Public Information

charts/envtoolbox/Chart.yaml

@@ -0,0 +1,11 @@
+apiVersion: v2
+name: nplus-environment-toolbox
+description: Installs the environment toolbox with git and nstore downloader installed, also serving as target for pool copy actions in the pipeline
+icon: data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4KPHN2ZyB2ZXJzaW9uPSIxLjEiIGlkPSJFYmVuZV8xIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB4PSIwcHgiIHk9IjBweCIKCSB2aWV3Qm94PSIwIDAgNTEuMDI0IDUxLjAyNCIgZW5hYmxlLWJhY2tncm91bmQ9Im5ldyAwIDAgNTEuMDI0IDUxLjAyNCIgeG1sOnNwYWNlPSJwcmVzZXJ2ZSI+CjxnPgoJPHBvbHlnb24gZmlsbD0iI0E0QkZFNCIgcG9pbnRzPSIzMi4zMjIsMTkuNzQ0IDIwLjY0OSwxOS43NDQgMTguNTkxLDMxLjQxNyAzMC4yNjQsMzEuNDE3IAkiLz4KCTxwb2x5Z29uIGZpbGw9IiNBNEJGRTQiIHBvaW50cz0iNDcuMTg1LDE5Ljc0NCAzNS41MTIsMTkuNzQ0IDMzLjQ1NCwzMS40MTcgNDUuMTI2LDMxLjQxNyAJIi8+Cgk8cG9seWdvbiBmaWxsPSIjQTRCRkU0IiBwb2ludHM9IjI5Ljc2NiwzNC41NTEgMTguMDk0LDM0LjU1MSAxNi4wMzUsNDYuMjI0IDI3LjcwOCw0Ni4yMjQgCSIvPgoJPHBvbHlnb24gZmlsbD0iI0E0QkZFNCIgcG9pbnRzPSIxNy41NywxOS43NDQgNS44OTcsMTkuNzQ0IDMuODM5LDMxLjQxNyAxNS41MTIsMzEuNDE3IAkiLz4KCTxwb2x5Z29uIGZpbGw9IiNBNEJGRTQiIHBvaW50cz0iMzUuMTUsNC43OTkgMjMuNDc3LDQuNzk5IDIxLjQxOSwxNi40NzIgMzMuMDkyLDE2LjQ3MiAJIi8+Cjwvc3ZnPgo=
+type: application
+dependencies:
+  - name: nplus-globals
+    alias: globals
+    version: "*-0"
+    repository: "file://../globals"
+version: 1.0.0

