Merge "[AAF] Use common secret in sms preload"

5 files changed, 273 insertions, 30 deletions

diff --git a/kubernetes/aaf/charts/aaf-sms/resources/config/has.json b/kubernetes/aaf/charts/aaf-sms/resources/config/has.json
index 4f48771275..679b5189de 100644
--- a/kubernetes/aaf/charts/aaf-sms/resources/config/has.json
+++ b/kubernetes/aaf/charts/aaf-sms/resources/config/has.json
@@ -5,37 +5,37 @@
             {
                 "name": "aai",
                 "values": {
-                    "username": "oof@oof.onap.org",
-                    "password": "demo123456!"
+                    "username": "${AAI_USER}",
+                    "password": "${AAI_PASS}"
                 }
             },
             {
                 "name": "conductor_api",
                 "values": {
-                    "username": "admin1",
-                    "password": "plan.15"
+                    "username": "${CONDUCTOR_USER}",
+                    "password": "${CONDUCTOR_PASS}"
                 }
             },
             {
                 "name": "sdnc",
                 "values": {
-                    "username": "admin",
-                    "password": "Kp8bJ4SXszM0WXlhak3eHlcse2gAw84vaoGGmJvUy2U"
+                    "username": "${SDNC_USER}",
+                    "password": "${SDNC_PASS}"
                 }
             },
             {
                 "name": "music_api",
                 "values": {
-                    "aafuser": "conductor",
-                    "aafpass": "c0nduct0r",
+                    "aafuser": "${MUSIC_USER}",
+                    "aafpass": "${MUSIC_PASS}",
                     "aafns": "conductor"
                 }
             },
             {
                 "name": "aaf_api",
                 "values": {
-                    "username": "aaf_admin@people.osaaf.org",
-                    "password": "demo123456!",
+                    "username": "${AAF_USER}",
+                    "password": "${AAF_PASS}",
                     "aaf_conductor_user": "oof@oof.onap.org"
                 }
             }
diff --git a/kubernetes/aaf/charts/aaf-sms/resources/config/osdf.json b/kubernetes/aaf/charts/aaf-sms/resources/config/osdf.json
index 0950957b11..7666ff3077 100644
--- a/kubernetes/aaf/charts/aaf-sms/resources/config/osdf.json
+++ b/kubernetes/aaf/charts/aaf-sms/resources/config/osdf.json
@@ -12,22 +12,22 @@
             {
                 "name": "conductor",
                 "values": {
-                    "UserName": "admin1",
-                    "Password": "plan.15"
+                    "UserName": "${CONDUCTOR_USER}",
+                    "Password": "${CONDUCTOR_PASS}"
                 }
             },
             {
                 "name": "policyPlatform",
                 "values": {
-                    "UserName": "testpdp",
-                    "Password": "alpha123"
+                    "UserName": "${POLICY_PLAT_USER}",
+                    "Password": "${POLICY_PLAT_PASS}"
                 }
             },
             {
                 "name": "policyClient",
                 "values": {
-                    "UserName": "python",
-                    "Password": "test"
+                    "UserName": "${POLICY_CLI_USER}",
+                    "Password": "${POLICY_CLI_PASS}"
                 }
             },
             {
@@ -47,36 +47,36 @@
             {
                 "name": "osdfPlacement",
                 "values": {
-                    "UserName": "test",
-                    "Password": "testpwd"
+                    "UserName": "${OSDF_PLACEMENT_USER}",
+                    "Password": "${OSDF_PLACEMENT_PASS}"
                 }
             },
             {
                 "name": "osdfPlacementSO",
                 "values": {
-                    "UserName": "so_test",
-                    "Password": "so_testpwd"
+                    "UserName": "${OSDF_PLACEMENT_SO_USER}",
+                    "Password": "${OSDF_PLACEMENT_SO_PASS}"
                 }
             },
             {
                 "name": "osdfPlacementVFC",
                 "values": {
-                    "UserName": "vfc_test",
-                    "Password": "vfc_testpwd"
+                    "UserName": "${OSDF_PLACEMENT_VFC_USER}",
+                    "Password": "${OSDF_PLACEMENT_VFC_PASS}"
                 }
             },
             {
                 "name": "osdfCMScheduler",
                 "values": {
-                    "UserName": "test1",
-                    "Password": "testpwd1"
+                    "UserName": "${OSDF_CM_SCHEDULER_USER}",
+                    "Password": "${OSDF_CM_SCHEDULER_PASS}"
                 }
             },
             {
                 "name": "configDb",
                 "values": {
-                    "UserName": "osdf",
-                    "Password": "passwd"
+                    "UserName": "${CONFIG_DB_USER}",
+                    "Password": "${CONFIG_DB_PASS}"
                 }
             },
             {
@@ -89,10 +89,17 @@
             {
                 "name": "osdfPCIOpt",
                 "values": {
-                    "UserName": "pci_test",
-                    "Password": "pci_testpwd"
+                    "UserName": "${OSDF_PCI_OPT_USER}",
+                    "Password": "${OSDF_PCI_OPT_PASS}"
+                }
+            },
+            {
+                "name": "osdfOptEngine",
+                "values": {
+                    "UserName": "${OSDF_OPT_ENGINE_USER}",
+                    "Password": "${OSDF_OPT_ENGINE_PASS}"
                 }
             }
         ]
     }
-}
\ No newline at end of file
+}
diff --git a/kubernetes/aaf/charts/aaf-sms/templates/job.yaml b/kubernetes/aaf/charts/aaf-sms/templates/job.yaml
index ccccf22037..7a17b917ae 100644
--- a/kubernetes/aaf/charts/aaf-sms/templates/job.yaml
+++ b/kubernetes/aaf/charts/aaf-sms/templates/job.yaml
@@ -33,6 +33,106 @@ spec:
         release: {{ include "common.release" . }}
     spec:
       initContainers:
+      - command:
+        - sh
+        args:
+        - -c
+        - "export AAI_PASS=${AAI_PASS_PLAIN};
+           export CONDUCTOR_PASS=${CONDUCTOR_PASS_PLAIN};
+           export SDNC_PASS=${SDNC_PASS_PLAIN};
+           export MUSIC_PASS=${MUSIC_PASS_PLAIN};
+           export AAF_PASS=${AAF_PASS_PLAIN};
+           export POLICY_PLAT_PASS=${POLICY_PLAT_PASS_PLAIN};
+           export POLICY_CLI_PASS=${POLICY_CLI_PASS_PLAIN};
+           export OSDF_PLACEMENT_PASS=${OSDF_PLACEMENT_PASS_PLAIN};
+           export OSDF_PLACEMENT_SO_PASS=${OSDF_PLACEMENT_SO_PASS_PLAIN};
+           export OSDF_PLACMENET_VFC_PASS=${OSDF_PLACEMENT_VFC_PASS_PLAIN};
+           export OSDF_CM_SCHEDULER_PASS=${OSDF_CM_SCHEDULER_PASS_PLAIN};
+           export CONFIG_DB_PASS=${CONFIG_DB_PASS_PLAIN};
+           export OSDF_PCI_OPT_PASS=${OSDF_PCI_OPT_PASS_PLAIN};
+           export OSDF_OPT_ENGINE_PASS=${OSDF_OPT_ENGINE_PASS_PLAIN};
+           cd /config-input;
+           for PFILE in `find . -not -type d | grep -v -F ..`; do
+             envsubst <${PFILE} >/config/${PFILE};
+           done"
+        env:
+        - name: AAI_USER
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "aai-creds" "key" "login") | indent 10 }}
+        - name: AAI_PASS_PLAIN
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "aai-creds" "key" "password") | indent 10 }}
+
+        - name: CONDUCTOR_USER
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "conductor-creds" "key" "login") | indent 10 }}
+        - name: CONDUCTOR_PASS_PLAIN
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "conductor-creds" "key" "password") | indent 10 }}
+
+        - name: SDNC_USER
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "sdnc-creds" "key" "login") | indent 10 }}
+        - name: SDNC_PASS_PLAIN
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "sdnc-creds" "key" "password") | indent 10 }}
+
+        - name: MUSIC_USER
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "music-creds" "key" "login") | indent 10 }}
+        - name: MUSIC_PASS_PLAIN
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "music-creds" "key" "password") | indent 10 }}
+
+        - name: AAF_USER
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "aaf-creds" "key" "login") | indent 10 }}
+        - name: AAF_PASS_PLAIN
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "aaf-creds" "key" "password") | indent 10 }}
+
