[AAI] 15.0.4 release

- [resources,traversal,graphadmin,schema-service] use v30 api version
- [resources,traversal,graphadmin] make basic-auth configurable
- [resources,traversal] remove Keycloak-auth related files
- [resources,traversal] remove logToFile option since container filesystems are read-only [0]
- [graphadmin] use init container for schema-creation

[0] and sooner or later any tmp volume will fill up

Issue-ID: AAI-4124
Change-Id: Ib9b70dedd07acfb8ae24506ab044de0940c0c815
Signed-off-by: Fiete Ostkamp <Fiete.Ostkamp@telekom.de>

8 files changed, 60 insertions, 93 deletions

diff --git a/kubernetes/aai/components/aai-resources/resources/config/aaiconfig.properties b/kubernetes/aai/components/aai-resources/resources/config/aaiconfig.properties
index 6392a8e0b0..4985a97dba 100644
--- a/kubernetes/aai/components/aai-resources/resources/config/aaiconfig.properties
+++ b/kubernetes/aai/components/aai-resources/resources/config/aaiconfig.properties
@@ -45,8 +45,8 @@ aai.global.callback.url=http://aai.{{ include "common.namespace" . }}/aai/
 
 {{ if .Values.global.config.basic.auth.enabled }}
 aai.tools.enableBasicAuth=true
-aai.tools.username={{ .Values.global.config.basic.auth.username }}
-aai.tools.password={{ .Values.global.config.basic.auth.passwd }}
+aai.tools.username={{ (index .Values.global.config.basic.auth.users 0).username }}
+aai.tools.password={{ (index .Values.global.config.basic.auth.users 0).password }}
 {{ end }}
 
 aai.notification.current.version={{ .Values.global.config.schema.version.api.default }}
diff --git a/kubernetes/aai/components/aai-resources/resources/config/application-keycloak.properties b/kubernetes/aai/components/aai-resources/resources/config/application-keycloak.properties
deleted file mode 100644
index 738634d230..0000000000
--- a/kubernetes/aai/components/aai-resources/resources/config/application-keycloak.properties
+++ /dev/null
@@ -1,14 +0,0 @@
-
-spring.autoconfigure.exclude=\
-  org.springframework.boot.autoconfigure.jdbc.DataSourceAutoConfiguration,\
-  org.springframework.boot.autoconfigure.orm.jpa.HibernateJpaAutoConfiguration
-
-multi.tenancy.enabled={{ .Values.config.keycloak.multiTenancy.enabled }}
-keycloak.auth-server-url=http://{{ .Values.config.keycloak.host }}:{{ .Values.config.keycloak.port }}/auth
-keycloak.realm={{ .Values.config.keycloak.realm }}
-keycloak.resource={{ .Values.config.keycloak.resource }}
-keycloak.public-client=true
-keycloak.principal-attribute=preferred_username
-
-keycloak.ssl-required=external
-keycloak.bearer-only=true
diff --git a/kubernetes/aai/components/aai-resources/resources/config/application.properties b/kubernetes/aai/components/aai-resources/resources/config/application.properties
index 5a16ebe9ef..6c34705e8a 100644
--- a/kubernetes/aai/components/aai-resources/resources/config/application.properties
+++ b/kubernetes/aai/components/aai-resources/resources/config/application.properties
@@ -51,7 +51,6 @@ server.tomcat.max-idle-time=60000
 # If you get an application startup failure that the port is already taken
 # If thats not it, please check if the key-store file path makes sense
 server.local.startpath=aai-resources/src/main/resources/
-server.basic.auth.location=${server.local.startpath}etc/auth/realm.properties
 