charts/envtoolbox/README.md

@@ -0,0 +1,126 @@
+
+
+# nplus-environment-toolbox
+
+Installs the environment toolbox with git and nstore downloader installed, also serving as target for pool copy actions in the pipeline
+
+## nplus-environment-toolbox Chart Configuration
+
+You can customize / configure nplus-environment-toolbox by setting configuration values on the command line or in values files,
+that you can pass to helm. Please see the samples directory for details.
+
+In case there is no value set, the key will not be used in the manifest, resulting in values taken from the config files of the component.
+
+### Template Functions
+
+You can use template functions in the values files. If you do so, make sure you quote correctly (single quotes, if you have double quotes in the template,
+or escaped quotes).
+
+### Global Values
+
+All values can be set per component, per instance or globally per environment.
+
+Example: `global.ingress.domain` sets the domain on instance level. You can still set a different domain on a component, such as administrator.
+In that case, simply set `ingress.domain` for the administrator chart and that setting will have priority:
+
+- Prio 1 - Component Level: `ingress.domain`
+- Prio 2 - Instance Level: `global.ingress.domain`
+- Prio 3 - Environment Level: `global.environment.ingress.domain`
+
+### Using Values in Templates
+
+As it would be a lot of typing to write `.Values.ingress.domain | default .Values.global.ingress.domain | default .Values.global.environment.ingress.domain`in your
+template code, this is automatically done by nplus. You can simply type `.this.ingress.domain` and you will get a condensed and defaulted version
+of your Values.
+
+So an example in your `values.yaml` would be:
+
+```
+administrator:
+  waitFor:
+    - '-service {{ .component.prefix }}nappljobs.{{ .Release.Namespace }}.svc.cluster.local:\{{ .this.nappl.port }} -timeout 600'
+```
+
+This example shows `.this.nappl.port` which might come from a component, instance or global setting. You do not need to care.
+The `.Release.Namespace` is set by helm. You have access to all Release and Chart Metadata, just like in your chart code.
+
+The `.component.prefix` is calculated by nplus and gives you some handy shortcuts to internal variables:
+
+- `.component.chartName` 
+  The name of the chart as in `.Chart.Name`, but with override by `.Values.nameOverride`
+- `.component.shortChartName` 
+  A shorter Version of the name - `nappl` instead of `nplus-component-nappl`
+- `.component.prefix` 
+  The instance Prefix used to name the resources including `-`. This prefix is dropped, if the
+  `.Release.Name` equals `.Release.Namespace` for those of you that only
+  run one nplus Instance per namespace
+- `.component.name` 
+  The name of the component, including `.Values.nameOverride` and some logic
+- `.component.fullName` 
+  The fullName inlcuding `.Values.fullnameOverride` and some logic
+- `.component.chart` 
+  Mainly the `Chart.Name` and `Chart.Version`
+- `.component.storagePath` 
+  The path where the component config is stored in the conf PVC
+- `.component.handler` 
+  The handler (either helm, argoCD or manual)
+
+- `.instance.name` 
+  The name of the instance, but with override by `.Values.instanceOverride`
+- `.instance.group` 
+  The group, this instance belongs to. Override by `.Values.groupOverride`
+- `.instance.version` 
+  The *nscale* version (mostly taken from Application Layer), this instance is deploying.
+
+- `.environment.name` 
+  The name of the environment, but with override by `.Values.environmentNameOverride`
+
+### Keys
+
+You can set any of the following values for this component:
+
+| Key | Description | Default |
+|-----|-------------|---------|
+env | Sets additional environment variables for the configuration. |   |
+envMap | Sets the name of a configMap, which holds additional environment variables for the configuration. It is added as envFrom configMap to the container. |   |
+envSecret | Sets the name of a secret, which holds additional environment variables for the configuration. It is added as envFrom secretRef to the container. |   |
+fullnameOverride | This overrides the output of the internal fullname function |   |
+**image**​.name | the name of the image to use |  `"toolbox2"` |
+**image**​.pullSecrets | you can provide your own pullSecrets, in case you use a private repo. |  `["nscale-cr", "nplus-cr"]` |
+**image**​.repo | if you use a private repo, feel free to set it here |  `"cr.nplus.cloud/subscription"` |
+**image**​.tag | the tag of the image to use |  `"latest"` |
+**meta**​.language | Sets the language of the main service (in the *service* container). This is used for instance if you turn OpenTelemetry on, to know which Agent to inject into the container. |   |
+**meta**​.provider | sets provider (partner, reseller) information to be able to invoice per use in a cloud environment |   |
+**meta**​.serviceContainer | The container name of the main service for this component. This is used to define where to inject the telemetry agents, if any |   |
+**meta**​.stage | A optional parameter to indicate the stage (DEV, QA, PROD, ...) this component, instance or environment runs in. This can be used in template functions to add the stage to for instance the service name of telemetry services like open telemetry. (see telemetry example) |   |
