fix(univention-management-stack): Functional replacement for UCS container monolith, still optional.

helmfile/apps/univention-management-stack/helmfile.yaml

@@ -148,6 +148,16 @@ releases:
       - "values-umc-server.yaml"
     installed: {{ .Values.univentionManagementStack.enabled }}
 
+  - name: "ums-selfservice-listener"
+    chart: "ums-repo/{{ .Values.charts.umsSelfserviceListener.name }}"
+    version: "{{ .Values.charts.umsSelfserviceListener.version }}"
+    values:
+      - "values-common.gotmpl"
+      - "values-common.yaml"
+      - "values-selfservice-listener.gotmpl"
+      - "values-selfservice-listener.yaml"
+    installed: {{ .Values.univentionManagementStack.enabled }}
+
 commonLabels:
   deploy-stage: "component-1"
   component: "univention-management-stack"

helmfile/apps/univention-management-stack/values-selfservice-listener.gotmpl

@@ -0,0 +1,48 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+selfserviceListener:
+
+  ldapBaseDn: {{ .Values.ldap.baseDn | quote }}
+  ldapHost: {{ .Values.ldap.host | quote }}
+  ldapHostDn: {{ printf "%s,%s" "cn=admin" .Values.ldap.baseDn | quote }}
+  ldapPassword: {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }}
+  machineSecret: {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }}
+  notifierServer: {{ .Values.ldap.notifierHost | quote }}
+  umcAdminPassword: {{ .Values.secrets.univentionManagementStack.defaultAccounts.adminPassword | quote }}
+
+image:
+  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  pullSecrets:
+    {{- range .Values.global.imagePullSecrets }}
+    - name: {{ . | quote }}
+    {{- end }}
+
+  selfserviceListener:
+    registry: {{ .Values.global.imageRegistry | quote }}
+    repository: {{ .Values.images.umsSelfserviceListener.repository | quote }}
+    tag: {{ .Values.images.umsSelfserviceListener.tag | quote }}
+
+  selfserviceInvitation:
+    registry: {{ .Values.global.imageRegistry | quote }}
+    repository: {{ .Values.images.umsSelfserviceInvitation.repository | quote }}
+    tag: {{ .Values.images.umsSelfserviceInvitation.tag | quote }}
+
+  waitForDependency:
+    registry: {{ .Values.global.imageRegistry | quote }}
+    repository: {{ .Values.images.umsWaitForDependency.repository | quote }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    tag: {{ .Values.images.umsWaitForDependency.tag | quote }}
+
+persistence:
+  storageClassName: {{ .Values.persistence.storageClassNames.RWO | quote }}
+  size: {{ .Values.persistence.size.univentionManagementStack.selfserviceListener | quote }}
+
+resources:
+  {{ .Values.resources.umsSelfserviceListener | toYaml | nindent 2 }}
+
+resourcesDependencyWaiter:
+  {{ .Values.resources.umsSelfserviceListenerDependencies | toYaml | nindent 2 }}
+...

helmfile/apps/univention-management-stack/values-selfservice-listener.yaml

@@ -0,0 +1,11 @@
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+
+selfserviceListener:
+  debugLevel: "4"
+  tlsMode: "off"
+  umcServerUrl: "http://ums-umc-server"
+  umcAdminUser: "default.admin"
+
+...

helmfile/apps/univention-management-stack/values-stack-data-swp.gotmpl

@@ -31,9 +31,6 @@ stackDataContext:
   userPassword: {{ .Values.secrets.univentionManagementStack.defaultAccounts.userPassword | quote }}
   adminPassword: {{ .Values.secrets.univentionManagementStack.defaultAccounts.adminPassword | quote }}
 
-  userPassword: {{ .Values.secrets.univentionManagementStack.defaultAccounts.userPassword | quote }}
-  adminPassword: {{ .Values.secrets.univentionManagementStack.defaultAccounts.adminPassword | quote }}
-
 image:
   registry: {{ .Values.global.imageRegistry | quote }}
   repository: {{ .Values.images.umsDataLoader.repository | quote }}

helmfile/apps/univention-management-stack/values-ums-stack-gateway.yaml

@@ -2,6 +2,11 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 ingress:
+  annotations:
+    # Ensure that the ingress controller can handle responses with plenty of
+    # headers. This is a requirement from the UDM Rest API.
+    nginx.org/proxy-buffer-size: "64k"
+    nginx.org/proxy-buffers: "4 128k"
   tls: false
 
 service:
@@ -16,6 +21,15 @@ serverBlock: |
   server {
     listen 8080;
 
+    proxy_http_version 1.1;
+
+    proxy_set_header Host $http_host;
+
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Host $http_x_forwarded_host;
+    proxy_set_header X-Forwarded-Port $http_x_forwarded_port;
+    proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
+
     ## portal-frontend
     # The frontend does not own "/univention/portal" nor
     # "/univention/selfservice", only these two bits
@@ -139,9 +153,13 @@ serverBlock: |
 
     ## udm-rest-api
     location /univention/udm/ {
+      # The UDM Rest API does return on some endpoints a lot of headers
+      proxy_busy_buffers_size 128k;
+      proxy_buffers 4 128k;
+      proxy_buffer_size 64k;
+
       rewrite ^/univention(/udm/.*)$ $1 break;
       proxy_pass http://ums-udm-rest-api:80;
-      proxy_set_header X-Forwarded-Host $host;
     }
 
 

helmfile/environments/default/charts.yaml

@@ -426,7 +426,7 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/opendesk-otterize"
     name: "opendesk-otterize"
-    version: "1.1.3"
+    version: "1.1.5"
     verify: true
     username: ~
     password: ~
@@ -563,7 +563,7 @@ charts:
     registry: "gitlab.souvap-univention.de"
     repository: "api/v4/projects/155/packages/helm/stable"
     name: "notifications-api"
-    version: "0.6.1"
+    version: "0.9.1"
     username: ~
     password: ~
 
@@ -576,7 +576,7 @@ charts:
     registry: "gitlab.souvap-univention.de"
     repository: "api/v4/projects/155/packages/helm/stable"
     name: "portal-frontend"
-    version: "0.6.1"
+    version: "0.9.1"
     username: ~
     password: ~
 
@@ -589,7 +589,7 @@ charts:
     registry: "gitlab.souvap-univention.de"
     repository: "api/v4/projects/155/packages/helm/stable"
     name: "portal-listener"
-    version: "0.6.1"
+    version: "0.9.1"
     username: ~
     password: ~
 
@@ -602,7 +602,20 @@ charts:
     registry: "gitlab.souvap-univention.de"
     repository: "api/v4/projects/155/packages/helm/stable"
     name: "portal-server"
-    version: "0.6.1"
+    version: "0.9.1"
+    username: ~
+    password: ~
+
+  umsSelfserviceListener:
+    # renovate:
+    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
+    # packageName=umc-server
+    # dataSource=helm
+    # dependencyType=vendor
+    registry: "gitlab.souvap-univention.de"
+    repository: "api/v4/projects/155/packages/helm/stable"
+    name: "selfservice-listener"
+    version: "0.2.0"
     username: ~
     password: ~
 
@@ -615,7 +628,7 @@ charts:
     registry: "gitlab.souvap-univention.de"
     repository: "api/v4/projects/155/packages/helm/stable"
     name: "stack-data-swp"
-    version: "0.38.1"
+    version: "0.39.3"
     username: ~
     password: ~
 
@@ -628,7 +641,7 @@ charts:
     registry: "gitlab.souvap-univention.de"
     repository: "api/v4/projects/155/packages/helm/stable"
     name: "stack-data-ums"
-    version: "0.38.1"
+    version: "0.39.3"
     username: ~
     password: ~
 
@@ -641,7 +654,7 @@ charts:
     registry: "gitlab.souvap-univention.de"
     repository: "api/v4/projects/155/packages/helm/stable"
     name: "store-dav"
-    version: "0.7.0"
+    version: "0.9.1"
     username: ~
     password: ~
 
@@ -654,7 +667,7 @@ charts:
     registry: "gitlab.souvap-univention.de"
     repository: "api/v4/projects/155/packages/helm/stable"
     name: "udm-rest-api"
-    version: "0.3.5"
+    version: "0.4.1"
     username: ~
     password: ~
 
