diff options
Diffstat (limited to 'kubernetes/common')
5 files changed, 190 insertions, 41 deletions
diff --git a/kubernetes/common/cert-wrapper/resources/import-custom-certs.sh b/kubernetes/common/cert-wrapper/resources/import-custom-certs.sh index 6df7505e7b..fa3de03ece 100755 --- a/kubernetes/common/cert-wrapper/resources/import-custom-certs.sh +++ b/kubernetes/common/cert-wrapper/resources/import-custom-certs.sh @@ -22,6 +22,7 @@ WORK_DIR=${WORK_DIR:-/updatedTruststore} ONAP_TRUSTSTORE=${ONAP_TRUSTSTORE:-truststoreONAPall.jks} JRE_TRUSTSTORE=${JRE_TRUSTSTORE:-$JAVA_HOME/lib/security/cacerts} TRUSTSTORE_OUTPUT_FILENAME=${TRUSTSTORE_OUTPUT_FILENAME:-truststore.jks} +SSL_WORKDIR=${SSL_WORKDIR:-/usr/local/share/ca-certificates} mkdir -p $WORK_DIR @@ -37,10 +38,10 @@ for f in $CERTS_DIR/*; do # Dont use onap truststore when aaf is disabled continue fi - if [ ${f: -3} = ".sh" ]; then + if echo $f | grep '\.sh$' >/dev/null; then continue fi - if [ ${f: -4} = ".b64" ] + if echo $f | grep '\.b64$' >/dev/null; then then base64 -d $f > $WORK_DIR/`basename $f .b64` else @@ -49,8 +50,7 @@ for f in $CERTS_DIR/*; do done for f in $MORE_CERTS_DIR/*; do - if [ ${f: -4} == ".pem" ] - then + if echo $f | grep '\.pem$' >/dev/null; then cp $f $WORK_DIR/. fi done @@ -67,7 +67,7 @@ fi # Import Custom Certificates for f in $WORK_DIR/*; do - if [ ${f: -4} = ".pem" ]; then + if echo $f | grep '\.pem$' >/dev/null; then echo "importing certificate: $f" keytool -import -file $f -alias `basename $f` -keystore $WORK_DIR/$TRUSTSTORE_OUTPUT_FILENAME -storepass $TRUSTSTORE_PASSWORD -noprompt if [ $? != 0 ]; then @@ -76,3 +76,15 @@ for f in $WORK_DIR/*; do fi fi done + +# Import certificates to Linux SSL Truststore +cp $CERTS_DIR/*.crt $SSL_WORKDIR/. +cp $MORE_CERTS_DIR/*.crt $SSL_WORKDIR/. +update-ca-certificates +if [ $? != 0 ] + then + echo "failed importing certificates" + exit 1 + else + cp /etc/ssl/certs/ca-certificates.crt $WORK_DIR/. +fi
\ No newline at end of file diff --git a/kubernetes/common/certInitializer/templates/_certInitializer.yaml b/kubernetes/common/certInitializer/templates/_certInitializer.yaml index f3ba8a24e0..32bba457ee 100644 --- a/kubernetes/common/certInitializer/templates/_certInitializer.yaml +++ b/kubernetes/common/certInitializer/templates/_certInitializer.yaml @@ -174,6 +174,9 @@ - mountPath: {{ $initRoot.truststoreMountpath }}/{{ $initRoot.truststoreOutputFileName }} name: updated-truststore subPath: {{ $initRoot.truststoreOutputFileName }} +- mountPath: /etc/ssl/certs/ca-certificates.crt + name: updated-truststore + subPath: ca-certificates.crt {{- end -}} {{- end -}} diff --git a/kubernetes/common/cmpv2Config/values.yaml b/kubernetes/common/cmpv2Config/values.yaml index 02595b348d..4b8438ace2 100644 --- a/kubernetes/common/cmpv2Config/values.yaml +++ b/kubernetes/common/cmpv2Config/values.yaml @@ -35,5 +35,5 @@ global: truststorePasswordSecretName: oom-cert-service-truststore-password truststorePasswordSecretKey: password certPostProcessor: - image: onap/org.onap.oom.platform.cert-service.oom-certservice-post-processor:2.3.3 + image: onap/org.onap.oom.platform.cert-service.oom-certservice-post-processor:2.4.0 diff --git a/kubernetes/common/common/templates/_serviceMonitor.tpl b/kubernetes/common/common/templates/_serviceMonitor.tpl new file mode 100644 index 0000000000..eb6c047c2f --- /dev/null +++ b/kubernetes/common/common/templates/_serviceMonitor.tpl @@ -0,0 +1,166 @@ +{{/* +# Copyright © 2021 Bell Canada +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +*/}} +{{/* + Resolve the name of a chart's serviceMonitor. + + The default will be the chart name (or $dot.Values.nameOverride if set). + And the use of .Values.metrics.serviceMonitor.name overrides all. + + - .Values.metrics.serviceMonitor.name: override default serviceMonitor (ie. chart) name + Example values file addition: + metrics: + serviceMonitor: + enabled: true + port: blueprints-processor-http + ## specify target port if name is not given to the port in the service definition + ## + # targetPort: 8080 + path: /metrics + basicAuth: + enabled: false + externalSecretName: mysecretname + externalSecretUserKey: login + externalSecretPasswordKey: password + + ## Namespace in which Prometheus is running + ## + # namespace: monitoring + + ## Interval at which metrics should be scraped. + ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint + ## + # interval: 60s + + ## Timeout after which the scrape is ended + ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint + ## + # scrapeTimeout: 10s + + ## ServiceMonitor selector labels + ## ref: https://github.com/bitnami/charts/tree/master/bitnami/prometheus-operator#prometheus-configuration + ## + selector: + app: '{{ include "common.name" . }}' + chart: '{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}' + release: '{{ include "common.release" . }}' + heritage: '{{ .Release.Service }}' + + ## RelabelConfigs to apply to samples before scraping + ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#relabelconfig + ## Value is evalued as a template + ## + relabelings: [] + + ## MetricRelabelConfigs to apply to samples before ingestion + ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#relabelconfig + ## Value is evalued as a template + ## + metricRelabelings: [] + # - sourceLabels: + # - "__name__" + # targetLabel: "__name__" + # action: replace + # regex: '(.*)' + # replacement: 'example_prefix_$1' + +*/}} +{{/* + Expand the serviceMonitor name for a chart. +*/}} +{{- define "common.serviceMonitorName" -}} + {{- $name := default .Chart.Name .Values.nameOverride -}} + {{- default $name .Values.metrics.serviceMonitor.name | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* Define the metadata of serviceMonitor + The function takes from one to four arguments (inside a dictionary): + - .dot : environment (.) + - .suffix : a string which will be added at the end of the name (with a '-'). + - .annotations: the annotations to add + - .labels : labels to add + Usage example: + {{ include "common.serviceMonitorMetadata" ( dict "suffix" "myService" "dot" .) }} + {{ include "common.serviceMonitorMetadata" ( dict "annotations" .Values.metrics.serviceMonitor.annotation "dot" .) }} +*/}} + +{{- define "common.serviceMonitorMetadata" -}} +{{- $dot := default . .dot -}} +{{- $annotations := default "" .annotations -}} +{{- $labels := default (dict) .labels -}} +{{- if $annotations -}} +annotations: +{{ include "common.tplValue" (dict "value" $annotations "context" $dot) | indent 2 }} +{{- end }} +name: {{ include "common.serviceMonitorName" $dot }} +{{- if $dot.Values.metrics.serviceMonitor.namespace }} +namespace: {{ $dot.Values.metrics.serviceMonitor.namespace }} +{{- else }} +namespace: {{ include "common.namespace" $dot }} +{{- end }} +labels: {{- include "common.labels" (dict "labels" $labels "dot" $dot) | nindent 2 }} +{{- end -}} + +{{/* + Create service monitor template +*/}} +{{- define "common.serviceMonitor" -}} +{{- $dot := default . .dot -}} +{{- $labels := default (dict) .labels -}} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: +{{- include "common.serviceMonitorMetadata" $dot | nindent 2 }} +spec: + endpoints: + - path: {{ default "/metrics" $dot.Values.metrics.serviceMonitor.path }} + {{- if $dot.Values.metrics.serviceMonitor.port }} + port: {{ $dot.Values.metrics.serviceMonitor.port }} + {{- else if $dot.Values.metrics.serviceMonitor.targetPort }} + targetPort: {{ $dot.Values.metrics.serviceMonitor.targetPort }} + {{- else }} + port: metrics + {{- end }} + {{- if $dot.Values.metrics.serviceMonitor.basicAuth.enabled }} + basicAuth: + username: + key: {{ $dot.Values.metrics.serviceMonitor.basicAuth.externalSecretUserKey }} + name: {{ $dot.Values.metrics.serviceMonitor.basicAuth.externalSecretName }} + password: + key: {{ $dot.Values.metrics.serviceMonitor.basicAuth.externalSecretPasswordKey }} + name: {{ $dot.Values.metrics.serviceMonitor.basicAuth.externalSecretName }} + {{- end }} + {{- if $dot.Values.metrics.serviceMonitor.interval }} + interval: {{ $dot.Values.metrics.serviceMonitor.interval }} + {{- end }} + {{- if $dot.Values.metrics.serviceMonitor.scrapeTimeout }} + scrapeTimeout: {{ $dot.Values.metrics.serviceMonitor.scrapeTimeout }} + {{- end }} + {{- if $dot.Values.metrics.serviceMonitor.relabelings }} + relabelings: {{- include "common.tplValue" ( dict "value" $dot.Values.metrics.serviceMonitor.relabelings "context" $dot) | nindent 6 }} + {{- end }} + {{- if $dot.Values.metrics.serviceMonitor.metricRelabelings }} + metricRelabelings: {{- include "common.tplValue" ( dict "value" $dot.Values.metrics.serviceMonitor.metricRelabelings "context" $dot) | nindent 6 }} + {{- end }} + namespaceSelector: + matchNames: + - {{ include "common.namespace" $dot }} + selector: + {{- if $dot.Values.metrics.serviceMonitor.selector }} + matchLabels: {{- include "common.tplValue" ( dict "value" $dot.Values.metrics.serviceMonitor.selector "context" $dot) | nindent 6 }} + {{- else }} + matchLabels: {{- include "common.labels" (dict "labels" $labels "dot" $dot) | nindent 6 }} + {{- end }} +{{- end -}} diff --git a/kubernetes/common/mariadb-galera/templates/servicemonitor.yaml b/kubernetes/common/mariadb-galera/templates/servicemonitor.yaml index 6c3b41f5a5..6d1ed40e13 100644 --- a/kubernetes/common/mariadb-galera/templates/servicemonitor.yaml +++ b/kubernetes/common/mariadb-galera/templates/servicemonitor.yaml @@ -1,5 +1,5 @@ {{/* -# Copyright © 2020 Bitnami, Orange +# Copyright © 2021 Bitnami, Orange, Bell Canada # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -14,38 +14,6 @@ # limitations under the License. */}} -{{- if default false (and .Values.global.metrics.enabled .Values.global.metrics.custom_resources) }} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ template "common.fullname" . }} - {{- if .Values.metrics.serviceMonitor.namespace }} - namespace: {{ .Values.metrics.serviceMonitor.namespace }} - {{- else }} - namespace: {{ include "common.namespace" . }} - {{- end }} - labels: {{- include "common.labels" . | nindent 4 }} - {{- range $key, $value := .Values.metrics.serviceMonitor.selector }} - {{ $key }}: {{ $value | quote }} - {{- end }} -spec: - selector: - matchLabels: {{- include "common.matchLabels" . | nindent 6 }} - endpoints: - - port: metrics - {{- if .Values.metrics.serviceMonitor.interval }} - interval: {{ .Values.metrics.serviceMonitor.interval }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} - scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.relabelings }} - relabelings: {{- include "common.tplValue" ( dict "value" .Values.metrics.serviceMonitor.relabelings "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.metricRelabelings }} - metricRelabelings: {{- include "common.tplValue" ( dict "value" .Values.metrics.serviceMonitor.metricRelabelings "context" $) | nindent 8 }} - {{- end }} - namespaceSelector: - matchNames: - - {{ .Release.Namespace }} +{{- if .Values.metrics.serviceMonitor.enabled }} +{{ include "common.serviceMonitor" . }} {{- end }} |