Datagrepper: add live/ready probes and CSP

Signed-off-by: Aurélien Bompard <aurelien@bompard.org>

roles/openshift-apps/datagrepper/templates/datagrepper.cfg.py

@@ -5,3 +5,7 @@
 APP_PATH = "https://apps{{ env_suffix }}.fedoraproject.org/datagrepper2"
 DEFAULT_QUERY_DELTA = 3600
 DATANOMMER_SQLALCHEMY_URL = "postgresql://{{ datanommerDBUser }}:{{ (env == 'production')|ternary(datanommerDBPassword, datanommer_stg_db_password) }}@db-datanommer01{{ env_suffix }}.iad2.fedoraproject.org/datanommer2"
+
+# Only allow ajax/websockets connections back to our domains.
+# https://github.com/fedora-infra/datagrepper/pull/192
+CONTENT_SECURITY_POLICY = "connect-src https://*.fedoraproject.org wss://*.fedoraproject.org"

roles/openshift-apps/datagrepper/templates/deploymentconfig.yml

@@ -30,7 +30,6 @@ spec:
         imagePullPolicy: Always
         ports:
         - containerPort: 8080
-          #protocol: TCP
         #resources: {}
         #terminationMessagePath: /dev/termination-log
         #terminationMessagePolicy: File
@@ -50,20 +49,20 @@ spec:
           value: "/etc/datagrepper/gunicorn.conf.py"
         - name: SCRIPT_NAME
           value: "/datagrepper2"
-        # readinessProbe:
-        #   timeoutSeconds: 10
-        #   initialDelaySeconds: 5
-        #   periodSeconds: 60
-        #   httpGet:
-        #     path: "/datagrepper/healthz/ready"
-        #     port: 8080
-        # livenessProbe:
-        #   timeoutSeconds: 10
-        #   initialDelaySeconds: 10
-        #   periodSeconds: 60
-        #   httpGet:
-        #     path: "/datagrepper/healthz/live"
-        #     port: 8080
+        readinessProbe:
+          timeoutSeconds: 10
+          initialDelaySeconds: 5
+          periodSeconds: 60
+          httpGet:
+            path: "/datagrepper/healthz/ready"
+            port: 8080
+        livenessProbe:
+          timeoutSeconds: 10
+          initialDelaySeconds: 3
+          periodSeconds: 60
+          httpGet:
+            path: "/datagrepper/healthz/live"
+            port: 8080
       volumes:
       - name: datagrepper-config-volume
         configMap: