-frontend:{{ .Values.imageTag }}
          ports:
            - containerPort: 80
              protocol: TCP
            - containerPort: 8080
              protocol: TCP
            - containerPort: 8443
              protocol: TCP
            - containerPort: 8888
              protocol: TCP
            - containerPort: 8890
              protocol: TCP
          envFrom:
            - configMapRef:
                name: keycloak
          env:
            - name: DOCUMENT_MANAGER_URL
              value: https://{{ .Values.environment }}.{{ .Values.urlStub }}/api/docman
          resources:
            limits:
              cpu: {{ .Values.cpuLimit }}
              memory: {{ .Values.memoryLimit }}
            requests:
              cpu: {{ .Values.cpuRequests }}
              memory: {{ .Values.memoryRequests }}
          readinessProbe:
            httpGet:
              path: /
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 5
          livenessProbe:
            httpGet:
              path: /
              port: 8080
            initialDelaySeconds: 5
            failureThreshold: 1
            periodSeconds: 5
          volumeMounts:
          - name: vanity-tls-certs
            readOnly: true
            mountPath: /etc/nginx/certs
          - name: plr-integration-volume
            readOnly: true
            mountPath: /etc/nginx/certs/plr
          - name: nginx-config
            readOnly: true
            mountPath: /etc/nginx/nginx.conf
            subPath: nginx.conf
          - name: env-config
            readOnly: true
            mountPath: /opt/app-root/src/assets/config-map.json
            subPath: config-map.json
      volumes:
      - name: vanity-tls-certs
        secret:
          secretName: vanity-tls-certificate
          defaultMode: 420
      - name: nginx-config
        configMap:
          name: {{ .Values.environment }}-nginx-config
          defaultMode: 420
      - name: plr-integration-volume
        secret:
          secretName: plr-integration
          defaultMode: 420
      - name: env-config
        configMap:
          name: {{ .Values.environment }}-env-config
          defaultMode: 420
  revisionHistoryLimit: 3
---
#   Environment file
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ .Values.environment }}-env-config
  namespace: {{ .Values.licensePlate }}-{{ .Values.environment }}
  labels:
    app.kubernetes.io/part-of: {{ .Values.environment }}
data:
  config-map.json: |-
    {
      "environmentName": "{{ .Values.environment }}",
      "apiEndpoint": "https://{{ if $isProd }}{{ else }}{{ $release }}.{{ end }}{{ .Values.urlStub }}/api/v1",
      "loginRedirectUrl": "https://{{ if $isProd }}{{ else }}{{ $release }}.{{ end }}{{ .Values.urlStub }}",
      "documentManagerUrl": "https://{{ if $isProd }}{{ else }}{{ $release }}.{{ end }}{{ .Values.urlStub }}/api/docman",
      "keycloakConfig": {
        "config": {
          "url": "{{ .Values.settings.keycloak.url }}",
          "realm": "{{ .Values.settings.keycloak.realm }}",
          "clientId": "{{ .Values.settings.keycloak.clientId }}"
        }
      },
      "mohKeycloakConfig": {
        "config": {
          "url": "",
          "realm": "",
          "clientId": ""
        }
      }
    }
---
#   NGINX Configuration
kind: ConfigMap
apiVersion: v1
metadata:
  name: {{ .Values.environment }}-nginx-config
  namespace: {{ .Values.licensePlate }}-{{ .Values.environment }}
  labels:
    app.kubernetes.io/part-of: {{ .Values.environment }}
data:
  nginx.conf: |-
    # Based on https://www.nginx.com/resources/wiki/start/topics/examples/full/#nginx-conf
    #user              www www;  ## Default: nobody

    worker_processes  auto;
    error_log         "/var/log/nginx/error.log";
    pid               "/tmp/nginx.pid";

    events {
        worker_connections  1024;
    }

    http {
        include       /etc/nginx/mime.types;
        default_type  application/octet-stream;
        log_format    main '$remote_addr - $remote_user [$time_local] '
                          '"$request" $status  $body_bytes_sent "$http_referer" '
                          '"$http_user_agent" "$http_x_forwarded_for"';
        access_log    "/var/log/nginx/access.log" main;
        # add_header    X-Frame-Options SAMEORIGIN;