 server.port=8447
 
@@ -121,3 +120,9 @@ scrape.uri.metrics=false
 # but doesn't show up in micrometer metrics
 aai.actuator.echo.enabled={{ .Values.actuator.echo.enabled }}
 aai.graph.properties.path=${server.local.startpath}/etc/appprops/janusgraph-realtime.properties
+
+aai.basic-auth.enabled={{ .Values.global.config.basic.auth.enabled }}
+{{- range $index, $user := .Values.global.config.basic.auth.users }}
+aai.basic-auth.users[{{ $index }}].username={{ $user.username }}
+aai.basic-auth.users[{{ $index }}].password={{ $user.password }}
+{{- end }}
diff --git a/kubernetes/aai/components/aai-resources/resources/config/realm.properties b/kubernetes/aai/components/aai-resources/resources/config/realm.properties
deleted file mode 100644
index f254d03631..0000000000
--- a/kubernetes/aai/components/aai-resources/resources/config/realm.properties
+++ /dev/null
@@ -1,35 +0,0 @@
-{{/*
-# Copyright © 2018 Amdocs, Bell Canada, AT&T
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#       http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-# format : username: password[,rolename ...]
-# default username/password: AAI/AAI, MSO/MSO, ModelLoader/ModelLoader...
-*/ -}}
-AAI:OBF:1gfr1ev31gg7,admin
-MSO:OBF:1jzx1lz31k01,admin
-SDNC:OBF:1itr1i0l1i151isv,admin
-DCAE:OBF:1g8u1f9d1f991g8w,admin
-POLICY:OBF:1mk61i171ima1im41i0j1mko,admin
-ASDC:OBF:1f991j0u1j001f9d,admin
-ModelLoader:OBF:1qvu1v2h1sov1sar1wfw1j7j1wg21saj1sov1v1x1qxw,admin
-AaiUI:OBF:1gfr1p571unz1p4j1gg7,admin
-OOF:OBF:1img1ke71ily,admin
-aai@aai.onap.org:OBF:1fia1ju61l871lfe18xp18xr18xt1lc41l531jrk1fek,admin
-so@so.onap.org:OBF:1fia1ju61l871lfe18xp18xr18xt1lc41l531jrk1fek,admin
-sdnc@sdnc.onap.org:OBF:1fia1ju61l871lfe18xp18xr18xt1lc41l531jrk1fek,admin
-dcae@dcae.onap.org:OBF:1fia1ju61l871lfe18xp18xr18xt1lc41l531jrk1fek,admin
-policy@policy.onap.org:OBF:1fia1ju61l871lfe18xp18xr18xt1lc41l531jrk1fek,admin
-sdc@sdc.onap.org:OBF:1fia1ju61l871lfe18xp18xr18xt1lc41l531jrk1fek,admin
-oof@oof.onap.org:OBF:1fia1ju61l871lfe18xp18xr18xt1lc41l531jrk1fek,admin
-pomba@pomba.onap.org:OBF:1fia1ju61l871lfe18xp18xr18xt1lc41l531jrk1fek,admin
-vfc@vfc.onap.org:OBF:1fia1ju61l871lfe18xp18xr18xt1lc41l531jrk1fek,admin
diff --git a/kubernetes/aai/components/aai-resources/templates/_helpers.tpl b/kubernetes/aai/components/aai-resources/templates/_helpers.tpl
new file mode 100644
index 0000000000..003be58409
--- /dev/null
+++ b/kubernetes/aai/components/aai-resources/templates/_helpers.tpl
@@ -0,0 +1,21 @@
+{{- define "aai.waitForSchemaCreation" -}}
+- name: wait-for-schema-creation
+  image: "{{ include "repositoryGenerator.image.curl" . }}"
+  imagePullPolicy: IfNotPresent
+  command: ["/bin/sh", "-c"]
+  args:
+    - |
+      URL="{{ required "URL is required" (.Values.schemaInitCheckURL | default "http://aai-graphadmin:8449/isSchemaInitialized") }}"
+      AUTH="{{ printf "%s:%s" (index .Values.global.config.basic.auth.users 0).username (index .Values.global.config.basic.auth.users 0).password }}"
+      while true; do
+        RESPONSE=$(curl -u $AUTH -s $URL)
+        if [ "$RESPONSE" = "true" ]; then
+          echo "Request successful. Schema is initialized."
+          exit 0
+        else
+          echo "Request unsuccessful. Schema is not yet initialized. Retrying in 3 seconds..."
+          sleep 3
+        fi
+      done
+  {{ include "common.containerSecurityContext" . | indent 2 | trim }}
+{{- end -}}
diff --git a/kubernetes/aai/components/aai-resources/templates/configmap.yaml b/kubernetes/aai/components/aai-resources/templates/configmap.yaml
index acf30c831d..73723a1270 100644
--- a/kubernetes/aai/components/aai-resources/templates/configmap.yaml
+++ b/kubernetes/aai/components/aai-resources/templates/configmap.yaml
@@ -26,5 +26,3 @@ data:
 {{ tpl (.Files.Glob "resources/config/janusgraph-realtime.properties").AsConfig . | indent 2 }}
 {{ tpl (.Files.Glob "resources/config/aaiconfig.properties").AsConfig . | indent 2 }}
 {{ tpl (.Files.Glob "resources/config/application.properties").AsConfig . | indent 2 }}
-{{ tpl (.Files.Glob "resources/config/application-keycloak.properties").AsConfig . | indent 2 }}
-{{ tpl (.Files.Glob "resources/config/realm.properties").AsConfig . | indent 2 }}
diff --git a/kubernetes/aai/components/aai-resources/templates/deployment.yaml b/kubernetes/aai/components/aai-resources/templates/deployment.yaml
index 6b35a0f252..35378fd83c 100644
--- a/kubernetes/aai/components/aai-resources/templates/deployment.yaml
+++ b/kubernetes/aai/components/aai-resources/templates/deployment.yaml
@@ -49,9 +49,7 @@ spec:
       {{- if .Values.global.jobs.migration.enabled }}
       {{ include "common.readinessCheck.waitFor" (dict "dot" . "wait_for" .Values.readinessCheck.wait_for_migration) | nindent 8 }}
       {{- else if .Values.global.jobs.createSchema.enabled  }}
-      {{ include "common.readinessCheck.waitFor" (dict "dot" . "wait_for" .Values.readinessCheck.wait_for_createSchema) | nindent 8 }}
-      {{- else }}
-      {{ include "common.readinessCheck.waitFor" (dict "dot" . "wait_for" .Values.readinessCheck.wait_for_cassandra) | nindent 8 }}
+      {{ include "aai.waitForSchemaCreation" . | nindent 6 }}
       {{- end }}
       containers:
       - name: {{ include "common.name" . }}
@@ -98,15 +96,9 @@ spec:
         - mountPath: /opt/app/aai-resources/resources/logback.xml
           name: {{ include "common.fullname" . }}-config
           subPath: logback.xml
-        - mountPath: /opt/app/aai-resources/resources/etc/auth/realm.properties
-          name: {{ include "common.fullname" . }}-config
-          subPath: realm.properties
         - mountPath: /opt/app/aai-resources/resources/application.properties
           name: {{ include "common.fullname" . }}-config
           subPath: application.properties
-        - mountPath: /opt/app/aai-resources/resources/application-keycloak.properties
-          name: {{ include "common.fullname" . }}-config
-          subPath: application-keycloak.properties
         - mountPath: /tmp
           name: tmp
         ports:
diff --git a/kubernetes/aai/components/aai-resources/values.yaml b/kubernetes/aai/components/aai-resources/values.yaml
index 9c7dea82ab..625267b318 100644
--- a/kubernetes/aai/components/aai-resources/values.yaml
+++ b/kubernetes/aai/components/aai-resources/values.yaml
@@ -47,8 +47,33 @@ global: # global defaults
     basic:
       auth:
         enabled: true
-        username: AAI
-        passwd: AAI
+        users:
+          - username: aai@aai.onap.org
+            password: demo123456!
+          - username: so@so.onap.org
+            password: demo123456!
+          - username: sdnc@sdnc.onap.org
+            password: demo123456!
+          - username: dcae@dcae.onap.org
+            password: demo123456!
+          - username: policy@policy.onap.org
+            password: demo123456!
+          - username: sdc@sdc.onap.org
+            password: demo123456!
+          - username: AAI
+            password: AAI
+          - username: DCAE
+            password: DCAE
+          - username: MSO
+            password: MSO
+          - username: POLICY
+            password: POLICY
+          - username: ASDC
+            password: ASDC
+          - username: ModelLoader
+            password: ModelLoader
+          - username: AaiUI
+            password: AaiUI
 
