up

2025-12-09 00:20:52 +02:00
parent 3d01bf9edc
commit bc0762e97d
261 changed files with 14033 additions and 4427 deletions
--- a/deploy/helm/stellaops/templates/configmaps.yaml
+++ b/deploy/helm/stellaops/templates/configmaps.yaml
@@ -9,7 +9,7 @@ metadata:
 data:
 {{- range $fileName, $content := $cfg.data }}
  {{ $fileName }}: |
-{{ $content | nindent 4 }}
+{{ tpl $content $root | nindent 4 }}
 {{- end }}
 ---
 {{- end }}
--- a/deploy/helm/stellaops/templates/core.yaml
+++ b/deploy/helm/stellaops/templates/core.yaml
@@ -7,18 +7,18 @@
 {{- end -}}
 {{- $policyActivationTargets := dict "policy-engine" true "policy-gateway" true -}}
 {{- range $name, $svc := .Values.services }}
-{{- $configMounts := (default (list) $svc.configMounts) }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ include "stellaops.fullname" (dict "root" $root "name" $name) }}
-  labels:
-    {{- include "stellaops.labels" (dict "root" $root "name" $name "svc" $svc) | nindent 4 }}
-spec:
-  replicas: {{ default 1 $svc.replicas }}
-  selector:
-    matchLabels:
-      {{- include "stellaops.selectorLabels" (dict "root" $root "name" $name "svc" $svc) | nindent 6 }}
+{{- $configMounts := (default (list) $svc.configMounts) }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "stellaops.fullname" (dict "root" $root "name" $name) }}
+  labels:
+    {{- include "stellaops.labels" (dict "root" $root "name" $name "svc" $svc) | nindent 4 }}
+spec:
+  replicas: {{ default 1 $svc.replicas }}
+  selector:
+    matchLabels:
+      {{- include "stellaops.selectorLabels" (dict "root" $root "name" $name "svc" $svc) | nindent 6 }}
  template:
    metadata:
      labels:
@@ -43,18 +43,18 @@ spec:
          securityContext:
 {{ toYaml $svc.securityContext | nindent 12 }}
 {{- end }}
-{{- if $svc.command }}
-          command:
-{{- range $cmd := $svc.command }}
-            - {{ $cmd | quote }}
-{{- end }}
-{{- end }}
-{{- if $svc.args }}
-          args:
-{{- range $arg := $svc.args }}
-            - {{ $arg | quote }}
-{{- end }}
-{{- end }}
+{{- if $svc.command }}
+          command:
+{{- range $cmd := $svc.command }}
+            - {{ $cmd | quote }}
+{{- end }}
+{{- end }}
+{{- if $svc.args }}
+          args:
+{{- range $arg := $svc.args }}
+            - {{ $arg | quote }}
+{{- end }}
+{{- end }}
 {{- if $svc.env }}
          env:
 {{- range $envName, $envValue := $svc.env }}
@@ -64,6 +64,9 @@ spec:
 {{- end }}
 {{- $needsPolicyActivation := and $hasPolicyActivationConfig (hasKey $policyActivationTargets $name) }}
 {{- $envFrom := default (list) $svc.envFrom }}
+{{- if and (hasKey $root.Values.configMaps "surface-env") (or (hasPrefix "scanner-" $name) (hasPrefix "zastava-" $name)) }}
+  {{- $envFrom = append $envFrom (dict "configMapRef" (dict "name" (include "stellaops.fullname" (dict "root" $root "name" "surface-env")))) }}
+{{- end }}
 {{- if and $needsPolicyActivation (ne $policyActivationConfigName "") }}
 {{- $hasActivationReference := false }}
 {{- range $envFromEntry := $envFrom }}
@@ -80,19 +83,19 @@ spec:
 {{ toYaml $envFrom | nindent 12 }}
 {{- end }}
 {{- if $svc.ports }}
-          ports:
-{{- range $port := $svc.ports }}
-            - name: {{ default (printf "%s-%v" $name $port.containerPort) $port.name | trunc 63 | trimSuffix "-" }}
