fix: update keycloak-bootstrap and keycloak-extensions

.gitlab-ci.yml

@@ -26,6 +26,7 @@ include:
 
 stages:
   - ".pre"
+  - "renovate"
   - "scan"
   - "automr"
   - "env-cleanup"
@@ -149,6 +150,12 @@ variables:
     options:
       - "yes"
       - "no"
+  RUN_RENOVATE:
+    description: "Triggers the Renovate based check for dependency updates."
+    value: "no"
+    options:
+      - "yes"
+      - "no"
   TESTS_BRANCH:
     description: "Branch of E2E-tests on which the test pipeline is triggered"
     value: "main"
@@ -544,7 +551,10 @@ avscan-start:
 
 conventional-commits-linter:
   rules:
-    - if: "$JOB_CONVENTIONAL_COMMITS_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|merge_request_event'"
+    - if: >
+          $RUN_RENOVATE == "yes" ||
+          $JOB_CONVENTIONAL_COMMITS_LINTER_ENABLED == 'false' ||
+          $CI_PIPELINE_SOURCE =~ 'tags|merge_request_event'
       when: "never"
     - when: "always"
 
@@ -623,4 +633,20 @@ release:
     - "semantic-release"
   needs:
     - "generate-docs"
+
+renovate:
+  rules:
+    - if: $RUN_RENOVATE == "yes"
+      when: "on_success"
+  # The `-full` image does not install the dependencies on the fly, that is our preferred approach
+  image: "${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/renovate/renovate:37.356-full"
+  variables:
+    RENOVATE_CONFIG_FILE: "${CI_PROJECT_DIR}/.renovate/config.yaml"
+    RENOVATE_ENDPOINT: "${CI_API_V4_URL}"
+    # Increase the renovatebot log level on stdout
+    LOG_LEVEL: "DEBUG"
+  script:
+    - "renovate ${RENOVATE_EXTRA_FLAGS}"
+  stage: "renovate"
+
 ...

.gitlab/lint/lint-opendesk.yml

@@ -7,6 +7,10 @@ include:
 lint-opendesk:
   extends: ".lint-common"
   image: "${OPENDESK_CI_CLI_IMAGE}"
+  rules:
+    - if: $RUN_RENOVATE == "yes"
+      when: "never"
+    - when: "always"
   script:
     - "node /app/src/index.js sort-all -d ${CI_PROJECT_DIR}/helmfile"
     - "git diff --exit-code"

.renovate/config.yaml

@@ -0,0 +1,89 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+# Platform type of repository
+platform: "gitlab"
+
+# Enable onboarding merge request
+onboarding: false
+
+# If set to true: keep repository data between runs instead of deleting the data
+persistRepoData: false
+
+# Controls Renovate's behavior regarding repository config files such as renovate.json
+requireConfig: "ignored"
+
+# List of Repositories
+# See: https://docs.renovatebot.com/configuration-options/
+repositories:
+  - repository: "bmi/opendesk/deployment/opendesk"
+    # Set the branch to read current dependency state from, this is especially useful during
+    # renovate setup when looking into your feature branch or when your default branch is
+    # not the one you want to check on.
+    baseBranches: [ "develop" ]
+    # baseBranches: [ 'develop' ]
+    # Prefix to use for all branch names created by renovate bot (default: "renovate/")
+    branchPrefix: "renovate/"
+    # Lowercase merge request and commit titles ("never" = leave titles untouched )
+    commitMessageLowerCase: "never"
+    # Commit scope to use if Semantic Commits are enabled (fix(<scope>)...)
+    semanticCommitScope: "ci"
+    # Commit type to use if Semantic Commits are enabled (default: "chore")
+    semanticCommitType: "chore"
+    # Include package files only within these defined paths
+    includePaths:
+      - "helmfile/environments/default/images.yaml"
+      - "helmfile/environments/default/charts.yaml"
+    customManagers:
+      - customType: "regex"
+        fileMatch:
+          - "helmfile/environments/default/images.yaml"
+        datasourceTemplate: "docker"
+        matchStrings:
+          # yamllint disable rule:line-length
+          - ' providerResponsible: "(?<depType>.+?)"[\s\S]+? upstreamRegistry: "(?<registryUrl>.+?)"[\s\S]+? upstreamRepository: "(?<depName>.+?)"[\s\S]+? tag: "(?<currentValue>[^@]+)@(?<currentDigest>sha256:[a-f0-9]+)"'
+          # yamllint enable rule:line-length
+      - customType: "regex"
+        fileMatch:
+          - "helmfile/environments/default/charts.yaml"
+        datasourceTemplate: "docker"
+        matchStrings:
+          # yamllint disable rule:quoted-strings
+          - ' providerResponsible: "(?<depType>.+?)"[\s\S]+? upstreamRegistry: "(?<registryUrl>.+?)"[\s\S]+? upstreamRepository: "(?<depName>.+?)"[\s\S]+? version: "(?<currentValue>.+?)"'
+          # yamllint enable rule:line-length
+    # Rules for matching packages
+    packageRules:
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "openDesk" ]
+        groupName: "Platform"
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "Collabora" ]
+        groupName: "Collabora"
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "Element" ]
+        groupName: "Element"
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "Nordeck" ]
+        groupName: "Nordeck"
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "Open-Xchange" ]
+        groupName: "Open-Xchange"
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "OpenProject" ]
+        groupName: "OpenProject"
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "OpenProject" ]
+        groupName: "OpenProject"
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "Univention" ]
+        groupName: "Univention"
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "XWiki" ]
+        groupName: "XWiki"
+    # Add merge request labels
+    labels:
+      - "renovate"
+    # Enable custom regex manager only
+    enabledManagers:
+      - "custom.regex"
+...

