chore(prod): cleanup go-api azure-pipline

README.md

@@ -10,8 +10,6 @@ This repository hosts the configuration files and scripts required for deploying
 The repository is structured as follows:
 
 - `base-infrastructure`: Contains the Terraform configuration files for deploying the Kubernetes clusters and other infrastructure components like managed databases, object storage etc on Azure.
-
-- `applications/go-api`: Contains the deployment scripts and Helm configurations for deploying Helm charts of IFRC GO ecosystem applications onto the Kubernetes clusters.
 - `applications/argocd`: Contains the definitions of kubernetes resoures for managing applications whose deployment is managed by [ArgoCD](https://argo-cd.readthedocs.io/en/stable/).
 
 

applications/argocd/production/applications/alert-hub-backend.yaml

@@ -10,7 +10,7 @@ spec:
   source:
     repoURL: ghcr.io/ifrcgo
     chart: ifrcgo-alert-hub-helm
-    targetRevision: 0.1.1-develop.cba3edc6
+    targetRevision: 0.1.1-develop.cd68d46e
     helm:
       valueFiles:
         - values/traefik.yaml

applications/argocd/production/applications/go-api.yaml

@@ -11,7 +11,7 @@ spec:
     repoURL: ghcr.io/ifrcgo
     chart: ifrcgo-helm
     # TODO: do we need to switch to a master-build chart tag
-    targetRevision: 0.0.2-develop.c676a57d
+    targetRevision: 0.0.2-develop.c054f0b4
     helm:
       valueFiles:
         - values/traefik.yaml

applications/argocd/production/applications/montandon-eoapi/application.yaml

@@ -11,7 +11,7 @@ spec:
 
   - repoURL: https://devseed.com/eoapi-k8s/
     chart: eoapi
-    targetRevision: 0.11.2
+    targetRevision: 0.16.2
     helm:
       valueFiles:
         - values/argocd.yaml
@@ -51,8 +51,6 @@ spec:
                 port: "DB_PORT"
 
         stac:
-          image:
-            tag: 6.1.2
           overrideRootPath: ""
           # External Azure PG + HPA: keep concurrency/pools capped.
           # Ceiling: maxReplicas × WEB_CONCURRENCY × pools(2 w/ transactions) × DB_MAX_CONN_SIZE
@@ -93,7 +91,6 @@ spec:
               CORS_HEADERS: "Accept, Authorization, Content-Type, Origin, X-Requested-With"
               CORS_METHODS: "GET,OPTIONS,POST"
               CORS_CREDENTIALS: "true"
-              STAC_FASTAPI_VERSION: "6.1.2"
               STAC_FASTAPI_TITLE: "Montandon STAC API"
               STAC_FASTAPI_DESCRIPTION: "Welcome to the [Montandon](https://ifrcgo.org/monty-stac-extension/) STAC API. This API provides the main entry to access the Global Crisis Data Bank, a database that brings in hazard and impact data for current, historical and forecasted disasters around the globe"
               STAC_FASTAPI_LANDING_ID: "montandon-eoapi"
@@ -118,12 +115,82 @@ spec:
               context: "off"
             queryables:
               - name: "stac_queryables.json"
-                indexFields: ["monty:hazard_codes","monty:country_codes","monty:corr_id","roles"]
+                indexFields: ["monty:corr_id"]
                 deleteMissing: true
                 configMapRef:
                   name: montandon-eoapi-stac-queryables
                   key: stac_queryables.json
 
+        stac-auth-proxy:
+          enabled: true
+          startupProbe:
+            httpGet:
+              path: /stac/healthz
+          livenessProbe:
+            httpGet:
+              path: /stac/healthz
+          readinessProbe:
+            httpGet:
+              path: /stac/healthz
+          env:
+            UPSTREAM_URL: "http://montandon-eoapi-stac:8080"
+            # UPSTREAM_URL: "https://montandon-eoapi.ifrc.org/stac"
+            UPSTREAM_TIMEOUT: "30"
+            OIDC_DISCOVERY_URL: "https://goadmin.ifrc.org/o/.well-known/openid-configuration"
+            OIDC_DISCOVERY_INTERNAL_URL: "https://goadmin.ifrc.org/o/.well-known/openid-configuration"
+            OVERRIDE_HOST: "0"
+            ROOT_PATH: "/stac"
+            DEFAULT_PUBLIC: "false"
+            COLLECTIONS_FILTER_CLS: stac_auth_proxy.montandon_filters:CollectionsFilter
+            ITEMS_FILTER_CLS: stac_auth_proxy.montandon_filters:ItemsFilter
+            # External-token revocation (go-api issue #2794), injected via montandon_revocation.py.
+            GOAPI_TOKEN_VERIFY_TTL: "300"
+            # Short TTL for a fail-open allow served during a go-api outage, so revocation
+            # resumes within seconds of recovery instead of being masked for a full TTL.
+            GOAPI_TOKEN_VERIFY_OUTAGE_TTL: "30"
+            # TTL for a definitive deny (go-api reported the jti inactive/unknown): 24h, so a
+            # known-revoked token is not re-checked against go-api on every request.
+            GOAPI_TOKEN_VERIFY_DENY_TTL: "86400"
+            # Upper bound on cached jti decisions (memory guard on a long-lived pod).
+            GOAPI_TOKEN_VERIFY_CACHE_MAX: "50000"
+            GOAPI_TOKEN_VERIFY_TIMEOUT: "3"
+            GOAPI_TOKEN_VERIFY_FAIL_OPEN: "true"
+            GOAPI_TOKEN_STATIC_BLACKLIST: "fec23689-bf00-401e-9f9c-a65684f44b5f"  # NOTE: Token ID used in hackathon
+          ingress:
+            # The eoapi-k8s chart default is `false` (main eoapi ingress handles routing);
+            # montandon disables the main ingress and routes through stac-auth-proxy directly.
+            enabled: true
+            host: "montandon-eoapi.ifrc.org"
+            className: "traefik"
+            tls:
+              enabled: true
+              secretName: "montandon-eoapi-helm-secret-cert"
+          autoscaling:
+            enabled: true
+            minReplicas: 1
+            maxReplicas: 3
+            targetCPUUtilizationPercentage: 75
+          resources:
+            limits:
+              cpu: 500m
+              memory: "2048Mi"
+            requests:
+              cpu: 200m
+              memory: "1024Mi"
+          extraVolumes:
+            - name: custom-modules
+              configMap:
+                name: stac-auth-proxy-modules
+          extraVolumeMounts:
+            - name: custom-modules
+              mountPath: /app/src/stac_auth_proxy/montandon_filters.py
+              subPath: montandon_filters.py
+              readOnly: true
+            - name: custom-modules
+              mountPath: /app/src/stac_auth_proxy/montandon_revocation.py
+              subPath: montandon_revocation.py
+              readOnly: true
+
   - path: applications/argocd/production/applications/montandon-eoapi/internal/
     targetRevision: develop
     repoURL: https://github.com/IFRCGo/go-deploy.git
@@ -135,78 +202,6 @@ spec:
             enabled: true
             keyvaultName: montandon-eoapi-producti
 
-  - repoURL: https://github.com/developmentseed/stac-auth-proxy.git
-    targetRevision: v1.2.0
-    path: helm/
-    helm:
-      valuesObject:
-        image:
-          tag: "v1.2.0"
-        # HealthCheck endpoints - https://github.com/developmentseed/stac-auth-proxy/pull/143
-        startupProbe:
-          httpGet:
-            path: /stac/healthz
-        livenessProbe:
-          httpGet:
-            path: /stac/healthz
-        readinessProbe:
-          httpGet:
-            path: /stac/healthz
-        env:
-          UPSTREAM_URL: "http://montandon-eoapi-stac:8080"
-          # UPSTREAM_URL: "https://montandon-eoapi.ifrc.org/stac"
-          OIDC_DISCOVERY_URL: "https://goadmin.ifrc.org/o/.well-known/openid-configuration"
-          OIDC_DISCOVERY_INTERNAL_URL: "https://goadmin.ifrc.org/o/.well-known/openid-configuration"
-          OVERRIDE_HOST: "0"
-          ROOT_PATH: "/stac"
-          COLLECTIONS_FILTER_CLS: stac_auth_proxy.montandon_filters:CollectionsFilter
-          ITEMS_FILTER_CLS: stac_auth_proxy.montandon_filters:ItemsFilter
-          # External-token revocation (go-api issue #2794), injected via montandon_revocation.py.
-          GOAPI_TOKEN_VERIFY_TTL: "300"
-          # Short TTL for a fail-open allow served during a go-api outage, so revocation
-          # resumes within seconds of recovery instead of being masked for a full TTL.
-          GOAPI_TOKEN_VERIFY_OUTAGE_TTL: "30"
-          # TTL for a definitive deny (go-api reported the jti inactive/unknown): 24h, so a
-          # known-revoked token is not re-checked against go-api on every request.
-          GOAPI_TOKEN_VERIFY_DENY_TTL: "86400"
-          # Upper bound on cached jti decisions (memory guard on a long-lived pod).
-          GOAPI_TOKEN_VERIFY_CACHE_MAX: "50000"
-          GOAPI_TOKEN_VERIFY_TIMEOUT: "3"
-          GOAPI_TOKEN_VERIFY_FAIL_OPEN: "true"
-          UPSTREAM_TIMEOUT: "30"
-          GOAPI_TOKEN_STATIC_BLACKLIST: "fec23689-bf00-401e-9f9c-a65684f44b5f"  # NOTE: Token ID used in hackathon
-        ingress:
-          enabled: true
-          host: "montandon-eoapi.ifrc.org"
-          className: "traefik"
-          tls:
-            enabled: true
-            secretName: "montandon-eoapi-helm-secret-cert"
-        autoscaling:
-          enabled: true
-          minReplicas: 1
-          maxReplicas: 3
-          targetCPUUtilizationPercentage: 75
-        resources:
-          limits:
-            cpu: 500m
-            memory: "2048Mi"
-          requests:
-            cpu: 200m
-            memory: "1024Mi"
-        extraVolumes:
-          - name: custom-modules
-            configMap:
-              name: stac-auth-proxy-modules
-        extraVolumeMounts:
-          - name: custom-modules
-            mountPath: /app/src/stac_auth_proxy/montandon_filters.py
-            subPath: montandon_filters.py
-            readOnly: true
-          - name: custom-modules
-            mountPath: /app/src/stac_auth_proxy/montandon_revocation.py
-            subPath: montandon_revocation.py
-            readOnly: true
   destination:
     server: https://kubernetes.default.svc
     namespace: montandon-eoapi

applications/argocd/production/applications/montandon-eoapi/internal/files/stac_queryables.json

@@ -38,6 +38,11 @@
       "description": "The unique identifier assigned by the Monty system to the reference event",
       "type": "string"
     },
+    "processing:version": {
+      "description": "The version of the pystac-monty transformer that generated the item, from the processing: extension",
+      "type": "string",
+      "pattern": "^\\d+\\.\\d+\\.\\d+$"
+    },
     "monty:hazard_codes": {
       "description": "The hazard codes of the hazards affecting the event",
       "type": "array",

applications/argocd/production/applications/risk-module.yaml

@@ -10,7 +10,7 @@ spec:
   source:
     repoURL: ghcr.io/ifrcgo
     chart: ifrcgo-risk-module-helm
-    targetRevision: 0.0.1-develop.c9cc4e94
+    targetRevision: 0.0.1-develop.c9561fd1
     helm:
       valueFiles:
         - values/traefik.yaml

applications/argocd/staging/applications/alert-hub-backend.yaml

@@ -10,7 +10,7 @@ spec:
   source:
     repoURL: ghcr.io/ifrcgo
     chart: ifrcgo-alert-hub-helm
-    targetRevision: 0.1.1-develop.cba3edc6
+    targetRevision: 0.1.1-develop.cd68d46e
     helm:
       valueFiles:
         - values/traefik.yaml

applications/argocd/staging/applications/go-api.yaml

@@ -10,7 +10,7 @@ spec:
   source:
     repoURL: ghcr.io/ifrcgo
     chart: ifrcgo-helm
-    targetRevision: 0.0.2-develop.c1b74d9c
+    targetRevision: 0.0.2-develop.c57b926b
     helm:
       valueFiles:
         - values/traefik.yaml

applications/argocd/staging/applications/montandon-eoapi/application.yaml

@@ -115,7 +115,7 @@ spec:
               context: "off"
             queryables:
               - name: "stac_queryables.json"
-                indexFields: ["monty:hazard_codes","monty:country_codes","monty:corr_id","roles"]
+                indexFields: ["monty:corr_id"]
                 deleteMissing: true
                 configMapRef:
                   name: montandon-eoapi-stac-queryables

applications/argocd/staging/applications/risk-module.yaml

@@ -10,7 +10,7 @@ spec:
   source:
     repoURL: ghcr.io/ifrcgo
     chart: ifrcgo-risk-module-helm
-    targetRevision: 0.0.1-develop.c9cc4e94
+    targetRevision: 0.0.1-develop.c9561fd1
     helm:
       valueFiles:
         - values/traefik.yaml
@@ -34,6 +34,7 @@ spec:
             AZURE_STORAGE_CONTAINER: "risk-module-staging-storage-container"
             AZURE_STORAGE_ACCOUNT_NAME: "riskmodulestaging4254"
             AZURE_STORAGE_MANAGED_IDENTITY: "true"
+            HEALTH_CHECK_DISK_USAGE_MAX: None
           serviceAccount:
             annotations:
               azure.workload.identity/client-id: "1a891bd5-87e2-4489-8050-84f26c3f99ce"