Quality Gate Checks (Release 3.2)

[matbmoser]

Introduction

We want to make public our status from the QG checks.

QG checks

Please keep this issue open until QG X is concluded and will be managed by the Issue Creator!
We will inform you about finding and proposals in separated issues, this issue here is for the Overview of the Checks!

Please keep this issue open until QG X is concluded!

Product Name: Digital Product Pass
Product Owner: Thorsten Dikmann
Dev SPOC: Jochen Braun / Mathias Moser
Helm Chart Version:
App Version:
QG5 Approval: yes/no

Check of Tractus-X Release Guidelines

This QG x Check is depending on the mandatory information from our current Release Guidelines.

TRG 1 Documentation

• TRG 1.01 appropriate README.md
• TRG 1.02 appropriate INSTALL.md [TRG 1.02] Create an appropriate INSTALL.md, moving GETTING_STARTED.md #39
• TRG 1.03 appropriate CHANGELOG.md

TRG 2 Git

• TRG 2.01 default branch is named main

• TRG 2.03 repository structure

  Checks within TRG 2.03

  • TRG 2.03 /docs directory contains detailed product related documentation for the Tractus-X product
  • TRG 2.03 /charts directory contains the Helm chart for the Tractus-X product IF available
  • TRG 2.03 AUTHORS.md file (optional) (TRG 2.03) file
  • TRG 2.03 CODE_OF_CONDUCT.md file (TRG 2.03)
  • TRG 2.03 CONTRIBUTING.md file (TRG 2.03)
  • TRG 2.03 DEPENDENCIES file(s) with up to date content (Dash tool generated) (TRG 2.03)
  • TRG 2.03 LICENSE file (TRG 2.03)
  • TRG 2.03 NOTICE.md file (TRG 2.03)
  • TRG 2.03 SECURITY.md file (TRG 2.03)

• TRG 2.04 Leading product repository

  Checks within TRG 2.04

  • TRG 2.04 repository name must be productname without prefix or suffix
  • TRG 2.04 should contain the release
  • TRG 2.04 references/urls to the product's other repositories
  • TRG 2.04 might contain product helm chart(s)
  • TRG 2.04 README.md: contains the urls for the underlying applications

• TRG 2.05 .tractusx metafile in a proper format [TRG 2.05] Create .tractusx metafile and place it in the root of the repository #40

TRG 3 Kubernetes

• TRG 3.02 PersistentVolume and PersistentVolumeClaim is used when needed ) -> [ 3° ] - Release/v1.0.0-data-persitance: Added pvc volume to store contract details #84

TRG 4 Container

• TRG 4.01 semantic versioning and tagging

• TRG 4.02 top level README.md file, that contains information about the used base image [TRG 4.02] Add a section to your top level README.md file, that contains information about the used base image #42

• TRG 4.03 Image has USER command and Non Root Container [TRG 4.03] Set in deployment-backend.yaml and deployment-frontend.yaml the property runAsUser properly #43

  Checks within TRG 4.03

  • TRG 4.03 deployment.yaml has runAsUser and allowPrivilegeEscalation: false properly set
  [TRG 4.03] Set in deployment-backend.yaml and deployment-frontend.yaml the property runAsUser properly #43

• [TRG 4.05 & TRG 4.06] Released image must be place DockerHub as mandatory container registry #50

• TRG 4.06 Notice File for DockerHub has all necessary information

  Checks within TRG 4.06

  • TRG 4.06 Link to the source of your base image (Container registry and GitHub if available)
  • TRG 4.06 Link to your product image on DockerHub
  • TRG 4.06 Link to your repository on GitHub
  • TRG 4.06 Direct link to the Dockerfile used to build your image
  • TRG 4.06 Link to LICENCE file in your repo as Project License (make clear, that this is the PROJECT licence, not an image license

TRG 5 Helm

• TRG 5.01 Helm chart must be released

  Checks within TRG 5.01

  • TRG 5.01 appropriate semantic versioning for version and appVersion has to be used in Chart.yaml
  • TRG 5.01 must not contain any environment specific values-xyz.yaml [TRG-5.01] Remove environmental values files #37
  • TRG 5.01 values.yaml file must contain proper default values/placeholders
  • TRG 5.01 No hostname provided for ingress [TRG 5.01] Remove hostnames from the ingress in the values.yaml #41
  • TRG 5.01 Ingress is disabled
  • TRG 5.01 No references to any secret engine service (e.g.: Hashicorp Vault)
  • TRG 5.01 Dependencies should be prefixed with the nameOverride and/or fullnameOverride properties
  • TRG 5.01 Image tag is set to the Chart.yaml appVersion property
  • TRG 5.01 must be deployable to any environment without overwriting default values with a simple helm install command
  • TRG 5.01 dependencies have to be declared in Chart.yaml NOT requirements.yml

• TRG 5.02 Helm chart location in /charts directory and correct structure

  Checks within TRG 5.02

  • TRG 5.02 each file must contain the Apache 2.0 Licence
  • TRG 5.02 latest tag is not used in helm chart be default

  charts/ 
      chartNameA/
        Chart.yaml
        ... 
      chartNameB/
        Chart.yaml
        ...
  AUTHORS.md 
  DEPENDENCIES.md 
  LICENCE 
  README.md 

• TRG 5.04 -> CPU and Memory utilization [ 1° ] - Release/v1.0.0-docker-helm: Added contents for notice for docker images and helm resource utilization #83

• TRG 5.06 application must be configurable through the Helm chart

• TRG 5.07 dependencies are present in the Chart.yaml they are properly configured

• TRG 5.08 a product has a single deployable helm chart that contains all components

  Checks within TRG 5.08

  • TRG 5.08 name of the Chart should be just the product-name without prefix or suffix
  • TRG 5.08 values file should contain all available variables (even from subcharts) with default values and comments about what they do
  • TRG 5.08 helm install command should successfully install the chart to any supported Kubernetes version cluster (without overwriting default values) [ 7° ] - Release/v1.0.0 kubernetes versions support: Support helm charts on different kubernetes versions #96
  • TRG 5.08 helm test runs without errors [TRG 5.08] Check if helm test runs without errors #94 [ 6° ] - Release/v1.0.0 create helm test: prepared helm test workflow to verify that a released helm chart work as expected #93

• TRG 5.09 Helm Test running properly

  Checks within TRG 5.09

  • TRG 5.09 A GitHub action exist which builds or uses the helm chart which gets released
  • TRG 5.09 The GitHub action can be triggered manually through Github WebUI manually running a workflow
  • TRG 5.09 Helm test verifies that the application is up and running [ 6° ] - Release/v1.0.0 create helm test: prepared helm test workflow to verify that a released helm chart work as expected #93

• TRG 5.10 Products need to support 3 versions at a time [ 7° ] - Release/v1.0.0 kubernetes versions support: Support helm charts on different kubernetes versions #96 (We tested for 4 versions)

  Checks within TRG 5.10

  • TRG 5.10 latest (K8s version 1.25)
  • TRG 5.10 latest - 1 (K8s version 1.24)
  • TRG 5.10 latest - 2 (K8s version 1.23)

• TRG 5.11 Upgradeability PRERELEASE [ 5° ] - Release/v1.0.0 add helm upgrade workflow: prepare helm upgrade to achieve pre-release upgradeability #90

  Checks within TRG 5.11

  • TRG 5.11 Based on the Helm test workflow, you must provide a GitHub action which takes the latest released helm chart, does an installation of it and then execute the upgrade to the current / new version.

TRG 6 Released Helm Chart

• TRG 6.01 Released Helm Chart

TRG 7 Open Source Governance

• TRG 7.01 Legal Documentation

• TRG 7.02 License and copyright header

• [TRG 7.03] IP checks for project content [TRG 7.03] Clarify if an extra IP check for project content is needed at the end of the release #95

• TRG 7.04 IP checks for 3rd party content -> Done using Dash Tool

  Checks within TRG 7.04

  • TRG 7.04 DEPENDENCIES file is up-to-date and reflects the current use of the 3rd party content
  • TRG 7.04 all libraries listed there should have the status "approved"
  • TRG 7.04 no libraries with status "rejected"
  • TRG 7.04 for libraries with status "restricted", the according IP issues must be present (issue number in the source column)

• TRG 7.05 Legal information for distributions [Included in v1.0.0-alpha]

• TRG 7.06 Legal information for end user content [Included in v1.0.0-alpha]

• TRG 7.07 Legal notice for documentation [TRG 7.07] Legal notice for documentation #60 -> Won't do because there was no clarification about which documentation needs to be CC-BY and what needs to be Apache-2.0 (Everything has the Apache Version)

Hints

Information Sharing

[matbmoser]

TRG Requirements for QG4 Approved by @SebastianBezold #108