diff --git a/.github/workflows/build-image-backend.yml b/.github/workflows/build-image-backend.yml index 11d88e0a..cafd4d7c 100644 --- a/.github/workflows/build-image-backend.yml +++ b/.github/workflows/build-image-backend.yml @@ -24,70 +24,70 @@ name: Build - Docker image Backend (SemVer) on: - push: - branches: - - main - # trigger events for SemVer like tags - tags: - - 'v*.*.*' - - 'v*.*.*-*' - pull_request: - branches: - - main + push: + branches: + - main + # trigger events for SemVer like tags + tags: + - 'v*.*.*' + - 'v*.*.*-*' + pull_request: + branches: + - main env: - IMAGE_NAMESPACE: "tractusx" - IMAGE_NAME: "app-puris-backend" + IMAGE_NAMESPACE: "tractusx" + IMAGE_NAME: "app-puris-backend" jobs: - docker: - if: github.repository_owner == 'eclipse-tractusx' # prevent running on forks - runs-on: ubuntu-latest - permissions: - packages: write + docker: + if: github.repository_owner == 'eclipse-tractusx' # prevent running on forks + runs-on: ubuntu-latest + permissions: + packages: write - steps: - - name: Checkout - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + steps: + - name: Checkout + uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - # Create SemVer or ref tags dependent of trigger event - - name: Docker meta - id: meta - uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0 - with: - images: | - ${{ env.IMAGE_NAMESPACE }}/${{ env.IMAGE_NAME }} - tags: | - # set latest tag for main branch - type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }},event=pr - type=ref,event=branch - type=ref,event=pr - type=semver,pattern={{version}} - type=semver,pattern={{major}} - type=semver,pattern={{major}}.{{minor}} + # Create SemVer or ref tags dependent of trigger event + - name: Docker meta + id: meta + uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0 + with: + images: | + ${{ env.IMAGE_NAMESPACE }}/${{ env.IMAGE_NAME }} + tags: | + # set latest tag for main branch + type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }},event=pr + type=ref,event=branch + type=ref,event=pr + type=semver,pattern={{version}} + type=semver,pattern={{major}} + type=semver,pattern={{major}}.{{minor}} - - name: DockerHub login - if: github.event_name != 'pull_request' - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3 - with: - username: ${{ secrets.DOCKER_HUB_USER }} - password: ${{ secrets.DOCKER_HUB_TOKEN }} + - name: DockerHub login + if: github.event_name != 'pull_request' + uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3 + with: + username: ${{ secrets.DOCKER_HUB_USER }} + password: ${{ secrets.DOCKER_HUB_TOKEN }} - - name: Build and push - uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 #v5.1 - with: - context: ./backend - file: ./backend/Dockerfile - push: ${{ github.event_name != 'pull_request' }} - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} + - name: Build and push + uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 #v5.1 + with: + context: ./backend + file: ./backend/Dockerfile + push: ${{ github.event_name != 'pull_request' }} + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} - # https://github.com/peter-evans/dockerhub-description - - name: Update Docker Hub description - if: github.event_name != 'pull_request' - uses: peter-evans/dockerhub-description@dc67fad7001ef9e8e3c124cb7a64e16d0a63d864 #v3.4.2 - with: - username: ${{ secrets.DOCKER_HUB_USER }} - password: ${{ secrets.DOCKER_HUB_TOKEN }} - repository: ${{ env.IMAGE_NAMESPACE }}/${{ env.IMAGE_NAME }} - readme-filepath: ./backend/README.md + # https://github.com/peter-evans/dockerhub-description + - name: Update Docker Hub description + if: github.event_name != 'pull_request' + uses: peter-evans/dockerhub-description@dc67fad7001ef9e8e3c124cb7a64e16d0a63d864 #v3.4.2 + with: + username: ${{ secrets.DOCKER_HUB_USER }} + password: ${{ secrets.DOCKER_HUB_TOKEN }} + repository: ${{ env.IMAGE_NAMESPACE }}/${{ env.IMAGE_NAME }} + readme-filepath: ./backend/DOCKER_NOTICE.md diff --git a/.github/workflows/build-image-frontend.yml b/.github/workflows/build-image-frontend.yml index f0a01de4..acae86a7 100644 --- a/.github/workflows/build-image-frontend.yml +++ b/.github/workflows/build-image-frontend.yml @@ -24,70 +24,70 @@ name: Build - Docker image Frontend (SemVer) on: - push: - branches: - - main - # trigger events for SemVer like tags - tags: - - 'v*.*.*' - - 'v*.*.*-*' - pull_request: - branches: - - main + push: + branches: + - main + # trigger events for SemVer like tags + tags: + - 'v*.*.*' + - 'v*.*.*-*' + pull_request: + branches: + - main env: - IMAGE_NAMESPACE: "tractusx" - IMAGE_NAME: "app-puris-frontend" + IMAGE_NAMESPACE: "tractusx" + IMAGE_NAME: "app-puris-frontend" jobs: - docker: - if: github.repository_owner == 'eclipse-tractusx' # prevent running on forks - runs-on: ubuntu-latest - permissions: - packages: write + docker: + if: github.repository_owner == 'eclipse-tractusx' # prevent running on forks + runs-on: ubuntu-latest + permissions: + packages: write - steps: - - name: Checkout - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + steps: + - name: Checkout + uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - # Create SemVer or ref tags dependent of trigger event - - name: Docker meta - id: meta - uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0 - with: - images: | - ${{ env.IMAGE_NAMESPACE }}/${{ env.IMAGE_NAME }} - tags: | - # set latest tag for main branch - type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }},event=pr - type=ref,event=branch - type=ref,event=pr - type=semver,pattern={{version}} - type=semver,pattern={{major}} - type=semver,pattern={{major}}.{{minor}} + # Create SemVer or ref tags dependent of trigger event + - name: Docker meta + id: meta + uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0 + with: + images: | + ${{ env.IMAGE_NAMESPACE }}/${{ env.IMAGE_NAME }} + tags: | + # set latest tag for main branch + type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }},event=pr + type=ref,event=branch + type=ref,event=pr + type=semver,pattern={{version}} + type=semver,pattern={{major}} + type=semver,pattern={{major}}.{{minor}} - - name: DockerHub login - if: github.event_name != 'pull_request' - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3 - with: - username: ${{ secrets.DOCKER_HUB_USER }} - password: ${{ secrets.DOCKER_HUB_TOKEN }} + - name: DockerHub login + if: github.event_name != 'pull_request' + uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3 + with: + username: ${{ secrets.DOCKER_HUB_USER }} + password: ${{ secrets.DOCKER_HUB_TOKEN }} - - name: Build and push - uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 #v5.1 - with: - context: ./frontend - file: ./frontend/Dockerfile - push: ${{ github.event_name != 'pull_request' }} - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} + - name: Build and push + uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 #v5.1 + with: + context: ./frontend + file: ./frontend/Dockerfile + push: ${{ github.event_name != 'pull_request' }} + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} - # https://github.com/peter-evans/dockerhub-description - - name: Update Docker Hub description - if: github.event_name != 'pull_request' - uses: peter-evans/dockerhub-description@dc67fad7001ef9e8e3c124cb7a64e16d0a63d864 #v3.4.2 - with: - username: ${{ secrets.DOCKER_HUB_USER }} - password: ${{ secrets.DOCKER_HUB_TOKEN }} - repository: ${{ env.IMAGE_NAMESPACE }}/${{ env.IMAGE_NAME }} - readme-filepath: ./frontend/README.md + # https://github.com/peter-evans/dockerhub-description + - name: Update Docker Hub description + if: github.event_name != 'pull_request' + uses: peter-evans/dockerhub-description@dc67fad7001ef9e8e3c124cb7a64e16d0a63d864 #v3.4.2 + with: + username: ${{ secrets.DOCKER_HUB_USER }} + password: ${{ secrets.DOCKER_HUB_TOKEN }} + repository: ${{ env.IMAGE_NAMESPACE }}/${{ env.IMAGE_NAME }} + readme-filepath: ./frontend/DOCKER_NOTICE.md diff --git a/.github/workflows/helm-test.yml b/.github/workflows/helm-test.yml new file mode 100644 index 00000000..6b4734ef --- /dev/null +++ b/.github/workflows/helm-test.yml @@ -0,0 +1,105 @@ +# +# Copyright (c) 2023 Contributors to the Eclipse Foundation +# +# See the NOTICE file(s) distributed with this work for additional +# information regarding copyright ownership. +# +# This program and the accompanying materials are made available under the +# terms of the Apache License, Version 2.0 which is available at +# https://www.apache.org/licenses/LICENSE-2.0. +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# SPDX-License-Identifier: Apache-2.0 +# +name: Lint and Test Charts + +on: + pull_request: + workflow_dispatch: + inputs: + node_image: + description: 'kindest/node image for k8s kind cluster' + # k8s version from 3.1 release as default + default: 'kindest/node:v1.27.3' + required: false + type: string + helm_version: + description: 'helm version to test (default = latest)' + default: 'latest' + required: false + type: string + +env: + REGISTRY: kind-registry:5000 + TAG: testing + APP_BACKEND_NAME: app-puris-backend + APP_FRONTEND_NAME: app-puris-frontend + +jobs: + lint-test: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1 + with: + fetch-depth: 0 + + - name: Kubernetes KinD Cluster + uses: container-tools/kind-action@7075d1458484493c6a92d4604cb27b87de0f8107 #v2.2 + with: + # upgrade version, default (v0.17.0) uses node image v1.21.1 and doesn't work with more recent node image versions + version: v0.20.0 + # default value for event_name != workflow_dispatch + node_image: ${{ github.event.inputs.node_image || 'kindest/node:v1.27.3' }} + + - name: Build Frontend image + uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 #v5.1 + with: + context: ./frontend + file: ./frontend/Dockerfile + push: true + tags: ${{ env.REGISTRY }}/${{ env.APP_FRONTEND_NAME }}:${{ env.TAG }} + + - name: Build Backend image + uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 #v5.1 + with: + context: ./backend + file: ./backend/Dockerfile + push: true + tags: ${{ env.REGISTRY }}/${{ env.APP_BACKEND_NAME }}:${{ env.TAG }} + + - name: Set up Helm + uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 #v3.5 + with: + version: ${{ github.event.inputs.helm_version || 'latest' }} + + - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c #v5.0.0 + with: + python-version: '3.9' + check-latest: true + + - name: Set up chart-testing + uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 #v2.6.1 + + - name: Run chart-testing (list-changed) + id: list-changed + run: | + changed=$(ct list-changed --target-branch ${{ github.event.repository.default_branch }}) + if [[ -n "$changed" ]]; then + echo "changed=true" >> $GITHUB_OUTPUT + fi + + - name: Run chart-testing (lint) + run: ct lint --validate-maintainers=false --target-branch ${{ github.event.repository.default_branch }} + + - name: Run chart-testing (install) + run: | + helm repo add bitnami https://charts.bitnami.com/bitnami + helm repo add postgresql https://charts.bitnami.com/bitnami + ct install --charts charts/puris --helm-extra-set-args "--set backend.image.repository=${{ env.REGISTRY }}/${{ env.APP_BACKEND_NAME}} --set backend.image.tag=${{ env.TAG }} --set frontend.image.repository=${{ env.REGISTRY }}/${{ env.APP_FRONTEND_NAME }} --set frontend.image.tag=${{ env.TAG }}" + if: github.event_name != 'pull_request' || steps.list-changed.outputs.changed == 'true' diff --git a/.tractusx b/.tractusx index 6a3bf141..ff946e98 100644 --- a/.tractusx +++ b/.tractusx @@ -1,3 +1,22 @@ +############################################################### +# Copyright (c) 2022,2024 Contributors to the Eclipse Foundation +# +# See the NOTICE file(s) distributed with this work for additional +# information regarding copyright ownership. +# +# This program and the accompanying materials are made available under the +# terms of the Apache License, Version 2.0 which is available at +# https://www.apache.org/licenses/LICENSE-2.0. +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# SPDX-License-Identifier: Apache-2.0 +############################################################### + product: "PURIS" leadingRepository: "https://github.com/eclipse-tractusx/puris" repositories: diff --git a/DEPENDENCIES_BACKEND b/DEPENDENCIES_BACKEND index 6fe7444a..e48173f6 100644 --- a/DEPENDENCIES_BACKEND +++ b/DEPENDENCIES_BACKEND @@ -43,7 +43,7 @@ maven/mavencentral/org.apiguardian/apiguardian-api/1.1.2, Apache-2.0, approved, maven/mavencentral/org.aspectj/aspectjweaver/1.9.21, Apache-2.0 AND BSD-3-Clause AND EPL-1.0 AND BSD-3-Clause AND Apache-1.1, approved, #7695 maven/mavencentral/org.assertj/assertj-core/3.24.2, Apache-2.0, approved, #6161 maven/mavencentral/org.awaitility/awaitility/4.2.0, Apache-2.0, approved, clearlydefined -maven/mavencentral/org.checkerframework/checker-qual/3.41.0, MIT, approved, #12032 +maven/mavencentral/org.checkerframework/checker-qual/3.42.0, MIT, approved, clearlydefined maven/mavencentral/org.eclipse.angus/angus-activation/2.0.1, EPL-2.0 OR GPL-2.0-only with Classpath-exception-2.0, approved, ee4j.angus maven/mavencentral/org.glassfish.jaxb/jaxb-core/4.0.4, BSD-3-Clause, approved, ee4j.jaxb maven/mavencentral/org.glassfish.jaxb/jaxb-runtime/4.0.4, BSD-3-Clause, approved, ee4j.jaxb @@ -71,7 +71,7 @@ maven/mavencentral/org.modelmapper/modelmapper/3.2.0, Apache-2.0, approved, clea maven/mavencentral/org.objenesis/objenesis/3.3, Apache-2.0, approved, clearlydefined maven/mavencentral/org.opentest4j/opentest4j/1.3.0, Apache-2.0, approved, #9713 maven/mavencentral/org.ow2.asm/asm/9.3, BSD-3-Clause, approved, clearlydefined -maven/mavencentral/org.postgresql/postgresql/42.7.1, BSD-2-Clause AND Apache-2.0, approved, #11681 +maven/mavencentral/org.postgresql/postgresql/42.7.2, BSD-2-Clause AND Apache-2.0, approved, #11681 maven/mavencentral/org.projectlombok/lombok/1.18.30, MIT AND LicenseRef-Public-Domain, approved, CQ23907 maven/mavencentral/org.skyscreamer/jsonassert/1.5.1, Apache-2.0, approved, clearlydefined maven/mavencentral/org.slf4j/jul-to-slf4j/2.0.11, MIT, approved, #7698 diff --git a/README.md b/README.md index d4de3634..79d1dba6 100644 --- a/README.md +++ b/README.md @@ -9,31 +9,13 @@ The project is made of a backend and a frontend. Look into the respective folder information about prerequirements and getting started guides. ## License + The project is licensed under the [Apache License Version 2.0](https://www.apache.org/licenses/LICENSE-2.0). For details on the licensing terms, see the `LICENSE` file. ## Notice for Docker Image -This application provides container images for demonstration purposes. - -Eclipse Tractus-X product(s) installed within the image: - -- GitHub: https://github.com/eclipse-tractusx/puris -- Project home: https://projects.eclipse.org/projects/automotive.tractusx -- Dockerfiles: - - Frontend: https://github.com/eclipse-tractusx/puris/blob/main/frontend/Dockerfile - - Backend: https://github.com/eclipse-tractusx/puris/blob/main/backend/Dockerfile -- Project license: [Apache License, Version 2.0](https://github.com/eclipse-tractusx/puris/blob/main/LICENSE) - -**Used Base Image [Frontend]** -- `node:lts-alpine` -- DockerHub: https://hub.docker.com/_/node/ -- GitHub project: https://github.com/nodejs/docker-node - -**Used Base Image [Backend]** -- `maven:3.8.7-eclipse-temurin-17` -- DockerHub: https://hub.docker.com/_/maven/ -- GitHub project: https://github.com/carlossg/docker-maven -As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained). +Below you can find the information regarding Docker Notice for this frontend. -As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within. +- [Frontend](./frontend/DOCKER_NOTICE.md) +- [Backend](./backend/DOCKER_NOTICE.md) diff --git a/backend/DEPENDENCIES b/backend/DEPENDENCIES index 6fe7444a..e48173f6 100644 --- a/backend/DEPENDENCIES +++ b/backend/DEPENDENCIES @@ -43,7 +43,7 @@ maven/mavencentral/org.apiguardian/apiguardian-api/1.1.2, Apache-2.0, approved, maven/mavencentral/org.aspectj/aspectjweaver/1.9.21, Apache-2.0 AND BSD-3-Clause AND EPL-1.0 AND BSD-3-Clause AND Apache-1.1, approved, #7695 maven/mavencentral/org.assertj/assertj-core/3.24.2, Apache-2.0, approved, #6161 maven/mavencentral/org.awaitility/awaitility/4.2.0, Apache-2.0, approved, clearlydefined -maven/mavencentral/org.checkerframework/checker-qual/3.41.0, MIT, approved, #12032 +maven/mavencentral/org.checkerframework/checker-qual/3.42.0, MIT, approved, clearlydefined maven/mavencentral/org.eclipse.angus/angus-activation/2.0.1, EPL-2.0 OR GPL-2.0-only with Classpath-exception-2.0, approved, ee4j.angus maven/mavencentral/org.glassfish.jaxb/jaxb-core/4.0.4, BSD-3-Clause, approved, ee4j.jaxb maven/mavencentral/org.glassfish.jaxb/jaxb-runtime/4.0.4, BSD-3-Clause, approved, ee4j.jaxb @@ -71,7 +71,7 @@ maven/mavencentral/org.modelmapper/modelmapper/3.2.0, Apache-2.0, approved, clea maven/mavencentral/org.objenesis/objenesis/3.3, Apache-2.0, approved, clearlydefined maven/mavencentral/org.opentest4j/opentest4j/1.3.0, Apache-2.0, approved, #9713 maven/mavencentral/org.ow2.asm/asm/9.3, BSD-3-Clause, approved, clearlydefined -maven/mavencentral/org.postgresql/postgresql/42.7.1, BSD-2-Clause AND Apache-2.0, approved, #11681 +maven/mavencentral/org.postgresql/postgresql/42.7.2, BSD-2-Clause AND Apache-2.0, approved, #11681 maven/mavencentral/org.projectlombok/lombok/1.18.30, MIT AND LicenseRef-Public-Domain, approved, CQ23907 maven/mavencentral/org.skyscreamer/jsonassert/1.5.1, Apache-2.0, approved, clearlydefined maven/mavencentral/org.slf4j/jul-to-slf4j/2.0.11, MIT, approved, #7698 diff --git a/backend/DOCKER_NOTICE.md b/backend/DOCKER_NOTICE.md new file mode 100644 index 00000000..258ff2f3 --- /dev/null +++ b/backend/DOCKER_NOTICE.md @@ -0,0 +1,20 @@ +This application provides container images for demonstration purposes. + +Eclipse Tractus-X product(s) installed within the image: + +- GitHub: https://github.com/eclipse-tractusx/puris +- Project home: https://projects.eclipse.org/projects/automotive.tractusx +- Dockerfile Backend: https://github.com/eclipse-tractusx/puris/blob/main/backend/Dockerfile +- Project license: [Apache License, Version 2.0](https://github.com/eclipse-tractusx/puris/blob/main/backend/LICENSE) + +**Used Base Image [Backend]** +`eclipse-temurin:17-jre-alpine` + +- DockerHub: https://hub.docker.com/_/eclipse-temurin +- GitHub project: https://github.com/adoptium/containers + +As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc +from the base distribution, along with any direct or indirect dependencies of the primary software being contained). + +As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies +with any relevant licenses for all software contained within. diff --git a/backend/README.md b/backend/README.md index 32279223..a7822c03 100644 --- a/backend/README.md +++ b/backend/README.md @@ -4,12 +4,13 @@ ## Table of Contents + - [Prerequirements](#prerequirements) - [Getting Started](#getting-started) - [License](#license) - ## Prerequirements + The following things are needed to start PURIS: - A Java Runtime Environment + Maven or an equivalent Docker setup @@ -21,25 +22,12 @@ The following things are needed to start PURIS: See the [installation instructions](INSTALL.md) for information on how to start the application. ## License + The project is licensed under the [Apache License Version 2.0](https://www.apache.org/licenses/LICENSE-2.0). For details on the licensing terms, see the `LICENSE` file. ## Notice for Docker Image -This application provides container images for demonstration purposes. - -Eclipse Tractus-X product(s) installed within the image: - -- GitHub: https://github.com/eclipse-tractusx/puris -- Project home: https://projects.eclipse.org/projects/automotive.tractusx -- Dockerfile Backend: https://github.com/eclipse-tractusx/puris/blob/main/backend/Dockerfile -- Project license: [Apache License, Version 2.0](https://github.com/eclipse-tractusx/puris/blob/main/backend/LICENSE) - - -**Used Base Image [Backend]** -- `maven:3.8.7-eclipse-temurin-17` -- DockerHub: https://hub.docker.com/_/maven/ -- GitHub project: https://github.com/carlossg/docker-maven -As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained). +Below you can find the information regarding Docker Notice for this frontend. -As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within. +[Backend](./DOCKER_NOTICE.md) diff --git a/backend/pom.xml b/backend/pom.xml index 8a3674ae..dfd363fe 100644 --- a/backend/pom.xml +++ b/backend/pom.xml @@ -73,7 +73,7 @@ org.postgresql postgresql - 42.7.1 + 42.7.2 runtime diff --git a/backend/src/main/java/org/eclipse/tractusx/puris/backend/PurisApplication.java b/backend/src/main/java/org/eclipse/tractusx/puris/backend/PurisApplication.java index 96191b75..71b5857b 100644 --- a/backend/src/main/java/org/eclipse/tractusx/puris/backend/PurisApplication.java +++ b/backend/src/main/java/org/eclipse/tractusx/puris/backend/PurisApplication.java @@ -1,7 +1,7 @@ /* - * Copyright (c) 2022-2024 Volkswagen AG - * Copyright (c) 2022-2024 Fraunhofer-Gesellschaft zur Foerderung der angewandten Forschung e.V. (represented by Fraunhofer ISST) - * Copyright (c) 2022-2024 Contributors to the Eclipse Foundation + * Copyright (c) 2022,2024 Volkswagen AG + * Copyright (c) 2022,2024 Fraunhofer-Gesellschaft zur Foerderung der angewandten Forschung e.V. (represented by Fraunhofer ISST) + * Copyright (c) 2022,2024 Contributors to the Eclipse Foundation * * See the NOTICE file(s) distributed with this work for additional * information regarding copyright ownership. @@ -44,8 +44,8 @@ public ModelMapper getModelMapper() { ModelMapper modelMapper = new ModelMapper(); modelMapper.getConfiguration() - .setFieldMatchingEnabled(true) - .setFieldAccessLevel(Configuration.AccessLevel.PRIVATE); + .setFieldMatchingEnabled(true) + .setFieldAccessLevel(Configuration.AccessLevel.PRIVATE); return new ModelMapper(); } diff --git a/backend/src/main/java/org/eclipse/tractusx/puris/backend/common/edc/controller/EdcController.java b/backend/src/main/java/org/eclipse/tractusx/puris/backend/common/edc/controller/EdcController.java index cb92b64e..d832e5d3 100644 --- a/backend/src/main/java/org/eclipse/tractusx/puris/backend/common/edc/controller/EdcController.java +++ b/backend/src/main/java/org/eclipse/tractusx/puris/backend/common/edc/controller/EdcController.java @@ -1,7 +1,7 @@ /* - * Copyright (c) 2022-2024 Volkswagen AG - * Copyright (c) 2022-2024 Fraunhofer-Gesellschaft zur Foerderung der angewandten Forschung e.V. (represented by Fraunhofer ISST) - * Copyright (c) 2022-2024 Contributors to the Eclipse Foundation + * Copyright (c) 2022,2024 Volkswagen AG + * Copyright (c) 2022,2024 Fraunhofer-Gesellschaft zur Foerderung der angewandten Forschung e.V. (represented by Fraunhofer ISST) + * Copyright (c) 2022,2024 Contributors to the Eclipse Foundation * * See the NOTICE file(s) distributed with this work for additional * information regarding copyright ownership. @@ -24,8 +24,8 @@ import com.fasterxml.jackson.databind.ObjectMapper; import com.fasterxml.jackson.databind.node.ObjectNode; import lombok.extern.slf4j.Slf4j; -import org.eclipse.tractusx.puris.backend.common.util.PatternStore; import org.eclipse.tractusx.puris.backend.common.edc.logic.service.EdcAdapterService; +import org.eclipse.tractusx.puris.backend.common.util.PatternStore; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.http.ResponseEntity; import org.springframework.web.bind.annotation.GetMapping; diff --git a/backend/src/main/java/org/eclipse/tractusx/puris/backend/common/edc/logic/service/EdcAdapterService.java b/backend/src/main/java/org/eclipse/tractusx/puris/backend/common/edc/logic/service/EdcAdapterService.java index 79f0bd81..ddd84fc1 100644 --- a/backend/src/main/java/org/eclipse/tractusx/puris/backend/common/edc/logic/service/EdcAdapterService.java +++ b/backend/src/main/java/org/eclipse/tractusx/puris/backend/common/edc/logic/service/EdcAdapterService.java @@ -1,7 +1,7 @@ /* - * Copyright (c) 2022-2024 Volkswagen AG - * Copyright (c) 2022-2024 Fraunhofer-Gesellschaft zur Foerderung der angewandten Forschung e.V. (represented by Fraunhofer ISST) - * Copyright (c) 2022-2024 Contributors to the Eclipse Foundation + * Copyright (c) 2022,2024 Volkswagen AG + * Copyright (c) 2022,2024 Fraunhofer-Gesellschaft zur Foerderung der angewandten Forschung e.V. (represented by Fraunhofer ISST) + * Copyright (c) 2022,2024 Contributors to the Eclipse Foundation * * See the NOTICE file(s) distributed with this work for additional * information regarding copyright ownership. diff --git a/backend/src/main/java/org/eclipse/tractusx/puris/backend/common/edc/logic/util/EdcRequestBodyBuilder.java b/backend/src/main/java/org/eclipse/tractusx/puris/backend/common/edc/logic/util/EdcRequestBodyBuilder.java index fbc4e2e2..085f45f8 100644 --- a/backend/src/main/java/org/eclipse/tractusx/puris/backend/common/edc/logic/util/EdcRequestBodyBuilder.java +++ b/backend/src/main/java/org/eclipse/tractusx/puris/backend/common/edc/logic/util/EdcRequestBodyBuilder.java @@ -90,7 +90,11 @@ public JsonNode buildCreateItemStockAssetBody(DT_ApiMethodEnum apiMethod) { propertiesObject.put("description", apiMethod.DESCRIPTION); var dataAddress = MAPPER.createObjectNode(); - String url = apiMethod == DT_ApiMethodEnum.REQUEST ? variablesService.getRequestServerEndpoint() : variablesService.getResponseServerEndpoint(); + String url = switch (apiMethod) { + case REQUEST -> variablesService.getRequestServerEndpoint(); + case RESPONSE -> variablesService.getResponseServerEndpoint(); + case STATUS_REQUEST -> variablesService.getStatusRequestServerEndpoint(); + }; dataAddress.put("baseUrl", url); dataAddress.put("type", "HttpData"); dataAddress.put("proxyPath", "true"); diff --git a/backend/src/main/java/org/eclipse/tractusx/puris/backend/common/security/SecurityConfig.java b/backend/src/main/java/org/eclipse/tractusx/puris/backend/common/security/SecurityConfig.java index 7b3264db..16153249 100644 --- a/backend/src/main/java/org/eclipse/tractusx/puris/backend/common/security/SecurityConfig.java +++ b/backend/src/main/java/org/eclipse/tractusx/puris/backend/common/security/SecurityConfig.java @@ -1,6 +1,6 @@ /* - * Copyright (c) 2023, 2024 Volkswagen AG - * Copyright (c) 2023, 2024 Contributors to the Eclipse Foundation + * Copyright (c) 2022,2024 Volkswagen AG + * Copyright (c) 2022,2024 Contributors to the Eclipse Foundation * * See the NOTICE file(s) distributed with this work for additional * information regarding copyright ownership. @@ -20,6 +20,12 @@ package org.eclipse.tractusx.puris.backend.common.security; +import io.swagger.v3.oas.annotations.OpenAPIDefinition; +import io.swagger.v3.oas.annotations.enums.SecuritySchemeIn; +import io.swagger.v3.oas.annotations.enums.SecuritySchemeType; +import io.swagger.v3.oas.annotations.info.Info; +import io.swagger.v3.oas.annotations.security.SecurityRequirement; +import io.swagger.v3.oas.annotations.security.SecurityScheme; import jakarta.servlet.DispatcherType; import lombok.AllArgsConstructor; import lombok.extern.slf4j.Slf4j; @@ -43,8 +49,12 @@ @EnableWebSecurity @AllArgsConstructor @Slf4j +@SecurityScheme(type = SecuritySchemeType.APIKEY, name = SecurityConfig.API_KEY_HEADER_NAME, in = SecuritySchemeIn.HEADER) +@OpenAPIDefinition(info = @Info(title = "PURIS FOSS Open API", version = "1.0.0"), security = {@SecurityRequirement(name = "X-API-KEY")}) public class SecurityConfig { + public static final String API_KEY_HEADER_NAME = "X-API-KEY"; + private final ApiKeyAuthenticationFilter apiKeyAuthenticationFilter; @Bean @@ -69,7 +79,7 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { .authorizeHttpRequests( // any request in spring context (authorizeHttpRequests) -> authorizeHttpRequests - .requestMatchers("/stockView/**", "/partners/**", "/materials/**", "/materialpartnerrelations/**", "/item-stock/**", "/edrendpoint/**", "/edc/**").authenticated() + .requestMatchers("/stockView/**", "/partners/**", "/materials/**", "/materialpartnerrelations/**", "/item-stock/**", "/edrendpoint/**", "/edc/**").authenticated() .requestMatchers("/swagger-ui/**", "/v3/api-docs/**", "/health/**").permitAll() .dispatcherTypeMatchers(DispatcherType.ERROR).permitAll() ) diff --git a/backend/src/main/java/org/eclipse/tractusx/puris/backend/common/security/logic/ApiKeyAuthenticationFilter.java b/backend/src/main/java/org/eclipse/tractusx/puris/backend/common/security/logic/ApiKeyAuthenticationFilter.java index c53aa9e8..93399cd5 100644 --- a/backend/src/main/java/org/eclipse/tractusx/puris/backend/common/security/logic/ApiKeyAuthenticationFilter.java +++ b/backend/src/main/java/org/eclipse/tractusx/puris/backend/common/security/logic/ApiKeyAuthenticationFilter.java @@ -1,6 +1,6 @@ /* - * Copyright (c) 2023 Volkswagen AG - * Copyright (c) 2023 Contributors to the Eclipse Foundation + * Copyright (c) 2022,2024 Volkswagen AG + * Copyright (c) 2022,2024 Contributors to the Eclipse Foundation * * See the NOTICE file(s) distributed with this work for additional * information regarding copyright ownership. @@ -24,7 +24,9 @@ import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletResponse; import lombok.AllArgsConstructor; +import org.eclipse.tractusx.puris.backend.common.security.SecurityConfig; import org.eclipse.tractusx.puris.backend.common.security.domain.ApiKeyAuthentication; +import org.jetbrains.annotations.NotNull; import org.springframework.security.core.Authentication; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.stereotype.Component; @@ -39,18 +41,18 @@ @AllArgsConstructor public class ApiKeyAuthenticationFilter extends OncePerRequestFilter { - public final String API_KEY_HEADER = "X-API-KEY"; private final ApiKeyAuthenticationProvider apiKeyAuthenticationProvider; + @Override - protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { - String headerKey = request.getHeader(API_KEY_HEADER); + protected void doFilterInternal(HttpServletRequest request, @NotNull HttpServletResponse response, @NotNull FilterChain filterChain) throws ServletException, IOException { + String headerKey = request.getHeader(SecurityConfig.API_KEY_HEADER_NAME); - if (headerKey != null){ + if (headerKey != null) { ApiKeyAuthentication apiKeyAuthentication = new ApiKeyAuthentication(headerKey, false); Authentication authenticatedObject = apiKeyAuthenticationProvider.authenticate(apiKeyAuthentication); SecurityContextHolder.getContext().setAuthentication(authenticatedObject); } - filterChain.doFilter(request,response); + filterChain.doFilter(request, response); } } diff --git a/backend/src/main/java/org/eclipse/tractusx/puris/backend/masterdata/domain/model/Partner.java b/backend/src/main/java/org/eclipse/tractusx/puris/backend/masterdata/domain/model/Partner.java index 4d8c185a..575db9ad 100644 --- a/backend/src/main/java/org/eclipse/tractusx/puris/backend/masterdata/domain/model/Partner.java +++ b/backend/src/main/java/org/eclipse/tractusx/puris/backend/masterdata/domain/model/Partner.java @@ -76,7 +76,9 @@ public class Partner { * Partner's BPNL. */ private SortedSet
addresses = new TreeSet<>(); + @OneToMany(cascade = CascadeType.ALL) + @Valid /** * Contains all Sites (BPNSs) that are assigned to this * Partner's BPNL. Each BPNS has one or more addresses (BPNAs). diff --git a/backend/src/main/java/org/eclipse/tractusx/puris/backend/masterdata/logic/dto/MaterialDto.java b/backend/src/main/java/org/eclipse/tractusx/puris/backend/masterdata/logic/dto/MaterialDto.java index 42589fd5..dfaaafc3 100644 --- a/backend/src/main/java/org/eclipse/tractusx/puris/backend/masterdata/logic/dto/MaterialDto.java +++ b/backend/src/main/java/org/eclipse/tractusx/puris/backend/masterdata/logic/dto/MaterialDto.java @@ -46,7 +46,6 @@ public class MaterialDto implements Serializable { *

* Boolean because there could be companies (tradesmen company) that buy and sell the same material. */ - @Pattern(regexp = PatternStore.NON_EMPTY_NON_VERTICAL_WHITESPACE_STRING) private boolean materialFlag; /** diff --git a/backend/src/main/java/org/eclipse/tractusx/puris/backend/masterdata/logic/dto/PartnerDto.java b/backend/src/main/java/org/eclipse/tractusx/puris/backend/masterdata/logic/dto/PartnerDto.java index 670bb995..8bdf3d55 100644 --- a/backend/src/main/java/org/eclipse/tractusx/puris/backend/masterdata/logic/dto/PartnerDto.java +++ b/backend/src/main/java/org/eclipse/tractusx/puris/backend/masterdata/logic/dto/PartnerDto.java @@ -21,6 +21,7 @@ */ package org.eclipse.tractusx.puris.backend.masterdata.logic.dto; +import jakarta.validation.Valid; import jakarta.validation.constraints.Pattern; import lombok.*; import org.eclipse.tractusx.puris.backend.common.util.PatternStore; @@ -45,7 +46,9 @@ public class PartnerDto implements Serializable { @Pattern(regexp = PatternStore.BPNL_STRING) private String bpnl; + @Valid private SortedSet addresses = new TreeSet<>(); + @Valid private SortedSet sites = new TreeSet<>(); } diff --git a/backend/src/main/java/org/eclipse/tractusx/puris/backend/masterdata/logic/dto/SiteDto.java b/backend/src/main/java/org/eclipse/tractusx/puris/backend/masterdata/logic/dto/SiteDto.java index f2f0f7c6..23b25a18 100644 --- a/backend/src/main/java/org/eclipse/tractusx/puris/backend/masterdata/logic/dto/SiteDto.java +++ b/backend/src/main/java/org/eclipse/tractusx/puris/backend/masterdata/logic/dto/SiteDto.java @@ -21,6 +21,7 @@ */ package org.eclipse.tractusx.puris.backend.masterdata.logic.dto; +import jakarta.validation.Valid; import jakarta.validation.constraints.Pattern; import lombok.*; import org.eclipse.tractusx.puris.backend.common.util.PatternStore; @@ -38,6 +39,7 @@ public class SiteDto implements Comparable { private String bpns; @Pattern(regexp = PatternStore.NON_EMPTY_NON_VERTICAL_WHITESPACE_STRING) private String name; + @Valid private Set addresses = new HashSet<>(); @Override diff --git a/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/ItemStockRequestMessageDto.java b/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/ItemStockRequestMessageDto.java index b568ba5b..f9b4162c 100644 --- a/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/ItemStockRequestMessageDto.java +++ b/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/ItemStockRequestMessageDto.java @@ -20,6 +20,7 @@ package org.eclipse.tractusx.puris.backend.stock.logic.dto; +import jakarta.validation.Valid; import jakarta.validation.constraints.NotNull; import jakarta.validation.constraints.Pattern; import lombok.Getter; @@ -43,8 +44,10 @@ */ public class ItemStockRequestMessageDto { @NotNull + @Valid private HeaderDto header = new HeaderDto(); @NotNull + @Valid private ContentDto content = new ContentDto(); @Getter @@ -76,6 +79,7 @@ public static class ContentDto { @NotNull private DirectionCharacteristic direction; @NotNull + @Valid private List itemStock = new ArrayList<>(); } @Getter diff --git a/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/ItemStockResponseDto.java b/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/ItemStockResponseDto.java index f77b9275..5b67cf37 100644 --- a/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/ItemStockResponseDto.java +++ b/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/ItemStockResponseDto.java @@ -20,6 +20,7 @@ package org.eclipse.tractusx.puris.backend.stock.logic.dto; +import jakarta.validation.Valid; import jakarta.validation.constraints.NotNull; import jakarta.validation.constraints.Pattern; import lombok.Getter; @@ -43,8 +44,10 @@ public class ItemStockResponseDto { @NotNull + @Valid private HeaderDto header = new HeaderDto(); @NotNull + @Valid private ContentDto content = new ContentDto(); @Getter @@ -75,6 +78,7 @@ public static class HeaderDto { @Setter @ToString public static class ContentDto { + @Valid List itemStock = new ArrayList<>(); } } diff --git a/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/ItemStockStatusRequestMessageDto.java b/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/ItemStockStatusRequestMessageDto.java index 7c71d5bc..05d39571 100644 --- a/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/ItemStockStatusRequestMessageDto.java +++ b/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/ItemStockStatusRequestMessageDto.java @@ -20,6 +20,7 @@ package org.eclipse.tractusx.puris.backend.stock.logic.dto; +import jakarta.validation.Valid; import jakarta.validation.constraints.NotNull; import jakarta.validation.constraints.Pattern; import lombok.Getter; @@ -39,8 +40,10 @@ */ public class ItemStockStatusRequestMessageDto { @NotNull + @Valid private HeaderDto header = new HeaderDto(); @NotNull + @Valid private Object content = new Object(); @Getter diff --git a/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/StockDto.java b/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/StockDto.java index ef8d8897..0bcf70ea 100644 --- a/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/StockDto.java +++ b/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/StockDto.java @@ -23,6 +23,7 @@ import com.fasterxml.jackson.annotation.JsonProperty; +import jakarta.validation.Valid; import jakarta.validation.constraints.Pattern; import lombok.Getter; import lombok.NoArgsConstructor; @@ -46,6 +47,7 @@ public abstract class StockDto implements Serializable { private UUID uuid; + @Valid private MaterialDto material; private double quantity; diff --git a/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/itemstocksamm/AllocatedStock.java b/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/itemstocksamm/AllocatedStock.java index 78bafc63..50a475ca 100644 --- a/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/itemstocksamm/AllocatedStock.java +++ b/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/itemstocksamm/AllocatedStock.java @@ -21,6 +21,7 @@ import com.fasterxml.jackson.annotation.JsonCreator; import com.fasterxml.jackson.annotation.JsonProperty; +import jakarta.validation.Valid; import jakarta.validation.constraints.NotNull; import jakarta.validation.constraints.Pattern; import lombok.Getter; @@ -46,6 +47,7 @@ public class AllocatedStock { @NotNull + @Valid private ItemQuantityEntity quantityOnAllocatedStock; @NotNull diff --git a/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/itemstocksamm/ItemStockSamm.java b/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/itemstocksamm/ItemStockSamm.java index d8bf5c76..56560d6a 100644 --- a/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/itemstocksamm/ItemStockSamm.java +++ b/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/itemstocksamm/ItemStockSamm.java @@ -21,6 +21,7 @@ import com.fasterxml.jackson.annotation.JsonCreator; import com.fasterxml.jackson.annotation.JsonProperty; +import jakarta.validation.Valid; import jakarta.validation.constraints.NotNull; import jakarta.validation.constraints.Pattern; import lombok.Getter; @@ -44,6 +45,7 @@ public class ItemStockSamm { @NotNull + @Valid private List positions; @NotNull diff --git a/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/itemstocksamm/Position.java b/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/itemstocksamm/Position.java index 16a8deed..6036689a 100644 --- a/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/itemstocksamm/Position.java +++ b/backend/src/main/java/org/eclipse/tractusx/puris/backend/stock/logic/dto/itemstocksamm/Position.java @@ -21,6 +21,7 @@ import com.fasterxml.jackson.annotation.JsonCreator; import com.fasterxml.jackson.annotation.JsonProperty; +import jakarta.validation.Valid; import jakarta.validation.constraints.NotNull; import lombok.Getter; import lombok.NoArgsConstructor; @@ -44,12 +45,14 @@ @NoArgsConstructor @ToString public class Position { + @Valid private OrderPositionReference orderPositionReference; @NotNull private Date lastUpdatedOnDateTime; @NotNull + @Valid private List allocatedStocks; @JsonCreator diff --git a/backend/src/test/java/org/eclipse/tractusx/puris/backend/masterdata/domain/model/PartnerTest.java b/backend/src/test/java/org/eclipse/tractusx/puris/backend/masterdata/domain/model/PartnerTest.java index 64142378..7b12c46d 100644 --- a/backend/src/test/java/org/eclipse/tractusx/puris/backend/masterdata/domain/model/PartnerTest.java +++ b/backend/src/test/java/org/eclipse/tractusx/puris/backend/masterdata/domain/model/PartnerTest.java @@ -46,7 +46,7 @@ public static void setUp() { @Test public void test_invalidPartnerName() { Partner partner = new Partner("Invalid\nName", "https://www.example.com", "BPNL1234567890LE", - "BPNS123456780LE", "Site A", "BPNA1234567890LE", "123 Main St", "12345 New York", "USA"); + "BPNS1234567890LE", "Site A", "BPNA1234567890LE", "123 Main St", "12345 New York", "USA"); Set> violations = validator.validate(partner); diff --git a/charts/puris/Chart.yaml b/charts/puris/Chart.yaml index 0fc91c7e..ce9aea4b 100644 --- a/charts/puris/Chart.yaml +++ b/charts/puris/Chart.yaml @@ -25,7 +25,7 @@ description: A helm chart for Kubernetes deployment of PURIS type: application home: https://github.com/eclipse-tractusx/puris sources: - - https://github.com/eclipse-tractusx/puris + - https://github.com/eclipse-tractusx/puris dependencies: - condition: postgresql.enabled name: postgresql @@ -35,7 +35,7 @@ dependencies: # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 1.0.0 +version: 1.0.2 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to diff --git a/charts/puris/README.md b/charts/puris/README.md index 39c385b5..7f3236ce 100644 --- a/charts/puris/README.md +++ b/charts/puris/README.md @@ -1,6 +1,6 @@ # puris -![Version: 1.0.0](https://img.shields.io/badge/Version-1.0.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: main](https://img.shields.io/badge/AppVersion-main-informational?style=flat-square) +![Version: 1.0.2](https://img.shields.io/badge/Version-1.0.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: main](https://img.shields.io/badge/AppVersion-main-informational?style=flat-square) A helm chart for Kubernetes deployment of PURIS @@ -155,6 +155,9 @@ $ helm install puris --namespace puris --create-namespace . | frontend.puris.keycloak.realm | string | `"Catena-X"` | Name of the Realm of the keycloak instance. | | frontend.puris.keycloak.redirectUrlFrontend | string | `"https://your-frontend-url.com"` | URL to use as keycloak redirect url. | | frontend.puris.keycloak.url | string | `"https://idp.com/auth"` | The URL to the IDP that should be used. | +| frontend.puris.rateLimiting.burst | int | `30` | Burst rate limiting for nginx. | +| frontend.puris.rateLimiting.limit | string | `"10m"` | Bucket zone limit for rate limiting in nginx. | +| frontend.puris.rateLimiting.rate | string | `"10r/s"` | Allowed rates per second for nginx rate limiting. | | frontend.readinessProbe | object | `{"failureThreshold":3,"initialDelaySeconds":10,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":1}` | Checks if the pod is fully ready to operate | | frontend.readinessProbe.failureThreshold | int | `3` | Number of failures (threshold) for a readiness probe | | frontend.readinessProbe.initialDelaySeconds | int | `10` | Delay in seconds after which an initial readiness probe is checked | diff --git a/charts/puris/templates/backend-deployment.yaml b/charts/puris/templates/backend-deployment.yaml index d3d4bc9a..31272934 100644 --- a/charts/puris/templates/backend-deployment.yaml +++ b/charts/puris/templates/backend-deployment.yaml @@ -1,3 +1,24 @@ +# +# Copyright (c) 2022,2024 Volkswagen AG +# Copyright (c) 2022,2024 Fraunhofer-Gesellschaft zur Foerderung der angewandten Forschung e.V. (represented by Fraunhofer ISST) +# Copyright (c) 2022,2024 Contributors to the Eclipse Foundation +# +# See the NOTICE file(s) distributed with this work for additional +# information regarding copyright ownership. +# +# This program and the accompanying materials are made available under the +# terms of the Apache License, Version 2.0 which is available at +# https://www.apache.org/licenses/LICENSE-2.0. +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# SPDX-License-Identifier: Apache-2.0 +# + apiVersion: apps/v1 kind: Deployment metadata: diff --git a/charts/puris/templates/backend-hpa.yaml b/charts/puris/templates/backend-hpa.yaml index 853860e5..a6d24592 100644 --- a/charts/puris/templates/backend-hpa.yaml +++ b/charts/puris/templates/backend-hpa.yaml @@ -1,3 +1,24 @@ +# +# Copyright (c) 2022,2024 Volkswagen AG +# Copyright (c) 2022,2024 Fraunhofer-Gesellschaft zur Foerderung der angewandten Forschung e.V. (represented by Fraunhofer ISST) +# Copyright (c) 2022,2024 Contributors to the Eclipse Foundation +# +# See the NOTICE file(s) distributed with this work for additional +# information regarding copyright ownership. +# +# This program and the accompanying materials are made available under the +# terms of the Apache License, Version 2.0 which is available at +# https://www.apache.org/licenses/LICENSE-2.0. +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# SPDX-License-Identifier: Apache-2.0 +# + {{- if .Values.backend.autoscaling.enabled }} apiVersion: autoscaling/v2beta1 kind: HorizontalPodAutoscaler diff --git a/charts/puris/templates/backend-ingress.yaml b/charts/puris/templates/backend-ingress.yaml index b14bbdaa..56448c73 100644 --- a/charts/puris/templates/backend-ingress.yaml +++ b/charts/puris/templates/backend-ingress.yaml @@ -1,3 +1,24 @@ +{{- /* +* Copyright (c) 2022,2024 Volkswagen AG +* Copyright (c) 2022,2024 Fraunhofer-Gesellschaft zur Foerderung der angewandten Forschung e.V. (represented by Fraunhofer ISST) +* Copyright (c) 2022,2024 Contributors to the Eclipse Foundation +* +* See the NOTICE file(s) distributed with this work for additional +* information regarding copyright ownership. +* +* This program and the accompanying materials are made available under the +* terms of the Apache License, Version 2.0 which is available at +* https://www.apache.org/licenses/LICENSE-2.0. +* +* Unless required by applicable law or agreed to in writing, software +* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +* License for the specific language governing permissions and limitations +* under the License. +* +* SPDX-License-Identifier: Apache-2.0 +*/}} + {{- if .Values.backend.ingress.enabled -}} {{- $fullName := include "backend.fullname" . -}} {{- $svcPort := .Values.backend.service.port -}} diff --git a/charts/puris/templates/backend-service.yaml b/charts/puris/templates/backend-service.yaml index 61129bbe..afe6b264 100644 --- a/charts/puris/templates/backend-service.yaml +++ b/charts/puris/templates/backend-service.yaml @@ -1,3 +1,24 @@ +# +# Copyright (c) 2022,2024 Volkswagen AG +# Copyright (c) 2022,2024 Fraunhofer-Gesellschaft zur Foerderung der angewandten Forschung e.V. (represented by Fraunhofer ISST) +# Copyright (c) 2022,2024 Contributors to the Eclipse Foundation +# +# See the NOTICE file(s) distributed with this work for additional +# information regarding copyright ownership. +# +# This program and the accompanying materials are made available under the +# terms of the Apache License, Version 2.0 which is available at +# https://www.apache.org/licenses/LICENSE-2.0. +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# SPDX-License-Identifier: Apache-2.0 +# + apiVersion: v1 kind: Service metadata: diff --git a/charts/puris/templates/backend-serviceaccount.yaml b/charts/puris/templates/backend-serviceaccount.yaml index e5e33000..3125dd0b 100644 --- a/charts/puris/templates/backend-serviceaccount.yaml +++ b/charts/puris/templates/backend-serviceaccount.yaml @@ -1,3 +1,24 @@ +{{- /* +* Copyright (c) 2022,2024 Volkswagen AG +* Copyright (c) 2022,2024 Fraunhofer-Gesellschaft zur Foerderung der angewandten Forschung e.V. (represented by Fraunhofer ISST) +* Copyright (c) 2022,2024 Contributors to the Eclipse Foundation +* +* See the NOTICE file(s) distributed with this work for additional +* information regarding copyright ownership. +* +* This program and the accompanying materials are made available under the +* terms of the Apache License, Version 2.0 which is available at +* https://www.apache.org/licenses/LICENSE-2.0. +* +* Unless required by applicable law or agreed to in writing, software +* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +* License for the specific language governing permissions and limitations +* under the License. +* +* SPDX-License-Identifier: Apache-2.0 +*/}} + {{- if .Values.backend.serviceAccount.create -}} apiVersion: v1 kind: ServiceAccount diff --git a/charts/puris/templates/frontend-deployment.yaml b/charts/puris/templates/frontend-deployment.yaml index cecf14a3..fd1971b0 100644 --- a/charts/puris/templates/frontend-deployment.yaml +++ b/charts/puris/templates/frontend-deployment.yaml @@ -1,3 +1,24 @@ +# +# Copyright (c) 2022,2024 Volkswagen AG +# Copyright (c) 2022,2024 Fraunhofer-Gesellschaft zur Foerderung der angewandten Forschung e.V. (represented by Fraunhofer ISST) +# Copyright (c) 2022,2024 Contributors to the Eclipse Foundation +# +# See the NOTICE file(s) distributed with this work for additional +# information regarding copyright ownership. +# +# This program and the accompanying materials are made available under the +# terms of the Apache License, Version 2.0 which is available at +# https://www.apache.org/licenses/LICENSE-2.0. +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# SPDX-License-Identifier: Apache-2.0 +# + apiVersion: apps/v1 kind: Deployment metadata: @@ -72,6 +93,12 @@ spec: value: "{{ .Values.frontend.puris.keycloak.clientId }}" - name: IDP_REDIRECT_URL_FRONTEND value: "{{ .Values.frontend.puris.keycloak.redirectUrlFrontend }}" + - name: NGINX_RATE_LIMIT + value: "{{ .Values.frontend.puris.rateLimiting.limit }}" + - name: NGINX_BURST + value: "{{ .Values.frontend.puris.rateLimiting.burst }}" + - name: NGINX_RATE + value: "{{ .Values.frontend.puris.rateLimiting.rate }}" ports: - name: http containerPort: {{ .Values.frontend.service.port }} diff --git a/charts/puris/templates/frontend-hpa.yaml b/charts/puris/templates/frontend-hpa.yaml index 49ba83cc..eecabe59 100644 --- a/charts/puris/templates/frontend-hpa.yaml +++ b/charts/puris/templates/frontend-hpa.yaml @@ -1,3 +1,24 @@ +# +# Copyright (c) 2022,2024 Volkswagen AG +# Copyright (c) 2022,2024 Fraunhofer-Gesellschaft zur Foerderung der angewandten Forschung e.V. (represented by Fraunhofer ISST) +# Copyright (c) 2022,2024 Contributors to the Eclipse Foundation +# +# See the NOTICE file(s) distributed with this work for additional +# information regarding copyright ownership. +# +# This program and the accompanying materials are made available under the +# terms of the Apache License, Version 2.0 which is available at +# https://www.apache.org/licenses/LICENSE-2.0. +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# SPDX-License-Identifier: Apache-2.0 +# + {{- if .Values.frontend.autoscaling.enabled }} apiVersion: autoscaling/v2beta1 kind: HorizontalPodAutoscaler diff --git a/charts/puris/templates/frontend-ingress.yaml b/charts/puris/templates/frontend-ingress.yaml index 9ce5b218..0e878817 100644 --- a/charts/puris/templates/frontend-ingress.yaml +++ b/charts/puris/templates/frontend-ingress.yaml @@ -1,3 +1,24 @@ +{{- /* +* Copyright (c) 2022,2024 Volkswagen AG +* Copyright (c) 2022,2024 Fraunhofer-Gesellschaft zur Foerderung der angewandten Forschung e.V. (represented by Fraunhofer ISST) +* Copyright (c) 2022,2024 Contributors to the Eclipse Foundation +* +* See the NOTICE file(s) distributed with this work for additional +* information regarding copyright ownership. +* +* This program and the accompanying materials are made available under the +* terms of the Apache License, Version 2.0 which is available at +* https://www.apache.org/licenses/LICENSE-2.0. +* +* Unless required by applicable law or agreed to in writing, software +* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +* License for the specific language governing permissions and limitations +* under the License. +* +* SPDX-License-Identifier: Apache-2.0 +*/}} + {{- if .Values.frontend.ingress.enabled -}} {{- $fullName := include "frontend.fullname" . -}} {{- $svcPort := .Values.frontend.service.port -}} diff --git a/charts/puris/templates/frontend-service.yaml b/charts/puris/templates/frontend-service.yaml index 9234e7af..86304839 100644 --- a/charts/puris/templates/frontend-service.yaml +++ b/charts/puris/templates/frontend-service.yaml @@ -1,3 +1,24 @@ +# +# Copyright (c) 2022,2024 Volkswagen AG +# Copyright (c) 2022,2024 Fraunhofer-Gesellschaft zur Foerderung der angewandten Forschung e.V. (represented by Fraunhofer ISST) +# Copyright (c) 2022,2024 Contributors to the Eclipse Foundation +# +# See the NOTICE file(s) distributed with this work for additional +# information regarding copyright ownership. +# +# This program and the accompanying materials are made available under the +# terms of the Apache License, Version 2.0 which is available at +# https://www.apache.org/licenses/LICENSE-2.0. +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. +# +# SPDX-License-Identifier: Apache-2.0 +# + apiVersion: v1 kind: Service metadata: diff --git a/charts/puris/templates/frontend-serviceaccount.yaml b/charts/puris/templates/frontend-serviceaccount.yaml index 67250f5f..9ff8135f 100644 --- a/charts/puris/templates/frontend-serviceaccount.yaml +++ b/charts/puris/templates/frontend-serviceaccount.yaml @@ -1,3 +1,24 @@ +{{- /* +* Copyright (c) 2022,2024 Volkswagen AG +* Copyright (c) 2022,2024 Fraunhofer-Gesellschaft zur Foerderung der angewandten Forschung e.V. (represented by Fraunhofer ISST) +* Copyright (c) 2022,2024 Contributors to the Eclipse Foundation +* +* See the NOTICE file(s) distributed with this work for additional +* information regarding copyright ownership. +* +* This program and the accompanying materials are made available under the +* terms of the Apache License, Version 2.0 which is available at +* https://www.apache.org/licenses/LICENSE-2.0. +* +* Unless required by applicable law or agreed to in writing, software +* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +* License for the specific language governing permissions and limitations +* under the License. +* +* SPDX-License-Identifier: Apache-2.0 +*/}} + {{- if .Values.frontend.serviceAccount.create -}} apiVersion: v1 kind: ServiceAccount diff --git a/charts/puris/values.yaml b/charts/puris/values.yaml index 7a28db6e..4622e4d9 100644 --- a/charts/puris/values.yaml +++ b/charts/puris/values.yaml @@ -21,442 +21,433 @@ # GlOBAL ----------- global: - domain: - backend: - ingress: &domain your-backend-host-address.com + domain: + backend: + ingress: &domain your-backend-host-address.com # FRONTEND ----------- frontend: - replicaCount: 1 - - image: - # -- Repository of the docker image - repository: tractusx/app-puris-frontend - # -- THe policy for the image pull process - pullPolicy: Always - # -- Overrides the image tag whose default is the chart appVersion. - tag: "" - - # -- List of used secrets - imagePullSecrets: [ ] - # -- Possibility to override the name - nameOverride: "" - # -- Possibility to override the fullname - fullnameOverride: "frontend" - - serviceAccount: - # -- Specifies whether a service account should be created - create: true - # -- Annotations to add to the service account - annotations: { } - # -- The name of the service account to use. If not set and create is true, a name is generated using the fullname template - name: "" - - # -- Annotations added to a running pod - podAnnotations: { } - - # -- Added security contexts for a pod - podSecurityContext: { } - # fsGroup: 2000 - - # Following Catena-X Helm Best Practices @url: https://eclipse-tractusx.github.io/docs/release/trg-5/trg-5-01/ - # @url: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod - # -- Security configurations - securityContext: - # -- Get more privileges than the parent process - allowPrivilegeEscalation: false - # -- Configures the non-root privileges for a run - runAsNonRoot: true - # -- Configures the user id for a run - runAsUser: 10001 - # -- Configures the group id of a user for a run - runAsGroup: 3000 - - service: - # -- Type of the service - type: ClusterIP - # -- The port of the service - port: 8080 - - ingress: - # -- Enable the Ingress - enabled: false - # -- Class name for the Ingress controller - className: "nginx" - # -- Annotations for the Ingress controller - annotations: { } - # -- Hosts for the Ingress controller + replicaCount: 1 + + image: + # -- Repository of the docker image + repository: tractusx/app-puris-frontend + # -- THe policy for the image pull process + pullPolicy: Always + # -- Overrides the image tag whose default is the chart appVersion. + tag: "" + + # -- List of used secrets + imagePullSecrets: [] + # -- Possibility to override the name + nameOverride: "" + # -- Possibility to override the fullname + fullnameOverride: "frontend" + + serviceAccount: + # -- Specifies whether a service account should be created + create: true + # -- Annotations to add to the service account + annotations: {} + # -- The name of the service account to use. If not set and create is true, a name is generated using the fullname template + name: "" + + # -- Annotations added to a running pod + podAnnotations: {} + + # -- Added security contexts for a pod + podSecurityContext: {} + # fsGroup: 2000 + + # -- Security configurations + securityContext: + # -- Get more privileges than the parent process + allowPrivilegeEscalation: false + # -- Configures the non-root privileges for a run + runAsNonRoot: true + # -- Configures the user id for a run + runAsUser: 10001 + # -- Configures the group id of a user for a run + runAsGroup: 3000 + + service: + # -- Type of the service + type: ClusterIP + # -- The port of the service + port: 8080 + + ingress: + # -- Enable the Ingress + enabled: false + # -- Class name for the Ingress controller + className: "nginx" + # -- Annotations for the Ingress controller + annotations: {} + # -- Hosts for the Ingress controller + hosts: + - host: "your-frontend-host-address.com" + paths: + - path: / + pathType: ImplementationSpecific + # -- TLS certificates for the Ingress controller + tls: + - secretName: tls-secret hosts: - - host: "your-frontend-host-address.com" - paths: - - path: / - pathType: ImplementationSpecific - # -- TLS certificates for the Ingress controller - tls: - - secretName: tls-secret - hosts: - - your-frontend-host-address.com - - # Following Catena-X Helm Best Practices @url: https://eclipse-tractusx.github.io/docs/release/trg-5/trg-5-01/ - # @url: https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits - resources: - # -- Maximum resource limits of CPU und memory - limits: - cpu: 600m - memory: 128Mi - # -- Minimum requested resources for CPU und memory - requests: - cpu: 200m - memory: 128Mi - - autoscaling: - # -- Enable or disable the autoscaling of pods - enabled: false - # -- Number of minimum replica pods for autoscaling - minReplicas: 1 - # -- Number of maximum replica pods for autoscaling - maxReplicas: 100 - # -- Value of CPU usage in percentage for autoscaling decisions - targetCPUUtilizationPercentage: 80 - # targetMemoryUtilizationPercentage: 80 - - # -- Constrains for the node selector - nodeSelector: { } - - # -- Constrains for tolerations - tolerations: [ ] - - # Following Catena-X Helm Best Practices @url: https://eclipse-tractusx.github.io/docs/release/trg-5/trg-5-01/ - # @url: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity - affinity: - podAntiAffinity: - # -- Rules for the scheduler to find a pod - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 100 - podAffinityTerm: - labelSelector: - # -- Matching Expressions as key and operators for the pod affinity - matchExpressions: - - key: app.kubernetes.io/name - operator: DoesNotExist - # -- Topology key of the Kubernetes cluster - topologyKey: kubernetes.io/hostname - - # Following Catena-X Helm Best Practices @url: https://eclipse-tractusx.github.io/docs/release/trg-5/trg-5-01/ - # @url: https://github.com/helm/charts/blob/master/stable/nginx-ingress/values.yaml#L210 - # -- Checks whether a pod is alive or not - livenessProbe: - # -- Number of failures (threshold) for a liveness probe - failureThreshold: 3 - # -- Delay in seconds after which an initial liveness probe is checked - initialDelaySeconds: 10 - # -- Wait time in seconds between liveness probes - periodSeconds: 10 - # -- Number of trys until a pod is marked alive - successThreshold: 1 - # -- Timeout in seconds of the liveness probe - timeoutSeconds: 1 - # -- Checks if the pod is fully ready to operate - readinessProbe: - # -- Number of failures (threshold) for a readiness probe - failureThreshold: 3 - # -- Delay in seconds after which an initial readiness probe is checked - initialDelaySeconds: 10 - # -- Wait time in seconds between readiness probes - periodSeconds: 10 - # -- Number of trys until a pod is marked ready - successThreshold: 1 - # -- Timeout in seconds of the readiness probe - timeoutSeconds: 1 - - puris: - # -- The name of the app displayed in the frontend - appName: PURIS - # -- The base URL for the backend base URL without further endpoints - baseUrl: *domain - # -- The endpoint for materials for the stock view - endpointMaterials: stockView/materials - # -- The endpoint for products for the stock view - endpointProducts: stockView/products - # -- The endpoint for material stocks for the stock view - endpointMaterialStocks: stockView/material-stocks - # -- The endpoint for product stocks for the stock view - endpointProductStocks: stockView/product-stocks - # -- The endpoint for the customers who buy a material identified via the own material number for the stock view - endpointCustomer: stockView/customer?ownMaterialNumber= - # -- The endpoint for the suppliers who buy a material identified via the own material number for the stock view - endpointSupplier: stockView/supplier?ownMaterialNumber= - # -- The endpoint for the partners' (supplier) material stocks that they potentially will deliver to me - endpointReportedMaterialStocks: stockView/reported-material-stocks?ownMaterialNumber= - # -- The endpoint for the partners' (customer) product stocks that they received from me - endpointReportedProductStocks: stockView/reported-product-stocks?ownMaterialNumber= - # -- The endpoint for triggering an update of your material stocks on your partners side - endpointUpdateReportedMaterialStocks: stockView/update-reported-material-stocks?ownMaterialNumber= - # -- The endpoint for triggering an update of your product stocks on your partners side - endpointUpdateReportedProductStocks: stockView/update-reported-product-stocks?ownMaterialNumber= - # -- The endpoint for the partners BPNS - endpointPartnerOwnSites: partners/ownSites - keycloak: - # -- Disable the Keycloak integration. - disabled: true - # -- The URL to the IDP that should be used. - url: "https://idp.com/auth" - # -- Name of the Realm of the keycloak instance. - realm: "Catena-X" - # -- Name of the client which is used for the application. - clientId: "appXYZ" - # -- URL to use as keycloak redirect url. - redirectUrlFrontend: "https://your-frontend-url.com" + - your-frontend-host-address.com + + resources: + # -- Maximum resource limits of CPU und memory + limits: + cpu: 600m + memory: 128Mi + # -- Minimum requested resources for CPU und memory + requests: + cpu: 200m + memory: 128Mi + + autoscaling: + # -- Enable or disable the autoscaling of pods + enabled: false + # -- Number of minimum replica pods for autoscaling + minReplicas: 1 + # -- Number of maximum replica pods for autoscaling + maxReplicas: 100 + # -- Value of CPU usage in percentage for autoscaling decisions + targetCPUUtilizationPercentage: 80 + # targetMemoryUtilizationPercentage: 80 + + # -- Constrains for the node selector + nodeSelector: {} + + # -- Constrains for tolerations + tolerations: [] + + affinity: + podAntiAffinity: + # -- Rules for the scheduler to find a pod + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 100 + podAffinityTerm: + labelSelector: + # -- Matching Expressions as key and operators for the pod affinity + matchExpressions: + - key: app.kubernetes.io/name + operator: DoesNotExist + # -- Topology key of the Kubernetes cluster + topologyKey: kubernetes.io/hostname + + # -- Checks whether a pod is alive or not + livenessProbe: + # -- Number of failures (threshold) for a liveness probe + failureThreshold: 3 + # -- Delay in seconds after which an initial liveness probe is checked + initialDelaySeconds: 10 + # -- Wait time in seconds between liveness probes + periodSeconds: 10 + # -- Number of trys until a pod is marked alive + successThreshold: 1 + # -- Timeout in seconds of the liveness probe + timeoutSeconds: 1 + # -- Checks if the pod is fully ready to operate + readinessProbe: + # -- Number of failures (threshold) for a readiness probe + failureThreshold: 3 + # -- Delay in seconds after which an initial readiness probe is checked + initialDelaySeconds: 10 + # -- Wait time in seconds between readiness probes + periodSeconds: 10 + # -- Number of trys until a pod is marked ready + successThreshold: 1 + # -- Timeout in seconds of the readiness probe + timeoutSeconds: 1 + + puris: + # -- The name of the app displayed in the frontend + appName: PURIS + # -- The base URL for the backend base URL without further endpoints + baseUrl: *domain + # -- The endpoint for materials for the stock view + endpointMaterials: stockView/materials + # -- The endpoint for products for the stock view + endpointProducts: stockView/products + # -- The endpoint for material stocks for the stock view + endpointMaterialStocks: stockView/material-stocks + # -- The endpoint for product stocks for the stock view + endpointProductStocks: stockView/product-stocks + # -- The endpoint for the customers who buy a material identified via the own material number for the stock view + endpointCustomer: stockView/customer?ownMaterialNumber= + # -- The endpoint for the suppliers who buy a material identified via the own material number for the stock view + endpointSupplier: stockView/supplier?ownMaterialNumber= + # -- The endpoint for the partners' (supplier) material stocks that they potentially will deliver to me + endpointReportedMaterialStocks: stockView/reported-material-stocks?ownMaterialNumber= + # -- The endpoint for the partners' (customer) product stocks that they received from me + endpointReportedProductStocks: stockView/reported-product-stocks?ownMaterialNumber= + # -- The endpoint for triggering an update of your material stocks on your partners side + endpointUpdateReportedMaterialStocks: stockView/update-reported-material-stocks?ownMaterialNumber= + # -- The endpoint for triggering an update of your product stocks on your partners side + endpointUpdateReportedProductStocks: stockView/update-reported-product-stocks?ownMaterialNumber= + # -- The endpoint for the partners BPNS + endpointPartnerOwnSites: partners/ownSites + keycloak: + # -- Disable the Keycloak integration. + disabled: true + # -- The URL to the IDP that should be used. + url: "https://idp.com/auth" + # -- Name of the Realm of the keycloak instance. + realm: "Catena-X" + # -- Name of the client which is used for the application. + clientId: "appXYZ" + # -- URL to use as keycloak redirect url. + redirectUrlFrontend: "https://your-frontend-url.com" + rateLimiting: + # -- Bucket zone limit for rate limiting in nginx. + limit: 10m + # -- Burst rate limiting for nginx. + burst: 30 + # -- Allowed rates per second for nginx rate limiting. + rate: 10r/s # BACKEND ----------- backend: - # -- Number of replicas of the Kubernetes deployment - replicaCount: 1 - - image: - # -- Repository of the docker image - repository: tractusx/app-puris-backend - # -- THe policy for the image pull process - pullPolicy: Always - # -- Overrides the image tag whose default is the chart appVersion. - tag: "" - - # -- List of used secrets - imagePullSecrets: [ ] - # -- Possibility to override the name - nameOverride: "" - # -- Possibility to override the fullname - fullnameOverride: backend - - serviceAccount: - # -- Specifies whether a service account should be created - create: true - # -- Annotations to add to the service account - annotations: { } - # -- The name of the service account to use. If not set and create is true, a name is generated using the fullname template - name: "" - - # -- Annotations added to a running pod - podAnnotations: { } - - # -- Added security contexts for a pod - podSecurityContext: { } - # fsGroup: 2000 - - # Following Catena-X Helm Best Practices @url: https://eclipse-tractusx.github.io/docs/release/trg-5/trg-5-01/ - # @url: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod - # -- Security configurations - securityContext: - # -- Get more privileges than the parent process - allowPrivilegeEscalation: false - # -- Configures the non-root privileges for a run - runAsNonRoot: true - # -- Configures the user id for a run - runAsUser: 10001 - # -- Configures the group id of a user for a run - runAsGroup: 3000 - - service: - # -- Type of the service - type: ClusterIP - # -- The port of the service - port: 8081 - - # Following Catena-X Helm Best Practices @url: https://eclipse-tractusx.github.io/docs/release/trg-5/trg-5-01/ - # @url: https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits - resources: - # -- Maximum resource limits of CPU und memory - limits: - cpu: 3000m - memory: 2048Mi - # -- Minimum requested resources for CPU und memory - requests: - cpu: 1000m - memory: 2048Mi - - autoscaling: - # -- Enable or disable the autoscaling of pods - enabled: false - - ingress: - # -- Enable the Ingress - enabled: false - # -- Annotations for the Ingress controller - annotations: - # -- Kubernetes Ingress class annotation for direct bindings - kubernetes.io/ingress.class: nginx - # -- Force redirects from HTTP to HTTPS - nginx.ingress.kubernetes.io/force-ssl-redirect: "true" - # -- Pass SSL traffic to the backend ports - nginx.ingress.kubernetes.io/ssl-passthrough: "true" - # -- The backend protocol type (e.g. HTTP) - nginx.ingress.kubernetes.io/backend-protocol: "HTTP" - # -- Hosts for the Ingress controller + # -- Number of replicas of the Kubernetes deployment + replicaCount: 1 + + image: + # -- Repository of the docker image + repository: tractusx/app-puris-backend + # -- THe policy for the image pull process + pullPolicy: Always + # -- Overrides the image tag whose default is the chart appVersion. + tag: "" + + # -- List of used secrets + imagePullSecrets: [] + # -- Possibility to override the name + nameOverride: "" + # -- Possibility to override the fullname + fullnameOverride: backend + + serviceAccount: + # -- Specifies whether a service account should be created + create: true + # -- Annotations to add to the service account + annotations: {} + # -- The name of the service account to use. If not set and create is true, a name is generated using the fullname template + name: "" + + # -- Annotations added to a running pod + podAnnotations: {} + + # -- Added security contexts for a pod + podSecurityContext: {} + # fsGroup: 2000 + + # -- Security configurations + securityContext: + # -- Get more privileges than the parent process + allowPrivilegeEscalation: false + # -- Configures the non-root privileges for a run + runAsNonRoot: true + # -- Configures the user id for a run + runAsUser: 10001 + # -- Configures the group id of a user for a run + runAsGroup: 3000 + + service: + # -- Type of the service + type: ClusterIP + # -- The port of the service + port: 8081 + + resources: + # -- Maximum resource limits of CPU und memory + limits: + cpu: 3000m + memory: 2048Mi + # -- Minimum requested resources for CPU und memory + requests: + cpu: 1000m + memory: 2048Mi + + autoscaling: + # -- Enable or disable the autoscaling of pods + enabled: false + + ingress: + # -- Enable the Ingress + enabled: false + # -- Annotations for the Ingress controller + annotations: + # -- Kubernetes Ingress class annotation for direct bindings + kubernetes.io/ingress.class: nginx + # -- Force redirects from HTTP to HTTPS + nginx.ingress.kubernetes.io/force-ssl-redirect: "true" + # -- Pass SSL traffic to the backend ports + nginx.ingress.kubernetes.io/ssl-passthrough: "true" + # -- The backend protocol type (e.g. HTTP) + nginx.ingress.kubernetes.io/backend-protocol: "HTTP" + # -- Hosts for the Ingress controller + hosts: + - host: *domain + paths: + - path: / + pathType: ImplementationSpecific + # -- TLS certificates for the Ingress controller + tls: + - secretName: tls-secret hosts: - - host: *domain - paths: - - path: / - pathType: ImplementationSpecific - # -- TLS certificates for the Ingress controller - tls: - - secretName: tls-secret - hosts: - - *domain - - # -- Constrains for the node selector - nodeSelector: { } - - # -- Constrains for tolerations - tolerations: [ ] - - # Following Catena-X Helm Best Practices @url: https://eclipse-tractusx.github.io/docs/release/trg-5/trg-5-01/ - # @url: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity - affinity: - podAntiAffinity: - # -- Rules for the scheduler to find a pod - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 100 - podAffinityTerm: - labelSelector: - # -- Matching Expressions as key and operators for the pod affinity - matchExpressions: - - key: app.kubernetes.io/name - operator: DoesNotExist - # -- Topology key of the Kubernetes cluster - topologyKey: kubernetes.io/hostname - - # Following Catena-X Helm Best Practices @url: https://eclipse-tractusx.github.io/docs/release/trg-5/trg-5-01/ - # @url: https://github.com/helm/charts/blob/master/stable/nginx-ingress/values.yaml#L210 - # -- Checks whether a pod is alive or not - livenessProbe: - # -- Number of failures (threshold) for a liveness probe - failureThreshold: 3 - # -- Delay in seconds after which an initial liveness probe is checked - initialDelaySeconds: 250 - # -- Wait time in seconds between liveness probes - periodSeconds: 25 - # -- Number of trys until a pod is marked alive - successThreshold: 1 - # -- Timeout in seconds of the liveness probe - timeoutSeconds: 1 - # -- Checks if the pod is fully ready to operate - readinessProbe: - # -- Number of failures (threshold) for a readiness probe - failureThreshold: 3 - # -- Delay in seconds after which an initial readiness probe is checked - initialDelaySeconds: 250 - # -- Wait time in seconds between readiness probes - periodSeconds: 25 - # -- Number of trys until a pod is marked ready - successThreshold: 1 - # -- Timeout in seconds of the readiness probe - timeoutSeconds: 1 - - puris: - api: - # -- The API key of the PURIS application - key: "test" - # -- The root directory of the API - rootDir: /catena - datasource: - # -- Driver class name of the database - driverClassName: org.postgresql.Driver - # -- URL of the database. Ignored if postgres.enabled is true. - url: jdbc:postgresql://postgresql-name:5432/puris-database - # -- Username of the database. Ignored if postgres.enabled is true. - username: db-user - # -- Password for the database user. Ignored if postgres.enabled is true. - password: - edc: - controlplane: - host: "172.17.0.2" - management: - # -- Url to the EDC controlplane management of the edc - url: "https:/your-edc-address:8181/management" - protocol: - # -- Url to the EDC controlplane protocol API of the edc - url: "https://your-edc-address:8184/api/v1/dsp" - # -- Key for the EDC control plane - key: "password" - web: - rest: - cors: - enabled: true - own: - # -- Own BPNL of the EDC - bpnl: BPNL4444444444XX - # -- Own BPNA of the EDC - bpna: BPNA4444444444ZZ - # -- Own BPNS of the EDC - bpns: BPNS4444444444XX - # -- Own country - country: "Germany" - site: - # -- Own site name - name: "puris-test" - # -- Own street and number - streetnumber: "Musterstraße 110A" - # -- Own zipcode and city - zipcodeandcity: "12345 Musterhausen" - # -- Own name (self-description) - name: "YOUR-APPLICATION-NAME" - demonstrator: - # -- Current role of the PURIS demonstrator. Default value should be empty. - # Can be set to "customer" or "supplier" to enable demonstration setup - role: - jpa: - hibernate: - # -- Initialises SQL database with Hibernate property "create" to allow Hibernate to first drop all tables and then create new ones - ddl-auto: create - properties: - hibernate: - # -- Enables "Lazy load no trans" property to fetch of each lazy entity to open a temporary session and run inside a separate transaction - enable_lazy_load_no_trans: true - request: - # -- Endpoint of server for request - serverendpoint: *domain - # -- Asset ID for request API - apiassetid: request-api-asset - response: - # -- Endpoint of server for response - serverendpoint: *domain - # -- Asset ID for response API - apiassetid: response-api-asset - statusrequest: - # -- Endpoint of server for statusrequest - serverendpoint: *domain - # -- Asset ID for status-request API - apiassetid: statusrequest-api-asset - frameworkagreement: - # -- Flag to determine whether to use a framework agreement in puris - use: false - # -- The name of the framework agreement - credential : FrameworkAgreement.traceability - edr: - # -- Number of minutes before received authentication data of a consumer pull is removed from memory - deletiontimer: 2 - # -- Endpoint for EDR - endpoint: *domain - dtr: - # --Endpoint for DTR - url: http://localhost:4243 - generatematerialcatenaxid: true + - *domain + + # -- Constrains for the node selector + nodeSelector: {} + + # -- Constrains for tolerations + tolerations: [] + + affinity: + podAntiAffinity: + # -- Rules for the scheduler to find a pod + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 100 + podAffinityTerm: + labelSelector: + # -- Matching Expressions as key and operators for the pod affinity + matchExpressions: + - key: app.kubernetes.io/name + operator: DoesNotExist + # -- Topology key of the Kubernetes cluster + topologyKey: kubernetes.io/hostname + + # -- Checks whether a pod is alive or not + livenessProbe: + # -- Number of failures (threshold) for a liveness probe + failureThreshold: 3 + # -- Delay in seconds after which an initial liveness probe is checked + initialDelaySeconds: 250 + # -- Wait time in seconds between liveness probes + periodSeconds: 25 + # -- Number of trys until a pod is marked alive + successThreshold: 1 + # -- Timeout in seconds of the liveness probe + timeoutSeconds: 1 + # -- Checks if the pod is fully ready to operate + readinessProbe: + # -- Number of failures (threshold) for a readiness probe + failureThreshold: 3 + # -- Delay in seconds after which an initial readiness probe is checked + initialDelaySeconds: 250 + # -- Wait time in seconds between readiness probes + periodSeconds: 25 + # -- Number of trys until a pod is marked ready + successThreshold: 1 + # -- Timeout in seconds of the readiness probe + timeoutSeconds: 1 + + puris: + api: + # -- The API key of the PURIS application + key: "test" + # -- The root directory of the API + rootDir: /catena + datasource: + # -- Driver class name of the database + driverClassName: org.postgresql.Driver + # -- URL of the database. Ignored if postgres.enabled is true. + url: jdbc:postgresql://postgresql-name:5432/puris-database + # -- Username of the database. Ignored if postgres.enabled is true. + username: db-user + # -- Password for the database user. Ignored if postgres.enabled is true. + password: + edc: + controlplane: + host: "172.17.0.2" + management: + # -- Url to the EDC controlplane management of the edc + url: "https:/your-edc-address:8181/management" + protocol: + # -- Url to the EDC controlplane protocol API of the edc + url: "https://your-edc-address:8184/api/v1/dsp" + # -- Key for the EDC control plane + key: "password" + web: + rest: + cors: + enabled: true + own: + # -- Own BPNL of the EDC + bpnl: BPNL4444444444XX + # -- Own BPNA of the EDC + bpna: BPNA4444444444ZZ + # -- Own BPNS of the EDC + bpns: BPNS4444444444XX + # -- Own country + country: "Germany" + site: + # -- Own site name + name: "puris-test" + # -- Own street and number + streetnumber: "Musterstraße 110A" + # -- Own zipcode and city + zipcodeandcity: "12345 Musterhausen" + # -- Own name (self-description) + name: "YOUR-APPLICATION-NAME" + demonstrator: + # -- Current role of the PURIS demonstrator. Default value should be empty. + # Can be set to "customer" or "supplier" to enable demonstration setup + role: + jpa: + hibernate: + # -- Initialises SQL database with Hibernate property "create" to allow Hibernate to first drop all tables and then create new ones + ddl-auto: create + properties: + hibernate: + # -- Enables "Lazy load no trans" property to fetch of each lazy entity to open a temporary session and run inside a separate transaction + enable_lazy_load_no_trans: true + request: + # -- Endpoint of server for request + serverendpoint: *domain + # -- Asset ID for request API + apiassetid: request-api-asset + response: + # -- Endpoint of server for response + serverendpoint: *domain + # -- Asset ID for response API + apiassetid: response-api-asset + statusrequest: + # -- Endpoint of server for statusrequest + serverendpoint: *domain + # -- Asset ID for status-request API + apiassetid: statusrequest-api-asset + frameworkagreement: + # -- Flag to determine whether to use a framework agreement in puris + use: false + # -- The name of the framework agreement + credential: FrameworkAgreement.traceability + edr: + # -- Number of minutes before received authentication data of a consumer pull is removed from memory + deletiontimer: 2 + # -- Endpoint for EDR + endpoint: *domain + dtr: + # --Endpoint for DTR + url: http://localhost:4243 + generatematerialcatenaxid: true postgresql: - # -- Enable postgres by default, set to false to use existing postgres. Make sure to set - # backend.puris.jpa.hibernate.ddl-auto accordingly (by default database is created using hibernate ddl from - # backend). - enabled: true - # -- Possibility to override the fullname - fullnameOverride: "backend-postgresql" - service: - ports: - # -- Port of postgres database. - postgresql: 5432 - auth: - # -- Name of the database. - database: "postgres" - # -- Username for the database. - username: "puris" - # -- Password for the database. - password: "password" + # -- Enable postgres by default, set to false to use existing postgres. Make sure to set + # backend.puris.jpa.hibernate.ddl-auto accordingly (by default database is created using hibernate ddl from + # backend). + enabled: true + # -- Possibility to override the fullname + fullnameOverride: "backend-postgresql" + service: + ports: + # -- Port of postgres database. + postgresql: 5432 + auth: + # -- Name of the database. + database: "postgres" + # -- Username for the database. + username: "puris" + # -- Password for the database. + password: "password" diff --git a/docs/adminGuide/Admin_Guide.md b/docs/adminGuide/Admin_Guide.md index e25e893f..5f3a3b7e 100644 --- a/docs/adminGuide/Admin_Guide.md +++ b/docs/adminGuide/Admin_Guide.md @@ -94,6 +94,16 @@ Thus, it may seem that the Credential is available, but isn't. Same applies to t _Note: Please refer to the [Portal's documentation on how to sign use case agreements](https://github.com/eclipse-tractusx/portal-assets/blob/main/docs/user/06.%20Certificates/01.%20UseCase%20Participation.md)._ +## Rate Limiting using nginx + +Rate limiting is by default enabled in the puris frontend served by nginx and can be dynamically configured. +In order to adjust any variables of nginx's rate limiting or disable it, one has to modify the respective variables in either the +local docker deployment by setting the necessary environment variables, or by modifying the variables in the helm chart values.yaml. + +These variables then get dynamically injected in the nginx.conf file, which is then copied to the docker image to be used by nginx. +That means that the rate limiting can be disabled by modifying the nginx.conf file in the frontend folder. This is also the place +to insert and override any other nginx configurations. + ## Serving with HTTPS / SSL Serving with SSL is available for Docker and Helm Deployment. In local deployment directly with mvn (backend) and diff --git a/docs/security-assessment.md b/docs/security-assessment.md new file mode 100644 index 00000000..7910d531 --- /dev/null +++ b/docs/security-assessment.md @@ -0,0 +1,163 @@ +# Security Assessment PURIS (incl. Frontend, Backend Services, IAM and other infrastructure) + +| Contact | Details | +| ------------------------- | ---------------------------------------------------------------------------------------------- | +| Contact for product | [@tom-rm-meyer-ISST](https://github.com/tom-rm-meyer-ISST) | +| Security responsible | [@SSIRKC](https://github.com/SSIRKC)
[@szymonkowalczykzf](https://github.com/szymonkowalczykzf) | +| Version number of product | 23.12 | +| Dates of assessment | 2023-12-11: Assessment | +| Dates of last re-assessment| 2024-02-16: Re-Assessment | +| Status of assessment | RE-ASSESSMENT DONE | + +## Product Description +Application Security review provides information about application design, architecture and current security state. +The Predictive Unit Real-Time Information System (PURIS) provides the capabilities to exchange the production related information within a given relationship between two business partners such as the already available stock of the supplier, the current stock of the customer and the customer's demand. The aim is to help to mitigate potential and actual shortage scenarios. + +PURIS is the second of two components of the Demand and Capacity Management as approached by the Resiliency Kit: +* A planning component forecasting its demands and capacities for the next months up to multiple years. +* An operationalization component verifying the demands and capacities of its actual production plan from today up to multiple weeks. + + +Within the Business Domain Resiliency, the Demand and Capacity Management (DCM) represents the planning and the PURIS represents the operationalization component. Considering a shorter time period in PURIS based on the production plan, results in more reliable information. +Generally, the Demand and Capacity Management needs a close cooperation between a company and its partners along the supply chain. +Within the value chain, each partner needs to plan his own production and relies on his customers' demand forecasts. The bullwhip effect describes the rising amplified deviation between orders to suppliers and sales to buyers along the value chain. The fluctuation rises from tier to tier. Using the latest production related information, you can mitigate the bullwhip effect for you and your partners within the value chain. + +As a customer, you can verify the production related information of your partner so that you can identify potential shortages earlier with less effort and mitigate or resolve them spending less resources. +As a supplier, you can increase your production efficiency, e.g. by optimizing your batch size based on your customers' latest demands. + +Currently the PURIS Application have 1 main functionality: +* Customers can View and Manage Stocks in the app. +* Additionally, adminsitrative views for the edc are in place. Also functionality related to the fully functional Customer dashboard is currently under creation. +* The rest of the functionalities, especially the resiliency ones are currently not yet implemented and only planned for the further development & implementation for upcoming future. + +## Scope of the review +|ID | Component Description | +| ------------------------- | ------------------------- | +|1 | Vue User Interface (Frontend) | +|2 | Stock View Controller | +|3 | H2 Database | +|4 | Data Response Controller | +|5 | Data Request Controller | + +## Dataflow Diagram + +```mermaid +flowchart TD + A(Customer \n Human User) + A2(Puris Endpoint App \n Data Provider \n Out of Scope) + A3(EDC \n Eclipse Data Space Components Connector \n C-X Member \n Out of Scope) + + B(EDC \n ECLIPSE DataSpace Components Connector \n C-X Operator \n Out of Scope) + + C(Vue User Interface) + + D6(Master Data Controller \n Exposed for external system based on API Keys \n Out of scope) + D7(Product Measures Visualization \n Just visualization of the data \n Out of scope - Not yet developped) + + D(Stock View Controller) + D2(EDC View Controller) + D3(Data Request Controller) + D4(Data Response Controller) + D5[(PostgreSQL DB \n Main Database)] + + A-->|Main functionality is possibility to view & manage stocks with Business Partners. \n Enter stock information manually. \n View the Supply Dashboard to check a supply situation between Partner & Customer \n for Partner and Supplier. \n HTTPS Protocol|C + A2-->|Providing Customer data on stocks & supplies \n HTTPS Protocol|A3 + + C-->|Read & Write access|D + C-->|Read access|D2 + + A3-->|View Data \n Negotiate Contracts \n Initialize & Perform Data Transfers \n HTTPS Protocol|B + + D-->|Data Read & Write \n TCP9092|D5 + D3-->|Data Read & Write \n TCP9092|D5 + + D4-->|Data Read & Write \n TCP9092|D5 + + D3-->|Forwarding Data Response \n HTTPS Protocol|B + + B-->|Forwarding Data Requests \n HTTPS Protocol|D3 + B-->|List catalog, negotiations \n and transfers, \n Read Access \n HTTPS Protocol|D2 + + B<-->|Forwarding Data Response \n HTTPS Protocol|D4 + + + subgraph Internet Boundary + A + + subgraph Customer Environment + + A2 + A3 + + end + +end + +subgraph Catena - X Environment + +B + + subgraph PURIS Product + + subgraph PURIS Product - View Frontend + C + end + + subgraph PURIS Product - Java Backend + D6 + D7 + D2 + D3 + D + D5 + D4 + end + + + end + + end +``` + +## Vulnerabilities & Threats +| V001 | Lack of authentication & authorization mechanisms | +| ------------------------- | ------------------------- | +| Element | PURIS IAM Policy | +| Before Mitigation | Impact: High, Likelihood: High, Risk: High | +| After Mitigation | Impact: Low, Likelihood: Low, Risk: Low | +| Mitigation | Authentication & authorization concept implemented. The front-end provides a Key Cloak integration. (C-X Central Identity Provider is in use.) Puris product may be accessed only by authenticated and authorized personnel, it restricts accessible views based on the client roles: PURIS_USER - common views related to short term information needs PURIS_ADMIN - EDC related views (may be used for debugging)| + +| V002 | Lack of User session management controls, including token handling. That pose a security risk, that can lead to unauthorized access and session hijacking. | +| ------------------------- | ------------------------- | +| Element | PURIS Product | +| Before Mitigation | Impact: High, Likelihood: High, Risk: High | +| After Mitigation | Impact: Low, Likelihood: Low, Risk: Low | +| Mitigation | Local implementation of KeyCloak was done. Token renewals are enforced for all Users. Token renewal was setup for 5 minutes. | + +| V003 | Lack of Input Validation mechanisms implemented, that can lead to various security vulnerabilities related to injection attacks. | +| ------------------------- | ------------------------- | +| Element | PURIS Product | +| Before Mitigation | Impact: High, Likelihood: High, Risk: High | +| After Mitigation | Impact: Low, Likelihood: Low, Risk: Low | +| Mitigation | Business Wise Validation was implemented. Input validation on controller level was implemented. Pattern validation on all fields and on entity level was implemented. | + +| V004 | Lack of encryption for data in transit, that may expose sensitive data to the risk of interception and compromise. | +| ------------------------- | ------------------------- | +| Element | PURIS Product | +| Before Mitigation | Impact: High, Likelihood: High, Risk: High | +| After Mitigation | Impact: Low, Likelihood: Low, Risk: Low | +| Mitigation | Product Team currently working on SSL. Team already implemented and enforce HTTPS for the front end of the product. Additionally, the admin guide explains how to serve the backend with spring configuration. It also includes configuration of HTTPS with docker. Guide was created on how to configure HTTPS with docker. There are currently some Cores issues that were detected and are being investigated, probably needs spring reconfiguration. It was fixed. Issues happened cause of self signed certificates. The issue is already solved. SSL was also already integrated to the Product. | + +| V006 | Lack of logging and monitoring solution in place, that can hinder the detection of security incidents, performance issues and operational anomalies. | +| ------------------------- | ------------------------- | +| Element | PURIS Product | +| Before Mitigation | Impact: Low, Likelihood: Medium, Risk: Medium | +| After Mitigation | Impact: Low, Likelihood: Low, Risk: Low | +| Mitigation | Application is already logging every information about : every call to the respective EDC's, actions related to the exchange of data between partners, all authentication & authorization data Logging enchantments were completed. | + +| V008 | Confirmed vulnerabilities with high severity for H2 Database. | +| ------------------------- | ------------------------- | +| Element | Hyper SQL DB (hsqldb) | +| Before Mitigation | Impact: High, Likelihood: Medium, Risk: High | +| After Mitigation | Impact: Low, Likelihood: Low, Risk: Low | +| Mitigation | PostgreSQL DB has been implemented to the product. Status of implementation is already completed. Additionally: We don't include it in compile, but in test scope so that we have easy testing but security when deploying. | diff --git a/frontend/DOCKER_NOTICE.md b/frontend/DOCKER_NOTICE.md new file mode 100644 index 00000000..76b775b4 --- /dev/null +++ b/frontend/DOCKER_NOTICE.md @@ -0,0 +1,20 @@ +This application provides container images for demonstration purposes. + +Eclipse Tractus-X product(s) installed within the image: + +- GitHub: https://github.com/eclipse-tractusx/puris +- Project home: https://projects.eclipse.org/projects/automotive.tractusx +- Dockerfile Frontend: https://github.com/eclipse-tractusx/puris/blob/main/frontend/Dockerfile +- Project license: [Apache License, Version 2.0](https://github.com/eclipse-tractusx/puris/blob/main/frontend/LICENSE) + +**Used Base Image [Frontend]** +`nginxinc/nginx-unprivileged:alpine` + +- DockerHub: https://hub.docker.com/r/nginxinc/nginx-unprivileged +- GitHub project: https://github.com/nginxinc/docker-nginx-unprivileged + +As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc +from the base distribution, along with any direct or indirect dependencies of the primary software being contained). + +As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies +with any relevant licenses for all software contained within. diff --git a/frontend/Dockerfile b/frontend/Dockerfile index 823dcd57..c90c874d 100644 --- a/frontend/Dockerfile +++ b/frontend/Dockerfile @@ -1,7 +1,7 @@ # -# Copyright (c) 2022,2023 Volkswagen AG -# Copyright (c) 2022,2023 Fraunhofer-Gesellschaft zur Foerderung der angewandten Forschung e.V. (represented by Fraunhofer ISST) -# Copyright (c) 2022,2023 Contributors to the Eclipse Foundation +# Copyright (c) 2022,2024 Volkswagen AG +# Copyright (c) 2022,2024 Fraunhofer-Gesellschaft zur Foerderung der angewandten Forschung e.V. (represented by Fraunhofer ISST) +# Copyright (c) 2022,2024 Contributors to the Eclipse Foundation # # See the NOTICE file(s) distributed with this work for additional # information regarding copyright ownership. @@ -23,9 +23,6 @@ FROM node:lts-alpine as build ARG NPM_BUILD_MODE=dockerbuild ENV JQ_VERSION=1.6 -# TODO curl results in problem with node during ```npm run ${NPM_BUILD_MODE}``` -#RUN apk --no-cache add curl -#RUN curl https://github.com/stedolan/jq/releases/download/jq-${JQ_VERSION}/jq-linux64 -o /tmp/jq-linux64 RUN wget --no-check-certificate https://github.com/stedolan/jq/releases/download/jq-${JQ_VERSION}/jq-linux64 -O /tmp/jq-linux64 RUN cp /tmp/jq-linux64 /usr/bin/jq RUN chmod +x /usr/bin/jq @@ -47,7 +44,7 @@ COPY NOTICE.md /app/dist/NOTICE.md COPY DEPENDENCIES /app/dist/DEPENDENCIES # uses 101 restricted user -FROM nginxinc/nginx-unprivileged:stable-alpine +FROM nginxinc/nginx-unprivileged:alpine #FROM nginx:stable-alpine # commly it would be .../html/js/.*js, but due to the project structure the JS files are in .../html/assets @@ -56,12 +53,15 @@ ENV JSFOLDER=/usr/share/nginx/html/assets/*.js # use root user to install moreutils for sponge in start-nginx to substring env workaround USER root +COPY ./nginx.conf /etc/nginx/nginx.conf +RUN chmod 777 /etc/nginx/nginx.conf COPY ./start-nginx.sh /usr/bin/start-nginx.sh -RUN apk --no-cache add moreutils # use non-root user USER 101 +HEALTHCHECK --interval=30s --timeout=3s CMD wget -O /dev/null http://localhost:8080 || exit 1 + WORKDIR /usr/share/nginx/html COPY --from=build /app/dist . ENTRYPOINT [ "start-nginx.sh" ] diff --git a/frontend/README.md b/frontend/README.md index 5bcbe97b..2ca46227 100644 --- a/frontend/README.md +++ b/frontend/README.md @@ -4,12 +4,13 @@ ## Table of Contents + - [Prerequirements](#prerequirements) - [Getting Started](#getting-started) - [License](#license) - ## Prerequirements + The following things are needed to start PURIS: - `npm` or an equivalent Docker setup @@ -20,24 +21,12 @@ The following things are needed to start PURIS: See the [installation instructions](INSTALL.md) for information on how to start the application. ## License + The project is licensed under the [Apache License Version 2.0](https://www.apache.org/licenses/LICENSE-2.0). For details on the licensing terms, see the `LICENSE` file. ## Notice for Docker Image -This application provides container images for demonstration purposes. - -Eclipse Tractus-X product(s) installed within the image: - -- GitHub: https://github.com/eclipse-tractusx/puris -- Project home: https://projects.eclipse.org/projects/automotive.tractusx -- Dockerfile Frontend: https://github.com/eclipse-tractusx/puris/blob/main/frontend/Dockerfile -- Project license: [Apache License, Version 2.0](https://github.com/eclipse-tractusx/puris/blob/main/frontend/LICENSE) - -**Used Base Image [Frontend]** -- `node:lts-alpine` -- DockerHub: https://hub.docker.com/_/node/ -- GitHub project: https://github.com/nodejs/docker-node -As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained). +Below you can find the information regarding Docker Notice for this frontend. -As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within. +[Frontend](./DOCKER_NOTICE.md) diff --git a/frontend/nginx.conf b/frontend/nginx.conf new file mode 100755 index 00000000..586abca8 --- /dev/null +++ b/frontend/nginx.conf @@ -0,0 +1,46 @@ +worker_processes auto; + +error_log /var/log/nginx/error.log notice; +pid /tmp/nginx.pid; + +events { + worker_connections 1024; +} + +http { + proxy_temp_path /tmp/proxy_temp; + client_body_temp_path /tmp/client_temp; + fastcgi_temp_path /tmp/fastcgi_temp; + uwsgi_temp_path /tmp/uwsgi_temp; + scgi_temp_path /tmp/scgi_temp; + + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + access_log /var/log/nginx/access.log main; + + sendfile on; + #tcp_nopush on; + + keepalive_timeout 65; + + #gzip on; + + limit_req_zone $binary_remote_addr zone=zoneLimit:${NGINX_RATE_LIMIT} rate=${NGINX_RATE}; + limit_req_status 503; + + server { + listen 8080; + server_name localhost; + + location / { + limit_req zone=zoneLimit burst=${NGINX_BURST} nodelay; + root /usr/share/nginx/html; + index index.html index.htm; + } + } +} diff --git a/frontend/postcss.config.js b/frontend/postcss.config.js index 33ad091d..27f698d3 100644 --- a/frontend/postcss.config.js +++ b/frontend/postcss.config.js @@ -1,6 +1,28 @@ +/* + * Copyright (c) 2022,2024 Volkswagen AG + * Copyright (c) 2022,2024 Fraunhofer-Gesellschaft zur Foerderung der angewandten Forschung e.V. (represented by Fraunhofer ISST) + * Copyright (c) 2022,2024 Contributors to the Eclipse Foundation + * + * See the NOTICE file(s) distributed with this work for additional + * information regarding copyright ownership. + * + * This program and the accompanying materials are made available under the + * terms of the Apache License, Version 2.0 which is available at + * https://www.apache.org/licenses/LICENSE-2.0. + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + * + * SPDX-License-Identifier: Apache-2.0 + */ + module.exports = { - plugins: { - tailwindcss: {}, - autoprefixer: {}, - }, + plugins: { + tailwindcss: {}, + autoprefixer: {}, + }, } + diff --git a/frontend/src/assets/base.css b/frontend/src/assets/base.css index 221ee740..8b068197 100644 --- a/frontend/src/assets/base.css +++ b/frontend/src/assets/base.css @@ -1,92 +1,113 @@ +/* + * Copyright (c) 2022,2024 Volkswagen AG + * Copyright (c) 2022,2024 Fraunhofer-Gesellschaft zur Foerderung der angewandten Forschung e.V. (represented by Fraunhofer ISST) + * Copyright (c) 2022,2024 Contributors to the Eclipse Foundation + * + * See the NOTICE file(s) distributed with this work for additional + * information regarding copyright ownership. + * + * This program and the accompanying materials are made available under the + * terms of the Apache License, Version 2.0 which is available at + * https://www.apache.org/licenses/LICENSE-2.0. + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + * + * SPDX-License-Identifier: Apache-2.0 + */ + @tailwind base; @tailwind components; @tailwind utilities; /* color palette from */ :root { - --vt-c-white: #ffffff; - --vt-c-white-soft: #f8f8f8; - --vt-c-white-mute: #f2f2f2; + --vt-c-white: #ffffff; + --vt-c-white-soft: #f8f8f8; + --vt-c-white-mute: #f2f2f2; - --vt-c-black: #181818; - --vt-c-black-soft: #222222; - --vt-c-black-mute: #282828; + --vt-c-black: #181818; + --vt-c-black-soft: #222222; + --vt-c-black-mute: #282828; - --vt-c-indigo: #2c3e50; + --vt-c-indigo: #2c3e50; - --vt-c-divider-light-1: rgba(60, 60, 60, 0.29); - --vt-c-divider-light-2: rgba(60, 60, 60, 0.12); - --vt-c-divider-dark-1: rgba(84, 84, 84, 0.65); - --vt-c-divider-dark-2: rgba(84, 84, 84, 0.48); + --vt-c-divider-light-1: rgba(60, 60, 60, 0.29); + --vt-c-divider-light-2: rgba(60, 60, 60, 0.12); + --vt-c-divider-dark-1: rgba(84, 84, 84, 0.65); + --vt-c-divider-dark-2: rgba(84, 84, 84, 0.48); - --vt-c-text-light-1: var(--vt-c-indigo); - --vt-c-text-light-2: rgba(60, 60, 60, 0.66); - --vt-c-text-dark-1: var(--vt-c-white); - --vt-c-text-dark-2: rgba(235, 235, 235, 0.64); + --vt-c-text-light-1: var(--vt-c-indigo); + --vt-c-text-light-2: rgba(60, 60, 60, 0.66); + --vt-c-text-dark-1: var(--vt-c-white); + --vt-c-text-dark-2: rgba(235, 235, 235, 0.64); } /* semantic color variables for this project */ :root { - --color-background: var(--vt-c-white); - --color-background-soft: var(--vt-c-white-soft); - --color-background-mute: var(--vt-c-white-mute); + --color-background: var(--vt-c-white); + --color-background-soft: var(--vt-c-white-soft); + --color-background-mute: var(--vt-c-white-mute); - --color-border: var(--vt-c-divider-light-2); - --color-border-hover: var(--vt-c-divider-light-1); + --color-border: var(--vt-c-divider-light-2); + --color-border-hover: var(--vt-c-divider-light-1); - --color-heading: var(--vt-c-text-light-1); - --color-text: var(--vt-c-text-light-1); + --color-heading: var(--vt-c-text-light-1); + --color-text: var(--vt-c-text-light-1); - --section-gap: 160px; + --section-gap: 160px; } @media (prefers-color-scheme: dark) { - :root { - --color-background: var(--vt-c-black); - --color-background-soft: var(--vt-c-black-soft); - --color-background-mute: var(--vt-c-black-mute); + :root { + --color-background: var(--vt-c-black); + --color-background-soft: var(--vt-c-black-soft); + --color-background-mute: var(--vt-c-black-mute); - --color-border: var(--vt-c-divider-dark-2); - --color-border-hover: var(--vt-c-divider-dark-1); + --color-border: var(--vt-c-divider-dark-2); + --color-border-hover: var(--vt-c-divider-dark-1); - --color-heading: var(--vt-c-text-dark-1); - --color-text: var(--vt-c-text-dark-2); - } + --color-heading: var(--vt-c-text-dark-1); + --color-text: var(--vt-c-text-dark-2); + } } *, *::before, *::after { - box-sizing: border-box; - margin: 0; - position: relative; - font-weight: normal; + box-sizing: border-box; + margin: 0; + position: relative; + font-weight: normal; } body { - min-height: 100vh; - color: var(--color-text); - background: var(--color-background); - transition: color 0.5s, background-color 0.5s; - line-height: 1.6; - font-family: Inter, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, - Cantarell, 'Fira Sans', 'Droid Sans', 'Helvetica Neue', sans-serif; - font-size: 15px; - text-rendering: optimizeLegibility; - -webkit-font-smoothing: antialiased; - -moz-osx-font-smoothing: grayscale; + min-height: 100vh; + color: var(--color-text); + background: var(--color-background); + transition: color 0.5s, background-color 0.5s; + line-height: 1.6; + font-family: Inter, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, + Cantarell, 'Fira Sans', 'Droid Sans', 'Helvetica Neue', sans-serif; + font-size: 15px; + text-rendering: optimizeLegibility; + -webkit-font-smoothing: antialiased; + -moz-osx-font-smoothing: grayscale; } th { - background-color: lightslategray; + background-color: lightslategray; } th, td { - padding: 5px; + padding: 5px; } tr:nth-child(odd) { - background-color: lightgray; + background-color: lightgray; } input:disabled, select:disabled { @@ -94,10 +115,11 @@ input:disabled, select:disabled { } @layer components { - .btn-primary { - @apply my-2 bg-blue-500 text-white font-bold py-2 px-4 rounded hover:bg-blue-700; - } - .btn-primary:disabled{ - opacity: 0.6; - } + .btn-primary { + @apply my-2 bg-blue-500 text-white font-bold py-2 px-4 rounded hover:bg-blue-700; + } + + .btn-primary:disabled { + opacity: 0.6; + } } diff --git a/frontend/src/index.css b/frontend/src/index.css index bd6213e1..572cc63c 100644 --- a/frontend/src/index.css +++ b/frontend/src/index.css @@ -1,3 +1,24 @@ +/* + * Copyright (c) 2022,2024 Volkswagen AG + * Copyright (c) 2022,2024 Fraunhofer-Gesellschaft zur Foerderung der angewandten Forschung e.V. (represented by Fraunhofer ISST) + * Copyright (c) 2022,2024 Contributors to the Eclipse Foundation + * + * See the NOTICE file(s) distributed with this work for additional + * information regarding copyright ownership. + * + * This program and the accompanying materials are made available under the + * terms of the Apache License, Version 2.0 which is available at + * https://www.apache.org/licenses/LICENSE-2.0. + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations + * under the License. + * + * SPDX-License-Identifier: Apache-2.0 + */ + @tailwind base; @tailwind components; -@tailwind utilities; \ No newline at end of file +@tailwind utilities; diff --git a/frontend/src/router/index.js b/frontend/src/router/index.js index 7d97dda1..7ff1867d 100644 --- a/frontend/src/router/index.js +++ b/frontend/src/router/index.js @@ -1,7 +1,7 @@ /* - * Copyright (c) 2022-2024 Volkswagen AG - * Copyright (c) 2022-2024 Fraunhofer-Gesellschaft zur Foerderung der angewandten Forschung e.V. (represented by Fraunhofer ISST) - * Copyright (c) 2022-2024 Contributors to the Eclipse Foundation + * Copyright (c) 2022,2024 Volkswagen AG + * Copyright (c) 2022,2024 Fraunhofer-Gesellschaft zur Foerderung der angewandten Forschung e.V. (represented by Fraunhofer ISST) + * Copyright (c) 2022,2024 Contributors to the Eclipse Foundation * * See the NOTICE file(s) distributed with this work for additional * information regarding copyright ownership. diff --git a/frontend/src/views/CatalogView.vue b/frontend/src/views/CatalogView.vue index cd57695e..373fdb70 100644 --- a/frontend/src/views/CatalogView.vue +++ b/frontend/src/views/CatalogView.vue @@ -1,6 +1,6 @@ -

+
- - +
- - +
- - +
- - - + +
-
+