chart 2.0.10 and adcs-simulator 0.0.6

charts/adcs-issuer/Chart.yaml

@@ -13,10 +13,10 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 2.0.9
+version: 2.0.10
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "2.0.9"
+appVersion: "2.0.10"
 

charts/adcs-issuer/README.md

@@ -2,7 +2,7 @@ helm template adcs-issuer  charts/adcs-issuer  -n adcs-issuer --values charts/ad
 
 helm template adcs-issuer charts/adcs-issuer -n adcs-issuer --values charts/adcs-issuer/values.yaml > adcs-issuer-all.yaml
 
-kubectl -n adcs-issuer apply -f adcs-issuer-all.yaml 
+kubectl -n adcs-issuer apply -f adcs-issuer-all.yaml --dry-run=server
 
 
 kubectl -n adcs-issuer get pod 

charts/adcs-issuer/templates/simulator-certificate-secret.yaml

@@ -0,0 +1,14 @@
+{{- if .Values.simulator.enabled  }}
+
+
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{.Values.simulator.secretCertificateName | default "adcs-sim-certificate-secret" }}
+  namespace: {{ .Release.Namespace }}
+data:
+  root.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBdVNkWnBKbEo4NmZmY2FVTW1FVG5VakFUajRVVHB2OExRK2hpMXI2aDd6dEl4M1hqCnJGMk1FSnY0QzAxaENlbThTZFViWnJ3YldhUGlzZkdST2dIOUhGeXYzQ2JaTm5tMFBVaWs1SU1TbUFoZzBTeGYKdVIrdW9xVW9EL3l0NkFXZ0h0QXVTVGt5dzZZeWo1ZzZ0bHh4dGtsVFhqaFl5YTdTZVZIV1pjTXdPMERvTTdKbwpnY0pNSTh5Ulh3WHZRL0EwTUxSVHVNcUJaSUFjQmtiaVErTmN3bE9aM0hWeTgzbXNydkFvTFJ3WDY4UVpLMXd2Cit4Szh4bUVDM1R5ZjZ1b1FhZTN0cGEyVm9NQ1lwUjdRbVhud0cveG1oZnZxOVZURC8vdUVTR3N4QXFWeWI5U0wKaFJNZlNlTEkzeUh4SWxDZGhmRHBVVXhyeXpXanBLN2pFZWpHK3Z0UFl1dE1scmIvZzl5aWZJUHlXam9wZ1BBNgpRU1A2NTNPS2FCVG83K1hjc1R0WkVDSEZHRThIcmRwNXlpblN5WHcyYlBrMjNLVzlUVEY1TllWM2lBNU5BV0JBCjAzMVdJeXFxZFNIRjBIaXJkd3FjeWJrTWZzdXZaMnNRU1VJbXJkSEcrcHV0YjNDdWkySjdqNkRWOHUzTHBrdWUKU3dTOGF6YnE1NENPVmRBTVpKNDUwenlVeTNKWG9hV1NBanJtZUdGeHV3QnhIeTlNc2hOUnM3cm9sbzNkQ1VpUwpuRXhqdlNHQzloaE1qL0xIY0pNZDJmcCtHbEthc21YRmYwMkRhQlJxRzFDSXcrckNmL3Y3WXhSUVNRS0hQZEZaCkJaSnVvUXpjTVdMMHlKZ2VZLzl4OEZDc1pjZG0vRHVlVFRicTY2b1lxVnNoU1Q2bGxOdUV5QjQ5aEhjQ0F3RUEKQVFLQ0FnQnV0UnFpa28xblJROFRrbzZQVlZQRERzQURacHl6azNnVzZKS0F1SWQyMWNuVWlhYlNYelRxa1hlawp1bVcxV2E2ZHJ2Q3RZdmd2aHhCN09XZU9lYlh3Q1hPVmZSMFB0NEdQeXluZEFJcFRvVjdTYzJmZzl4S2lhWUlrCjNQN1c1dFl3MW1WMm50NjlvVmhHQjgzRFVFOGxvWDVacmZOWTFGRkEvUy9tdE9qWDVSMXlHOURsRlZvVlpiSGUKVVZ3WkVUMERpaTh0Sk5odFVUUndoRjJ5SGZaT3MxSWlRWSswQ1NLNWp4dFdyWitYOXk3ZGdFZW9Kakg5bysvawpmT1Zadnc2RmFDQmFtZ29Iam1FM0NjL01sTjUrdlZKSDlyTXNjYnlvQ0ttMTYzSG9sU2h4dVhLYTVTNG1MWlhSCjVTZWJUdnlCSStVK0dTV3k0YVd4U0dpNVFxZ0dVSkJYQkp4dllqbHpIMWo2S1l4Z1pkV0VpQjdjUFo3cGdHVVEKZG9zd3N6Wk1WR20rRkRaZHp6Tm94M2ZVa3BGaHFscUU3MWg4QTRSOTZLQW9GaDQrWTljNjFBNnFZZWpPZFIxcQpybEswOHpJUUdQN1gwZzBsQzdVZm92NW9ZNGdpUVFTYkFpekNqdUhqTXZhdnhEdGh1SUJFSGtQaTlPblVRcmJlCkZCcGhmaUt5SmIzc2lkbXYxSEk0SWJyN2h5dWxaenQwU3ROcGpOUklta1lFQWgzMkdmd2Evb3hnK2xNYTZad2EKRzZIanV3dStjY1RBU1RScHNyblA5S0drU1dNb1FkOVNJUzhwclhXZnRFS21IdW9TVkUwbFBmQ0VCQ3RLNnZydApXWFo2VjQ5TVFwRFFQNEtCc2pGT2U5R29CMnMxTnl4WVlrQXRZb1MwSjBaY0QzclFvUUtDQVFFQTdKV0dpU3llCm9hWVduTkluUXptbnVlbm9yYk0xNnlPVjBnRHVQeXhxK21td051ZkY2a3FOR3JIT1J5alFPRzkrZW1iS2ZqalYKWEloNWFtMnhmaUljaE4vZkxDZjRaMFl4R2I5alNxeVRMbW1KU3FLbXZqR1g4dUxXRTNkdy84ZEp5QVlTY1FFaQpIbkdzdG9FalMybXBkOVp1VGk5di95bEVGS01nUU5jRWJ2S3lOU3NqSC9FOENNSmpiR0RORUxWVUk2bWs5ejF2CmpYKy95TFNHT0JCTUkrMXp1dFdXU0cwWTlwMnFCVERHVlJNMXh2bFhJOHd6OWZ3eGtNME12c1BxVjBqRzJmMmsKZnZZNDlvcEVqc0ZZRlFtb0IzeEFUbmxTdEIyS2RDT213Y0c2YThLaTdFZmRHSHhoNndrU05Jd1dveVhzTFlyMQowMXl4QnRha3o5d2kyUUtDQVFFQXlGbE9nZlQ3ZWVsN2d4T01FdWl3U3AwTmZVbnVxMy96OTFaSE5RYzR5NU16CmlkdWQ3aCsxcFRET045MDVzRlZGa3NuN1Y2cDU3Uk5SSm9lenp3NkZidEJGOFlEbzRVZ0krSnA3Q1JFSjdiNlIKb09NZlRYT0xHdzRjVEJLWXhjS0NrTWl1VWFNVjlxRkJLQ3VWMmVDamx3M0twckJFdTVDQmdkTHBiRVNNdS9qdwpXbGcvUUF2R25XMlk3Vm02MTBmOWRMNkRDdmU4djZUbk9KUTV6aVRROE1tZkV3M0N2MmY2MURXKzVrRGNFbkFvCjR5VFRCamxjY2FIZXF4SWhDR1Vra2dkUTA5TlJ1SC9TUUl5MlB1V1NxdjBWeG1BWW03bnd5d2g0NHRtRmthMUwKRHlNcVVqbm50UGp4MlZFS1phbkN5T0FCWU0xRk11ZWkycS9yVWVPdnp3S0NBUUIyVGY5TXNTZFNKai9BZzhabQpjM3BRR1l2azhHelIvS1Y2c2tSeENzRWtINTJpbHh2OUlQS1dtcnRRRWpTdFEvTzNPWmVncnNMaTFzd0FVSUlsClZPRjJBSTBWQTVmUDdPVzR2bC9rZzQvRjhiaFp2aVFyajVrd09BWmREYWxQL2xRQzFpWjZvOXB2NXVBN0V6Q1gKRVd0UkpjVmJDNVd4dnV6d2RQSTMrazJaUFh1bjRyNVp4c1FDalZJeWErV2ZxVTA5MkNOS0QwcXRNMml2OExYOQphd2pvSG1GMDJFR2lUZ3ZocHMzU2NxVjYvWFF5MzVTWHJoRjl2SEw4dWN6WnlCWnpOMDFZek9GcEs2OG9lZFAyCm52Qnc5TGMxcHdoeE5YSUo1NHZJcjlzL29LU2NKbVJhUzBWZ2JUSjUyYnRrMDNpdWROUTVvZmR6ampKbi9RWEYKZTR0aEFvSUJBUUNtSDA3MmVQRFB6R1pxY0JuVVQvWmxWOFlvbmRYMWhEb0JXeHZkLzJmN2ZNbmVSQ2kybXJwZQpCNUxtUlZ3aE53TmlUSEpJNVlVRnE5Kzg2QWFTNkVLQmVOYVdBa0tYRWNqR2dpa0Vnb2xPQlpidzVZSStFVkZGCmxMU242eitic3NYYVVWd2hPdTNxT3hrd3Vyc2RGcVB1aXpQK2RPZjQ4a0JBS21iOEsvYlpvZmVCb2V5SUtYdDkKYTdQREVvVFhIczB0TVE2dFdHKzhKSHJJc2pjZ0UremZ5djVJcVQ5U3dGLzk5N2FiYXlwUGE0cXJsUXdZL0JVSAo3NlVYQ2dnejB0RzQ5N0h3Z2ljZnFYVG5xd1V1TCtNbVBvWUFvQXVuakV6NXZNT25yWitRQkRYWmpsbjRKaVZYCkxKZzBqbnJsZ3hhTXd4akJjRk14ZTFuUXBNK2xiZnFIQW9JQkFRQ0xpOEovazB6SmNDcnoxcTc0Ky92cnRpV24KbjVJRVlUdllmM0UyWXNqYXVWL2Z2UW5GbWs3eGFEYXNGQ0hIMzNTdzEwclpML29mZVJVK3ppZHhMVTJVRWtvOApuU3V6d3JKMUlDVlJQWjV2K3VLektYSFNBcnEzeFc0aXhBcGJZVHdTdzBuQkxXK01uR01WaDZRbDNJSGlQczM2Cit1bVF2Z2ZJSDlhcHdRdDE1R0ZIRisycllSVXRiZnBIVGFyYmd1Qk9SMnhDV01OUC9RMTFHZ1M0WVRPOEdUUVUKZ0FYWHkyOCtXV00zaGovMUpKZlV5Y3BkbXFiamRyeFpScDErSGFOYkQyT0Q5OHZVclBEeEx4eTVEVTE2R0ZyVgpyaWhObjl0U2NiRWtCR1dERWFHRTBFUVo3WTA2NnlBelJQY2VaMVphQVBGcVdpYVlTa2huMWlYRkdtR1YKLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
+  root.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUYxekNDQTcrZ0F3SUJBZ0lVS1BFM0tya2FUUENKS3FYS1k4cHR0bWoxNTJVd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1pERUxNQWtHQTFVRUJoTUNVRXd4RHpBTkJnTlZCQWdNQmxkaGNuTmhkekVQTUEwR0ExVUVCd3dHVFc5eQpaRzl5TVJBd0RnWURWUVFLREFkQlJFTlRVMGxOTVFzd0NRWURWUVFMREFKSlZERVVNQklHQTFVRUF3d0xaWGhoCmJYQnNaUzVqYjIwd0hoY05Nak14TWpNeE1USTFNalExV2hjTk16TXhNakk0TVRJMU1qUTFXakJrTVFzd0NRWUQKVlFRR0V3SlFUREVQTUEwR0ExVUVDQXdHVjJGeWMyRjNNUTh3RFFZRFZRUUhEQVpOYjNKa2IzSXhFREFPQmdOVgpCQW9NQjBGRVExTlRTVTB4Q3pBSkJnTlZCQXNNQWtsVU1SUXdFZ1lEVlFRRERBdGxlR0Z0Y0d4bExtTnZiVENDCkFpSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnSVBBRENDQWdvQ2dnSUJBTGtuV2FTWlNmT24zM0dsREpoRTUxSXcKRTQrRkU2Yi9DMFBvWXRhK29lODdTTWQxNDZ4ZGpCQ2IrQXROWVFucHZFblZHMmE4RzFtajRySHhrVG9CL1J4YwpyOXdtMlRaNXREMUlwT1NERXBnSVlORXNYN2tmcnFLbEtBLzhyZWdGb0I3UUxrazVNc09tTW8rWU9yWmNjYlpKClUxNDRXTW11MG5sUjFtWERNRHRBNkRPeWFJSENUQ1BNa1Y4RjcwUHdOREMwVTdqS2dXU0FIQVpHNGtQalhNSlQKbWR4MWN2TjVySzd3S0MwY0YrdkVHU3RjTC9zU3ZNWmhBdDA4bitycUVHbnQ3YVd0bGFEQW1LVWUwSmw1OEJ2OApab1g3NnZWVXcvLzdoRWhyTVFLbGNtL1VpNFVUSDBuaXlOOGg4U0pRbllYdzZWRk1hOHMxbzZTdTR4SG94dnI3ClQyTHJUSmEyLzRQY29ueUQ4bG82S1lEd09rRWordWR6aW1nVTZPL2wzTEU3V1JBaHhSaFBCNjNhZWNvcDBzbDgKTm16NU50eWx2VTB4ZVRXRmQ0Z09UUUZnUU5OOVZpTXFxblVoeGRCNHEzY0tuTW01REg3THIyZHJFRWxDSnEzUgp4dnFiclc5d3JvdGllNCtnMWZMdHk2Wkxua3NFdkdzMjZ1ZUFqbFhRREdTZU9kTThsTXR5VjZHbGtnSTY1bmhoCmNic0FjUjh2VExJVFViTzY2SmFOM1FsSWtweE1ZNzBoZ3ZZWVRJL3l4M0NUSGRuNmZocFNtckpseFg5TmcyZ1UKYWh0UWlNUHF3bi83KzJNVVVFa0NoejNSV1FXU2JxRU0zREZpOU1pWUhtUC9jZkJRckdYSFp2dzduazAyNnV1cQpHS2xiSVVrK3BaVGJoTWdlUFlSM0FnTUJBQUdqZ1lBd2ZqQWRCZ05WSFE0RUZnUVVUS1pVQitFWFRWaVNuV2l2CjNYNGVSN3h0aXVFd0h3WURWUjBqQkJnd0ZvQVVUS1pVQitFWFRWaVNuV2l2M1g0ZVI3eHRpdUV3RHdZRFZSMFQKQVFIL0JBVXdBd0VCL3pBckJnTlZIUkVFSkRBaWdndGxlR0Z0Y0d4bExtTnZiWUlOS2k1bGVHRnRjR3hsTG1OdgpiWWNFQ2dBQUFUQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FnRUFjZDVncmV0aTQ0dWtqZ3hXU05vWUZzNkhaNjU5Ck9vc3R4S0xIMGpNRlNVUXh2dDV0cks5a2p3MjdoV1lnNUM3M1dJYzNYbGUvYnlQU3lrVFFzeHE5dGk5NnFlMFQKVTQraHNmZEZWZWtxbE44M2gzcFovTG9EOXlFbFgydnpGa0xhaXFuLzdHV2RmNm00NzJ6cGdYeDZvUGxQNkdUVgpuOXBicVBoYnV0TVNBanBvbXJSNVNpdWVQb3NWaVYxVWpQdjZRVXZLV3VTK0dPUDBIelkrS3UxeWZlejEvcFJwCjB0NUpUZ01OVW9ZU2tqQzRkU3lQQnk5SFFNeFI3T2lnM01OellldUM5MHNZdnY2R0o0bjlzcVF4Y2orYURjM2cKYkR4RlpWOVF1MTlXK3pDZ0xQMjVhcXNjM1I1MmMwZEViQnlaVkVqMnUzNlU3bzJzZ0VSUFZpdjNOdzlxY2ZaRQptVFovK1VROXl1WXJmOWFLYzBxU1U1cVZvdXp4MW5HOVRRYlgvNWdoWmdtd1VMUkxUaWcyb3dBaWJEMDVKVTBlCmF5blNDYm1FSmtkSVB4NWRyS3piYUI5UktKLy9qcmtwbVVTQ084QjlSalJWWm1tSUl0eGRuMjhweUR5N0E4SlgKWFl3QkZRSWZ0Q0IxV1BpeHhybGlUaVlyUW90S2dLNFQ3QS95dFRheUZNdGFNdkJxTTdvdWxqNXYzUG93Y2Zaagpoa2V6YU5Qc1J4NGNMU0cvOVBjMDJRMEVIQ2pMemw4UzhGOC9tMDZuall1OWtQZEc3N3VWMjVvdlNhTnluQm00CmpmMTdQNTJQNXpxUHdXUXNPTU91NTFPVERoeWFnRGgxcVZKYXlyNGs5c2tBcEl5WUVCVHNoQkJ1T3dyUC9ueEYKRjhTRE5uNXdqc1lwVUlzPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+
+{{- end  }}    

