Merge branch 'main' into fix/bfl-analytics

apps/.olares/config/user/helm-charts/system-apps/templates/system-frontend.yaml

@@ -669,6 +669,19 @@ spec:
                   name: user-service-secrets
             - name: DATABASE_URL
               value: postgres://user_service_{{ .Values.bfl.username }}:$(DATABASE_PASSWORD)@citus-master-svc.user-system-{{ .Values.bfl.username }}/user_space_{{ .Values.bfl.username }}_user_service?sslmode=disable
+            - name: NATS_HOST
+              value: nats.user-system-{{ .Values.bfl.username }}
+            - name: NATS_PORT
+              value: '4222'
+            - name: NATS_USERNAME_USERSERVICE
+              value: user-service-{{ .Values.bfl.username }}
+            - name: NATS_PASSWORD_USERSESRVICE
+              valueFrom:
+                secretKeyRef:
+                  key: nats_password
+                  name: user-service-nats-secret
+            - name: NATS_SUBJECT_USER_APPS
+              value: terminus.user.*.{{ .Values.bfl.username}}
         - name: drive-server
           image: beclab/drive:v0.0.72
           imagePullPolicy: IfNotPresent
@@ -3401,7 +3414,7 @@ spec:
           - appName: files-server
             sub: allow
             pub: allow
-        name: "files.*"
+        name: "*."
         permission:
           pub: allow
           sub: allow
@@ -3452,6 +3465,9 @@ spec:
           - appName: knowledge
             sub: allow
             pub: allow
+          - appName: download
+            sub: allow
+            pub: allow
         name: "knowledge.*"
         permission:
           sub: allow

framework/app-service/.olares/config/cluster/deploy/appservice_deploy.yaml

@@ -162,7 +162,7 @@ spec:
       priorityClassName: "system-cluster-critical"
       containers:
       - name: app-service
-        image: beclab/app-service:0.3.37
+        image: beclab/app-service:0.3.38
         imagePullPolicy: IfNotPresent
         securityContext:
           runAsUser: 0

framework/bfl/.olares/config/launcher/templates/bfl_deploy.yaml

@@ -318,7 +318,7 @@ spec:
               apiVersion: v1
               fieldPath: spec.nodeName
       - name: ingress
-        image: beclab/bfl-ingress:v0.3.6
+        image: beclab/bfl-ingress:v0.3.7
         imagePullPolicy: IfNotPresent
         volumeMounts:
         - name: ngxlog

framework/knowledge/.olares/config/cluster/deploy/knowledge_deployment.yaml

@@ -437,7 +437,14 @@ spec:
         secretKeyRef:
           key: nat_password
           name: knowledge-secrets
-    refs: []
+    refs:
+      - appName: user-service
+        appNamespace: user
+        subjects:
+          - name: knowledge.*
+            perm:
+              - pub
+              - sub
     subjects:
     - name: download_status
       permission:

framework/vault/.olares/config/cluster/deploy/vault_server_deploy.yaml

@@ -136,7 +136,7 @@ spec:
           valueFrom:
             secretKeyRef:
               key: nats_password
-              name: nats-secrets
+              name: vault-server-nats-secret
         - name: NATS_SUBJECT_SYSTEM_VAULT
           value: "terminus.{{ .Release.Namespace }}.system.vault"
         volumeMounts: