feat: Initialize Zastava Webhook service with TLS and Authority authentication

- Added Program.cs to set up the web application with Serilog for logging, health check endpoints, and a placeholder admission endpoint. - Configured Kestrel server to use TLS 1.3 and handle client certificates appropriately. - Created StellaOps.Zastava.Webhook.csproj with necessary dependencies including Serilog and Polly. - Documented tasks in TASKS.md for the Zastava Webhook project, outlining current work and exit criteria for each task.
2025-10-19 18:36:22 +03:00
parent 7e2fa0a42a
commit 5ce40d2eeb
966 changed files with 91038 additions and 1850 deletions
--- a/deploy/helm/stellaops/templates/configmaps.yaml
+++ b/deploy/helm/stellaops/templates/configmaps.yaml
@@ -0,0 +1,15 @@
+{{- $root := . -}}
+{{- range $name, $cfg := .Values.configMaps }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "stellaops.fullname" (dict "root" $root "name" $name) }}
+  labels:
+    {{- include "stellaops.labels" (dict "root" $root "name" $name "svc" (dict "class" "config")) | nindent 4 }}
+data:
+{{- range $fileName, $content := $cfg.data }}
+  {{ $fileName }}: |
+{{ $content | nindent 4 }}
+{{- end }}
+---
+{{- end }}
--- a/deploy/helm/stellaops/templates/core.yaml
+++ b/deploy/helm/stellaops/templates/core.yaml
@@ -1,5 +1,6 @@
 {{- $root := . -}}
 {{- range $name, $svc := .Values.services }}
+{{- $configMounts := (default (list) $svc.configMounts) }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -53,11 +54,12 @@ spec:
              containerPort: {{ $port.containerPort }}
              protocol: {{ default "TCP" $port.protocol }}
 {{- end }}
-{{- else if $svc.service.port }}
+{{- else if and $svc.service (hasKey $svc.service "port") }}
+          {{- $svcService := $svc.service }}
          ports:
            - name: {{ printf "%s-http" $name | trunc 63 | trimSuffix "-" }}
-              containerPort: {{ $svc.service.targetPort | default $svc.service.port }}
-              protocol: TCP
+              containerPort: {{ default (index $svcService "port") (index $svcService "targetPort") }}
+              protocol: {{ default "TCP" (index $svcService "protocol") }}
 {{- end }}
 {{- if $svc.resources }}
          resources:
@@ -71,11 +73,25 @@ spec:
          readinessProbe:
 {{ toYaml $svc.readinessProbe | nindent 12 }}
 {{- end }}
-{{- if $svc.volumeMounts }}
+{{- if or $svc.volumeMounts $configMounts }}
          volumeMounts:
+{{- if $svc.volumeMounts }}
 {{ toYaml $svc.volumeMounts | nindent 12 }}
 {{- end }}
-      {{- if or $svc.volumes $svc.volumeClaims }}
+{{- range $mount := $configMounts }}
+            - name: {{ $mount.name }}
+              mountPath: {{ $mount.mountPath }}
+{{- if $mount.subPath }}
+              subPath: {{ $mount.subPath }}
+{{- end }}
+{{- if hasKey $mount "readOnly" }}
+              readOnly: {{ $mount.readOnly }}
+{{- else }}
+              readOnly: true
+{{- end }}
+{{- end }}
+{{- end }}
+      {{- if or $svc.volumes (or $svc.volumeClaims $configMounts) }}
      volumes:
 {{- if $svc.volumes }}
 {{ toYaml $svc.volumes | nindent 8 }}
@@ -86,6 +102,19 @@ spec:
          persistentVolumeClaim:
            claimName: {{ $claim.claimName }}
 {{- end }}
+{{- end }}
+{{- range $mount := $configMounts }}
+        - name: {{ $mount.name }}
+          configMap:
+            name: {{ include "stellaops.fullname" (dict "root" $root "name" $mount.configMap) }}
+{{- if $mount.items }}
+            items:
+{{ toYaml $mount.items | nindent 12 }}
+{{- else if $mount.subPath }}
+            items:
+              - key: {{ $mount.subPath }}
+                path: {{ $mount.subPath }}
+{{- end }}
