Public Information

2025-01-24 16:18:47 +01:00
commit 0bd2038c86
449 changed files with 108655 additions and 0 deletions
--- a/charts/sharepoint/templates/clusteringress.tpl
+++ b/charts/sharepoint/templates/clusteringress.tpl
@@ -0,0 +1,22 @@
+{{- include "nplus.init" $ -}}
+{{- $name := (print .component.prefix "sharepoint-cluster") -}}
+{{- if (.Values.clusterService).enabled }}
+{{- if (.Values.clusterService).contextPath }}
+{{- include "nplus.ingress" (list . $name) | nindent 0 }}
+      - path: {{ .Values.clusterService.contextPath }}
+        pathType: Prefix
+        backend:
+          service:
+            name: {{ $name }}
+            port: 
+              name: {{ include "nplus.backendProtocol" . }}
+{{- else }}
+# kind: Ingress
+# Not Generating any Ingress for {{ $name }} as the context Path is unset on component {{ .component.fullName }}
+# clusterService: {{ .Values.clusterService }}
+{{- end }}
+{{- else }}
+# kind: Ingress
+# Not Generating any Ingress for {{ $name }} as the Cluster Service is not enabled on component {{ .component.fullName }}
+# clusterService: {{ .Values.clusterService }}
+{{- end }}
--- a/charts/sharepoint/templates/clusterservice.tpl
+++ b/charts/sharepoint/templates/clusterservice.tpl
@@ -0,0 +1,33 @@
+{{- include "nplus.init" $ -}}
+{{- $name := (print .component.prefix "sharepoint-cluster") -}}
+{{- if (.Values.clusterService).enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  {{- if .this.utils.includeNamespace }}
+  namespace: {{ .Release.Namespace }}
+  {{- end }}
+  name: {{ $name }}
+  labels:
+    {{- include "nplus.instanceLabels" . | nindent 4 }}
+  annotations:
+    {{- include "nplus.argoWave" . | nindent 4 }}
+    {{- include "nplus.annotations" . | nindent 4 }}
+    {{- include "nplus.securityAnnotations" . | nindent 4 }}
+    {{- include "nplus.serviceAnnotations" . | nindent 4 }}
+spec:
+  # this is a "headless service", no cluster IP is defined
+  # as none of the internal components need to access this service,
+  # access is purely through an ingress if desired.
+  type: ClusterIP
+  clusterIP: None
+
+  ports:
+    {{- include "nplus.defaultServicePorts" . | nindent 4 }}
+  selector:
+    {{- include "nplus.selectorLabelsNc" . | nindent 4 }}
+{{- else }}
+# kind: Service
+# Not Generating any Service for {{ $name }} as the Cluster Service is not enabled on component {{ .component.fullName }}
+# clusterService: {{ .Values.clusterService }}
+{{- end }}
--- a/charts/sharepoint/templates/component.tpl
+++ b/charts/sharepoint/templates/component.tpl
@@ -0,0 +1,2 @@
+{{- include "nplus.init" $ -}}
+{{- include "nplus.component" . -}}
--- a/charts/sharepoint/templates/ingress.tpl
+++ b/charts/sharepoint/templates/ingress.tpl
@@ -0,0 +1,16 @@
+{{- include "nplus.init" $ -}}
+{{- if ( include "nplus.ingressEnabled" . ) }}
+{{- include "nplus.ingress" (list . .component.fullName) | nindent 0 }}
+      - path: {{ .Values.ingress.contextPath }}
+        pathType: Prefix
+        backend:
+          service:
+            name: {{ .component.fullName }}
+            port: 
+              name: {{ include "nplus.backendProtocol" . }}
+{{- else }}
+# kind: ingress
+# Not Generating any Ingress for {{ .component.fullName }} as
+# Ingress = {{ .this.ingress }}
+# Service = {{ .this.service }}
