Everything within this section is only visible while editing. Use Page Properties ID "STUB", "REFACTURE", "PROGRESS", "rDEV", "rDOC", "rLANG" and "DONE".

Everything contained within the table is displayed in the (INTERNAL) Reports page.

Product Version	2021 Autumn
Report Note
Assignee	Antje

Resources & Remarks

Modification History

Add a new line to this table and fill it whenever you edit the page.

Name	Date	Product Version	Action
Antje	07 JUL 2021	2021 Autumn	Security of Actuator Endpoints

When updating your yuuvis® Momentum installation to version 2021 Autumn, manual configuration changes are required for some services.

Core

Configuration Changes for the AUTHENTICATION Service

Especially for customers using the Tenant Management services, the configuration of the AUTHENTICATION Service has to be adjusted as follows in order to request the /manage endpoints as usual:

Adjust the file 'authentication-prod.yml':

Expose the individual /manage endpoints in the section authorization.accesses.

Deprecated Configuration

New Configuration

authorization.accesses:
### manage-endpoints
  - endpoints: /manage/info,/manage/health
    expose: true

authorization.accesses:
### manage-endpoints
  - endpoints: /manage/**
    expose: true

Add the following two lines in order to select the port number 9091 for the /manage endpoints.
management.server.port: 9091 management.server.servlet.context-path: /

Adjust the Kubernetes Service:

Run the command.

kubectl -n yuuvis edit svc authentication

Remove the label yuuvis: "true".

Deprecated Configuration

New Configuration

  labels:
    app: yuuvis
    name: authentication
    yuuvis: "true"
  name: authentication

labels:
  app: yuuvis
  name: authentication
name: authentication

Create a new Kubernetes Service:

Create a new file authentication-manage-service.yaml with the following content:

apiVersion: v1
kind: Service
metadata:
  labels:
    app: yuuvis
    name: authentication-manage
  name: authentication-manage
spec:
  ports:
  - name: "80"
    port: 80
    targetPort: 9091
  selector:
    name: authentication
  type: ClusterIP

Run the command:

kubectl -n yuuvis apply -f authentication-manage-service.yaml

Adjust the ports for liveness probe and readiness probe:

Run the command:

kubectl -n yuuvis edit deploy authentication

Adjust the configuration:

Deprecated Configuration

New Configuration

livenessProbe:
  failureThreshold: 3
  httpGet:
    path: /manage/info
    port: 8080
    scheme: HTTP
...
readinessProbe:
  failureThreshold: 3
  httpGet:
    path: /manage/info
    port: 8080
    scheme: HTTP

livenessProbe:
  failureThreshold: 3
  httpGet:
    path: /manage/info
    port: 9091
    scheme: HTTP
...
readinessProbe:
  failureThreshold: 3
  httpGet:
    path: /manage/info
    port: 9091
    scheme: HTTP

Table of Contents

Core

Configuration Changes for the AUTHENTICATION Service

Adjust the file 'authentication-prod.yml':

Adjust the Kubernetes Service:

Create a new Kubernetes Service:

Adjust the ports for liveness probe and readiness probe:

Restart the AUTHENTICATION service.