fix(nubus): Configure "global.subDomains" based on "global.hosts"

feat(nubus): Update chart and images to version 0.56.1
fix(ci): Correct the way how credentials for the RUN_TESTS job are extracted
2025-12-07 07:51:38 +01:00 · 2024-09-12 12:03:06 +02:00 · 2024-09-12 11:29:12 +02:00 · 2024-09-12 11:29:12 +02:00 · 2024-09-12 10:41:54 +02:00 · 2024-09-11 17:54:28 +02:00
8 changed files with 370 additions and 19 deletions
--- a/README.md
+++ b/README.md
@@ -29,7 +29,7 @@ openDesk is a Kubernetes based, open-source and cloud-native digital workplace s
 openDesk currently features the following functional main components:

 | Function             | Functional Component        | Component<br/>Version                                                                 | Upstream Documentation                                                                                                                       |
-| -------------------- | --------------------------- | ------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| -------------------- | --------------------------- |---------------------------------------------------------------------------------------| -------------------------------------------------------------------------------------------------------------------------------------------- |
 | Chat & collaboration | Element ft. Nordeck widgets | [1.11.67](https://github.com/element-hq/element-desktop/releases/tag/v1.11.67)        | [For the most recent release](https://element.io/user-guide)                                                                                 |
 | Diagram editor       | CryptPad ft. diagrams.net   | [5.6.0](https://github.com/cryptpad/cryptpad/releases/tag/5.6.0)                      | [For the most recent release](https://docs.cryptpad.org/en/)                                                                                 |
 | File management      | Nextcloud                   | [28.0.5](https://nextcloud.com/de/changelog/#28-0-5)                                  | [Nextcloud 28](https://docs.nextcloud.com/)                                                                                                  |
@@ -38,7 +38,7 @@ openDesk currently features the following functional main components:
 | Portal & IAM         | Nubus                       | Product Preview[^1]                                                                   | [Univention's documentation website](https://docs.software-univention.de/n/en/index.html)                                                    |
 | Project management   | OpenProject                 | [14.4.1](https://www.openproject.org/docs/release-notes/14-4-1/)                      | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                                  |
 | Videoconferencing    | Jitsi                       | [2.0.9646](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9646) | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                                   |
-| Weboffice            | Collabora                   | [24.04.7.2](https://www.collaboraoffice.com/code-24-04-release-notes/)                | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)               |
+| Weboffice            | Collabora                   | [24.04.7.1.2](https://www.collaboraoffice.com/code-24-04-release-notes/)              | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)               |

 While not all components are perfectly shaped for the execution inside containers, one of the project's objectives is to
 align the applications with best practices regarding container design and operations.
--- a/helmfile/apps/nubus/values-nubus.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-nubus.yaml.gotmpl
@@ -112,11 +112,11 @@ global:
                      visible: "False"
            wizard:
              disabled: "No"
-
+    
    ucs:
      web:
        theme: light
-
+    
    umc:
      cookie-banner:
        show: "false"
@@ -135,6 +135,21 @@ global:
      self-service:
        passwordreset:
          token_validity_period: 172800
+    
+    password:
+      # quality:
+        # length:
+          # min: 8
+        # required:
+          # chars:
+        # forbidden:
+          # chars:
+        # credit:
+          # digits: 1
+          # upper: 0
+          # other: 0
+          # lower: 1
+        # mspolicy: false

 ingress:
  certManager:
@@ -392,6 +407,32 @@ nubusStackDataUms:
      auth:
        username: ""

+# TODO: Remove values when upstreaming fixes
+nubusStackDataSwp:
+  stackDataSwp:
+    {{- if .Values.functional.admin.portal.deploymentInformation.enabled }}
+    systemInformation:
+      deployDate: "Deployed: {{ now | date "2006-01-02T15:04:05-0700" }}"
+      releaseVersion: "Release: {{ .Values.global.systemInformation.releaseVersion }}"
+    {{- end }}
+  stackDataContext:
+    externalMailDomain: {{ .Values.global.mailDomain | default .Values.global.domain }}
+    smtpHost: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+    smtpPort: 25
+    smtpUser: ""
+    smtpStartTls: false
+    ldapBase: {{ .Values.ldap.baseDn }}
+    # FIXME: Should be templated correctly in the future
+    portalRealtimeCollaborationLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.element .Values.global.domain }}
+    portalRealtimeVideoconferenceLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.jitsi .Values.global.domain }}
+    portalManagementProjectLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.openproject .Values.global.domain }}
+    portalManagementKnowledgeLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.xwiki .Values.global.domain }}
+    portalGroupwareLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.openxchange .Values.global.domain }}
+    portalFileshareLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.nextcloud .Values.global.domain }}
+    portalTitleDE: "openDesk Portal"
+    portalTitleEN: "openDesk Portal"
+    oxDefaultContext: "1"
+
 nubusUmcServer:
  postgresql:
    bundled: false
--- a/helmfile/apps/nubus/values-opendesk-customization.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-opendesk-customization.yaml.gotmpl
@@ -166,6 +166,12 @@ nubusStackDataUms:
  resources:
    {{ .Values.resources.umsStackDataUms | toYaml | nindent 4 }}

+nubusStackDataSwp:
+  additionalAnnotations:
+    intents.otterize.com/service-name: "ums-stack-data-swp"
+  resources:
+    {{ .Values.resources.umsStackDataSwp | toYaml | nindent 4 }}
+
 nubusSelfServiceConsumer:
  podAnnotations:
    intents.otterize.com/service-name: "ums-selfservice-listener"
--- a/helmfile/apps/nubus/values-opendesk-images.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-opendesk-images.yaml.gotmpl
@@ -212,3 +212,9 @@ nubusStackDataUms:
    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusDataLoader.registry | quote }}
    repository: {{ .Values.images.nubusDataLoader.repository }}
    tag: {{ .Values.images.nubusDataLoader.tag }}
+
+nubusStackDataSwp:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusDataLoader.registry | quote }}
+    repository: {{ .Values.images.nubusDataLoader.repository }}
+    tag: {{ .Values.images.nubusDataLoader.tag }}
--- a/helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl
@@ -29,7 +29,7 @@ config:
  managed:
    clientScopes: [ 'acr', 'web-origins', 'email', 'profile', 'microprofile-jwt', 'role_list', 'offline_access', 'roles', 'address', 'phone' ]
    # 'guardian-management-api', 'guardian-scripts', 'guardian-ui' clients have been added explicitly for the moment (see further down this file)
-    clients: [ 'opendesk-intercom', 'guardian-management-api', 'guardian-scripts', 'guardian-ui', 'UMC', '${client_account}', '${client_account-console}', '${client_admin-cli}', '${client_broker}', '${client_realm-management}', '${client_security-admin-console}' ]
+    clients: [ 'UMC', '${client_account}', '${client_account-console}', '${client_admin-cli}', '${client_broker}', '${client_realm-management}', '${client_security-admin-console}' ]
  keycloak:
    adminUser: "kcadmin"
    adminPassword: {{ .Values.secrets.keycloak.adminPassword | quote }}
@@ -517,6 +517,296 @@ config:
          post.logout.redirect.uris: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        defaultClientScopes:
          - "opendesk-xwiki-scope"
+      - name: "guardian-management-api"
+        clientId: "guardian-management-api"
+        rootUrl: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+        baseUrl: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+        protocol: "openid-connect"
+        publicClient: false
+        clientAuthenticatorType: "client-secret"
+        secret: {{ .Values.secrets.keycloak.clientSecret.guardian | quote }}
+        redirectUris:
+          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/guardian/*"
+        fullScopeAllowed: true
+        standardFlowEnabled: true
+        implicitFlowEnabled: false
+        directAccessGrantsEnabled: false
+        serviceAccountsEnabled: true
+        protocolMappers:
+          - name: "Client Host"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usersessionmodel-note-mapper"
+            consentRequired: false
+            config:
+              user.session.note: "clientHost"
+              userinfo.token.claim: true
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "clientHost"
+              jsonType.label: "String"
+          - name: "Client ID"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usersessionmodel-note-mapper"
+            consentRequired: false
+            config:
+              user.session.note: "client_id"
+              userinfo.token.claim: true
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "client_id"
+              jsonType.label: "String"
+          - name: "guardian-audience"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-audience-mapper"
+            consentRequired: false
+            config:
+              included.client.audience: "guardian"
+              userinfo.token.claim: false
+              id.token.claim: false
+              access.token.claim: true
+          - name: "audiencemap"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-audience-mapper"
+            consentRequired: false
+            config:
+              included.client.audience: "guardian-cli"
+              userinfo.token.claim: true
+              id.token.claim: true
+              access.token.claim: true
+          - name: "dn"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: false
+              user.attribute: "LDAP_ENTRY_DN"
+              id.token.claim: false
+              access.token.claim: true
+              claim.name: "dn"
+              jsonType.label: "String"
+          - name: "username"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-property-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "username"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "preferred_username"
+              jsonType.label: "String"
+          - name: "uid"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "uid"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "uid"
+              jsonType.label: "String"
+          - name: "email"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-property-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "email"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "email"
+              jsonType.label: "String"
+          - name: "Client IP Address"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usersessionmodel-note-mapper"
+            consentRequired: false
+            config:
+              user.session.note: "clientAddress"
+              userinfo.token.claim: true
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "clientAddress"
+              jsonType.label: "String"
+      - name: "guardian-scripts"
+        clientId: "guardian-scripts"
+        description: ""
+        rootUrl: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+        adminUrl: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+        baseUrl: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+        surrogateAuthRequired: false
+        enabled: true
+        alwaysDisplayInConsole: false
+        clientAuthenticatorType: "client-secret"
+        redirectUris:
+          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/univention/guardian/*"
+          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/guardian/*"
+        webOrigins:
+          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+        bearerOnly: false
+        consentRequired: false
+        standardFlowEnabled: true
+        implicitFlowEnabled: false
+        directAccessGrantsEnabled: true
+        serviceAccountsEnabled: false
+        publicClient: true
+        frontchannelLogout: false
+        protocol: "openid-connect"
+        fullScopeAllowed: true
+        protocolMappers:
+          - name: "email"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-property-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "email"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "email"
+              jsonType.label: "String"
+          - name: "guardian-audience"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-audience-mapper"
+            consentRequired: false
+            config:
+              included.client.audience: "guardian"
+              id.token.claim: false
+              access.token.claim: true
+              userinfo.token.claim: false
+          - name: "username"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-property-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "username"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "preferred_username"
+              jsonType.label: "String"
+          - name: "uid"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "uid"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "uid"
+              jsonType.label: "String"
+          - name: "audiencemap"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-audience-mapper"
+            consentRequired: false
+            config:
+              included.client.audience: "guardian-scripts"
+              id.token.claim: true
+              access.token.claim: true
+              userinfo.token.claim: true
+          - name: "dn"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              aggregate.attrs: false
+              multivalued: false
+              userinfo.token.claim: false
+              user.attribute: "LDAP_ENTRY_DN"
+              id.token.claim: false
+              access.token.claim: true
+              claim.name: "dn"
+              jsonType.label: "String"
+        defaultClientScopes:
+          - "web-origins"
+          - "acr"
+          - "roles"
+          - "profile"
+          - "email"
+        optionalClientScopes:
+          - "address"
+          - "phone"
+          - "offline_access"
+          - "microprofile-jwt"
+      - name: "guardian-ui"
+        clientId: "guardian-ui"
+        rootUrl: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+        baseUrl: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+        clientAuthenticatorType: "client-secret"
+        redirectUris:
+          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/univention/guardian/*"
+        standardFlowEnabled: true
+        publicClient: true
+        implicitFlowEnabled: false
+        directAccessGrantsEnabled: false
+        serviceAccountsEnabled: false
+        protocol: "openid-connect"
+        fullScopeAllowed: true
+        protocolMappers:
+          - name: "uid"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "uid"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "uid"
+              jsonType.label: "String"
+          - name: "username"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-property-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "username"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "preferred_username"
+              jsonType.label: "String"
+          - name: "dn"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: "false"
+              user.attribute: "LDAP_ENTRY_DN"
+              id.token.claim: false
+              access.token.claim: true
+              claim.name: "dn"
+              jsonType.label: "String"
+          - name: "audiencemap"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-audience-mapper"
+            consentRequired: false
+            config:
+              included.client.audience: "guardian"
+              id.token.claim: true
+              access.token.claim: true
+              userinfo.token.claim: true
+          - name: "email"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-property-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "email"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "email"
+              jsonType.label: "String"
+          - name: "guardian-audience"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-audience-mapper"
+            consentRequired: false
+            config:
+              included.client.audience: "guardian"
+              id.token.claim: false
+              access.token.claim: true
+              userinfo.token.claim: false

 containerSecurityContext:
  allowPrivilegeEscalation: false
--- a/helmfile/environments/default/charts.yaml
+++ b/helmfile/environments/default/charts.yaml
@@ -46,7 +46,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/collabora/charts-mirror"
    name: "collabora-online"
-    version: "1.1.21"
+    version: "1.1.20"
    verify: true
  cryptpad:
    # providerCategory: "Supplier"
@@ -264,7 +264,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
    name: "nubus"
-    version: "0.57.3"
+    version: "0.56.1"
    verify: true
  opendeskKeycloakBootstrap:
    # providerCategory: "Platform"
@@ -274,8 +274,9 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-keycloak-bootstrap"
    name: "opendesk-keycloak-bootstrap"
-    version: "2.1.1"
-    verify: true
+    version: "2.2.0-jtorres-univention-keycloak-clients"
+    verify: false
+    # TODO: change to the final version during MR to develop
  openproject:
    # providerCategory: "Supplier"
    # providerResponsible: "openProject"
--- a/helmfile/environments/default/images.yaml
+++ b/helmfile/environments/default/images.yaml
@@ -20,7 +20,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/supplier/collabora/images/collabora-online-for-opendesk"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/collabora/images/collabora-online-for-opendesk"
-    tag: "24.04.7.2.1@sha256:5b00478f2c6c7372b2a67e68783d9b1a91265679bbd4afdc1416e50720d50ce6"
+    tag: "24.04.7.1.2@sha256:6e3d64dfdf4a429c374f18947d7c4e987f585a13642817672123fd1963dc8a2d"
  cryptpad:
    # providerCategory: "Supplier"
    # providerResponsible: "XWiki"
@@ -413,7 +413,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "9", "4"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/notifications-api"
-    tag: "0.38.3@sha256:3b74617c6a8b68b086be8ab648bfffb08ba6ddb052ff0dcd4731c1bcc5a87a03"
+    tag: "0.38.1@sha256:da8bed3e1ce40804d8ac4ac5901109dcce8cd76eb7c6c711787fff6cbcc76733"
  nubusOpendeskExtension:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -451,7 +451,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "27", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-consumer"
-    tag: "0.38.3@sha256:a4c7b57870aa7868174ef446f4212da1fc9f57d72c31dca245a5787699f2975b"
+    tag: "0.38.1@sha256:beaa9f6f9cf2045781dba6f4aa67ed0b129b0f01a5a719ac038a07be135b6430"
  nubusPortalExtension:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -471,7 +471,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "9", "4"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-frontend"
-    tag: "0.38.3@sha256:514ff5117331d0b446944b252d993db547daad64062fcfaab8794bfb4f5290a3"
+    tag: "0.38.1@sha256:ace41eb46cc751efda5e0c827a5707c0442b454254944a71cd6a7a265a5e2247"
  nubusPortalServer:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -481,7 +481,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "9", "4"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-server"
-    tag: "0.38.3@sha256:0cd37fc82a7426013a1f93dcf4a72686f3b90b7532991dd1d50ae28cbca493e5"
+    tag: "0.38.1@sha256:3cb56bf434607282bad4a70e6be0ee72d8889c4135b63af91db54d8f48b31b0a"
  nubusProvisioningDispatcher:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -491,7 +491,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "14", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-dispatcher"
-    tag: "0.39.0@sha256:cff262c399785594a07d61a0645ca304e4da044d37831c29f848d8d70b2e58c9"
+    tag: "0.38.0@sha256:d583151b108164374bd11dc74626c62aace0ff4ddc5997b08553b559d7c0bf91"
  nubusProvisioningEventsAndConsumerApi:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -501,7 +501,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "14", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-events-and-consumer-api"
-    tag: "0.39.0@sha256:9f537eb138863ea9c3f6f7b416e7787ab1841e3e0ba3a8dd39fe35464955d75d"
+    tag: "0.38.0@sha256:b459c3a9bfd51692691736f0afeb0c7ba2d75efe30a5b1e2a8b51c5c48f08ac4"
  nubusProvisioningPrefill:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -511,7 +511,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "14", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-prefill"
-    tag: "0.39.0@sha256:72ab91cd235b52875c03411c5488984b482aafc6d58f2064bd5313ab7a119cab"
+    tag: "0.38.0@sha256:7fe6dfe75c3131ebf9bb9a36210adf4bd0bead06d6214985427d59eb4b420b40"
  nubusProvisioningUdmListener:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -521,7 +521,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "14", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-udm-listener"
-    tag: "0.39.0@sha256:f0e63353f0ea28890c992a374b82ac65f379f9dfd4c7fe645f002b170df1da69"
+    tag: "0.38.0@sha256:99a7fdc23650c5bcbf58c38ffea86b5fe779b12a834824ae5e206fc5f2c0301a"
  nubusProvisioningUdmTransformer:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -531,7 +531,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "14", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-udm-transformer"
-    tag: "0.39.0@sha256:64166fae60856da544698b601b70037a93239e9f6072ced890cd5965fab148dc"
+    tag: "0.38.0@sha256:e40b33188f11d82f669532e1f085ba5e1758fd6099f679a759f6ae2b1d0ee3ef"
  nubusSelfserviceInvitation:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
--- a/helmfile/environments/default/resources.yaml
+++ b/helmfile/environments/default/resources.yaml
@@ -562,6 +562,13 @@ resources:
    requests:
      cpu: 0.1
      memory: "256Mi"
+  umsStackDataSwp:
+    limits:
+      cpu: 99
+      memory: "1Gi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
  umsStackGateway:
    limits:
      cpu: 99
Author	SHA1	Message	Date
Johannes Bornhold	6c2682176d	fix(nubus): Configure "global.subDomains" based on "global.hosts"	2024-09-12 12:03:06 +02:00
Nubus CI Bot	77528d4a14	feat(nubus): Update chart and images to version 0.56.1	2024-09-12 11:29:12 +02:00
Johannes Bornhold	558a0c350d	fix(ci): Correct the way how credentials for the RUN_TESTS job are extracted	2024-09-12 11:29:12 +02:00
Carlos García-Mauriño	5f8d27dc3c	chore(nubus): Remove installUmcPolicies option	2024-09-12 10:41:54 +02:00
Johannes Bornhold	20d75271b3	fix(nubus): Update images to match version 0.56.0	2024-09-11 17:54:28 +02:00
Carlos García-Mauriño	a68704b310	feat(nubus): Upgrade nubus chart to 0.56.0	2024-09-11 17:25:04 +02:00
Nubus CI Bot	c9ce869d1d	feat(nubus): Update chart to version 0.54.1-pre-jlohmer-consumer-race-condition	2024-09-11 17:25:04 +02:00
Johannes Lohmer	20a6200483	fix(nubus): Clean up portal-listener and selfservice-listener artifacts	2024-09-11 17:21:02 +02:00
Johannes Lohmer	39e125c26a	fix(nubus): Use helmfile secrets in provisioning and remove unused secrets.	2024-09-11 17:21:02 +02:00
Johannes Lohmer	6047197d8c	feat(nubus): Activate Nubus Provisioning components and Consumers to replace portal-listener and selfservice-listener	2024-09-11 17:21:01 +02:00
Johannes Lohmer	dcacd9cac9	fix(nubus): Keep provisioning and consumers behind a feature-flag for easier merging This commit should be reverted once we are confident that provisioning and the consumers work as expected.	2024-09-11 17:21:01 +02:00
Johannes Lohmer	95c4dd2e2e	fix(nubus): Update nubus provisioning and consumer configuration	2024-09-11 17:21:01 +02:00
Nubus CI Bot	269c8270ee	feat(nubus): Update chart to version 0.51.0	2024-09-11 17:21:01 +02:00
Juan Pedro Torres	1d1c170142	feat(nubus): Bump chart version for default tiles removal	2024-09-11 17:21:01 +02:00
Johannes Bornhold	19f366defb	fix(nubus): Adjust keyring for intercom service	2024-09-11 17:21:01 +02:00
Nubus CI Bot	49382879d8	feat(nubus): Integrate keycloak provisioning	2024-09-11 17:21:01 +02:00
Juan Pedro Torres	26defa7776	feat(nubus): Bump chart version for default tiles removal	2024-09-11 17:21:00 +02:00
Nubus CI Bot	c76a117418	feat(nubus): Update chart to version 0.47.0	2024-09-11 17:21:00 +02:00
Jaime Conde	01f8e602f1	fix(nubus): Map Administrator credentials	2024-09-11 17:21:00 +02:00
Jaime Conde	86085c0f41	fix(nubus): Univention Portal images	2024-09-11 17:21:00 +02:00
Nubus CI Bot	e51ba3bc40	feat(nubus): Update chart to version 0.45.0	2024-09-11 17:21:00 +02:00
Carlos García-Mauriño	70ccbe400e	feat(nubus): Update charts and images	2024-09-11 17:21:00 +02:00
Carlos García-Mauriño	c819ec6ee8	fix(nubus): Configure stackDataContext	2024-09-11 17:21:00 +02:00
Carlos García-Mauriño	5316bd58a2	feat(nubus): Add custom UCR values	2024-09-11 17:20:59 +02:00
Juan Pedro Torres	565237155a	fix(nubus): Cleanup values	2024-09-11 17:20:59 +02:00
Juan Pedro Torres	036230eb58	feat(nubus): Upgrade Keycloak version	2024-09-11 17:20:59 +02:00
Juan Pedro Torres	0b3ee7e2d9	fix(nubus): Fix Keycloak init race condition	2024-09-11 17:20:59 +02:00
Juan Pedro Torres	ddbc89102b	feat(nubus): Bump Nubus version to 0.41.0, readonly user from Nubus	2024-09-11 17:20:59 +02:00
Jaime Conde	73c08ca953	fix(nubus): Use Nubus LDAP server image	2024-09-11 17:20:59 +02:00
Nubus CI Bot	d260c183ad	feat(nubus): Update ldap-server with umc-server license fix	2024-09-11 17:20:59 +02:00
Johannes Lohmer	cbe2da123b	fix(nubus): Comments are not allowed in images.yaml	2024-09-11 17:20:58 +02:00
Johannes Lohmer	03131989fa	fix(nubus): Keep provisioning and consumers behind a feature-flag for easier merging This commit should be reverted once we are confident that provisioning and the consumers work as expected.	2024-09-11 17:20:58 +02:00
Johannes Lohmer	aa46848e30	fix(nubus): Update nubus provisioning and consumer configuration	2024-09-11 17:20:58 +02:00
Johannes Lohmer	5d080c4abf	feat(nubus): Update nubus chart and images to version 0.39.2	2024-09-11 17:20:58 +02:00
Johannes Bornhold	a2afb22dce	fix(nubus): Disable certManager	2024-09-11 17:20:58 +02:00
Johannes Bornhold	2398f8c8a2	fix(nubus): Support "ingress.tls.secretName"	2024-09-11 17:20:57 +02:00
Thorsten Roßner	6484e1bd8b	fix(nubus): Set replicaCountProxy and replicaCountSecondary to `0`.	2024-09-11 17:15:01 +02:00
Johannes Bornhold	9e154b178d	fix(nubus): Configure keycloak-bootstrap to use the correct bind DN	2024-09-11 17:15:01 +02:00
Johannes Lohmer	9f0c481017	fix(nubus-extensions): Replace branch version of image after the merge	2024-09-11 17:15:01 +02:00
Johannes Lohmer	137e8e3437	fix(nubus): Use keycloak passwords from helmfile	2024-09-11 17:15:01 +02:00
Thorsten Roßner	02253ef4f2	fix(docs): Ensure 120 char line limit in yaml.	2024-09-11 17:15:01 +02:00
Johannes Lohmer	660618cff9	fix(nubus): Only use one LDAP Primary and make replica count of Secondary and Proxy others configurable	2024-09-11 17:15:01 +02:00
Juan Pedro Torres	171cc164ef	feat(nubus): OpenDesk UDM loader	2024-09-11 17:15:00 +02:00
Thorsten Roßner	246fbf4960	fix(nubus): Update migration to delete umc-server deployment.	2024-09-11 17:15:00 +02:00
Johannes Bornhold	31664a1803	fix(nubus): Update openDesk extension to version 1.2.1	2024-09-11 17:15:00 +02:00
Johannes Bornhold	5e2d28b90d	fix(nubus): Update to version 0.39.2 This does include a fix related to the UMC Server proxy in regard to issues around "too many open files".	2024-09-11 17:15:00 +02:00
Johannes Bornhold	579c303a5f	fix(nubus): Use the selfservice-invitation image out of the correct registry	2024-09-11 17:15:00 +02:00
Johannes Bornhold	c8aa5b8432	fix(nubus): Remove TODO note around the custom ldap server image	2024-09-11 17:15:00 +02:00
Johannes Bornhold	82e3e8aa0d	fix(nubus): Remove TODO note around dhInitcontainer	2024-09-11 17:15:00 +02:00
Johannes Bornhold	861009995d	fix(nubus): Use the newer keycloak-bootstrap image	2024-09-11 17:15:00 +02:00
Johannes Bornhold	df7bccef26	fix(nubus): Use the newer Keycloak image	2024-09-11 17:14:59 +02:00
Johannes Bornhold	5affcc0e29	fix(nubus): Remove stack gateway related image configuration	2024-09-11 17:14:59 +02:00
Johannes Bornhold	f45ef0740c	fix(nubus): Disable certManager	2024-09-11 17:14:59 +02:00
Johannes Bornhold	3bac7cafde	fix(nubus): Increase UMC Server limit	2024-09-11 17:14:59 +02:00
Johannes Bornhold	b635aa3a3c	feat(nubus): Update to Nubus 0.39.1 chart and images only	2024-09-11 17:14:59 +02:00
Jaime Conde	4cc0479876	fix(nubus): Drop umc-gateway menu unused patches	2024-09-11 17:14:59 +02:00
Johannes Bornhold	3fbf6c8bfd	fix(nubus): Support "ingress.tls.secretName"	2024-09-11 17:14:59 +02:00
Johannes Bornhold	b2e517afab	fix(nubus): Use cert-manager issuer name out of Helmfile values	2024-09-11 17:14:59 +02:00