+{{- end }}
--- a/charts/sharepoint/templates/networkpolicy.tpl
+++ b/charts/sharepoint/templates/networkpolicy.tpl
@@ -0,0 +1,36 @@
+{{- include "nplus.init" $ -}}
+{{- if ((.this.security).cni).createNetworkPolicy }}
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: {{ .component.fullName }}
+  {{- if .this.utils.includeNamespace }}
+  namespace: {{ .Release.Namespace }}
+  {{- end }}
+  labels:
+    {{- include "nplus.instanceLabels" . | nindent 4 }}
+  annotations:
+    {{- include "nplus.argoWave" . | nindent 4 }}
+    {{- include "nplus.annotations" . | nindent 4 }}
+    {{- include "nplus.securityAnnotations" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+    {{- include "nplus.selectorLabels" . | nindent 6 }}
+
+  policyTypes:
+  - Ingress
+  - Egress
+
+  ingress:
+
+  {{- if or ( include "nplus.ingressEnabled" . ) ( (.Values.clusterService).contextPath ) }}
+  {{- include "nplus.networkpolicy.allowFromIngress" . | nindent 2 }}
+  {{- end }}
+
+  {{- include "nplus.networkpolicy.allowFromAdmin" . | nindent 2 }}
+  {{- include "nplus.networkpolicy.allowFromMon" . | nindent 2 }}
+
+  egress:
+  {{- include "nplus.networkpolicy.allowToNappl" . | nindent 2 }}
+{{- end }}
--- a/charts/sharepoint/templates/pdb.tpl
+++ b/charts/sharepoint/templates/pdb.tpl
@@ -0,0 +1,2 @@
+{{- include "nplus.init" $ -}}
+{{- include "nplus.podDisruptionBudget" . -}}
--- a/charts/sharepoint/templates/pvc.tpl
+++ b/charts/sharepoint/templates/pvc.tpl
@@ -0,0 +1,2 @@
+{{- include "nplus.init" $ -}}
+{{- include "nplus.pvc" . }}
--- a/charts/sharepoint/templates/service.tpl
+++ b/charts/sharepoint/templates/service.tpl
@@ -0,0 +1,32 @@
+{{- include "nplus.init" $ -}}
+apiVersion: v1
+kind: Service
+metadata:
+  {{- if .this.utils.includeNamespace }}
+  namespace: {{ .Release.Namespace }}
+  {{- end }}
+  name: {{ .component.fullName }}
+  labels:
+    {{- include "nplus.instanceLabels" . | nindent 4 }}
+  annotations:
+    {{- include "nplus.argoWave" . | nindent 4 }}
+    {{- include "nplus.annotations" . | nindent 4 }}
+    {{- include "nplus.securityAnnotations" . | nindent 4 }}
+    {{- include "nplus.serviceAnnotations" . | nindent 4 }}
+spec:
+  # this is a "headless service", no cluster IP is defined
+  # as none of the internal components need to access this service,
+  # access is purely through an ingress if desired.
+  type: ClusterIP
+  clusterIP: None
+
+  ports:
+    {{- include "nplus.defaultServicePorts" . | nindent 4 }}
+  selector:
+  {{- if eq .this.service.selector "component" }}
+    {{- include "nplus.selectorLabels" . | nindent 4 }}
+  {{- else if eq .this.service.selector "type" }}
+    {{- include "nplus.selectorLabelsNc" . | nindent 4 }}
+  {{- else }}
+    {{- fail (printf "Unknown Service Selector Type: %s - must be component or type" .this.service.selector) }}
+  {{- end }}
--- a/charts/sharepoint/templates/statefulset.tpl
+++ b/charts/sharepoint/templates/statefulset.tpl
@@ -0,0 +1,422 @@
+{{- include "nplus.init" $ -}}
+# Component: {{ .component.chartName }}
+# will connect to:
+{{- if (.this.nappl).host }}
+#   nappl: {{ if ($.this.nappl).ssl -}}https{{- else -}}http{{- end -}}://{{ ($.this.nappl).host }}:{{ (.this.nappl).port }}/{{ (.this.nappl).instance }}
+{{- else }}
+#   defined by config file in conf PV.
+{{- end }}
+#
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ .component.fullName }}
+  {{- if .this.utils.includeNamespace }}
+  namespace: {{ .Release.Namespace }}
+  {{- end }}
+  labels:
+    {{- include "nplus.instanceLabels" . | nindent 4 }}
+  annotations:
+    {{- include "nplus.argoWave" . | nindent 4 }}
+    {{- include "nplus.annotations" . | nindent 4 }}
+    {{- include "nplus.securityAnnotations" . | nindent 4 }}
+
+spec:
+  selector:
+    matchLabels:
+      {{- include "nplus.selectorLabels" . | nindent 6 }}
+  replicas: {{ .Values.replicaCount }}
+  podManagementPolicy: OrderedReady
+  updateStrategy:
+    type: {{ .Values.updateStrategy | default "OnDelete" }}  
+  minReadySeconds: 5
+
+  template:
+    metadata:
+      labels:
+        {{- include "nplus.templateLabels" . | nindent 8 }}
+      annotations:
+        {{- include "nplus.templateAnnotations" . | nindent 8 }}
+        {{- include "nplus.securityAnnotations" . | nindent 8 }}
+    spec:
+      {{- include "nplus.imagePullSecrets" . | nindent 6 }}
+      {{- include "nplus.securityIllumioReadinessGates" . | nindent 6 }}
+      {{- include "nplus.podSecurityContext" . | nindent 6 }}
+      {{- include "nplus.templateAffinity" . | nindent 6 }}
+      {{- include "nplus.terminationGracePeriodSeconds" . | nindent 6 }}
+      
+      initContainers:
+      {{- include "nplus.waitFor" . | nindent 6 }}
+      {{- include "nplus.copyConfig" . | nindent 6 }}
+
+      containers:
+      - name: sharepoint-connector
+        image: {{ include "nplus.image"  (dict "global" .Values.global "image" .Values.image) }}
+        imagePullPolicy: {{ include "nplus.imagePullPolicy" .Values.image }}
+        {{- include "nplus.containerSecurityContext" . | nindent 8 }}
+
+        {{- if .this.utils.maintenance }}
+          {{- include "nplus.idle" . | nindent 8 }}
+        {{- else }}
+        # -- Ceyoniq does currently not define an *official* startupProbe, so we use
+        # one that quickly checks the main socket on Layer 4.
+        startupProbe:
+          initialDelaySeconds: 10
+          failureThreshold: 30
+          periodSeconds: 10
+          timeoutSeconds: 5
+          httpGet:
+            path: '/actuator/health/liveness'
+            port: {{ ($.this.management).port }}
+        livenessProbe:
+          httpGet:
+            path: '/actuator/health/liveness'
+            port: {{ ($.this.management).port }}
+          # initialDelaySeconds: 10
+        readinessProbe:
+          httpGet:
+            path: '/actuator/health/readiness'
+            port: {{ ($.this.management).port }}
+          # initialDelaySeconds: 10
+        {{- end }}
+
+        env:
+
+          # -- Management Port Settings, for Probes
+          {{- include "nplus.env" (dict 
+            "MANAGEMENT_SERVER_PORT"         ($.this.management).port
+            "MANAGEMENT_SERVER_SSL_ENABLED"  ($.this.management).ssl
+            "MANAGEMENT_SECURITY_ENABLED"    ($.this.management).security
+          ) | nindent 10 }}
+
+          #
+          # Service Settings
+          #
+
+          - name: SERVER_SERVLET_CONTEXT_PATH
+            value: {{ .Values.ingress.contextPath | quote }}
+
+          - name: LOGGING_CONFIG
+            value: "/opt/ceyoniq/sharepoint-connector/conf/log4j2.xml"
+
+          {{- if ((.Values.ingress).ssl).keystore }}
+          - name: SERVER_SSL_KEYSTORE
+            value: {{ .Values.ingress.ssl.keystore | quote }}
+          {{- end }}
+
+          {{- if or (($.this.security).zeroTrust) (eq .Values.ingress.backendProtocol "https") }}
+          - name: SERVER_SSL_ENABLED
+            value: "true"
+          - name: SERVER_PORT
+            value: {{ (.this.meta).ports.https | quote }}
+          - name: SERVER_SSL_KEYALIAS
+            value: "https"
+
+          {{- if ((.Values.ingress).ssl).keystoreSecret }}
+
+          - name: SERVER_SSL_KEYSTOREPASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Values.ingress.ssl.keystoreSecret }}
+                key: keystorePassword
+
+          - name: SERVER_SSL_KEYPASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Values.ingress.ssl.keystoreSecret }}
+                key: keyPassword
+
+          {{- else }}
+
+          {{- if ((.Values.ingress).ssl).keystorePassword }}
+          - name: SERVER_SSL_KEYSTOREPASSWORD
+            value: {{ .Values.ingress.ssl.keystorePassword | quote }}
+          {{- end }}
+          {{- if ((.Values.ingress).ssl).keyPassword }}
+          - name: SERVER_SSL_KEYPASSWORD
+            value: {{ .Values.ingress.ssl.keyPassword | quote }}
+          {{- end }}
+
+          {{- end }}
+
+          {{- if ((.Values.ingress).ssl).keyAlias }}
+          - name: SERVER_SSL_KEYALIAS
+            value: {{ .Values.ingress.ssl.keyAlias | quote }}
+          {{- end }}          
+
+          {{- else }}
+          - name: SERVER_SSL_ENABLED
+            value: "false"
+          - name: SERVER_PORT
+            value: {{ (.this.meta).ports.http | quote }}
+          {{- end }}
+
+          #
+          # NAPPL Settings
+          #
+
+          {{- if ($.this.nappl).host }}
+          - name: HOST
+            value: {{ ($.this.nappl).host | quote }}
+          {{- end }}
+          {{- if ($.this.nappl).port }}
+          - name: PORT
+            value: {{ ($.this.nappl).port | quote }}
+          - name: USESSL
+            value: "{{ if ($.this.nappl).ssl }}true{{- else -}}false{{- end -}}"
+          {{- end }}
+          {{- if ($.this.nappl).instance }}
+          - name: INSTANCE
+            value: {{ ($.this.nappl).instance | quote }}
+          {{- end }}
+
+          # -- setting the credentials for the technical user to access the application layer
+          {{- if ($.this.nappl).secret }}
+          # using a secret to get the functional nappl user for ILM
+          - name: NSCALEUSER
+            valueFrom:
+              secretKeyRef:
+                name: {{ ($.this.nappl).secret }}
+                key: account
+          - name: PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: {{ ($.this.nappl).secret }}
+                key: password
+          - name: DOMAIN
+            valueFrom:
+              secretKeyRef:
+                name: {{ ($.this.nappl).secret }}
+                key: domain
+
+          {{- else }}
+
+          {{- if ($.this.nappl).account }}
+          # Account is defined in manifest. That is ok for dev environments, but you should 
+          # switch to secrets for productive environments.
+          - name: NSCALEUSER
+            value: {{ ($.this.nappl).account }}
+          {{- else }}
+          # nappl user is not defined in manifest (and also no secret). Using the config file settings.
+          {{- end }}
+
+          {{- if ($.this.nappl).password }}
+          # The password is defined in manifest. That is ok for dev environments, but you should 
+          # switch to secrets for productive environments.
+          - name: PASSWORD
+            value: {{ ($.this.nappl).password }}
+          {{- else }}
+          # nappl password is not defined in manifest (and also no secret). Using the config file settings.
+          {{- end }}
+
+          {{- if ($.this.nappl).domain }}
+          - name: DOMAIN
+            value: {{ ($.this.nappl).domain }}
+          {{- else }}
+          # nappl password is not defined in manifest (and also no secret). Using the config file settings.
+          {{- end }}
+
+          {{- end }}
+
+          {{- if (.Values.nappl).baseFolder }}
+          - name: BASEFOLDER
+            value: {{ .Values.nappl.baseFolder | quote }}
+          {{- end }}
+
+          {{- if (.Values.nappl).docArea }}
+          - name: DOCAREA
+            value: {{ .Values.nappl.docArea | quote }}
+          {{- end }}
+       
+          #
+          # Service Settings
+          #
+          - name: DOINITIALCRAWL
+            value: {{ .Values.doInitialCrawl | quote }}
+
+          {{- if .Values.parallelRequests }}
+          - name: PARALLELREQUESTS
+            value: {{ .Values.parallelRequests | quote }}
+          {{- end }}
+
+          
+          #
+          # O365 AZURE SharePoint Settings
+          #
+          {{- if (.Values.sharepoint).doCheckOut }}
+          - name: DOCHECKOUT
+            value: {{ .Values.sharepoint.doCheckOut | quote }}
+          {{- end }}
+          {{- if (.Values.sharepoint).spHost }}
+          - name: SPHOST
+            value: {{ .Values.sharepoint.spHost | quote }}
+          {{- end }}
+          {{- if (.Values.sharepoint).triggerProperty }}
+          - name: TRIGGERPROPERTY
+            value: {{ .Values.sharepoint.triggerProperty | quote }}
+          {{- end }}
+          {{- if (.Values.sharepoint).serviceBusQueueName }}
+          - name: SERVICEBUSQUEUENAME
+            value: {{ .Values.sharepoint.serviceBusQueueName | quote }}
+          {{- end }}
+          {{- if (.Values.sharepoint).serviceBusConnectionString }}
+          - name: SERVICEBUSCONNECTIONSTRING
+            value: {{ .Values.sharepoint.serviceBusConnectionString | quote }}
+          {{- end }}
+          {{- if (.Values.sharepoint).serviceBusRetentionConnectionString }}
+          - name: SERVICEBUSRETENTIONCONNECTIONSTRING
+            value: {{ .Values.sharepoint.serviceBusRetentionConnectionString | quote }}
+          {{- end }}
+          {{- if (.Values.sharepoint).serviceBusRetentionQueueName }}
+          - name: SERVICEBUSRETENTIONQUEUENAME
+            value: {{ .Values.sharepoint.serviceBusRetentionQueueName | quote }}
+          {{- end }}
+          {{- if (.Values.sharepoint).serviceBusTopicNameConfigUpdate }}
+          - name: SERVICEBUSTOPICNAMECONFIGUPDATE
+            value: {{ .Values.sharepoint.serviceBusTopicNameConfigUpdate | quote }}
+          {{- end }}
+
+          #
+          # O365 SharePoint Credentials
+          #
+          {{- if (.Values.sharepoint).secret }}
+          # using a secret to get the functional access to SharePoint
+          - name: TENANTID
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Values.sharepoint.secret }}
+                key: tenantId
+          - name: CLIENTID
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Values.sharepoint.secret }}
+                key: clientId
+          - name: WEBUSERPW
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Values.sharepoint.secret }}
+                key: webUserPw
+          - name: CLIENTCERTPW
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Values.sharepoint.secret }}
+                key: clientCertPw
+
+          {{- else }}
+
+          {{- if (.Values.sharepoint).tenantId }}
+          - name: TENANTID
+            value: {{ .Values.sharepoint.tenantId | quote }}
+          {{- end }}
+          {{- if (.Values.sharepoint).clientId }}
+          - name: CLIENTID
+            value: {{ .Values.sharepoint.clientId | quote }}
+          {{- end }}
+          {{- if (.Values.sharepoint).clientCertPw }}
+          - name: CLIENTCERTPW
+            value: {{ .Values.sharepoint.clientCertPw | quote }}
+          {{- end }}
+          {{- if (.Values.sharepoint).webUserPw }}
+          - name: WEBUSERPW
+            value: {{ .Values.sharepoint.webUserPw | quote }}
+          {{- end }}
+
+          {{- end }}
+
+          #
+          # nscale Connector Settings
+          #
+          {{- if (.Values.connector).sharePointCreatorPropertyName }}
+          - name: SHAREPOINTCREATORPROPERTYNAME
+            value: {{ .Values.connector.sharePointCreatorPropertyName | quote }}
+          {{- end }}
+          {{- if (.Values.connector).sharePointCreatedPropertyName }}
+          - name: SHAREPOINTCREATEDPROPERTYNAME
+            value: {{ .Values.connector.sharePointCreatedPropertyName | quote }}
+          {{- end }}
+          {{- if (.Values.connector).sharePointEditorPropertyName }}
+          - name: SHAREPOINTEDITORPROPERTYNAME
+            value: {{ .Values.connector.sharePointEditorPropertyName | quote }}
+          {{- end }}
+          {{- if (.Values.connector).sharePointEditedPropertyName }}
+          - name: SHAREPOINTEDITEDPROPERTYNAME
+            value: {{ .Values.connector.sharePointEditedPropertyName | quote }}
+          {{- end }}
+          {{- if (.Values.connector).sharePointChangeTokenPropertyName }}
+          - name: SHAREPOINTCHANGETOKENPROPERTYNAME
+            value: {{ .Values.connector.sharePointChangeTokenPropertyName | quote }}
+          {{- end }}
+          {{- if (.Values.connector).idPropertyName }}
+          - name: IDPROPERTYNAME
+            value: {{ .Values.connector.idPropertyName | quote }}
+          {{- end }}
+
+          {{- if (.Values.connector).stubIdPropertyName }}
+          - name: STUBIDPROPERTYNAME
+            value: {{ .Values.connector.stubIdPropertyName | quote }}
+          {{- end }}
+          {{- if (.Values.connector).stubListItemIdPropertyName }}
+          - name: STUBLISTITEMIDPROPERTYNAME
+            value: {{ .Values.connector.stubListItemIdPropertyName | quote }}
+          {{- end }}
+          {{- if (.Values.connector).parentIdPropertyName }}
+          - name: PARENTIDPROPERTYNAME
+            value: {{ .Values.connector.parentIdPropertyName | quote }}
+          {{- end }}
+
+          {{- if (.Values.connector).cTagPropertyName }}
+          - name: CTAGPROPERTYNAME
+            value: {{ .Values.connector.cTagPropertyName | quote }}
+          {{- end }}
+          {{- if (.Values.connector).eTagPropertyName }}
+          - name: ETAGPROPERTYNAME
+            value: {{ .Values.connector.eTagPropertyName | quote }}
+          {{- end }}
+          {{- if (.Values.connector).webUrlPropertyName }}
+          - name: WEBURLPROPERTYNAME
+            value: {{ .Values.connector.webUrlPropertyName | quote }}
+          {{- end }}
+          {{- if (.Values.connector).listItemIdPropertyName }}
+          - name: LISTITEMIDPROPERTYNAME
+            value: {{ .Values.connector.listItemIdPropertyName | quote }}
+          {{- end }}
+
+          {{- if (.Values.connector).nscaleRetentionPropertyName }}
+          - name: NSCALERETENTIONPROPERTYNAME
+            value: {{ .Values.connector.nscaleRetentionPropertyName | quote }}
+          {{- end }}
+          {{- if (.Values.connector).nscaleExpirationPropertyName }}
+          - name: NSCALEEXPIRATIONPROPERTYNAME
+            value: {{ .Values.connector.nscaleExpirationPropertyName | quote }}
+          {{- end }}
+          {{- if (.Values.connector).nscaleLegalHoldPropertyName }}
+          - name: NSCALELEGALHOLDPROPERTYNAME
+            value: {{ .Values.connector.nscaleLegalHoldPropertyName | quote }}
+          {{- end }}
+          {{- if (.Values.connector).nscaleLegalHidePropertyName }}
+          - name: NSCALELEGALHIDEPROPERTYNAME
+            value: {{ .Values.connector.nscaleLegalHidePropertyName | quote }}
+          {{- end }}
+          {{- if (.Values.connector).nscaleGdprRelevantPropertyName }}
+          - name: NSCALEGDPRRELEVANTPROPERTYNAME
+            value: {{ .Values.connector.nscaleGdprRelevantPropertyName | quote }}
+          {{- end }}
+
+        {{- include "nplus.environment" . | nindent 8 }}
+
+
+        ports:
+        {{- include "nplus.defaultContainerPorts" . | nindent 8 }}
+        # -- Setting the management port for the probes to use
+        - name: management
+          containerPort: {{ required "setting the management port is required for the probes" ($.this.management).port }}
+          protocol: TCP
+
+        {{- include "nplus.resources" . | nindent 8 }}
+
+        volumeMounts:
+        {{- include "nplus.defaultMounts" . | nindent 8 }}
+
+      volumes:
+      {{- include "nplus.defaultVolumes" . | nindent 6 }}
+