+        - name: POLICY_PLAT_USER
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "policy-plat-creds" "key" "login") | indent 10 }}
+        - name: POLICY_PLAT_PASS_PLAIN
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "policy-plat-creds" "key" "password") | indent 10 }}
+
+        - name: POLICY_CLI_USER
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "policy-cli-creds" "key" "login") | indent 10 }}
+        - name: POLICY_CLI_PASS_PLAIN
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "policy-cli-creds" "key" "password") | indent 10 }}
+
+        - name: OSDF_PLACEMENT_USER
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "osdf-placement-creds" "key" "login") | indent 10 }}
+        - name: OSDF_PLACEMENT_PASS_PLAIN
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "osdf-placement-creds" "key" "password") | indent 10 }}
+
+        - name: OSDF_PLACEMENT_SO_USER
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "osdf-placement-so-creds" "key" "login") | indent 10 }}
+        - name: OSDF_PLACEMENT_SO_PASS_PLAIN
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "osdf-placement-so-creds" "key" "password") | indent 10 }}
+
+        - name: OSDF_PLACEMENT_VFC_USER
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "osdf-placement-vfc-creds" "key" "login") | indent 10 }}
+        - name: OSDF_PLACEMENT_VFC_PASS_PLAIN
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "osdf-placement-vfc-creds" "key" "password") | indent 10 }}
+
+        - name: OSDF_CM_SCHEDULER_USER
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "osdf-cm-scheduler-creds" "key" "login") | indent 10 }}
+        - name: OSDF_CM_SCHEDULER_PASS_PLAIN
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "osdf-cm-scheduler-creds" "key" "password") | indent 10 }}
+
+        - name: CONFIG_DB_USER
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "config-db-creds" "key" "login") | indent 10 }}
+        - name: CONFIG_DB_PASS_PLAIN
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "config-db-creds" "key" "password") | indent 10 }}
+
+        - name: OSDF_PCI_OPT_USER
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "osdf-pci-opt-creds" "key" "login") | indent 10 }}
+        - name: OSDF_PCI_OPT_PASS_PLAIN
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "osdf-pci-opt-creds" "key" "password") | indent 10 }}
+
+        - name: OSDF_OPT_ENGINE_USER
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "osdf-opt-engine-creds" "key" "login") | indent 10 }}
+        - name: OSDF_OPT_ENGINE_PASS_PLAIN
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "osdf-opt-engine-creds" "key" "password") | indent 10 }}
+        volumeMounts:
+        - mountPath: /config-input
+          name: {{ include "common.name" . }}-preload-input
+        - mountPath: /config/
+          name: {{ include "common.name" . }}-preload
+        image: "{{ .Values.global.envsubstImage }}"
+        imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+        name: {{ include "common.name" . }}-update-config
       - image:  "{{ .Values.global.readinessRepository }}/{{ .Values.global.readinessImage }}"
         imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
         name: {{ include "common.name" . }}-readiness
@@ -84,9 +184,12 @@ spec:
       - name: localtime
         hostPath:
           path: /etc/localtime
-      - name : {{ include "common.name" . }}-preload
+      - name: {{ include "common.name" . }}-preload-input
         configMap:
           name: {{ include "common.fullname" . }}-preload
+      - name: {{ include "common.name" . }}-preload
+        emptyDir:
+          medium: Memory
       restartPolicy: OnFailure
       imagePullSecrets:
       - name: "{{ include "common.namespace" . }}-docker-registry-key"
diff --git a/kubernetes/aaf/charts/aaf-sms/templates/secret.yaml b/kubernetes/aaf/charts/aaf-sms/templates/secret.yaml
new file mode 100644
index 0000000000..34932b713d
--- /dev/null
+++ b/kubernetes/aaf/charts/aaf-sms/templates/secret.yaml
@@ -0,0 +1,17 @@
+{{/*
+# Copyright © 2020 Samsung Electronics
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+*/}}
+
+{{ include "common.secretFast" . }}
diff --git a/kubernetes/aaf/charts/aaf-sms/values.yaml b/kubernetes/aaf/charts/aaf-sms/values.yaml
index b24605161a..12312c5430 100644
--- a/kubernetes/aaf/charts/aaf-sms/values.yaml
+++ b/kubernetes/aaf/charts/aaf-sms/values.yaml
@@ -21,6 +21,7 @@ global:
   loggingRepository: docker.elastic.co
   loggingImage: beats/filebeat:5.5.0
   persistence: {}
+  envsubstImage: dibi/envsubst
 
 flavor: small
 #################################################################
@@ -84,6 +85,121 @@ persistence:
 ingress:
   enabled: false
 
+secrets:
+  - uid: aai-creds
+    type: basicAuth
+    login: '{{ .Values.oofCreds.aaiUsername }}'
+    password: '{{ .Values.oofCreds.aaiPassword }}'
+    passwordPolicy: required
+  - uid: conductor-creds
+    type: basicAuth
+    login: '{{ .Values.oofCreds.conductorUsername }}'
+    password: '{{ .Values.oofCreds.conductorPassword }}'
+    passwordPolicy: required
+  - uid: sdnc-creds
+    type: basicAuth
+    login: '{{ .Values.oofCreds.sdncUsername }}'
+    password: '{{ .Values.oofCreds.sdncPassword }}'
+    passwordPolicy: required
+  - uid: music-creds
+    type: basicAuth
+    login: '{{ .Values.oofCreds.musicUsername }}'
+    password: '{{ .Values.oofCreds.musicPassword }}'
+    passwordPolicy: required
+  - uid: aaf-creds
+    type: basicAuth
+    login: '{{ .Values.oofCreds.aafUsername }}'
+    password: '{{ .Values.oofCreds.aafPassword }}'
+    passwordPolicy: required
+  - uid: policy-plat-creds
+    type: basicAuth
+    login: '{{ .Values.oofCreds.policyPlatUsername }}'
+    password: '{{ .Values.oofCreds.policyPlatPassword }}'
+    passwordPolicy: required
+  - uid: policy-cli-creds
+    type: basicAuth
+    login: '{{ .Values.oofCreds.policyCliUsername }}'
+    password: '{{ .Values.oofCreds.policyCliPassword }}'
+    passwordPolicy: required
+  - uid: osdf-placement-creds
+    type: basicAuth
+    login: '{{ .Values.oofCreds.osdfPlacementUsername }}'
+    password: '{{ .Values.oofCreds.osdfPlacementPassword }}'
+    passwordPolicy: required
+  - uid: osdf-placement-so-creds
+    type: basicAuth
+    login: '{{ .Values.oofCreds.osdfPlacementSOUsername }}'
+    password: '{{ .Values.oofCreds.osdfPlacementSOPassword }}'
+    passwordPolicy: required
+  - uid: osdf-placement-vfc-creds
+    type: basicAuth
+    login: '{{ .Values.oofCreds.osdfPlacementVFCUsername }}'
+    password: '{{ .Values.oofCreds.osdfPlacementVFCPassword }}'
+    passwordPolicy: required
+  - uid: osdf-cm-scheduler-creds
+    type: basicAuth
+    login: '{{ .Values.oofCreds.osdfCMSchedulerUsername }}'
+    password: '{{ .Values.oofCreds.osdfCMSchedulerPassword }}'
+    passwordPolicy: required
+  - uid: config-db-creds
+    type: basicAuth
+    login: '{{ .Values.oofCreds.configDbUsername }}'
+    password: '{{ .Values.oofCreds.configDbPassword }}'
+    passwordPolicy: required
+  - uid: osdf-pci-opt-creds
+    type: basicAuth
+    login: '{{ .Values.oofCreds.osdfPCIOptUsername }}'
+    password: '{{ .Values.oofCreds.osdfPCIOptPassword }}'
+    passwordPolicy: required
+  - uid: osdf-opt-engine-creds
+    type: basicAuth
+    login: '{{ .Values.oofCreds.osdfOptEngineUsername }}'
+    password: '{{ .Values.oofCreds.osdfOptEnginePassword }}'
+    passwordPolicy: required
+
+oofCreds:
+  aaiUsername: oof@oof.onap.org
+  aaiPassword: demo123456!
+
+  conductorUsername: admin1
+  conductorPassword: plan.15
+
+  sdncUsername: admin
+  sdncPassword: Kp8bJ4SXszM0WXlhak3eHlcse2gAw84vaoGGmJvUy2U
+
+  musicUsername: conductor
+  musicPassword: c0nduct0r
+
+  aafUsername: aaf_admin@people.osaaf.org
+  aafPassword: demo123456!
+
+  policyPlatUsername: testpdp
+  policyPlatPassword: alpha123
+
+  policyCliUsername: python
+  policyCliPassword: test
+
+  osdfPlacementUsername: test
+  osdfPlacementPassword: testpwd
+
+  osdfPlacementSOUsername: so_test
+  osdfPlacementSOPassword: so_testpwd
+
+  osdfPlacementVFCUsername: vfc_test
+  osdfPlacementVFCPassword: vfc_testpwd
+
+  osdfCMSchedulerUsername: test1
+  osdfCMSchedulerPassword: testpwd1
+
+  configDbUsername: osdf
+  configDbPassword: passwd
+
+  osdfPCIOptUsername: pci_test
+  osdfPCIOptPassword: pci_testpwd
+
+  osdfOptEngineUsername: opt_test
+  osdfOptEnginePassword: opt_testpwd
+
 # Configure resource requests and limits
 resources:
   small: