Merge branch 'nightly' into k8s-shuffle-app-ports

functions/kubernetes/charts/shuffle/templates/backend/backend-cm-env.yaml

@@ -8,18 +8,20 @@ metadata:
   annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
   {{- end }}
 data:
-  BACKEND_PORT: "5001"
+  BACKEND_PORT: "{{ .Values.backend.containerPorts.http }}"
   {{- if .Values.shuffle.baseUrl }}
   BASE_URL: "{{ .Values.shuffle.baseUrl }}"
   SSO_REDIRECT_URL: "{{ .Values.shuffle.baseUrl }}"
   {{- else }}
-  BASE_URL: "http://{{ include "shuffle.backend.name" . }}:5001"
+  BASE_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.backend.containerPorts.http }}"
   {{- end }}
   ORG_ID: "{{ .Values.shuffle.org }}"
   SHUFFLE_APP_DOWNLOAD_LOCATION: "{{ .Values.backend.apps.downloadLocation }}"
   SHUFFLE_DOWNLOAD_AUTH_BRANCH: "{{ .Values.backend.apps.downloadBranch }}"
   SHUFFLE_APP_FORCE_UPDATE: "{{ .Values.backend.apps.forceUpdate }}"
   SHUFFLE_CHAT_DISABLED: "true"
+  # Sets backend_url parameter for workflow execution to the cluster-internal shuffle-backend address
+  SHUFFLE_CLOUDRUN_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.backend.containerPorts.http }}"
   SHUFFLE_OPENSEARCH_URL: {{ include "common.tplvalues.render" (dict "value" .Values.backend.openSearch.url "context" $) }}
   SHUFFLE_OPENSEARCH_USERNAME: "{{ .Values.backend.openSearch.username }}"
   SHUFFLE_OPENSEARCH_CERTIFICATE_FILE: "{{ .Values.backend.openSearch.certificateFile }}"

functions/kubernetes/charts/shuffle/templates/backend/backend-svc.yaml

@@ -3,7 +3,8 @@ kind: Service
 metadata:
   name: {{ template "shuffle.backend.name" . }}
   namespace: {{ include "common.names.namespace" . | quote }}
-  labels: {{- include "shuffle.backend.labels" (dict "customLabels" .Values.commonLabels "context" $) | nindent 4 }}
+  {{- $serviceLabels := include "common.tplvalues.merge" (dict "values" (list .Values.backend.service.labels .Values.commonLabels) "context" .) }}
+  labels: {{- include "shuffle.backend.labels" (dict "customLabels" $serviceLabels "context" $) | nindent 4 }}
   {{- if .Values.commonAnnotations }}
   annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }}
   {{- end }}
@@ -14,5 +15,6 @@ spec:
       port: {{ .Values.backend.containerPorts.http }}
       targetPort: http
       protocol: TCP
+      appProtocol: http
   {{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.backend.podLabels .Values.commonLabels) "context" .) }}
   selector: {{- include "shuffle.backend.matchLabels" (dict "customLabels" $podLabels "context" $) | nindent 4 }}

functions/kubernetes/charts/shuffle/templates/frontend/frontend-svc.yaml

@@ -3,7 +3,8 @@ kind: Service
 metadata:
   name: {{ template "shuffle.frontend.name" . }}
   namespace: {{ include "common.names.namespace" . | quote }}
-  labels: {{- include "shuffle.frontend.labels" (dict "customLabels" .Values.commonLabels "context" $) | nindent 4 }}
+  {{- $serviceLabels := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.service.labels .Values.commonLabels) "context" .) }}
+  labels: {{- include "shuffle.frontend.labels" (dict "customLabels" $serviceLabels "context" $) | nindent 4 }}
   {{- if .Values.commonAnnotations }}
   annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }}
   {{- end }}
@@ -14,11 +15,13 @@ spec:
       port: {{ .Values.frontend.containerPorts.http }}
       targetPort: http
       protocol: TCP
+      appProtocol: http
     {{- if .Values.frontend.containerPorts.https }}
     - name: https
       port: {{ .Values.frontend.containerPorts.https }}
       targetPort: https
       protocol: TCP
+      appProtocol: https
     {{- end }}
   {{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.podLabels .Values.commonLabels) "context" .) }}
   selector: {{- include "shuffle.frontend.matchLabels" (dict "customLabels" $podLabels "context" $) | nindent 4 }}

functions/kubernetes/charts/shuffle/templates/orborus/orborus-cm-env.yaml

@@ -11,7 +11,7 @@ data:
   ENVIRONMENT_NAME: "{{ .Values.shuffle.org }}"
   ORG_ID: "{{ .Values.shuffle.org }}"
   TZ: "{{ .Values.shuffle.timezone }}"
-  BASE_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:5001"
+  BASE_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.backend.containerPorts.http }}"
   KUBERNETES_NAMESPACE: "{{ .Release.Namespace }}"
   KUBERNETES_SERVICE_ACCOUNT: {{ include "shuffle.orborus.serviceAccount.name" . }}
   SHUFFLE_WORKER_IMAGE: "{{ include "shuffle.worker.image" . }}"

functions/kubernetes/charts/shuffle/templates/orborus/orborus-dpl.yaml

@@ -90,8 +90,24 @@ spec:
               value: {{ include "shuffle.worker.serviceAccount.name" . }}
             - name: SHUFFLE_APP_EXPOSED_PORT
               value: {{ .Values.app.exposedContainerPort | quote }}
+            {{- if .Values.worker.podSecurityContext.enabled }}
+            - name: SHUFFLE_WORKER_POD_SECURITY_CONTEXT
+              value: {{ omit .Values.worker.podSecurityContext "enabled" | mustToJson | quote }}
+            {{- end }}
+            {{- if .Values.worker.containerSecurityContext.enabled }}
+            - name: SHUFFLE_WORKER_CONTAINER_SECURITY_CONTEXT
+              value: {{ include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.worker.containerSecurityContext "context" $) | fromYaml | mustToJson | quote }}
+            {{- end }}
             - name: SHUFFLE_APP_SERVICE_ACCOUNT_NAME
               value: {{ include "shuffle.app.serviceAccount.name" . }}
+            {{- if .Values.app.podSecurityContext.enabled }}
+            - name: SHUFFLE_APP_POD_SECURITY_CONTEXT
+              value: {{ omit .Values.app.podSecurityContext "enabled" | mustToJson | quote }}
+            {{- end }}
+            {{- if .Values.app.containerSecurityContext.enabled }}
+            - name: SHUFFLE_APP_CONTAINER_SECURITY_CONTEXT
+              value: {{ include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.app.containerSecurityContext "context" $) | fromYaml | mustToJson | quote }}
+            {{- end }}
             {{- if .Values.orborus.extraEnvVars }}
             {{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVars "context" $) | nindent 12 }}
             {{- end }}

functions/kubernetes/charts/shuffle/templates/shuffle-app/shuffle-app-network-policy.yaml

@@ -29,6 +29,16 @@ spec:
         - namespaceSelector:
             matchLabels:
               kubernetes.io/metadata.name: kube-system
+    # Allow access to backend
+    - ports:
+      - port: {{ .Values.backend.containerPorts.http }}
+        protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ .Release.Namespace }}
+          podSelector:
+            matchLabels: {{ include "shuffle.backend.matchLabels" . | nindent 14 }}
     # Allow access to workers
     - ports:
         - port: 33333