CIV-10543 removing bootstrap (#2814)

* CIV-10543 removing bootstrap * Bumping chart version/ fixing aliases Co-authored-by: hmcts-jenkins-a-to-c <62422075+hmcts-jenkins-a-to-c[bot]@users.noreply.github.com>
hmcts · Dec 5, 2023 · 926d09d · 926d09d
1 parent fce6c54
commit 926d09d
Show file tree

Hide file tree

Showing 10 changed files with 56 additions and 110 deletions.
diff --git a/build.gradle b/build.gradle
@@ -240,7 +240,7 @@ dependencies {
   implementation group: 'uk.gov.hmcts.reform', name: 'logging', version: versions.reformJavaLogging
   implementation group: 'uk.gov.hmcts.reform', name: 'logging-appinsights', version: versions.loggingAppinsights
   implementation group: 'com.microsoft.azure', name: 'applicationinsights-web', version: '2.6.4'
-  
+
   implementation group: 'com.github.hmcts', name: 'java-logging', version: '6.0.1'
 
   implementation('com.github.hmcts:cmc-pdf-service-client:7.0.0') {

diff --git a/charts/cmc-claim-store/Chart.yaml b/charts/cmc-claim-store/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v2
 name: cmc-claim-store
 home: https://github.com/hmcts/cmc-claim-store
-version: 4.1.51
+version: 4.1.52
 description: Helm chart for the HMCTS CMC Claim-Store service
 # be aware when bumping version that it is used elsewhere, e.g.:
 # chart-cmc - demo: https://github.com/hmcts/chart-cmc/tree/master/cmc

diff --git a/charts/cmc-claim-store/values.aat.template.yaml b/charts/cmc-claim-store/values.aat.template.yaml
@@ -2,36 +2,9 @@ java:
   # Don't modify below here
   image: ${IMAGE_NAME}
   ingressHost: ${SERVICE_FQDN}
-  keyVaults:
-    cmc:
-      resourceGroup: cmc
-      secrets:
-        - AppInsightsInstrumentationKey
-        - cmc-db-password-v11
-        - citizen-oauth-client-secret
-        - claim-store-s2s-secret
-        - anonymous-caseworker-username
-        - anonymous-caseworker-password
-        - system-update-username
-        - system-update-password
-        - notify-api-key
-        - milo-recipient
-        - staff-email
-        - live-support-email
-        - rpa-email-sealed-claim
-        - rpa-email-breathing-space
-        - rpa-email-legal-sealed-claim
-        - rpa-email-more-time-requested
-        - rpa-email-response
-        - rpa-email-ccj
-        - rpa-email-paid-in-full
-        - launchDarkly-sdk-key
-        - sendgrid-api-key
-        - staff-email-legal-rep
   environment:
     MILO_CSV_SCHEDULE: "0 0 8 * * ?"
     CLAIM_STAYED_SCHEDULE: "0 0 16 ? * MON-FRI *"
     SCHEDULE_TRANSFER_CLAIMS: '0 0 12 1 * ?'
     OIDC_ISSUER: https://forgerock-am.service.core-compute-idam-aat2.internal:8443/openam/oauth2/realms/root/realms/hmcts
-    CMC_DB_USERNAME: cmc@cmc-db-v11-aat
-    CMC_DB_HOST: cmc-db-v11-aat.postgres.database.azure.com
+
diff --git a/charts/cmc-claim-store/values.preview.template.yaml b/charts/cmc-claim-store/values.preview.template.yaml
@@ -4,31 +4,6 @@ java:
   livenessFailureThreshold: 6
   livenessDelay: 75
   readinessDelay: 75
-  keyVaults:
-    cmc:
-      resourceGroup: cmc
-      secrets:
-        - AppInsightsInstrumentationKey
-        - citizen-oauth-client-secret
-        - claim-store-s2s-secret
-        - anonymous-caseworker-username
-        - anonymous-caseworker-password
-        - system-update-username
-        - system-update-password
-        - notify-api-key
-        - milo-recipient
-        - staff-email
-        - live-support-email
-        - rpa-email-sealed-claim
-        - rpa-email-breathing-space
-        - rpa-email-legal-sealed-claim
-        - rpa-email-more-time-requested
-        - rpa-email-response
-        - rpa-email-ccj
-        - rpa-email-paid-in-full
-        - launchDarkly-sdk-key
-        - sendgrid-api-key
-        - staff-email-legal-rep
   environment:
     LOG_LEVEL: DEBUG
     CMC_DB_HOST: "{{ .Values.postgresql.releaseNameOverride}}"

diff --git a/charts/cmc-claim-store/values.yaml b/charts/cmc-claim-store/values.yaml
@@ -12,35 +12,59 @@ java:
     cmc:
       resourceGroup: cmc
       secrets:
-        - AppInsightsInstrumentationKey
-        - cmc-db-password-v11
-        - citizen-oauth-client-secret
-        - claim-store-s2s-secret
-        - anonymous-caseworker-username
-        - anonymous-caseworker-password
-        - system-update-username
-        - system-update-password
-        - notify-api-key
-        - milo-recipient
-        - staff-email
-        - live-support-email
-        - rpa-email-sealed-claim
-        - rpa-email-breathing-space
-        - rpa-email-legal-sealed-claim
-        - rpa-email-more-time-requested
-        - rpa-email-response
-        - rpa-email-ccj
-        - rpa-email-paid-in-full
-        - launchDarkly-sdk-key
-        - sendgrid-api-key
-        - staff-email-legal-rep
+        - name: claim-store-db-password
+          alias: CLAIM_STORE_DB_PASSWORD
+        - name: AppInsightsInstrumentationKey
+          alias: azure.application-insights.instrumentation-key
+        - name: cmc-db-password-v11
+          alias: CMC_DB_PASSWORD
+        - name: citizen-oauth-client-secret
+          alias: oauth2.client.secret
+        - name: claim-store-s2s-secret
+          alias: idam.s2s-auth.totp_secret
+        - name: anonymous-caseworker-username
+          alias: idam.caseworker.anonymous.username
+        - name: anonymous-caseworker-password
+          alias: idam.caseworker.anonymous.password
+        - name: system-update-username
+          alias: idam.caseworker.system.username
+        - name: system-update-password
+          alias: idam.caseworker.system.password
+        - name: notify-api-key
+          alias: GOV_NOTIFY_API_KEY
+        - name: milo-recipient
+          alias: MILO_CSV_RECIPIENT
+        - name: staff-email
+          alias: staff-notifications.recipient
+        - name: live-support-email
+          alias: live-support.recipient
+        - name: rpa-email-sealed-claim
+          alias: rpa.notifications.sealedClaimRecipient
+        - name: rpa-email-breathing-space
+          alias: rpa.notifications.breathingSpaceRecipient
+        - name: rpa-email-legal-sealed-claim
+          alias: rpa.notifications.legalSealedClaimRecipient
+        - name: rpa-email-more-time-requested
+          alias: rpa.notifications.moreTimeRequestedRecipient
+        - name: rpa-email-response
+          alias: rpa.notifications.responseRecipient
+        - name: rpa-email-ccj
+          alias: rpa.notifications.countyCourtJudgementRecipient
+        - name: rpa-email-paid-in-full
+          alias: rpa.notifications.paidInFullRecipient
+        - name: launchDarkly-sdk-key
+          alias: LAUNCH_DARKLY_SDK_KEY
+        - name: sendgrid-api-key
+          alias: SENDGRID_API_KEY
+        - name: staff-email-legal-rep
+          alias: staff-notifications.legalRecipient
+        - name: appinsights-connection-string
+          alias: appinsights-connection-string
   environment:
     REFORM_TEAM: cmc
     REFORM_SERVICE_NAME: claim-store
     REFORM_ENVIRONMENT: preview
     CLAIM_STORE_TEST_SUPPORT_ENABLED: true
-    CMC_DB_USERNAME: 'cmc@cmc-db-v11-{{ .Values.global.environment }}'
-    CMC_DB_HOST: cmc-db-v11-{{ .Values.global.environment }}.postgres.database.azure.com
     CMC_DB_CONNECTION_OPTIONS: '?sslmode=require'
     CMC_DB_NAME: cmc
     CMC_DB_PORT: 5432

diff --git a/config/owasp/suppressions.xml b/config/owasp/suppressions.xml
@@ -39,5 +39,6 @@
     </suppress>
     <suppress until="2024-04-18">
         <cve>CVE-2023-20860</cve>
+        <cve>CVE-2023-33202</cve>
     </suppress>
 </suppressions>
diff --git a/email-client/build.gradle b/email-client/build.gradle
@@ -23,7 +23,7 @@ dependencies {
   implementation group: 'uk.gov.hmcts.reform', name: 'logging', version: '5.1.7'
   implementation group: 'uk.gov.hmcts.reform', name: 'logging-appinsights', version: '5.1.7'
 
-  implementation group: 'com.sendgrid', name: 'sendgrid-java', version: '4.7.2'
+  implementation group: 'com.sendgrid', name: 'sendgrid-java', version: '4.10.1'
 
   testImplementation group: 'org.springframework.boot', name: 'spring-boot-starter-test'
   testImplementation group: 'commons-io', name: 'commons-io', version: '2.11.0'

diff --git a/infrastructure/main.tf b/infrastructure/main.tf
@@ -226,7 +226,7 @@ module "db-v15" {
 
     pgsql_sku            = var.pgsql_sku
     pgsql_storage_mb     = var.pgsql_storage_mb
-
+    force_user_permissions_trigger = "1"
 }
 
 resource "azurerm_key_vault_secret" "cmc-db-password-v15" {

diff --git a/src/main/resources/application.yml b/src/main/resources/application.yml
@@ -18,6 +18,8 @@ async:
       size: 50
 
 spring:
+  config:
+    import: "optional:configtree:/mnt/secrets/cmc/"
   main:
     allow-bean-definition-overriding: true  # https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-2.1-Release-Notes#bean-overriding
   application:

diff --git a/src/main/resources/bootstrap.yml b/src/main/resources/bootstrap.yml