charts/adcs-issuer/templates/simulator-deployment.yaml

@@ -6,6 +6,9 @@ metadata:
   namespace: {{ .Release.Namespace }}
 spec:
   replicas: 1
+  strategy:
+    type:
+      Recreate
   selector:
     matchLabels:
       control-plane: adcs-sim
@@ -14,6 +17,8 @@ spec:
       labels:
         control-plane: adcs-sim
     spec:
+      securityContext:
+        {{- toYaml  .Values.simulator.podSecurityContext | nindent 8 }}
       containers:
         {{- if .Values.simulator.arguments }}
       - args:
@@ -61,22 +66,41 @@ spec:
 
         resources: {{- toYaml .Values.simulator.resources | nindent 10 }}
 
+        securityContext:
+        {{- toYaml  .Values.simulator.containerSecurityContext | nindent 10 }}
+
+        {{- with .Values.livenessProbe }}
+        livenessProbe:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
+
+        {{- with .Values.simulator.readinessProbe }}
+        readinessProbe:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
+        livenessProbe:
+
+        {{- with .Values.simulator.livenessProbe }}
+        livenessProbe:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
 
       terminationGracePeriodSeconds: 10
 
+
       volumes:
 
         - name: csr
           emptyDir:
             sizeLimit: 50Mi 
 
         - name: config-pem
-          configMap:
-            name: {{.Values.simulator.configMapName | default "adcs-sim-configmap" }} # configmap for storing ca cert
+          secret:
+            secretName: {{.Values.simulator.secretCertificateName | default "adcs-sim-certificate-secret" }} # secret for storing ca cert
 
         - name: config-key
-          configMap:
-            name: {{.Values.simulator.configMapName | default "adcs-sim-configmap" }} # configmap for storing ca key
+          secret:
+            secretName: {{.Values.simulator.secretCertificateName | default "adcs-sim-certificate-secret" }} # secret for storing ca key
 
