feat: upgrade helm charts for nl portal and config panel

* fix minor issues in existing templating
* add support for nl-portal 3.0.x
* fix probes for nl-portal and configuration panel

Author: anna-ritense

README.md

@@ -36,6 +36,78 @@ helm upgrade --install nl-portal-backend nl-portal/nl-portal-backend \
 
 ### NL Portal
 
+#### 3.0.0
+
+**Breaking changes:**
+
+- `ingress.host` renamed to `ingress.hosts` (now a list) in nl-portal-backend and nl-portal-frontend
+- `settings.app.features.configurationPanel.enabled` now defaults to `false` — explicitly enable if using config panel
+- nl-portal-configpanel-backend: `secretEnvVars` pattern now coexists with new `existingSecret` option; both disable chart-managed Secret
+- nl-portal-configpanel-backend: fixed `settings.app.configServerToken` → use `settings.app.serverToken`
+- nl-portal-configpanel-backend: Secret now uses `stringData` (was broken `data` without base64 encoding)
+- nl-portal-configpanel chart version jumps from 1.x to 3.0.0 (aligns chart family with nl-portal major version)
+- `image.tag` default on configpanel charts changed from `"latest"` to `""` (uses appVersion)
+- HPA API updated from `autoscaling/v2beta1` to `autoscaling/v2`
+- Minimum Kubernetes version: 1.23 (`kubeVersion: ">=1.23.0"`)
+
+**New features:**
+
+Backend new env vars:
+- `CONFIGURATION_PANEL_APPLICATION_NAME` — application name for config panel integration
+- `NLPORTAL_CONFIG_CATALOGIAPI_PROPERTIES_DOCUMENTTYPEURL` — Catalogi API document type URL
+- `NLPORTAL_CONFIG_CATALOGIAPI_PROPERTIES_RSIN` — Catalogi API RSIN
+- `NLPORTAL_CONFIG_OPENKLANT2_PROPERTIES_CONTACTGEGEVENSAPIURL` — OpenKlant2 contact details API URL
+- `NLPORTAL_CONFIG_OPENPRODUCT_ENABLED` — enable OpenProduct module
+- `NLPORTAL_CONFIG_OPENPRODUCT_PROPERTIES_PRODUCTAPIURL` — OpenProduct product API URL
+- `NLPORTAL_CONFIG_OPENPRODUCT_PROPERTIES_PRODUCTTYPEAPIURL` — OpenProduct product type API URL
+- `NLPORTAL_CONFIG_OPENPRODUCT_PROPERTIES_TOKEN` — OpenProduct API token (secret)
+- `NLPORTAL_CONFIG_OPENPRODUCT_PROPERTIES_DMN_CLIENTID` — OpenProduct DMN client ID
+- `NLPORTAL_CONFIG_OPENPRODUCT_PROPERTIES_DMN_USERNAME` — OpenProduct DMN username
+- `NLPORTAL_CONFIG_OPENPRODUCT_PROPERTIES_DMN_SECRET` — OpenProduct DMN secret (secret)
+- `NLPORTAL_CONFIG_OPENPRODUCT_PROPERTIES_DMN_PASSWORD` — OpenProduct DMN password (secret)
+- `NLPORTAL_CONFIG_THEME_LOGO` — theme logo URL
+- `NLPORTAL_CONFIG_THEME_STYLE` — theme style configuration
+
+Frontend new env vars:
+- `USE_THEME_API` — whether to fetch theme from backend API
+- `OIDC_AUTO_IDLE_SESSION_LOGOUT` — enable automatic logout after idle timeout
+- `OIDC_IDLE_TIMEOUT_MINUTES` — idle timeout in minutes before automatic logout
+- `MESSAGE_COUNT_ENABLE` — enable message count polling
+
+Other improvements:
+- Frontend: `startupProbe`, `extraVolumes`/`extraVolumeMounts` support
+- HPA now supports memory metric via `autoscaling.targetMemoryUtilizationPercentage`
+- Backend probes now use proper `/actuator/health/*` endpoints instead of GraphQL
+
+**Migration:**
+
+```yaml
+# Ingress: host → hosts (backend and frontend)
+# Before (2.x)
+ingress:
+  host: "portal.example.com"
+
+# After (3.x)
+ingress:
+  hosts:
+    - portal.example.com
+```
+
+```yaml
+# Configpanel-backend: existingSecret option added
+# Before (2.x) - only secretEnvVars for external secrets
+secretEnvVars:
+  - name: DATABASE_PASSWORD
+    valueFrom:
+      secretKeyRef:
+        name: my-secret
+        key: password
+
+# After (3.x) - can also use existingSecret for whole secret
+existingSecret: my-secret
+# Or keep using secretEnvVars for partial secret injection
+```
+
 #### 2.1.0
 
 - Moved `NLPORTAL_CONFIG_ZAKENAPI_PROPERTIES_SECRET` and `NLPORTAL_CONFIG_CATALOGIAPI_PROPERTIES_SECRET` secrets from ConfigMap into Secret

charts/nl-portal-backend/nl-portal-backend/Chart.yaml

@@ -1,9 +1,10 @@
 apiVersion: v2
-appVersion: 2.x.y
+appVersion: 3.0.x
 description: Nl Portal backend Helm chart to be used in Kubernetes clusters.
+kubeVersion: ">=1.23.0"
 name: nl-portal-backend
 type: application
-version: 2.1.0
+version: 3.0.0
 
 dependencies:
   - name: postgresql

charts/nl-portal-backend/nl-portal-backend/templates/NOTES.txt

@@ -1,9 +1,8 @@
 1. Get the application URL by running these commands:
 {{- if .Values.ingress.enabled }}
-{{- range $host := .Values.ingress.hosts }}
-  {{- range .paths }}
-  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
-  {{- end }}
+{{- range .Values.ingress.hosts }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ . }}/graphql
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ . }}/api
 {{- end }}
 {{- else if contains "NodePort" .Values.service.type }}
   export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "nl-portal-backend.fullname" . }})

charts/nl-portal-backend/nl-portal-backend/templates/configmap.yaml

@@ -13,7 +13,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ template "nl-portal-backend.fullname" . }}
+  name: {{ include "nl-portal-backend.fullname" . }}
   labels:
     {{- include "nl-portal-backend.labels" . | nindent 4 }}
 data:
@@ -32,6 +32,7 @@ data:
 
   CONFIGURATION_PANEL_ENABLED: {{ .Values.settings.app.features.configurationPanel.enabled | quote }}
   CONFIGURATION_PANEL_URI: {{ .Values.settings.app.features.configurationPanel.uri | quote }}
+  CONFIGURATION_PANEL_APPLICATION_NAME: {{ .Values.settings.app.features.configurationPanel.applicationName | quote }}
 
   # Authentication
   NLPORTAL_AUTHENTICATION_MACHTINGSDIENST_RESOURCEURL: {{ .Values.settings.services.authentication.machtingsdienst.resourceUrl | quote }}
@@ -45,6 +46,8 @@ data:
   NLPORTAL_CONFIG_CATALOGIAPI_ENABLED: {{ .Values.settings.services.catalogiapi.enabled | quote }}
   NLPORTAL_CONFIG_CATALOGIAPI_PROPERTIES_URL: {{ .Values.settings.services.catalogiapi.properties.url | quote }}
   NLPORTAL_CONFIG_CATALOGIAPI_PROPERTIES_CLIENTID: {{ .Values.settings.services.catalogiapi.properties.clientId | quote }}
+  NLPORTAL_CONFIG_CATALOGIAPI_PROPERTIES_DOCUMENTTYPEURL: {{ .Values.settings.services.catalogiapi.properties.documentTypeUrl | quote }}
+  NLPORTAL_CONFIG_CATALOGIAPI_PROPERTIES_RSIN: {{ .Values.settings.services.catalogiapi.properties.rsin | quote }}
 
   # DocumentenAPIs
   NLPORTAL_CONFIG_DOCUMENTENAPIS_ENABLED: {{ .Values.settings.services.documentenapis.enabled | quote }}
@@ -79,6 +82,14 @@ data:
   # OpenKlant2
   NLPORTAL_CONFIG_OPENKLANT2_ENABLED: {{ .Values.settings.services.openklant2.enabled | quote }}
   NLPORTAL_CONFIG_OPENKLANT2_PROPERTIES_KLANTINTERACTIESAPIURL: {{ .Values.settings.services.openklant2.properties.klantinteractiesApiUrl | quote }}
+  NLPORTAL_CONFIG_OPENKLANT2_PROPERTIES_CONTACTGEGEVENSAPIURL: {{ .Values.settings.services.openklant2.properties.contactgegevensApiUrl | quote }}
+
+  # OpenProduct
+  NLPORTAL_CONFIG_OPENPRODUCT_ENABLED: {{ .Values.settings.services.openproduct.enabled | quote }}
+  NLPORTAL_CONFIG_OPENPRODUCT_PROPERTIES_PRODUCTAPIURL: {{ .Values.settings.services.openproduct.properties.productApiUrl | quote }}
+  NLPORTAL_CONFIG_OPENPRODUCT_PROPERTIES_PRODUCTTYPEAPIURL: {{ .Values.settings.services.openproduct.properties.productTypeApiUrl | quote }}
+  NLPORTAL_CONFIG_OPENPRODUCT_PROPERTIES_DMN_CLIENTID: {{ .Values.settings.services.openproduct.properties.dmn.clientId | quote }}
+  NLPORTAL_CONFIG_OPENPRODUCT_PROPERTIES_DMN_USERNAME: {{ .Values.settings.services.openproduct.properties.dmn.username | quote }}
 
   # HaalCentraal2
   NLPORTAL_CONFIG_HAALCENTRAAL2_ENABLED: {{ .Values.settings.services.haalcentraal2.enabled | quote }}
@@ -122,6 +133,10 @@ data:
   NLPORTAL_CONFIG_PREFILL_ENABLED: {{ .Values.settings.services.prefill.enabled | quote }}
   NLPORTAL_CONFIG_PREFILL_PROPERTIES_TYPEURL: {{ .Values.settings.services.prefill.properties.typeUrl | quote }}
 
+  # Theme
+  NLPORTAL_CONFIG_THEME_LOGO: {{ .Values.settings.theme.logo | quote }}
+  NLPORTAL_CONFIG_THEME_STYLE: {{ .Values.settings.theme.style | quote }}
+
   # Payment Direct
   NLPORTAL_CONFIG_PAYMENT_DIRECT_ENABLED: {{ .Values.settings.services.payment.direct.enabled | quote }}
   NLPORTAL_CONFIG_PAYMENT_DIRECT_PROPERTIES_URL: {{ .Values.settings.services.payment.direct.properties.url | quote }}

charts/nl-portal-backend/nl-portal-backend/templates/hpa.yaml

@@ -1,5 +1,5 @@
 {{- if .Values.autoscaling.enabled }}
-apiVersion: autoscaling/v2beta1
+apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
 metadata:
   name: {{ include "nl-portal-backend.fullname" . }}
@@ -13,16 +13,20 @@ spec:
   minReplicas: {{ .Values.autoscaling.minReplicas }}
   maxReplicas: {{ .Values.autoscaling.maxReplicas }}
   metrics:
-    {{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
+    {{- with .Values.autoscaling.targetCPUUtilizationPercentage }}
     - type: Resource
       resource:
         name: cpu
-        targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
+        target:
+          type: Utilization
+          averageUtilization: {{ . }}
     {{- end }}
-    {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
+    {{- with .Values.autoscaling.targetMemoryUtilizationPercentage }}
     - type: Resource
       resource:
         name: memory
-        targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
+        target:
+          type: Utilization
+          averageUtilization: {{ . }}
     {{- end }}
 {{- end }}

charts/nl-portal-backend/nl-portal-backend/templates/ingress.yaml

@@ -1,18 +1,6 @@
 {{- if .Values.ingress.enabled -}}
 {{- $fullName := include "nl-portal-backend.fullname" . -}}
-{{- $svcPort := .Values.service.port -}}
-{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
-  {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
-  {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}}
-  {{- end }}
-{{- end }}
-{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
 apiVersion: networking.k8s.io/v1
-{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
-apiVersion: networking.k8s.io/v1beta1
-{{- else -}}
-apiVersion: extensions/v1beta1
-{{- end }}
 kind: Ingress
 metadata:
   name: {{ $fullName }}
@@ -23,12 +11,12 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
 spec:
-  {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
-  ingressClassName: {{ .Values.ingress.className }}
+  {{- with .Values.ingress.className }}
+  ingressClassName: {{ . }}
   {{- end }}
-  {{- if .Values.ingress.tls }}
+  {{- with .Values.ingress.tls }}
   tls:
-    {{- range .Values.ingress.tls }}
+    {{- range . }}
     - hosts:
         {{- range .hosts }}
         - {{ . | quote }}
@@ -37,21 +25,23 @@ spec:
     {{- end }}
   {{- end }}
   rules:
-    - host: {{ .Values.ingress.host | quote }}
+    {{- range .Values.ingress.hosts }}
+    - host: {{ . | quote }}
       http:
         paths:
           - path: "/graphql"
             pathType: "Prefix"
             backend:
               service:
-                name: {{ include "nl-portal-backend.fullname" . }}
+                name: {{ $fullName }}
                 port:
                   name: http
           - path: "/api"
             pathType: "Prefix"
             backend:
               service:
-                name: {{ include "nl-portal-backend.fullname" . }}
+                name: {{ $fullName }}
                 port:
                   name: http
+    {{- end }}
 {{- end }}

charts/nl-portal-backend/nl-portal-backend/templates/secret.yaml

@@ -35,6 +35,11 @@ stringData:
   # OpenKlant2
   NLPORTAL_CONFIG_OPENKLANT2_PROPERTIES_TOKEN: {{ .Values.settings.services.openklant2.properties.token | quote }}
 
+  # OpenProduct
+  NLPORTAL_CONFIG_OPENPRODUCT_PROPERTIES_TOKEN: {{ .Values.settings.services.openproduct.properties.token | quote }}
+  NLPORTAL_CONFIG_OPENPRODUCT_PROPERTIES_DMN_SECRET: {{ .Values.settings.services.openproduct.properties.dmn.secret | quote }}
+  NLPORTAL_CONFIG_OPENPRODUCT_PROPERTIES_DMN_PASSWORD: {{ .Values.settings.services.openproduct.properties.dmn.password | quote }}
+
   # HaalCentraal BRP
   NLPORTAL_CONFIG_HAALCENTRAAL_BRP_PROPERTIES_APIKEY: {{ .Values.settings.services.haalcentraal_brp.properties.apiKey | quote }}
   NLPORTAL_CONFIG_HAALCENTRAAL_BRP_PROPERTIES_SSL_KEY_KEY: {{ .Values.settings.services.haalcentraal_brp.properties.ssl.key.key | quote }}

charts/nl-portal-backend/nl-portal-backend/values.yaml

@@ -47,40 +47,37 @@ service:
 ingress:
   enabled: false
   className: ""
-  annotations:
-    {}
+  annotations: {}
     # kubernetes.io/ingress.class: nginx
     # kubernetes.io/tls-acme: "true"
-  host: your-nl-portal.example.com
-
+  hosts:
+    - your-nl-portal.example.com
   tls: []
   #  - secretName: chart-example-tls
   #    hosts:
   #      - chart-example.local
 
 startupProbe:
   httpGet:
-    path: /graphql?query=%7B__typename%7D
+    path: /actuator/health
     port: http
   failureThreshold: 90
   periodSeconds: 10
 livenessProbe:
-  enabled: true
   httpGet:
-    path: /graphql?query=%7B__typename%7D
+    path: /actuator/health/liveness
     port: http
-  initialDelaySeconds: 120
+  initialDelaySeconds: 10
   periodSeconds: 10
   timeoutSeconds: 1
   failureThreshold: 6
   successThreshold: 1
 
 readinessProbe:
-  enabled: true
   httpGet:
-    path: /graphql?query=%7B__typename%7D
+    path: /actuator/health/readiness
     port: http
-  initialDelaySeconds: 120
+  initialDelaySeconds: 10
   periodSeconds: 10
   timeoutSeconds: 1
   failureThreshold: 6
@@ -190,10 +187,11 @@ settings:
         unsecured: ""
     features:
       configurationPanel:
-        enabled: true
+        enabled: false
         uri: ""
         # -- If using existingSecret, set via key: CONFIGURATION_PANEL_TOKEN
         token:
+        applicationName: ""
 
 
   services:
@@ -216,6 +214,8 @@ settings:
         clientId: ""
         # -- If using existingSecret, set via key: NLPORTAL_CONFIG_CATALOGIAPI_PROPERTIES_SECRET
         secret: ""
+        documentTypeUrl: ""
+        rsin: ""
 
     documentenapis:
       enabled: false
@@ -273,6 +273,22 @@ settings:
         klantinteractiesApiUrl: ""
         # -- If using existingSecret, set via key: NLPORTAL_CONFIG_OPENKLANT2_PROPERTIES_TOKEN
         token: ""
+        contactgegevensApiUrl: ""
+
+    openproduct:
+      enabled: false
+      properties:
+        productApiUrl: ""
+        productTypeApiUrl: ""
+        # -- If using existingSecret, set via key: NLPORTAL_CONFIG_OPENPRODUCT_PROPERTIES_TOKEN
+        token: ""
+        dmn:
+          clientId: ""
+          # -- If using existingSecret, set via key: NLPORTAL_CONFIG_OPENPRODUCT_PROPERTIES_DMN_SECRET
+          secret: ""
+          username: ""
+          # -- If using existingSecret, set via key: NLPORTAL_CONFIG_OPENPRODUCT_PROPERTIES_DMN_PASSWORD
+          password: ""
 
     haalcentraal2:
       enabled: false
@@ -380,3 +396,7 @@ settings:
               shaOutKey: ""
               failureUrl: ""
               successUrl: ""
+
+  theme:
+    logo: ""
+    style: ""

charts/nl-portal-configpanel-backend/nl-portal-configpanel-backend/Chart.yaml

@@ -1,6 +1,7 @@
 apiVersion: v2
 appVersion: 2.0.0
 description: NL-Portal Configuration Panel Helm chart to be used in Kubernetes clusters.
+kubeVersion: ">=1.23.0"
 name: nl-portal-configpanel-backend
 type: application
-version: 1.0.2
+version: 3.0.0

charts/nl-portal-configpanel-backend/nl-portal-configpanel-backend/templates/configmap.yaml

@@ -1,13 +1,12 @@
----
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ template "nl-portal-configpanel-backend.fullname" . }}
+  name: {{ include "nl-portal-configpanel-backend.fullname" . }}
   labels:
     {{- include "nl-portal-configpanel-backend.labels" . | nindent 4 }}
 data:
   LOGLEVEL: {{ .Values.settings.app.logLevel | quote }}
-  DATABASE_URL: {{ .Values.settings.database.url | quote }}
+  DATABASE_URL: {{ required "You must set settings.database.url" .Values.settings.database.url | quote }}
   JWKS_URI: {{ .Values.settings.auth.jwksURI | quote }}
   CONFIG_SERVER_PREFIX: {{ .Values.settings.app.serverPrefix | quote }}
   CONFIG_CACHE_TTL: {{ .Values.settings.app.cacheTTL | quote }}