Skip to content

Commit f26cf5c

Browse files
Salatondotasekjschneid-nmdpjamesagnewchgl
authored
Sync fork (#5)
* Bump to HAPI 7.7.7-SNAPSHOT * Update HAPI + match config changes * Bump HAPI to 7.7.10-SNAPSHOT * Bump parent to 7.7.14-SNAPSHOT * Bump parent version + fix CQL test See diff in https://github.com/cqframework/clinical-reasoning/pull/579/files * Bump parent to 7.7.18-SNAPSHOT fix CR breakage * use URI constructor instead of string concatenation, to avoid having static code analysis tool complain about "Concatenating user-controlled input into a URL" security issue * Add support for Database Partition Mode * Add spotless-check * Apply spotless * Apply spotless * Revert "Apply spotless" This reverts commit 8b77aa0. * Test fix * Spotless * Helm chart dependency updates and support for extraVolumes and -Mounts (hapifhir#766) * Helm chart updates * set target branch to master for chart testing * Bump to release * Expose expansion properties as configuration * Externalizes more subscription parameters (hapifhir#783) * Externalizes more subscription parameters Allows : - to parametrize the polling interval of subscription - to enable the setting to queue the subscription jobs immediately. Following the change in hapifhir/hapi-fhir/pull/6395 * Fix formatting * feat: add a github actions deploy workflow * chore: deploy hapi fhir staging and production instance * chore: use UUIDs for resource IDs * feat: updating FHIR version from R4 to R5 --------- Co-authored-by: dotasek.dev <[email protected]> Co-authored-by: dotasek <[email protected]> Co-authored-by: Joel Schneider <[email protected]> Co-authored-by: James Agnew <[email protected]> Co-authored-by: chgl <[email protected]> Co-authored-by: Adam Stevenson <[email protected]> Co-authored-by: Yoann Isaac <[email protected]> Co-authored-by: Kennedy Omondi <[email protected]>
1 parent 141fb2b commit f26cf5c

37 files changed

+1399
-922
lines changed

.github/ct/config.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,3 +12,4 @@ upgrade: true
1212
skip-missing-values: true
1313
release-label: release
1414
release-name-template: "helm-v{{ .Version }}"
15+
target-branch: master

.github/workflows/chart-test.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ on:
1010
jobs:
1111
lint:
1212
runs-on: ubuntu-22.04
13-
container: quay.io/helmpack/chart-testing:v3.10.1@sha256:7d8a7f99fc5840142249cc33ed6d9752fc66b92f9e1bf792d987ee85227d84da
13+
container: quay.io/helmpack/chart-testing:v3.11.0@sha256:f2fd21d30b64411105c7eafb1862783236a219d29f2292219a09fe94ca78ad2a
1414
steps:
1515
- name: Install helm-docs
1616
working-directory: /tmp
@@ -38,7 +38,7 @@ jobs:
3838
runs-on: ubuntu-22.04
3939
strategy:
4040
matrix:
41-
k8s-version: [1.29.8, 1.30.4, 1.31.0]
41+
k8s-version: [1.30.8, 1.31.4, 1.32.0]
4242
needs:
4343
- lint
4444
steps:
Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: mvn spotless:check (Formatting)
2+
3+
4+
on:
5+
pull_request:
6+
types: [opened, reopened, synchronize]
7+
8+
jobs:
9+
format-check:
10+
runs-on: ubuntu-latest
11+
permissions:
12+
pull-requests: write
13+
steps:
14+
- uses: actions/checkout@v3
15+
- name: Set up JDK 17
16+
uses: actions/setup-java@v3
17+
with:
18+
java-version: '17'
19+
distribution: 'temurin'
20+
- name: spotless:check
21+
run: mvn spotless:check
22+
- uses: mshick/add-pr-comment@v2
23+
if: always()
24+
with:
25+
message-success: |
26+
Formatting check succeeded!
27+
message-failure: |
28+
**This Pull Request has failed the formatting check**
29+
30+
Please run `mvn spotless:apply` or `mvn clean install -DskipTests` to fix the formatting issues.
31+
32+
You can automate this auto-formatting process to execute on the git pre-push hook, by installing [pre-commit](https://pre-commit.com/) and then calling `pre-commit install --hook-type pre-push`. This will cause formatting to run automatically whenever you push.

charts/hapi-fhir-jpaserver/Chart.yaml

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,14 @@ annotations:
2020
# When using the list of objects option the valid supported kinds are
2121
# added, changed, deprecated, removed, fixed, and security.
2222
- kind: changed
23-
description: updated curlimages/curl to 8.9.1
23+
description: "updated postgresql sub-chart to 16.3.2"
2424
- kind: changed
25-
description: "updated postgresql sub-chart to 15.5.22."
25+
description: "updated curlimages/curl to 8.11.1"
26+
- kind: changed
27+
description: "updated hapiproject/hapi to 7.6.0"
28+
- kind: added
29+
description: "support for setting resource limits and requests from presets. With a default set for all containers"
30+
- kind: added
31+
description: "support for setting extra volumes and volume mounts"
32+
- kind: changed
33+
description: "set default pod security context for main and test pods"

charts/hapi-fhir-jpaserver/README.md

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# HAPI FHIR JPA Server Starter Helm Chart
22

3-
![Version: 0.17.1](https://img.shields.io/badge/Version-0.17.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 7.2.0](https://img.shields.io/badge/AppVersion-7.2.0-informational?style=flat-square)
3+
![Version: 0.18.0](https://img.shields.io/badge/Version-0.18.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 7.6.0](https://img.shields.io/badge/AppVersion-7.6.0-informational?style=flat-square)
44

55
This helm chart will help you install the HAPI FHIR JPA Server in a Kubernetes environment.
66

@@ -15,7 +15,8 @@ helm install hapi-fhir-jpaserver hapifhir/hapi-fhir-jpaserver
1515

1616
| Repository | Name | Version |
1717
|------------|------|---------|
18-
| oci://registry-1.docker.io/bitnamicharts | postgresql | 15.5.22 |
18+
| oci://registry-1.docker.io/bitnamicharts | common | 2.28.0 |
19+
| oci://registry-1.docker.io/bitnamicharts | postgresql | 16.3.2 |
1920

2021
## Values
2122

@@ -32,18 +33,22 @@ helm install hapi-fhir-jpaserver hapifhir/hapi-fhir-jpaserver
3233
| externalDatabase.user | string | `"fhir"` | username for the external database |
3334
| extraConfig | string | `""` | additional Spring Boot application config. Mounted as a file and automatically loaded by the application. |
3435
| extraEnv | list | `[]` | extra environment variables to set on the server container |
36+
| extraVolumeMounts | list | `[]` | Optionally specify extra list of additional volumeMounts |
37+
| extraVolumes | list | `[]` | Optionally specify extra list of additional volumes |
3538
| fullnameOverride | string | `""` | override the chart fullname |
3639
| image.pullPolicy | string | `"IfNotPresent"` | image pullPolicy to use |
3740
| image.registry | string | `"docker.io"` | registry where the HAPI FHIR server image is hosted |
3841
| image.repository | string | `"hapiproject/hapi"` | the path inside the repository |
39-
| image.tag | string | `"v7.2.0@sha256:9bcafa8342b572eee248cb7c48c496863d352bbd0347e1d98ea238d09620e89b"` | the image tag. As of v5.7.0, this is the `distroless` flavor by default, add `-tomcat` to use the Tomcat-based image. |
42+
| image.tag | string | `"v7.6.0@sha256:4771a178e764896c83881c1b3a52bd487e53d06e1acc3653ea0db0c6f6b2b8a1"` | the image tag. As of v5.7.0, this is the `distroless` flavor by default, add `-tomcat` to use the Tomcat-based image. |
4043
| imagePullSecrets | list | `[]` | image pull secrets to use when pulling the image |
4144
| ingress.annotations | object | `{}` | provide any additional annotations which may be required. Evaluated as a template. |
4245
| ingress.enabled | bool | `false` | whether to create an Ingress to expose the FHIR server HTTP endpoint |
4346
| ingress.hosts[0].host | string | `"fhir-server.127.0.0.1.nip.io"` | |
4447
| ingress.hosts[0].pathType | string | `"ImplementationSpecific"` | |
4548
| ingress.hosts[0].paths[0] | string | `"/"` | |
4649
| ingress.tls | list | `[]` | ingress TLS config |
50+
| initContainers.resources | object | `{}` | configure the init containers pods resource requests and limits |
51+
| initContainers.resourcesPreset | string | `"nano"` | set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if `resources` is set (`resources` is recommended for production). More information: <https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15> |
4752
| metrics.service.port | int | `8081` | |
4853
| metrics.serviceMonitor.additionalLabels | object | `{}` | additional labels to apply to the ServiceMonitor object, e.g. `release: prometheus` |
4954
| metrics.serviceMonitor.enabled | bool | `false` | if enabled, creates a ServiceMonitor instance for Prometheus Operator-based monitoring |
@@ -53,12 +58,13 @@ helm install hapi-fhir-jpaserver hapifhir/hapi-fhir-jpaserver
5358
| podDisruptionBudget.enabled | bool | `false` | Enable PodDisruptionBudget for the server pods. uses policy/v1/PodDisruptionBudget thus requiring k8s 1.21+ |
5459
| podDisruptionBudget.maxUnavailable | string | `""` | maximum unavailable instances |
5560
| podDisruptionBudget.minAvailable | int | `1` | minimum available instances |
56-
| podSecurityContext | object | `{}` | pod security context |
61+
| podSecurityContext | object | `{"fsGroup":65532,"fsGroupChangePolicy":"OnRootMismatch","runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}` | pod security context |
5762
| postgresql.auth.database | string | `"fhir"` | name for a custom database to create |
5863
| postgresql.auth.existingSecret | string | `""` | Name of existing secret to use for PostgreSQL credentials `auth.postgresPassword`, `auth.password`, and `auth.replicationPassword` will be ignored and picked up from this secret The secret must contain the keys `postgres-password` (which is the password for "postgres" admin user), `password` (which is the password for the custom user to create when `auth.username` is set), and `replication-password` (which is the password for replication user). The secret might also contains the key `ldap-password` if LDAP is enabled. `ldap.bind_password` will be ignored and picked from this secret in this case. The value is evaluated as a template. |
5964
| postgresql.enabled | bool | `true` | enable an included PostgreSQL DB. see <https://github.com/bitnami/charts/tree/master/bitnami/postgresql> for details if set to `false`, the values under `externalDatabase` are used |
6065
| replicaCount | int | `1` | number of replicas to deploy |
6166
| resources | object | `{}` | configure the FHIR server's resource requests and limits |
67+
| resourcesPreset | string | `"medium"` | set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if `resources` is set (`resources` is recommended for production). More information: <https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15> |
6268
| securityContext.allowPrivilegeEscalation | bool | `false` | |
6369
| securityContext.capabilities.drop[0] | string | `"ALL"` | |
6470
| securityContext.privileged | bool | `false` | |
@@ -75,6 +81,7 @@ helm install hapi-fhir-jpaserver hapifhir/hapi-fhir-jpaserver
7581
| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
7682
| tests.automountServiceAccountToken | bool | `false` | whether the service account token should be auto-mounted for the test pods |
7783
| tests.resources | object | `{}` | configure the test pods resource requests and limits |
84+
| tests.resourcesPreset | string | `"nano"` | set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if `resources` is set (`resources` is recommended for production). More information: <https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15> |
7885
| tolerations | list | `[]` | pod tolerations |
7986
| topologySpreadConstraints | list | `[]` | pod topology spread configuration see: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#api |
8087

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
extraVolumes:
2+
- name: config-kube-root-ca
3+
configMap:
4+
name: kube-root-ca.crt
5+
items:
6+
- key: ca.crt
7+
path: ca.crt
8+
9+
extraVolumeMounts:
10+
- name: config-kube-root-ca
11+
mountPath: /etc/test

charts/hapi-fhir-jpaserver/templates/deployment.yaml

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,12 +31,17 @@ spec:
3131
{{- toYaml .Values.podSecurityContext | nindent 8 }}
3232
initContainers:
3333
- name: wait-for-db-to-be-ready
34-
image: docker.io/bitnami/postgresql:16.4.0-debian-12-r1@sha256:fb3d0a34e7b9f3e59442aa1fa2e6377857147c09ae754ddd5d4bb3fc0dd137da
34+
image: docker.io/bitnami/postgresql:17.2.0-debian-12-r3@sha256:4de5c47eb98dd8fe09abdcbc2264984486ee8196e90902fb354f5d2ab97e8921
3535
imagePullPolicy: IfNotPresent
3636
{{- with .Values.restrictedContainerSecurityContext }}
3737
securityContext:
3838
{{- toYaml . | nindent 12 }}
3939
{{- end }}
40+
{{- if .Values.initContainers.resources }}
41+
resources: {{- toYaml .Values.initContainers.resources | nindent 12 }}
42+
{{- else if ne .Values.initContainers.resourcesPreset "none" }}
43+
resources: {{- include "common.resources.preset" (dict "type" .Values.initContainers.resourcesPreset) | nindent 12 }}
44+
{{- end }}
4045
env:
4146
- name: PGHOST
4247
value: "{{ include "hapi-fhir-jpaserver.database.host" . }}"
@@ -76,8 +81,11 @@ spec:
7681
readinessProbe:
7782
{{- toYaml . | nindent 12 }}
7883
{{- end }}
79-
resources:
80-
{{- toYaml .Values.resources | nindent 12 }}
84+
{{- if .Values.resources }}
85+
resources: {{- toYaml .Values.resources | nindent 12 }}
86+
{{- else if ne .Values.resourcesPreset "none" }}
87+
resources: {{- include "common.resources.preset" (dict "type" .Values.resourcesPreset) | nindent 12 }}
88+
{{- end }}
8189
env:
8290
- name: SPRING_DATASOURCE_URL
8391
value: {{ include "hapi-fhir-jpaserver.database.jdbcUrl" $ }}
@@ -98,6 +106,8 @@ spec:
98106
value: "true"
99107
- name: MANAGEMENT_SERVER_PORT
100108
value: "8081"
109+
- name: MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE
110+
value: "health,prometheus"
101111
{{- if .Values.extraConfig }}
102112
- name: SPRING_CONFIG_IMPORT
103113
value: "/app/config/application-extra.yaml"
@@ -116,6 +126,9 @@ spec:
116126
readOnly: true
117127
subPath: application-extra.yaml
118128
{{- end }}
129+
{{- if .Values.extraVolumeMounts }}
130+
{{- include "common.tplvalues.render" (dict "value" .Values.extraVolumeMounts "context" $) | nindent 12 }}
131+
{{- end }}
119132
{{- with .Values.nodeSelector }}
120133
nodeSelector:
121134
{{- toYaml . | nindent 8 }}
@@ -142,3 +155,6 @@ spec:
142155
configMap:
143156
name: {{ include "hapi-fhir-jpaserver.fullname" . }}-application-config
144157
{{- end }}
158+
{{- if .Values.extraVolumes }}
159+
{{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 8 }}
160+
{{- end }}

charts/hapi-fhir-jpaserver/templates/tests/test-endpoints.yaml

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,14 @@ metadata:
55
labels:
66
{{- include "hapi-fhir-jpaserver.labels" . | nindent 4 }}
77
{{ include "hapi-fhir-jpaserver.fullname" . }}-client: "true"
8+
app.kubernetes.io/component: tests
89
annotations:
910
"helm.sh/hook": test
1011
spec:
1112
restartPolicy: Never
1213
automountServiceAccountToken: {{ .Values.tests.automountServiceAccountToken }}
14+
securityContext:
15+
{{- toYaml .Values.tests.podSecurityContext | nindent 4 }}
1316
containers:
1417
- name: test-metadata-endpoint
1518
image: "{{ .Values.curl.image.registry }}/{{ .Values.curl.image.repository }}:{{ .Values.curl.image.tag }}"
@@ -19,9 +22,10 @@ spec:
1922
securityContext:
2023
{{- toYaml . | nindent 8 }}
2124
{{- end }}
22-
{{- with .Values.tests.resources }}
23-
resources:
24-
{{- toYaml . | nindent 8 }}
25+
{{- if .Values.tests.resources }}
26+
resources: {{- toYaml .Values.tests.resources | nindent 10 }}
27+
{{- else if ne .Values.tests.resourcesPreset "none" }}
28+
resources: {{- include "common.resources.preset" (dict "type" .Values.tests.resourcesPreset) | nindent 10 }}
2529
{{- end }}
2630
livenessProbe:
2731
exec:
@@ -37,9 +41,10 @@ spec:
3741
securityContext:
3842
{{- toYaml . | nindent 8 }}
3943
{{- end }}
40-
{{- with .Values.tests.resources }}
41-
resources:
42-
{{- toYaml . | nindent 8 }}
44+
{{- if .Values.tests.resources }}
45+
resources: {{- toYaml .Values.tests.resources | nindent 10 }}
46+
{{- else if ne .Values.tests.resourcesPreset "none" }}
47+
resources: {{- include "common.resources.preset" (dict "type" .Values.tests.resourcesPreset) | nindent 10 }}
4348
{{- end }}
4449
livenessProbe:
4550
exec:
@@ -55,9 +60,10 @@ spec:
5560
securityContext:
5661
{{- toYaml . | nindent 8 }}
5762
{{- end }}
58-
{{- with .Values.tests.resources }}
59-
resources:
60-
{{- toYaml . | nindent 8 }}
63+
{{- if .Values.tests.resources }}
64+
resources: {{- toYaml .Values.tests.resources | nindent 10 }}
65+
{{- else if ne .Values.tests.resourcesPreset "none" }}
66+
resources: {{- include "common.resources.preset" (dict "type" .Values.tests.resourcesPreset) | nindent 10 }}
6167
{{- end }}
6268
livenessProbe:
6369
exec:

charts/hapi-fhir-jpaserver/values.yaml

Lines changed: 45 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,13 @@ podAnnotations: {}
2828

2929
# -- pod security context
3030
podSecurityContext:
31-
{}
32-
# fsGroup: 2000
31+
fsGroupChangePolicy: OnRootMismatch
32+
runAsNonRoot: true
33+
runAsGroup: 65532
34+
runAsUser: 65532
35+
fsGroup: 65532
36+
seccompProfile:
37+
type: RuntimeDefault
3338

3439
securityContext:
3540
allowPrivilegeEscalation: false
@@ -71,6 +76,10 @@ ingress:
7176
- secretName: ""
7277
hosts:
7378
- ""
79+
# -- set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge).
80+
# This is ignored if `resources` is set (`resources` is recommended for production).
81+
# More information: <https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15>
82+
resourcesPreset: "medium"
7483

7584
# -- configure the FHIR server's resource requests and limits
7685
resources:
@@ -244,11 +253,15 @@ curl:
244253
image:
245254
registry: docker.io
246255
repository: curlimages/curl
247-
tag: 8.9.1@sha256:8addc281f0ea517409209f76832b6ddc2cabc3264feb1ebbec2a2521ffad24e4
256+
tag: 8.11.1@sha256:c1fe1679c34d9784c1b0d1e5f62ac0a79fca01fb6377cdd33e90473c6f9f9a69
248257

249258
tests:
250259
# -- whether the service account token should be auto-mounted for the test pods
251260
automountServiceAccountToken: false
261+
# -- set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge).
262+
# This is ignored if `resources` is set (`resources` is recommended for production).
263+
# More information: <https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15>
264+
resourcesPreset: "nano"
252265
# -- configure the test pods resource requests and limits
253266
resources: {}
254267
# limits:
@@ -257,6 +270,29 @@ tests:
257270
# requests:
258271
# cpu: 100m
259272
# memory: 128Mi
273+
# @ignored
274+
podSecurityContext:
275+
fsGroupChangePolicy: OnRootMismatch
276+
runAsNonRoot: true
277+
runAsGroup: 65532
278+
runAsUser: 65532
279+
fsGroup: 65532
280+
seccompProfile:
281+
type: RuntimeDefault
282+
283+
initContainers:
284+
# -- set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge).
285+
# This is ignored if `resources` is set (`resources` is recommended for production).
286+
# More information: <https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15>
287+
resourcesPreset: "nano"
288+
# -- configure the init containers pods resource requests and limits
289+
resources: {}
290+
# limits:
291+
# cpu: 100m
292+
# memory: 128Mi
293+
# requests:
294+
# cpu: 100m
295+
# memory: 128Mi
260296

261297
# -- additional Spring Boot application config. Mounted as a file and automatically loaded by the application.
262298
extraConfig:
@@ -270,3 +306,9 @@ extraConfig:
270306
# url: https://build.fhir.org/ig/hl7-eu/gravitate-health/package.tgz
271307
# name: hl7.eu.fhir.gh
272308
# version: 0.1.0
309+
310+
# -- Optionally specify extra list of additional volumes
311+
extraVolumes: []
312+
313+
# -- Optionally specify extra list of additional volumeMounts
314+
extraVolumeMounts: []

pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
<parent>
1515
<groupId>ca.uhn.hapi.fhir</groupId>
1616
<artifactId>hapi-fhir</artifactId>
17-
<version>7.6.0</version>
17+
<version>8.0.0</version>
1818
</parent>
1919

2020
<artifactId>hapi-fhir-jpaserver-starter</artifactId>

0 commit comments

Comments
 (0)