+**meta**​.tenant | sets tenant information to be able to invoice per use in a cloud environment |   |
+**meta**​.type | the type of the component. You should not change this value, except if you use a pipeliner in core mode. In core mode, it should be *core*, else *pipeliner* This type is used to create cluster communication for nappl and nstl and potentially group multiple replicaSets into one service. |  `"envtoolbox"` |
+**meta**​.wave | Sets the wave in which this component should be deployed within an ArgoCD deployment if unset, it uses the default wave thus all components are installed in one wave, then relying on correct wait settings just like in a helm installation |   |
+minReplicaCountType | if you set minReplicaCountType, a podDesruptionBudget will be created with this value as minAvailable, using the component type as selector. This is useful for components, that are spread across multiple replicaSets, like sharepoint or storage layer |   |
+nameOverride | This overrides the output of the internal name function |   |
+nodeSelector | select specific nodes for this component |   |
+**nstoreDownloader**​.enabled | enables the nstore downloader |  `false` |
+**nstoreDownloader**​.nstore | set the nstore URL |  `https://nstore.ceyoniq.com...` |
+**nstoreDownloader**​.target | target directory in the conf pv |  `"pool/nstore"` |
+**resources**​.limits​.cpu | The maximum allowed CPU for the container |  `"1"` |
+**resources**​.limits​.memory | The maximum allowed RAM for the container |  `"512Mi"` |
+**resources**​.requests​.cpu | Set the share of guaranteed CPU to the container. |  `"1m"` |
+**resources**​.requests​.memory | Set the share of guaranteed RAM to the container |  `"64Mi"` |
+**security**&#8203;.containerSecurityContext&#8203;.allowPrivilegeEscalation | Some functionality may need the possibility to allow privilege escalation. This should be very restrictive <br>you should not change this | **info only**, do not change<br> `false` |
+**security**&#8203;.containerSecurityContext&#8203;.readOnlyRootFilesystem | sets the container root file system to read only. This should be the case in production environment <br>you should not change this | **info only**, do not change<br> `true` |
+**security**&#8203;.podSecurityContext&#8203;.fsGroup | The file system group as which new files are created <br>there is normally no need to change this | **info only**, do not change<br> `1001` |
+**security**&#8203;.podSecurityContext&#8203;.fsGroupChangePolicy | Under which condition should the fsGroup be changed <br>there is normally no need to change this | **info only**, do not change<br> `"OnRootMismatch"` |
+**security**&#8203;.podSecurityContext&#8203;.runAsUser | The user under which the container ist run. Avoid 0 / root. The container should run in a non-root context for security <br>there is normally no need to change this | **info only**, do not change<br> `1001` |
+**security**&#8203;.zeroTrust | turns on *Zero Trust* Mode, disabling *all* http communication, even the internal http probes |  `false` |
+**telemetry**&#8203;.openTelemetry | turns Open Telemetry on |   |
+**telemetry**&#8203;.serviceName | Sets the service name for the telemetry service to more convenient identify the displayed component Example: "{{ .this.meta.type }}-{{ .instance.name }}" |   |
+terminationGracePeriodSeconds | Sets the terminationGracePeriodSeconds for the component If not set, it uses the Kubernetes defaults |   |
+timezone | set the time zone for this component to make sure log output has a specific timestamp, internal dates and times are correct (like the creationDate in nappl) etc. |  `Europe/Berlin` |
+tolerations | Set tolerations for this component |   |
+**utils**&#8203;.debug | Turn debugging *on* will give you stack trace etc.  Please check out the Chart Developer Guide |  `false` |
+**utils**&#8203;.disableWait | in case you use the argoCD Wave feature, you might think about switching off the waitFor mechanism, that makes sure PODs are only started after pre-requisites are fulfilled. You can disable the starndard wait mechanism, but at your own risk, as this might start components even if they are not intended to run yet. |  `false` |
+**utils**&#8203;.disableWave | If you use argoCD, you most likely want to use the argo Wave Feature as well, making sure the components of an instance are deployed ordered. However, in DEV you might want to disable this to allow live changing components while previous waves are not finished yet. |  `false` |
+**utils**&#8203;.includeNamespace | By default, the namespace is rendered into the manifest. However, if you want to use `helm template` and store manifests for later applying them to multiple namespaces, you might want to turn this `false` to be able to use `kubectl apply -n <namespace> -f template.yaml` later |  `true` |
+**utils**&#8203;.maintenance | in Maintenance Mode, all *waitFor* actions will be skipped, the *Health Checks* are ignored and the pods will start in idle, not starting the service at all. This will allow you to gain access to the container to perform recovery and maintenance tasks while having the real container up. |  `false` |
+**utils**&#8203;.renderComments | You can turn Comment rendering *on* to get descriptive information inside the manifests. It will also fail on depricated functions and keys, so it is recommended to only switch it off in PROD |  `true` |
+

charts/envtoolbox/templates/cronjob-nstore.tpl

@@ -0,0 +1,72 @@
+{{- define "nplus.environment.nstorecopy" -}}
+{{- if (.Values.nstoreDownloader).enabled }}
+template:
+  metadata:
+    labels:
+      {{- include "nplus.instanceLabels" . | nindent 6 }}
+  spec:
+    {{- include "nplus.podSecurityContext" . | nindent 4 }}
+    {{- include "nplus.imagePullSecrets" . | nindent 4 }}
+    containers:
+    - name: downloader
+      image: {{ include "nplus.image"  (dict "global" .Values.global "image" .Values.image) }}
+      imagePullPolicy: {{ include "nplus.imagePullPolicy" .Values.image }}
+      {{ include "nplus.containerSecurityContext" . | nindent 6 }}
+      command: [ "/bin/sh", "-c" ]
+      args:
+      - |
+          mkdir -p /conf/{{ .Values.nstoreDownloader.target }}
+          cd /conf/{{ .Values.nstoreDownloader.target }}
+          wget -r -np -nH -nc -nd -A zip -X '*/*/*/*/*/*/1*,*/*/*/*/*/*/2*,*/*/*/*/*/*/3*,*/*/*/*/*/*/4*,*/*/*/*/*/*/5*,*/*/*/*/*/*/6*,*/*/*/*/*/*/7*,*/*/*/*/*/*/8*' -nd {{ .Values.nstoreDownloader.nstore }}
+      volumeMounts:
+      - name: conf
+        mountPath: /conf
+
+    restartPolicy: OnFailure
+    volumes:
+    - name: conf
+      persistentVolumeClaim:
+        claimName: conf
+{{- end -}}
+{{- end -}}
+---
+{{- if .Values.nstoreDownloader.enabled }}
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ .component.fullName }}-nstore
+  {{- if .this.utils.includeNamespace }}
+  namespace: {{ .Release.Namespace }}
+  {{- end }}
+  labels:
+    {{- include "nplus.instanceLabels" . | nindent 4 }}
+  annotations:
+    {{- include "nplus.annotations" . | nindent 4 }}
+    {{- include "nplus.securityAnnotations" . | nindent 4 }}
+spec:
+  schedule: "0 3 * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 0
+  failedJobsHistoryLimit: 1
+  jobTemplate:
+    spec:
+      {{- include "nplus.environment.nstorecopy" . | nindent 6 }}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ .component.fullName }}-nstore-oncreate
+  {{- if .this.utils.includeNamespace }}
+  namespace: {{ .Release.Namespace }}
+  {{- end }}
+  labels:
+    {{- include "nplus.instanceLabels" . | nindent 4 }}
+  annotations:
+    {{- include "nplus.annotations" . | nindent 4 }}
+    {{- include "nplus.securityAnnotations" . | nindent 4 }}
+spec:
+  ttlSecondsAfterFinished: 60
+  {{- include "nplus.environment.nstorecopy" . | nindent 2 }}
+{{- else }}
+# nstore Downloader is disabled
+{{- end }}

charts/envtoolbox/templates/networkpolicy.tpl

@@ -0,0 +1,33 @@
+{{- include "nplus.init" $ -}}
+{{- if ((.this.security).cni).createNetworkPolicy }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ .component.fullName }}
+  {{- if .this.utils.includeNamespace }}
+  namespace: {{ .Release.Namespace }}
+  {{- end }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "nplus.selectorLabels" . | nindent 6 }}
+
+  policyTypes:
+  - Egress
+  - Ingress
+
+  egress:
+  - ports:
+      # -- Possible K8s API
+      - protocol: TCP
+        port: 16443
+      # -- Possible K8s API AND potential git server
+      - protocol: TCP
+        port: 443
+      # -- Access DNS
+      - protocol: TCP
+        port: 53
+      # -- Access DNS
+      - protocol: UDP
+        port: 53
+{{- end }}

charts/envtoolbox/templates/pdb.tpl

@@ -0,0 +1,2 @@
+{{- include "nplus.init" $ -}}
+{{- include "nplus.podDisruptionBudget" . -}}