        client_body_temp_path  "/tmp/client_body" 1 2;
        proxy_temp_path        "/tmp/proxy" 1 2;
        fastcgi_temp_path      "/tmp/fastcgi" 1 2;
        scgi_temp_path         "/tmp/scgi" 1 2;
        uwsgi_temp_path        "/tmp/uwsgi" 1 2;

        sendfile           on;
        # tcp_nopush         on;
        tcp_nodelay        off;
        gzip               on;
        gzip_http_version  1.0;
        gzip_comp_level    2;
        gzip_proxied       any;
        gzip_types         text/plain text/css application/javascript text/xml application/xml+rss;
        keepalive_timeout  65;
        ssl_protocols      TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
        ssl_ciphers        HIGH:!aNULL:!MD5;
        client_max_body_size 80M;
        server_tokens off;

      server {
        listen 8080;
        server_name localhost *.gov.bc.ca;
        server_tokens off;

        root /opt/app-root/src;
        index index.html index.htm;

        include mime.types;
        add_header X-Frame-Options "ALLOW-FROM common-logon-dev.hlth.gov.bc.ca" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header Content-Security-Policy "frame-ancestors 'self'  common-logon-dev.hlth.gov.bc.ca; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com https://fonts.gstatic.com ; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com" always;
        add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "no-referrer-when-downgrade";

        gzip on;
        gzip_min_length 1000;
        gzip_proxied expired no-cache no-store private auth;
        gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;

        location / {
          try_files $uri $uri/ /index.html$args;
        }
        location /api/docman/ {
          proxy_pass http://{{ .Values.appName }}-document-manager:6001/;
        }
        location /api/v1/ {
          proxy_pass http://{{ .Values.appName }}-webapi:8080/api/;
        }
        location /api/v1/PLRHL7 {
          proxy_pass http://{{ .Values.appName }}-webapi:8080/api/PLRHL7;
          #        proxy_set_header  X-SSL-CERT $ssl_client_escaped_cert;
        }
        location /nginx_status {
          # Enable Nginx stats
          stub_status on;
          # Only allow access from localhost
          allow 127.0.0.1;
          # Other request should be denied
          deny all;
          # No need to log this request, its just noise
          access_log on;
        }
      }
      server {
        listen 8443 ssl;
        server_name *.gov.bc.ca;
        ssl_password_file certs/passwd.txt;
        ssl_certificate certs/chained.crt;
        ssl_certificate_key certs/private.key;
        server_tokens off;
        #    ssl_verify_client   optional_no_ca;

        root /opt/app-root/src;
        index index.html index.htm;

        add_header X-Frame-Options "ALLOW-FROM common-logon-dev.hlth.gov.bc.ca" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header Content-Security-Policy "frame-ancestors 'self'  common-logon-dev.hlth.gov.bc.ca; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com https://fonts.gstatic.com ; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com" always;
        add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "no-referrer-when-downgrade";

        gzip on;
        gzip_min_length 1000;
        gzip_proxied expired no-cache no-store private auth;
        gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;

        location / {
          try_files $uri $uri/ /index.html$args;
        }
        location /api/docman/ {
          proxy_pass http://{{ .Values.appName }}-document-manager:6001/;
        }
        location /api/v1/ {
          proxy_pass http://{{ .Values.appName }}-webapi:8080/api/;
        }
        location /api/v1/PLRHL7 {
          proxy_pass http://{{ .Values.appName }}-webapi:8080/api/PLRHL7;
          #        proxy_set_header  X-SSL-CERT $ssl_client_escaped_cert;
        }
        location /nginx_status {
          # Enable Nginx stats
          stub_status on;

          # Only allow access from localhost
          allow 127.0.0.1;

          # Other request should be denied
          deny all;

          # No need to log this request, its just noise
          access_log on;
        }
      }
      server {
        listen 8888;
        server_name *.gov.bc.ca;
        server_tokens off;

        root /opt/app-root/src;
        index index.html index.htm;

        add_header X-Frame-Options "ALLOW-FROM common-logon-dev.hlth.gov.bc.ca" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header Content-Security-Policy "frame-ancestors 'self'  common-logon-dev.hlth.gov.bc.ca; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com https://fonts.gstatic.com ; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com" always;
        add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "no-referrer-when-downgrade";
        gzip on;
        gzip_min_length 1000;
        gzip_proxied expired no-cache no-store private auth;
        gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;

        location / {
          try_files $uri $uri/ /index.html$args;
        }
        location /api/docman/ {
          proxy_pass http://{{ .Values.appName }}-document-manager:6001;
        }
        location /api/v1/ {
          proxy_pass http://{{ .Values.appName }}-webapi:8080/api/;
        }
        location /nginx_status {
          # Enable Nginx stats
          stub_status on;
          # Only allow access from localhost
          allow 127.0.0.1;
          # Other request should be denied
          deny all;
          # No need to log this request, its just noise
          access_log on;
        }
      }
      server {
        # Block for API end-points that require a client certificate (Mutual Authentication)
        listen 8890 ssl;
        server_name *.gov.bc.ca;
        ssl_password_file certs/passwd.txt;
        ssl_certificate certs/chained.crt;
        ssl_certificate_key certs/private.key;
        server_tokens off;
        ssl_verify_client optional_no_ca;
        ssl_client_certificate certs/plr/trusted-ca-certs.pem;
        root /opt/app-root/src;
        index index.html index.htm;

        # add_header X-Frame-Options "ALLOW-FROM common-logon-dev.hlth.gov.bc.ca" always;
        # add_header X-XSS-Protection "1; mode=block" always;
        # add_header Content-Security-Policy "frame-ancestors 'self'  common-logon-dev.hlth.gov.bc.ca; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com https://fonts.gstatic.com ; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com" always;
        add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
        add_header X-Content-Type-Options "nosniff" always;
        # add_header Referrer-Policy "no-referrer-when-downgrade";
        gzip on;
        gzip_min_length 1000;
        gzip_proxied expired no-cache no-store private auth;
        gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;

        location /api/v1/PLRHL7 {
          proxy_pass http://{{ .Values.appName }}-webapi:8080/api/PLRHL7;
          proxy_set_header X-SSL-CERT $ssl_client_escaped_cert;
        }
      }
    }
---
#   Frontend Service
kind: Service
apiVersion: v1
metadata:
  name: {{ .Values.environment }}-frontend
  namespace: {{ .Values.licensePlate }}-{{ .Values.environment }}
  labels:
    app.kubernetes.io/part-of: {{ .Values.environment }}
spec:
  ports:
    - name: "http"
      port: 8080
      targetPort: 8080
    - name: "https"
      port: 8443
      targetPort: 8443
    - name: "hpr"
      port: 8888
      targetPort: 8888
    - name: "mutualauth"
      port: 8890
      targetPort: 8890
  selector:
    name: {{ .Values.environment }}-frontend
---
#   Ingress
kind: Ingress
apiVersion: networking.k8s.io/v1
metadata:
  name: {{ .Values.environment }}
  namespace: {{ .Values.licensePlate }}-{{ .Values.environment }}
  labels:
    app.kubernetes.io/part-of: {{ .Values.environment }}
spec:
  tls:
    - hosts:
      - '{{ .Values.appName }}.pharmanetenrolment.gov.bc.ca'
      - '{{ .Values.appName }}-hpr.pharmanetenrolment.gov.bc.ca'
      secretName: pharmanetenrolment-tls
  rules:
    - host: '{{ .Values.appName }}.pharmanetenrolment.gov.bc.ca'
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: {{ .Values.environment }}-frontend
                port:
                  number: 8080
    - host: '{{ .Values.appName }}-hpr.pharmanetenrolment.gov.bc.ca'
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: {{ .Values.environment }}-frontend
                port:
                  number: 8888
---
kind: Route
apiVersion: route.openshift.io/v1
metadata:
  name: {{ .Values.environment }}-frontend-mutualauth
  namespace: {{ .Values.licensePlate }}-{{ .Values.environment }}
  labels:
    app.kubernetes.io/part-of: {{ .Values.environment }}
spec:
  host: {{ .Values.environment }}-mauth-{{ .Values.licensePlate }}-{{ .Values.environment }}.apps.silver.devops.gov.bc.ca
  to:
    kind: Service
    name: {{ .Values.environment }}-frontend
    weight: 100
  port:
    targetPort: 8890
  tls:
    termination: passthrough
    insecureEdgeTerminationPolicy: Redirect
  wildcardPolicy: None