Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
40 commits
Select commit Hold shift + click to select a range
2af8290
feat(frontend): add security context support
guncha25 Apr 8, 2025
0b6291d
Reduce size of examples for Security context
guncha25 Apr 9, 2025
e67f72d
Simplify defaults
guncha25 Apr 9, 2025
bda7763
SLT-1103: Drupal chart: Add mailpit dependency to Drupal chart
k4lv15 Mar 27, 2025
8640af5
SLT-1103: Drupal chart: Update values.schema.json to fix validation i…
k4lv15 Mar 27, 2025
d0655e5
SLT-1103: Drupal chart: Set default resource requests and limits for …
k4lv15 Mar 27, 2025
a7bbe78
SLT-1103: Drupal chart: Check if release name doesn't contain 'mailpi…
k4lv15 Mar 27, 2025
b2011ea
SLT-1103: Drupal chart: Add mailpit links to release notes.
k4lv15 Mar 27, 2025
eabe630
SLT-1103: Drupal chart: Update smtp.env template in helpers - set SMT…
k4lv15 Mar 27, 2025
fd40396
SLT-1103: Drupal chart: Fix failing tests.
k4lv15 Mar 27, 2025
8019518
SLT-1103: Drupal chart: Fix the check that generates smtp-secret, oth…
k4lv15 Mar 27, 2025
01d86a2
SLT-1103: Drupal chart: Update checks.yaml
k4lv15 Mar 27, 2025
5feddc4
SLT-1103: Drupal chart: Update nginx config in drupal-configmap - pro…
k4lv15 Mar 27, 2025
09342b8
SLT-1103: Drupal chart: Pass /mailpit path in varnish.
k4lv15 Mar 27, 2025
0b458fc
SLT-1103: Drupal chart: Set extra env vars for mailpit as Drupal's e-…
k4lv15 Mar 28, 2025
bc2492c
SLT-1103: Drupal chart: Override the default webroot for mailpit, upd…
k4lv15 Mar 28, 2025
1444738
SLT-1103: Drupal chart: Adjust nginx config to have proxy_pass workin…
k4lv15 Mar 29, 2025
da58542
SLT-1103: Drupal chart: Lock mailpit dependency to 0.23.x
k4lv15 Apr 1, 2025
07ae14b
SLT-1103: Drupal chart: Add back support for mailhog, add additional …
k4lv15 Apr 1, 2025
90b179f
SLT-1103: Drupal chart: Redirect the legacy mailhog service path to /…
k4lv15 Apr 1, 2025
c145fc0
SLT-1103: Drupal chart: Update mailpit dependency to 0.24.x, disable …
k4lv15 Apr 8, 2025
a6aa84c
SLT-1103: Front-end chart: Add mailpit dependency to frontend chart
k4lv15 Apr 2, 2025
c7b97be
SLT-1103: Front-end chart: Add default value overrides for mailpit.
k4lv15 Apr 2, 2025
617abe6
SLT-1103: Front-end chart: Add release notes.
k4lv15 Apr 2, 2025
28421f2
SLT-1103: Front-end chart: Add MAILPIT_ADDRESS env var in helpers.tpl…
k4lv15 Apr 2, 2025
fb4976e
SLT-1103: Front-end chart: Update frontend and varnish config maps
k4lv15 Apr 2, 2025
457ef27
SLT-1103: Front-end chart: Update test.values.yaml
k4lv15 Apr 2, 2025
b493d34
SLT-1103: Front-end chart: Remove extra line.
k4lv15 Apr 2, 2025
a5d4ef4
SLT-1103: Front-end chart: Update mailpit dependency to 0.24.x, disab…
k4lv15 Apr 8, 2025
aefe001
SLT-1103: Add jouve chart repo in CCI config.
k4lv15 Apr 9, 2025
a1ebdf3
SLT-1103: Add jouve helm charts repo in pull-request workflow.
k4lv15 Apr 9, 2025
6079a70
SLT-1185: mitigate 444 issue with ingress-nginx
ArtisKrumins Apr 25, 2025
b3dfde5
SLT-1185: mitigate 444 issue with ingress-nginx. Removing comment
ArtisKrumins Apr 25, 2025
4907ef4
Merge pull request #477 from wunderio/feat/securityContext
Rade333 May 5, 2025
6a8d6a0
Merge pull request #478 from wunderio/feature/mailpit-support
Rade333 May 5, 2025
55b8f6f
Merge pull request #479 from wunderio/feature/SLT-1185-mitigate-444
Rade333 May 5, 2025
f35d48b
Simple: SLT-1189: Add JA4 signature into nginx logs.
Rade333 May 5, 2025
57ab1e8
Frontend: SLT-1189: Add JA4 signature into nginx logs.
Rade333 May 5, 2025
991d70d
Drupal: SLT-1189: Add JA4 signature into nginx logs; Enable partial r…
Rade333 May 5, 2025
e7ca9ea
Bump chart versions.
Rade333 May 5, 2025
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .circleci/config.yml
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@ jobs:
set -o xtrace

helm repo add wunderio https://storage.googleapis.com/charts.wdr.io
helm repo add jouve https://jouve.github.io/charts/
helm repo add codecentric https://codecentric.github.io/helm-charts
helm repo add jetstack https://charts.jetstack.io
helm repo add elastic https://helm.elastic.co
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/pull-request.yml
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,7 @@ jobs:
&& helm repo add wunderio https://storage.googleapis.com/charts.wdr.io \
&& helm repo add percona https://percona.github.io/percona-helm-charts/ \
&& helm repo add elastic https://helm.elastic.co \
&& helm repo add jouve https://jouve.github.io/charts/ \
&& helm repo add codecentric https://codecentric.github.io/helm-charts \
&& helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx \
&& helm repo add nginx-stable https://helm.nginx.com/stable \
Expand Down
7 changes: 5 additions & 2 deletions drupal/Chart.lock
Original file line number Diff line number Diff line change
Expand Up @@ -14,11 +14,14 @@ dependencies:
- name: mailhog
repository: https://storage.googleapis.com/charts.wdr.io
version: 5.1.0
- name: mailpit
repository: https://jouve.github.io/charts/
version: 0.24.0
- name: elasticsearch
repository: file://../elasticsearch
version: 8.5.1
- name: silta-release
repository: file://../silta-release
version: 1.0.1
digest: sha256:9941fba8da73d8d7c9024c8c53dda085f0fba6ae50ef63d884dfe994d08a7641
generated: "2025-03-18T10:31:05.247476421+02:00"
digest: sha256:e3ea21b74deadb01861e37b2296391e1f0a25f62dc6b3da226d28cb95245342d
generated: "2025-04-08T22:42:49.491746+03:00"
6 changes: 5 additions & 1 deletion drupal/Chart.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
apiVersion: v2
name: drupal
version: 1.19.0
version: 1.20.0
dependencies:
- name: mariadb
version: 7.5.x
Expand All @@ -22,6 +22,10 @@ dependencies:
version: 5.1.x
repository: https://storage.googleapis.com/charts.wdr.io
condition: mailhog.enabled
- name: mailpit
version: 0.24.x
repository: https://jouve.github.io/charts/
condition: mailpit.enabled
- name: elasticsearch
version: 8.5.x
# repository: https://helm.elastic.co
Expand Down
10 changes: 10 additions & 0 deletions drupal/templates/NOTES.txt
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,16 @@ Mailhog available at:
{{- end }}
{{- end }}

{{- if .Values.mailpit.enabled }}

Mailpit available at:

http://{{- template "drupal.domain" . }}/mailpit
{{- range $index, $domain := .Values.exposeDomains }}
http://{{ $domain.hostname }}/mailpit
{{- end }}
{{- end }}

{{- if .Values.nginx.basicauth.enabled }}

Basic access authentication credentials:
Expand Down
213 changes: 120 additions & 93 deletions drupal/templates/_helpers.tpl
Original file line number Diff line number Diff line change
Expand Up @@ -96,7 +96,9 @@ imagePullSecrets:

{{- define "smtp.env" }}
- name: SMTP_ADDRESS
{{- if .Values.mailhog.enabled }}
{{- if .Values.mailpit.enabled }}
value: "{{ .Release.Name }}-mailpit-smtp:25"
{{ else if .Values.mailhog.enabled }}
value: "{{ .Release.Name }}-mailhog:1025"
{{ else }}
value: {{ .Values.smtp.address | quote }}
Expand All @@ -114,7 +116,9 @@ imagePullSecrets:
key: password
# Duplicate SMTP env variables for ssmtp bundled with amazee php image
- name: SSMTP_MAILHUB
{{- if .Values.mailhog.enabled }}
{{- if .Values.mailpit.enabled }}
value: "{{ .Release.Name }}-mailpit-smtp:25"
{{ else if .Values.mailhog.enabled }}
value: "{{ .Release.Name }}-mailhog:1025"
{{ else }}
value: {{ .Values.smtp.address | quote }}
Expand All @@ -132,6 +136,13 @@ imagePullSecrets:
key: password
{{- end }}

{{- define "drupal.ref-data-env" }}
- name: REF_DATA_COPY_DB
value: {{ .Values.referenceData.copyDatabase | quote }}
- name: REF_DATA_COPY_FILES
value: {{ .Values.referenceData.copyFiles | quote }}
{{- end }}

{{- define "drupal.db-env" }}
{{- if .Values.mariadb.enabled }}
- name: MARIADB_DB_USER
Expand Down Expand Up @@ -233,14 +244,22 @@ imagePullSecrets:
- name: ELASTICSEARCH_HOST
value: {{ .Release.Name }}-es
{{- end }}
{{- if or .Values.mailhog.enabled .Values.smtp.enabled }}
{{- if or .Values.mailhog.enabled .Values.mailpit.enabled .Values.smtp.enabled }}
{{- if .Values.mailhog.enabled }}
{{- if contains "mailhog" .Release.Name -}}
{{- fail "Do not use 'mailhog' in release name or deployment will fail" -}}
{{- end }}
{{- end }}
{{- if .Values.mailpit.enabled }}
{{- if contains "mailpit" .Release.Name -}}
{{- fail "Do not use 'mailpit' in release name or deployment will fail" -}}
{{- end }}
{{- end }}
{{ include "smtp.env" . }}
{{- end}}
{{- if .Values.referenceData.enabled }}
{{ include "drupal.ref-data-env" . }}
{{- end }}
{{- if .Values.varnish.enabled }}
- name: VARNISH_ADMIN_HOST
value: {{ .Release.Name }}-varnish
Expand Down Expand Up @@ -440,112 +459,119 @@ wait
{{- define "drupal.extract-reference-data" -}}
set -e
if [[ "$(drush status --fields=bootstrap)" = *'Successful'* ]] ; then
echo "Dump reference database."
dump_dir=/tmp/reference-data-export/
mkdir "${dump_dir}"

echo "Dump reference database."
gdpr-dump /app/gdpr-dump.yaml > /tmp/db.sql

previous_wd=$(pwd)
cd "${dump_dir}" || exit

# Split the dump to one file per table. Use 4 digit suffix so that we don't run into sorting issues when there are over 100 or 1000 tables.
csplit \
--silent \
--prefix='table-' \
--suffix-format='%04d' \
/tmp/db.sql \
'/-- Table structure for table/-1' \
'{*}'
# First file is the mysqldump header, rename it to "header"
mv table-0000 header
# Find last table file
last_table=$(find -type f -name 'table-*' | sort -n | tail -n1)
# Split last table file to extract mysqldump footer, which starts with a line including "@OLD_"
csplit \
--silent \
--prefix='last-' \
"${last_table}" \
'/@OLD_/'
# Replace $last_table with the version of it that has footer extracted from it
mv last-00 "${last_table}"
# Rename the extracted footer to "footer"
mv last-01 footer
# Prepend header and append footer to all table files, save them as <table_name>.sql
for file in table-*; do
table_name=$(grep 'Table structure for table' ${file} | cut -d$'\x60' -f2)
cat header "${file}" footer > "${table_name}.sql"
done
# Remove all non .sql files
find . -type f ! -name '*.sql' -delete

cd "${previous_wd}"
if [ "${REF_DATA_COPY_DB:-}" == "true" ]; then
echo "Dump reference database."
dump_dir=/tmp/reference-data-export/
mkdir "${dump_dir}"

echo "Dump reference database."
gdpr-dump /app/gdpr-dump.yaml > /tmp/db.sql

previous_wd=$(pwd)
cd "${dump_dir}" || exit

# Split the dump to one file per table. Use 4 digit suffix so that we don't run into sorting issues when there are over 100 or 1000 tables.
csplit \
--silent \
--prefix='table-' \
--suffix-format='%04d' \
/tmp/db.sql \
'/-- Table structure for table/-1' \
'{*}'
# First file is the mysqldump header, rename it to "header"
mv table-0000 header
# Find last table file
last_table=$(find -type f -name 'table-*' | sort -n | tail -n1)
# Split last table file to extract mysqldump footer, which starts with a line including "@OLD_"
csplit \
--silent \
--prefix='last-' \
"${last_table}" \
'/@OLD_/'
# Replace $last_table with the version of it that has footer extracted from it
mv last-00 "${last_table}"
# Rename the extracted footer to "footer"
mv last-01 footer
# Prepend header and append footer to all table files, save them as <table_name>.sql
for file in table-*; do
table_name=$(grep 'Table structure for table' ${file} | cut -d$'\x60' -f2)
cat header "${file}" footer > "${table_name}.sql"
done
# Remove all non .sql files
find . -type f ! -name '*.sql' -delete

# Compress the sql files into a single file and copy it into the backup folder.
# We don't do this directly on the volume mount to avoid sending the uncompressed dump across the network.
tar -cf /tmp/db.tar.gz -I 'gzip -1' -C "${dump_dir}" .
cp /tmp/db.tar.gz /app/reference-data/db.tar.gz && echo "Saved db.tar.gz"
cd "${previous_wd}"

# For backwards compability, we keep this older method of saving reference data. This way it will be easier to roll back if needed.
# This will be removed once the new method has successfully been rolled out.
gzip -1 /tmp/db.sql
cp /tmp/db.sql.gz /app/reference-data/db.sql.gz && echo "Saved db.sql.gz"
# Compress the sql files into a single file and copy it into the backup folder.
# We don't do this directly on the volume mount to avoid sending the uncompressed dump across the network.
tar -cf /tmp/db.tar.gz -I 'gzip -1' -C "${dump_dir}" .
cp /tmp/db.tar.gz /app/reference-data/db.tar.gz && echo "Saved db.tar.gz"

{{ range $index, $mount := .Values.mounts -}}
{{- if eq $mount.enabled true -}}
# File backup for {{ $index }} volume.
echo "Dump reference files for {{ $index }} volume."
# For backwards compability, we keep this older method of saving reference data. This way it will be easier to roll back if needed.
# This will be removed once the new method has successfully been rolled out.
gzip -1 /tmp/db.sql
cp /tmp/db.sql.gz /app/reference-data/db.sql.gz && echo "Saved db.sql.gz"
fi

# Update reference data files.
rsync -rvu "{{ $mount.mountPath }}/" \
--max-size="{{ $.Values.referenceData.maxFileSize }}" \
{{ range $folderIndex, $folderPattern := $.Values.referenceData.ignoreFolders -}}
--exclude="{{ $folderPattern }}" \
if [ "${REF_DATA_COPY_FILES:-}" == "true" ]; then
{{ range $index, $mount := .Values.mounts -}}
{{- if eq $mount.enabled true -}}
# File backup for {{ $index }} volume.
echo "Dump reference files for {{ $index }} volume."

# Update reference data files.
rsync -rvu "{{ $mount.mountPath }}/" \
--max-size="{{ $.Values.referenceData.maxFileSize }}" \
{{ range $folderIndex, $folderPattern := $.Values.referenceData.ignoreFolders -}}
--exclude="{{ $folderPattern }}" \
{{ end -}}
--delete --delete-excluded \
/app/reference-data/{{ $index }}
{{ end -}}
--delete --delete-excluded \
/app/reference-data/{{ $index }}
{{ end -}}
{{- end }}
{{- end }}
fi
else
echo "Drupal bootstrap unsuccessful, skipping reference database dump."
fi
{{- end }}

{{- define "drupal.import-reference-db" -}}
if [[ -f /app/reference-data/db.tar.gz || -f /app/reference-data/db.sql.gz ]]; then
echo "Dropping old database"
drush sql-drop -y

app_ref_data=/app/reference-data
tmp_ref_data=/tmp/reference-data

# New way of importing.
if [[ -f "${app_ref_data}/db.tar.gz" ]]; then
echo "Importing reference database dump from db.tar.gz"
mkdir "${tmp_ref_data}"
tar -xzf "${app_ref_data}/db.tar.gz" -C "${tmp_ref_data}/"
find "${tmp_ref_data}/" -type f -name "*.sql" | xargs -P10 -I{} sh -c 'echo "Importing {}" && mysql -A --user="${DB_USER}" --password="${DB_PASS}" --host="${DB_HOST}" "${DB_NAME}" < {}'

# Backwards compatibility for old way of importing.
elif [[ -f "${app_ref_data}/db.sql.gz" ]]; then
echo "Importing reference database dump from db.sql.gz"
gunzip -c "${app_ref_data}/db.sql.gz" > "${tmp_ref_data}-db.sql"
pv -f "${tmp_ref_data}-db.sql" | drush sql-cli
fi
if [ "${REF_DATA_COPY_DB:-}" == "true" ]; then
if [[ -f /app/reference-data/db.tar.gz || -f /app/reference-data/db.sql.gz ]]; then
echo "Dropping old database"
drush sql-drop -y

app_ref_data=/app/reference-data
tmp_ref_data=/tmp/reference-data

# New way of importing.
if [[ -f "${app_ref_data}/db.tar.gz" ]]; then
echo "Importing reference database dump from db.tar.gz"
mkdir "${tmp_ref_data}"
tar -xzf "${app_ref_data}/db.tar.gz" -C "${tmp_ref_data}/"
find "${tmp_ref_data}/" -type f -name "*.sql" | xargs -P10 -I{} sh -c 'echo "Importing {}" && mysql -A --user="${DB_USER}" --password="${DB_PASS}" --host="${DB_HOST}" "${DB_NAME}" < {}'

# Backwards compatibility for old way of importing.
elif [[ -f "${app_ref_data}/db.sql.gz" ]]; then
echo "Importing reference database dump from db.sql.gz"
gunzip -c "${app_ref_data}/db.sql.gz" > "${tmp_ref_data}-db.sql"
pv -f "${tmp_ref_data}-db.sql" | drush sql-cli
fi

# Clear caches before doing anything else.
if [[ "${DRUPAL_CORE_VERSION}" -eq 7 ]] ; then
drush cache-clear all;
# Clear caches before doing anything else.
if [[ "${DRUPAL_CORE_VERSION}" -eq 7 ]] ; then
drush cache-clear all;
else
drush cache-rebuild;
fi
else
drush cache-rebuild;
printf "\e[33mNo reference data found, please install Drupal or import a database dump. See release information for instructions.\e[0m\n"
fi
else
printf "\e[33mNo reference data found, please install Drupal or import a database dump. See release information for instructions.\e[0m\n"
fi
{{- end }}

{{- define "drupal.import-reference-files" -}}
{{- define "drupal.import-reference-files" }}
if [ "${REF_DATA_COPY_FILES:-}" == "true" ]; then
{{ range $index, $mount := .Values.mounts -}}
{{- if eq $mount.enabled true -}}
if [ -d "/app/reference-data/{{ $index }}" ] && [ -n "$(ls /app/reference-data/{{ $index }})" ]; then
Expand All @@ -560,6 +586,7 @@ fi
fi
{{ end -}}
{{- end }}
fi
{{- end }}

{{- define "drupal.backup-command" -}}
Expand Down Expand Up @@ -743,4 +770,4 @@ autoscaling/v2beta1
{{- else }}
{{- .Release.Name }}-sa
{{- end }}
{{- end }}
{{- end }}
6 changes: 6 additions & 0 deletions drupal/templates/checks.yaml
Original file line number Diff line number Diff line change
@@ -1,8 +1,14 @@
{{- if and .Values.mailhog.enabled .Values.mailpit.enabled }}
{{- fail "Mailhog and mailpit can't be enabled at the same time as those are overlapping services. Use mailpit only as mailhog is deprecated." -}}
{{- end }}
{{- if index (index .Values "silta-release") "branchName" }}
{{- if eq (index (index .Values "silta-release") "branchName") "production" }}
{{- if .Values.mailhog.enabled }}
{{- fail "Mailhog should not be enabled in production" -}}
{{- end }}
{{- if .Values.mailpit.enabled }}
{{- fail "Mailpit should not be enabled in production" -}}
{{- end }}
{{- if eq .Values.nginx.resources.requests.cpu "1m" }}
{{- fail "Raise nginx.resources.requests.cpu for production environment" -}}
{{- end }}
Expand Down
Loading