charts/envtoolbox/templates/rbac.tpl

@@ -0,0 +1,76 @@
+{{- include "nplus.init" $ -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .component.fullName }}-svc-account
+  {{- if .this.utils.includeNamespace }}
+  namespace: {{ .Release.Namespace }}
+  {{- end }}
+  labels:
+    {{- include "nplus.instanceLabels" . | nindent 4 }}
+  annotations:
+    {{- include "nplus.argoSharedResource" . | nindent 4 }}
+    {{- include "nplus.annotations" . | nindent 4 }}
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .component.fullName }}-role
+  {{- if .this.utils.includeNamespace }}
+  namespace: {{ .Release.Namespace }}
+  {{- end }}
+  labels:
+    {{- include "nplus.instanceLabels" . | nindent 4 }}
+  annotations:
+    {{- include "nplus.argoSharedResource" . | nindent 4 }}
+    {{- include "nplus.annotations" . | nindent 4 }}
+
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "secrets","serviceaccounts", "persistentvolumeclaims", "configmaps", "services", "replicationcontrollers", "pods/log"]
+    verbs: ["create", "get", "update", "patch", "delete", "list", "watch"]
+  - apiGroups: ["apps"]
+    resources: ["deployments", "statefulsets", "daemonsets", "replicasets"]
+    verbs: ["create", "get", "update", "patch", "delete", "list", "watch"]
+  - apiGroups: ["rbac.authorization.k8s.io"]
+    resources: ["Role", "roles", "rolebindings"]
+    verbs: ["create", "get", "update", "patch", "delete", "list", "watch"]
+  - apiGroups: ["batch"]
+    resources: ["jobs", "cronjobs"]
+    verbs: ["create", "get", "update", "patch", "delete", "list", "watch"]
+  - apiGroups: ["autoscaling"]
+    resources: ["horizontalpodautoscalers"]
+    verbs: ["create", "get", "update", "patch", "delete", "list", "watch"]
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["ingresses"]
+    verbs: ["create", "get", "update", "patch", "delete", "list", "watch"]
+  - apiGroups: ["cert-manager.io"]
+    resources: ["certificates"]
+    verbs: ["create", "get", "update", "patch", "delete", "list", "watch"]
+
+  - apiGroups: ["nplus.cloud"]
+    resources: ["components", "instances"]
+    verbs: ["get", "update", "patch", "list", "watch"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .component.fullName }}-role-binding
+  {{- if .this.utils.includeNamespace }}
+  namespace: {{ .Release.Namespace }}
+  {{- end }}
+  labels:
+    {{- include "nplus.instanceLabels" . | nindent 4 }}
+  annotations:
+    {{- include "nplus.argoSharedResource" . | nindent 4 }}
+    {{- include "nplus.annotations" . | nindent 4 }}
+
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .component.fullName }}-role
+subjects:
+- kind: ServiceAccount
+  name: {{ .component.fullName }}-svc-account

charts/envtoolbox/templates/statefulset.tpl

@@ -0,0 +1,125 @@
+{{- include "nplus.init" $ -}}
+
+{{- if not ((.this.storage).conf).name -}}
+  {{ fail "conf name must be set" }}
+{{- end -}}
+{{- if not ((.this.storage).ptemp).name -}}
+  {{ fail "ptemp name must be set" }}
+{{- end -}}
+
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ .component.fullName }}
+  {{- if .this.utils.includeNamespace }}
+  namespace: {{ .Release.Namespace }}
+  {{- end }}
+  labels:
+    {{- include "nplus.instanceLabels" . | nindent 4 }}
+  annotations:
+    {{- include "nplus.annotations" . | nindent 4 }}
+    {{- include "nplus.securityAnnotations" . | nindent 4 }}
+
+spec:
+  serviceName: {{ .component.fullName }}
+  selector:
+    matchLabels:
+      {{- include "nplus.selectorLabels" . | nindent 6 }}
+  replicas: 1
+  podManagementPolicy: OrderedReady
+  updateStrategy:
+      type: RollingUpdate
+  minReadySeconds: 30
+  template:
+    metadata:
+      labels:
+        {{- include "nplus.templateLabels" . | nindent 8 }}
+      annotations:
+        {{- include "nplus.templateAnnotations" . | nindent 8 }}
+        {{- include "nplus.securityAnnotations" . | nindent 8 }}
+        kubectl.kubernetes.io/default-container: toolbox
+    spec:
+      serviceAccountName: {{ .component.fullName }}-svc-account
+      {{- include "nplus.imagePullSecrets" . | nindent 6 }}
+      {{- include "nplus.podSecurityContext" . | nindent 6 }}
+      {{- include "nplus.securityIllumioReadinessGates" . | nindent 6 }}
+      {{- include "nplus.terminationGracePeriodSeconds" . | nindent 6 }}
+      
+      initContainers:
+      {{/*
+      - name: deploy
+        image: {{ .Values.toolboxImage }}
+        imagePullPolicy: {{ .Values.toolboxImagePullPolicy }}
+        {{- include "nplus.containerSecurityContext" . | nindent 8 }}
+        command: [ "/bin/sh", "-c" ]
+        args:
+        - |
+            echo "deploying to /nplus"
+            cp -rnxv /opt/42i/nplus/* /nplus
+        volumeMounts:
+        - name: nplus
+          mountPath: /nplus
+      {{- end }} */}}
+      - name: dirprepare
+        image: {{ include "nplus.image"  (dict "global" .Values.global "image" .Values.image) }}
+        imagePullPolicy: {{ include "nplus.imagePullPolicy" .Values.image }}
+        {{- include "nplus.containerSecurityContext" . | nindent 8 }}
+        {{- include "nplus.initResources" . | nindent 8 }}
+        command: [ "/bin/sh", "-c" ]
+        args:
+        - |
+            mkdir -p /conf/pool/{apps,fonts,snippets,scripts,snc} && \
+            {{- if not ((.this.storage).conf).cifs }}
+            chmod 775 -R /conf/pool && \
+            {{- end }}
+            echo "ok."
+        volumeMounts:
+        - name: conf
+          mountPath: /conf
+      - name: gitprepare
+        image: {{ include "nplus.image"  (dict "global" .Values.global "image" .Values.image) }}
+        imagePullPolicy: {{ include "nplus.imagePullPolicy" .Values.image }}
+        {{- include "nplus.containerSecurityContext" . | nindent 8 }}
+        {{- include "nplus.initResources" . | nindent 8 }}
+        command: [ "/bin/sh", "-c" ]
+        args:
+        - |
+            echo "checking git in /conf..."
+            if [ ! -f "/conf/.gitignore" ]; then
+            echo "writing .gitignore"
+            echo "/{{ .Values.nstoreDownloader.target }}/*" > /conf/.gitignore
+            fi
+            if [ ! -d "/conf/.git" ]; then
+            echo "init git in /conf with branch master"
+            git -C "/conf" init -b master
+            git -C "/conf" add .gitignore
+            echo "first commit (with .gitignore)"
+            git -C "/conf" commit -m "Initial commit for config of nplus environment {{ .Release.Namespace }}"
+            fi
+            echo "ok."
+        volumeMounts:
+        - name: conf
+          mountPath: /conf
+      containers:
+      - name: toolbox
+        image: {{ include "nplus.image"  (dict "global" .Values.global "image" .Values.image) }}
+        imagePullPolicy: {{ include "nplus.imagePullPolicy" .Values.image }}
+        {{- include "nplus.containerSecurityContext" . | nindent 8 }}
+        command: [ "/bin/bash", "-c", "--" ]
+        args: [ "while true; do sleep 30; done;" ]
+
+        volumeMounts:
+        - name: conf
+          mountPath: /conf
+        - name: ptemp
+          mountPath: /ptemp
+        {{- include "nplus.resources" . | nindent 8 }}
+
+      volumes:
+      - name: ptemp
+        persistentVolumeClaim:
+          claimName: ptemp
+      - name: conf
+        persistentVolumeClaim:
+          claimName: conf
+