     # Active spring profiles for the resources microservice
     profiles:
@@ -77,11 +102,11 @@ global: # global defaults
       version:
         # Current version of the REST API
         api:
-          default: v29
+          default: v30
         # Specifies which version the depth parameter is configurable
         depth: v11
         # List of all the supported versions of the API
-        list: v11,v12,v13,v14,v15,v16,v17,v18,v19,v20,v21,v22,v23,v24,v25,v26,v27,v28,v29
+        list: v11,v12,v13,v14,v15,v16,v17,v18,v19,v20,v21,v22,v23,v24,v25,v26,v27,v28,v29,v30
         # Specifies from which version related link should appear
         related:
           link: v11
@@ -134,7 +159,7 @@ aai_enpoints:
     url: external-system
 
 # application image
-image: onap/aai-resources:1.15.4
+image: onap/aai-resources:1.15.5
 pullPolicy: Always
 restartPolicy: Always
 flavor: small
@@ -155,19 +180,6 @@ updateStrategy:
 
 # Configuration for the resources deployment
 config:
-  # configure keycloak according to your environment.
-  # don't forget to add keycloak in active profiles above (global.config.profiles)
-  keycloak:
-    host: keycloak.your.domain
-    port: 8180
-    # Specifies a set of users, credentials, roles, and groups
-    realm: aai-resources
-    # Used by any client application for enabling fine-grained authorization for their protected resources
-    resource: aai-resources-app
-    # If set to true, additional criteria will be added that match the data-owner property with the given role
-    # to the user in keycloak
-    multiTenancy:
-      enabled: true
   janusgraph:
     caching:
       # enable when running read-heavy workloads
@@ -395,18 +407,6 @@ log:
     dbMetric: WARN
 logConfigMapNamePrefix: '{{ include "common.fullname" . }}'
 
-# To make logback capping values configurable
-logback:
-  logToFileEnabled: false
-  maxHistory: 7
-  totalSizeCap: 1GB
-  queueSize: 1000
-
-accessLogback:
-  livenessAccessLogEnabled: false # false: do not log kubernetes liveness probes
-  logToFileEnabled: false
-  maxHistory: 7
-  totalSizeCap: 1GB
 #################################################################
 # Secrets metaconfig
 #################################################################