 {{- end }}
      {{- end }}
      {{- if $svc.serviceAccount }}
--- a/deploy/helm/stellaops/values-airgap.yaml
+++ b/deploy/helm/stellaops/values-airgap.yaml
@@ -8,6 +8,49 @@ global:
    pullPolicy: IfNotPresent
  labels:
    stellaops.io/channel: airgap
+
+configMaps:
+  notify-config:
+    data:
+      notify.yaml: |
+        storage:
+          driver: mongo
+          connectionString: "mongodb://notify-mongo.prod.svc.cluster.local:27017"
+          database: "stellaops_notify"
+          commandTimeoutSeconds: 60
+
+        authority:
+          enabled: true
+          issuer: "https://authority.stella-ops.org"
+          metadataAddress: "https://authority.stella-ops.org/.well-known/openid-configuration"
+          requireHttpsMetadata: true
+          allowAnonymousFallback: false
+          backchannelTimeoutSeconds: 30
+          tokenClockSkewSeconds: 60
+          audiences:
+            - notify
+          readScope: notify.read
+          adminScope: notify.admin
+
+        api:
+          basePath: "/api/v1/notify"
+          internalBasePath: "/internal/notify"
+          tenantHeader: "X-StellaOps-Tenant"
+
+        plugins:
+          baseDirectory: "/var/opt/stellaops"
+          directory: "plugins/notify"
+          searchPatterns:
+            - "StellaOps.Notify.Connectors.*.dll"
+          orderedPlugins:
+            - StellaOps.Notify.Connectors.Slack
+            - StellaOps.Notify.Connectors.Teams
+            - StellaOps.Notify.Connectors.Email
+            - StellaOps.Notify.Connectors.Webhook
+
+        telemetry:
+          enableRequestLogging: true
+          minimumLogLevel: Warning
 services:
  authority:
    image: registry.stella-ops.org/stellaops/authority@sha256:5551a3269b7008cd5aceecf45df018c67459ed519557ccbe48b093b926a39bcc
@@ -68,6 +111,17 @@ services:
      SCANNER__STORAGE__S3__ACCESSKEYID: "stellaops-airgap"
      SCANNER__STORAGE__S3__SECRETACCESSKEY: "airgap-minio-secret"
      SCANNER__QUEUE__BROKER: "nats://stellaops-nats:4222"
+  notify-web:
+    image: registry.stella-ops.org/stellaops/notify-web:2025.09.2
+    service:
+      port: 8446
+    env:
+      DOTNET_ENVIRONMENT: Production
+    configMounts:
+      - name: notify-config
+        mountPath: /app/etc/notify.yaml
+        subPath: notify.yaml
+        configMap: notify-config
  excititor:
    image: registry.stella-ops.org/stellaops/excititor@sha256:65c0ee13f773efe920d7181512349a09d363ab3f3e177d276136bd2742325a68
    env:
--- a/deploy/helm/stellaops/values-dev.yaml
+++ b/deploy/helm/stellaops/values-dev.yaml
@@ -8,6 +8,49 @@ global:
    pullPolicy: IfNotPresent
  labels:
    stellaops.io/channel: edge
+
+configMaps:
+  notify-config:
+    data:
+      notify.yaml: |
+        storage:
+          driver: mongo
+          connectionString: "mongodb://notify-mongo.dev.svc.cluster.local:27017"
+          database: "stellaops_notify_dev"
+          commandTimeoutSeconds: 30
+
+        authority:
+          enabled: true
+          issuer: "https://authority.dev.stella-ops.local"
+          metadataAddress: "https://authority.dev.stella-ops.local/.well-known/openid-configuration"
+          requireHttpsMetadata: false
+          allowAnonymousFallback: false
+          backchannelTimeoutSeconds: 30
+          tokenClockSkewSeconds: 60
+          audiences:
+            - notify.dev
+          readScope: notify.read
+          adminScope: notify.admin
+
+        api:
+          basePath: "/api/v1/notify"
+          internalBasePath: "/internal/notify"
+          tenantHeader: "X-StellaOps-Tenant"
+
+        plugins:
+          baseDirectory: "../"
+          directory: "plugins/notify"