@@ -667,7 +680,7 @@ charts:
     registry: "gitlab.souvap-univention.de"
     repository: "api/v4/projects/155/packages/helm/stable"
     name: "umc-gateway"
-    version: "0.6.1"
+    version: "0.6.2"
     username: ~
     password: ~
 
@@ -680,7 +693,7 @@ charts:
     registry: "gitlab.souvap-univention.de"
     repository: "api/v4/projects/155/packages/helm/stable"
     name: "umc-server"
-    version: "0.6.1"
+    version: "0.6.2"
     username: ~
     password: ~
 

helmfile/environments/default/images.yaml

@@ -395,7 +395,7 @@ images:
     # dependencyType=vendor
     # This is a preview and not part of the standard deployment.
     repository: "souvap/tooling/images/univention/config-htpasswd"
-    tag: "0.7.0@sha256:8ffa8ce61fc55f67cdf740b3cd30e21d979506a1796028f5c6329da344b2e5db"
+    tag: "0.9.1@sha256:5694da729235371d93b1c7f14c00720657b34d6425f232426a1848b69f97ab15"
     # @supplier: "Univention"
   umsDataLoader:
     # renovate:
@@ -403,7 +403,7 @@ images:
     # dependencyType=vendor
     # This is a preview and not part of the standard deployment.
     repository: "souvap/tooling/images/univention/data-loader"
-    tag: "0.38.1@sha256:cef20b0224571eeda29f19e78340ab7d943e46b02275f9b9497605357be70e61"
+    tag: "0.39.3@sha256:f2968f98cf4f7cb4fd44339422c2d06ee590c61780ea88728af685719b497a9f"
     # @supplier: "Univention"
   umsLdapNotifier:
     # renovate:
@@ -427,7 +427,7 @@ images:
     # dependencyType=vendor
     # This is a preview and not part of the standard deployment.
     repository: "souvap/tooling/images/univention/notifications-api"
-    tag: "0.6.1@sha256:bdf0c5ba8b15c2e7f4daaf470254b13837bdc5fbaa98d9f441f33abd565acfc3"
+    tag: "0.9.1@sha256:86f86119292ccda53d77db010ceac9217a2552145fad8d20e876002f74c3a187"
     # @supplier: "Univention"
   umsPortalListener:
     # renovate:
@@ -435,7 +435,7 @@ images:
     # dependencyType=vendor
     # This is a preview and not part of the standard deployment.
     repository: "souvap/tooling/images/univention/portal-listener"
-    tag: "0.6.1@sha256:c418be054dfb2c6fe0e2e8870553c3b27269ae77b88a59cd6d790201cf7c3d17"
+    tag: "0.9.1@sha256:615a587717934153179c138d3598841922e3a658e5e891347f21ecbe5c8387ae"
     # @supplier: "Univention"
   umsPortalFrontend:
     # renovate:
@@ -443,7 +443,7 @@ images:
     # dependencyType=vendor
     # This is a preview and not part of the standard deployment.
     repository: "souvap/tooling/images/univention/portal-frontend"
-    tag: "0.6.1@sha256:0a4dc8ed47fd86eedd7bfd826b4538564194fe951000cff016eaa271382ed822"
+    tag: "0.9.1@sha256:c0984b246692d58b3fbecac487d3737e9b4f62181666f1abfa2401d1a3a72267"
     # @supplier: "Univention"
   umsPortalServer:
     # renovate:
@@ -451,7 +451,7 @@ images:
     # dependencyType=vendor
     # This is a preview and not part of the standard deployment.
     repository: "souvap/tooling/images/univention/portal-server"
-    tag: "0.6.1@sha256:dd9431c8a82e6fca89ef871de90947db2f594a349d634f0b1aa9669d0b3d5715"
+    tag: "0.9.1@sha256:f608986d8b072a143260531b6e3fcb08d18c88bc444b968c0713737769fd1292"
     # @supplier: "Univention"
   umsWaitForDependency:
     # renovate:
@@ -459,7 +459,7 @@ images:
     # dependencyType=vendor
     # This is a preview and not part of the standard deployment.
     repository: "souvap/tooling/images/univention/wait-for-dependency"
-    tag: "0.6.1@sha256:e83fe2d7535167d1d1effe443fca0be431aa551ab31f172a84073b7d9ffec54b"
+    tag: "0.9.1@sha256:22e57dca261dad12e046a827914bb888f49fd6bb61f50ad5023b53dade4eda33"
     # @supplier: "Univention"
   umsStoreDav:
     # renovate:
@@ -467,7 +467,7 @@ images:
     # dependencyType=vendor
     # This is a preview and not part of the standard deployment.
     repository: "souvap/tooling/images/univention/store-dav"
-    tag: "0.7.0@sha256:732b0d2fdf320209de04403753d3bc80f9c73a46b237202a95305a332805f305"
+    tag: "0.9.1@sha256:82b6b5e7c20793b2a6000a1ceddd3e4b3d085bf75999e9ff9814e7224d1de629"
     # @supplier: "Univention"
   umsUdmRestApi:
     # renovate:
@@ -475,7 +475,7 @@ images:
     # dependencyType=vendor
     # This is a preview and not part of the standard deployment.
     repository: "souvap/tooling/images/univention/udm-rest-api"
-    tag: "0.3.5@sha256:1a434f9d5e4d15217d011c13d9f1694e8a12291e09a6d0802c1158f7e2c5e035"
+    tag: "0.4.1@sha256:4b264251e9e1f2933be86051964d6113011379af107cc95dca53c1eff4c1e709"
     # @supplier: "Univention"
   umsUmcGateway:
     # renovate:
@@ -483,7 +483,7 @@ images:
     # dependencyType=vendor
     # This is a preview and not part of the standard deployment.
     repository: "souvap/tooling/images/univention/umc-gateway"
-    tag: "0.6.1@sha256:e023c6b4a66eb80dc165310aff9b869cf35c102196514741676a9dba68cfae89"
+    tag: "0.6.2@sha256:326ced2ffd5cffa7591f23f5b0e2fe313a5aa0984d1537c3464df042d93b341c"
     # @supplier: "Univention"
   umsUmcServer:
     # renovate:
@@ -491,7 +491,23 @@ images:
     # dependencyType=vendor
     # This is a preview and not part of the standard deployment.
     repository: "souvap/tooling/images/univention/umc-server"
-    tag: "0.6.1@sha256:9fc3ad7c45c436698223fe3219c314420b4687c9c694f5d255612beb51df9347"
+    tag: "0.6.2@sha256:e2694fbc1b8f3027ae48f329e034431e06648028ca9c928b464db66a9fd080fb"
+    # @supplier: "Univention"
+  umsSelfserviceListener:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # dependencyType=vendor
+    # This is a preview and not part of the standard deployment.
+    repository: "souvap/tooling/images/univention/selfservice-listener"
+    tag: "0.3.0@sha256:919c4cbef3c4920fe661f5d69de7258135096b673a26370a0cbd98d244a20752"
+    # @supplier: "Univention"
+  umsSelfserviceInvitation:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # dependencyType=vendor
+    # This is a preview and not part of the standard deployment.
+    repository: "souvap/tooling/images/univention/selfservice-invitation"
+    tag: "0.3.0@sha256:225ce06e2859586d4c0fa1933d687df370d170b71b62cfd1e46992b44e880b08"
     # @supplier: "Univention"
   wellKnown:
     # renovate:

helmfile/environments/default/persistence.yaml

@@ -24,6 +24,7 @@ persistence:
       ldapServerData: "1Gi"
       ldapServerShared: "1Gi"
       portalListener: "1Gi"
+      selfserviceListener: "1Gi"
       storeDav: "1Gi"
     xwiki: "1Gi"
 ...

helmfile/environments/default/resources.yaml

@@ -396,6 +396,21 @@ resources:
     requests:
       cpu: 0.1
       memory: "256Mi"
+  umsSelfserviceListener:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsSelfserviceListenerDependencies:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+
   umsStackDataUms:
     limits:
       cpu: 99