Skip to content

Commit 7b2a0ff

Browse files
kalinkrustevkleyow
kalinkrustev
authored and
kleyow
committed
fix: support read only root filesystem (#700)
1 parent 46b5d38 commit 7b2a0ff

File tree

4 files changed

+93
-29
lines changed

4 files changed

+93
-29
lines changed

‎terraform/gitops/generate-files/templates/mcm/configmaps/vault-config-configmap.hcl.tpl‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,8 @@ spec:
127127
- key: cli-add-dfsp-environment.json
128128
path: cli-add-dfsp-environment.json
129129
defaultMode: 420
130+
- name: tmp
131+
emptyDir: {}
130132

131133
containers:
132134
- name: ml-ttk-add-dfsp
@@ -143,9 +145,9 @@ spec:
143145
https://github.com/mojaloop/testing-toolkit-test-cases/archive/v${onboarding_collection_tag}.zip
144146
-O downloaded-test-collections.zip;
145147

146-
mkdir tmp_test_cases;
148+
mkdir /tmp/test_cases;
147149

148-
unzip -d tmp_test_cases -o downloaded-test-collections.zip;
150+
unzip -d /tmp/test_cases -o downloaded-test-collections.zip;
149151

150152
fxp_currencies="{{ .Data.fxpCurrencies }}"
151153

@@ -154,7 +156,7 @@ spec:
154156
npm run cli -- \
155157
-c cli-add-dfsp-config.json \
156158
-e cli-add-dfsp-environment.json \
157-
-i tmp_test_cases/testing-toolkit-test-cases-${onboarding_collection_tag}/collections/hub/provisioning/new_participants/new_dfsp.json \
159+
-i /tmp/test_cases/testing-toolkit-test-cases-${onboarding_collection_tag}/collections/hub/provisioning/new_participants/new_dfsp.json \
158160
-u http://moja-ml-testing-toolkit-backend:5050 \
159161
--report-format html \
160162
--report-auto-filename-enable true \
@@ -172,7 +174,7 @@ spec:
172174
npm run cli -- \
173175
-c cli-add-dfsp-config.json \
174176
-e fxp.json \
175-
-i tmp_test_cases/testing-toolkit-test-cases-${onboarding_collection_tag}/collections/hub/provisioning/new_participants/new_fxp.json \
177+
-i /tmp/test_cases/testing-toolkit-test-cases-${onboarding_collection_tag}/collections/hub/provisioning/new_participants/new_fxp.json \
176178
-u http://moja-ml-testing-toolkit-backend:5050 \
177179
--report-format html \
178180
--report-auto-filename-enable true \
@@ -193,6 +195,9 @@ spec:
193195
envFrom:
194196
- secretRef:
195197
name: moja-ml-ttk-test-setup-aws-creds
198+
env:
199+
- name: NPM_CONFIG_UPDATE_NOTIFIER
200+
value: "false"
196201
resources: {}
197202
volumeMounts:
198203
- name: {{ .Data.host }}-ml-ttk-add-dfsp-conf
@@ -201,13 +206,16 @@ spec:
201206
- name: {{ .Data.host }}-ml-ttk-add-dfsp-conf
202207
mountPath: /opt/app/cli-add-dfsp-config.json
203208
subPath: cli-add-dfsp-config.json
209+
- name: tmp
210+
mountPath: /tmp
204211
terminationMessagePath: /dev/termination-log
205212
terminationMessagePolicy: File
206213
imagePullPolicy: IfNotPresent
207214
restartPolicy: Never
208215
terminationGracePeriodSeconds: 30
209216
dnsPolicy: ClusterFirst
210-
securityContext: {}
217+
securityContext:
218+
readOnlyRootFilesystem: true
211219
schedulerName: default-scheduler
212220
completionMode: NonIndexed
213221
suspend: false

‎terraform/gitops/generate-files/templates/mojaloop/values-finance-portal.yaml.tpl‎

Lines changed: 71 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -71,16 +71,12 @@ role-assignment-service:
7171
}
7272

7373
reporting-hub-bop-api-svc:
74-
containerSecurityContext:
75-
enabled: false
7674
enabled: true
7775
ingress:
7876
enabled: false
7977

8078

8179
reporting-legacy-api:
82-
containerSecurityContext:
83-
enabled: false
8480
enabled: true
8581
ingress:
8682
enabled: false
@@ -157,6 +153,7 @@ reporting-hub-bop-shell:
157153
enabled: false
158154

159155
config:
156+
# images before v2.3.2 use env variables
160157
env:
161158
AUTH_MOCK_API: false
162159
REMOTE_API_BASE_URL: ''
@@ -172,25 +169,74 @@ reporting-hub-bop-shell:
172169
REMOTE_2_URL: https://${portal_fqdn}/uis/transfers
173170
REMOTE_3_URL: https://${portal_fqdn}/uis/settlements
174171
REMOTE_4_URL: https://${portal_fqdn}/uis/positions
172+
configFiles:
173+
# images after v2.3.2 use config.json and remotes.json
174+
config.json:
175+
AUTH_API_BASE_URL: ''
176+
AUTH_MOCK_API: 'false'
177+
REMOTE_API_BASE_URL: ''
178+
REMOTE_MOCK_API: 'false'
179+
AUTH_ENABLED: 'true'
180+
LOGIN_URL: https://${auth_fqdn}/kratos/self-service/login/browser
181+
LOGIN_PROVIDER: keycloak
182+
LOGOUT_URL: /kratos/self-service/logout/browser?return_to=https%3A%2F%2F${keycloak_fqdn}%2Frealms%2F${keycloak_realm_name}%2Fprotocol%2Fopenid-connect%2Flogout
183+
AUTH_TOKEN_URL: /kratos/sessions/whoami
184+
remotes.json:
185+
roles:
186+
path: /iam
187+
label: Roles
188+
menuComponent: Menu
189+
appComponent: App
190+
baseUrl: https://${portal_fqdn}/uis/iam
191+
url: https://${portal_fqdn}/uis/iam/app.js
192+
appName: reporting_hub_bop_role_ui
193+
transfers:
194+
path: /transfers
195+
label: Transfers
196+
menuComponent: Menu
197+
appComponent: App
198+
baseUrl: https://${portal_fqdn}/uis/transfers
199+
url: https://${portal_fqdn}/uis/transfers/app.js
200+
appName: reporting_hub_bop_trx_ui
201+
settlements:
202+
path: /settlements
203+
label: Settlements
204+
menuComponent: Menu
205+
appComponent: App
206+
baseUrl: https://${portal_fqdn}/uis/settlements
207+
url: https://${portal_fqdn}/uis/settlements/app.js
208+
appName: reporting_hub_bop_settlements_ui
209+
positions:
210+
path: /positions
211+
label: Financial Positions
212+
menuComponent: Menu
213+
appComponent: App
214+
baseUrl: https://${portal_fqdn}/uis/positions
215+
url: https://${portal_fqdn}/uis/positions/app.js
216+
appName: reporting_hub_bop_positions_ui
175217

176218
### Micro-frontends
177219
reporting-hub-bop-role-ui:
178220
enabled: true
179221
ingress:
180222
enabled: false
181-
config:
182-
env:
183-
REACT_APP_API_BASE_URL: https://${portal_fqdn}/api/iam
184-
REACT_APP_MOCK_API: false
223+
configFiles:
224+
runtime-env.js: |
225+
window.roleEnv = {
226+
REACT_APP_API_BASE_URL: 'https://${portal_fqdn}/api/iam',
227+
REACT_APP_MOCK_API: 'false'
228+
};
185229

186230
reporting-hub-bop-trx-ui:
187231
enabled: true
188232
ingress:
189233
enabled: false
190-
config:
191-
env:
192-
REACT_APP_API_BASE_URL: https://${portal_fqdn}/api/transfers
193-
REACT_APP_MOCK_API: false
234+
configFiles:
235+
runtime-env.js: |
236+
window.transferEnv = {
237+
REACT_APP_API_BASE_URL: 'https://${portal_fqdn}/api/transfers',
238+
REACT_APP_MOCK_API: 'false'
239+
};
194240

195241
reporting-hub-bop-settlements-ui:
196242
## Overriding the image version for bugfix related to https://modusbox.atlassian.net/browse/MBP-639
@@ -199,20 +245,24 @@ reporting-hub-bop-settlements-ui:
199245
repository: mojaloop/reporting-hub-bop-settlements-ui
200246
tag: v0.0.19-snapshot.2
201247
enabled: true
202-
config:
203-
env:
204-
CENTRAL_LEDGER_ENDPOINT: https://${portal_fqdn}/api/central-admin
205-
CENTRAL_SETTLEMENTS_ENDPOINT: https://${portal_fqdn}/api/central-settlements
206-
REPORTING_API_ENDPOINT: https://${portal_fqdn}/api/transfers
207-
REPORTING_TEMPLATE_API_ENDPOINT: https://${portal_fqdn}/api/reports/report-bilateral-settlement
248+
configFiles:
249+
runtime-env.js: |
250+
window.settlementEnv = {
251+
CENTRAL_LEDGER_ENDPOINT: 'https://${portal_fqdn}/api/central-admin',
252+
CENTRAL_SETTLEMENTS_ENDPOINT: 'https://${portal_fqdn}/api/central-settlements',
253+
REPORTING_API_ENDPOINT: 'https://${portal_fqdn}/api/transfers',
254+
REPORTING_TEMPLATE_API_ENDPOINT: 'https://${portal_fqdn}/api/reports/report-bilateral-settlement'
255+
};
208256
ingress:
209257
enabled: false
210258

211259

212260
reporting-hub-bop-positions-ui:
213261
enabled: true
214-
config:
215-
env:
216-
CENTRAL_LEDGER_ENDPOINT: https://${portal_fqdn}/api/central-admin
262+
configFiles:
263+
runtime-env.js: |
264+
window.positionsEnv = {
265+
CENTRAL_LEDGER_ENDPOINT: 'https://${portal_fqdn}/api/central-admin'
266+
};
217267
ingress:
218268
enabled: false

‎terraform/gitops/generate-files/templates/ory/kustomization.yaml.tpl‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@ resources:
77
- https://raw.githubusercontent.com/ory/k8s/v${oathkeeper_chart_version}/helm/charts/oathkeeper-maester/crds/crd-rules.yaml
88
- blank-rule.yaml
99
- rbac-role-permissions.yaml
10-
- https://raw.githubusercontent.com/mojaloop/charts/v${bof_chart_version}/mojaloop/security-role-perm-operator-svc/crds/mojalooprole-crd.yaml
11-
- https://raw.githubusercontent.com/mojaloop/charts/v${bof_chart_version}/mojaloop/security-role-perm-operator-svc/crds/mojaloop-permission-exclusions-crd.yaml
10+
- https://raw.githubusercontent.com/mojaloop/charts/v${security_role_chart_version}/mojaloop/security-role-perm-operator-svc/crds/mojalooprole-crd.yaml
11+
- https://raw.githubusercontent.com/mojaloop/charts/v${security_role_chart_version}/mojaloop/security-role-perm-operator-svc/crds/mojaloop-permission-exclusions-crd.yaml
1212
helmCharts:
1313
- name: oathkeeper
1414
releaseName: oathkeeper

‎terraform/gitops/k8s-cluster-config/ory.tf‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ module "generate_ory_files" {
4242
istio_external_wildcard_gateway_name = local.istio_external_wildcard_gateway_name
4343
istio_internal_wildcard_gateway_name = local.istio_internal_wildcard_gateway_name
4444
bof_chart_version = try(var.app_var_map.bof_chart_version, var.bof_chart_version)
45+
security_role_chart_version = try(var.app_var_map.security_role_chart_version, var.security_role_chart_version)
4546
bof_release_name = local.bof_release_name
4647
vault_secret_key = var.vault_secret_key
4748
role_assign_svc_secret_name = join("$", ["", "{${replace(var.role_assign_svc_secret, "-", "_")}}"])
@@ -111,7 +112,12 @@ variable "keycloak_hubop_realm_name" {
111112
}
112113
variable "bof_chart_version" {
113114
type = string
114-
default = "5.1.0"
115+
default = "5.1.1"
116+
}
117+
118+
variable "security_role_chart_version" {
119+
type = string
120+
default = "2.1.10"
115121
}
116122

117123
variable "rbac_permissions_file" {

0 commit comments

Comments
 (0)