Merge "[OOM] Moving cert-service to platform"

15 files changed, 525 insertions, 0 deletions

diff --git a/kubernetes/platform/components/Makefile b/kubernetes/platform/components/Makefile
new file mode 100644
index 0000000000..27e17db9ff
--- /dev/null
+++ b/kubernetes/platform/components/Makefile
@@ -0,0 +1,51 @@
+# Copyright © 2020 Samsung Electronics
+# Modifications Copyright © 2020 Nokia
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+ROOT_DIR := $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))
+OUTPUT_DIR := $(ROOT_DIR)/../../dist
+PACKAGE_DIR := $(OUTPUT_DIR)/packages
+SECRET_DIR := $(OUTPUT_DIR)/secrets
+
+EXCLUDES :=
+HELM_CHARTS := $(filter-out $(EXCLUDES), $(sort $(patsubst %/.,%,$(wildcard */.))))
+
+.PHONY: $(EXCLUDES) $(HELM_CHARTS)
+
+all: $(HELM_CHARTS)
+
+$(HELM_CHARTS):
+	@echo "\n[$@]"
+	@make package-$@
+
+make-%:
+	@if [ -f $*/Makefile ]; then make -C $*; fi
+
+dep-%: make-%
+	@if [ -f $*/requirements.yaml ]; then helm dep up $*; fi
+
+lint-%: dep-%
+	@if [ -f $*/Chart.yaml ]; then helm lint $*; fi
+
+package-%: lint-%
+	@mkdir -p $(PACKAGE_DIR)
+	@if [ -f $*/Chart.yaml ]; then helm package -d $(PACKAGE_DIR) $*; fi
+	@helm repo index $(PACKAGE_DIR)
+
+clean:
+	@rm -f */requirements.lock
+	@rm -f *tgz */charts/*tgz
+	@rm -rf $(PACKAGE_DIR)
+%:
+	@:
diff --git a/kubernetes/platform/components/oom-cert-service/.helmignore b/kubernetes/platform/components/oom-cert-service/.helmignore
new file mode 100644
index 0000000000..50af031725
--- /dev/null
+++ b/kubernetes/platform/components/oom-cert-service/.helmignore
@@ -0,0 +1,22 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/kubernetes/platform/components/oom-cert-service/Chart.yaml b/kubernetes/platform/components/oom-cert-service/Chart.yaml
new file mode 100644
index 0000000000..dd99988868
--- /dev/null
+++ b/kubernetes/platform/components/oom-cert-service/Chart.yaml
@@ -0,0 +1,18 @@
+# Copyright © 2020 Nokia
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+description: ONAP Cert Service
+name: oom-cert-service
+version: 6.0.0
\ No newline at end of file
diff --git a/kubernetes/platform/components/oom-cert-service/requirements.yaml b/kubernetes/platform/components/oom-cert-service/requirements.yaml
new file mode 100644
index 0000000000..6afaa06e8a
--- /dev/null
+++ b/kubernetes/platform/components/oom-cert-service/requirements.yaml
@@ -0,0 +1,18 @@
+ # Copyright © 2020 Orange
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+ dependencies:
+  - name: common
+    version: ~6.x-0
+    repository: '@local'
diff --git a/kubernetes/platform/components/oom-cert-service/resources/certServiceClient-keystore.jks b/kubernetes/platform/components/oom-cert-service/resources/certServiceClient-keystore.jks
new file mode 100644
index 0000000000..c089764466
--- /dev/null
+++ b/kubernetes/platform/components/oom-cert-service/resources/certServiceClient-keystore.jks
diff --git a/kubernetes/platform/components/oom-cert-service/resources/certServiceServer-keystore.jks b/kubernetes/platform/components/oom-cert-service/resources/certServiceServer-keystore.jks
new file mode 100644
index 0000000000..e3882b1357
--- /dev/null
+++ b/kubernetes/platform/components/oom-cert-service/resources/certServiceServer-keystore.jks
diff --git a/kubernetes/platform/components/oom-cert-service/resources/certServiceServer-keystore.p12 b/kubernetes/platform/components/oom-cert-service/resources/certServiceServer-keystore.p12
new file mode 100644
index 0000000000..ce9261146c
--- /dev/null
+++ b/kubernetes/platform/components/oom-cert-service/resources/certServiceServer-keystore.p12
diff --git a/kubernetes/platform/components/oom-cert-service/resources/default/cmpServers.json b/kubernetes/platform/components/oom-cert-service/resources/default/cmpServers.json
new file mode 100644
index 0000000000..358f2a82c7
--- /dev/null
+++ b/kubernetes/platform/components/oom-cert-service/resources/default/cmpServers.json
@@ -0,0 +1,3 @@
+{
+  "cmpv2Servers": []
+}
\ No newline at end of file
diff --git a/kubernetes/platform/components/oom-cert-service/resources/root.crt b/kubernetes/platform/components/oom-cert-service/resources/root.crt
new file mode 100644
index 0000000000..242e437f75
--- /dev/null
+++ b/kubernetes/platform/components/oom-cert-service/resources/root.crt
@@ -0,0 +1,33 @@
+-----BEGIN CERTIFICATE-----
+MIIFnjCCA4agAwIBAgIEHn8h9TANBgkqhkiG9w0BAQwFADB3MQswCQYDVQQGEwJV
+UzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuLUZyYW5jaXNjbzEZ
+MBcGA1UEChMQTGludXgtRm91bmRhdGlvbjENMAsGA1UECxMET05BUDERMA8GA1UE
+AxMIb25hcC5vcmcwHhcNMjAwODI3MDg1MjQ3WhcNMzAwODI1MDg1MjQ3WjB3MQsw
+CQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuLUZy
+YW5jaXNjbzEZMBcGA1UEChMQTGludXgtRm91bmRhdGlvbjENMAsGA1UECxMET05B
+UDERMA8GA1UEAxMIb25hcC5vcmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
+AoICAQCOQ8TArFljhDu9EXKqAppV/eslelFAGG1NhDnh3PI6jK7qKKSTIcUpKPiG
+u9CagyNq4Y1dNt1LsP/KSDDkm6CGYW2z4E0Nm0ckcGc4izdoFDFhoXkrMoKvQxct
+az3YD1AiEH7kIYqDp7S3LMP8FbAXlcV62J2AEPqWtbFGszi6Pj65InNnFTGT4Oon
+E46egKcSWAhNR6vN29MO9/0wZHxwXWlcS2CKt6+2QKpfimHf48EJ0idntsKpj302
+i93jWGVNtORZbDddmVZG6XaVQkfRrJiivPQHvIXU5bWCsV7OQsrzbbsSscnqDuAr
+5DjR1Jbm2394e3DkXZTnqLGKReaaz0roA7ybLSesU1Fu0ZjD5Zq6ZezpXEQvcxcd
+wmq1A8ugeuRKhizeBO9YddjYTHWflHLBpiEyIwDCUsXfdNdS0nHQNKMDNbkC9512
+SLbG1N6iLGt85BriMLzJrlMP48feuheu3G/Mrit01yBzIgbqP30DcAIox5bgnJOY
+knxPctNaGsBup76msBzk+aBeDU5N/zirEJYxTmC3okeISzcLFlqYUUSsEzlqh8SS
+pNDK6ZbnX1khJJdUbCJGmgFS6N4RPXdxX12OCJDyjjCXcn7RXcZsYb3A+eF09+EM
+l0Vp3P+Aj6+eSN+t1Ez0sjGfSv/I8q1zV/trYZBq/LZIznfBFwIDAQABozIwMDAd
+BgNVHQ4EFgQUC0e3vObokYFDHM21OlRF4UO6L7EwDwYDVR0TAQH/BAUwAwEB/zAN
+BgkqhkiG9w0BAQwFAAOCAgEAWLrsWPcRJb81ozx1O8lytX4aUagjYyWIDOst1mqI
+VH+U5bHo7oReKdfFcy4Zen2bKh9DITGD7jweqTxAVx3scLq/3PE2HSG+6fNJ6wt7
+amrMZA6IdWqDWnaFMZQug3JTMH7s6v3rD7FU7awVc6lY+7TjR3qunU2m8F5GvATF
+ag+VmMSLiaBBbbmQqd1JkvCzPXlwwN3rg2u81zMys1AIbgeOlE5ZmWppOQpi7UrZ
+C8PTsRKzapgENlgxtsqVjsAMJI6OGk20bNcQKDn5fU6QwYLfnLPlkuRmFD8FeluI
+jz+ROjzxdC7E/BA80uZctvEEvn2VnD01IlEm6HoC+71erT+zmvM4AGd7EJa6mklb
+X+tGSkfzbIAR2gcn9sdNdhYA2hXXpQaeEp19bB8MAoSp5raCtbqZDQVHofJFY7gG
+FW+yKLlqBTCTm1XOPriUwbP6gkpLlkeTxeIAx8QbucoFx11J7jAeXY7oTXfSQw3h
+OR0/CHlG0BjVep6RNGA0k9cDNRyIdkxvA31rtgYCSbtepR5IhZyFhiN25Djxu/g9
+krspoxAS9ModBSiswjl4Q26eoYT4pnFXMfYbh5E4qNZNv0/S3YQ0HSTupls6M77J
+KHMx17m8EWtdsv2KyUkFqu1Q1nGky7SjpFUsVlp65Q+au3ftKxUDIRWK6jgpRH1e
+YIk=
+-----END CERTIFICATE-----
diff --git a/kubernetes/platform/components/oom-cert-service/resources/test/cmpServers.json b/kubernetes/platform/components/oom-cert-service/resources/test/cmpServers.json
new file mode 100644
index 0000000000..06e1087f60
--- /dev/null
+++ b/kubernetes/platform/components/oom-cert-service/resources/test/cmpServers.json
@@ -0,0 +1,24 @@
+{
+  "cmpv2Servers": [
+    {
+      "caName": "CLIENT",
+      "url": "http://ejbca:8080/ejbca/publicweb/cmp/cmp",
+      "issuerDN": "CN=ManagementCA",
+      "caMode": "CLIENT",
+      "authentication": {
+        "iak": "${CLIENT_IAK}",
+        "rv": "${CLIENT_RV}"
+      }
+    },
+    {
+      "caName": "RA",
+      "url": "http://ejbca:8080/ejbca/publicweb/cmp/cmpRA",
+      "issuerDN": "CN=ManagementCA",
+      "caMode": "RA",
+      "authentication": {
+        "iak": "${RA_IAK}",
+        "rv": "${RA_RV}"
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/kubernetes/platform/components/oom-cert-service/resources/truststore.jks b/kubernetes/platform/components/oom-cert-service/resources/truststore.jks
new file mode 100644
index 0000000000..3d857e34af
--- /dev/null
+++ b/kubernetes/platform/components/oom-cert-service/resources/truststore.jks
diff --git a/kubernetes/platform/components/oom-cert-service/templates/deployment.yaml b/kubernetes/platform/components/oom-cert-service/templates/deployment.yaml
new file mode 100644
index 0000000000..666e83c5f8
--- /dev/null
+++ b/kubernetes/platform/components/oom-cert-service/templates/deployment.yaml
@@ -0,0 +1,123 @@
+# Copyright © 2020, Nokia
+# Modifications Copyright  © 2020, Nordix Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+{{- if .Values.global.cmpv2Enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata: {{- include "common.resourceMetadata" . | nindent 2 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector: {{- include "common.selectors" . | nindent 4 }}
+  template:
+    metadata: {{- include "common.templateMetadata" . | nindent 6 }}
+    spec:
+      volumes:
+{{- if .Values.global.addTestingComponents }}
+        - name: cmp-servers-template-volume
+          secret:
+            secretName: {{ .Values.cmpServers.secret.name }}
+        - name: {{ .Values.cmpServers.volume.name }}
+          emptyDir:
+            medium: Memory
+{{- else }}
+        - name: {{ .Values.cmpServers.volume.name }}
+          secret:
+            secretName: {{ .Values.cmpServers.secret.name }}
+{{- end }}
+        - name: {{ .Values.tls.server.volume.name }}
+          secret:
+            secretName: {{ .Values.tls.server.secret.name }}
+{{- if .Values.global.addTestingComponents }}
+      initContainers:
+        - name: wait-for-ejbca
+          command:
+          - /app/ready.py
+          args:
+          - --container-name
+          - ejbca-ejbca
+          env:
+          - name: NAMESPACE
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.namespace
+          image: "{{ include "common.repository" . }}/{{ .Values.global.readinessImage }}"
+          imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+        - name: subsitute-envs
+          image: "{{ .Values.global.envsubstImage }}"
+          imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+          command: ['sh', '-c', "cd /config-input &&  envsubst < cmpServers.json > {{ .Values.cmpServers.volume.mountPath }}/cmpServers.json"]
+          volumeMounts:
+            - name: cmp-servers-template-volume
+              mountPath: /config-input
+              readOnly: true
+            - name: {{ .Values.cmpServers.volume.name }}
+              mountPath: {{ .Values.cmpServers.volume.mountPath }}
+              readOnly: false
+          env:
+            - name: CLIENT_IAK
+              {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "ejbca-server-client-iak" "key" "password") | indent 14 }}
+            - name: CLIENT_RV
+              {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "cmp-config-client-rv" "key" "password") | indent 14 }}
+            - name: RA_IAK
+              {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "ejbca-server-ra-iak" "key" "password") | indent 14 }}
+            - name: RA_RV
+              {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "cmp-config-ra-rv" "key" "password") | indent 14 }}
+{{- end }}
+      containers:
+        - name: {{ include "common.name" . }}
+          image: {{ include "common.repository" . }}/{{ .Values.image }}
+          imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+          ports: {{ include "common.containerPorts" . | nindent 10 }}
+          env:
+            - name: HTTPS_PORT
+              value: "{{ .Values.envs.httpsPort }}"
+            - name: KEYSTORE_PATH
+              value: "{{ .Values.tls.server.volume.mountPath }}/{{ .Values.envs.keystore.jksName }}"
+            - name: KEYSTORE_P12_PATH
+              value: "{{ .Values.tls.server.volume.mountPath }}/{{ .Values.envs.keystore.p12Name }}"
+            - name: TRUSTSTORE_PATH
+              value: "{{ .Values.tls.server.volume.mountPath }}/{{ .Values.envs.truststore.jksName }}"
+            - name: ROOT_CERT
+              value: "{{ .Values.tls.server.volume.mountPath }}/{{ .Values.envs.truststore.crtName }}"
+            - name: KEYSTORE_PASSWORD
+              {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "keystore-password" "key" "password") | indent 14 }}
+            - name: TRUSTSTORE_PASSWORD
+              {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "truststore-password" "key" "password") | indent 14 }}
+          livenessProbe:
+            exec:
+              command:
+                - /bin/bash
+                - -c
+                - {{ .Values.liveness.command }}
+            initialDelaySeconds: {{ .Values.liveness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.liveness.periodSeconds }}
+          readinessProbe:
+            exec:
+              command:
+                - /bin/bash
+                - -c
+                - {{ .Values.readiness.command }}
+            initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readiness.periodSeconds }}
+          volumeMounts:
+            - name: {{ .Values.cmpServers.volume.name }}
+              mountPath: {{ .Values.cmpServers.volume.mountPath }}
+              readOnly: false
+            - name: {{ .Values.tls.server.volume.name }}
+              mountPath: {{ .Values.tls.server.volume.mountPath }}
+              readOnly: true
+          resources: {{ include "common.resources" . | nindent 12 }}
+{{ end -}}
diff --git a/kubernetes/platform/components/oom-cert-service/templates/secret.yaml b/kubernetes/platform/components/oom-cert-service/templates/secret.yaml
new file mode 100644
index 0000000000..33056c79fd
--- /dev/null
+++ b/kubernetes/platform/components/oom-cert-service/templates/secret.yaml
@@ -0,0 +1,56 @@
+# Copyright © 2020, Nokia
+# Modifications Copyright  © 2020, Nordix Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+{{- if .Values.global.cmpv2Enabled }}
+{{ include "common.secretFast" . }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.cmpServers.secret.name }}
+type: Opaque
+data:
+{{ if .Values.global.addTestingComponents }}
+  {{ (.Files.Glob "resources/test/cmpServers.json").AsSecrets }}
+{{ else }}
+  {{ (.Files.Glob "resources/default/cmpServers.json").AsSecrets }}
+{{ end }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.global.certService.certServiceClient.secret.name | default .Values.tls.client.secret.defaultName }}
+type: Opaque
+data:
+  certServiceClient-keystore.jks:
+  {{ (.Files.Glob "resources/certServiceClient-keystore.jks").AsSecrets }}
+  truststore.jks:
+  {{ (.Files.Glob "resources/truststore.jks").AsSecrets }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.tls.server.secret.name }}
+type: Opaque
+data:
+  certServiceServer-keystore.jks:
+  {{ (.Files.Glob "resources/certServiceServer-keystore.jks").AsSecrets }}
+  certServiceServer-keystore.p12:
+  {{ (.Files.Glob "resources/certServiceServer-keystore.p12").AsSecrets }}
+  truststore.jks:
+  {{ (.Files.Glob "resources/truststore.jks").AsSecrets }}
+  root.crt:
+  {{ (.Files.Glob "resources/root.crt").AsSecrets }}
+{{ end -}}
\ No newline at end of file
diff --git a/kubernetes/platform/components/oom-cert-service/templates/service.yaml b/kubernetes/platform/components/oom-cert-service/templates/service.yaml
new file mode 100644
index 0000000000..60e2afa41d
--- /dev/null
+++ b/kubernetes/platform/components/oom-cert-service/templates/service.yaml
@@ -0,0 +1,17 @@
+# Copyright © 2020, Nokia
+# Modifications Copyright  © 2020, Nordix Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+{{- if .Values.global.cmpv2Enabled }}
+  {{ include "common.service" . }}
+{{ end -}}
\ No newline at end of file
diff --git a/kubernetes/platform/components/oom-cert-service/values.yaml b/kubernetes/platform/components/oom-cert-service/values.yaml
new file mode 100644
index 0000000000..4a3a289484
--- /dev/null
+++ b/kubernetes/platform/components/oom-cert-service/values.yaml
@@ -0,0 +1,160 @@
+# Copyright © 2020, Nokia
+# Modifications Copyright  © 2020, Nordix Foundation, Orange
+# Modifications Copyright © 2020 Nokia
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Global
+global:
+  envsubstImage: dibi/envsubst
+  nodePortPrefix: 302
+  # Readiness image
+  readinessImage: onap/oom/readiness:3.0.1
+  # Ubuntu Init image
+  ubuntuInitRepository: registry.hub.docker.com
+  ubuntuInitImage: oomk8s/ubuntu-init:2.0.0
+  # Logging image
+  loggingRepository: docker.elastic.co
+  loggingImage: beats/filebeat:5.5.0
+  # BusyBox image
+  busyboxRepository: registry.hub.docker.com
+  busyboxImage: library/busybox:1.31
+  persistence:
+    enabled: true
+  # Standard OOM
+  pullPolicy: "Always"
+  repository: "nexus3.onap.org:10001"
+
+
+# Service configuration
+service:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8443
+      port_protocol: http
+
+
+# Deployment configuration
+repository: nexus3.onap.org:10001
+image: onap/org.onap.oom.platform.cert-service.oom-certservice-api:2.0.0
+pullPolicy: Always
+replicaCount: 1
+
+liveness:
+  initialDelaySeconds: 60
+  periodSeconds: 10
+  command: curl https://localhost:$HTTPS_PORT/actuator/health --cacert $ROOT_CERT --cert-type p12 --cert $KEYSTORE_P12_PATH --pass $KEYSTORE_PASSWORD
+readiness:
+  initialDelaySeconds: 30
+  periodSeconds: 10
+  command: curl https://localhost:$HTTPS_PORT/ready --cacert $ROOT_CERT --cert-type p12 --cert $KEYSTORE_P12_PATH --pass $KEYSTORE_PASSWORD
+
+flavor: small
+resources:
+  small:
+    limits:
+      cpu: 0.5
+      memory: 1Gi
+    requests:
+      cpu: 0.2
+      memory: 512Mi
+  large:
+    limits:
+      cpu: 1
+      memory: 2Gi
+    requests:
+      cpu: 0.4
+      memory: 1Gi
+  unlimited: {}
+
+
+# Application configuration
+cmpServers:
+  secret:
+    name: oom-cert-service-secret
+  volume:
+    name: oom-cert-service-volume
+    mountPath: /etc/onap/oom/certservice
+
+tls:
+  server:
+    secret:
+      name: oom-cert-service-server-tls-secret
+    volume:
+      name: oom-cert-service-server-tls-volume
+      mountPath: /etc/onap/oom/certservice/certs/
+  client:
+    secret:
+      defaultName: oom-cert-service-client-tls-secret
+
+envs:
+  keystore:
+    jksName: certServiceServer-keystore.jks
+    p12Name: certServiceServer-keystore.p12
+  truststore:
+    jksName: truststore.jks
+    crtName: root.crt
+  httpsPort: 8443
+
+# External secrets with credentials can be provided to override default credentials defined below,
+# by uncommenting and filling appropriate *ExternalSecret value
+credentials:
+  tls:
+    keystorePassword: secret
+    truststorePassword: secret
+    #keystorePasswordExternalSecret:
+    #truststorePasswordExternalSecret:
+  # Below cmp values contain credentials for EJBCA test instance and are relevant only if global addTestingComponents flag is enabled
+  cmp:
+    clientIakExternalSecret: '{{ include "common.release" . }}-ejbca-client-iak'
+    #clientRvExternalSecret:
+    raIakExternalSecret: '{{ include "common.release" . }}-ejbca-ra-iak'
+    #raRvExternalSecret:
+    client: {}
+      # iak: mypassword
+      # rv: unused
+    ra: {}
+      # iak: mypassword
+      # rv: unused
+
+secrets:
+  - uid: keystore-password
+    name: '{{ include "common.release" . }}-keystore-password'
+    type: password
+    externalSecret: '{{ tpl (default "" .Values.credentials.tls.keystorePasswordExternalSecret) . }}'
+    password: '{{ .Values.credentials.tls.keystorePassword }}'
+    passwordPolicy: required
+  - uid: truststore-password
+    name: '{{ include "common.release" . }}-truststore-password'
+    type: password
+    externalSecret: '{{ tpl (default "" .Values.credentials.tls.truststorePasswordExternalSecret) . }}'
+    password: '{{ .Values.credentials.tls.truststorePassword }}'
+    passwordPolicy: required
+  # Below values are relevant only if global addTestingComponents flag is enabled
+  - uid: ejbca-server-client-iak
+    type: password
+    externalSecret: '{{ tpl (default "" .Values.credentials.cmp.clientIakExternalSecret) . }}'
+    password: '{{ .Values.credentials.cmp.client.iak }}'
+  - uid: cmp-config-client-rv
+    type: password
+    externalSecret: '{{ tpl (default "" .Values.credentials.cmp.clientRvExternalSecret) . }}'
+    password: '{{ .Values.credentials.cmp.client.rv }}'
+  - uid: ejbca-server-ra-iak
+    type: password
+    externalSecret: '{{ tpl (default "" .Values.credentials.cmp.raIakExternalSecret) . }}'
+    password: '{{ .Values.credentials.cmp.ra.iak }}'
+  - uid: cmp-config-ra-rv
+    type: password
+    externalSecret: '{{ tpl (default "" .Values.credentials.cmp.raRvExternalSecret) . }}'
+    password: '{{ .Values.credentials.cmp.ra.rv }}'