diff options
Diffstat (limited to 'kubernetes')
131 files changed, 1182 insertions, 446 deletions
diff --git a/kubernetes/aai/Chart.yaml b/kubernetes/aai/Chart.yaml index 7f00c2f002..6c958f6edd 100644 --- a/kubernetes/aai/Chart.yaml +++ b/kubernetes/aai/Chart.yaml @@ -18,7 +18,7 @@ apiVersion: v2 description: ONAP Active and Available Inventory name: aai -version: 13.0.1 +version: 14.0.0 dependencies: - name: common @@ -35,31 +35,31 @@ dependencies: version: ~13.x-0 repository: '@local' - name: aai-babel - version: ~13.x-0 + version: ~14.x-0 repository: 'file://components/aai-babel' condition: aai-babel.enabled - name: aai-graphadmin - version: ~13.x-0 + version: ~14.x-0 repository: 'file://components/aai-graphadmin' condition: aai-graphadmin.enabled - name: aai-modelloader - version: ~13.x-0 + version: ~14.x-0 repository: 'file://components/aai-modelloader' condition: aai-modelloader.enabled - name: aai-resources - version: ~13.x-0 + version: ~14.x-0 repository: 'file://components/aai-resources' condition: aai-resources.enabled - name: aai-schema-service - version: ~13.x-0 + version: ~14.x-0 repository: 'file://components/aai-schema-service' condition: aai-schema-service.enabled - name: aai-sparky-be - version: ~13.x-0 + version: ~14.x-0 repository: 'file://components/aai-sparky-be' condition: aai-sparky-be.enabled - name: aai-traversal - version: ~13.x-0 + version: ~14.x-0 repository: 'file://components/aai-traversal' condition: aai-traversal.enabled - name: serviceAccount diff --git a/kubernetes/aai/components/aai-babel/Chart.yaml b/kubernetes/aai/components/aai-babel/Chart.yaml index 447b59f573..edf450c325 100644 --- a/kubernetes/aai/components/aai-babel/Chart.yaml +++ b/kubernetes/aai/components/aai-babel/Chart.yaml @@ -18,7 +18,7 @@ apiVersion: v2 description: Babel microservice name: aai-babel -version: 13.0.0 +version: 14.0.0 dependencies: - name: common diff --git a/kubernetes/aai/components/aai-graphadmin/Chart.yaml b/kubernetes/aai/components/aai-graphadmin/Chart.yaml index 69abea193f..af6c0d6646 100644 --- a/kubernetes/aai/components/aai-graphadmin/Chart.yaml +++ b/kubernetes/aai/components/aai-graphadmin/Chart.yaml @@ -22,7 +22,7 @@ apiVersion: v2 description: ONAP AAI GraphAdmin name: aai-graphadmin -version: 13.0.0 +version: 14.0.0 dependencies: - name: common diff --git a/kubernetes/aai/components/aai-graphadmin/resources/config/janusgraph-realtime.properties b/kubernetes/aai/components/aai-graphadmin/resources/config/janusgraph-realtime.properties index 61550e7a57..a3b902a151 100644 --- a/kubernetes/aai/components/aai-graphadmin/resources/config/janusgraph-realtime.properties +++ b/kubernetes/aai/components/aai-graphadmin/resources/config/janusgraph-realtime.properties @@ -91,3 +91,7 @@ storage.lock.wait-time=300 cache.db-cache = false #load graphson file on startup load.snapshot.file=false + +{{ if .Values.config.janusgraph.allowUpgrade }} +graph.allow-upgrade=true +{{ end }} diff --git a/kubernetes/aai/components/aai-graphadmin/templates/deployment.yaml b/kubernetes/aai/components/aai-graphadmin/templates/deployment.yaml index 9a0ca764bf..cff82c978c 100644 --- a/kubernetes/aai/components/aai-graphadmin/templates/deployment.yaml +++ b/kubernetes/aai/components/aai-graphadmin/templates/deployment.yaml @@ -39,6 +39,7 @@ metadata: heritage: {{ .Release.Service }} spec: replicas: {{ .Values.replicaCount }} + revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} minReadySeconds: {{ .Values.minReadySeconds }} strategy: type: {{ .Values.updateStrategy.type }} @@ -113,9 +114,9 @@ spec: - name: LOCAL_GROUP_ID value: {{ .Values.securityContext.group_id | quote }} - name: INTERNAL_PORT_1 - value: {{ .Values.service.internalPort | quote }} + value: {{ .Values.service.appPort | quote }} - name: INTERNAL_PORT_2 - value: {{ .Values.service.internalPort2 | quote }} + value: {{ .Values.service.debugPort | quote }} - name: INTERNAL_PORT_3 value: {{ .Values.service.internalPort3 | quote }} - name: BOOTSTRAP_SERVERS @@ -125,6 +126,14 @@ spec: secretKeyRef: name: {{ include "common.release" . }}-{{ .Values.global.aaiGraphKafkaUser }} key: sasl.jaas.config + {{- if .Values.config.profiling.enabled }} + - name: PRE_JVM_ARGS + value: '{{ join " " .Values.config.profiling.args }}' + {{- end }} + {{- if .Values.config.debug.enabled }} + - name: POST_JVM_ARGS + value: {{ .Values.config.debug.args | quote }} + {{- end }} volumeMounts: - mountPath: /opt/app/aai-graphadmin/resources/etc/appprops/janusgraph-realtime.properties name: config @@ -150,10 +159,16 @@ spec: name: properties subPath: application.properties ports: - - containerPort: {{ .Values.service.internalPort }} - name: {{ .Values.service.portName }} - - containerPort: {{ .Values.service.internalPort2 }} - name: {{ .Values.service.portName2 }} + - containerPort: {{ .Values.service.appPort }} + name: {{ .Values.service.appPortName }} + {{- if .Values.config.debug.enabled }} + - containerPort: {{ .Values.service.debugPort }} + name: {{ .Values.service.debugPortName }} + {{- end }} + {{- if .Values.config.profiling.enabled }} + - containerPort: {{ .Values.service.profilingPort }} + name: {{ .Values.service.profilingPortName }} + {{- end }} - containerPort: {{ .Values.service.internalPort3 }} name: {{ .Values.service.portName3 }} lifecycle: @@ -168,18 +183,18 @@ spec: while (netstat -an | grep ESTABLISHED | grep -e $INTERNAL_PORT_1 -e $INTERNAL_PORT_2) do sleep 10 done - # disable liveness probe when breakpoints set in debugger - # so K8s doesn't restart unresponsive container - {{ if .Values.liveness.enabled }} + # disable liveness probe when + # debugging.enabled=true or profiling.enabled=true + {{- if and .Values.liveness.enabled (not (or .Values.config.debug.enabled .Values.config.profiling.enabled)) }} livenessProbe: tcpSocket: - port: {{ .Values.service.internalPort }} + port: {{ .Values.service.appPort }} initialDelaySeconds: {{ .Values.liveness.initialDelaySeconds }} periodSeconds: {{ .Values.liveness.periodSeconds }} {{ end }} readinessProbe: tcpSocket: - port: {{ .Values.service.internalPort }} + port: {{ .Values.service.appPort }} initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }} periodSeconds: {{ .Values.readiness.periodSeconds }} resources: {{ include "common.resources" . | nindent 10 }} diff --git a/kubernetes/aai/components/aai-graphadmin/templates/service.yaml b/kubernetes/aai/components/aai-graphadmin/templates/service.yaml index e3f7569767..68f1cda815 100644 --- a/kubernetes/aai/components/aai-graphadmin/templates/service.yaml +++ b/kubernetes/aai/components/aai-graphadmin/templates/service.yaml @@ -35,28 +35,28 @@ spec: type: {{ .Values.service.type }} ports: {{if eq .Values.service.type "NodePort" -}} - - port: {{ .Values.service.internalPort }} + - port: {{ .Values.service.appPort }} nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort }} - name: {{ .Values.service.portName }} - targetPort: {{ .Values.service.portName }} - - port: {{ .Values.service.internalPort2 }} + name: {{ .Values.service.appPortName }} + targetPort: {{ .Values.service.appPortName }} + - port: {{ .Values.service.debugPort }} nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort2 }} - name: {{ .Values.service.portName2 }} - targetPort: {{ .Values.service.portName2 }} + name: {{ .Values.service.debugPortName }} + targetPort: {{ .Values.service.debugPortName }} - port: {{ .Values.service.internalPort3 }} nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort3 }} name: {{ .Values.service.portName3 }} targetPort: {{ .Values.service.portName3 }} {{- else -}} - - port: {{ .Values.service.internalPort }} - name: {{ .Values.service.portName }} - targetPort: {{ .Values.service.portName }} - - port: {{ .Values.service.internalPort2 }} - name: {{ .Values.service.portName2 }} - targetPort: {{ .Values.service.portName2 }} + - port: {{ .Values.service.appPort }} + name: {{ .Values.service.appPortName }} + targetPort: {{ .Values.service.appPortName }} + - port: {{ .Values.service.debugPort }} + name: {{ .Values.service.debugPortName }} + targetPort: {{ .Values.service.debugPortName }} - port: {{ .Values.service.internalPort3 }} name: {{ .Values.service.portName3 }} - targetPort: {{ .Values.service.portName }} + targetPort: {{ .Values.service.appPort }} {{- end}} selector: app: {{ include "common.name" . }} diff --git a/kubernetes/aai/components/aai-graphadmin/values.yaml b/kubernetes/aai/components/aai-graphadmin/values.yaml index a0d43a7ff5..74751e8585 100644 --- a/kubernetes/aai/components/aai-graphadmin/values.yaml +++ b/kubernetes/aai/components/aai-graphadmin/values.yaml @@ -41,6 +41,8 @@ global: # global defaults #migration using helm hooks migration: enabled: false + duplicates: + enabled: false config: # Specifies that the cluster connected to a dynamic @@ -104,13 +106,17 @@ global: # global defaults clients: SDNC,-1|MSO,-1|SO,-1|robot-ete,-1 # application image -image: onap/aai-graphadmin:1.13.7 +image: onap/aai-graphadmin:1.14.0 pullPolicy: Always restartPolicy: Always flavor: small flavorOverride: small # default number of instances replicaCount: 1 + +# number of ReplicaSets that should be retained for the Deployment +revisionHistoryLimit: 2 + # the minimum number of seconds that a newly created Pod should be ready minReadySeconds: 30 updateStrategy: @@ -122,7 +128,7 @@ updateStrategy: # Configuration for the graphadmin deployment config: - + projectHome: /opt/app/aai-graphadmin # Specify the profiles for the graphadmin microservice profiles: active: kafka @@ -134,6 +140,10 @@ config: timeout: enabled: true limit: 180000 + janusgraph: + # temporarily enable this to update the graph storage version + # see: https://docs.janusgraph.org/changelog/#upgrade-instructions_9 + allowUpgrade: true # Default maximum records to fix for the data grooming and dupeTool maxFix: @@ -176,7 +186,22 @@ config: lock: uri: enabled: false + # adds jvm args for remote debugging the application + debug: + enabled: false + args: "-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5005" + # adds jvm args for remote profiling the application + profiling: + enabled: false + args: + - "-Dcom.sun.management.jmxremote" + - "-Dcom.sun.management.jmxremote.ssl=false" + - "-Dcom.sun.management.jmxremote.authenticate=false" + - "-Dcom.sun.management.jmxremote.local.only=false" + - "-Dcom.sun.management.jmxremote.port=9999" + - "-Dcom.sun.management.jmxremote.rmi.port=9999" + - "-Djava.rmi.server.hostname=127.0.0.1" nodeSelector: {} @@ -197,10 +222,12 @@ readiness: service: type: ClusterIP # REST API port for the graphadmin microservice - portName: http - internalPort: 8449 - portName2: tcp-5005 - internalPort2: 5005 + appPortName: http + appPort: 8449 + debugPortName: tcp-5005 + debugPort: 5005 + profilingPortName: jxm-9999 + profilingPort: 9999 portName3: http-graphadmin internalPort3: 8448 terminationGracePeriodSeconds: 120 @@ -299,6 +326,14 @@ log: root: DEBUG base: DEBUG logConfigMapNamePrefix: '{{ include "common.fullname" . }}' + +#DupeTool cronjob parameters +dupeToolParams: + schedule: "0 8 * * *" + userId: "am8383 " + nodeType: "complex" + timeWindowMinutes: 60 + autoFix: true ################################################################# # Secrets metaconfig ################################################################# diff --git a/kubernetes/aai/components/aai-modelloader/Chart.yaml b/kubernetes/aai/components/aai-modelloader/Chart.yaml index 123da099a5..b1cb8576df 100644 --- a/kubernetes/aai/components/aai-modelloader/Chart.yaml +++ b/kubernetes/aai/components/aai-modelloader/Chart.yaml @@ -17,7 +17,7 @@ apiVersion: v2 description: ONAP AAI modelloader name: aai-modelloader -version: 13.0.0 +version: 14.0.0 dependencies: - name: common diff --git a/kubernetes/aai/components/aai-resources/.helmignore b/kubernetes/aai/components/aai-resources/.helmignore index daebc7da77..f0c1319444 100644 --- a/kubernetes/aai/components/aai-resources/.helmignore +++ b/kubernetes/aai/components/aai-resources/.helmignore @@ -1,21 +1,21 @@ -# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
+# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/kubernetes/aai/components/aai-resources/Chart.yaml b/kubernetes/aai/components/aai-resources/Chart.yaml index 3594492675..51684cfb87 100644 --- a/kubernetes/aai/components/aai-resources/Chart.yaml +++ b/kubernetes/aai/components/aai-resources/Chart.yaml @@ -18,7 +18,7 @@ apiVersion: v2 description: ONAP AAI resources name: aai-resources -version: 13.0.1 +version: 14.0.0 dependencies: - name: common diff --git a/kubernetes/aai/components/aai-resources/resources/config/aaiconfig.properties b/kubernetes/aai/components/aai-resources/resources/config/aaiconfig.properties index adabae3ac7..0f6f2923af 100644 --- a/kubernetes/aai/components/aai-resources/resources/config/aaiconfig.properties +++ b/kubernetes/aai/components/aai-resources/resources/config/aaiconfig.properties @@ -5,7 +5,7 @@ # ================================================================================ # Copyright © 2017 AT&T Intellectual Property. All rights reserved. # Modifications Copyright © 2020 Orange -# Modifications Copyright © 2023 Nordix Foundation +# Modifications Copyright © 2023 Nordix Foundation # ================================================================================ # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -97,4 +97,4 @@ aai.graph.checker.task.enabled=true aai.graph.checker.task.delay=5 # Period, in seconds, between two consecutive executions of the scheduled task, if enabled -aai.graph.checker.task.period=10
\ No newline at end of file +aai.graph.checker.task.period=10 diff --git a/kubernetes/aai/components/aai-resources/resources/config/janusgraph-realtime.properties b/kubernetes/aai/components/aai-resources/resources/config/janusgraph-realtime.properties index 4835560665..adc7f6a4af 100644 --- a/kubernetes/aai/components/aai-resources/resources/config/janusgraph-realtime.properties +++ b/kubernetes/aai/components/aai-resources/resources/config/janusgraph-realtime.properties @@ -104,3 +104,7 @@ cache.db-cache-clean-wait={{ .Values.config.janusgraph.caching.dbCacheCleanWait #load graphson file on startup load.snapshot.file=false + +{{ if .Values.config.janusgraph.allowUpgrade }} +graph.allow-upgrade=true +{{ end }} diff --git a/kubernetes/aai/components/aai-resources/templates/deployment.yaml b/kubernetes/aai/components/aai-resources/templates/deployment.yaml index 7cccfb11a8..47bbaef0ca 100644 --- a/kubernetes/aai/components/aai-resources/templates/deployment.yaml +++ b/kubernetes/aai/components/aai-resources/templates/deployment.yaml @@ -36,6 +36,7 @@ metadata: heritage: {{ .Release.Service }} spec: replicas: {{ .Values.replicaCount }} + revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} minReadySeconds: {{ .Values.minReadySeconds }} strategy: type: {{ .Values.updateStrategy.type }} @@ -157,11 +158,11 @@ spec: - name: LOCAL_GROUP_ID value: {{ .Values.global.config.groupId | quote }} - name: INTERNAL_PORT_1 - value: {{ .Values.service.internalPort | quote }} + value: {{ .Values.service.resourcesPort | quote }} - name: INTERNAL_PORT_2 - value: {{ .Values.service.internalPort2 | quote }} + value: {{ .Values.service.debugPort | quote }} - name: INTERNAL_PORT_3 - value: {{ .Values.service.internalPort3 | quote }} + value: {{ .Values.service.metricsPort | quote }} - name: BOOTSTRAP_SERVERS value: {{ include "common.release" . }}-strimzi-kafka-bootstrap:9092 - name: JAAS_CONFIG @@ -197,19 +198,18 @@ spec: name: {{ include "common.fullname" . }}-config subPath: application-keycloak.properties ports: - - containerPort: {{ .Values.service.internalPort }} - name: {{ .Values.service.portName }} + - containerPort: {{ .Values.service.resourcesPort }} + name: {{ .Values.service.resourcesPortName }} {{- if .Values.config.debug.enabled }} - - containerPort: {{ .Values.service.internalPort2 }} - name: {{ .Values.service.portName2 }} + - containerPort: {{ .Values.service.debugPort }} + name: {{ .Values.service.debugPortName }} {{- end }} - - containerPort: {{ .Values.service.internalPort3 }} - name: {{ .Values.service.portName3 }} + - containerPort: {{ .Values.service.metricsPort }} + name: {{ .Values.service.metricsPortName }} {{- if .Values.config.profiling.enabled }} - - containerPort: {{ .Values.service.internalPort4 }} - name: {{ .Values.service.portName4 }} + - containerPort: {{ .Values.service.profilingPort }} + name: {{ .Values.service.profilingPortName }} {{- end }} - lifecycle: # wait for active requests (long-running tasks) to be finished # Before the SIGTERM is invoked, Kubernetes exposes a preStop hook in the Pod. @@ -219,16 +219,16 @@ spec: - sh - -c - | - while (netstat -an | grep ESTABLISHED | grep -e $INTERNAL_PORT_1 -e $INTERNAL_PORT_2) + while (netstat -an | grep ESTABLISHED | grep -e $INTERNAL_PORT_1) do sleep 10 done - # disable liveness probe when breakpoints set in debugger - # so K8s doesn't restart unresponsive container - {{- if .Values.liveness.enabled }} + # disable liveness probe when + # debugging.enable=true or profiling.enabled=true + {{- if and .Values.liveness.enabled (not (or .Values.config.debug.enabled .Values.config.profiling.enabled)) }} livenessProbe: httpGet: path: /aai/util/echo?action=checkDB - port: {{ .Values.service.internalPort }} + port: {{ .Values.service.resourcesPort }} scheme: HTTP httpHeaders: - name: X-FromAppId @@ -243,7 +243,7 @@ spec: readinessProbe: httpGet: path: /aai/util/echo?action=checkDB - port: {{ .Values.service.internalPort }} + port: {{ .Values.service.resourcesPort }} scheme: HTTP httpHeaders: - name: X-FromAppId diff --git a/kubernetes/aai/components/aai-resources/templates/service.yaml b/kubernetes/aai/components/aai-resources/templates/service.yaml index 0613129aac..308dc052c8 100644 --- a/kubernetes/aai/components/aai-resources/templates/service.yaml +++ b/kubernetes/aai/components/aai-resources/templates/service.yaml @@ -29,28 +29,30 @@ spec: type: {{ .Values.service.type }} ports: {{ if eq .Values.service.type "NodePort" -}} - - port: {{ .Values.service.internalPort }} + - port: {{ .Values.service.resourcesPort }} nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort }} - name: {{ .Values.service.portName }} - targetPort: {{ .Values.service.portName }} - - port: {{ .Values.service.internalPort2 }} + name: {{ .Values.service.resourcesPortName }} + targetPort: {{ .Values.service.resourcesPortName }} + - port: {{ .Values.service.debugPort }} nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort2 }} - name: {{ .Values.service.portName2 }} - targetPort: {{ .Values.service.portName2 }} - - port: {{ .Values.service.internalPort3 }} + name: {{ .Values.service.debugPortName }} + targetPort: {{ .Values.service.debugPortName }} + - port: {{ .Values.service.metricsPort }} nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort3 }} - name: {{ .Values.service.portName3 }} - targetPort: {{ .Values.service.portName3 }} + name: {{ .Values.service.metricsPortName }} + targetPort: {{ .Values.service.metricsPortName }} {{- else -}} - - port: {{ .Values.service.internalPort }} - name: {{ .Values.service.portName }} - targetPort: {{ .Values.service.portName }} - - port: {{ .Values.service.internalPort2 }} - name: {{ .Values.service.portName2 }} - targetPort: {{ .Values.service.portName2 }} - - port: {{ .Values.service.internalPort3 }} - name: {{ .Values.service.portName3 }} - targetPort: {{ .Values.service.portName3 }} + - port: {{ .Values.service.resourcesPort }} + name: {{ .Values.service.resourcesPortName }} + targetPort: {{ .Values.service.resourcesPortName }} + {{- if .Values.config.debug.enabled }} + - port: {{ .Values.service.debugPort }} + name: {{ .Values.service.debugPortName }} + targetPort: {{ .Values.service.debugPortName }} + {{- end }} + - port: {{ .Values.service.metricsPort }} + name: {{ .Values.service.metricsPortName }} + targetPort: {{ .Values.service.metricsPortName }} {{- end }} selector: app: {{ include "common.name" . }} diff --git a/kubernetes/aai/components/aai-resources/values.yaml b/kubernetes/aai/components/aai-resources/values.yaml index 6229992e94..b7acd64610 100644 --- a/kubernetes/aai/components/aai-resources/values.yaml +++ b/kubernetes/aai/components/aai-resources/values.yaml @@ -98,11 +98,10 @@ global: # global defaults # Specifies which clients should always default to realtime graph connection realtime: clients: SDNC,MSO,SO,robot-ete - kafkaBootstrap: strimzi-kafka-bootstrap - jaasConfExternalSecret: '{{ include "common.release" . }}-{{ .Values.global.aaiKafkaUser }}' - someConfig: random - aaiTopic: AAI-EVENT - + kafkaBootstrap: strimzi-kafka-bootstrap + jaasConfExternalSecret: '{{ include "common.release" . }}-{{ .Values.global.aaiKafkaUser }}' + someConfig: random + aaiTopic: AAI-EVENT api_list: - 11 - 12 @@ -113,6 +112,16 @@ api_list: - 17 - 18 - 19 + - 20 + - 21 + - 22 + - 23 + - 24 + - 25 + - 26 + - 27 + - 28 + - 29 aai_enpoints: - name: aai-cloudInfrastructure @@ -129,13 +138,17 @@ aai_enpoints: url: external-system # application image -image: onap/aai-resources:1.13.5 +image: onap/aai-resources:1.14.0 pullPolicy: Always restartPolicy: Always flavor: small flavorOverride: small # default number of instances replicaCount: 1 + +# number of ReplicaSets that should be retained for the Deployment +revisionHistoryLimit: 2 + # the minimum number of seconds that a newly created Pod should be ready minReadySeconds: 30 updateStrategy: @@ -166,11 +179,15 @@ config: # modifications to graph done by this service/janusgraph instance will immediately invalidate the cache # modifications to graph done by other services (traversal) will only be visible # after time specified in db-cache-time - enabled: false + enabled: true # Documentation: https://docs.janusgraph.org/operations/cache/#database-level-caching dbCacheTime: 180000 # in milliseconds dbCacheSize: 0.1 # percentage (expressed as a decimal between 0 and 1) of the total heap space available to the JVM running dbCacheCleanWait: 20 # in milliseconds + # temporarily enable this to update the graph storage version + # see: https://docs.janusgraph.org/changelog/#upgrade-instructions_9 + allowUpgrade: true + # Specifies crud related operation timeouts and overrides @@ -196,7 +213,7 @@ config: # environment variables added to the launch of the image in deployment env: MIN_HEAP_SIZE: "512m" - MAX_HEAP_SIZE: "1024m" + MAX_HEAP_SIZE: "2g" MAX_METASPACE_SIZE: "512m" # adds jvm args for remote debugging the application @@ -228,9 +245,7 @@ affinity: {} liveness: initialDelaySeconds: 60 periodSeconds: 60 - # necessary to disable liveness probe when setting breakpoints - # in debugger so K8s doesn't restart unresponsive container - enabled: false + enabled: true readiness: initialDelaySeconds: 60 @@ -238,13 +253,15 @@ readiness: service: type: ClusterIP - portName: http - internalPort: 8447 - portName2: tcp-5005 - internalPort2: 5005 - portName3: http-resources - internalPort3: 8448 - terminationGracePeriodSeconds: 120 + resourcesPortName: http + resourcesPort: 8447 + debugPortName: tcp-5005 + debugPort: 5005 + metricsPortName: metrics + metricsPort: 8448 + profilingPortName: jmx-9999 + profilingPort: 9999 + terminationGracePeriodSeconds: 60 sessionAffinity: None ingress: diff --git a/kubernetes/aai/components/aai-schema-service/.helmignore b/kubernetes/aai/components/aai-schema-service/.helmignore index daebc7da77..f0c1319444 100644 --- a/kubernetes/aai/components/aai-schema-service/.helmignore +++ b/kubernetes/aai/components/aai-schema-service/.helmignore @@ -1,21 +1,21 @@ -# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
+# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/kubernetes/aai/components/aai-schema-service/Chart.yaml b/kubernetes/aai/components/aai-schema-service/Chart.yaml index 3860826d1b..4d8fea753b 100644 --- a/kubernetes/aai/components/aai-schema-service/Chart.yaml +++ b/kubernetes/aai/components/aai-schema-service/Chart.yaml @@ -18,7 +18,7 @@ apiVersion: v2 description: ONAP AAI Schema Service name: aai-schema-service -version: 13.0.0 +version: 14.0.0 dependencies: - name: common diff --git a/kubernetes/aai/components/aai-schema-service/config/aaiconfig.properties b/kubernetes/aai/components/aai-schema-service/config/aaiconfig.properties index 4c620a0028..1cd6335585 100644 --- a/kubernetes/aai/components/aai-schema-service/config/aaiconfig.properties +++ b/kubernetes/aai/components/aai-schema-service/config/aaiconfig.properties @@ -4,7 +4,7 @@ # org.onap.aai # ================================================================================ # Copyright © 2019 AT&T Intellectual Property. All rights reserved. -# Modifications Copyright © 2023 Nordix Foundation +# Modifications Copyright © 2023 Nordix Foundation # ================================================================================ # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. diff --git a/kubernetes/aai/components/aai-schema-service/config/application.properties b/kubernetes/aai/components/aai-schema-service/config/application.properties index 20dc6bc520..5d55923021 100644 --- a/kubernetes/aai/components/aai-schema-service/config/application.properties +++ b/kubernetes/aai/components/aai-schema-service/config/application.properties @@ -1,6 +1,6 @@ {{/* # Copyright © 2018 Amdocs, Bell Canada, AT&T -# Modifications Copyright © 2023 Nordix Foundation +# Modifications Copyright © 2023 Nordix Foundation # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. diff --git a/kubernetes/aai/components/aai-sparky-be/.helmignore b/kubernetes/aai/components/aai-sparky-be/.helmignore index daebc7da77..f0c1319444 100644 --- a/kubernetes/aai/components/aai-sparky-be/.helmignore +++ b/kubernetes/aai/components/aai-sparky-be/.helmignore @@ -1,21 +1,21 @@ -# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
+# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/kubernetes/aai/components/aai-sparky-be/Chart.yaml b/kubernetes/aai/components/aai-sparky-be/Chart.yaml index a057002f57..5f05c6d428 100644 --- a/kubernetes/aai/components/aai-sparky-be/Chart.yaml +++ b/kubernetes/aai/components/aai-sparky-be/Chart.yaml @@ -17,7 +17,7 @@ apiVersion: v2 description: ONAP AAI sparky-be name: aai-sparky-be -version: 13.0.0 +version: 14.0.0 dependencies: - name: common diff --git a/kubernetes/aai/components/aai-sparky-be/resources/config/application/application-oxm-schema-prod.properties b/kubernetes/aai/components/aai-sparky-be/resources/config/application/application-oxm-schema-prod.properties index 178adb80b3..79f48da2aa 100644 --- a/kubernetes/aai/components/aai-sparky-be/resources/config/application/application-oxm-schema-prod.properties +++ b/kubernetes/aai/components/aai-sparky-be/resources/config/application/application-oxm-schema-prod.properties @@ -1,6 +1,6 @@ {{/* # Copyright © 2018 Amdocs, Bell Canada, AT&T -# Modifications Copyright © 2023 Nordix Foundation +# Modifications Copyright © 2023 Nordix Foundation # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. diff --git a/kubernetes/aai/components/aai-sparky-be/resources/config/application/application-resources.properties b/kubernetes/aai/components/aai-sparky-be/resources/config/application/application-resources.properties index e9ed63e76e..e0cf24c40b 100644 --- a/kubernetes/aai/components/aai-sparky-be/resources/config/application/application-resources.properties +++ b/kubernetes/aai/components/aai-sparky-be/resources/config/application/application-resources.properties @@ -1,6 +1,6 @@ {{/* # Copyright © 2018 Amdocs, Bell Canada, AT&T -# Modifications Copyright © 2023 Nordix Foundation +# Modifications Copyright © 2023 Nordix Foundation # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -19,4 +19,3 @@ resources.hostname=aai resources.port=80 resources.authType=HTTP_NOAUTH - diff --git a/kubernetes/aai/components/aai-sparky-be/resources/config/application/application-ssl.properties b/kubernetes/aai/components/aai-sparky-be/resources/config/application/application-ssl.properties index c6e1baac2a..68e1141cb3 100644 --- a/kubernetes/aai/components/aai-sparky-be/resources/config/application/application-ssl.properties +++ b/kubernetes/aai/components/aai-sparky-be/resources/config/application/application-ssl.properties @@ -1,5 +1,5 @@ # Copyright © 2018 Amdocs, Bell Canada, AT&T -# Modifications Copyright © 2023 Nordix Foundation +# Modifications Copyright © 2023 Nordix Foundation # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -16,4 +16,3 @@ server.port=8000 security.require-ssl=false server.ssl.enabled=false - diff --git a/kubernetes/aai/components/aai-sparky-be/resources/config/application/application.properties b/kubernetes/aai/components/aai-sparky-be/resources/config/application/application.properties index b5ad6b3f4a..41c41d29b1 100644 --- a/kubernetes/aai/components/aai-sparky-be/resources/config/application/application.properties +++ b/kubernetes/aai/components/aai-sparky-be/resources/config/application/application.properties @@ -1,5 +1,5 @@ # Copyright © 2018 Amdocs, Bell Canada, AT&T -# Modifications Copyright © 2023 Nordix Foundation +# Modifications Copyright © 2023 Nordix Foundation # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -30,3 +30,55 @@ searchservice.hostname={{.Values.global.searchData.serviceName}} searchservice.port=9509 schema.ingest.file=${CONFIG_HOME}/schemaIngest.properties + +# Properties for the SchemaLocationsBean +# Files named aai_oxm_v*.xml are unpacked here: +# Schema Version Related Attributes +schema.uri.base.path=/aai +# Lists all of the versions in the schema +schema.version.list=v9,v10,v11,v12,v13,v14 +# Specifies from which version should the depth parameter to default to zero +schema.version.depth.start=v10 +# Specifies from which version should the related link be displayed in response payload +schema.version.related.link.start=v10 +# Specifies from which version should the client see only the uri excluding host info +# Before this version server base will also be included +schema.version.app.root.start=v11 +# Specifies from which version should the namespace be changed +schema.version.namespace.change.start=v12 +# Specifies from which version should the client start seeing the edge label in payload +schema.version.edge.label.start=v12 +# Specifies the version that the application should default to +schema.version.api.default=v14 +# Schema Location Related Attributes +schema.configuration.location=NA +# New propterties required by the aai-common - aai-schema-ingest lib as of 1.3.0 +schema.configuration.location=N/A +schema.nodes.location=${APP_HOME}/onap/oxm +schema.edges.location= +# Setting this values to ${oxm.apiVersion} only to ensure the value used exists (we don't use this properties in our application) +# schema.version.depth.start=${oxm.apiVersion} +# schema.version.related.link.start=${oxm.apiVersion} +# schema.version.app.root.start=${oxm.apiVersion} +# schema.version.namespace.change.start=${oxm.apiVersion} +# schema.version.edge.label.start=${oxm.apiVersion} +# Properties required by AAI Schema Service MS +schema.translator.list=config +schema.service.base.url=${oxm.schemaServiceBaseUrl} +schema.service.nodes.endpoint=nodes?version= +schema.service.edges.endpoint=edgerules?version= +schema.service.versions.endpoint=versions +schema.local=true +schema.filename=mockrequests +#Default rest client is the two-way-ssl +#schema.service.client=two-way-ssl +#Replace the below with the A&AI client key store +schema.service.ssl.key-store=${oxm.schemaServiceKeystore} +#Replace the below with the A&AI tomcat trust store +schema.service.ssl.trust-store=${oxm.schemaServiceTruststore} +schema.service.ssl.key-store-password=${oxm.schemaServiceKeystorePassword} +schema.service.ssl.trust-store-password=${oxm.schemaServiceTruststorePassword} +spring.application.name=sparky +nodeDir=src/main/resources/schema/onap/oxm/ +edgeDir=src/main/resources/schema/onap/oxm +schemaIngestPropLoc=src/main/resources/schema/onap/oxm diff --git a/kubernetes/aai/components/aai-sparky-be/resources/config/application/users.config b/kubernetes/aai/components/aai-sparky-be/resources/config/application/users.config index ce69e88918..093e7b01fa 100644 --- a/kubernetes/aai/components/aai-sparky-be/resources/config/application/users.config +++ b/kubernetes/aai/components/aai-sparky-be/resources/config/application/users.config @@ -1,20 +1,20 @@ -[{
- "orgId": null,
- "managerId": null,
- "firstName": "Demo",
- "middleInitial": null,
- "lastName": "User",
- "phone": null,
- "email": "demo@email.com",
- "hrid": null,
- "orgUserId": "demo",
- "orgCode": null,
- "orgManagerUserId": null,
- "jobTitle": null,
- "loginId": "demo",
- "active": false,
- "roles": [{
- "id": 1,
- "name": "View"
- }]
-}]
\ No newline at end of file +[{ + "orgId": null, + "managerId": null, + "firstName": "Demo", + "middleInitial": null, + "lastName": "User", + "phone": null, + "email": "demo@email.com", + "hrid": null, + "orgUserId": "demo", + "orgCode": null, + "orgManagerUserId": null, + "jobTitle": null, + "loginId": "demo", + "active": false, + "roles": [{ + "id": 1, + "name": "View" + }] +}] diff --git a/kubernetes/aai/components/aai-sparky-be/templates/deployment.yaml b/kubernetes/aai/components/aai-sparky-be/templates/deployment.yaml index f8813cdf69..3c0b4b9d92 100644 --- a/kubernetes/aai/components/aai-sparky-be/templates/deployment.yaml +++ b/kubernetes/aai/components/aai-sparky-be/templates/deployment.yaml @@ -23,6 +23,7 @@ metadata: {{- include "common.resourceMetadata" . | nindent 2 }} spec: selector: {{- include "common.selectors" . | nindent 4 }} replicas: {{ .Values.replicaCount }} + revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} strategy: type: {{ .Values.updateStrategy.type }} {{- if (eq "RollingUpdate" .Values.updateStrategy.type) }} @@ -96,10 +97,34 @@ spec: - mountPath: /opt/app/sparky/config/logging/logback.xml name: config subPath: logback.xml - ports: {{ include "common.containerPorts" . | nindent 10 }} - # disable liveness probe when breakpoints set in debugger - # so K8s doesn't restart unresponsive container - {{- if eq .Values.liveness.enabled true }} + ports: + {{- if .Values.debug.enabled }} + - containerPort: {{ .Values.debug.port }} + name: {{ .Values.debug.portName }} + {{- end }} + {{- if .Values.profiling.enabled }} + - containerPort: {{ .Values.profiling.port }} + name: {{ .Values.profiling.portName }} + {{- end }} + {{ include "common.containerPorts" . | nindent 10 }} + env: + {{- if .Values.config.env }} + {{- range $key,$value := .Values.config.env }} + - name: {{ $key | upper | quote}} + value: {{ $value | quote}} + {{- end }} + {{- end }} + {{- if .Values.profiling.enabled }} + - name: JVM_ARGS + value: '{{ join " " .Values.profiling.args }}' + {{- end }} + {{- if .Values.debug.enabled }} + - name: JVM_ARGS + value: {{ .Values.debug.args | quote }} + {{- end }} + # disable liveness probe when + # debugging.enabled=true or profiling.enabled=true + {{- if and .Values.liveness.enabled (not (or .Values.debug.enabled .Values.profiling.enabled)) }} livenessProbe: tcpSocket: port: {{ .Values.service.internalPort }} diff --git a/kubernetes/aai/components/aai-sparky-be/values.yaml b/kubernetes/aai/components/aai-sparky-be/values.yaml index 0a9de51e54..4bb6d4163e 100644 --- a/kubernetes/aai/components/aai-sparky-be/values.yaml +++ b/kubernetes/aai/components/aai-sparky-be/values.yaml @@ -1,5 +1,5 @@ -# Copyright (c) 2018 Amdocs, Bell Canada, AT&T -# Modifications Copyright (c) 2020 Nokia, Orange +# Copyright © 2018 Amdocs, Bell Canada, AT&T +# Modifications Copyright © 2020 Nokia, Orange # Modifications Copyright © 2023 Nordix Foundation # # Licensed under the Apache License, Version 2.0 (the "License"); @@ -46,6 +46,8 @@ config: portalCookieName: UserId portalAppRoles: ui_view cookieDecryptorClass: org.onap.aai.sparky.security.BaseCookieDecryptor + env: + JVM_ARGS: -XX:MaxRAMPercentage=50.0 # ONAP Cookie Processing - During initial development, the following flag, if true, will # prevent the portal interface's login processing from searching for a user @@ -53,9 +55,33 @@ config: portalOnapEnabled: true # +# adds jvm args for remote debugging the application +debug: + enabled: false + args: "-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5005" + port: 5555 + portName: debug + +# adds jvm args for remote profiling the application +profiling: + enabled: false + args: + - "-Dcom.sun.management.jmxremote" + - "-Dcom.sun.management.jmxremote.ssl=false" + - "-Dcom.sun.management.jmxremote.authenticate=false" + - "-Dcom.sun.management.jmxremote.local.only=false" + - "-Dcom.sun.management.jmxremote.port=9999" + - "-Dcom.sun.management.jmxremote.rmi.port=9999" + - "-Djava.rmi.server.hostname=127.0.0.1" + port: 9999 + portName: jmx + # default number of instances replicaCount: 1 +# number of ReplicaSets that should be retained for the Deployment +revisionHistoryLimit: 2 + updateStrategy: type: RollingUpdate maxUnavailable: 0 diff --git a/kubernetes/aai/components/aai-traversal/.helmignore b/kubernetes/aai/components/aai-traversal/.helmignore index daebc7da77..f0c1319444 100644 --- a/kubernetes/aai/components/aai-traversal/.helmignore +++ b/kubernetes/aai/components/aai-traversal/.helmignore @@ -1,21 +1,21 @@ -# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
+# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/kubernetes/aai/components/aai-traversal/Chart.yaml b/kubernetes/aai/components/aai-traversal/Chart.yaml index 8c77848368..d511cf1b9b 100644 --- a/kubernetes/aai/components/aai-traversal/Chart.yaml +++ b/kubernetes/aai/components/aai-traversal/Chart.yaml @@ -17,7 +17,7 @@ apiVersion: v2 description: ONAP AAI traversal name: aai-traversal -version: 13.0.0 +version: 14.0.0 dependencies: - name: common diff --git a/kubernetes/aai/components/aai-traversal/resources/config/aaiconfig.properties b/kubernetes/aai/components/aai-traversal/resources/config/aaiconfig.properties index 559166ba8e..c844b3d194 100644 --- a/kubernetes/aai/components/aai-traversal/resources/config/aaiconfig.properties +++ b/kubernetes/aai/components/aai-traversal/resources/config/aaiconfig.properties @@ -5,7 +5,7 @@ # ================================================================================ # Copyright © 2017 AT&T Intellectual Property. All rights reserved. # Modifications Copyright © 2020 Orange -# Modifications Copyright © 2023 Nordix Foundation +# Modifications Copyright © 2023 Nordix Foundation # ================================================================================ # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. diff --git a/kubernetes/aai/components/aai-traversal/resources/config/application.properties b/kubernetes/aai/components/aai-traversal/resources/config/application.properties index 1b58ad6167..da2703dd41 100644 --- a/kubernetes/aai/components/aai-traversal/resources/config/application.properties +++ b/kubernetes/aai/components/aai-traversal/resources/config/application.properties @@ -1,7 +1,7 @@ {{/* # Copyright © 2018 Amdocs, Bell Canada, AT&T # Modifications Copyright © 2020 Orange -# Modifications Copyright � 2023 Nordix Foundation +# Modifications Copyright © 2023 Nordix Foundation # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -112,4 +112,4 @@ management.metrics.distribution.sla[http.server.requests]=20ms, 30ms, 40ms, 50ms #Add common tag for grouping all aai related metrics management.metrics.tags.group_id=aai #It is not advisable to use labels to store dimensions with high cardinality. Enable this option only for debug purposes. For more information: https://github.com/micrometer-metrics/micrometer/issues/1584 -scrape.uri.metrics=false
\ No newline at end of file +scrape.uri.metrics=false diff --git a/kubernetes/aai/components/aai-traversal/resources/config/janusgraph-realtime.properties b/kubernetes/aai/components/aai-traversal/resources/config/janusgraph-realtime.properties index 4835560665..adc7f6a4af 100644 --- a/kubernetes/aai/components/aai-traversal/resources/config/janusgraph-realtime.properties +++ b/kubernetes/aai/components/aai-traversal/resources/config/janusgraph-realtime.properties @@ -104,3 +104,7 @@ cache.db-cache-clean-wait={{ .Values.config.janusgraph.caching.dbCacheCleanWait #load graphson file on startup load.snapshot.file=false + +{{ if .Values.config.janusgraph.allowUpgrade }} +graph.allow-upgrade=true +{{ end }} diff --git a/kubernetes/aai/components/aai-traversal/templates/deployment.yaml b/kubernetes/aai/components/aai-traversal/templates/deployment.yaml index 67e1b996e3..e86a25ecad 100644 --- a/kubernetes/aai/components/aai-traversal/templates/deployment.yaml +++ b/kubernetes/aai/components/aai-traversal/templates/deployment.yaml @@ -1,8 +1,8 @@ {{/* -# Copyright (c) 2017 Amdocs, Bell Canada -# Modifications Copyright (c) 2018 AT&T -# Modifications Copyright (c) 2020 Nokia, Orange -# Modifications Copyright (c) 2021 Orange +# Copyright © 2017 Amdocs, Bell Canada +# Modifications Copyright © 2018 AT&T +# Modifications Copyright © 2020 Nokia, Orange +# Modifications Copyright © 2021 Orange # Modifications Copyright © 2023 Nordix Foundation # # Licensed under the Apache License, Version 2.0 (the "License"); @@ -36,6 +36,7 @@ metadata: heritage: {{ .Release.Service }} spec: replicas: {{ .Values.replicaCount }} + revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} minReadySeconds: {{ .Values.minReadySeconds }} strategy: type: {{ .Values.updateStrategy.type }} @@ -178,11 +179,11 @@ spec: - name: LOCAL_GROUP_ID value: {{ .Values.global.config.groupId | quote }} - name: INTERNAL_PORT_1 - value: {{ .Values.service.internalPort | quote }} + value: {{ .Values.service.traversalPort | quote }} - name: INTERNAL_PORT_2 - value: {{ .Values.service.internalPort2 | quote }} + value: {{ .Values.service.debugPort | quote }} - name: INTERNAL_PORT_3 - value: {{ .Values.service.internalPort3 | quote }} + value: {{ .Values.service.metricsPort | quote }} - name: BOOTSTRAP_SERVERS value: {{ include "common.release" . }}-strimzi-kafka-bootstrap:9092 - name: JAAS_CONFIG @@ -220,20 +221,18 @@ spec: name: {{ include "common.fullname" . }}-config subPath: application-keycloak.properties ports: - - containerPort: {{ .Values.service.internalPort }} - name: {{ .Values.service.portName }} - + - containerPort: {{ .Values.service.traversalPort }} + name: {{ .Values.service.traversalPortName }} {{- if .Values.config.debug.enabled }} - - containerPort: {{ .Values.service.internalPort2 }} - name: {{ .Values.service.portName2 }} + - containerPort: {{ .Values.service.debugPort }} + name: {{ .Values.service.debugPortName }} {{- end }} - - containerPort: {{ .Values.service.internalPort3 }} - name: {{ .Values.service.portName3 }} + - containerPort: {{ .Values.service.metricsPort }} + name: {{ .Values.service.metricsPortName }} {{- if .Values.config.profiling.enabled }} - - containerPort: {{ .Values.service.internalPort4 }} - name: {{ .Values.service.portName4 }} + - containerPort: {{ .Values.service.profilingPort }} + name: {{ .Values.service.profilingPortName }} {{- end }} - lifecycle: # wait for active requests (long-running tasks) to be finished # Before the SIGTERM is invoked, Kubernetes exposes a preStop hook in the Pod. @@ -243,16 +242,16 @@ spec: - sh - -c - | - while (netstat -an | grep ESTABLISHED | grep -e $INTERNAL_PORT_1 -e $INTERNAL_PORT_2) + while (netstat -an | grep ESTABLISHED | grep -e $INTERNAL_PORT_1) do sleep 10 done - # disable liveness probe when breakpoints set in debugger - # so K8s doesn't restart unresponsive container - {{ if .Values.liveness.enabled }} + # disable liveness probe when + # debugging.enable=true or profiling.enabled=true + {{- if and .Values.liveness.enabled (not (or .Values.config.debug.enabled .Values.config.profiling.enabled)) }} livenessProbe: httpGet: path: /aai/util/echo?action=checkDB - port: {{ .Values.service.internalPort }} + port: {{ .Values.service.traversalPort }} scheme: HTTP httpHeaders: - name: X-FromAppId @@ -267,7 +266,7 @@ spec: readinessProbe: httpGet: path: /aai/util/echo?action=checkDB - port: {{ .Values.service.internalPort }} + port: {{ .Values.service.traversalPort }} scheme: HTTP httpHeaders: - name: X-FromAppId diff --git a/kubernetes/aai/components/aai-traversal/templates/service.yaml b/kubernetes/aai/components/aai-traversal/templates/service.yaml index 2fac1e5a42..49ed56306a 100644 --- a/kubernetes/aai/components/aai-traversal/templates/service.yaml +++ b/kubernetes/aai/components/aai-traversal/templates/service.yaml @@ -29,28 +29,30 @@ spec: type: {{ .Values.service.type }} ports: {{if eq .Values.service.type "NodePort" -}} - - port: {{ .Values.service.internalPort }} + - port: {{ .Values.service.traversalPort }} nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort }} - name: {{ .Values.service.portName }} - targetPort: {{ .Values.service.portName }} - - port: {{ .Values.service.internalPort2 }} + name: {{ .Values.service.traversalPortName }} + targetPort: {{ .Values.service.traversalPortName }} + - port: {{ .Values.service.debugPort }} nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort2 }} - name: {{ .Values.service.portName2 }} - targetPort: {{ .Values.service.portName2 }} - - port: {{ .Values.service.internalPort3 }} + name: {{ .Values.service.debugPortName }} + targetPort: {{ .Values.service.debugPortName }} + - port: {{ .Values.service.metricsPort }} nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort3 }} - name: {{ .Values.service.portName3 }} - targetPort: {{ .Values.service.portName3 }} + name: {{ .Values.service.metricsPortName }} + targetPort: {{ .Values.service.metricsPortName }} {{- else -}} - - port: {{ .Values.service.internalPort }} - name: {{ .Values.service.portName }} - targetPort: {{ .Values.service.portName }} - - port: {{ .Values.service.internalPort2 }} - name: {{ .Values.service.portName2 }} - targetPort: {{ .Values.service.portName2 }} - - port: {{ .Values.service.internalPort3 }} - name: {{ .Values.service.portName3 }} - targetPort: {{ .Values.service.portName3 }} + - port: {{ .Values.service.traversalPort }} + name: {{ .Values.service.traversalPortName }} + targetPort: {{ .Values.service.traversalPortName }} + {{- if .Values.config.debug.enabled }} + - port: {{ .Values.service.debugPort }} + name: {{ .Values.service.debugPortName }} + targetPort: {{ .Values.service.debugPortName }} + {{- end }} + - port: {{ .Values.service.metricsPort }} + name: {{ .Values.service.metricsPortName }} + targetPort: {{ .Values.service.metricsPortName }} {{- end }} selector: app: {{ include "common.name" . }} diff --git a/kubernetes/aai/components/aai-traversal/values.yaml b/kubernetes/aai/components/aai-traversal/values.yaml index b860b8126a..691e65d8c2 100644 --- a/kubernetes/aai/components/aai-traversal/values.yaml +++ b/kubernetes/aai/components/aai-traversal/values.yaml @@ -22,6 +22,7 @@ global: # global defaults nodePortPrefix: 302 kafkaBootstrap: strimzi-kafka-bootstrap aaiTravKafkaUser: aai-trav-kafka-user + cassandra: #Service Name of the cassandra cluster to connect to. #Override it to aai-cassandra if localCluster is enabled. @@ -112,7 +113,7 @@ global: # global defaults aaiTopic: AAI-EVENT # application image -image: onap/aai-traversal:1.13.5 +image: onap/aai-traversal:1.14.0 pullPolicy: Always restartPolicy: Always flavor: small @@ -136,6 +137,16 @@ api_list: - 17 - 18 - 19 + - 20 + - 21 + - 22 + - 23 + - 24 + - 25 + - 26 + - 27 + - 28 + - 29 aai_enpoints: - name: aai-generic-query @@ -147,6 +158,7 @@ aai_enpoints: # application configuration config: + # configure keycloak according to your environment. # don't forget to add keycloak in active profiles above (global.config.profiles) keycloak: @@ -164,14 +176,16 @@ config: caching: # enable when running read-heavy workloads # modifications to graph done by this service/janusgraph instance will immediately invalidate the cache - # modifications to graph done by other services (resources) will only be visible + # modifications to graph done by other services (traversal) will only be visible # after time specified in db-cache-time - enabled: false + enabled: true # Documentation: https://docs.janusgraph.org/operations/cache/#database-level-caching dbCacheTime: 180000 # in milliseconds dbCacheSize: 0.1 # percentage (expressed as a decimal between 0 and 1) of the total heap space available to the JVM running dbCacheCleanWait: 20 # in milliseconds - + # temporarily enable this to update the graph storage version + # see: https://docs.janusgraph.org/changelog/#upgrade-instructions_9 + allowUpgrade: true # Specifies timeout information such as application specific and limits timeout: @@ -185,8 +199,9 @@ config: # environment variables added to the launch of the image in deployment env: MIN_HEAP_SIZE: "512m" - MAX_HEAP_SIZE: "1024m" + MAX_HEAP_SIZE: "2g" MAX_METASPACE_SIZE: "512m" + # POST_JVM_ARGS: "-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5005" # adds jvm args for remote debugging the application debug: @@ -237,6 +252,9 @@ persistence: # default number of instances replicaCount: 1 +# number of ReplicaSets that should be retained for the Deployment +revisionHistoryLimit: 2 + nodeSelector: {} affinity: {} @@ -245,9 +263,7 @@ affinity: {} liveness: initialDelaySeconds: 60 periodSeconds: 60 - # necessary to disable liveness probe when setting breakpoints - # in debugger so K8s doesn't restart unresponsive container - enabled: false + enabled: true readiness: initialDelaySeconds: 10 @@ -255,13 +271,15 @@ readiness: service: type: ClusterIP - portName: http - internalPort: 8446 - portName2: tcp-5005 - internalPort2: 5005 - portName3: http-traversal - internalPort3: 8448 - terminationGracePeriodSeconds: 120 + traversalPortName: http + traversalPort: 8446 + debugPortName: tcp-5005 + debugPort: 5005 + metricsPortName: metrics + metricsPort: 8448 + profilingPortName: jmx-9999 + profilingPort: 9999 + terminationGracePeriodSeconds: 60 sessionAffinity: None ingress: @@ -281,8 +299,8 @@ logback: queueSize: 1000 accessLogback: - livenessAccessLogEnabled: false # false: do not log kubernetes liveness probes logToFileEnabled: false + livenessAccessLogEnabled: false # false: do not log kubernetes liveness probes maxHistory: 7 totalSizeCap: 6GB @@ -305,6 +323,14 @@ resources: memory: "4Gi" unlimited: {} +tracing: + collector: + baseUrl: http://jaeger-collector.istio-system:9411 + sampling: + probability: 1.0 # percentage of requests that are sampled (between 0-1/0%-100%) + ignorePatterns: + - /aai/util.* + endpoints: enabled: true health: diff --git a/kubernetes/common/cassandra/.helmignore b/kubernetes/common/cassandra/.helmignore new file mode 100644 index 0000000000..0bab41b6b1 --- /dev/null +++ b/kubernetes/common/cassandra/.helmignore @@ -0,0 +1,32 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +# Project/CI/CD related items +.gitlab +.gitlab-ci.yml +.dockerignore +# Helm build files +.helmignore +.cache/ +.config/ +.local/ +# OOM specific dirs +components/ diff --git a/kubernetes/common/cassandra/Chart.yaml b/kubernetes/common/cassandra/Chart.yaml index ee3f4e5355..81f5c5dae7 100644 --- a/kubernetes/common/cassandra/Chart.yaml +++ b/kubernetes/common/cassandra/Chart.yaml @@ -30,4 +30,4 @@ dependencies: - name: serviceAccount version: ~13.x-0 repository: 'file://../serviceAccount' - condition: global.cassandra.enableServiceAccount
\ No newline at end of file + condition: global.cassandra.enableServiceAccount diff --git a/kubernetes/common/cassandra/resources/config/docker-entrypoint.sh b/kubernetes/common/cassandra/resources/config/docker-entrypoint.sh index f9f62739f2..50051b4b44 100644 --- a/kubernetes/common/cassandra/resources/config/docker-entrypoint.sh +++ b/kubernetes/common/cassandra/resources/config/docker-entrypoint.sh @@ -93,4 +93,3 @@ if [ "$1" = 'cassandra' ]; then fi exec "$@" - diff --git a/kubernetes/common/cassandra/resources/exec.py b/kubernetes/common/cassandra/resources/exec.py index a7f297399e..ec2f0b4fc6 100644 --- a/kubernetes/common/cassandra/resources/exec.py +++ b/kubernetes/common/cassandra/resources/exec.py @@ -118,5 +118,3 @@ def main(argv): if __name__ == "__main__": main(sys.argv[1:]) - - diff --git a/kubernetes/common/cassandra/templates/backup/cronjob.yaml b/kubernetes/common/cassandra/templates/backup/cronjob.yaml index 6db1202b4f..263ac28512 100644 --- a/kubernetes/common/cassandra/templates/backup/cronjob.yaml +++ b/kubernetes/common/cassandra/templates/backup/cronjob.yaml @@ -250,4 +250,4 @@ spec: persistentVolumeClaim: claimName: {{ include "common.fullname" . }}-backup-data {{- end -}} -{{- end -}}
\ No newline at end of file +{{- end -}} diff --git a/kubernetes/common/cassandra/templates/cassOp.yaml b/kubernetes/common/cassandra/templates/cassOp.yaml index 9f463adf08..6b7052d10e 100644 --- a/kubernetes/common/cassandra/templates/cassOp.yaml +++ b/kubernetes/common/cassandra/templates/cassOp.yaml @@ -16,4 +16,4 @@ {{- if .Values.global.cassandra.useOperator }} {{ include "common.k8ssandraCluster" . }} -{{- end }}
\ No newline at end of file +{{- end }} diff --git a/kubernetes/common/cassandra/templates/configmap.yaml b/kubernetes/common/cassandra/templates/configmap.yaml index 5510986e54..117100a441 100644 --- a/kubernetes/common/cassandra/templates/configmap.yaml +++ b/kubernetes/common/cassandra/templates/configmap.yaml @@ -26,4 +26,4 @@ metadata: heritage: {{ .Release.Service }} data: {{ tpl (.Files.Glob "resources/config/docker-entrypoint.sh").AsConfig . | indent 2 }} -{{- end }}
\ No newline at end of file +{{- end }} diff --git a/kubernetes/common/cassandra/templates/pv.yaml b/kubernetes/common/cassandra/templates/pv.yaml index d18e51d2f4..00e61d3bb5 100644 --- a/kubernetes/common/cassandra/templates/pv.yaml +++ b/kubernetes/common/cassandra/templates/pv.yaml @@ -15,4 +15,4 @@ */}} {{- if not .Values.global.cassandra.useOperator }} {{ include "common.replicaPV" . }} -{{- end }}
\ No newline at end of file +{{- end }} diff --git a/kubernetes/common/cassandra/templates/secrets.yaml b/kubernetes/common/cassandra/templates/secrets.yaml index 5a611a9bef..181e5f98a7 100644 --- a/kubernetes/common/cassandra/templates/secrets.yaml +++ b/kubernetes/common/cassandra/templates/secrets.yaml @@ -18,4 +18,4 @@ {{- if .Values.global.cassandra.useOperator }} {{ include "common.secretFast" . }} -{{- end }}
\ No newline at end of file +{{- end }} diff --git a/kubernetes/common/cassandra/templates/service.yaml b/kubernetes/common/cassandra/templates/service.yaml index 8b2e534a5f..6b6f585d2f 100644 --- a/kubernetes/common/cassandra/templates/service.yaml +++ b/kubernetes/common/cassandra/templates/service.yaml @@ -16,4 +16,4 @@ {{- if not .Values.global.cassandra.useOperator }} {{ include "common.headlessService" . }} -{{- end }}
\ No newline at end of file +{{- end }} diff --git a/kubernetes/common/cassandra/templates/servicemonitor.yaml b/kubernetes/common/cassandra/templates/servicemonitor.yaml index 078107393a..57f4d3f412 100644 --- a/kubernetes/common/cassandra/templates/servicemonitor.yaml +++ b/kubernetes/common/cassandra/templates/servicemonitor.yaml @@ -18,4 +18,4 @@ {{- if .Values.metrics.serviceMonitor.enabled }} {{ include "common.serviceMonitor" . }} {{- end }} -{{- end }}
\ No newline at end of file +{{- end }} diff --git a/kubernetes/common/cassandra/templates/statefulset.yaml b/kubernetes/common/cassandra/templates/statefulset.yaml index ddaff5c7c0..d76dde3454 100644 --- a/kubernetes/common/cassandra/templates/statefulset.yaml +++ b/kubernetes/common/cassandra/templates/statefulset.yaml @@ -199,4 +199,4 @@ spec: requests: storage: {{ .Values.persistence.size | quote }} {{- end }} -{{- end }}
\ No newline at end of file +{{- end }} diff --git a/kubernetes/common/common/.helmignore b/kubernetes/common/common/.helmignore new file mode 100644 index 0000000000..f066c4b723 --- /dev/null +++ b/kubernetes/common/common/.helmignore @@ -0,0 +1,32 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +# Project/CI/CD related items +.gitlab +.gitlab-ci.yml +.dockerignore +# Helm build files +.helmignore +.cache/ +.local/ +.config/ +# OOM specific dirs +components/ diff --git a/kubernetes/common/common/Chart.yaml b/kubernetes/common/common/Chart.yaml index ffcda6736a..787930a473 100644 --- a/kubernetes/common/common/Chart.yaml +++ b/kubernetes/common/common/Chart.yaml @@ -12,8 +12,8 @@ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. - +--- apiVersion: v2 description: Common templates for inclusion in other charts name: common -version: 13.2.0 +version: 13.2.1 diff --git a/kubernetes/common/common/templates/_affinities.tpl b/kubernetes/common/common/templates/_affinities.tpl index bf7ae497ca..69d0e78680 100644 --- a/kubernetes/common/common/templates/_affinities.tpl +++ b/kubernetes/common/common/templates/_affinities.tpl @@ -106,4 +106,4 @@ Return a podAffinity/podAntiAffinity definition {{- else if eq .type "hard" }} {{- include "common.affinities.pods.hard" . -}} {{- end -}} -{{- end -}}
\ No newline at end of file +{{- end -}} diff --git a/kubernetes/common/common/templates/_cassOp.tpl b/kubernetes/common/common/templates/_cassOp.tpl index b0cf8e331e..bdcf5caa02 100644 --- a/kubernetes/common/common/templates/_cassOp.tpl +++ b/kubernetes/common/common/templates/_cassOp.tpl @@ -111,13 +111,18 @@ spec: name: {{ $datacenter.name }} size: {{ $datacenter.size }} {{- end }} - {{ if .Values.podAnnotations -}} + podSecurityContext: + fsGroup: 999 + runAsGroup: 999 + runAsUser: 999 + runAsNonRoot: true metadata: + {{ if .Values.podAnnotations -}} pods: annotations: {{ toYaml .Values.podAnnotations | nindent 10 }} + {{- end }} commonLabels: app: {{ .Values.k8ssandraOperator.config.clusterName }} version: {{ .Values.k8ssandraOperator.cassandraVersion }} - {{- end }} {{ end }} diff --git a/kubernetes/common/common/templates/_dmaapProvisioning.tpl b/kubernetes/common/common/templates/_dmaapProvisioning.tpl index e7b90ea8ff..f162e9a2f9 100644 --- a/kubernetes/common/common/templates/_dmaapProvisioning.tpl +++ b/kubernetes/common/common/templates/_dmaapProvisioning.tpl @@ -115,4 +115,4 @@ {{- include "common.dmaap.provisioning._volumeMounts" $dot | trim | nindent 2 }} resources: {{ include "common.resources" $dot | nindent 4 }} {{- end -}} -{{- end -}}
\ No newline at end of file +{{- end -}} diff --git a/kubernetes/common/common/templates/_log.tpl b/kubernetes/common/common/templates/_log.tpl index 993c48239a..dc900dd4e4 100644 --- a/kubernetes/common/common/templates/_log.tpl +++ b/kubernetes/common/common/templates/_log.tpl @@ -59,4 +59,3 @@ data: {{ tpl (.Files.Glob "resources/config/log/filebeat/*").AsConfig . | indent 2 }} {{- end }} {{- end -}} - diff --git a/kubernetes/common/common/templates/_mariadb.tpl b/kubernetes/common/common/templates/_mariadb.tpl index 3092298a7d..0e46e5ef26 100644 --- a/kubernetes/common/common/templates/_mariadb.tpl +++ b/kubernetes/common/common/templates/_mariadb.tpl @@ -257,6 +257,29 @@ spec: runAsUser: 10001 runAsGroup: 10001 fsGroup: 10001 + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + securityContext: + readOnlyRootFilesystem: true + privileged: false + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - CAP_NET_RAW + volumes: + - name: run + emptyDir: + sizeLimit: 64Mi + - name: tmp + emptyDir: + sizeLimit: 64Mi + volumeMounts: + - name: run + mountPath: /run/mysqld + - name: tmp + mountPath: /tmp inheritMetadata: {{ if .Values.podAnnotations -}} annotations: {{ toYaml .Values.podAnnotations | nindent 6 }} @@ -288,6 +311,17 @@ spec: enabled: true authDelegatorRoleName: {{ $dbinst }}-auth gracefulShutdownTimeout: 5s + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - CAP_NET_RAW + privileged: false + runAsNonRoot: true + runAsUser: 10001 + seccompProfile: + type: RuntimeDefault primary: automaticFailover: true podIndex: 0 @@ -301,6 +335,17 @@ spec: initContainer: image: {{ include "repositoryGenerator.githubContainerRegistry" . }}/{{ $dot.Values.mariadbOperator.galera.initImage }}:{{ $dot.Values.mariadbOperator.galera.initVersion }} imagePullPolicy: IfNotPresent + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - CAP_NET_RAW + privileged: false + runAsNonRoot: true + runAsUser: 10001 + seccompProfile: + type: RuntimeDefault config: reuseStorageVolume: false volumeClaimTemplate: @@ -334,6 +379,31 @@ spec: {{- if default false $dot.Values.global.metrics.enabled }} metrics: enabled: true + exporter: + image: {{ include "repositoryGenerator.dockerHubRepository" . }}/prom/mysqld-exporter:v0.15.1 + port: 9104 + podSecurityContext: + fsGroup: 10001 + runAsGroup: 10001 + runAsUser: 10001 + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + securityContext: + readOnlyRootFilesystem: true + privileged: false + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - CAP_NET_RAW + resources: + limits: + cpu: 100m + memory: 128Mi + requests: + cpu: 100m + memory: 128Mi {{- end }} affinity: podAntiAffinity: diff --git a/kubernetes/common/common/templates/_mongodb.tpl b/kubernetes/common/common/templates/_mongodb.tpl new file mode 100644 index 0000000000..80d8d72194 --- /dev/null +++ b/kubernetes/common/common/templates/_mongodb.tpl @@ -0,0 +1,165 @@ +{{/* +# Copyright © 2019 Samsung Electronics +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +*/}} +{{/* + UID of mongodb root password +*/}} +{{- define "common.mongodb.secret.rootPassUID" -}} + {{- printf "db-root-password" }} +{{- end -}} + +{{/* + Name of mongodb secret +*/}} +{{- define "common.mongodb.secret._secretName" -}} + {{- $global := .dot }} + {{- $chartName := tpl .chartName $global -}} + {{- include "common.secret.genName" (dict "global" $global "uid" (include .uidTemplate $global) "chartName" $chartName) }} +{{- end -}} + +{{/* + Name of mongodb root password secret +*/}} +{{- define "common.mongodb.secret.rootPassSecretName" -}} + {{- include "common.mongodb.secret._secretName" (set . "uidTemplate" "common.mongodb.secret.rootPassUID") }} +{{- end -}} + +{{/* + UID of mongodb user credentials +*/}} +{{- define "common.mongodb.secret.userCredentialsUID" -}} + {{- printf "db-user-credentials" }} +{{- end -}} + +{{/* + Name of mongodb user credentials secret +*/}} +{{- define "common.mongodb.secret.userCredentialsSecretName" -}} + {{- include "common.mongodb.secret._secretName" (set . "uidTemplate" "common.mongodb.secret.userCredentialsUID") }} +{{- end -}} + +{{/* + UID of mongodb primary password +*/}} +{{- define "common.mongodb.secret.primaryPasswordUID" -}} + {{- printf "primary-password" }} +{{- end -}} + +{{/* + Name of mongodb user credentials secret +*/}} +{{- define "common.mongodb.secret.primaryPasswordSecretName" -}} + {{- include "common.mongodb.secret._secretName" (set . "uidTemplate" "common.mongodb.secret.primaryPasswordUID") }} +{{- end -}} + +{{/* + Choose the name of the mongodb app label to use. +*/}} +{{- define "common.mongodbAppName" -}} + {{- if .Values.global.mongodb.localCluster -}} + {{- index .Values "mongodb" "nameOverride" -}} + {{- else -}} + {{- .Values.global.mongodb.nameOverride -}} + {{- end -}} +{{- end -}} + +#Not edited yet +{{/* + Create mongodb cluster via mongodb percona-operator +*/}} +{{- define "common.mongodbOpInstance" -}} +{{- $dot := default . .dot -}} +{{- $global := $dot.Values.global -}} +{{- $dbinst := include "common.name" $dot -}} +--- + +apiVersion: psmdb.percona.com/v1 +kind: PerconaServerMongoDB +metadata: + name: {{ $dbinst }} + labels: + app: {{ $dbinst }} + version: "5.5" +spec: + metadata: + labels: + app: {{ $dbinst }} + version: "5.5" + {{- if .Values.mongodbOperator.imageMongo }} + image: {{ .Values.mongodbOperator.imageMongo | quote }} + {{- end }} + imagePullSecrets: + - name: {{ include "common.namespace" . }}-docker-registry-key + mongodbVersion: {{ $dot.Values.mongodbOperator.mongodbVersion }} + instances: + - name: {{ default "instance1" .Values.mongodbOperator.instanceName | quote }} + replicas: {{ default 2 .Values.mongodbOperator.instanceReplicas }} + dataVolumeClaimSpec: + {{- if .Values.instanceStorageClassName }} + storageClassName: {{ .Values.mongodbOperator.instanceStorageClassName | quote }} + {{- end }} + accessModes: + - "ReadWriteOnce" + resources: + requests: + storage: {{ default "1Gi" .Values.mongodbOperator.instanceSize | quote }} + {{- if or .Values.instanceMemory .Values.mongodbOperator.instanceCPU }} + resources: + limits: + cpu: {{ default "" .Values.mongodbOperator.instanceCPU | quote }} + memory: {{ default "" .Values.mongodbOperator.instanceMemory | quote }} + {{- end }} + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 1 + podAffinityTerm: + topologyKey: kubernetes.io/hostname + labelSelector: + matchLabels: + mongodb-operator.crunchydata.com/cluster: {{ $dbinst }} + mongodb-operator.crunchydata.com/instance-set: {{ default "instance1" .Values.mongodbOperator.instanceName | quote }} + proxy: + pgBouncer: + metadata: + labels: + app: {{ $dbinst }} + version: "5.5" + {{- if .Values.mongodbOperator.imagePgBouncer }} + image: {{ .Values.mongodbOperator.imagePgBouncer | quote }} + {{- end }} + replicas: {{ default 2 .Values.mongodbOperator.bouncerReplicas }} + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 1 + podAffinityTerm: + topologyKey: kubernetes.io/hostname + labelSelector: + matchLabels: + mongodb-operator.crunchydata.com/cluster: {{ $dbinst }} + mongodb-operator.crunchydata.com/role: pgbouncer + {{- if .Values.mongodbOperator.monitoring }} + monitoring: + pgmonitor: + exporter: + image: {{ default "" .Values.mongodbOperator.imageExporter | quote }} + {{- if .Values.mongodbOperator.monitoringConfig }} +{{ toYaml .Values.monitoringConfig | indent 8 }} + {{- end }} + {{- end }} + users: + - name: mongodb +{{- end -}} diff --git a/kubernetes/common/common/templates/_pod.tpl b/kubernetes/common/common/templates/_pod.tpl index 810350bfa6..0a1d0abdf6 100644 --- a/kubernetes/common/common/templates/_pod.tpl +++ b/kubernetes/common/common/templates/_pod.tpl @@ -59,6 +59,9 @@ securityContext: runAsUser: {{ .Values.securityContext.user_id }} runAsGroup: {{ .Values.securityContext.group_id }} fsGroup: {{ .Values.securityContext.group_id }} + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault {{- end }} {{/* @@ -69,4 +72,8 @@ securityContext: readOnlyRootFilesystem: true privileged: false allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - CAP_NET_RAW {{- end }} diff --git a/kubernetes/common/common/templates/_serviceMesh.tpl b/kubernetes/common/common/templates/_serviceMesh.tpl index de779f8db8..55e9e00410 100644 --- a/kubernetes/common/common/templates/_serviceMesh.tpl +++ b/kubernetes/common/common/templates/_serviceMesh.tpl @@ -65,6 +65,14 @@ exit "$RCODE" fieldRef: apiVersion: v1 fieldPath: metadata.namespace + {{ include "common.containerSecurityContext" . | indent 2 | trim }} + resources: + limits: + cpu: 100m + memory: 500Mi + requests: + cpu: 10m + memory: 10Mi {{- end }} {{- end }} diff --git a/kubernetes/common/elasticsearch/.helmignore b/kubernetes/common/elasticsearch/.helmignore index 68ffb32406..0bab41b6b1 100644 --- a/kubernetes/common/elasticsearch/.helmignore +++ b/kubernetes/common/elasticsearch/.helmignore @@ -1 +1,32 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +# Project/CI/CD related items +.gitlab +.gitlab-ci.yml +.dockerignore +# Helm build files +.helmignore +.cache/ +.config/ +.local/ +# OOM specific dirs components/ diff --git a/kubernetes/common/elasticsearch/Chart.yaml b/kubernetes/common/elasticsearch/Chart.yaml index 82c8ccd056..6949da7962 100644 --- a/kubernetes/common/elasticsearch/Chart.yaml +++ b/kubernetes/common/elasticsearch/Chart.yaml @@ -24,6 +24,9 @@ dependencies: - name: common version: ~13.x-0 repository: 'file://../common' + - name: repositoryGenerator + version: ~13.x-0 + repository: 'file://../repositoryGenerator' - name: master version: ~13.x-0 repository: 'file://components/master' @@ -35,6 +38,3 @@ dependencies: version: ~13.x-0 repository: 'file://components/curator' condition: elasticsearch.curator.enabled,curator.enabled - - name: repositoryGenerator - version: ~13.x-0 - repository: 'file://../repositoryGenerator' diff --git a/kubernetes/common/elasticsearch/components/curator/Chart.yaml b/kubernetes/common/elasticsearch/components/curator/Chart.yaml index 39780f2e83..390228b6ae 100644 --- a/kubernetes/common/elasticsearch/components/curator/Chart.yaml +++ b/kubernetes/common/elasticsearch/components/curator/Chart.yaml @@ -26,4 +26,4 @@ dependencies: repository: 'file://../../../common' - name: repositoryGenerator version: ~13.x-0 - repository: 'file://../../../repositoryGenerator'
\ No newline at end of file + repository: 'file://../../../repositoryGenerator' diff --git a/kubernetes/common/elasticsearch/components/curator/values.yaml b/kubernetes/common/elasticsearch/components/curator/values.yaml index 00f113b5bb..d02d017108 100644 --- a/kubernetes/common/elasticsearch/components/curator/values.yaml +++ b/kubernetes/common/elasticsearch/components/curator/values.yaml @@ -175,4 +175,3 @@ extraInitContainers: {} # "storage_class": "${S3_STORAGE_CLASS}" # } # } - diff --git a/kubernetes/common/elasticsearch/templates/_helpers.tpl b/kubernetes/common/elasticsearch/templates/_helpers.tpl index 1de2599af9..34663e14f1 100644 --- a/kubernetes/common/elasticsearch/templates/_helpers.tpl +++ b/kubernetes/common/elasticsearch/templates/_helpers.tpl @@ -69,5 +69,3 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this {{ default "default" .Values.serviceAccount.name }} {{- end -}} {{- end -}} - - diff --git a/kubernetes/common/etcd/.helmignore b/kubernetes/common/etcd/.helmignore index f0c1319444..0bab41b6b1 100644 --- a/kubernetes/common/etcd/.helmignore +++ b/kubernetes/common/etcd/.helmignore @@ -19,3 +19,14 @@ .project .idea/ *.tmproj +# Project/CI/CD related items +.gitlab +.gitlab-ci.yml +.dockerignore +# Helm build files +.helmignore +.cache/ +.config/ +.local/ +# OOM specific dirs +components/ diff --git a/kubernetes/common/etcd/templates/service.yaml b/kubernetes/common/etcd/templates/service.yaml index 006378f631..72dea06832 100644 --- a/kubernetes/common/etcd/templates/service.yaml +++ b/kubernetes/common/etcd/templates/service.yaml @@ -35,4 +35,3 @@ spec: selector: app.kubernetes.io/name: {{ include "common.name" . }} app.kubernetes.io/instance: {{ include "common.release" . }} - diff --git a/kubernetes/common/logConfiguration/.helmignore b/kubernetes/common/logConfiguration/.helmignore new file mode 100644 index 0000000000..0bab41b6b1 --- /dev/null +++ b/kubernetes/common/logConfiguration/.helmignore @@ -0,0 +1,32 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +# Project/CI/CD related items +.gitlab +.gitlab-ci.yml +.dockerignore +# Helm build files +.helmignore +.cache/ +.config/ +.local/ +# OOM specific dirs +components/ diff --git a/kubernetes/common/mariadb-galera/.helmignore b/kubernetes/common/mariadb-galera/.helmignore index f0c1319444..0bab41b6b1 100644 --- a/kubernetes/common/mariadb-galera/.helmignore +++ b/kubernetes/common/mariadb-galera/.helmignore @@ -19,3 +19,14 @@ .project .idea/ *.tmproj +# Project/CI/CD related items +.gitlab +.gitlab-ci.yml +.dockerignore +# Helm build files +.helmignore +.cache/ +.config/ +.local/ +# OOM specific dirs +components/ diff --git a/kubernetes/common/mariadb-galera/templates/backup/pvc.yaml b/kubernetes/common/mariadb-galera/templates/backup/pvc.yaml index 4c2bfcd389..05aafb5cc9 100644 --- a/kubernetes/common/mariadb-galera/templates/backup/pvc.yaml +++ b/kubernetes/common/mariadb-galera/templates/backup/pvc.yaml @@ -47,4 +47,4 @@ spec: {{- end -}} {{- end -}} {{- end -}} -{{- end -}}
\ No newline at end of file +{{- end -}} diff --git a/kubernetes/common/mariadb-galera/templates/configmap.yaml b/kubernetes/common/mariadb-galera/templates/configmap.yaml index 0aa0a63f0a..152d39f4a5 100644 --- a/kubernetes/common/mariadb-galera/templates/configmap.yaml +++ b/kubernetes/common/mariadb-galera/templates/configmap.yaml @@ -39,4 +39,4 @@ data: my.cnf: | {{ .Values.mariadbConfiguration | indent 4 }} {{- end }} -{{- end }}
\ No newline at end of file +{{- end }} diff --git a/kubernetes/common/mariadb-galera/templates/mariadb.yaml b/kubernetes/common/mariadb-galera/templates/mariadb.yaml index ce09c9ff06..d8ada6fbbb 100644 --- a/kubernetes/common/mariadb-galera/templates/mariadb.yaml +++ b/kubernetes/common/mariadb-galera/templates/mariadb.yaml @@ -16,4 +16,4 @@ {{- if .Values.global.mariadbGalera.useOperator }} {{ include "common.mariadbOpInstance" . }} -{{- end }}
\ No newline at end of file +{{- end }} diff --git a/kubernetes/common/mariadb-galera/templates/metrics-svc.yaml b/kubernetes/common/mariadb-galera/templates/metrics-svc.yaml index d37aeb1751..e628deea15 100644 --- a/kubernetes/common/mariadb-galera/templates/metrics-svc.yaml +++ b/kubernetes/common/mariadb-galera/templates/metrics-svc.yaml @@ -34,4 +34,4 @@ spec: targetPort: tcp-metrics selector: {{- include "common.matchLabels" . | nindent 4 }} {{- end }} -{{- end }}
\ No newline at end of file +{{- end }} diff --git a/kubernetes/common/mariadb-galera/templates/pdb.yaml b/kubernetes/common/mariadb-galera/templates/pdb.yaml index 734f03f237..da83abc993 100644 --- a/kubernetes/common/mariadb-galera/templates/pdb.yaml +++ b/kubernetes/common/mariadb-galera/templates/pdb.yaml @@ -29,4 +29,4 @@ spec: selector: matchLabels: {{- include "common.matchLabels" . | nindent 6 }} {{- end }} -{{- end }}
\ No newline at end of file +{{- end }} diff --git a/kubernetes/common/mariadb-galera/templates/prometheusrules.yaml b/kubernetes/common/mariadb-galera/templates/prometheusrules.yaml index cf0ab566a4..ee9124f23b 100644 --- a/kubernetes/common/mariadb-galera/templates/prometheusrules.yaml +++ b/kubernetes/common/mariadb-galera/templates/prometheusrules.yaml @@ -28,4 +28,3 @@ spec: rules: {{- toYaml .Values.metrics.prometheusRules.rules | nindent 6 }} {{- end }} - diff --git a/kubernetes/common/mariadb-galera/templates/pv.yaml b/kubernetes/common/mariadb-galera/templates/pv.yaml index 129b5b26c7..267755259d 100644 --- a/kubernetes/common/mariadb-galera/templates/pv.yaml +++ b/kubernetes/common/mariadb-galera/templates/pv.yaml @@ -17,4 +17,4 @@ {{- if not .Values.global.mariadbGalera.useOperator }} {{ include "common.replicaPV" . }} -{{- end }}
\ No newline at end of file +{{- end }} diff --git a/kubernetes/common/mariadb-galera/templates/secrets.yaml b/kubernetes/common/mariadb-galera/templates/secrets.yaml index 527f41266d..77a8e38e80 100644 --- a/kubernetes/common/mariadb-galera/templates/secrets.yaml +++ b/kubernetes/common/mariadb-galera/templates/secrets.yaml @@ -16,4 +16,4 @@ # limitations under the License. */}} -{{ include "common.secretFast" . }}
\ No newline at end of file +{{ include "common.secretFast" . }} diff --git a/kubernetes/common/mariadb-galera/templates/servicemonitor.yaml b/kubernetes/common/mariadb-galera/templates/servicemonitor.yaml index 4cbf7b394f..1bffb246f4 100644 --- a/kubernetes/common/mariadb-galera/templates/servicemonitor.yaml +++ b/kubernetes/common/mariadb-galera/templates/servicemonitor.yaml @@ -18,4 +18,4 @@ {{- if .Values.metrics.serviceMonitor.enabled }} {{ include "common.serviceMonitor" . }} {{- end }} -{{- end }}
\ No newline at end of file +{{- end }} diff --git a/kubernetes/common/mariadb-galera/templates/statefulset.yaml b/kubernetes/common/mariadb-galera/templates/statefulset.yaml index 70cc0c34bd..f9b4de4b88 100644 --- a/kubernetes/common/mariadb-galera/templates/statefulset.yaml +++ b/kubernetes/common/mariadb-galera/templates/statefulset.yaml @@ -266,4 +266,4 @@ spec: volumeClaimTemplates: - {{ include "common.PVCTemplate" (dict "dot" . "suffix" "data" "persistenceInfos" .Values.persistence) | indent 6 | trim }} {{- end }} -{{- end }}
\ No newline at end of file +{{- end }} diff --git a/kubernetes/common/mariadb-galera/values.yaml b/kubernetes/common/mariadb-galera/values.yaml index 3d9725cb43..47264f971c 100644 --- a/kubernetes/common/mariadb-galera/values.yaml +++ b/kubernetes/common/mariadb-galera/values.yaml @@ -63,9 +63,9 @@ mariadbOperator: galera: enabled: true agentImage: mariadb-operator/mariadb-operator - agentVersion: v0.0.27 + agentVersion: v0.0.28 initImage: mariadb-operator/mariadb-operator - initVersion: v0.0.27 + initVersion: v0.0.28 ## String to partially override common.names.fullname template (will maintain the release name) ## diff --git a/kubernetes/common/mariadb-init/.helmignore b/kubernetes/common/mariadb-init/.helmignore index dadf202953..f4d0b92f20 100644 --- a/kubernetes/common/mariadb-init/.helmignore +++ b/kubernetes/common/mariadb-init/.helmignore @@ -21,3 +21,14 @@ *.tmproj tests +# Project/CI/CD related items +.gitlab +.gitlab-ci.yml +.dockerignore +# Helm build files +.helmignore +.cache/ +.config/ +.local/ +# OOM specific dirs +components/ diff --git a/kubernetes/common/mariadb-init/Chart.yaml b/kubernetes/common/mariadb-init/Chart.yaml index fa89a669d2..6414785154 100644 --- a/kubernetes/common/mariadb-init/Chart.yaml +++ b/kubernetes/common/mariadb-init/Chart.yaml @@ -13,11 +13,11 @@ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. - +--- apiVersion: v2 description: Chart for MariaDB Galera init job name: mariadb-init -version: 13.0.0 +version: 13.0.1 dependencies: - name: common diff --git a/kubernetes/common/mariadb-init/templates/_configmap.tpl b/kubernetes/common/mariadb-init/templates/_configmap.tpl index ea612a078d..8d111b5170 100644 --- a/kubernetes/common/mariadb-init/templates/_configmap.tpl +++ b/kubernetes/common/mariadb-init/templates/_configmap.tpl @@ -1,4 +1,4 @@ -{{/* +{{- /* # Copyright © 2019 Orange # # Licensed under the Apache License, Version 2.0 (the "License"); @@ -12,7 +12,7 @@ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. -*/}} +*/ -}} {{/* Choose the name of the configmap to use. diff --git a/kubernetes/common/mariadb-init/templates/_mariadb.tpl b/kubernetes/common/mariadb-init/templates/_mariadb.tpl index 5563fe714d..fda93b52ef 100644 --- a/kubernetes/common/mariadb-init/templates/_mariadb.tpl +++ b/kubernetes/common/mariadb-init/templates/_mariadb.tpl @@ -1,4 +1,4 @@ -{{/* +{{- /* # Copyright © 2019 Orange # Copyright © 2020 Samsung Electronics # @@ -13,7 +13,7 @@ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. -*/}} +*/ -}} {{/* Choose the name of the mariadb secret to use. diff --git a/kubernetes/common/mariadb-init/templates/configmap.yaml b/kubernetes/common/mariadb-init/templates/configmap.yaml index 6708efdb60..6df329e8a5 100644 --- a/kubernetes/common/mariadb-init/templates/configmap.yaml +++ b/kubernetes/common/mariadb-init/templates/configmap.yaml @@ -1,4 +1,3 @@ -{{/* # Copyright © 2019 Orange # Modifications Copyright © 2018 AT&T # @@ -13,8 +12,7 @@ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. -*/}} - +--- apiVersion: v1 kind: ConfigMap metadata: diff --git a/kubernetes/common/mariadb-init/templates/job.yaml b/kubernetes/common/mariadb-init/templates/job.yaml index 4bb142d001..d620bd2edc 100644 --- a/kubernetes/common/mariadb-init/templates/job.yaml +++ b/kubernetes/common/mariadb-init/templates/job.yaml @@ -1,4 +1,3 @@ -{{/* # Copyright © 2019 Orange # Copyright © 2020 Samsung Electronics # @@ -13,8 +12,7 @@ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. -*/}} - +--- {{ include "mariadbInit._updateSecrets" . -}} apiVersion: batch/v1 @@ -42,11 +40,13 @@ spec: release: {{ include "common.release" . }} name: {{ include "common.name" . }} spec: + {{ include "common.podSecurityContext" . | indent 6 | trim }} initContainers: {{ include "common.readinessCheck.waitFor" . | nindent 6 }} containers: - name: {{ include "common.name" . }} image: {{ include "repositoryGenerator.image.mariadb" . }} imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} + {{ include "common.containerSecurityContext" . | indent 8 | trim }} command: - /bin/sh - -c diff --git a/kubernetes/common/mariadb-init/templates/secret.yaml b/kubernetes/common/mariadb-init/templates/secret.yaml index a9d9e0b704..b2876bcb82 100644 --- a/kubernetes/common/mariadb-init/templates/secret.yaml +++ b/kubernetes/common/mariadb-init/templates/secret.yaml @@ -1,4 +1,3 @@ -{{/* # Copyright © 2017 Amdocs, Bell Canada, Orange # Copyright © 2020 Samsung Electronics # @@ -13,8 +12,7 @@ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. -*/}} - +--- {{ include "mariadbInit._updateSecrets" . -}} {{ include "common.secretFast" . }} diff --git a/kubernetes/common/mariadb-init/tests/job_test.yaml b/kubernetes/common/mariadb-init/tests/job_test.yaml index cff8f947f8..33cd1c2dc3 100644 --- a/kubernetes/common/mariadb-init/tests/job_test.yaml +++ b/kubernetes/common/mariadb-init/tests/job_test.yaml @@ -98,11 +98,11 @@ tests: - it: "should render with default value (volumes)" asserts: - contains: - path: spec.template.spec.volumes - content: - name: mariadb-conf - configMap: - name: RELEASE-NAME-mariadb-init + path: spec.template.spec.volumes + content: + name: mariadb-conf + configMap: + name: RELEASE-NAME-mariadb-init - it: "should render with nameOverride set" set: @@ -136,11 +136,11 @@ tests: name: RELEASE-NAME-myJob-secret key: db-user-password - contains: - path: spec.template.spec.volumes - content: - name: mariadb-conf - configMap: - name: RELEASE-NAME-myJob + path: spec.template.spec.volumes + content: + name: mariadb-conf + configMap: + name: RELEASE-NAME-myJob - it: "should render with configmap set" set: @@ -158,8 +158,8 @@ tests: set: global: mariadbGalera: - nameOverride: myMaria - servicePort: 545 + nameOverride: myMaria + servicePort: 545 asserts: - contains: path: spec.template.spec.initContainers[0].args @@ -187,10 +187,10 @@ tests: set: global: mariadbGalera: - nameOverride: myMaria - servicePort: 545 - userRootSecret: galera-secret - userRootSecretKey: root-password + nameOverride: myMaria + servicePort: 545 + userRootSecret: galera-secret + userRootSecretKey: root-password asserts: - contains: path: spec.template.spec.initContainers[0].args @@ -230,11 +230,11 @@ tests: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - - key: kubernetes.io/e2e-az-name - operator: In - values: - - e2e-az1 - - e2e-az2 + - key: kubernetes.io/e2e-az-name + operator: In + values: + - e2e-az1 + - e2e-az2 asserts: - equal: path: spec.template.spec.affinity @@ -243,11 +243,11 @@ tests: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - - key: kubernetes.io/e2e-az-name - operator: In - values: - - e2e-az1 - - e2e-az2 + - key: kubernetes.io/e2e-az-name + operator: In + values: + - e2e-az1 + - e2e-az2 - it: "should use large flavor" set: flavor: large diff --git a/kubernetes/common/mariadb-init/values.yaml b/kubernetes/common/mariadb-init/values.yaml index 57dfb400c4..591477c5cf 100644 --- a/kubernetes/common/mariadb-init/values.yaml +++ b/kubernetes/common/mariadb-init/values.yaml @@ -11,7 +11,7 @@ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. - +--- ################################################################# # Global configuration defaults. ################################################################# @@ -106,21 +106,25 @@ config: # externalSecret: some-secret-name config_map: default +securityContext: + user_id: 100 + group_id: 65533 + nodeSelector: {} affinity: {} -#resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # - # Example: - # Configure resource requests and limits - # ref: http://kubernetes.io/docs/user-guide/compute-resources/ - # Minimum memory for development is 2 CPU cores and 4GB memory - # Minimum memory for production is 4 CPU cores and 8GB memory +# resources: {} +# We usually recommend not to specify default resources and to leave this as a conscious +# choice for the user. This also increases chances charts run on environments with little +# resources, such as Minikube. If you do want to specify resources, uncomment the following +# lines, adjust them as necessary, and remove the curly braces after 'resources:'. +# +# Example: +# Configure resource requests and limits +# ref: http://kubernetes.io/docs/user-guide/compute-resources/ +# Minimum memory for development is 2 CPU cores and 4GB memory +# Minimum memory for production is 4 CPU cores and 8GB memory flavor: small resources: small: @@ -139,7 +143,7 @@ resources: memory: "20Mi" unlimited: {} -#Pods Service Account +# Pods Service Account serviceAccount: nameOverride: mariadb-init roles: @@ -152,4 +156,4 @@ wait_for_job_container: readinessCheck: wait_for: services: - - '{{ include "common.mariadbService" . }}' + - '{{ include "common.mariadbService" . }}' diff --git a/kubernetes/common/mongodb/Chart.yaml b/kubernetes/common/mongodb/Chart.yaml index 2d6bf4bb4f..fc39ce3dee 100644 --- a/kubernetes/common/mongodb/Chart.yaml +++ b/kubernetes/common/mongodb/Chart.yaml @@ -40,4 +40,4 @@ maintainers: name: mongodb sources: - https://github.com/bitnami/charts/tree/main/bitnami/mongodb -version: 14.12.3 +version: 14.12.4 diff --git a/kubernetes/common/mongodb/README.md b/kubernetes/common/mongodb/README.md index 065e047fdc..a4d1803a9f 100644 --- a/kubernetes/common/mongodb/README.md +++ b/kubernetes/common/mongodb/README.md @@ -1117,4 +1117,4 @@ Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and -limitations under the License.
\ No newline at end of file +limitations under the License. diff --git a/kubernetes/common/mongodb/common/templates/_images.tpl b/kubernetes/common/mongodb/common/templates/_images.tpl index 1bcb779df5..e6acf9e3c6 100644 --- a/kubernetes/common/mongodb/common/templates/_images.tpl +++ b/kubernetes/common/mongodb/common/templates/_images.tpl @@ -114,4 +114,3 @@ Return the proper image version (ingores image revision/prerelease info & fallba {{- print .chart.AppVersion -}} {{- end -}} {{- end -}} - diff --git a/kubernetes/common/mongodb/templates/arbiter/statefulset.yaml b/kubernetes/common/mongodb/templates/arbiter/statefulset.yaml index 041b0cb51d..ee033e9437 100644 --- a/kubernetes/common/mongodb/templates/arbiter/statefulset.yaml +++ b/kubernetes/common/mongodb/templates/arbiter/statefulset.yaml @@ -274,7 +274,8 @@ spec: {{- end }} volumes: - name: empty-dir - emptyDir: {} + emptyDir: + sizeLimit: {{ .Values.arbiter.emptyDir.sizeLimit }} {{- if or .Values.arbiter.configuration .Values.arbiter.existingConfigmap .Values.arbiter.extraVolumes .Values.tls.enabled }} - name: common-scripts configMap: @@ -287,7 +288,8 @@ spec: {{- end }} {{- if and .Values.tls.enabled .Values.arbiter.enabled }} - name: certs - emptyDir: {} + emptyDir: + sizeLimit: 64Mi {{- if (include "mongodb.autoGenerateCerts" .) }} - name: certs-volume secret: diff --git a/kubernetes/common/mongodb/templates/backup/cronjob.yaml b/kubernetes/common/mongodb/templates/backup/cronjob.yaml index 2e884b14b9..44c297accd 100644 --- a/kubernetes/common/mongodb/templates/backup/cronjob.yaml +++ b/kubernetes/common/mongodb/templates/backup/cronjob.yaml @@ -167,7 +167,7 @@ spec: volumes: - name: empty-dir emptyDir: - sizeLimit: 64Mi + sizeLimit: {{ .Values.arbiter.emptyDir.sizeLimit }} - name: common-scripts configMap: name: {{ printf "%s-common-scripts" (include "mongodb.fullname" .) }} diff --git a/kubernetes/common/mongodb/templates/hidden/statefulset.yaml b/kubernetes/common/mongodb/templates/hidden/statefulset.yaml index 08a55ebd06..a64002a30a 100644 --- a/kubernetes/common/mongodb/templates/hidden/statefulset.yaml +++ b/kubernetes/common/mongodb/templates/hidden/statefulset.yaml @@ -515,7 +515,7 @@ spec: volumes: - name: empty-dir emptyDir: - sizeLimit: 64Mi + sizeLimit: {{ .Values.arbiter.emptyDir.sizeLimit }} - name: common-scripts configMap: name: {{ printf "%s-common-scripts" (include "mongodb.fullname" .) }} diff --git a/kubernetes/common/mongodb/templates/networkpolicy.yaml b/kubernetes/common/mongodb/templates/networkpolicy.yaml index f6d62ca867..63c4d715d4 100644 --- a/kubernetes/common/mongodb/templates/networkpolicy.yaml +++ b/kubernetes/common/mongodb/templates/networkpolicy.yaml @@ -80,4 +80,4 @@ spec: {{- if $extraIngress }} {{- include "common.tplvalues.render" ( dict "value" $extraIngress "context" $ ) | nindent 4 }} {{- end }} -{{- end }}
\ No newline at end of file +{{- end }} diff --git a/kubernetes/common/mongodb/templates/replicaset/statefulset.yaml b/kubernetes/common/mongodb/templates/replicaset/statefulset.yaml index b171eca005..089119c970 100644 --- a/kubernetes/common/mongodb/templates/replicaset/statefulset.yaml +++ b/kubernetes/common/mongodb/templates/replicaset/statefulset.yaml @@ -513,7 +513,7 @@ spec: volumes: - name: empty-dir emptyDir: - sizeLimit: 64Mi + sizeLimit: {{ .Values.arbiter.emptyDir.sizeLimit }} - name: common-scripts configMap: name: {{ printf "%s-common-scripts" (include "mongodb.fullname" .) }} diff --git a/kubernetes/common/mongodb/templates/standalone/dep-sts.yaml b/kubernetes/common/mongodb/templates/standalone/dep-sts.yaml index 6f63f0be5b..619533d8d0 100644 --- a/kubernetes/common/mongodb/templates/standalone/dep-sts.yaml +++ b/kubernetes/common/mongodb/templates/standalone/dep-sts.yaml @@ -438,7 +438,7 @@ spec: volumes: - name: empty-dir emptyDir: - sizeLimit: 64Mi + sizeLimit: {{ .Values.arbiter.emptyDir.sizeLimit }} - name: common-scripts configMap: name: {{ printf "%s-common-scripts" (include "mongodb.fullname" .) }} diff --git a/kubernetes/common/mongodb/values.yaml b/kubernetes/common/mongodb/values.yaml index 9612859392..7628846a3e 100644 --- a/kubernetes/common/mongodb/values.yaml +++ b/kubernetes/common/mongodb/values.yaml @@ -307,6 +307,14 @@ hostAliases: [] ## @param replicaSetName Name of the replica set (only when `architecture=replicaset`) ## Ignored when mongodb.architecture=standalone ## +replicaSet: + emptyDir: + sizeLimit: 1Gi + +standalone: + emptyDir: + sizeLimit: 1Gi + replicaSetName: rs0 ## @param replicaSetHostnames Enable DNS hostnames in the replicaset config (only when `architecture=replicaset`) ## Ignored when mongodb.architecture=standalone @@ -1166,6 +1174,8 @@ backup: ## @param backup.enabled Enable the logical dump of the database "regularly" ## enabled: false + emptyDir: + sizeLimit: 1Gi ## Fine tuning cronjob's config ## cronjob: @@ -1438,6 +1448,8 @@ volumePermissions: ## @section Arbiter parameters ## arbiter: + emptyDir: + sizeLimit: 1Gi ## @param arbiter.enabled Enable deploying the arbiter ## https://docs.mongodb.com/manual/tutorial/add-replica-set-arbiter/ ## @@ -1616,8 +1628,8 @@ arbiter: allowPrivilegeEscalation: false capabilities: drop: - - ALL - - CAP_NET_RAW + - ALL + - CAP_NET_RAW seccompProfile: type: "RuntimeDefault" ## MongoDB(®) Arbiter containers' resource requests and limits. @@ -1783,6 +1795,8 @@ hidden: ## https://docs.mongodb.com/manual/tutorial/configure-a-hidden-replica-set-member/ ## enabled: false + emptyDir: + sizeLimit: 1Gi ## @param hidden.automountServiceAccountToken Mount Service Account token in pod ## automountServiceAccountToken: false @@ -1960,9 +1974,7 @@ hidden: readOnlyRootFilesystem: true allowPrivilegeEscalation: false capabilities: - drop: - - ALL - - CAP_NET_RAW + drop: ["ALL"] seccompProfile: type: "RuntimeDefault" ## MongoDB(®) Hidden containers' resource requests and limits. @@ -1971,7 +1983,7 @@ hidden: ## choice for the user. This also increases chances charts run on environments with little ## resources, such as Minikube. If you do want to specify resources, uncomment the following ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. - ## @param hidden.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if hidden.resources is set (hidden.resources is recommended for production). + ## @param hidden.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if hidden.resources is set (hidden.resources is recommended for production). ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 ## resourcesPreset: "none" diff --git a/kubernetes/common/postgres-init/.helmignore b/kubernetes/common/postgres-init/.helmignore index f0c1319444..0bab41b6b1 100644 --- a/kubernetes/common/postgres-init/.helmignore +++ b/kubernetes/common/postgres-init/.helmignore @@ -19,3 +19,14 @@ .project .idea/ *.tmproj +# Project/CI/CD related items +.gitlab +.gitlab-ci.yml +.dockerignore +# Helm build files +.helmignore +.cache/ +.config/ +.local/ +# OOM specific dirs +components/ diff --git a/kubernetes/common/postgres-init/Chart.yaml b/kubernetes/common/postgres-init/Chart.yaml index 81f566f9e1..be9ecc2f5f 100644 --- a/kubernetes/common/postgres-init/Chart.yaml +++ b/kubernetes/common/postgres-init/Chart.yaml @@ -31,4 +31,4 @@ dependencies: repository: '@local' - name: serviceAccount version: ~13.x-0 - repository: '@local'
\ No newline at end of file + repository: '@local' diff --git a/kubernetes/common/postgres-init/values.yaml b/kubernetes/common/postgres-init/values.yaml index 160e6720ed..cede7e0976 100644 --- a/kubernetes/common/postgres-init/values.yaml +++ b/kubernetes/common/postgres-init/values.yaml @@ -104,4 +104,4 @@ readinessCheck: wait_for_job_container: containers: - - '{{ include "common.name" . }}-update-config'
\ No newline at end of file + - '{{ include "common.name" . }}-update-config' diff --git a/kubernetes/common/postgres/.helmignore b/kubernetes/common/postgres/.helmignore index f0c1319444..0bab41b6b1 100644 --- a/kubernetes/common/postgres/.helmignore +++ b/kubernetes/common/postgres/.helmignore @@ -19,3 +19,14 @@ .project .idea/ *.tmproj +# Project/CI/CD related items +.gitlab +.gitlab-ci.yml +.dockerignore +# Helm build files +.helmignore +.cache/ +.config/ +.local/ +# OOM specific dirs +components/ diff --git a/kubernetes/common/postgres/Chart.yaml b/kubernetes/common/postgres/Chart.yaml index 3920d8e73d..d1fb768cc5 100644 --- a/kubernetes/common/postgres/Chart.yaml +++ b/kubernetes/common/postgres/Chart.yaml @@ -25,4 +25,4 @@ dependencies: repository: 'file://../common' - name: repositoryGenerator version: ~13.x-0 - repository: 'file://../repositoryGenerator'
\ No newline at end of file + repository: 'file://../repositoryGenerator' diff --git a/kubernetes/common/postgres/configs/pg_hba.conf b/kubernetes/common/postgres/configs/pg_hba.conf index 580185c6f0..d8918409e8 100644 --- a/kubernetes/common/postgres/configs/pg_hba.conf +++ b/kubernetes/common/postgres/configs/pg_hba.conf @@ -65,4 +65,3 @@ #local all all trust # IPv4 local connections: host all all 0.0.0.0/0 md5 - diff --git a/kubernetes/common/postgres/templates/deployment-primary.yaml b/kubernetes/common/postgres/templates/deployment-primary.yaml index 535eefa8cf..7947559211 100644 --- a/kubernetes/common/postgres/templates/deployment-primary.yaml +++ b/kubernetes/common/postgres/templates/deployment-primary.yaml @@ -15,4 +15,4 @@ */}} {{- if not .Values.global.postgres.useOperator }} {{ include "common.postgres.deployment" (dict "dot" . "pgMode" "primary") }} -{{- end }}
\ No newline at end of file +{{- end }} diff --git a/kubernetes/common/postgres/templates/deployment-replica.yaml b/kubernetes/common/postgres/templates/deployment-replica.yaml index 97c7e11053..246e1e9a07 100644 --- a/kubernetes/common/postgres/templates/deployment-replica.yaml +++ b/kubernetes/common/postgres/templates/deployment-replica.yaml @@ -15,4 +15,4 @@ */}} {{- if not .Values.global.postgres.useOperator }} {{ include "common.postgres.deployment" (dict "dot" . "pgMode" "replica") }} -{{- end }}
\ No newline at end of file +{{- end }} diff --git a/kubernetes/common/postgres/templates/metrics-svc-primary.yaml b/kubernetes/common/postgres/templates/metrics-svc-primary.yaml index 00a5182eb1..b8d7912210 100644 --- a/kubernetes/common/postgres/templates/metrics-svc-primary.yaml +++ b/kubernetes/common/postgres/templates/metrics-svc-primary.yaml @@ -35,4 +35,4 @@ spec: name: {{ .Values.container.name.primary }} release: {{ include "common.release" . }} {{- end }} -{{- end }}
\ No newline at end of file +{{- end }} diff --git a/kubernetes/common/postgres/templates/metrics-svc-replica.yaml b/kubernetes/common/postgres/templates/metrics-svc-replica.yaml index b8b9e793e8..6d9990a7bc 100644 --- a/kubernetes/common/postgres/templates/metrics-svc-replica.yaml +++ b/kubernetes/common/postgres/templates/metrics-svc-replica.yaml @@ -35,4 +35,4 @@ spec: name: {{ .Values.container.name.replica }} release: {{ include "common.release" . }} {{- end }} -{{- end }}
\ No newline at end of file +{{- end }} diff --git a/kubernetes/common/postgres/templates/postgres.yaml b/kubernetes/common/postgres/templates/postgres.yaml index aca6aa260f..0dad7f5886 100644 --- a/kubernetes/common/postgres/templates/postgres.yaml +++ b/kubernetes/common/postgres/templates/postgres.yaml @@ -16,4 +16,4 @@ {{- if .Values.global.postgres.useOperator }} {{ include "common.postgresOpInstance" . }} -{{- end }}
\ No newline at end of file +{{- end }} diff --git a/kubernetes/common/postgres/templates/pv-primary.yaml b/kubernetes/common/postgres/templates/pv-primary.yaml index 8db79d665e..9e73ceb8e3 100644 --- a/kubernetes/common/postgres/templates/pv-primary.yaml +++ b/kubernetes/common/postgres/templates/pv-primary.yaml @@ -38,4 +38,4 @@ spec: path: {{ .Values.global.persistence.mountPath | default .Values.persistence.mountPath }}/{{ include "common.release" . }}/{{ .Values.persistence.mountSubPath }}/primary {{- end -}} {{- end -}} -{{- end }}
\ No newline at end of file +{{- end }} diff --git a/kubernetes/common/postgres/templates/pvc-replica.yaml b/kubernetes/common/postgres/templates/pvc-replica.yaml index f59adf736a..e71284fcec 100644 --- a/kubernetes/common/postgres/templates/pvc-replica.yaml +++ b/kubernetes/common/postgres/templates/pvc-replica.yaml @@ -43,4 +43,4 @@ spec: storageClassName: {{ include "common.storageClass" . }} {{- end }} {{- end }} -{{- end }}
\ No newline at end of file +{{- end }} diff --git a/kubernetes/common/postgres/templates/service-replica.yaml b/kubernetes/common/postgres/templates/service-replica.yaml index 68694561bd..878a02ef66 100644 --- a/kubernetes/common/postgres/templates/service-replica.yaml +++ b/kubernetes/common/postgres/templates/service-replica.yaml @@ -40,4 +40,4 @@ spec: selector: name: "{{.Values.container.name.replica}}" release: {{ include "common.release" . }} -{{- end }}
\ No newline at end of file +{{- end }} diff --git a/kubernetes/common/postgres/templates/servicemonitor.yaml b/kubernetes/common/postgres/templates/servicemonitor.yaml index 522e515545..3fb716b133 100644 --- a/kubernetes/common/postgres/templates/servicemonitor.yaml +++ b/kubernetes/common/postgres/templates/servicemonitor.yaml @@ -17,4 +17,4 @@ {{- if .Values.metrics.serviceMonitor.enabled }} {{ include "common.serviceMonitor" . }} {{- end }} -{{- end }}
\ No newline at end of file +{{- end }} diff --git a/kubernetes/common/readinessCheck/.helmignore b/kubernetes/common/readinessCheck/.helmignore new file mode 100644 index 0000000000..0bab41b6b1 --- /dev/null +++ b/kubernetes/common/readinessCheck/.helmignore @@ -0,0 +1,32 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +# Project/CI/CD related items +.gitlab +.gitlab-ci.yml +.dockerignore +# Helm build files +.helmignore +.cache/ +.config/ +.local/ +# OOM specific dirs +components/ diff --git a/kubernetes/common/readinessCheck/Chart.yaml b/kubernetes/common/readinessCheck/Chart.yaml index bb2986a9fb..bd8adbfcea 100644 --- a/kubernetes/common/readinessCheck/Chart.yaml +++ b/kubernetes/common/readinessCheck/Chart.yaml @@ -17,7 +17,7 @@ apiVersion: v2 description: Template used to wait for other deployment/sts/jobs in onap name: readinessCheck -version: 13.1.0 +version: 13.1.1 dependencies: - name: common @@ -25,4 +25,4 @@ dependencies: repository: 'file://../common' - name: repositoryGenerator version: ~13.x-0 - repository: 'file://../repositoryGenerator'
\ No newline at end of file + repository: 'file://../repositoryGenerator' diff --git a/kubernetes/common/readinessCheck/templates/_readinessCheck.tpl b/kubernetes/common/readinessCheck/templates/_readinessCheck.tpl index 51791fec13..42f526148a 100644 --- a/kubernetes/common/readinessCheck/templates/_readinessCheck.tpl +++ b/kubernetes/common/readinessCheck/templates/_readinessCheck.tpl @@ -95,6 +95,13 @@ securityContext: runAsUser: {{ $subchartDot.Values.user }} runAsGroup: {{ $subchartDot.Values.group }} + readOnlyRootFilesystem: true + privileged: false + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - CAP_NET_RAW command: - /app/ready.py args: diff --git a/kubernetes/common/repositoryGenerator/.helmignore b/kubernetes/common/repositoryGenerator/.helmignore new file mode 100644 index 0000000000..0bab41b6b1 --- /dev/null +++ b/kubernetes/common/repositoryGenerator/.helmignore @@ -0,0 +1,32 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +# Project/CI/CD related items +.gitlab +.gitlab-ci.yml +.dockerignore +# Helm build files +.helmignore +.cache/ +.config/ +.local/ +# OOM specific dirs +components/ diff --git a/kubernetes/common/serviceAccount/.helmignore b/kubernetes/common/serviceAccount/.helmignore new file mode 100644 index 0000000000..0bab41b6b1 --- /dev/null +++ b/kubernetes/common/serviceAccount/.helmignore @@ -0,0 +1,32 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +# Project/CI/CD related items +.gitlab +.gitlab-ci.yml +.dockerignore +# Helm build files +.helmignore +.cache/ +.config/ +.local/ +# OOM specific dirs +components/ diff --git a/kubernetes/common/serviceAccount/Chart.yaml b/kubernetes/common/serviceAccount/Chart.yaml index 7afd31f4d9..4e3eab3712 100644 --- a/kubernetes/common/serviceAccount/Chart.yaml +++ b/kubernetes/common/serviceAccount/Chart.yaml @@ -23,4 +23,4 @@ version: 13.0.1 dependencies: - name: common version: ~13.x-0 - repository: 'file://../common'
\ No newline at end of file + repository: 'file://../common' diff --git a/kubernetes/common/serviceAccount/templates/role.yaml b/kubernetes/common/serviceAccount/templates/role.yaml index 83cb945ba9..d6d041f916 100644 --- a/kubernetes/common/serviceAccount/templates/role.yaml +++ b/kubernetes/common/serviceAccount/templates/role.yaml @@ -128,6 +128,7 @@ rules: - pods/exec verbs: - create + - get - apiGroups: - cert-manager.io resources: diff --git a/kubernetes/common/serviceAccount/templates/service-account.yaml b/kubernetes/common/serviceAccount/templates/service-account.yaml index 20bd94f49a..683d5d2984 100644 --- a/kubernetes/common/serviceAccount/templates/service-account.yaml +++ b/kubernetes/common/serviceAccount/templates/service-account.yaml @@ -21,4 +21,4 @@ apiVersion: v1 kind: ServiceAccount metadata: name: {{ include "common.fullname" (dict "suffix" $role_type "dot" $dot ) }} -{{- end }}
\ No newline at end of file +{{- end }} diff --git a/kubernetes/common/timescaledb/.helmignore b/kubernetes/common/timescaledb/.helmignore index 50af031725..0bab41b6b1 100644 --- a/kubernetes/common/timescaledb/.helmignore +++ b/kubernetes/common/timescaledb/.helmignore @@ -19,4 +19,14 @@ .project .idea/ *.tmproj -.vscode/ +# Project/CI/CD related items +.gitlab +.gitlab-ci.yml +.dockerignore +# Helm build files +.helmignore +.cache/ +.config/ +.local/ +# OOM specific dirs +components/ diff --git a/kubernetes/common/timescaledb/Chart.yaml b/kubernetes/common/timescaledb/Chart.yaml index d8b9869817..dd92121eb8 100644 --- a/kubernetes/common/timescaledb/Chart.yaml +++ b/kubernetes/common/timescaledb/Chart.yaml @@ -33,4 +33,4 @@ dependencies: repository: '@local' - name: repositoryGenerator version: ~13.x-0 - repository: 'file://../repositoryGenerator'
\ No newline at end of file + repository: 'file://../repositoryGenerator' diff --git a/kubernetes/common/timescaledb/templates/statefulset.yaml b/kubernetes/common/timescaledb/templates/statefulset.yaml index 653326be5f..bee389f191 100644 --- a/kubernetes/common/timescaledb/templates/statefulset.yaml +++ b/kubernetes/common/timescaledb/templates/statefulset.yaml @@ -30,22 +30,6 @@ spec: spec: serviceAccountName: {{ include "common.fullname" (dict "suffix" "read" "dot" . ) }} {{ include "common.podSecurityContext" . | indent 10 | trim}} - initContainers: - # we shouldn't need this but for unknown reason, it's fsGroup is not - # applied - - name: fix-permission - command: - - /bin/sh - args: - - -c - - chown -R {{ .Values.securityContext.user_id }}:{{ .Values.securityContext.group_id }} /var/lib/postgresql/data - image: {{ include "repositoryGenerator.image.busybox" . }} - imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} - securityContext: - runAsUser: 0 - volumeMounts: - - mountPath: /var/lib/postgresql/data - name: {{ include "common.fullname" . }} containers: - name: {{ include "common.name" . }} image: {{ include "repositoryGenerator.dockerHubRepository" . }}/{{ .Values.image }} diff --git a/kubernetes/dcaegen2-services/components/dcae-tcagen2/Chart.yaml b/kubernetes/dcaegen2-services/components/dcae-tcagen2/Chart.yaml index 7b30414fa3..8596dcd2e1 100644 --- a/kubernetes/dcaegen2-services/components/dcae-tcagen2/Chart.yaml +++ b/kubernetes/dcaegen2-services/components/dcae-tcagen2/Chart.yaml @@ -41,5 +41,5 @@ dependencies: version: ~13.x-0 repository: '@local' - name: mongodb - version: 14.12.3 + version: ~14.12.x-0 repository: '@local'
\ No newline at end of file diff --git a/kubernetes/dmaap/components/dmaap-dr-node/templates/statefulset.yaml b/kubernetes/dmaap/components/dmaap-dr-node/templates/statefulset.yaml index 2795a2b5e5..4bb57063ad 100644 --- a/kubernetes/dmaap/components/dmaap-dr-node/templates/statefulset.yaml +++ b/kubernetes/dmaap/components/dmaap-dr-node/templates/statefulset.yaml @@ -23,7 +23,11 @@ spec: template: metadata: {{- include "common.templateMetadata" . | nindent 6 }} spec: - {{ include "common.podSecurityContext" . | indent 6 | trim}} + # temporarily use less restrictions + securityContext: + runAsUser: {{ .Values.securityContext.user_id }} + runAsGroup: {{ .Values.securityContext.group_id }} + fsGroup: {{ .Values.securityContext.group_id }} initContainers: {{ include "common.readinessCheck.waitFor" . | nindent 8 }} - name: {{ include "common.name" . }}-permission-fixer securityContext: diff --git a/kubernetes/multicloud/components/multicloud-k8s/Chart.yaml b/kubernetes/multicloud/components/multicloud-k8s/Chart.yaml index 8d50814fd0..5dc375290a 100644 --- a/kubernetes/multicloud/components/multicloud-k8s/Chart.yaml +++ b/kubernetes/multicloud/components/multicloud-k8s/Chart.yaml @@ -27,7 +27,7 @@ dependencies: # be published independently to a repo (at this point) repository: '@local' - name: mongodb - version: 14.12.3 + version: ~14.12.x-0 repository: '@local' - name: etcd version: ~13.x-0 diff --git a/kubernetes/nbi/Chart.yaml b/kubernetes/nbi/Chart.yaml index 6f403f7f74..3ffd2a1f81 100644 --- a/kubernetes/nbi/Chart.yaml +++ b/kubernetes/nbi/Chart.yaml @@ -27,7 +27,7 @@ dependencies: # be published independently to a repo (at this point) repository: '@local' - name: mongodb - version: 14.12.3 + version: ~14.12.x-0 repository: '@local' - name: mariadb-galera version: ~13.x-0 diff --git a/kubernetes/onap/Chart.yaml b/kubernetes/onap/Chart.yaml index b3a20b20ef..3e19cbd0d3 100644 --- a/kubernetes/onap/Chart.yaml +++ b/kubernetes/onap/Chart.yaml @@ -30,7 +30,7 @@ dependencies: repository: '@local' condition: authentication:enabled - name: aai - version: ~13.x-0 + version: ~14.x-0 repository: '@local' condition: aai.enabled - name: cassandra diff --git a/kubernetes/platform/components/chartmuseum/templates/deployment.yaml b/kubernetes/platform/components/chartmuseum/templates/deployment.yaml index 3956255fb2..fea1a1a614 100644 --- a/kubernetes/platform/components/chartmuseum/templates/deployment.yaml +++ b/kubernetes/platform/components/chartmuseum/templates/deployment.yaml @@ -27,21 +27,6 @@ spec: metadata: {{- include "common.templateMetadata" . | nindent 6 }} spec: {{ include "common.podSecurityContext" . | indent 7 | trim}} - initContainers: - - name: volume-permissions - image: {{ include "repositoryGenerator.image.busybox" . }} - imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} - command: - - sh - args: - - "-c" - - | - chown -R {{ .Values.securityContext.user_id }}:{{ .Values.securityContext.group_id }} //chartmuseum-persist - securityContext: - runAsUser: 0 - volumeMounts: - - name: chart-persistent - mountPath: "/chartmuseum-persist" containers: - name: {{ include "common.name" . }} image: {{ include "repositoryGenerator.githubContainerRegistry" . }}/{{ .Values.image }} diff --git a/kubernetes/portal-ng/components/portal-ng-history/Chart.yaml b/kubernetes/portal-ng/components/portal-ng-history/Chart.yaml index ab28bf2949..4b62b5def2 100644 --- a/kubernetes/portal-ng/components/portal-ng-history/Chart.yaml +++ b/kubernetes/portal-ng/components/portal-ng-history/Chart.yaml @@ -47,5 +47,5 @@ dependencies: version: ~13.x-0 repository: '@local' - name: mongodb - version: 14.12.3 + version: ~14.12.x-0 repository: '@local' diff --git a/kubernetes/portal-ng/components/portal-ng-preferences/Chart.yaml b/kubernetes/portal-ng/components/portal-ng-preferences/Chart.yaml index 8f8c494a68..96088586fc 100644 --- a/kubernetes/portal-ng/components/portal-ng-preferences/Chart.yaml +++ b/kubernetes/portal-ng/components/portal-ng-preferences/Chart.yaml @@ -47,7 +47,7 @@ dependencies: version: ~13.x-0 repository: '@local' - name: mongodb - version: 14.12.3 + version: ~14.12.x-0 repository: '@local' |