 
 {{- end  }}    

charts/adcs-issuer/values.yaml

@@ -57,11 +57,12 @@ simulator:
   clusterIssuserName: adcs-sim-adcsclusterissuer
   deploymentName: adcs-sim-deployment
   configMapName: adcs-sim-configmap
+  secretCertificateName: adcs-sim-certificate-secret
   secretName: adcs-sim-secret
   serviceName: adcs-sim-service 
   image:
     repository: djkormo/adcs-sim
-    tag: 0.0.5
+    tag: 0.0.6
 
   environment:
     ENABLE_DEBUG: "false"
@@ -74,6 +75,32 @@ simulator:
   containerPort: 8443
   servicePort: 8443
 
+  livenessProbe:
+    httpGet:
+      path: /healthz
+      port: 8443 # the same as containerPort
+      scheme: HTTPS
+    timeoutSeconds: 10
+    periodSeconds: 10
+  readinessProbe:
+    httpGet:
+      path: /readyz
+      port: 8443 # the same as containerPort
+      scheme: HTTPS
+    timeoutSeconds: 20
+    periodSeconds: 20
+    initialDelaySeconds: 10
+
+  podSecurityContext:
+    runAsUser: 1000
+
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop:
+      - all
+
   resources:
 
     limits:

test/Makefile

@@ -5,10 +5,10 @@ export $(shell sed 's/=.*//' $(dpl))
 # DOCKER TASKS
 # Build the container
 build: ## Build the container
-	DOCKER_BUILDKIT=1 docker build -t $(APP_NAME) .
+	DOCKER_BUILDKIT=1 docker build -t $(APP_NAME) . --progress=plain
 
 build-nc: ## Build the container without caching
-	DOCKER_BUILDKIT=1 docker build --no-cache -t $(APP_NAME) .
+	DOCKER_BUILDKIT=1 docker build --no-cache -t $(APP_NAME) . --progress=plain
 
 run: ## Run container on port configured in `config.env`
 	docker run --name $(APP_NAME) -it  $(DOCKER_REPO)/$(APP_NAME):latest  bash
@@ -39,3 +39,10 @@ tag-latest: ## Generate container `{version}` tag
 tag-version: ## Generate container `latest` tag
 	@echo 'create tag $(VERSION)'
 	docker tag $(APP_NAME) $(DOCKER_REPO)/$(APP_NAME):$(VERSION)
+
+
+
+inspect: ## Generate container `latest` tag
+	@echo 'inspect $(APP_NAME)'
+	docker history $(APP_NAME)
+	docker inspect $(APP_NAME)

test/adcs-sim/certserv/certserv.go

@@ -40,13 +40,7 @@ type Certserv struct {
 }
 
 var (
-	//TODO refactor 
-	//caWorkDir  = *flag.String("directory", "/usr/local/adcs-sim", "ADCS simulator working directory")
-	//caWorkDir, _ = os.Getwd()
-	//caWorkDir = "/d/development/kubernetes/go/adcs-issuer/test/adcs-sim"
-	//caWorkDir  = *flag.String("workdir", "/d/development/kubernetes/go/adcs-issuer/test/adcs-sim", "ADCS simulator working directory")
-	//caCertFile   = caWorkDir + "/ca/root.pem"
-	//caWorkDir=os.Getenv("workdir")
+
 	caWorkDir=getEnv("workdir","/usr/local/adcs-sim")
 	caCertFile   = caWorkDir + "root.pem"
 	caKeyFile    = caWorkDir + "/ca/root.key"
@@ -62,7 +56,7 @@ var (
 	//scheme    = runtime.NewScheme()
 	setupLog  = ctrl.Log.WithName("adcs-sim")
 	version   = "adcs-sim-by-djkormo"
-	buildTime = "2023-12-31:23:00"
+	buildTime = "2024-02-12:00:00"
 
 )
 type SimOrders struct {
@@ -94,6 +88,8 @@ func NewCertserv() (*Certserv, error) {
 	return cs, nil
 }
 
+
+
 func (c *Certserv) HandleCertnewCer(w http.ResponseWriter, req *http.Request) {
 	tmpl, _ := template.ParseFiles(tmplCertnewCer)