helmfile/apps/univention-management-stack/values-umbrella.yaml.gotmpl

@@ -440,7 +440,7 @@ portal-server:
     {{ .Values.resources.umsPortalServer | toYaml | nindent 4 }}
 
 provisioning:
-  enabled: true
+  enabled: false
   api:
     image:
       registry: {{ .Values.global.imageRegistry | default .Values.images.umsProvisioningEventsAndConsumerApi.registry | quote }}
@@ -452,37 +452,6 @@ provisioning:
         - name: {{ . | quote }}
         {{- end }}
     credentialSecretName: "ums-provisioning-api-credentials"
-  udmTransformer:
-    image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.umsProvisioningUdmTransformer.registry | quote }}
-      repository: {{ .Values.images.umsProvisioningUdmTransformer.repository }}
-      pullPolicy: {{ .Values.global.imagePullPolicy }}
-      tag: {{ .Values.images.umsProvisioningUdmTransformer.tag }}
-      pullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . | quote }}
-        {{- end }}
-    config:
-      LOG_LEVEL: "DEBUG"
-      # not actually used in the code but needed for startup
-      UDM_HOST: "foobar"
-      UDM_PORT: 80
-      LDAP_TLS_MODE: "off"
-    api:
-      auth:
-        credentialSecretName: "ums-provisioning-udm-transformer-api-credentials"
-    nats:
-      auth:
-        credentialSecretName: "ums-provisioning-udm-transformer-credentials"
-    ldap:
-      baseDn: {{ .Values.ldap.baseDn | quote }}
-      auth:
-        bindDn: {{ printf "%s,%s" "cn=admin" .Values.ldap.baseDn | quote }}
-        credertialSecretName: "ums-provisioning-udm-transformer-ldap-credentials"
-      connection:
-        host: {{ .Values.ldap.host | quote }}
-        port: "389"
-
   dispatcher:
     image:
       registry: {{ .Values.global.imageRegistry | default .Values.images.umsProvisioningDispatcher.registry | quote }}
@@ -494,8 +463,6 @@ provisioning:
         - name: {{ . | quote }}
         {{- end }}
     credentialSecretName: "ums-provisioning-dispatcher-credentials"
-    config:
-      UDM_HOST: "ums-udm-rest-api"
   prefill:
     image:
       registry: {{ .Values.global.imageRegistry | default .Values.images.umsProvisioningPrefill.registry | quote }}
@@ -507,19 +474,69 @@ provisioning:
         - name: {{ . | quote }}
         {{- end }}
     credentialSecretName: "ums-provisioning-prefill-credentials"
-  register_consumers:
-    image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.umsWaitForDependency.registry | quote }}
-      repository: {{ .Values.images.umsWaitForDependency.repository }}
-      pullPolicy: {{ .Values.global.imagePullPolicy }}
-      tag: {{ .Values.images.umsWaitForDependency.tag }}
-      pullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . | quote }}
-        {{- end }}
-    credentialSecretName: "ums-provisioning-register-consumers-credentials"
-    jsonSecretName: "ums-provisioning-register-consumers-json-secrets"
-    provisioningApiBaseUrl: "http://ums-provisioning-api/internal/admin/v1/subscriptions"
+  nats:
+    config:
+      authorization:
+        enabled: false
+        users:
+          - user: "admin"
+            password: "$NATS_PASSWORD"
+            permissions:
+              publish: ">"
+              subscribe: ">"
+          - user: "$NATS_API_USER"
+            password: "$NATS_API_PASSWORD"
+            permissions:
+              publish: ">"
+              subscribe: ">"
+          - user: "$NATS_DISPATCHER_USER"
+            password: "$NATS_DISPATCHER_PASSWORD"
+            permissions:
+              publish: ">"
+              subscribe: ">"
+          - user: "$NATS_PREFILL_USER"
+            password: "$NATS_PREFILL_PASSWORD"
+            permissions:
+              publish: ">"
+              subscribe: ">"
+    extraEnvVars:
+      - name: NATS_USER
+        value: "admin"
+      - name: NATS_PASSWORD
+        valueFrom:
+          secretKeyRef:
+            name: ums-provisioning-nats-credentials
+            key: admin_password
+      - name: NATS_API_USER
+        valueFrom:
+          secretKeyRef:
+            name: ums-provisioning-api-credentials
+            key: NATS_USER
+      - name: NATS_API_PASSWORD
+        valueFrom:
+          secretKeyRef:
+            name: ums-provisioning-api-credentials
+            key: NATS_PASSWORD
+      - name: NATS_DISPATCHER_USER
+        valueFrom:
+          secretKeyRef:
+            name: ums-provisioning-dispatcher-credentials
+            key: NATS_USER
+      - name: NATS_DISPATCHER_PASSWORD
+        valueFrom:
+          secretKeyRef:
+            name: ums-provisioning-dispatcher-credentials
+            key: NATS_PASSWORD
+      - name: NATS_PREFILL_USER
+        valueFrom:
+          secretKeyRef:
+            name: ums-provisioning-prefill-credentials
+            key: NATS_USER
+      - name: NATS_PREFILL_PASSWORD
+        valueFrom:
+          secretKeyRef:
+            name: ums-provisioning-prefill-credentials
+            key: NATS_PASSWORD
   nats:
     nats:
       image:
@@ -540,13 +557,14 @@ provisioning:
         imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
         tag: {{ .Values.images.umsNatsReloader.tag | quote }}
 
+
   ingress:
     host: "localhost"
     tls:
       enabled: false
 
 udm-listener:
-  enabled: true
+  enabled: false
   image:
     registry: {{ .Values.global.imageRegistry | default .Values.images.umsProvisioningUdmListener.registry | quote }}
     repository: {{ .Values.images.umsProvisioningUdmListener.repository | quote }}
@@ -557,18 +575,15 @@ udm-listener:
       - name: {{ . | quote }}
       {{- end }}
   config:
+    debugLevel: "4"
     ldapBaseDn: {{ .Values.ldap.baseDn | quote }}
     ldapHost: {{ .Values.ldap.host | quote }}
     ldapHostDn: {{ printf "%s,%s" "cn=admin" .Values.ldap.baseDn | quote }}
     ldapPassword: {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }}
     ldapPort: "389"
-    internalApiHost: "ums-provisioning-api"
     notifierServer: "ums-ldap-notifier"
+    tlsMode: "off"
     natsHost: "ums-provisioning-nats"
-    natsUser: {{ .Values.provisioning.udmListener.nats.username | quote }}
-    natsPassword: {{ .Values.provisioning.udmListener.nats.password | default .Values.secrets.univentionManagementStack.provisioning.udmListener.nats.password | quote }}
-    eventsUsernameUdm: {{ .Values.provisioning.api.udmListener.username | quote }}
-    eventsPasswordUdm: {{ .Values.provisioning.api.udmListener.password | default .Values.secrets.univentionManagementStack.provisioning.api.udmListener.password | quote }}
 
 stack-data-ums:
   enabled: true
@@ -1037,52 +1052,45 @@ keycloak-bootstrap:
   cleanup:
     deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
     keepPVCOnDelete: {{ .Values.cleanup.keepPVCOnDelete }}
+
   keycloak:
+    connection:
+      baseUrl: "http://ums-keycloak.{{ .Release.Namespace }}.svc.{{ .Values.cluster.networking.domain }}:8080"
     auth:
       username: "kcadmin"
       password: {{ .Values.secrets.keycloak.adminPassword | quote }}
       realm: {{ .Values.platform.realm | quote }}
-    connection:
-      host: "ums-keycloak.{{ .Release.Namespace }}.svc.{{ .Values.cluster.networking.domain }}:8080"
-      baseUrl: "http://ums-keycloak:8080"
   ldap:
+    baseDn: {{ .Values.ldap.baseDn | quote }}
     connection:
-      host: "ums-ldap-server"
-      port: 389
-    baseDn: "dc=univention-organization,dc=intranet"
+      host: {{ .Values.ldap.host | quote }}
+      port: "389"
+      protocol: "ldap"
     auth:
-      bindDn: "uid=ldapsearch_keycloak,cn=users,dc=univention-organization,dc=intranet"
-      password: "univention"
+      bindDn: "uid=ldapsearch_keycloak,cn=users,dc=swp-ldap,dc=internal"
+      password: {{ .Values.secrets.univentionManagementStack.ldapSearch.keycloak | quote }}
 
-  config:
-    keycloak:
-      intraCluster:
-        enabled: true
-        internalBaseUrl: "http://ums-keycloak.{{ .Release.Namespace }}.svc.{{ .Values.cluster.networking.domain }}:8080"
-      loginLinks:
-        - link_number: 1
-          language: "de"
-          description: "Passwort vergessen?"
-          href: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/#/selfservice/passwordforgotten"
-        - link_number: 1
-          language: "en"
-          description: "Forgot password?"
-          href: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/#/selfservice/passwordforgotten"
-    ums:
-      ldap:
-        internalHostname: {{ .Values.ldap.host | quote }}
-        baseDN: {{ .Values.ldap.baseDn | quote }}
-        readUserDN: "uid=ldapsearch_keycloak,cn=users,dc=swp-ldap,dc=internal"
-        readUserPassword: {{ .Values.secrets.univentionManagementStack.ldapSearch.keycloak | quote }}
-        mappers:
-          - ldapAndUserModelAttributeName: "opendeskProjectmanagementAdmin"
-          - ldapAndUserModelAttributeName: "oxContextIDNum"
-      saml:
-        serviceProviderHostname: "{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
+  bootstrap:
+    ldapMappers:
+      - ldapAndUserModelAttributeName: "opendeskProjectmanagementAdmin"
+      - ldapAndUserModelAttributeName: "oxContextIDNum"
+    loginLinks:
+      - link_number: 1
+        language: "de"
+        description: "Passwort vergessen?"
+        href: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/#/selfservice/passwordforgotten"
+      - link_number: 1
+        language: "en"
+        description: "Forgot password?"
+        href: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/#/selfservice/passwordforgotten"
     twoFactorAuthentication:
       enabled: true
       group: "2fa-users"
 
+  config:
+    saml:
+      serviceProviderHostname: "{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
+
   containerSecurityContext:
     enabled: true
     allowPrivilegeEscalation: false
@@ -1114,12 +1122,12 @@ keycloak-extensions:
   enabled: true
   keycloak:
     connection:
-      host: "ums-keycloak.{{ .Release.Namespace }}.svc.{{ .Values.cluster.networking.domain }}:8080"
+      host: "ums-keycloak.{{ .Release.Namespace }}.svc.{{ .Values.cluster.networking.domain }}"
     auth:
       username: "kcadmin"
       password: {{ .Values.secrets.keycloak.adminPassword | quote }}
-      realm: "master"
-    realm: {{ .Values.platform.realm | quote }}
+      masterRealm: "master"
+      realm: {{ .Values.platform.realm | quote }}
   postgresql:
     connection:
       host: {{ .Values.databases.keycloakExtension.host | quote }}
@@ -1128,6 +1136,13 @@ keycloak-extensions:
       database: {{ .Values.databases.keycloakExtension.name | quote }}
       username: {{ .Values.databases.keycloakExtension.username | quote }}
       password: {{ .Values.databases.keycloakExtension.password | default .Values.secrets.postgresql.keycloakExtensionUser | quote }}
+  smtp:
+    connection:
+      host: {{ .Values.smtp.host | quote }}
+      port: {{ .Values.smtp.port | quote }}
+    auth:
+      username: {{ .Values.smtp.username | quote }}
+      password: {{ .Values.smtp.password | quote }}
   handler:
     replicaCount: {{ .Values.replicas.umsKeycloakExtensionsHandler }}
     podAnnotations:
@@ -1145,10 +1160,10 @@ keycloak-extensions:
       ipProtectionEnable: true
       logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"WARN"{{ end }}
       newDeviceLoginSubject: "New device login on your {{ .Values.theme.texts.productName }} account"
-      smtpPassword: {{ .Values.smtp.password | quote }}
-      smtpHost: {{ .Values.smtp.host | quote }}
-      smtpPort: {{ .Values.smtp.port | quote }}
-      smtpUsername: {{ .Values.smtp.username | quote }}
+      # smtpPassword: {{ .Values.smtp.password | quote }}
+      # smtpHost: {{ .Values.smtp.host | quote }}
+      # smtpPort: {{ .Values.smtp.port | quote }}
+      # smtpUsername: {{ .Values.smtp.username | quote }}
       mailFrom: "noreply@{{ .Values.global.domain }}"
     securityContext:
       allowPrivilegeEscalation: false
@@ -1547,6 +1562,23 @@ extraSecrets:
   - name: ums-portal-server-authenticator-credentials
     stringData:
       authenticator.secret: {{ .Values.secrets.centralnavigation.apiKey | quote }}
+  - name: ums-provisioning-api-credentials
+    stringData:
+      NATS_USER: "api"
+      NATS_PASSWORD: "password"
+  - name: ums-provisioning-dispatcher-credentials
+    stringData:
+      UDM_USERNAME: "cn=admin"
+      UDM_PASSWORD: "password"
+      NATS_USER: "dispatcher"
+      NATS_PASSWORD: "password"
+  - name: ums-provisioning-prefill-credentials
+    stringData:
+      NATS_USER: "prefill"
+      NATS_PASSWORD: "password"
+  - name: ums-provisioning-nats-credentials
+    stringData:
+      admin_password: "nimda"
   - name: ums-udm-rest-api-credentials
     stringData:
       ldap.secret: {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }}
@@ -1561,68 +1593,4 @@ extraSecrets:
     stringData:
       KEYCLOAK_ADMIN_PASSWORD: {{ .Values.secrets.keycloak.adminPassword | quote }}
       GUARDIAN_MANAGEMENT_API_CLIENT_SECRET: {{ .Values.secrets.keycloak.clientSecret.guardian | quote }}
-
-
-  - name: ums-provisioning-nats-credentials
-    stringData:
-      admin_password: {{ .Values.provisioning.nats.password | default .Values.secrets.univentionManagementStack.provisioning.nats.password | quote }}
-  - name: ums-provisioning-api-credentials
-    stringData:
-      NATS_USER: {{ .Values.provisioning.api.nats.username | quote }}
-      NATS_PASSWORD: {{ .Values.provisioning.api.nats.password | default .Values.secrets.univentionManagementStack.provisioning.api.nats.password | quote }}
-      ADMIN_NATS_USER: {{ .Values.provisioning.nats.username | quote }}
-      ADMIN_NATS_PASSWORD: {{ .Values.provisioning.nats.password | default .Values.secrets.univentionManagementStack.provisioning.nats.password | quote }}
-      ADMIN_USERNAME: {{ .Values.provisioning.api.admin.username | quote }}
-      ADMIN_PASSWORD: {{ .Values.provisioning.api.admin.password | default .Values.secrets.univentionManagementStack.provisioning.api.admin.password | quote }}
-      PREFILL_USERNAME: {{ .Values.provisioning.api.prefill.username | quote }}
-      PREFILL_PASSWORD: {{ .Values.provisioning.api.prefill.password | default .Values.secrets.univentionManagementStack.provisioning.api.prefill.password | quote }}
-      # UDM Transformer Username
-      EVENTS_USERNAME_UDM: {{ .Values.provisioning.api.udmListener.username | quote }}
-      # UDM Transformer Password
-      EVENTS_PASSWORD_UDM: {{ .Values.provisioning.api.udmListener.password | default .Values.secrets.univentionManagementStack.provisioning.api.udmListener.password | quote }}
-  - name: ums-provisioning-dispatcher-credentials
-    stringData:
-      UDM_USERNAME: "cn=admin"
-      UDM_PASSWORD: {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }}
-      NATS_USER: {{ .Values.provisioning.dispatcher.nats.username | quote }}
-      NATS_PASSWORD: {{ .Values.provisioning.dispatcher.nats.password | default .Values.secrets.univentionManagementStack.provisioning.dispatcher.nats.password | quote }}
-  - name: ums-provisioning-prefill-credentials
-    stringData:
-      NATS_USER: {{ .Values.provisioning.prefill.nats.username | quote }}
-      NATS_PASSWORD: {{ .Values.provisioning.prefill.nats.password | default .Values.secrets.univentionManagementStack.provisioning.prefill.nats.password | quote }}
-      UDM_USERNAME: "cn=admin"
-      UDM_PASSWORD: {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }}
-      PREFILL_USERNAME: {{ .Values.provisioning.api.prefill.username | quote }}
-      PREFILL_PASSWORD: {{ .Values.provisioning.api.prefill.password | default .Values.secrets.univentionManagementStack.provisioning.api.prefill.password | quote }}
-  - name: ums-provisioning-udm-transformer-api-credentials
-    stringData:
-      # UDM Transformer Username
-      EVENTS_USERNAME_UDM: {{ .Values.provisioning.api.udmListener.username | quote }}
-      # UDM Transformer Password
-      EVENTS_PASSWORD_UDM: {{ .Values.provisioning.api.udmListener.password | default .Values.secrets.univentionManagementStack.provisioning.api.udmListener.password | quote }}
-  - name: ums-provisioning-udm-transformer-credentials
-    stringData:
-      NATS_USER: {{ .Values.provisioning.udmTransformer.nats.username | quote }}
-      NATS_PASSWORD: {{ .Values.provisioning.udmTransformer.nats.password | default .Values.secrets.univentionManagementStack.provisioning.udmTransformer.nats.password | quote }}
-  - name: ums-provisioning-udm-transformer-ldap-credentials
-    stringData:
-      LDAP_BIND_PW: {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }}
-  - name: "ums-provisioning-udm-listener-credentials"
-    stringData:
-      NATS_USER: {{ .Values.provisioning.udmListener.nats.username | quote }}
-      NATS_PASSWORD: {{ .Values.provisioning.udmListener.nats.password | default .Values.secrets.univentionManagementStack.provisioning.udmListener.nats.password | quote }}
-      EVENTS_USERNAME_UDM: {{ .Values.provisioning.api.udmListener.username | quote }}
-      EVENTS_PASSWORD_UDM: {{ .Values.provisioning.api.udmListener.password | default .Values.secrets.univentionManagementStack.provisioning.api.udmListener.password | quote }}
-  - name: "ums-provisioning-register-consumers-credentials"
-    stringData:
-      ADMIN_USERNAME: {{ .Values.provisioning.api.admin.username | quote }}
-      ADMIN_PASSWORD: {{ .Values.provisioning.api.admin.password | default .Values.secrets.univentionManagementStack.provisioning.api.admin.password | quote }}
-  - name: "ums-provisioning-register-consumers-json-secrets"
-    stringData:
-      consumer.json: |
-        { "name": "consumer", "realms_topics": [["udm", "groups/group"]], "request_prefill": true, "password": "s0m3p4ss" }
-  - name: "ums-provisioning-selfservice-listener-credentials"
-    stringData:
-      NATS_USER: {{ .Values.provisioning.selfservice.nats.username | quote }}
-      NATS_PASSWORD: {{ .Values.provisioning.selfservice.nats.password | default .Values.secrets.univentionManagementStack.provisioning.selfservice.nats.password | quote }}
 ...

helmfile/environments/default/charts.yaml

@@ -7,363 +7,363 @@
 ---
 charts:
   certificates:
-    # providerCategory: 'Platform'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry.opencode.de'
-    # upstreamRepository: 'bmi/opendesk/components/platform-development/charts/opendesk-certificates/opendesk-certificates'
-    registry: "registry.opencode.de"
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-certificates/opendesk-certificates"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-certificates"
     name: "opendesk-certificates"
     version: "2.2.0"
     verify: true
   clamav:
-    # providerCategory: 'Platform'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry.opencode.de'
-    # upstreamRepository: 'bmi/opendesk/components/platform-development/charts/opendesk-clamav/opendesk-clamav'
-    registry: "registry.opencode.de"
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-clamav/opendesk-clamav"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-clamav"
     name: "opendesk-clamav"
     version: "4.0.5"
     verify: true
   clamavSimple:
-    # providerCategory: 'Platform'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry.opencode.de'
-    # upstreamRepository: 'bmi/opendesk/components/platform-development/charts/opendesk-clamav/clamav-simple'
-    registry: "registry.opencode.de"
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-clamav/clamav-simple"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-clamav"
     name: "clamav-simple"
     version: "4.0.5"
     verify: true
   collabora:
-    # providerCategory: 'Supplier'
-    # providerResponsible: 'Collabora'
-    # upstreamRegistry: 'ghcr.io/collaboraonline/charts'
-    # upstreamRepository: 'collabora-online'
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ['1', '1', '8']
-    registry: "registry.opencode.de"
+    # providerCategory: "Supplier"
+    # providerResponsible: "Collabora"
+    # upstreamRegistry: "https://ghcr.io/collaboraonline/charts"
+    # upstreamRepository: "collabora-online"
+    # upstreamMirrorTagFilterRegEx: "^(\d+)\.(\d+)\.(\d+)$"
+    # upstreamMirrorStartFrom: ["1", "1", "8"]
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/collabora/charts-mirror"
     name: "collabora-online"
     version: "1.1.11"
     verify: true
   cryptpad:
-    # providerCategory: 'Supplier'
-    # providerResponsible: 'XWiki'
-    # upstreamRegistry: 'ghcr.io/cryptpad/helm'
-    # upstreamRepository: 'cryptpad'
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ['0', '0', '17']
-    registry: "registry.opencode.de"
+    # providerCategory: "Supplier"
+    # providerResponsible: "XWiki"
+    # upstreamRegistry: "https://ghcr.io/cryptpad/helm"
+    # upstreamRepository: "cryptpad"
+    # upstreamMirrorTagFilterRegEx: "^(\d+)\.(\d+)\.(\d+)$"
+    # upstreamMirrorStartFrom: ["0", "0", "17"]
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/xwiki/charts-mirror"
     name: "cryptpad"
     version: "0.0.18"
     verify: true
   dovecot:
-    # providerCategory: 'Platform'
-    # providerResponsible: 'Open-Xchange'
-    # upstreamRegistry: 'registry.opencode.de'
-    # upstreamRepository: 'bmi/opendesk/components/platform-development/charts/opendesk-dovecot/dovecot'
-    registry: "registry.opencode.de"
+    # providerCategory: "Platform"
+    # providerResponsible: "Open-Xchange"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-dovecot/dovecot"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-dovecot"
     name: "dovecot"
     version: "1.3.10"
     verify: true
   element:
-    # providerCategory: 'Platform'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry.opencode.de'
-    # upstreamRepository: 'bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-element'
-    registry: "registry.opencode.de"
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-element"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-element"
     version: "2.7.1"
     verify: true
   elementWellKnown:
-    # providerCategory: 'Platform'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry.opencode.de'
-    # upstreamRepository: 'bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-well-known'
-    registry: "registry.opencode.de"
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-well-known"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-well-known"
     version: "2.7.1"
     verify: true
   home:
-    # providerCategory: 'Platform'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry.opencode.de'
-    # upstreamRepository: 'bmi/opendesk/components/platform-development/charts/opendesk-home'
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-home"
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-home"
     name: "opendesk-home"
     version: "1.0.1"
     verify: true
   intercomService:
-    # providerCategory: 'Supplier'
-    # providerResponsible: 'Univention'
-    # upstreamRegistry: 'registry.souvap-univention.de'
-    # upstreamRepository: 'souvap/tooling/charts/intercom-service/intercom-service'
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ['2', '0', '1']
-    registry: "registry.opencode.de"
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://registry.souvap-univention.de"
+    # upstreamRepository: "souvap/tooling/charts/intercom-service/intercom-service"
+    # upstreamMirrorTagFilterRegEx: "^(\d+)\.(\d+)\.(\d+)$"
+    # upstreamMirrorStartFrom: ["2", "0", "1"]
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "intercom-service"
     version: "2.0.1"
     verify: true
   jitsi:
-    # providerCategory: 'Platform'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry.opencode.de'
-    # upstreamRepository: 'bmi/opendesk/components/platform-development/charts/opendesk-jitsi/opendesk-jitsi'
-    registry: "registry.opencode.de"
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-jitsi/opendesk-jitsi"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-jitsi"
     name: "opendesk-jitsi"
     version: "1.7.8"
     verify: true
   mariadb:
-    # providerCategory: 'Platform'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry.opencode.de'
-    # upstreamRepository: 'bmi/opendesk/components/platform-development/charts/opendesk-mariadb/mariadb'
-    registry: "registry.opencode.de"
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-mariadb/mariadb"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-mariadb"
     name: "mariadb"
     version: "2.2.1"
     verify: true
   matrixNeoboardWidget:
-    # providerCategory: 'Platform'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry.opencode.de'
-    # upstreamRepository: 'bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets/matrix-neoboard-widget'
-    registry: "registry.opencode.de"
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets/matrix-neoboard-widget"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets"
     name: "matrix-neoboard-widget"
     version: "3.5.0"
     verify: true
   matrixNeochoiseWidget:
-    # providerCategory: 'Platform'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry.opencode.de'
-    # upstreamRepository: 'bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets/matrix-neochoice-widget'
-    registry: "registry.opencode.de"
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets/matrix-neochoice-widget"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets"
     name: "matrix-neochoice-widget"
     version: "3.5.0"
     verify: true
   matrixNeodatefixBot:
-    # providerCategory: 'Platform'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry.opencode.de'
-    # upstreamRepository: 'bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets/matrix-neodatefix-bot'
-    registry: "registry.opencode.de"
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets/matrix-neodatefix-bot"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets"
     name: "matrix-neodatefix-bot"
     version: "3.5.0"
     verify: true
   matrixNeodatefixWidget:
-    # providerCategory: 'Platform'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry.opencode.de'
-    # upstreamRepository: 'bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets/matrix-neodatefix-widget'
-    registry: "registry.opencode.de"
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets/matrix-neodatefix-widget"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets"
     name: "matrix-neodatefix-widget"
     version: "3.5.0"
     verify: true
   matrixUserVerificationService:
-    # providerCategory: 'Platform'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry.opencode.de'
-    # upstreamRepository: 'bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-matrix-user-verification-service'
-    registry: "registry.opencode.de"
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-matrix-user-verification-service"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-matrix-user-verification-service"
     version: "2.7.1"
     verify: true
   memcached:
-    # providerCategory: 'Community'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry-1.docker.io'
-    # upstreamRepository: 'bitnamicharts/memcached'
-    registry: "registry.opencode.de"
+    # providerCategory: "Community"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry-1.docker.io"
+    # upstreamRepository: "bitnamicharts/memcached"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/external/charts/bitnami-charts"
     name: "memcached"
     version: "6.7.1"
     verify: true
   minio:
-    # providerCategory: 'Community'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry-1.docker.io'
-    # upstreamRepository: 'bitnamicharts/minio'
-    registry: "registry.opencode.de"
+    # providerCategory: "Community"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry-1.docker.io"
+    # upstreamRepository: "bitnamicharts/minio"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/external/charts/bitnami-charts"
     name: "minio"
     version: "12.10.11"
     verify: true
   nextcloud:
-    # providerCategory: 'Platform'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry.opencode.de'
-    # upstreamRepository: 'bmi/opendesk/components/platform-development/charts/opendesk-nextcloud/opendesk-nextcloud'
-    registry: "registry.opencode.de"
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud/opendesk-nextcloud"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
     name: "opendesk-nextcloud"
     version: "1.5.2"
     verify: true
   nextcloudManagement:
-    # providerCategory: 'Platform'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry.opencode.de'
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
     # packageName=bmi/opendesk/components/platform-development/charts/opendesk-nextcloud/opendesk-nextcloud-management
-    registry: "registry.opencode.de"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
     name: "opendesk-nextcloud-management"
     version: "1.5.2"
     verify: true
   nginx:
-    # providerCategory: 'Community'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry-1.docker.io'
-    # upstreamRepository: 'bitnamicharts/nginx'
-    registry: "registry.opencode.de"
+    # providerCategory: "Community"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry-1.docker.io"
+    # upstreamRepository: "bitnamicharts/nginx"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/external/charts/bitnami-charts"
     name: "nginx"
     version: "15.9.3"
     verify: true
   opendeskKeycloakBootstrap:
-    # providerCategory: 'Platform'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry.opencode.de'
-    # upstreamRepository: 'bmi/opendesk/components/platform-development/charts/opendesk-keycloak-bootstrap/opendesk-keycloak-bootstrap'
-    registry: "registry.opencode.de"
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-keycloak-bootstrap/opendesk-keycloak-bootstrap"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-keycloak-bootstrap"
     name: "opendesk-keycloak-bootstrap"
     version: "1.0.7"
     verify: true
   openproject:
-    # providerCategory: 'Supplier'
-    # providerResponsible: 'openProject'
-    # upstreamRegistry: 'ghcr.io'
-    # upstreamRepository: 'opf/helm-charts/openproject'
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ['3', '0', '2']
-    registry: "registry.opencode.de"
+    # providerCategory: "Supplier"
+    # providerResponsible: "openProject"
+    # upstreamRegistry: "https://ghcr.io"
+    # upstreamRepository: "opf/helm-charts/openproject"
+    # upstreamMirrorTagFilterRegEx: "^(\d+)\.(\d+)\.(\d+)$"
+    # upstreamMirrorStartFrom: ["3", "0", "2"]
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/openproject/charts-mirror"
     name: "openproject"
     version: "4.2.1"
     verify: true
   openprojectBootstrap:
-    # providerCategory: 'Platform'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry.opencode.de'
-    # upstreamRepository: 'bmi/opendesk/components/platform-development/charts/opendesk-openproject-bootstrap/opendesk-openproject-bootstrap'
-    registry: "registry.opencode.de"
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-openproject-bootstrap/opendesk-openproject-bootstrap"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-openproject-bootstrap"
     name: "opendesk-openproject-bootstrap"
     version: "1.3.0"
     verify: true
   openXchangeAppSuite:
-    # providerCategory: 'Supplier'
-    # providerResponsible: 'Open-Xchange'
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ['2', '2', '37']
-    # upstreamRegistry: 'registry.open-xchange.com'
-    # upstreamRepository: 'appsuite-public-sector/charts/appsuite-public-sector'
-    registry: "registry.opencode.de"
+    # providerCategory: "Supplier"
+    # providerResponsible: "Open-Xchange"
+    # upstreamMirrorTagFilterRegEx: "^(\d+)\.(\d+)\.(\d+)$"
+    # upstreamMirrorStartFrom: ["2", "2", "37"]
+    # upstreamRegistry: "https://registry.open-xchange.com"
+    # upstreamRepository: "appsuite-public-sector/charts/appsuite-public-sector"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/charts-mirror"
     name: "appsuite-public-sector"
     version: "2.5.3"
     verify: false
   openXchangeAppSuiteBootstrap:
-    # providerCategory: 'Platform'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry.opencode.de'
-    # upstreamRepository: 'bmi/opendesk/components/platform-development/charts/opendesk-open-xchange-bootstrap/opendesk-open-xchange-bootstrap'
-    registry: "registry.opencode.de"
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-open-xchange-bootstrap/opendesk-open-xchange-bootstrap"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-open-xchange-bootstrap"
     name: "opendesk-open-xchange-bootstrap"
     version: "1.3.4"
     verify: true
   otterize:
-    # providerCategory: 'Platform'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry.opencode.de'
-    # upstreamRepository: 'bmi/opendesk/components/platform-development/charts/opendesk-otterize/opendesk-otterize'
-    registry: "registry.opencode.de"
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-otterize/opendesk-otterize"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-otterize"
     name: "opendesk-otterize"
     version: "2.0.1"
     verify: true
   oxConnector:
-    # providerCategory: 'Supplier'
-    # providerResponsible: 'Univention'
-    # upstreamRegistry: 'registry.souvap-univention.de'
-    # upstreamRepository: 'souvap/tooling/charts/univention/ox-connector'
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ['0', '4', '2']
-    registry: "registry.opencode.de"
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://registry.souvap-univention.de"
+    # upstreamRepository: "souvap/tooling/charts/univention/ox-connector"
+    # upstreamMirrorTagFilterRegEx: "^(\d+)\.(\d+)\.(\d+)$"
+    # upstreamMirrorStartFrom: ["0", "4", "2"]
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "ox-connector"
     version: "0.4.2"
     verify: true
   postfix:
-    # providerCategory: 'Platform'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry.opencode.de'
-    # upstreamRepository: 'bmi/opendesk/components/platform-development/charts/opendesk-postfix/postfix'
-    registry: "registry.opencode.de"
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-postfix/postfix"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-postfix"
     name: "postfix"
     version: "2.0.5"
     verify: true
   postgresql:
-    # providerCategory: 'Platform'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry.opencode.de'
-    # upstreamRepository: 'bmi/opendesk/components/platform-development/charts/opendesk-postgresql/postgresql'
-    registry: "registry.opencode.de"
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-postgresql/postgresql"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-postgresql"
     name: "postgresql"
     version: "2.0.5"
     verify: true
   redis:
-    # providerCategory: 'Community'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry-1.docker.io'
-    # upstreamRepository: 'bitnamicharts/redis'
-    registry: "registry.opencode.de"
+    # providerCategory: "Community"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry-1.docker.io"
+    # upstreamRepository: "bitnamicharts/redis"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/external/charts/bitnami-charts"
     name: "redis"
     version: "18.6.1"
     verify: true
   synapse:
-    # providerCategory: 'Platform'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry.opencode.de'
-    # upstreamRepository: 'bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-synapse'
-    registry: "registry.opencode.de"
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-synapse"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-synapse"
     version: "2.7.1"
     verify: true
   synapseCreateAccount:
-    # providerCategory: 'Platform'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry.opencode.de'
-    # upstreamRepository: 'bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-synapse-create-account'
-    registry: "registry.opencode.de"
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-synapse-create-account"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-synapse-create-account"
     version: "2.7.1"
     verify: true
   synapseWeb:
-    # providerCategory: 'Platform'
-    # providerResponsible: 'openDesk'
-    # upstreamRegistry: 'registry.opencode.de'
-    # upstreamRepository: 'bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-synapse-web'
-    registry: "registry.opencode.de"
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-synapse-web"
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-synapse-web"
     version: "2.7.1"
@@ -375,31 +375,19 @@ charts:
     # upstreamRepository: 'souvap/tooling/charts/univention/ums'
     # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
     # upstreamMirrorStartFrom: ['0', '0', '1']
-    registry: "registry.souvap-univention.de"
-    repository: "souvap/tooling/charts/univention"
-    name: "ums"
-    version: "0.14.0-pre-jlohmer-split-provisioning-listener"
-    verify: true
-  umsKeycloakBootstrap:
-    # providerCategory: 'Supplier'
-    # providerResponsible: 'Univention'
-    # upstreamRegistry: 'registry.souvap-univention.de'
-    # upstreamRepository: 'souvap/tooling/charts/univention-keycloak-bootstrap/ums-keycloak-bootstrap'
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ['1', '0', '1']
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
-    name: "ums-keycloak-bootstrap"
-    version: "1.0.1"
+    name: "ums"
+    version: "0.13.0"
     verify: true
   xwiki:
-    # providerCategory: 'Supplier'
-    # providerResponsible: 'XWiki'
-    # upstreamRegistry: 'git.xwikisas.com:5050/xwikisas/swp/xwiki/contrib-xwiki-helm'
-    # upstreamRepository: 'xwiki'
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ['1', '2', '4']
-    registry: "registry.opencode.de"
+    # providerCategory: "Supplier"
+    # providerResponsible: "XWiki"
+    # upstreamRegistry: "https://git.xwikisas.com:5050/xwikisas/swp/xwiki/contrib-xwiki-helm"
+    # upstreamRepository: "xwiki"
+    # upstreamMirrorTagFilterRegEx: "^(\d+)\.(\d+)\.(\d+)$"
+    # upstreamMirrorStartFrom: ["1", "2", "4"]
+    registry: "https://registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/xwiki/charts-mirror"
     name: "xwiki"
     version: "1.3.0"

helmfile/environments/default/provisioning.yaml

@@ -1,41 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-provisioning:
-  nats:
-    username: "admin"
-    password: ""
-  api:
-    nats:
-      username: "api"
-      password: ""
-    admin:
-      username: "admin"
-      password: ""
-    prefill:
-      username: "prefill"
-      password: ""
-    udmListener:
-      username: "udmListener"
-      password: ""
-  dispatcher:
-    nats:
-      username: "dispatcher"
-      password: ""
-  udmTransformer:
-    nats:
-      username: "udmTransformer"
-      password: ""
-  prefill:
-    nats:
-      username: "prefill"
-      password: ""
-  udmListener:
-    nats:
-      username: "udmListener"
-      password: ""
-  selfservice:
-    nats:
-      username: "selfservice"
-      password: ""
-...

helmfile/environments/default/secrets.gotmpl

@@ -31,32 +31,20 @@ secrets:
       portalServer: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "portal-server" "store-dav" | sha1sum | quote }}
       portalListener: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "portal-listener" "store-dav" | sha1sum | quote }}
     provisioning:
-      nats:
-        password: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "nats" "admin" | b64enc | quote }}
-      api:
-        nats:
-          password: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "nats" "api" | b64enc | quote }}
-        admin:
-          password: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "api" "admin" | sha1sum | quote }}
-        prefill:
-          password: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "api" "prefill" | sha1sum | quote }}
-        udmListener:
-          password: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "api" "udmListener" | sha1sum | quote }}
-      dispatcher:
-        nats:
-          password: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "nats" "dispatcher" | b64enc | quote }}
-      udmTransformer:
-        nats:
-          password: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "nats" "udmTransformer" | b64enc | quote }}
-      prefill:
-        nats:
-          password: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "nats" "prefill" | b64enc | quote }}
-      udmListener:
-        nats:
-          password: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "nats" "udmListener" | b64enc | quote }}
-      selfservice:
-        nats:
-          password: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "nats" "selfservice" | b64enc | quote }}
+      apiNatsPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "api" "nats" | sha1sum | quote }}
+      apiAdminNatsPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "apiAdmin" "nats" | sha1sum | quote }}
+      apiAdminPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "api" "admin_api" | sha1sum | quote }}
+      dispatcherPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "dispatcher" "dispatcher_service" | sha1sum | quote }}
+      prefillPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "prefill" "prefill_service" | sha1sum | quote }}
+      prefillNatsPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "prefill" "nats" | sha1sum | quote }}
+      udmProducerPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "udmproducer" "events_api" | sha1sum | quote }}
+      dispatcherNatsPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "dispatcher" "nats" | sha1sum | quote }}
+      dispatcherUdmPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "cn=admin" "udm" | sha1sum | quote }}
+      udmListenerNatsPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "udmlistener" "nats" | sha1sum | quote }}
+      udmPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "cn=admin" "udm" | sha1sum | quote }}
+  nats:
+    natsAdminPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "admin" "nats" | sha1sum | quote }}
+
   postgresql:
     postgresUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "postgres_user" | sha1sum | quote }}
     keycloakUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "keycloak_user" | sha1sum | quote }}