Sync master with develop

.pre-commit-config.yaml

@@ -5,7 +5,7 @@ repos:
       - id: trailing-whitespace
       - id: end-of-file-fixer
       - id: check-yaml
-        exclude: ^applications/.*/internal/
+        exclude: ^(applications/.*/internal/|base-infrastructure/charts/)
       - id: check-case-conflict
       - id: detect-private-key
 

applications/argocd/production/applications/alert-hub-backend.yaml

@@ -10,17 +10,19 @@ spec:
   source:
     repoURL: ghcr.io/ifrcgo
     chart: ifrcgo-alert-hub-helm
-    targetRevision: 0.1.1-develop.c6f10f53
+    targetRevision: 0.1.1-develop.c8139886
     helm:
       valueFiles:
-        - values-go-deploy.yaml
-        - values-production.yaml
+        - values/operators.yaml
+        - values/go-deploy.yaml
+        - values/production.yaml
       valuesObject:
         app:
-          ingress:
-            host: "alerthub-api.ifrc.org"
-            tls:
-              secretName: "alerthub-helm-secret-cert"
+          api:
+            ingress:
+              host: "alerthub-api.ifrc.org"
+              tls:
+                secretName: "alerthub-helm-secret-cert"
           env:
             APP_FRONTEND_HOST: "https://alerthub.ifrc.org"
             APP_DOMAIN: "alerthub-api.ifrc.org"

applications/argocd/production/applications/alert-hub-frontend.yaml

@@ -8,22 +8,21 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: ghcr.io/ifrcgo/alert-hub-web-app
-    chart: ifrcgo-web-app-nginx-serve
-    targetRevision: 0.0.1-develop.6a791e5
+    repoURL: ghcr.io/ifrcgo
+    chart: alert-hub-web-app-helm
+    targetRevision: 0.0.1-develop.c2098b00
     helm:
       parameters:
-        - name: ingress.host
+        - name: app.ingress.hostname
           value: "alerthub.ifrc.org"
-        - name: ingress.className
+        - name: app.ingress.ingressClassName
           value: nginx
-        - name: ingress.tls.secretName
+        - name: app.ingress.tls.secretName
           value: "alerthub-helm-secret-cert"
-        - name: env.APP_GRAPHQL_API_ENDPOINT
+        - name: app.env.APP_GRAPHQL_API_ENDPOINT
           value: https://alerthub-api.ifrc.org/graphql/
       valueFiles:
-        - values.yaml
-        - values-production.yaml
+        - values/production.yaml
   destination:
     server: https://kubernetes.default.svc
     namespace: alert-hub

applications/argocd/production/applications/montandon-eoapi/application.yaml

@@ -54,17 +54,32 @@ spec:
           image:
             tag: 6.1.2
           overrideRootPath: ""
+          autoscaling:
+            enabled: true
+            minReplicas: 2
+            maxReplicas: 5
+            type: "cpu"
+            targets:
+              cpu: 70
+            behavior:
+              scaleDown:
+                stabilizationWindowSeconds: 300
+              scaleUp:
+                stabilizationWindowSeconds: 60
           settings:
             labels:
               azure.workload.identity/use: "true"
             resources:
               requests:
                 memory: "2048Mi"
-                cpu: "10m"
+                cpu: "500m"
               limits:
                 memory: "4096Mi"
                 cpu: "1000m"
             envVars:
+              WEB_CONCURRENCY: "4"
+              DB_MIN_CONN_SIZE: "1"
+              DB_MAX_CONN_SIZE: "2"
               ENABLE_TRANSACTIONS_EXTENSIONS: "TRUE"
               FORWARDED_ALLOW_IPS: "*"
               PROXY_HEADERS: True
@@ -144,7 +159,11 @@ spec:
           tls:
             enabled: true
             secretName: "montandon-eoapi-helm-secret-cert"
-        replicaCount: 1
+        autoscaling:
+          enabled: true
+          minReplicas: 2
+          maxReplicas: 6
+          targetCPUUtilizationPercentage: 75
         extraVolumes:
           - name: filters
             configMap:

applications/argocd/production/applications/montandon-etl.yaml

@@ -10,7 +10,7 @@ spec:
   source:
     repoURL: ghcr.io/ifrcgo/montandon-etl
     chart: montandon-etl-helm
-    targetRevision: 0.1.1-develop.c9f69327
+    targetRevision: 0.1.1-develop.c3ab8d96
     helm:
       valueFiles:
         - values/operators.yaml

applications/argocd/production/applications/risk-module.yaml

@@ -10,18 +10,19 @@ spec:
   source:
     repoURL: ghcr.io/ifrcgo
     chart: ifrcgo-risk-module-helm
-    targetRevision: 0.0.1-develop.c0c63878
+    targetRevision: 0.0.1-develop.c35bbf8e
     helm:
       valueFiles:
         - values/operators.yaml
         - values/go-deploy.yaml
         - values/production.yaml
       valuesObject:
         app:
-          ingress:
-            host: "go-risk-api.ifrc.org"
-            tls:
-              secretName: "risk-helm-secret-cert"
+          api:
+            ingress:
+              host: "go-risk-api.ifrc.org"
+              tls:
+                secretName: "risk-helm-secret-cert"
           env:
             RISK_API_FQDN: "https://go-risk-api.ifrc.org"
             DJANGO_ALLOWED_HOSTS: "go-risk-api.ifrc.org"

applications/argocd/staging/applications/alert-hub-backend.yaml

@@ -10,17 +10,19 @@ spec:
   source:
     repoURL: ghcr.io/ifrcgo
     chart: ifrcgo-alert-hub-helm
-    targetRevision: 0.1.1-develop.c6f10f53
+    targetRevision: 0.1.1-develop.c8139886
     helm:
       valueFiles:
-        - values-go-deploy.yaml
-        - values-staging.yaml
+        - values/operators.yaml
+        - values/go-deploy.yaml
+        - values/staging.yaml
       valuesObject:
         app:
-          ingress:
-            host: "alerthub-stage-api.ifrc.org"
-            tls:
-              secretName: "alerthub-helm-secret-cert"
+          api:
+            ingress:
+              host: "alerthub-stage-api.ifrc.org"
+              tls:
+                secretName: "alerthub-helm-secret-cert"
           env:
             APP_FRONTEND_HOST: "https://alerthub-stage.ifrc.org"
             APP_DOMAIN: "alerthub-stage-api.ifrc.org"

applications/argocd/staging/applications/alert-hub-frontend.yaml

@@ -8,22 +8,21 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: ghcr.io/ifrcgo/alert-hub-web-app
-    chart: ifrcgo-web-app-nginx-serve
-    targetRevision: 0.0.1-develop.6a791e5
+    repoURL: ghcr.io/ifrcgo
+    chart: alert-hub-web-app-helm
+    targetRevision: 0.0.1-develop.c2098b00
     helm:
       parameters:
-        - name: ingress.host
+        - name: app.ingress.hostname
           value: "alerthub-stage.ifrc.org"
-        - name: ingress.className
+        - name: app.ingress.ingressClassName
           value: nginx
-        - name: ingress.tls.secretName
+        - name: app.ingress.tls.secretName
           value: "alerthub-helm-secret-cert"
-        - name: env.APP_GRAPHQL_API_ENDPOINT
+        - name: app.env.APP_GRAPHQL_API_ENDPOINT
           value: https://alerthub-stage-api.ifrc.org/graphql/
       valueFiles:
-        - values.yaml
-        - values-staging.yaml
+        - values/staging.yaml
   destination:
     server: https://kubernetes.default.svc
     namespace: alert-hub

applications/argocd/staging/applications/montandon-eoapi/application.yaml

@@ -54,17 +54,32 @@ spec:
           image:
             tag: 6.1.2
           overrideRootPath: ""
+          autoscaling:
+            enabled: true
+            minReplicas: 1
+            maxReplicas: 3
+            type: "cpu"
+            targets:
+              cpu: 70
+            behavior:
+              scaleDown:
+                stabilizationWindowSeconds: 300
+              scaleUp:
+                stabilizationWindowSeconds: 60
           settings:
             labels:
               azure.workload.identity/use: "true"
             resources:
               requests:
                 memory: "2048Mi"
-                cpu: "10m"
+                cpu: "500m"
               limits:
                 memory: "4096Mi"
                 cpu: "1000m"
             envVars:
+              WEB_CONCURRENCY: "4"
+              DB_MIN_CONN_SIZE: "1"
+              DB_MAX_CONN_SIZE: "2"
               ENABLE_TRANSACTIONS_EXTENSIONS: "TRUE"
               FORWARDED_ALLOW_IPS: "*"
               PROXY_HEADERS: True
@@ -137,23 +152,51 @@ spec:
           ROOT_PATH: "/stac"
           COLLECTIONS_FILTER_CLS: stac_auth_proxy.montandon_filters:CollectionsFilter
           ITEMS_FILTER_CLS: stac_auth_proxy.montandon_filters:ItemsFilter
+          # External-token revocation (go-api issue #2794), injected via montandon_revocation.py.
+          GOAPI_TOKEN_VERIFY_TTL: "300"
+          # Short TTL for a fail-open allow served during a go-api outage, so revocation
+          # resumes within seconds of recovery instead of being masked for a full TTL.
+          GOAPI_TOKEN_VERIFY_OUTAGE_TTL: "30"
+          # TTL for a definitive deny (go-api reported the jti inactive/unknown): 24h, so a
+          # known-revoked token is not re-checked against go-api on every request.
+          GOAPI_TOKEN_VERIFY_DENY_TTL: "86400"
+          # Upper bound on cached jti decisions (memory guard on a long-lived pod).
+          GOAPI_TOKEN_VERIFY_CACHE_MAX: "50000"
+          GOAPI_TOKEN_VERIFY_TIMEOUT: "3"
+          GOAPI_TOKEN_VERIFY_FAIL_OPEN: "true"
+          GOAPI_TOKEN_STATIC_BLACKLIST: "fec23689-bf00-401e-9f9c-a65684f44b5f"  # NOTE: Token ID used in hackathon
         ingress:
           enabled: true
           host: "montandon-eoapi-stage.ifrc.org"
           className: "nginx"
           tls:
             enabled: true
             secretName: "montandon-eoapi-helm-secret-cert"
-        replicaCount: 1
+        autoscaling:
+          enabled: true
+          minReplicas: 1
+          maxReplicas: 3
+          targetCPUUtilizationPercentage: 75
+        resources:
+          limits:
+            cpu: 500m
+            memory: "2048Mi"
+          requests:
+            cpu: 200m
+            memory: "1024Mi"
         extraVolumes:
-          - name: filters
+          - name: custom-modules
             configMap:
-              name: stac-auth-proxy-filters
+              name: stac-auth-proxy-modules
         extraVolumeMounts:
-          - name: filters
+          - name: custom-modules
             mountPath: /app/src/stac_auth_proxy/montandon_filters.py
             subPath: montandon_filters.py
             readOnly: true
+          - name: custom-modules
+            mountPath: /app/src/stac_auth_proxy/montandon_revocation.py
+            subPath: montandon_revocation.py
+            readOnly: true
   destination:
     server: https://kubernetes.default.svc
     namespace: montandon-eoapi

applications/argocd/staging/applications/montandon-eoapi/internal/files/stac-auth-proxy/montandon_filters.py

@@ -17,6 +17,13 @@
 
 import httpx
 
+# Apply the external-token revocation monkeypatch to EnforceAuthMiddleware. stac-auth-proxy
+# imports this filter module during app construction (before serving requests), which is the
+# only Helm-reachable hook to run the patch. Keep this call.
+from .montandon_revocation import apply_patch
+
+apply_patch()
+
 logger = logging.getLogger(__name__)
 
 if not (UPSTREAM_URL := os.environ.get("UPSTREAM_URL")):