-              containerPort: {{ $port.containerPort }}
-              protocol: {{ default "TCP" $port.protocol }}
-{{- end }}
-{{- else if and $svc.service (hasKey $svc.service "port") }}
-          {{- $svcService := $svc.service }}
-          ports:
-            - name: {{ printf "%s-http" $name | trunc 63 | trimSuffix "-" }}
-              containerPort: {{ default (index $svcService "port") (index $svcService "targetPort") }}
-              protocol: {{ default "TCP" (index $svcService "protocol") }}
-{{- end }}
+          ports:
+{{- range $port := $svc.ports }}
+            - name: {{ default (printf "%s-%v" $name $port.containerPort) $port.name | trunc 63 | trimSuffix "-" }}
+              containerPort: {{ $port.containerPort }}
+              protocol: {{ default "TCP" $port.protocol }}
+{{- end }}
+{{- else if and $svc.service (hasKey $svc.service "port") }}
+          {{- $svcService := $svc.service }}
+          ports:
+            - name: {{ printf "%s-http" $name | trunc 63 | trimSuffix "-" }}
+              containerPort: {{ default (index $svcService "port") (index $svcService "targetPort") }}
+              protocol: {{ default "TCP" (index $svcService "protocol") }}
+{{- end }}
 {{- if $svc.resources }}
          resources:
 {{ toYaml $svc.resources | nindent 12 }}
@@ -122,61 +125,61 @@ spec:
          {{- $svc.podAnnotations = merge $svc.podAnnotations (dict "prometheus.io/scrape" "true" "prometheus.io/path" (default "/metrics" $pr.path) "prometheus.io/port" (toString (default 8080 $pr.port)) "prometheus.io/scheme" (default "http" $pr.scheme))) }}
          {{- end }}
 {{- end }}
-{{- if or $svc.volumeMounts $configMounts }}
-          volumeMounts:
-{{- if $svc.volumeMounts }}
-{{ toYaml $svc.volumeMounts | nindent 12 }}
-{{- end }}
-{{- range $mount := $configMounts }}
-            - name: {{ $mount.name }}
-              mountPath: {{ $mount.mountPath }}
-{{- if $mount.subPath }}
-              subPath: {{ $mount.subPath }}
-{{- end }}
-{{- if hasKey $mount "readOnly" }}
-              readOnly: {{ $mount.readOnly }}
-{{- else }}
-              readOnly: true
-{{- end }}
-{{- end }}
-{{- end }}
-      {{- if or $svc.volumes (or $svc.volumeClaims $configMounts) }}
-      volumes:
-{{- if $svc.volumes }}
-{{ toYaml $svc.volumes | nindent 8 }}
-{{- end }}
-{{- if $svc.volumeClaims }}
-{{- range $claim := $svc.volumeClaims }}
-        - name: {{ $claim.name }}
-          persistentVolumeClaim:
-            claimName: {{ $claim.claimName }}
-{{- end }}
-{{- end }}
-{{- range $mount := $configMounts }}
-        - name: {{ $mount.name }}
-          configMap:
-            name: {{ include "stellaops.fullname" (dict "root" $root "name" $mount.configMap) }}
-{{- if $mount.items }}
-            items:
-{{ toYaml $mount.items | nindent 12 }}
-{{- else if $mount.subPath }}
-            items:
-              - key: {{ $mount.subPath }}
-                path: {{ $mount.subPath }}
-{{- end }}
-{{- end }}
-      {{- end }}
-      {{- if $svc.serviceAccount }}
-      serviceAccountName: {{ $svc.serviceAccount | quote }}
-      {{- end }}
-      {{- if $svc.nodeSelector }}
-      nodeSelector:
-{{ toYaml $svc.nodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if $svc.affinity }}
-      affinity:
-{{ toYaml $svc.affinity | nindent 8 }}
-      {{- end }}
+{{- if or $svc.volumeMounts $configMounts }}
+          volumeMounts:
+{{- if $svc.volumeMounts }}
+{{ toYaml $svc.volumeMounts | nindent 12 }}
+{{- end }}
+{{- range $mount := $configMounts }}
+            - name: {{ $mount.name }}
+              mountPath: {{ $mount.mountPath }}
+{{- if $mount.subPath }}
+              subPath: {{ $mount.subPath }}
+{{- end }}
+{{- if hasKey $mount "readOnly" }}
+              readOnly: {{ $mount.readOnly }}
+{{- else }}
+              readOnly: true
+{{- end }}
+{{- end }}
+{{- end }}
+      {{- if or $svc.volumes (or $svc.volumeClaims $configMounts) }}
+      volumes:
+{{- if $svc.volumes }}
+{{ toYaml $svc.volumes | nindent 8 }}
+{{- end }}
+{{- if $svc.volumeClaims }}
+{{- range $claim := $svc.volumeClaims }}
+        - name: {{ $claim.name }}
+          persistentVolumeClaim:
+            claimName: {{ $claim.claimName }}
+{{- end }}
+{{- end }}
+{{- range $mount := $configMounts }}
+        - name: {{ $mount.name }}
+          configMap:
+            name: {{ include "stellaops.fullname" (dict "root" $root "name" $mount.configMap) }}
+{{- if $mount.items }}
+            items:
+{{ toYaml $mount.items | nindent 12 }}
+{{- else if $mount.subPath }}
+            items:
+              - key: {{ $mount.subPath }}
+                path: {{ $mount.subPath }}
+{{- end }}
+{{- end }}
+      {{- end }}
+      {{- if $svc.serviceAccount }}
+      serviceAccountName: {{ $svc.serviceAccount | quote }}
+      {{- end }}
+      {{- if $svc.nodeSelector }}
+      nodeSelector:
+{{ toYaml $svc.nodeSelector | nindent 8 }}
+      {{- end }}
+      {{- if $svc.affinity }}
+      affinity:
+{{ toYaml $svc.affinity | nindent 8 }}
+      {{- end }}
 {{- if $svc.tolerations }}
      tolerations:
 {{ toYaml $svc.tolerations | nindent 8 }}
@@ -203,20 +206,20 @@ spec:
 ---
 {{- if $svc.service }}
 apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "stellaops.fullname" (dict "root" $root "name" $name) }}
-  labels:
-    {{- include "stellaops.labels" (dict "root" $root "name" $name "svc" $svc) | nindent 4 }}
-spec:
-  type: {{ default "ClusterIP" $svc.service.type }}
-  selector:
-    {{- include "stellaops.selectorLabels" (dict "root" $root "name" $name "svc" $svc) | nindent 4 }}
-  ports:
-    - name: {{ default "http" $svc.service.portName }}
-      port: {{ $svc.service.port }}
-      targetPort: {{ $svc.service.targetPort | default $svc.service.port }}
-      protocol: {{ default "TCP" $svc.service.protocol }}
---
-{{- end }}
-{{- end }}
+kind: Service
+metadata:
+  name: {{ include "stellaops.fullname" (dict "root" $root "name" $name) }}
+  labels:
+    {{- include "stellaops.labels" (dict "root" $root "name" $name "svc" $svc) | nindent 4 }}
+spec:
+  type: {{ default "ClusterIP" $svc.service.type }}
+  selector:
+    {{- include "stellaops.selectorLabels" (dict "root" $root "name" $name "svc" $svc) | nindent 4 }}
+  ports:
+    - name: {{ default "http" $svc.service.portName }}
+      port: {{ $svc.service.port }}
+      targetPort: {{ $svc.service.targetPort | default $svc.service.port }}
+      protocol: {{ default "TCP" $svc.service.protocol }}
+---
+{{- end }}
+{{- end }}