ci(backend): Oracle host/servicename from env-scoped secrets; security always on

ORACLEDB_HOST and ORACLEDB_SERVICENAME move from GitHub vars to secrets,
passed through the init job (env-scoped secrets don't resolve in the
deploy matrix) into the backend Secret and read via secretKeyRef.
ILCR_SECURITY_ENABLED is no longer parameterized: deployed pods hardcode
"true" so auth can never be switched off from CI config.

Author: kamal-mohammed

.github/workflows/reusable-deploy.yml

@@ -45,6 +45,8 @@ jobs:
     env:
       DB_USER: ${{ secrets.ORACLEDB_USERNAME }}
       DB_PASS: ${{ secrets.ORACLEDB_PASSWORD }}
+      DB_HOST: ${{ secrets.ORACLEDB_HOST }}
+      DB_SERVICENAME: ${{ secrets.ORACLEDB_SERVICENAME }}
       COGNITO_POOL: ${{ secrets.USER_POOLS_ID }}
       COGNITO_CLIENT: ${{ secrets.USER_POOLS_WEB_CLIENT_ID }}
     steps:
@@ -67,6 +69,8 @@ jobs:
             -p NAME='${{ github.event.repository.name }}'
             -p SPRING_DATASOURCE_USERNAME="$DB_USER"
             -p SPRING_DATASOURCE_PASSWORD="$DB_PASS"
+            -p ORACLEDB_HOST="$DB_HOST"
+            -p ORACLEDB_SERVICENAME="$DB_SERVICENAME"
             -p COGNITO_USER_POOL="$COGNITO_POOL"
             -p COGNITO_CLIENT_ID="$COGNITO_CLIENT"
             -p COGNITO_DOMAIN='${{ vars.COGNITO_DOMAIN || 'lza-prod-fam-user-pool-domain.auth.ca-central-1.amazoncognito.com' }}'
@@ -87,16 +91,13 @@ jobs:
         include:
           - name: backend
             file: backend/openshift.deploy.yml
-            # Security and datasource flags come from GitHub vars, resolved
-            # environment-first, and FAIL CLOSED: auth is enforced unless a
-            # var explicitly opts a scope out. The backend refuses to start
-            # with security off and the datasource on (DeployedSecurityGuard),
-            # so a mock-auth deployment requires disabling both — mock auth
-            # never fronts real data.
+            # Oracle host/servicename are environment-scoped SECRETS, passed
+            # through the init job above (env-scoped secrets don't resolve in
+            # this matrix — GitHub evaluates it before the environment
+            # attaches) into the backend Secret. ILCR_SECURITY_ENABLED is
+            # hardcoded "true" in the backend template — deployed pods always
+            # enforce auth.
             parameters: -p IMAGE_TAG="${{ inputs.tag }}"
-              -p ORACLEDB_HOST="${{ vars.ORACLEDB_HOST }}"
-              -p ORACLEDB_SERVICENAME="${{ vars.ORACLEDB_SERVICENAME }}"
-              -p ILCR_SECURITY_ENABLED="${{ vars.ILCR_SECURITY_ENABLED || 'true' }}"
               -p ILCR_DATASOURCE_ENABLED="${{ vars.ILCR_DATASOURCE_ENABLED || 'true' }}"
           - name: frontend
             file: frontend/openshift.deploy.yml

backend/openshift.deploy.yml

@@ -35,24 +35,18 @@ parameters:
   - name: MEMORY_LIMIT
     description: Container memory limit; the JVM heap sizes itself from this cgroup limit via MaxRAMPercentage (see backend/Dockerfile). Raised for the embedded JasperReports 7 engine (Batik/OpenPDF/fonts add classpath + metaspace + native AWT footprint) per AD-16 "size the reporting path's pod CPU/Mem".
     value: "1Gi"
-  - name: ILCR_SECURITY_ENABLED
-    description: Enforce Cognito (FAM) JWT auth. "false" installs MockPrincipalFilter, treating every request as an authenticated ILCR_SUBMITTER; DeployedSecurityGuard refuses to start a deployed pod with security off and the datasource on. Fail-closed default.
-    value: "true"
   - name: ILCR_DATASOURCE_ENABLED
-    description: Connect to the Oracle datasource. Set "false" together with ILCR_SECURITY_ENABLED="false" for a data-less mock-auth smoke deployment.
+    description: Connect to the Oracle datasource. Set "false" for a data-less smoke deployment. Deployed pods always enforce Cognito (FAM) JWT auth — ILCR_SECURITY_ENABLED is hardcoded "true" below, not parameterized.
     value: "true"
   - name: LOG_LEVEL
     description: Application log level (debug|info|warn|error)
     value: "info"
-  - name: ORACLEDB_HOST
-    description: Oracle database host; the init container fetches its TCPS cert
-    required: true
+  # ORACLEDB_HOST / ORACLEDB_SERVICENAME are not parameters: they come from
+  # environment-scoped GitHub secrets via the init-created backend Secret
+  # (common/openshift.init.yml), read below with secretKeyRef.
   - name: ORACLEDB_PORT
     description: Oracle database TCPS port
     value: "1543"
-  - name: ORACLEDB_SERVICENAME
-    description: Oracle database service name
-    required: true
   - name: COGNITO_REGION
     description: AWS region of the Cognito (FAM) user pool
     value: ca-central-1
@@ -94,7 +88,10 @@ objects:
               imagePullPolicy: Always
               env:
                 - name: ORACLEDB_HOST
-                  value: ${ORACLEDB_HOST}
+                  valueFrom:
+                    secretKeyRef:
+                      name: ${NAME}-${ZONE}-${COMPONENT}
+                      key: ORACLEDB_HOST
                 - name: ORACLEDB_PORT
                   value: ${ORACLEDB_PORT}
                 - name: ORACLEDB_SECRET
@@ -137,15 +134,21 @@ objects:
                 - name: APP_VERSION
                   value: ${IMAGE_TAG}
                 - name: ILCR_SECURITY_ENABLED
-                  value: ${ILCR_SECURITY_ENABLED}
+                  value: "true"
                 - name: ILCR_DATASOURCE_ENABLED
                   value: ${ILCR_DATASOURCE_ENABLED}
                 - name: ORACLEDB_HOST
-                  value: ${ORACLEDB_HOST}
+                  valueFrom:
+                    secretKeyRef:
+                      name: ${NAME}-${ZONE}-${COMPONENT}
+                      key: ORACLEDB_HOST
                 - name: ORACLEDB_PORT
                   value: ${ORACLEDB_PORT}
                 - name: ORACLEDB_SERVICENAME
-                  value: ${ORACLEDB_SERVICENAME}
+                  valueFrom:
+                    secretKeyRef:
+                      name: ${NAME}-${ZONE}-${COMPONENT}
+                      key: ORACLEDB_SERVICENAME
                 - name: ORACLEDB_KEYSTORE
                   value: /cert/jssecacerts
                 - name: COGNITO_REGION

common/openshift.init.yml

@@ -19,6 +19,12 @@ parameters:
   - name: ORACLEDB_KEYSTORE_SECRET
     description: Password for the Oracle keystore built by the backend init container
     value: changeit
+  - name: ORACLEDB_HOST
+    description: Oracle database host (environment-scoped GitHub secret)
+    required: true
+  - name: ORACLEDB_SERVICENAME
+    description: Oracle database service name (environment-scoped GitHub secret)
+    required: true
   - name: COGNITO_USER_POOL
     description: Cognito (FAM) user pool ID for JWT validation
     required: true
@@ -62,6 +68,8 @@ objects:
       SPRING_DATASOURCE_USERNAME: ${SPRING_DATASOURCE_USERNAME}
       SPRING_DATASOURCE_PASSWORD: ${SPRING_DATASOURCE_PASSWORD}
       ORACLEDB_KEYSTORE_SECRET: ${ORACLEDB_KEYSTORE_SECRET}
+      ORACLEDB_HOST: ${ORACLEDB_HOST}
+      ORACLEDB_SERVICENAME: ${ORACLEDB_SERVICENAME}
       COGNITO_USER_POOL: ${COGNITO_USER_POOL}
       COGNITO_CLIENT_ID: ${COGNITO_CLIENT_ID}