+          searchPatterns:
+            - "StellaOps.Notify.Connectors.*.dll"
+          orderedPlugins:
+            - StellaOps.Notify.Connectors.Slack
+            - StellaOps.Notify.Connectors.Teams
+            - StellaOps.Notify.Connectors.Email
+            - StellaOps.Notify.Connectors.Webhook
+
+        telemetry:
+          enableRequestLogging: true
+          minimumLogLevel: Debug
 services:
  authority:
    image: registry.stella-ops.org/stellaops/authority@sha256:a8e8faec44a579aa5714e58be835f25575710430b1ad2ccd1282a018cd9ffcdd
@@ -67,6 +110,17 @@ services:
      SCANNER__STORAGE__S3__ACCESSKEYID: "stellaops"
      SCANNER__STORAGE__S3__SECRETACCESSKEY: "dev-minio-secret"
      SCANNER__QUEUE__BROKER: "nats://stellaops-nats:4222"
+  notify-web:
+    image: registry.stella-ops.org/stellaops/notify-web:2025.10.0-edge
+    service:
+      port: 8446
+    env:
+      DOTNET_ENVIRONMENT: Development
+    configMounts:
+      - name: notify-config
+        mountPath: /app/etc/notify.yaml
+        subPath: notify.yaml
+        configMap: notify-config
  excititor:
    image: registry.stella-ops.org/stellaops/excititor@sha256:d9bd5cadf1eab427447ce3df7302c30ded837239771cc6433b9befb895054285
    env:
--- a/deploy/helm/stellaops/values-stage.yaml
+++ b/deploy/helm/stellaops/values-stage.yaml
@@ -8,6 +8,49 @@ global:
    pullPolicy: IfNotPresent
  labels:
    stellaops.io/channel: stable
+
+configMaps:
+  notify-config:
+    data:
+      notify.yaml: |
+        storage:
+          driver: mongo
+          connectionString: "mongodb://notify-mongo.stage.svc.cluster.local:27017"
+          database: "stellaops_notify_stage"
+          commandTimeoutSeconds: 45
+
+        authority:
+          enabled: true
+          issuer: "https://authority.stage.stella-ops.org"
+          metadataAddress: "https://authority.stage.stella-ops.org/.well-known/openid-configuration"
+          requireHttpsMetadata: true
+          allowAnonymousFallback: false
+          backchannelTimeoutSeconds: 30
+          tokenClockSkewSeconds: 60
+          audiences:
+            - notify
+          readScope: notify.read
+          adminScope: notify.admin
+
+        api:
+          basePath: "/api/v1/notify"
+          internalBasePath: "/internal/notify"
+          tenantHeader: "X-StellaOps-Tenant"
+
+        plugins:
+          baseDirectory: "/opt/stellaops"
+          directory: "plugins/notify"
+          searchPatterns:
+            - "StellaOps.Notify.Connectors.*.dll"
+          orderedPlugins:
+            - StellaOps.Notify.Connectors.Slack
+            - StellaOps.Notify.Connectors.Teams
+            - StellaOps.Notify.Connectors.Email
+            - StellaOps.Notify.Connectors.Webhook
+
+        telemetry:
+          enableRequestLogging: true
+          minimumLogLevel: Information
 services:
  authority:
    image: registry.stella-ops.org/stellaops/authority@sha256:b0348bad1d0b401cc3c71cb40ba034c8043b6c8874546f90d4783c9dbfcc0bf5
@@ -68,6 +111,17 @@ services:
      SCANNER__STORAGE__S3__ACCESSKEYID: "stellaops-stage"
      SCANNER__STORAGE__S3__SECRETACCESSKEY: "stage-minio-secret"
      SCANNER__QUEUE__BROKER: "nats://stellaops-nats:4222"
+  notify-web:
+    image: registry.stella-ops.org/stellaops/notify-web:2025.09.2
+    service:
+      port: 8446
+    env:
+      DOTNET_ENVIRONMENT: Production
+    configMounts:
+      - name: notify-config
+        mountPath: /app/etc/notify.yaml
+        subPath: notify.yaml
+        configMap: notify-config
  excititor:
    image: registry.stella-ops.org/stellaops/excititor@sha256:59022e2016aebcef5c856d163ae705755d3f81949d41195256e935ef40a627fa
    env: