TIBCOSoftware · cmoeller-tibco · Jan 25, 2025 · Jan 24, 2025
diff --git a/charts/msg-ems-tp/Chart.yaml b/charts/msg-ems-tp/Chart.yaml
@@ -1,14 +1,14 @@
 #
-# Copyright (c) 2023-2024. Cloud Software Group, Inc.
+# Copyright (c) 2023-2025. Cloud Software Group, Inc.
 # This file is subject to the license terms contained
 # in the license file that is distributed with this file.
 #
 
 apiVersion: v2
-appVersion: "10.3.0-35"
+appVersion: "10.3.0-36"
 description: Data-plane provisioning chart for EMS server group
 name: msg-ems-tp
-version: "1.3.18"
+version: "1.4.20"
 maintainers:
 - email: [email protected]
   name: TIBCO Cloud Messaging Team

diff --git a/charts/msg-ems-tp/scripts/emsadmin-curl.sh b/charts/msg-ems-tp/scripts/emsadmin-curl.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# Copyright (c) 2023-2024 Cloud Software Group, Inc. All Rights Reserved. Confidential and Proprietary.
+# Copyright (c) 2023-2025 Cloud Software Group, Inc. All Rights Reserved. Confidential and Proprietary.
 
 base="$(cd "${0%/*}" 2>/dev/null; echo "$PWD")"
 cmd="${0##*/}"

diff --git a/charts/msg-ems-tp/scripts/fix-sample-certs.sh b/charts/msg-ems-tp/scripts/fix-sample-certs.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 #
-# Copyright (c) 2023-2024. Cloud Software Group, Inc.
+# Copyright (c) 2023-2025. Cloud Software Group, Inc.
 # This file is subject to the license terms contained
 # in the license file that is distributed with this file.
 #

diff --git a/charts/msg-ems-tp/scripts/health-watcher.sh b/charts/msg-ems-tp/scripts/health-watcher.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 #
-# Copyright (c) 2023-2024. Cloud Software Group, Inc.
+# Copyright (c) 2023-2025. Cloud Software Group, Inc.
 # This file is subject to the license terms contained
 # in the license file that is distributed with this file.
 #

diff --git a/charts/msg-ems-tp/scripts/load-ems-init-json.sh b/charts/msg-ems-tp/scripts/load-ems-init-json.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 #
-# Copyright (c) 2023-2024. Cloud Software Group, Inc.
+# Copyright (c) 2023-2025. Cloud Software Group, Inc.
 # This file is subject to the license terms contained
 # in the license file that is distributed with this file.
 #

diff --git a/charts/msg-ems-tp/scripts/mk-common.conf.sh b/charts/msg-ems-tp/scripts/mk-common.conf.sh
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2023-2024. Cloud Software Group, Inc.
+# Copyright (c) 2023-2025. Cloud Software Group, Inc.
 # This file is subject to the license terms contained
 # in the license file that is distributed with this file.
 #

diff --git a/charts/msg-ems-tp/scripts/mk-cp-oauth2.jwks.json.sh b/charts/msg-ems-tp/scripts/mk-cp-oauth2.jwks.json.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 #
-# Copyright (c) 2023-2024. Cloud Software Group, Inc.
+# Copyright (c) 2023-2025. Cloud Software Group, Inc.
 # This file is subject to the license terms contained
 # in the license file that is distributed with this file.
 #

diff --git a/charts/msg-ems-tp/scripts/mk-fluentbits.conf.sh b/charts/msg-ems-tp/scripts/mk-fluentbits.conf.sh
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2023-2024. Cloud Software Group, Inc.
+# Copyright (c) 2023-2025. Cloud Software Group, Inc.
 # This file is subject to the license terms contained
 # in the license file that is distributed with this file.
 #

diff --git a/charts/msg-ems-tp/scripts/mk-ftlserver.yaml.sh b/charts/msg-ems-tp/scripts/mk-ftlserver.yaml.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 
 #
-# Copyright (c) 2023-2024. Cloud Software Group, Inc.
+# Copyright (c) 2023-2025. Cloud Software Group, Inc.
 # This file is subject to the license terms contained
 # in the license file that is distributed with this file.
 #

diff --git a/charts/msg-ems-tp/scripts/mk-output.conf.sh b/charts/msg-ems-tp/scripts/mk-output.conf.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 #
-# Copyright (c) 2023-2024. Cloud Software Group, Inc.
+# Copyright (c) 2023-2025. Cloud Software Group, Inc.
 # This file is subject to the license terms contained
 # in the license file that is distributed with this file.
 #

diff --git a/charts/msg-ems-tp/scripts/mk-parsers.conf.sh b/charts/msg-ems-tp/scripts/mk-parsers.conf.sh
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2023-2024. Cloud Software Group, Inc.
+# Copyright (c) 2023-2025. Cloud Software Group, Inc.
 # This file is subject to the license terms contained
 # in the license file that is distributed with this file.
 #

diff --git a/charts/msg-ems-tp/scripts/mk-tibemsd-ftl.json.sh b/charts/msg-ems-tp/scripts/mk-tibemsd-ftl.json.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 #
-# Copyright (c) 2023-2024. Cloud Software Group, Inc.
+# Copyright (c) 2023-2025. Cloud Software Group, Inc.
 # This file is subject to the license terms contained
 # in the license file that is distributed with this file.
 #
@@ -137,7 +137,7 @@ cat - <<EOF > $outfile
     "user_auth": "local,oauth2",
     "oauth2_server_validation_key": "/data/boot/cp-oauth2.jwks.json",
     "oauth2_user_claim": "email",
-    "oauth2_group_claim": "rolX",
+    "oauth2_group_claim": "gsbc",
     "always_exit_on_disk_error":true,
     "authorization":false,
     "console_trace": "DEFAULT,+CONNECT",

diff --git a/charts/msg-ems-tp/scripts/mk-toolset-wd.yaml.sh b/charts/msg-ems-tp/scripts/mk-toolset-wd.yaml.sh
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2023-2024. Cloud Software Group, Inc.
+# Copyright (c) 2023-2025. Cloud Software Group, Inc.
 # This file is subject to the license terms contained
 # in the license file that is distributed with this file.
 #

diff --git a/charts/msg-ems-tp/scripts/mk-watchdog.yaml.sh b/charts/msg-ems-tp/scripts/mk-watchdog.yaml.sh
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2023-2024. Cloud Software Group, Inc.
+# Copyright (c) 2023-2025. Cloud Software Group, Inc.
 # This file is subject to the license terms contained
 # in the license file that is distributed with this file.
 #

diff --git a/charts/msg-ems-tp/scripts/ops-tibemsadmin-shell.sh b/charts/msg-ems-tp/scripts/ops-tibemsadmin-shell.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 
 #
-# Copyright (c) 2023-2024. Cloud Software Group, Inc.
+# Copyright (c) 2023-2025. Cloud Software Group, Inc.
 # This file is subject to the license terms contained
 # in the license file that is distributed with this file.
 #

diff --git a/charts/msg-ems-tp/scripts/pod-stats.sh b/charts/msg-ems-tp/scripts/pod-stats.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 #
-# Copyright (c) 2023-2024. Cloud Software Group, Inc.
+# Copyright (c) 2023-2025. Cloud Software Group, Inc.
 # This file is subject to the license terms contained
 # in the license file that is distributed with this file.
 #

diff --git a/charts/msg-ems-tp/scripts/start-admin-api.sh b/charts/msg-ems-tp/scripts/start-admin-api.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 #
-# Copyright (c) 2023-2024. Cloud Software Group, Inc.
+# Copyright (c) 2023-2025. Cloud Software Group, Inc.
 # This file is subject to the license terms contained
 # in the license file that is distributed with this file.
 #
@@ -56,7 +56,7 @@ proxy:
     - ":$emsAdminPort"
   session_timeout: 86400
   session_inactivity_timeout: 3600
-  page_limit: 100
+  page_limit: 0
   disable_tls: true
   certificate: /opt/tibco/ems/current-version/samples/certs/server.cert.pem
   private_key: /opt/tibco/ems/current-version/samples/certs/server.key.p8

diff --git a/charts/msg-ems-tp/templates/_dp.helpers.tpl b/charts/msg-ems-tp/templates/_dp.helpers.tpl
@@ -2,7 +2,7 @@
 {{/*
 MSG DP Common Helpers
 #
-# Copyright (c) 2023-2024. Cloud Software Group, Inc.
+# Copyright (c) 2023-2025. Cloud Software Group, Inc.
 # This file is subject to the license terms contained
 # in the license file that is distributed with this file.
 #
@@ -36,6 +36,7 @@ need.msg.dp.params
   {{- $instanceId := "no-instanceId" -}}
   {{- $fluentbitEnabled := .Values.global.cp.logging.fluentbit.enabled -}}
   {{- $enableClusterScopedPerm := .Values.global.cp.enableClusterScopedPerm -}}
+  {{- $enableResourceConstraints := .Values.global.cp.enableResourceConstraints -}}
   {{- $enableSecurityContext := true -}}
   {{- $enableHaproxy := true -}}
   # These 3 are currently unused!
@@ -116,6 +117,9 @@ need.msg.dp.params
       {{- if hasKey .Values.dp "enableClusterScopedPerm" -}}
         {{- $enableClusterScopedPerm = .Values.dp.enableClusterScopedPerm -}}
       {{- end -}}
+      {{- if hasKey .Values.dp "enableResourceConstraints" -}}
+        {{- $enableResourceConstraints = .Values.dp.enableResourceConstraints -}}
+      {{- end -}}
       {{- if hasKey .Values.dp "enableSecurityContext" -}}
         {{- $enableSecurityContext = .Values.dp.enableSecurityContext -}}
       {{- end -}}
@@ -146,6 +150,7 @@ dp:
   chart: {{ printf "%s-%s" .Chart.Name .Chart.Version }}
   fluentbitEnabled: {{ $fluentbitEnabled }}
   enableClusterScopedPerm: {{ $enableClusterScopedPerm }}
+  enableResourceConstraints: {{ $enableResourceConstraints }}
   enableSecurityContext: {{ $enableSecurityContext }}
   enableHaproxy: {{ $enableHaproxy }}
 {{- end }}
@@ -178,7 +183,7 @@ note: tib-msg-stsname will be added directly in statefulset charts, as it needs
 */}}
 {{- define "msg.dpparams.labels" }}
 tib-dp-release: {{ .dp.release }}
-tib-dp-msgbuild: "1.3.0.18"
+tib-dp-msgbuild: "1.4.0.20"
 tib-dp-chart: {{ .dp.chart }}
 tib-dp-workload-type: "capability-service"
 tib-dp-dataplane-id: "{{ .dp.name }}"
@@ -438,6 +443,7 @@ securityContext:
   capabilities:
     drop:
     - ALL
+    - CAP_NET_RAW
   readOnlyRootFilesystem: true
   runAsNonRoot: true
     {{- end }}
@@ -450,7 +456,9 @@ securityContext:
   capabilities:
     drop:
     - ALL
-  readOnlyRootFilesystem: false
+    - CAP_NET_RAW
+  # readOnlyRootFilesystem: false
+  readOnlyRootFilesystem: true
   runAsNonRoot: true
     {{- end }}
   {{- end }}

diff --git a/charts/msg-ems-tp/templates/_ems.dp.helpers.tpl b/charts/msg-ems-tp/templates/_ems.dp.helpers.tpl
@@ -2,7 +2,7 @@
 {{/*
 MSGDP EMS Helpers
 #
-# Copyright (c) 2023-2024. Cloud Software Group, Inc.
+# Copyright (c) 2023-2025. Cloud Software Group, Inc.
 # This file is subject to the license terms contained
 # in the license file that is distributed with this file.
 #
@@ -14,7 +14,7 @@ need.msg.ems.params
 */}}
 {{ define "need.msg.ems.params" }}
 {{-  $dpParams := include "need.msg.dp.params" . | fromYaml -}}
-{{-  $emsDefaultFullImage := printf "%s/%s/msg-ems-all:10.3.0-35" $dpParams.dp.registry $dpParams.dp.repo -}}
+{{-  $emsDefaultFullImage := printf "%s/%s/msg-ems-all:10.3.0-36" $dpParams.dp.registry $dpParams.dp.repo -}}
 {{-  $opsDefaultFullImage := printf "%s/%s/msg-tp-ops:1.2.0-4" $dpParams.dp.registry $dpParams.dp.repo -}}
 # Set EMS defaults
 {{- $name := ternary .Release.Name .Values.ems.name ( not .Values.ems.name ) -}}
@@ -158,6 +158,7 @@ ems:
   allowNodeSkew: "{{ .Values.ems.allowNodeSkew | default $allowNodeSkew }}"
   allowZoneSkew: "{{ .Values.ems.allowZoneSkew | default $allowZoneSkew }}"
   resources:
+    {{ if $dpParams.dp.enableResourceConstraints }}
     {{ if .Values.ems.resources }}
 {{ .Values.ems.resources | toYaml | indent 4 }}
     {{ else }}
@@ -168,6 +169,7 @@ ems:
       memory: {{ $memLim }}
       cpu: {{ $cpuLim }}
     {{ end }}
+    {{ end }}
   # Computed settings below, not intended for user changes
   # use -pods instead of -headless to avoid reducing STS name size
   stsname: "{{ $name }}-ems"
@@ -184,6 +186,33 @@ ems:
 toolset:
   lbHost: "nlbNameHere"
   enableIngress: true
+  resources:
+    {{ if $dpParams.dp.enableResourceConstraints }}
+    {{ if and .Values.toolset .Values.toolset.resources }}
+{{ .Values.toolset.resources | toYaml | indent 4 }}
+    {{ else }}
+    requests:
+      memory: "0.5Gi"
+      cpu: "0.1"
+    limits:
+      memory: "4Gi"
+      cpu: "3"
+    {{ end }}
+    {{ end }}
+job:
+  resources:
+    {{ if $dpParams.dp.enableResourceConstraints }}
+    {{ if and .Values.job .Values.job.resources }}
+{{ .Values.job.resources | toYaml | indent 4 }}
+    {{ else }}
+    requests:
+      memory: "0.5Gi"
+      cpu: "0.1"
+    limits:
+      memory: "1Gi"
+      cpu: "1"
+    {{ end }}
+    {{ end }}
 securityProfile: "{{ .Values.ems.securityProfile | default "ems" }}"
 {{ end }}
 
@@ -201,8 +230,8 @@ tib-msg-ems-use: "{{ .ems.use }}"
 app.kubernetes.io/name: "ems"
 platform.tibco.com/app-type: "msg-ems"
 app.kubernetes.io/part-of: "{{ .ems.name }}"
-platform.tibco.com/app.resources.requests.cpu: {{ .ems.resources.requests.cpu | default "100m" | quote }}
-platform.tibco.com/app.resources.requests.memory: {{ .ems.resources.requests.memory | default "128Mi" | quote }}
-platform.tibco.com/app.resources.limits.cpu: {{ .ems.resources.limits.cpu | default "3" | quote }}
-platform.tibco.com/app.resources.limits.memory: {{ .ems.resources.limits.memory | default "4Gi" | quote }}
+platform.tibco.com/app.resources.requests.cpu: {{ if and .ems.resources .ems.resources.requests -}} {{ .ems.resources.requests.cpu | default "100m" | quote }} {{- else -}} "100m" {{- end }}
+platform.tibco.com/app.resources.requests.memory: {{ if and .ems.resources .ems.resources.requests -}}  {{ .ems.resources.requests.memory | default "128Mi" | quote }} {{- else -}} "128Mi" {{- end }}
+platform.tibco.com/app.resources.limits.cpu: {{ if and .ems.resources .ems.resources.limits -}}  {{ .ems.resources.limits.cpu | default "3" | quote }} {{- else -}} "3" {{- end }}
+platform.tibco.com/app.resources.limits.memory: {{ if and .ems.resources .ems.resources.limits -}} {{ .ems.resources.limits.memory | default "4Gi" | quote }} {{- else -}} "4Gi" {{- end }}
 {{- end }}
diff --git a/charts/msg-ems-tp/templates/client.cm.yaml b/charts/msg-ems-tp/templates/client.cm.yaml
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2023-2024. Cloud Software Group, Inc.
+# Copyright (c) 2023-2025. Cloud Software Group, Inc.
 # This file is subject to the license terms contained
 # in the license file that is distributed with this file.
 #

diff --git a/charts/msg-ems-tp/templates/ems-init.job.yaml b/charts/msg-ems-tp/templates/ems-init.job.yaml
@@ -1,6 +1,6 @@
 {{- if .Release.IsInstall }}
 #
-# Copyright (c) 2023-2024. Cloud Software Group, Inc.
+# Copyright (c) 2023-2025. Cloud Software Group, Inc.
 # This file is subject to the license terms contained
 # in the license file that is distributed with this file.
 #
@@ -54,6 +54,7 @@ spec:
             - name: {{ $emsParams.dp.pullSecret }}
             {{- end }}
             serviceAccountName: "{{ $emsParams.dp.serviceAccount }}"
+            {{ include "msg.dp.security.pod" $emsParams | nindent 12 }}
             restartPolicy: Never
             volumes:
             - name: scripts-vol
@@ -67,6 +68,9 @@ spec:
               {{ else }}
               emptyDir: {}
               {{ end }}
+            - name: "ems-data"
+              # TODO: Support PVCdata during init
+              emptyDir: {}
             terminationGracePeriodSeconds: 10
             containers:
             -   name: "main"
@@ -78,6 +82,9 @@ spec:
                   bash < /boot/load-ems-init-json.sh ; 
                 image: "{{ $emsParams.ems.image }}"
                 imagePullPolicy: "{{ $emsParams.dp.pullPolicy }}"
+                resources:
+{{ $emsParams.job.resources | toYaml | indent 18 }}
+                {{ include "msg.dp.security.container" $emsParams | nindent 16 }}
                 volumeMounts:
                 - mountPath: /boot
                   name: scripts-vol
@@ -86,6 +93,8 @@ spec:
                   {{ if eq "sharedPvc" $emsParams.ems.logs.storageType }}
                   subPathExpr: "$(MY_RELEASE)/logs"
                   {{ end }}
+                - mountPath: /data 
+                  name: ems-data
                 envFrom:
                   - secretRef:
                       name: "{{ $emsParams.ems.name }}-tibadmin"

diff --git a/charts/msg-ems-tp/templates/ems-logs.pvc.yaml b/charts/msg-ems-tp/templates/ems-logs.pvc.yaml
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2023-2024. Cloud Software Group, Inc.
+# Copyright (c) 2023-2025. Cloud Software Group, Inc.
 # This file is subject to the license terms contained
 # in the license file that is distributed with this file.
 #

diff --git a/charts/msg-ems-tp/templates/ems-preinstall.job.yaml b/charts/msg-ems-tp/templates/ems-preinstall.job.yaml
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2023-2024. Cloud Software Group, Inc.
+# Copyright (c) 2023-2025. Cloud Software Group, Inc.
 # This file is subject to the license terms contained
 # in the license file that is distributed with this file.
 #
@@ -50,6 +50,7 @@ spec:
             - name: {{ $emsParams.dp.pullSecret }}
             {{- end }}
             serviceAccountName: "{{ $emsParams.dp.serviceAccount }}"
+            {{ include "msg.dp.security.pod" $emsParams | nindent 12 }}
             restartPolicy: Never
             terminationGracePeriodSeconds: 10
             containers:
@@ -70,6 +71,9 @@ spec:
                   fi ;
                 image: "{{ $emsParams.ems.image }}"
                 imagePullPolicy: "{{ $emsParams.dp.pullPolicy }}"
+                resources:
+{{ $emsParams.job.resources | toYaml | indent 18 }}
+                {{ include "msg.dp.security.container" $emsParams | nindent 16 }}
                 env:
                 # CAUTION! Setting Names here overrides envFrom values
                 {{ include "msg.dp.stdenv" $emsParams | indent  16 }}