charts/envtoolbox/values.schema.json

@@ -0,0 +1,380 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "env": {
+      "default": "",
+      "description": "Sets additional environment variables for the configuration.",
+      "title": "env"
+    },
+    "envMap": {
+      "default": "",
+      "description": "Sets the name of a configMap, which holds additional environment variables for the configuration. It is added as envFrom configMap to the container.",
+      "title": "envMap"
+    },
+    "envSecret": {
+      "default": "",
+      "description": "Sets the name of a secret, which holds additional environment variables for the configuration. It is added as envFrom secretRef to the container.",
+      "title": "envSecret"
+    },
+    "fullnameOverride": {
+      "default": "",
+      "description": "This overrides the output of the internal fullname function",
+      "title": "fullnameOverride"
+    },
+    "global": {
+      "description": "Global values are values that can be accessed from any chart or subchart by exactly the same name.",
+      "title": "global",
+      "type": "object"
+    },
+    "globals": {
+      "description": "nplus Global Functions Library Chart",
+      "properties": {
+        "global": {
+          "description": "Global values are values that can be accessed from any chart or subchart by exactly the same name.",
+          "title": "global",
+          "type": "object"
+        }
+      },
+      "title": "nplus-globals",
+      "type": "object"
+    },
+    "image": {
+      "additionalProperties": false,
+      "description": "provide the image to be used for this component",
+      "properties": {
+        "name": {
+          "default": "toolbox2",
+          "description": "the name of the image to use",
+          "title": "name"
+        },
+        "pullPolicy": {
+          "default": "IfNotPresent",
+          "title": "pullPolicy",
+          "type": "string"
+        },
+        "pullSecrets": {
+          "description": "you can provide your own pullSecrets, in case you use a private repo.",
+          "items": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "string"
+              }
+            ]
+          },
+          "title": "pullSecrets"
+        },
+        "repo": {
+          "default": "cr.nplus.cloud/subscription",
+          "description": "if you use a private repo, feel free to set it here",
+          "title": "repo"
+        },
+        "tag": {
+          "default": "1.2.1300",
+          "description": "the tag of the image to use",
+          "title": "tag"
+        }
+      },
+      "title": "image"
+    },
+    "meta": {
+      "additionalProperties": false,
+      "properties": {
+        "componentVersion": {
+          "default": "",
+          "description": "This is the version of the component, used for display @internal -- set by devOps pipeline, so do not modify",
+          "title": "componentVersion"
+        },
+        "language": {
+          "default": "",
+          "description": "Sets the language of the main service (in the *service* container). This is used for instance if you turn OpenTelemetry on, to know which Agent to inject into the container.",
+          "title": "language"
+        },
+        "ports": {
+          "additionalProperties": false,
+          "description": "lists the ports this component exposes. This is important for zero trust mode and others.",
+          "properties": {
+            "http": {
+              "default": "",
+              "description": "The http port this component uses (if any). In zero trust mode, this will be disabled. @internal -- this is a constant value of the component and should not be changed.",
+              "title": "http"
+            },
+            "https": {
+              "default": "",
+              "description": "The tls / https port, this component uses (if any) @internal -- this is a constant value of the component and should not be changed.",
+              "title": "https"
+            },
+            "rmi": {
+              "default": "",
+              "description": "A potential rmi port, this component uses (if any) @internal -- this is a constant value of the component and should not be changed.",
+              "title": "rmi"
+            },
+            "tcp": {
+              "default": "",
+              "description": "A potential tcp port, this component uses (if any) @internal -- this is a constant value of the component and should not be changed.",
+              "title": "tcp"
+            },
+            "tcps": {
+              "default": "",
+              "description": "A potential tls / tcps port, this component uses (if any) @internal -- this is a constant value of the component and should not be changed.",
+              "title": "tcps"
+            }
+          },
+          "title": "ports"
+        },
+        "provider": {
+          "default": "",
+          "description": "sets provider (partner, reseller) information to be able to invoice per use in a cloud environment",
+          "title": "provider"
+        },
+        "serviceContainer": {
+          "default": "",
+          "description": "The container name of the main service for this component. This is used to define where to inject the telemetry agents, if any",
+          "title": "serviceContainer"
+        },
+        "stage": {
+          "default": "",
+          "description": "A optional parameter to indicate the stage (DEV, QA, PROD, ...) this component, instance or environment runs in. This can be used in template functions to add the stage to for instance the service name of telemetry services like open telemetry. (see telemetry example)",
+          "title": "stage"
+        },
+        "tenant": {
+          "default": "",
+          "description": "sets tenant information to be able to invoice per use in a cloud environment",
+          "title": "tenant"
+        },
+        "type": {
+          "default": "envtoolbox",
+          "description": "the type of the component. You should not change this value, except if you use a pipeliner in core mode. In core mode, it should be *core*, else *pipeliner* This type is used to create cluster communication for nappl and nstl and potentially group multiple replicaSets into one service.",
+          "title": "type"
+        },
+        "wave": {
+          "default": "",
+          "description": "Sets the wave in which this component should be deployed within an ArgoCD deployment if unset, it uses the default wave thus all components are installed in one wave, then relying on correct wait settings just like in a helm installation",
+          "title": "wave"
+        }
+      },
+      "title": "meta",
+      "type": "object"
+    },
+    "minReplicaCountType": {
+      "default": "",
+      "description": "if you set minReplicaCountType, a podDesruptionBudget will be created with this value as minAvailable, using the component type as selector. This is useful for components, that are spread across multiple replicaSets, like sharepoint or storage layer",
+      "title": "minReplicaCountType"
+    },
+    "nameOverride": {
+      "default": "",
+      "description": "This overrides the output of the internal name function",
+      "title": "nameOverride"
+    },
+    "nodeSelector": {
+      "default": "",
+      "description": "select specific nodes for this component",
+      "title": "nodeSelector"
+    },
+    "nstoreDownloader": {
+      "additionalProperties": false,
+      "properties": {
+        "enabled": {
+          "default": "false",
+          "description": "enables the nstore downloader",
+          "title": "enabled"
+        },
+        "nstore": {
+          "default": "`https://nstore.ceyoniq.com...`",
+          "description": "set the nstore URL",
+          "title": "nstore"
+        },
+        "target": {
+          "default": "pool/nstore",
+          "description": "target directory in the conf pv",
+          "title": "target"
+        }
+      },
+      "title": "nstoreDownloader",
+      "type": "object"
+    },
+    "resources": {
+      "additionalProperties": false,
+      "description": "Assigns hardware resources to container",
+      "properties": {
+        "limits": {
+          "additionalProperties": false,
+          "description": "Limits the maximum resources",
+          "properties": {
+            "cpu": {
+              "default": "1",
+              "description": "The maximum allowed CPU for the container",
+              "title": "cpu"
+            },
+            "memory": {
+              "default": "512Mi",
+              "description": "The maximum allowed RAM for the container",
+              "title": "memory"
+            }
+          },
+          "title": "limits"
+        },
+        "requests": {
+          "additionalProperties": false,
+          "description": "Requests are used to assign a minimum to a container. This is the guaranteed amount",
+          "properties": {
+            "cpu": {
+              "default": "1m",
+              "description": "Set the share of guaranteed CPU to the container.",
+              "title": "cpu"
+            },
+            "memory": {
+              "default": "64Mi",
+              "description": "Set the share of guaranteed RAM to the container",
+              "title": "memory"
+            }
+          },
+          "title": "requests"
+        }
+      },
+      "title": "resources"
+    },
+    "security": {
+      "additionalProperties": false,
+      "description": "Security Section defining default runtime environment for your container",
+      "properties": {
+        "containerSecurityContext": {
+          "additionalProperties": false,
+          "properties": {
+            "allowPrivilegeEscalation": {
+              "default": "false",
+              "description": "Some functionality may need the possibility to allow privilege escalation. This should be very restrictive @internal -- you should not change this",
+              "title": "allowPrivilegeEscalation"
+            },
+            "capabilities": {
+              "additionalProperties": false,
+              "description": "Capabilities this container should have. Only allow the necessity, and drop as many as possible @internal -- you should not change this",
+              "properties": {
+                "drop": {
+                  "items": {
+                    "anyOf": [
+                      {
+                        "type": "string"
+                      }
+                    ]
+                  },
+                  "title": "drop",
+                  "type": "array"
+                }
+              },
+              "title": "capabilities"
+            },
+            "readOnlyRootFilesystem": {
+              "default": "true",
+              "description": "sets the container root file system to read only. This should be the case in production environment @internal -- you should not change this",
+              "title": "readOnlyRootFilesystem"
+            }
+          },
+          "title": "containerSecurityContext",
+          "type": "object"
+        },
+        "podSecurityContext": {
+          "additionalProperties": false,
+          "properties": {
+            "fsGroup": {
+              "default": "1001",
+              "description": "The file system group as which new files are created @internal -- there is normally no need to change this",
+              "title": "fsGroup"
+            },
+            "fsGroupChangePolicy": {
+              "default": "OnRootMismatch",
+              "description": "Under which condition should the fsGroup be changed @internal -- there is normally no need to change this",
+              "title": "fsGroupChangePolicy"
+            },
+            "runAsUser": {
+              "default": "1001",
+              "description": "The user under which the container ist run. Avoid 0 / root. The container should run in a non-root context for security @internal -- there is normally no need to change this",
+              "title": "runAsUser"
+            }
+          },
+          "title": "podSecurityContext",
+          "type": "object"
+        },
+        "zeroTrust": {
+          "default": "`false`",
+          "description": "turns on *Zero Trust* Mode, disabling *all* http communication, even the internal http probes",
+          "title": "zeroTrust"
+        }
+      },
+      "title": "security"
+    },
+    "telemetry": {
+      "additionalProperties": false,
+      "description": "Settings for telemetry tools",
+      "properties": {
+        "openTelemetry": {
+          "default": "",
+          "description": "turns Open Telemetry on",
+          "title": "openTelemetry"
+        },
+        "serviceName": {
+          "default": "",
+          "description": "Sets the service name for the telemetry service to more convenient identify the displayed component Example: \"{{ .this.meta.type }}-{{ .instance.name }}\"",
+          "title": "serviceName"
+        }
+      },
+      "title": "telemetry"
+    },
+    "terminationGracePeriodSeconds": {
+      "default": "",
+      "description": "Sets the terminationGracePeriodSeconds for the component If not set, it uses the Kubernetes defaults",
+      "title": "terminationGracePeriodSeconds"
+    },
+    "timezone": {
+      "default": "`Europe/Berlin`",
+      "description": "set the time zone for this component to make sure log output has a specific timestamp, internal dates and times are correct (like the creationDate in nappl) etc.",
+      "title": "timezone"
+    },
+    "tolerations": {
+      "default": "",
+      "description": "Set tolerations for this component",
+      "title": "tolerations"
+    },
+    "utils": {
+      "additionalProperties": false,
+      "properties": {
+        "debug": {
+          "default": "`false`",
+          "description": "Turn debugging *on* will give you stack trace etc.  Please check out the Chart Developer Guide",
+          "title": "debug"
+        },
+        "disableWait": {
+          "default": "`false`",
+          "description": "in case you use the argoCD Wave feature, you might think about switching off the waitFor mechanism, that makes sure PODs are only started after pre-requisites are fulfilled. You can disable the starndard wait mechanism, but at your own risk, as this might start components even if they are not intended to run yet.",
+          "title": "disableWait"
+        },
+        "disableWave": {
+          "default": "`false`",
+          "description": "If you use argoCD, you most likely want to use the argo Wave Feature as well, making sure the components of an instance are deployed ordered. However, in DEV you might want to disable this to allow live changing components while previous waves are not finished yet.",
+          "title": "disableWave"
+        },
+        "includeNamespace": {
+          "default": "`true`",
+          "description": "By default, the namespace is rendered into the manifest. However, if you want to use `helm template` and store manifests for later applying them to multiple namespaces, you might want to turn this `false` to be able to use `kubectl apply -n <namespace> -f template.yaml` later",
+          "title": "includeNamespace"
+        },
+        "maintenance": {
+          "default": "`false`",
+          "description": "in Maintenance Mode, all *waitFor* actions will be skipped, the *Health Checks* are ignored and the pods will start in idle, not starting the service at all. This will allow you to gain access to the container to perform recovery and maintenance tasks while having the real container up.",
+          "title": "maintenance"
+        },
+        "renderComments": {
+          "default": "`true`",
+          "description": "You can turn Comment rendering *on* to get descriptive information inside the manifests. It will also fail on depricated functions and keys, so it is recommended to only switch it off in PROD",
+          "title": "renderComments"
+        }
+      },
+      "title": "utils",
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

charts/envtoolbox/values.yaml

@@ -0,0 +1,174 @@
+# yaml-language-server: $schema=values.schema.json
+nstoreDownloader:
+  # -- enables the nstore downloader
+  enabled: false
+  # -- set the nstore URL
+  # @default -- `https://nstore.ceyoniq.com...`
+  nstore: "https://nstore.ceyoniq.com/repository/com/ceyoniq/nscale/businessapps/"
+  # -- target directory in the conf pv
+  target: pool/nstore
+# -- provide the image to be used for this component
+image:
+  # -- if you use a private repo, feel free to set it here
+  repo: cr.nplus.cloud/subscription
+  # -- the name of the image to use
+  name: toolbox2
+  # -- the tag of the image to use
+  tag: "latest"
+  pullPolicy: IfNotPresent
+  # -- you can provide your own pullSecrets, in case you use
+  # a private repo.
+  pullSecrets:
+    - nscale-cr
+    - nplus-cr
+# -- Security Section defining default runtime environment for your container
+security:
+  podSecurityContext:
+    # -- The user under which the container ist run. Avoid 0 / root. The container should run in a non-root context
+    # for security
+    # @internal -- there is normally no need to change this
+    runAsUser: 1001
+    # -- The file system group as which new files are created
+    # @internal -- there is normally no need to change this
+    fsGroup: 1001
+    # -- Under which condition should the fsGroup be changed
+    # @internal -- there is normally no need to change this
+    fsGroupChangePolicy: OnRootMismatch
+  containerSecurityContext:
+    # -- sets the container root file system to read only. This should be the case in production environment
+    # @internal -- you should not change this
+    readOnlyRootFilesystem: true
+    # -- Some functionality may need the possibility to allow privilege escalation. This should be very restrictive
+    # @internal -- you should not change this
+    allowPrivilegeEscalation: false
+    # -- Capabilities this container should have. Only allow the necessity, and drop as many as possible
+    # @internal -- you should not change this
+    capabilities:
+      drop:
+        - ALL
+  # -- turns on *Zero Trust* Mode, disabling *all* http communication, even the internal http probes
+  # @default -- `false`
+  zeroTrust:
+# -- Assigns hardware resources to container
+resources:
+  # -- Requests are used to assign a minimum to a container. This is the guaranteed amount
+  requests:
+    # -- Set the share of guaranteed CPU to the container.
+    cpu: "1m"
+    # -- Set the share of guaranteed RAM to the container
+    memory: "64Mi"
+  # -- Limits the maximum resources
+  limits:
+    # -- The maximum allowed CPU for the container
+    cpu: "1"
+    # -- The maximum allowed RAM for the container
+    memory: "512Mi"
+# -- set the time zone for this component to make sure log output has a specific timestamp, internal dates and times are correct (like the creationDate in nappl)
+# etc.
+# @default -- `Europe/Berlin`
+timezone:
+meta:
+  # -- the type of the component. You should not change this value, except if
+  # you use a pipeliner in core mode. In core mode, it should be *core*, else *pipeliner*
+  # This type is used to create cluster communication for nappl and nstl and potentially
+  # group multiple replicaSets into one service.
+  type: envtoolbox
+  # -- lists the ports this component exposes. This is important for zero trust mode and others.
+  ports:
+    # -- The http port this component uses (if any). In zero trust mode, this will be disabled.
+    # @internal -- this is a constant value of the component and should not be changed.
+    http:
+    # -- The tls / https port, this component uses (if any)
+    # @internal -- this is a constant value of the component and should not be changed.
+    https:
+    # -- A potential tcp port, this component uses (if any)
+    # @internal -- this is a constant value of the component and should not be changed.
+    tcp:
+    # -- A potential tls / tcps port, this component uses (if any)
+    # @internal -- this is a constant value of the component and should not be changed.
+    tcps:
+    # -- A potential rmi port, this component uses (if any)
+    # @internal -- this is a constant value of the component and should not be changed.
+    rmi:
+  # -- sets tenant information to be able to invoice per use in a cloud environment
+  tenant:
+  # -- sets provider (partner, reseller) information to be able to invoice per use in a cloud environment
+  provider:
+  # -- Sets the wave in which this component should be deployed within an ArgoCD deployment
+  # if unset, it uses the default wave thus all components are installed in one wave, then relying
+  # on correct wait settings just like in a helm installation
+  wave:
+  # -- Sets the language of the main service (in the *service* container). This is used for instance
+  # if you turn OpenTelemetry on, to know which Agent to inject into the container.
+  language:
+  # -- The container name of the main service for this component. This is used to define where to
+  # inject the telemetry agents, if any
+  serviceContainer:
+  # -- A optional parameter to indicate the stage (DEV, QA, PROD, ...) this component, instance or environment
+  # runs in. This can be used in template functions to add the stage to for instance the service name of
+  # telemetry services like open telemetry. (see telemetry example)
+  stage:
+  # -- This is the version of the component, used for display
+  # @internal -- set by devOps pipeline, so do not modify
+  componentVersion:
+# -- Set tolerations for this component
+tolerations:
+# -- select specific nodes for this component
+nodeSelector:
+# -- Sets the name of a secret, which holds additional environment variables for
+# the configuration. It is added as envFrom secretRef to the container.
+envSecret:
+# -- Sets the name of a configMap, which holds additional environment variables for
+# the configuration. It is added as envFrom configMap to the container.
+envMap:
+# -- Sets additional environment variables for
+# the configuration.
+env:
+# -- This overrides the output of the internal name function
+nameOverride:
+# -- This overrides the output of the internal fullname function
+fullnameOverride:
+utils:
+  # -- Turn debugging *on* will give you stack trace etc. 
+  # Please check out the Chart Developer Guide
+  # @default -- `false`
+  debug:
+  # -- You can turn Comment rendering *on* to get descriptive information inside the manifests. It
+  # will also fail on depricated functions and keys, so it is recommended to only switch it off in PROD
+  # @default -- `true`
+  renderComments:
+  # -- By default, the namespace is rendered into the manifest. However, if you want to use
+  # `helm template` and store manifests for later applying them to multiple namespaces, you might
+  # want to turn this `false` to be able to use `kubectl apply -n <namespace> -f template.yaml` later
+  # @default -- `true`
+  includeNamespace:
+  # -- in Maintenance Mode, all *waitFor* actions will be skipped, the *Health Checks* are ignored and the
+  # pods will start in idle, not starting the service at all. This will allow you to gain access to the container
+  # to perform recovery and maintenance tasks while having the real container up.
+  # @default -- `false`
+  maintenance:
+  # -- If you use argoCD, you most likely want to use the argo Wave Feature as well, making sure the components
+  # of an instance are deployed ordered. However, in DEV you might want to disable this to allow live changing components
+  # while previous waves are not finished yet.
+  # @default -- `false`
+  disableWave:
+  # -- in case you use the argoCD Wave feature, you might think about switching off the waitFor mechanism, that makes sure PODs are
+  # only started after pre-requisites are fulfilled. You can disable the starndard wait mechanism, but at your own risk, as this might
+  # start components even if they are not intended to run yet.
+  # @default -- `false`
+  disableWait:
+# -- if you set minReplicaCountType, a podDesruptionBudget will be created with this value as
+# minAvailable, using the component type as selector. This is useful for components, that are spread
+# across multiple replicaSets, like sharepoint or storage layer
+minReplicaCountType:
+# -- Settings for telemetry tools
+telemetry:
+  # -- turns Open Telemetry on
+  openTelemetry:
+  # -- Sets the service name for the telemetry service to more convenient
+  # identify the displayed component
+  # Example: "{{ .this.meta.type }}-{{ .instance.name }}"
+  serviceName:
+# -- Sets the terminationGracePeriodSeconds for the component
+# If not set, it uses the Kubernetes defaults
+terminationGracePeriodSeconds: