diff options
Diffstat (limited to 'kubernetes')
113 files changed, 1349 insertions, 401 deletions
diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/bin/init_sg.sh b/kubernetes/aai/charts/aai-elasticsearch/resources/bin/init_sg.sh new file mode 100644 index 0000000000..e85936570e --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/bin/init_sg.sh @@ -0,0 +1,11 @@ +#!/bin/sh + +/usr/share/elasticsearch/plugins/search-guard-6/tools/sgadmin.sh \ + -cd /usr/share/elasticsearch/config/sg \ + -ks /usr/share/elasticsearch/config/sg/auth/{{ .Values.config.adminKeyStore }} \ + -ts /usr/share/elasticsearch/config/sg/auth/{{ .Values.config.trustStore }} \ + -kspass {{ .Values.config.adminKeyStorePassword }} \ + -tspass {{ .Values.config.trustStorePassword}} \ + -nhnv \ + -icl \ + -p {{ .Values.service.internalPort2 }}
\ No newline at end of file diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/bin/run.sh b/kubernetes/aai/charts/aai-elasticsearch/resources/bin/run.sh new file mode 100644 index 0000000000..a612c74a1c --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/bin/run.sh @@ -0,0 +1,8 @@ +#!/bin/sh + +# Wait for ES to start then initialize SearchGuard +/usr/local/bin/docker-entrypoint.sh eswrapper & +/usr/share/elasticsearch/bin/wait_until_started.sh +/usr/share/elasticsearch/bin/init_sg.sh + +wait
\ No newline at end of file diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/bin/wait_until_started.sh b/kubernetes/aai/charts/aai-elasticsearch/resources/bin/wait_until_started.sh new file mode 100644 index 0000000000..279253b43d --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/bin/wait_until_started.sh @@ -0,0 +1,9 @@ +#!/bin/sh +RET=1 + +while [[ RET -ne 0 ]]; do + echo "Waiting for Elasticsearch to become ready before running sgadmin..." + curl -XGET -k "https://localhost:{{ .Values.service.internalPort }}/" >/dev/null 2>&1 + RET=$? + sleep 5 +done
\ No newline at end of file diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/elasticsearch.yml b/kubernetes/aai/charts/aai-elasticsearch/resources/config/elasticsearch.yml index 24b3c5aefc..87536e3faa 100644 --- a/kubernetes/aai/charts/aai-elasticsearch/resources/config/elasticsearch.yml +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/config/elasticsearch.yml @@ -192,7 +192,7 @@ network.bind_host: 0.0.0.0 # Set a custom port for the node to node communication (9300 by default): -transport.tcp.port: {{ .Values.config.tcpPort }} +transport.tcp.port: {{ .Values.service.internalPort2 }} # Enable compression for all communication between nodes (disabled by default): transport.tcp.compress: false @@ -368,77 +368,29 @@ discovery.zen.ping.unicast.hosts: ["0.0.0.0"] ### SEARCH GUARD SSL # ### Configuration # ############################################################################################### -## Uncomment all lines below prefixed with #X# (globally remove #X#) for searchguard -## -############################################################################################### -### Transport layer SSL # -### # -############################################################################################### -### Enable or disable node-to-node ssl encryption (default: true) -#X#searchguard.ssl.transport.enable_openssl_if_available: true -#X#searchguard.ssl.transport.enabled: true -### JKS or PKCS12 (default: JKS) -#X#searchguard.ssl.transport.keystore_type: JKS -### Relative path to the keystore file (mandatory, this stores the server certificates), must be placed under the config/ dir -#X#searchguard.ssl.transport.keystore_filepath: /some/path -### Alias name (default: first alias which could be found) -###searchguard.ssl.transport.keystore_alias: localhost -### Keystore password (default: changeit) -#X#searchguard.ssl.transport.keystore_password: changeit -## -### JKS or PKCS12 (default: JKS) -#X#searchguard.ssl.transport.truststore_type: JKS -### Relative path to the truststore file (mandatory, this stores the client/root certificates), must be placed under the config/ dir -#X#searchguard.ssl.transport.truststore_filepath: truststore.jks -### Alias name (default: first alias which could be found) -###searchguard.ssl.transport.truststore_alias: my_alias -### Truststore password (default: changeit) -#X#searchguard.ssl.transport.truststore_password: changeit -### Enforce hostname verification (default: true) -###searchguard.ssl.transport.enforce_hostname_verification: true -### If hostname verification specify if hostname should be resolved (default: true) -###searchguard.ssl.transport.resolve_hostname: true -### Use native Open SSL instead of JDK SSL if available (default: true) -###searchguard.ssl.transport.enable_openssl_if_available: false -## -############################################################################################### -### HTTP/REST layer SSL # -### # -############################################################################################### -### Enable or disable rest layer security - https, (default: false) -#X#searchguard.ssl.http.enable_openssl_if_available: true -#X#searchguard.ssl.http.enabled: true -### JKS or PKCS12 (default: JKS) -#X#searchguard.ssl.http.keystore_type: JKS -### Relative path to the keystore file (this stores the server certificates), must be placed under the config/ dir -#X#searchguard.ssl.http.keystore_filepath: /keystore/path -### Alias name (default: first alias which could be found) -###searchguard.ssl.http.keystore_alias: my_alias -### Keystore password (default: changeit) -#X#searchguard.ssl.http.keystore_password: changeit -### Do the clients (typically the browser or the proxy) have to authenticate themself to the http server, default is OPTIONAL -### To enforce authentication use REQUIRE, to completely disable client certificates use NONE -###searchguard.ssl.http.clientauth_mode: REQUIRE -### JKS or PKCS12 (default: JKS) -#X#searchguard.ssl.http.truststore_type: JKS -### Relative path to the truststore file (this stores the client certificates), must be placed under the config/ dir -#X#searchguard.ssl.http.truststore_filepath: truststore.jks -### Alias name (default: first alias which could be found) -###searchguard.ssl.http.truststore_alias: my_alias -### Truststore password (default: changeit) -#X#searchguard.ssl.http.truststore_password: changeit -### Use native Open SSL instead of JDK SSL if available (default: true) -###searchguard.ssl.http.enable_openssl_if_available: false - -##################################################### -##### Security manager - Searchguard Configuration -##################################################### -#X#security.manager.enabled: false -#X#searchguard.authcz.admin_dn: - -##################################################### -##### X-Pack Configuration -##################################################### +######## Start Search Guard Demo Configuration ######## + +searchguard.enterprise_modules_enabled: false + +searchguard.ssl.transport.keystore_filepath: sg/auth/{{ .Values.config.nodeKeyStore }} +searchguard.ssl.transport.keystore_password: {{ .Values.config.nodeKeyStorePassword }} +searchguard.ssl.transport.truststore_filepath: sg/auth/{{ .Values.config.trustStore }} +searchguard.ssl.transport.truststore_password: {{ .Values.config.trustStorePassword }} +searchguard.ssl.transport.enforce_hostname_verification: false + +searchguard.ssl.http.enabled: true +searchguard.ssl.http.keystore_filepath: sg/auth/{{ .Values.config.nodeKeyStore }} +searchguard.ssl.http.keystore_password: {{ .Values.config.nodeKeyStorePassword }} +searchguard.ssl.http.truststore_filepath: sg/auth/{{ .Values.config.trustStore }} +searchguard.ssl.http.truststore_password: {{ .Values.config.trustStorePassword }} + +searchguard.nodes_dn: + - CN=esaai + +searchguard.authcz.admin_dn: + - CN=sgadmin + +# x-pack security conflicts with searchguard xpack.security.enabled: false xpack.ml.enabled: false xpack.monitoring.enabled: false diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/esaai-keystore.jks b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/esaai-keystore.jks Binary files differnew file mode 100644 index 0000000000..21ec9bba97 --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/esaai-keystore.jks diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/sgadmin-keystore.p12 b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/sgadmin-keystore.p12 Binary files differnew file mode 100644 index 0000000000..db7cbf401c --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/sgadmin-keystore.p12 diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/truststore.jks b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/truststore.jks Binary files differnew file mode 100644 index 0000000000..b3bd666652 --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/truststore.jks diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_action_groups.yml b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_action_groups.yml new file mode 100644 index 0000000000..be5901a559 --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_action_groups.yml @@ -0,0 +1,137 @@ +UNLIMITED: + readonly: true + permissions: + - "*" + +###### INDEX LEVEL ###### + +INDICES_ALL: + readonly: true + permissions: + - "indices:*" + +# for backward compatibility +ALL: + readonly: true + permissions: + - INDICES_ALL + +MANAGE: + readonly: true + permissions: + - "indices:monitor/*" + - "indices:admin/*" + +CREATE_INDEX: + readonly: true + permissions: + - "indices:admin/create" + - "indices:admin/mapping/put" + +MANAGE_ALIASES: + readonly: true + permissions: + - "indices:admin/aliases*" + +# for backward compatibility +MONITOR: + readonly: true + permissions: + - INDICES_MONITOR + +INDICES_MONITOR: + readonly: true + permissions: + - "indices:monitor/*" + +DATA_ACCESS: + readonly: true + permissions: + - "indices:data/*" + - CRUD + +WRITE: + readonly: true + permissions: + - "indices:data/write*" + - "indices:admin/mapping/put" + +READ: + readonly: true + permissions: + - "indices:data/read*" + - "indices:admin/mappings/fields/get*" + +DELETE: + readonly: true + permissions: + - "indices:data/write/delete*" + +CRUD: + readonly: true + permissions: + - READ + - WRITE + +SEARCH: + readonly: true + permissions: + - "indices:data/read/search*" + - "indices:data/read/msearch*" + - SUGGEST + +SUGGEST: + readonly: true + permissions: + - "indices:data/read/suggest*" + +INDEX: + readonly: true + permissions: + - "indices:data/write/index*" + - "indices:data/write/update*" + - "indices:admin/mapping/put" + - "indices:data/write/bulk*" + +GET: + readonly: true + permissions: + - "indices:data/read/get*" + - "indices:data/read/mget*" + +###### CLUSTER LEVEL ###### + +CLUSTER_ALL: + readonly: true + permissions: + - "cluster:*" + +CLUSTER_MONITOR: + readonly: true + permissions: + - "cluster:monitor/*" + +CLUSTER_COMPOSITE_OPS_RO: + readonly: true + permissions: + - "indices:data/read/mget" + - "indices:data/read/msearch" + - "indices:data/read/mtv" + - "indices:data/read/coordinate-msearch*" + - "indices:admin/aliases/exists*" + - "indices:admin/aliases/get*" + - "indices:data/read/scroll" + +CLUSTER_COMPOSITE_OPS: + readonly: true + permissions: + - "indices:data/write/bulk" + - "indices:admin/aliases*" + - "indices:data/write/reindex" + - CLUSTER_COMPOSITE_OPS_RO + +MANAGE_SNAPSHOTS: + readonly: true + permissions: + - "cluster:admin/snapshot/*" + - "cluster:admin/repository/*"
\ No newline at end of file diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_config.yml b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_config.yml new file mode 100644 index 0000000000..3fefe1690d --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_config.yml @@ -0,0 +1,221 @@ +# This is the main Search Guard configuration file where authentication +# and authorization is defined. +# +# You need to configure at least one authentication domain in the authc of this file. +# An authentication domain is responsible for extracting the user credentials from +# the request and for validating them against an authentication backend like Active Directory for example. +# +# If more than one authentication domain is configured the first one which succeeds wins. +# If all authentication domains fail then the request is unauthenticated. +# In this case an exception is thrown and/or the HTTP status is set to 401. +# +# After authentication authorization (authz) will be applied. There can be zero or more authorizers which collect +# the roles from a given backend for the authenticated user. +# +# Both, authc and auth can be enabled/disabled separately for REST and TRANSPORT layer. Default is true for both. +# http_enabled: true +# transport_enabled: true +# +# 5.x Migration: "enabled: true/false" will also be respected currently but only to provide backward compatibility. +# +# For HTTP it is possible to allow anonymous authentication. If that is the case then the HTTP authenticators try to +# find user credentials in the HTTP request. If credentials are found then the user gets regularly authenticated. +# If none can be found the user will be authenticated as an "anonymous" user. This user has always the username "sg_anonymous" +# and one role named "sg_anonymous_backendrole". +# If you enable anonymous authentication all HTTP authenticators will not challenge. +# +# +# Note: If you define more than one HTTP authenticators make sure to put non-challenging authenticators like "proxy" or "clientcert" +# first and the challenging one last. +# Because it's not possible to challenge a client with two different authentication methods (for example +# Kerberos and Basic) only one can have the challenge flag set to true. You can cope with this situation +# by using pre-authentication, e.g. sending a HTTP Basic authentication header in the request. +# +# Default value of the challenge flag is true. +# +# +# HTTP +# basic (challenging) +# proxy (not challenging, needs xff) +# kerberos (challenging) NOT FREE FOR COMMERCIAL +# clientcert (not challenging, needs https) +# jwt (not challenging) NOT FREE FOR COMMERCIAL +# host (not challenging) #DEPRECATED, will be removed in a future version. +# host based authentication is configurable in sg_roles_mapping + +# Authc +# internal +# noop +# ldap NOT FREE FOR COMMERCIAL USE + +# Authz +# ldap NOT FREE FOR COMMERCIAL USE +# noop + +searchguard: + dynamic: + # Set filtered_alias_mode to 'disallow' to forbid more than 2 filtered aliases per index + # Set filtered_alias_mode to 'warn' to allow more than 2 filtered aliases per index but warns about it (default) + # Set filtered_alias_mode to 'nowarn' to allow more than 2 filtered aliases per index silently + #filtered_alias_mode: warn + #kibana: + # Kibana multitenancy - NOT FREE FOR COMMERCIAL USE + # see https://github.com/floragunncom/search-guard-docs/blob/master/multitenancy.md + # To make this work you need to install https://github.com/floragunncom/search-guard-module-kibana-multitenancy/wiki + #multitenancy_enabled: true + #server_username: kibanaserver + #index: '.kibana' + #do_not_fail_on_forbidden: false + http: + anonymous_auth_enabled: false + xff: + enabled: false + internalProxies: '192\.168\.0\.10|192\.168\.0\.11' # regex pattern + #internalProxies: '.*' # trust all internal proxies, regex pattern + remoteIpHeader: 'x-forwarded-for' + proxiesHeader: 'x-forwarded-by' + #trustedProxies: '.*' # trust all external proxies, regex pattern + ###### see https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html for regex help + ###### more information about XFF https://en.wikipedia.org/wiki/X-Forwarded-For + ###### and here https://tools.ietf.org/html/rfc7239 + ###### and https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Remote_IP_Valve + authc: + kerberos_auth_domain: + http_enabled: false + transport_enabled: false + order: 6 + http_authenticator: + type: kerberos # NOT FREE FOR COMMERCIAL USE + challenge: true + config: + # If true a lot of kerberos/security related debugging output will be logged to standard out + krb_debug: false + # If true then the realm will be stripped from the user name + strip_realm_from_principal: true + authentication_backend: + type: noop + basic_internal_auth_domain: + http_enabled: true + transport_enabled: true + order: 2 + http_authenticator: + type: basic + challenge: true + authentication_backend: + type: intern + proxy_auth_domain: + http_enabled: false + transport_enabled: false + order: 3 + http_authenticator: + type: proxy + challenge: false + config: + user_header: "x-proxy-user" + roles_header: "x-proxy-roles" + authentication_backend: + type: noop + jwt_auth_domain: + http_enabled: false + transport_enabled: false + order: 0 + http_authenticator: + type: jwt + challenge: false + config: + signing_key: "base64 encoded HMAC key or public RSA/ECDSA pem key" + jwt_header: "Authorization" + jwt_url_parameter: null + roles_key: null + subject_key: null + authentication_backend: + type: noop + clientcert_auth_domain: + http_enabled: true + transport_enabled: true + order: 1 + http_authenticator: + type: clientcert + config: + username_attribute: cn #optional, if omitted DN becomes username + challenge: false + authentication_backend: + type: noop + ldap: + http_enabled: false + transport_enabled: false + order: 5 + http_authenticator: + type: basic + challenge: false + authentication_backend: + # LDAP authentication backend (authenticate users against a LDAP or Active Directory) + type: ldap # NOT FREE FOR COMMERCIAL USE + config: + # enable ldaps + enable_ssl: false + # enable start tls, enable_ssl should be false + enable_start_tls: false + # send client certificate + enable_ssl_client_auth: false + # verify ldap hostname + verify_hostnames: true + hosts: + - localhost:8389 + bind_dn: null + password: null + userbase: 'ou=people,dc=example,dc=com' + # Filter to search for users (currently in the whole subtree beneath userbase) + # {0} is substituted with the username + usersearch: '(sAMAccountName={0})' + # Use this attribute from the user as username (if not set then DN is used) + username_attribute: null + authz: + roles_from_myldap: + http_enabled: false + transport_enabled: false + authorization_backend: + # LDAP authorization backend (gather roles from a LDAP or Active Directory, you have to configure the above LDAP authentication backend settings too) + type: ldap # NOT FREE FOR COMMERCIAL USE + config: + # enable ldaps + enable_ssl: false + # enable start tls, enable_ssl should be false + enable_start_tls: false + # send client certificate + enable_ssl_client_auth: false + # verify ldap hostname + verify_hostnames: true + hosts: + - localhost:8389 + bind_dn: null + password: null + rolebase: 'ou=groups,dc=example,dc=com' + # Filter to search for roles (currently in the whole subtree beneath rolebase) + # {0} is substituted with the DN of the user + # {1} is substituted with the username + # {2} is substituted with an attribute value from user's directory entry, of the authenticated user. Use userroleattribute to specify the name of the attribute + rolesearch: '(member={0})' + # Specify the name of the attribute which value should be substituted with {2} above + userroleattribute: null + # Roles as an attribute of the user entry + userrolename: disabled + #userrolename: memberOf + # The attribute in a role entry containing the name of that role, Default is "name". + # Can also be "dn" to use the full DN as rolename. + rolename: cn + # Resolve nested roles transitive (roles which are members of other roles and so on ...) + resolve_nested_roles: true + userbase: 'ou=people,dc=example,dc=com' + # Filter to search for users (currently in the whole subtree beneath userbase) + # {0} is substituted with the username + usersearch: '(uid={0})' + # Skip users matching a user name, a wildcard or a regex pattern + #skip_users: + # - 'cn=Michael Jackson,ou*people,o=TEST' + # - '/\S*/' + roles_from_another_ldap: + enabled: false + authorization_backend: + type: ldap # NOT FREE FOR COMMERCIAL USE + #config goes here ... diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_internal_users.yml b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_internal_users.yml new file mode 100644 index 0000000000..942a7164aa --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_internal_users.yml @@ -0,0 +1,45 @@ +# This is the internal user database +# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh + +#password is: admin +admin: + readonly: true + hash: $2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv..TOG + roles: + - admin + attributes: + #no dots allowed in attribute names + attribute1: value1 + attribute2: value2 + attribute3: value3 + +#password is: logstash +logstash: + hash: $2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2 + roles: + - logstash + +#password is: kibanaserver +kibanaserver: + readonly: true + hash: $2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H. + +#password is: kibanaro +kibanaro: + hash: $2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC + roles: + - kibanauser + - readall + +#password is: readall +readall: + hash: $2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2 + #password is: readall + roles: + - readall + +#password is: snapshotrestore +snapshotrestore: + hash: $2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W + roles: + - snapshotrestore
\ No newline at end of file diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_roles.yml b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_roles.yml new file mode 100644 index 0000000000..c918e851f1 --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_roles.yml @@ -0,0 +1,262 @@ +# Allows everything, but no changes to searchguard configuration index +sg_all_access: + readonly: true + cluster: + - UNLIMITED + indices: + '*': + '*': + - UNLIMITED + tenants: + admin_tenant: RW + +# Read all, but no write permissions +sg_readall: + readonly: true + cluster: + - CLUSTER_COMPOSITE_OPS_RO + indices: + '*': + '*': + - READ + +# Read all and monitor, but no write permissions +sg_readall_and_monitor: + cluster: + - CLUSTER_MONITOR + - CLUSTER_COMPOSITE_OPS_RO + indices: + '*': + '*': + - READ + +# For users which use kibana, access to indices must be granted separately +sg_kibana_user: + readonly: true + cluster: + - INDICES_MONITOR + - CLUSTER_COMPOSITE_OPS + indices: + '?kibana': + '*': + - MANAGE + - INDEX + - READ + - DELETE + '?kibana-6': + '*': + - MANAGE + - INDEX + - READ + - DELETE + '?kibana_*': + '*': + - MANAGE + - INDEX + - READ + - DELETE + '?tasks': + '*': + - INDICES_ALL + '?management-beats': + '*': + - INDICES_ALL + '*': + '*': + - indices:data/read/field_caps* + - indices:data/read/xpack/rollup* + - indices:admin/mappings/get* + - indices:admin/get + +# For the kibana server +sg_kibana_server: + readonly: true + cluster: + - CLUSTER_MONITOR + - CLUSTER_COMPOSITE_OPS + - cluster:admin/xpack/monitoring* + - indices:admin/template* + - indices:data/read/scroll* + indices: + '?kibana': + '*': + - INDICES_ALL + '?kibana-6': + '*': + - INDICES_ALL + '?kibana_*': + '*': + - INDICES_ALL + '?reporting*': + '*': + - INDICES_ALL + '?monitoring*': + '*': + - INDICES_ALL + '?tasks': + '*': + - INDICES_ALL + '?management-beats*': + '*': + - INDICES_ALL + '*': + '*': + - "indices:admin/aliases*" + +# For logstash and beats +sg_logstash: + cluster: + - CLUSTER_MONITOR + - CLUSTER_COMPOSITE_OPS + - indices:admin/template/get + - indices:admin/template/put + indices: + 'logstash-*': + '*': + - CRUD + - CREATE_INDEX + '*beat*': + '*': + - CRUD + - CREATE_INDEX + +# Allows adding and modifying repositories and creating and restoring snapshots +sg_manage_snapshots: + cluster: + - MANAGE_SNAPSHOTS + indices: + '*': + '*': + - "indices:data/write/index" + - "indices:admin/create" + +# Allows each user to access own named index +sg_own_index: + cluster: + - CLUSTER_COMPOSITE_OPS + indices: + '${user_name}': + '*': + - INDICES_ALL + +### X-Pack COMPATIBILITY +sg_xp_monitoring: + readonly: true + cluster: + - cluster:monitor/xpack/info + - cluster:monitor/main + - cluster:admin/xpack/monitoring/bulk + indices: + '?monitor*': + '*': + - INDICES_ALL + +sg_xp_alerting: + readonly: true + cluster: + - indices:data/read/scroll + - cluster:admin/xpack/watcher* + - cluster:monitor/xpack/watcher* + indices: + '?watches*': + '*': + - INDICES_ALL + '?watcher-history-*': + '*': + - INDICES_ALL + '?triggered_watches': + '*': + - INDICES_ALL + '*': + '*': + - READ + - indices:admin/aliases/get + +sg_xp_machine_learning: + readonly: true + cluster: + - cluster:admin/persistent* + - cluster:internal/xpack/ml* + - indices:data/read/scroll* + - cluster:admin/xpack/ml* + - cluster:monitor/xpack/ml* + indices: + '*': + '*': + - READ + - indices:admin/get* + '?ml-*': + '*': + - "*" + +### LEGACY ROLES, FOR COMPATIBILITY ONLY +### WILL BE REMOVED IN SG7, DO NOT USE ANYMORE + +sg_readonly_and_monitor: + cluster: + - CLUSTER_MONITOR + - CLUSTER_COMPOSITE_OPS_RO + indices: + '*': + '*': + - READ + +# Make xpack monitoring work +sg_monitor: + cluster: + - cluster:admin/xpack/monitoring/* + - cluster:admin/ingest/pipeline/put + - cluster:admin/ingest/pipeline/get + - indices:admin/template/get + - indices:admin/template/put + - CLUSTER_MONITOR + - CLUSTER_COMPOSITE_OPS + indices: + '?monitor*': + '*': + - INDICES_ALL + '?marvel*': + '*': + - INDICES_ALL + '?kibana*': + '*': + - READ + '*': + '*': + - indices:data/read/field_caps + +# Make xpack alerting work +sg_alerting: + cluster: + - indices:data/read/scroll + - cluster:admin/xpack/watcher/watch/put + - cluster:admin/xpack/watcher* + - CLUSTER_MONITOR + - CLUSTER_COMPOSITE_OPS + indices: + '?kibana*': + '*': + - READ + '?watches*': + '*': + - INDICES_ALL + '?watcher-history-*': + '*': + - INDICES_ALL + '?triggered_watches': + '*': + - INDICES_ALL + '*': + '*': + - READ + + +sg_role_test: + cluster: + - indices:admin/template/get + - indices:admin/template/put + - CLUSTER_COMPOSITE_OPS + indices: + '*': + '*': + - UNLIMITED diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_roles_mapping.yml b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_roles_mapping.yml new file mode 100644 index 0000000000..970e02763b --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_roles_mapping.yml @@ -0,0 +1,38 @@ +# In this file users, backendroles and hosts can be mapped to Search Guard roles. +# Permissions for Search Guard roles are configured in sg_roles.yml + +sg_all_access: + readonly: true + backendroles: + - admin + +sg_logstash: + backendroles: + - logstash + +sg_kibana_server: + readonly: true + users: + - kibanaserver + +sg_kibana_user: + backendroles: + - kibanauser + +sg_readall: + readonly: true + backendroles: + - readall + +sg_manage_snapshots: + readonly: true + backendroles: + - snapshotrestore + +sg_own_index: + users: + - '*' + +sg_role_test: + users: + - test diff --git a/kubernetes/aai/charts/aai-elasticsearch/templates/configmap.yaml b/kubernetes/aai/charts/aai-elasticsearch/templates/configmap.yaml index c60b8f2da8..4be124fc0f 100644 --- a/kubernetes/aai/charts/aai-elasticsearch/templates/configmap.yaml +++ b/kubernetes/aai/charts/aai-elasticsearch/templates/configmap.yaml @@ -1,5 +1,4 @@ -# Copyright © 2017 Amdocs, Bell Canada -# Modifications Copyright © 2018 AT&T +# Copyright © 2018 Amdocs, Bell Canada, AT&T # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -13,11 +12,10 @@ # See the License for the specific language governing permissions and # limitations under the License. -#{{ if not .Values.disableAaiElasticsearch }} apiVersion: v1 kind: ConfigMap metadata: - name: {{ include "common.fullname" . }} + name: {{ include "common.fullname" . }}-es-config namespace: {{ include "common.namespace" . }} labels: app: {{ include "common.name" . }} @@ -26,4 +24,29 @@ metadata: heritage: {{ .Release.Service }} data: {{ tpl (.Files.Glob "resources/config/*").AsConfig . | indent 2 }} -#{{ end }} +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "common.fullname" . }}-sg-scripts + namespace: {{ include "common.namespace" . }} + labels: + app: {{ include "common.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +data: +{{ tpl (.Files.Glob "resources/bin/*").AsConfig . | indent 2 }} +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "common.fullname" . }}-sg-config + namespace: {{ include "common.namespace" . }} + labels: + app: {{ include "common.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +data: +{{ tpl (.Files.Glob "resources/config/sg/*").AsConfig . | indent 2 }} diff --git a/kubernetes/aai/charts/aai-elasticsearch/templates/deployment.yaml b/kubernetes/aai/charts/aai-elasticsearch/templates/deployment.yaml index 14b896e272..785693a9ba 100644 --- a/kubernetes/aai/charts/aai-elasticsearch/templates/deployment.yaml +++ b/kubernetes/aai/charts/aai-elasticsearch/templates/deployment.yaml @@ -34,6 +34,7 @@ spec: release: {{ .Release.Name }} name: {{ include "common.name" . }} spec: + hostname: {{ include "common.name" . }} initContainers: - command: - /bin/sh @@ -53,18 +54,18 @@ spec: securityContext: privileged: true image: {{ .Values.global.dockerhubRepository | default .Values.dockerhubRepository }}/{{ .Values.global.busyboxImage | default .Values.busyboxImage }} - imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} + imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.pullPolicy }} name: init-sysctl volumeMounts: - name: elasticsearch-data mountPath: /logroot/ - hostname: {{ include "common.name" . }} containers: - name: {{ include "common.name" . }} - image: {{ .Values.global.loggingRepository | default .Values.loggingRepository }}/{{ .Values.image }} - imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} + image: "{{ include "common.repository" . }}/{{ .Values.image }}" + imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.pullPolicy }} ports: - containerPort: {{ .Values.service.internalPort }} + - containerPort: {{ .Values.service.internalPort2 }} # disable liveness probe when breakpoints set in debugger # so K8s doesn't restart unresponsive container {{- if eq .Values.liveness.enabled true }} @@ -92,10 +93,23 @@ spec: - name: elasticsearch-config subPath: log4j2.properties mountPath: /usr/share/elasticsearch/config/log4j2.properties + - name: searchguard-scripts + subPath: run.sh + mountPath: /usr/share/elasticsearch/bin/run.sh + - name: searchguard-scripts + subPath: wait_until_started.sh + mountPath: /usr/share/elasticsearch/bin/wait_until_started.sh + - name: searchguard-scripts + subPath: init_sg.sh + mountPath: /usr/share/elasticsearch/bin/init_sg.sh + - name: searchguard-config + mountPath: /usr/share/elasticsearch/config/sg + - name: searchguard-auth-config + mountPath: /usr/share/elasticsearch/config/sg/auth - name: elasticsearch-data mountPath: /usr/share/elasticsearch/data resources: -{{ include "common.resources" . }} +{{ include "common.resources" . | indent 12 }} {{- if .Values.nodeSelector }} nodeSelector: {{ toYaml .Values.nodeSelector | indent 8 }} @@ -111,9 +125,20 @@ spec: path: /etc/localtime - name: elasticsearch-config configMap: - name: {{ include "common.fullname" . }} + name: {{ include "common.fullname" . }}-es-config + - name: searchguard-scripts + configMap: + name: {{ include "common.fullname" . }}-sg-scripts + defaultMode: 0754 + - name: searchguard-config + configMap: + name: {{ include "common.fullname" . }}-sg-config + - name: searchguard-auth-config + secret: + secretName: {{ include "common.fullname" . }}-sg-auth - name: elasticsearch-data hostPath: path: {{ .Values.persistence.mountPath }}/{{ .Release.Name }}/{{ .Values.persistence.mountSubPath }} + restartPolicy: {{ .Values.restartPolicy }} imagePullSecrets: - name: "{{ include "common.namespace" . }}-docker-registry-key" diff --git a/kubernetes/dmaap/charts/dmaap-data-router/Chart.yaml b/kubernetes/aai/charts/aai-elasticsearch/templates/secrets.yaml index 07de3beccf..34b272f086 100644 --- a/kubernetes/dmaap/charts/dmaap-data-router/Chart.yaml +++ b/kubernetes/aai/charts/aai-elasticsearch/templates/secrets.yaml @@ -1,4 +1,4 @@ -# Copyright © 2017 Amdocs, Bell Canada +# Copyright © 2018 Amdocs, Bell Canada, AT&T # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -13,6 +13,10 @@ # limitations under the License. apiVersion: v1 -description: ONAP DMaaP Data Router -name: dmaap-data-router -version: 1.0 +kind: Secret +metadata: + name: {{ include "common.fullname" . }}-sg-auth + namespace: {{ include "common.namespace" . }} +type: Opaque +data: +{{ tpl (.Files.Glob "resources/config/sg/auth/*").AsSecrets . | indent 2 }}
\ No newline at end of file diff --git a/kubernetes/aai/charts/aai-elasticsearch/templates/service.yaml b/kubernetes/aai/charts/aai-elasticsearch/templates/service.yaml index b1de5a73cb..d1199125d2 100644 --- a/kubernetes/aai/charts/aai-elasticsearch/templates/service.yaml +++ b/kubernetes/aai/charts/aai-elasticsearch/templates/service.yaml @@ -25,14 +25,19 @@ metadata: spec: type: {{ .Values.service.type }} ports: - {{if eq .Values.service.type "NodePort" -}} - - port: {{ .Values.service.internalPort }} - nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort }} - name: {{ .Values.service.portName }} - {{- else -}} - - port: {{ .Values.service.internalPort }} - name: {{ .Values.service.portName }} - {{- end}} + {{if eq .Values.service.type "NodePort" -}} + - port: {{ .Values.service.internalPort }} + nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort }} + name: {{ .Values.service.portName }} + - port: {{ .Values.service.internalPort2 }} + nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort2 }} + name: {{ .Values.service.portName2 }} + {{- else -}} + - port: {{ .Values.service.internalPort }} + name: {{ .Values.service.portName }} + - port: {{ .Values.service.internalPort2 }} + name: {{ .Values.service.portName2 }} + {{- end}} selector: app: {{ include "common.name" . }} release: {{ .Release.Name }} diff --git a/kubernetes/aai/charts/aai-elasticsearch/values.yaml b/kubernetes/aai/charts/aai-elasticsearch/values.yaml index 5ce8f8016b..ea82c99f8b 100644 --- a/kubernetes/aai/charts/aai-elasticsearch/values.yaml +++ b/kubernetes/aai/charts/aai-elasticsearch/values.yaml @@ -19,16 +19,21 @@ global: # global defaults nodePortPrefix: 302 # application image -loggingRepository: docker.elastic.co -image: elasticsearch/elasticsearch:6.1.2 +image: onap/elasticsearch-sg:1.4-STAGING-latest pullPolicy: Always +restartPolicy: Always flavor: small # application configuration config: tcpPort: 8443 - + nodeKeyStore: esaai-keystore.jks + nodeKeyStorePassword: b87b46d3da7d3d4aadfe + adminKeyStore: sgadmin-keystore.p12 + adminKeyStorePassword: 341274302a70ad691e12 + trustStore: truststore.jks + trustStorePassword: b200926e9da205487f63 # default number of instances replicaCount: 1 @@ -54,6 +59,8 @@ service: name: aai-elasticsearch portName: aai-elasticsearch internalPort: 9200 + portName2: aai-elasticsearch-tcp + internalPort2: 8443 ingress: enabled: false diff --git a/kubernetes/aai/charts/aai-sparky-be/resources/config/application-oxm-schema-prod.properties b/kubernetes/aai/charts/aai-sparky-be/resources/config/application-oxm-schema-prod.properties index 98c7abd59c..c7f6bbc1d3 100644 --- a/kubernetes/aai/charts/aai-sparky-be/resources/config/application-oxm-schema-prod.properties +++ b/kubernetes/aai/charts/aai-sparky-be/resources/config/application-oxm-schema-prod.properties @@ -13,3 +13,16 @@ # limitations under the License. oxm.schemaNodeDir=/opt/app/sparky/onap/oxm +#schemaServiceTranslator is used to define whether to retreive the oxm from schema service microservice or read from the disk, possible values are schema-service/config +oxm.schemaServiceTranslatorList=config +# The end point for onap is https://<hostname>:<port>/onap/schema-service/v1/ +oxm.schemaServiceBaseUrl=https://<schema-service/config>/aai/schema-service/v1/ +oxm.schemaServiceKeystore=file:${CONFIG_HOME}/auth/aai-client-cert.p12 +oxm.schemaServiceTruststore=file:${CONFIG_HOME}/auth/tomcat_keystore +oxm.schemaServiceKeystorePassword=OBF:1i9a1u2a1unz1lr61wn51wn11lss1unz1u301i6o +oxm.schemaServiceTruststorePassword=OBF:1i9a1u2a1unz1lr61wn51wn11lss1unz1u301i6o + + + +# Schema Service need this variable for the time being +spring.applicationName=sparky diff --git a/kubernetes/aai/charts/aai-sparky-be/resources/config/application.properties b/kubernetes/aai/charts/aai-sparky-be/resources/config/application.properties index da4812c646..108f9ef7b5 100644 --- a/kubernetes/aai/charts/aai-sparky-be/resources/config/application.properties +++ b/kubernetes/aai/charts/aai-sparky-be/resources/config/application.properties @@ -24,8 +24,12 @@ spring.mvc.favicon.enabled=false spring.profiles.active=camel,ssl,fe-prod,oxm-schema-prod,oxm-default,resources,sync,portal +portal.cadiFileLocation={{.Values.config.cadiFileLocation}} +portal.cadiFileLocation={{.Values.config.cadiFileLocation}} searchservice.hostname={{.Values.global.searchData.serviceName}} searchservice.port=9509 searchservice.client-cert=client-cert-onap.p12 searchservice.client-cert-password=1y0q1uvc1uum1uvg1pil1pjl1uuq1uvk1uuu1y10 searchservice.truststore=tomcat_keystore + +schema.ingest.file=${CONFIG_HOME}/schemaIngest.properties diff --git a/kubernetes/aai/charts/aai-sparky-be/resources/config/portal/BOOT-INF/classes/key.properties b/kubernetes/aai/charts/aai-sparky-be/resources/config/portal/BOOT-INF/classes/key.properties new file mode 100644 index 0000000000..67268e33e2 --- /dev/null +++ b/kubernetes/aai/charts/aai-sparky-be/resources/config/portal/BOOT-INF/classes/key.properties @@ -0,0 +1 @@ +cipher.enc.key=AGLDdG4D04BKm2IxIWEr8o==! diff --git a/kubernetes/aai/charts/aai-sparky-be/resources/config/portal/BOOT-INF/classes/portal.properties b/kubernetes/aai/charts/aai-sparky-be/resources/config/portal/BOOT-INF/classes/portal.properties index aa16b1b3ce..546955f98a 100644 --- a/kubernetes/aai/charts/aai-sparky-be/resources/config/portal/BOOT-INF/classes/portal.properties +++ b/kubernetes/aai/charts/aai-sparky-be/resources/config/portal/BOOT-INF/classes/portal.properties @@ -18,7 +18,7 @@ ################################################################################ # Java class that implements the ECOMP role and user mgt API -portal.api.impl.class = org.onap.aai.sparky.security.portal.PortalRestAPIServiceImpl +portal.api.impl.class = org.onap.aai.sparky.security.portal.PortalRestAPICentralServiceImpl # Instance of ECOMP Portal where the app has been on-boarded # use insecure http for dev purposes to avoid self-signed certificate @@ -35,4 +35,13 @@ csp_gate_keeper_prod_key = PROD # Toggles use of UEB ueb_listeners_enable = false # IDs application withing UEB flow -ueb_app_key = qFKles9N8gDTV0Zc +ueb_app_key = ueb_key_7 +# Use this tag if the app is centralized +role_access_centralized=remote + +# Connection and Read timeout values +ext_req_connection_timeout=15000 +ext_req_read_timeout=20000 + +#Add AAF namespace if the app is centralized +auth_namespace={{.Values.config.aafNamespace}} diff --git a/kubernetes/aai/charts/aai-sparky-be/resources/config/portal/cadi.properties b/kubernetes/aai/charts/aai-sparky-be/resources/config/portal/cadi.properties new file mode 100644 index 0000000000..41a49a0ed7 --- /dev/null +++ b/kubernetes/aai/charts/aai-sparky-be/resources/config/portal/cadi.properties @@ -0,0 +1,45 @@ +# Configure AAF +aaf_locate_url=https://aaf-locate.{{.Release.Namespace}}:8095 +aaf_url=<%=https://AAF_LOCATE_URL/AAF_NS.service:2.0 + +#aaf_url=https://DME2RESOLVE/service=com.att.authz.AuthorizationService/version=2.0/envContext=TEST/routeOffer=BAU_SE +# AAF Environment Designation + +#if you are running aaf service from a docker image you have to use aaf service IP and port number +aaf_id={{.Values.config.aafUsername}} +#Encrypt the password using AAF Jar +aaf_password={{.Values.config.aafPassword}} +# Sample CADI Properties, from CADI 1.4.2 +#hostname=org.onap.aai.orr +csp_domain=PROD +# Add Absolute path to Keyfile +cadi_keyfile={{.Values.config.cadiKeyFile}} + +# This is required to accept Certificate Authentication from Certman certificates. +# can be TEST, IST or PROD +aaf_env=DEV + +# DEBUG prints off all the properties. Use to get started. +cadi_loglevel=DEBUG + +# Add Absolute path to truststore2018.jks +cadi_truststore={{.Values.config.cadiTrustStore}} +# Note: This is the ONLY password that doesn't have to be encrypted. All Java's TrustStores are this passcode by default, because they are public certs +cadi_truststore_password={{.Values.config.cadiTrustStorePassword}} + +# how to turn on SSL Logging +#javax.net.debug=ssl + +# Use "maps.bing.com" to get Lat and Long for an Address +AFT_LATITUDE=32.780140 +AFT_LONGITUDE=-96.800451 +AFT_ENVIRONMENT=AFTUAT +AFT_DME2_CLIENT_IGNORE_SSL_CONFIG=true +DME2.DEBUG=true +AFT_DME2_HTTP_EXCHANGE_TRACE_ON=true + +cadi_latitude=32.780140 +cadi_longitude=-96.800451 + +aaf_root_ns=com.att.aaf +aaf_api_version=2.0 diff --git a/kubernetes/aai/charts/aai-sparky-be/resources/config/portal/keyFile b/kubernetes/aai/charts/aai-sparky-be/resources/config/portal/keyFile new file mode 100644 index 0000000000..921ce6714a --- /dev/null +++ b/kubernetes/aai/charts/aai-sparky-be/resources/config/portal/keyFile @@ -0,0 +1,27 @@ +77E_fh-8gTjeg8egAo-JgNkXYm1FGEBPMo44vKPgKyGCJj9Dn0xJqIBct2Ko35X4_HSU3wPq3I2q +YHIvJCjmzXTVu2zvu4rIGTlwycTtLGDkgPyhOYFytv4GgazbpSs9331MPUeVVrdpkDCQmjtHSB4m +DThhfEe2lkbZ35ljX3sVSf3JDy4ngRot0ktQwnnY4vxFdgVUl7LzVinXWgFLoqMyXmKh_bGw9aUH +VMgqFsF_YmqLZY5ZARAraeywktvrU5kXYh5SnfXoJy7XIk0TBjHKqO-1mW-TcIgS3_v6GIGkZnpq +e1FyE8cS21gTPFlc1KDoWUZE2yoEsQKJc4RFWfjid_mE6nckxym1TOsEn3G2_TlkZvliN_QMDB_c +RuFLDB9HCChm4YYHpSn-RBqtJFz29bMTHQX8VNVfZ_Zhh-4dWOlEfpSzJvAqm_boo-8y8YDGIusx +mvKyPXEKVCuBOljHaKhYg0d43nAXIFsssKpjmtQizA2L_TP1Mo_lDFIlCsPcRlHKTvzkTstEAhRj +JnepzA--olBMwBkPxjm1Y5XQBGZH72i_o4Hr7_NqHb9sP486I2Nd1-owjHkhacGrLO1oORnuBUxp +_SnaXYywe9tTz3BcfFupXSoDv4Sj7g9B53yPIWmjGggigidql3SNJsui6qOtwDHOejzEDFm23Lj7 +fXD6sb52U_ul9ahi4CoLTzpvMsPRYOqyRCk8K8FVBauZbG5D42oaFPn0S0rCSHOCU1TXbRdTF-Cs +I2R0pEHNgb33yx6vtInaTSYIQ5cxa3XDA_50AQearV5SuYSlp8dK0BkpVCKgvSQdTn-2WiaV_hvO +KzG7D2adT1kYY6TjYMXIaUiJ33y1XSNDG0s6r4NG5dNE6Jj7thdpnV-AAZoi0uZh1_bsHKLVmHRr +NCXAc6DZm1D4N9y5lOJwUprUlJisZXLFTQThGMRY5dtiY_eK9Xjj4FQygXXhuhFXHz2-e4YApORv +lXDcT29IZuuI1j26bxdNdhNr1wZsqqievBN6l6OQMiP21eIrxAUu1BEmiVOrfOzaEjxldDN2gFum +4-zf9gsQT9UT8KEuOje64wVeHr09JpWuddV9HOAMvqc6mKTWmvUv_QiLgtK_b39QccMrOfOA1usM +biRJ9wuTYIr584Q9CjHEcm5e2YufcbF-IDZ4IDui8gNXyYJuusTYdspeKzrtiLKfgI56ZWA3it9G +SOkN18YyUmhk7HFkx9qEifb4UEbUQPb0dyXBRotf-91c5CPkct-36uV4sZBA_AR1tX3-aRKKB_SQ +B0zaG-eaEdEqKv-ZYHqk23ZxiEsCX3ZdY7VSMWztE3_D5n8UgEl4et5LVfnjvU-arVVO93WUbXk0 +zi2QrOwytOZ0StAvFdF1nVwWllPg4EYcn8qLJIaaBRvLMlpHixtwRhltwJeMmJl3ExImOxNhVbhF +6LxVXW6JK8JfMIwb_TE4EShDBjemq76BojQOwrO4OAyPG7B5iUtefdY-Zu1EtjXPhrUgljI_A1tg +5_2WNjNTCT7Bvig3saFsIRi3cvgIcMAF2H7kJYw3UDvCFnx4LIom2u6vSeyatPxEOhRfpP0KvgEU +koM9DFJW7VWQ11mB_DcU2NoYHdFKFy_cM62kIvoRwZTADGryEtkLSWEDT8MLpVrGXP2RjSZ3HHqC +vVpVqQHC2VIqNKi2uHtYCiTEfj81Z0rCrnH3hYIRoOSe5W6m17xyb0RloG0G44uK0oNCfDYLwK0L +TJaBdWSIBYI__ISsKx8o8r-3XLtbwQPPhv4-LpGwJYd7sIcqnpTYAyNGSrbEM4ECzHCH9Hwf9Duy +cAQGWqXIbTV9i8ryw8OhcCZPTf3noPZyhzzdegiv6KNT-BBbxsgtDehtP-jvpd9eAhjlfUV_hoFJ +rBUVMFrIOEDnnItVqBDmnavRdhn6N9ObVjVMv_4inhkvtpBCEVxtVQT2kFuBmZvPu_uHHbXi7_g8 +SVs3AjJ2ya3pZraK6gH3IOYoGtTAH3rKl7XdTMjqWnUCbhepuJqeEOF-DhpsEW7Oo0Lqzbjg
\ No newline at end of file diff --git a/kubernetes/aai/charts/aai-sparky-be/resources/config/portal/portal-authentication.properties b/kubernetes/aai/charts/aai-sparky-be/resources/config/portal/portal-authentication.properties index ac09f9b2c2..97b5399f54 100644 --- a/kubernetes/aai/charts/aai-sparky-be/resources/config/portal/portal-authentication.properties +++ b/kubernetes/aai/charts/aai-sparky-be/resources/config/portal/portal-authentication.properties @@ -26,3 +26,6 @@ password={{.Values.config.portalPassword}} # prevent the portal interface's login processing from searching for a user
# specific cookie, and will instead allow passage if a valid session cookie is discovered.
onap_enabled={{.Values.config.portalOnapEnabled}}
+onap.user_id_cookie_name={{.Values.config.portalCookieName}}
+cookie_decryptor_classname={{.Values.config.cookieDecryptorClass}}
+app_roles={{.Values.config.portalAppRoles}}
diff --git a/kubernetes/aai/charts/aai-sparky-be/values.yaml b/kubernetes/aai/charts/aai-sparky-be/values.yaml index c60ce29e52..9755c8bcc2 100644 --- a/kubernetes/aai/charts/aai-sparky-be/values.yaml +++ b/kubernetes/aai/charts/aai-sparky-be/values.yaml @@ -28,7 +28,7 @@ global: # global defaults # application image repository: nexus3.onap.org:10001 -image: onap/sparky-be:1.3.0 +image: onap/sparky-be:1.4-STAGING-latest pullPolicy: Always restartPolicy: Always flavor: small @@ -40,7 +40,17 @@ config: gerritBranch: 3.0.0-ONAP gerritProject: http://gerrit.onap.org/r/aai/test-config portalUsername: aaiui - portalPassword: 1t2v1vfv1unz1vgz1t3b + portalPassword: OBF:1t2v1vfv1unz1vgz1t3b + portalCookieName: UserId + portalAppRoles: ui_view + aafUsername: aai@aai.onap.org + aafNamespace: org.onap.aai.aaiui + aafPassword: enc:xxYw1FqXU5UpianbPeH5Rezg0YfjzuwQrSiLcCmJGfz + cadiKeyFile: /opt/app/sparky/config/portal/keyFile + cadiTrustStore: /opt/app/sparky/config/auth/truststoreONAPall.jks + cadiFileLocation: /opt/app/sparky/config/portal/cadi.properties + cadiTrustStorePassword: changeit + cookieDecryptorClass: org.onap.aai.sparky.security.BaseCookieDecryptor # ONAP Cookie Processing - During initial development, the following flag, if true, will # prevent the portal interface's login processing from searching for a user diff --git a/kubernetes/aai/values.yaml b/kubernetes/aai/values.yaml index dab171df39..e86c416fc3 100644 --- a/kubernetes/aai/values.yaml +++ b/kubernetes/aai/values.yaml @@ -176,11 +176,11 @@ global: # global defaults version: # Current version of the REST API api: - default: v15 + default: v16 # Specifies which version the depth parameter is configurable depth: v11 # List of all the supported versions of the API - list: v11,v12,v13,v14,v15 + list: v11,v12,v13,v14,v15,v16 # Specifies from which version related link should appear related: link: v11 diff --git a/kubernetes/dmaap/Makefile b/kubernetes/dmaap/Makefile index b39b91f804..847366d52c 100644 --- a/kubernetes/dmaap/Makefile +++ b/kubernetes/dmaap/Makefile @@ -1,5 +1,4 @@ # Copyright © 2018 AT&T Intellectual Property. All rights reserved. -# Modifications Copyright © 2018 Amdocs,Bell Canada # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -13,16 +12,19 @@ # See the License for the specific language governing permissions and # limitations under the License. -make-dmaap: make-bus-controller make-message-router make-dmaap-data-router +make-dmaap: make-bus-controller make-message-router make-dmaap-dr-node make-dmaap-dr-prov make-bus-controller: - cd charts && helm dep up dmaap-bus-controller && helm lint dmaap-bus-controller + cd components && helm dep up dmaap-bus-controller && helm lint dmaap-bus-controller make-message-router: - cd charts && helm dep up message-router && helm lint message-router + cd components && helm dep up message-router && helm lint message-router -make-dmaap-data-router: - cd charts && helm dep up dmaap-data-router && helm lint dmaap-data-router +make-dmaap-dr-node: + cd components && helm dep up dmaap-dr-node && helm lint dmaap-dr-node + +make-dmaap-dr-prov: + cd components && helm dep up dmaap-dr-prov && helm lint dmaap-dr-prov clean: @find . -type f -name '*.tgz' -delete diff --git a/kubernetes/dmaap/charts/dmaap-data-router/values.yaml b/kubernetes/dmaap/charts/dmaap-data-router/values.yaml deleted file mode 100644 index c783d0745a..0000000000 --- a/kubernetes/dmaap/charts/dmaap-data-router/values.yaml +++ /dev/null @@ -1,71 +0,0 @@ -# Copyright © 2017 Amdocs, Bell Canada -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -################################################################# -# DMaap Data Router Global config defaults. -################################################################# -global: - env: - name: AUTO - ubuntuInitRepository: oomk8s - ubuntuInitImage: ubuntu-init:1.0.0 - loggingDirectory: /opt/app/datartr/logs - - config: -# dr provisioning server configuration - dmaapDrProv: - servicetype: NodePort - name: dmaap-dr-prov - externalPort: 8080 - externalPort2: 8443 - internalPort: 8080 - internalPort2: 8443 - portName: dr-prov-port - portName2: dr-prov-port2 - nodePort: 59 - nodePort2: 69 -# dr node server configuration - dmaapDrNode: - servicetype: ClusterIP - name: dmaap-dr-node - externalPort: 8080 - externalPort2: 8443 - internalPort: 8080 - internalPort2: 8443 - portName: dr-node-port - portName2: dr-node-port2 -# dr-prov db configuration - dmaapDrDb: - mariadbServiceName: dmaap-dr-db-svc - mariadbServicePort: 3306 - mariadbContName: dmaap-dr-db - -# mariadb-galera configuration -mariadb: - name: dmaap-dr-db - nameOverride: dmaap-dr-db - replicaCount: 2 - config: - mariadbRootPassword: datarouter - userName: datarouter - userPassword: datarouter - mysqlDatabase: datarouter - service: - name: dmaap-dr-db-svc - portName: dmaap-dr-db-svc - nfsprovisionerPrefix: dmaap-dr-db - persistence: - size: 1Gi - mountSubPath: data-router/dr-db-data - disableNfsProvisioner: true
\ No newline at end of file diff --git a/kubernetes/dmaap/charts/message-router/charts/message-router-zookeeper/.helmignore b/kubernetes/dmaap/charts/message-router/charts/message-router-zookeeper/.helmignore deleted file mode 100644 index f0c1319444..0000000000 --- a/kubernetes/dmaap/charts/message-router/charts/message-router-zookeeper/.helmignore +++ /dev/null @@ -1,21 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj diff --git a/kubernetes/dmaap/charts/dmaap-bus-controller/.helmignore b/kubernetes/dmaap/components/dmaap-bus-controller/.helmignore index f0c1319444..f0c1319444 100644 --- a/kubernetes/dmaap/charts/dmaap-bus-controller/.helmignore +++ b/kubernetes/dmaap/components/dmaap-bus-controller/.helmignore diff --git a/kubernetes/dmaap/charts/dmaap-bus-controller/Chart.yaml b/kubernetes/dmaap/components/dmaap-bus-controller/Chart.yaml index fc2ba21e29..fc2ba21e29 100644 --- a/kubernetes/dmaap/charts/dmaap-bus-controller/Chart.yaml +++ b/kubernetes/dmaap/components/dmaap-bus-controller/Chart.yaml diff --git a/kubernetes/dmaap/charts/dmaap-bus-controller/README.md b/kubernetes/dmaap/components/dmaap-bus-controller/README.md index a799fd44dd..a799fd44dd 100644 --- a/kubernetes/dmaap/charts/dmaap-bus-controller/README.md +++ b/kubernetes/dmaap/components/dmaap-bus-controller/README.md diff --git a/kubernetes/dmaap/charts/dmaap-bus-controller/requirements.yaml b/kubernetes/dmaap/components/dmaap-bus-controller/requirements.yaml index 61c265fe64..61c265fe64 100644 --- a/kubernetes/dmaap/charts/dmaap-bus-controller/requirements.yaml +++ b/kubernetes/dmaap/components/dmaap-bus-controller/requirements.yaml diff --git a/kubernetes/dmaap/charts/dmaap-bus-controller/resources/config/buscontroller.env b/kubernetes/dmaap/components/dmaap-bus-controller/resources/config/buscontroller.env index cde43f95b7..cde43f95b7 100644 --- a/kubernetes/dmaap/charts/dmaap-bus-controller/resources/config/buscontroller.env +++ b/kubernetes/dmaap/components/dmaap-bus-controller/resources/config/buscontroller.env diff --git a/kubernetes/dmaap/charts/dmaap-bus-controller/resources/config/dmaapbc.properties b/kubernetes/dmaap/components/dmaap-bus-controller/resources/config/dmaapbc.properties index faa19c6f4d..faa19c6f4d 100644 --- a/kubernetes/dmaap/charts/dmaap-bus-controller/resources/config/dmaapbc.properties +++ b/kubernetes/dmaap/components/dmaap-bus-controller/resources/config/dmaapbc.properties diff --git a/kubernetes/dmaap/charts/dmaap-bus-controller/resources/dcaeLocations/san-francisco.json b/kubernetes/dmaap/components/dmaap-bus-controller/resources/dcaeLocations/san-francisco.json index ca1e740dd8..ca1e740dd8 100644 --- a/kubernetes/dmaap/charts/dmaap-bus-controller/resources/dcaeLocations/san-francisco.json +++ b/kubernetes/dmaap/components/dmaap-bus-controller/resources/dcaeLocations/san-francisco.json diff --git a/kubernetes/dmaap/charts/dmaap-bus-controller/resources/dmaap/onap.json b/kubernetes/dmaap/components/dmaap-bus-controller/resources/dmaap/onap.json index 9099e046ed..9099e046ed 100644 --- a/kubernetes/dmaap/charts/dmaap-bus-controller/resources/dmaap/onap.json +++ b/kubernetes/dmaap/components/dmaap-bus-controller/resources/dmaap/onap.json diff --git a/kubernetes/dmaap/charts/dmaap-bus-controller/resources/feeds/DefaultPM.json b/kubernetes/dmaap/components/dmaap-bus-controller/resources/feeds/DefaultPM.json index 411d7f41e1..411d7f41e1 100644 --- a/kubernetes/dmaap/charts/dmaap-bus-controller/resources/feeds/DefaultPM.json +++ b/kubernetes/dmaap/components/dmaap-bus-controller/resources/feeds/DefaultPM.json diff --git a/kubernetes/dmaap/charts/dmaap-bus-controller/resources/feeds/README b/kubernetes/dmaap/components/dmaap-bus-controller/resources/feeds/README index 4f5eac5ba1..4f5eac5ba1 100644 --- a/kubernetes/dmaap/charts/dmaap-bus-controller/resources/feeds/README +++ b/kubernetes/dmaap/components/dmaap-bus-controller/resources/feeds/README diff --git a/kubernetes/dmaap/charts/dmaap-bus-controller/resources/mr_clusters/san-francisco.json b/kubernetes/dmaap/components/dmaap-bus-controller/resources/mr_clusters/san-francisco.json index 9e732d2af8..9e732d2af8 100644 --- a/kubernetes/dmaap/charts/dmaap-bus-controller/resources/mr_clusters/san-francisco.json +++ b/kubernetes/dmaap/components/dmaap-bus-controller/resources/mr_clusters/san-francisco.json diff --git a/kubernetes/dmaap/charts/dmaap-bus-controller/resources/topics/PNF_READY.json b/kubernetes/dmaap/components/dmaap-bus-controller/resources/topics/PNF_READY.json index 8f4cf8bd64..8f4cf8bd64 100644 --- a/kubernetes/dmaap/charts/dmaap-bus-controller/resources/topics/PNF_READY.json +++ b/kubernetes/dmaap/components/dmaap-bus-controller/resources/topics/PNF_READY.json diff --git a/kubernetes/dmaap/charts/dmaap-bus-controller/resources/topics/PNF_REGISTRATION.json b/kubernetes/dmaap/components/dmaap-bus-controller/resources/topics/PNF_REGISTRATION.json index f0dd2c7829..f0dd2c7829 100644 --- a/kubernetes/dmaap/charts/dmaap-bus-controller/resources/topics/PNF_REGISTRATION.json +++ b/kubernetes/dmaap/components/dmaap-bus-controller/resources/topics/PNF_REGISTRATION.json diff --git a/kubernetes/dmaap/charts/dmaap-bus-controller/resources/topics/README b/kubernetes/dmaap/components/dmaap-bus-controller/resources/topics/README index fbb88b97e6..fbb88b97e6 100644 --- a/kubernetes/dmaap/charts/dmaap-bus-controller/resources/topics/README +++ b/kubernetes/dmaap/components/dmaap-bus-controller/resources/topics/README diff --git a/kubernetes/dmaap/charts/dmaap-bus-controller/templates/NOTES.txt b/kubernetes/dmaap/components/dmaap-bus-controller/templates/NOTES.txt index 050853cfa2..050853cfa2 100644 --- a/kubernetes/dmaap/charts/dmaap-bus-controller/templates/NOTES.txt +++ b/kubernetes/dmaap/components/dmaap-bus-controller/templates/NOTES.txt diff --git a/kubernetes/dmaap/charts/dmaap-bus-controller/templates/configmap.yaml b/kubernetes/dmaap/components/dmaap-bus-controller/templates/configmap.yaml index ead7562a59..ead7562a59 100644 --- a/kubernetes/dmaap/charts/dmaap-bus-controller/templates/configmap.yaml +++ b/kubernetes/dmaap/components/dmaap-bus-controller/templates/configmap.yaml diff --git a/kubernetes/dmaap/charts/dmaap-bus-controller/templates/deployment.yaml b/kubernetes/dmaap/components/dmaap-bus-controller/templates/deployment.yaml index 4d009e9698..4d009e9698 100644 --- a/kubernetes/dmaap/charts/dmaap-bus-controller/templates/deployment.yaml +++ b/kubernetes/dmaap/components/dmaap-bus-controller/templates/deployment.yaml diff --git a/kubernetes/dmaap/charts/dmaap-bus-controller/templates/service.yaml b/kubernetes/dmaap/components/dmaap-bus-controller/templates/service.yaml index 4b51d44fa2..4b51d44fa2 100644 --- a/kubernetes/dmaap/charts/dmaap-bus-controller/templates/service.yaml +++ b/kubernetes/dmaap/components/dmaap-bus-controller/templates/service.yaml diff --git a/kubernetes/dmaap/charts/dmaap-bus-controller/values.yaml b/kubernetes/dmaap/components/dmaap-bus-controller/values.yaml index 47a6f8ddb9..aab6c237f3 100644 --- a/kubernetes/dmaap/charts/dmaap-bus-controller/values.yaml +++ b/kubernetes/dmaap/components/dmaap-bus-controller/values.yaml @@ -31,7 +31,7 @@ pullPolicy: Always # application images repository: nexus3.onap.org:10001 -image: onap/dmaap/buscontroller:1.0.26 +image: onap/dmaap/buscontroller:1.0.23 # application configuration diff --git a/kubernetes/dmaap/charts/dmaap-data-router/.helmignore b/kubernetes/dmaap/components/dmaap-dr-node/.helmignore index f0c1319444..f0c1319444 100644 --- a/kubernetes/dmaap/charts/dmaap-data-router/.helmignore +++ b/kubernetes/dmaap/components/dmaap-dr-node/.helmignore diff --git a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-node/Chart.yaml b/kubernetes/dmaap/components/dmaap-dr-node/Chart.yaml index 084aa58dc6..44bf9dfc80 100644 --- a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-node/Chart.yaml +++ b/kubernetes/dmaap/components/dmaap-dr-node/Chart.yaml @@ -15,4 +15,4 @@ apiVersion: v1 description: ONAP DMaaP Data Router Node Server name: dmaap-dr-node -version: 1.0 +version: 4.0.0 diff --git a/kubernetes/dmaap/components/dmaap-dr-node/requirements.yaml b/kubernetes/dmaap/components/dmaap-dr-node/requirements.yaml new file mode 100644 index 0000000000..0b6190657a --- /dev/null +++ b/kubernetes/dmaap/components/dmaap-dr-node/requirements.yaml @@ -0,0 +1,24 @@ +# +# ============LICENSE_START======================================================= +# Copyright (C) 2019 Nordix Foundation. +# ================================================================================ +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# SPDX-License-Identifier: Apache-2.0 +# ============LICENSE_END========================================================= +# + +dependencies: + - name: common + version: ~4.x-0 + repository: '@local' diff --git a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-node/resources/config/feeds/createFeed.sh b/kubernetes/dmaap/components/dmaap-dr-node/resources/config/feeds/createFeed.sh index 8899f1bca2..1289ecae86 100644 --- a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-node/resources/config/feeds/createFeed.sh +++ b/kubernetes/dmaap/components/dmaap-dr-node/resources/config/feeds/createFeed.sh @@ -1,6 +1,6 @@ #!/bin/sh -dr_prov_url="{{.Values.global.config.dmaapDrProv.name}}:{{.Values.global.config.dmaapDrProv.internalPort2}}" +dr_prov_url="{{.Values.config.dmaapDrProv.name}}:{{.Values.config.dmaapDrProv.internalPort2}}" ct_header="Content-Type:application/vnd.dmaap-dr.feed" obo_header="X-DMAAP-DR-ON-BEHALF-OF:dradmin" feed_payload=/opt/app/datartr/etc/dedicatedFeed.json diff --git a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-node/resources/config/feeds/dedicatedFeed.json b/kubernetes/dmaap/components/dmaap-dr-node/resources/config/feeds/dedicatedFeed.json index a96f46d528..a96f46d528 100644 --- a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-node/resources/config/feeds/dedicatedFeed.json +++ b/kubernetes/dmaap/components/dmaap-dr-node/resources/config/feeds/dedicatedFeed.json diff --git a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-node/resources/config/logback.xml b/kubernetes/dmaap/components/dmaap-dr-node/resources/config/logback.xml index 25a2c6e093..25a2c6e093 100644 --- a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-node/resources/config/logback.xml +++ b/kubernetes/dmaap/components/dmaap-dr-node/resources/config/logback.xml diff --git a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-node/resources/config/node.properties b/kubernetes/dmaap/components/dmaap-dr-node/resources/config/node.properties index 41062c77c8..2046dbfbf0 100644 --- a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-node/resources/config/node.properties +++ b/kubernetes/dmaap/components/dmaap-dr-node/resources/config/node.properties @@ -26,23 +26,23 @@ # URL to retrieve dynamic configuration # #ProvisioningURL: ${DRTR_PROV_INTURL} -ProvisioningURL=https://{{.Values.global.config.dmaapDrProv.name}}:{{.Values.global.config.dmaapDrProv.externalPort2}}/internal/prov +ProvisioningURL=https://{{.Values.config.dmaapDrProv.name}}:{{.Values.config.dmaapDrProv.externalPort2}}/internal/prov # # URL to upload PUB/DEL/EXP logs # #LogUploadURL: ${DRTR_LOG_URL} -LogUploadURL=https://{{.Values.global.config.dmaapDrProv.name}}:{{.Values.global.config.dmaapDrProv.externalPort2}}/internal/logs +LogUploadURL=https://{{.Values.config.dmaapDrProv.name}}:{{.Values.config.dmaapDrProv.externalPort2}}/internal/logs # # The port number for http as seen within the server # #IntHttpPort: ${DRTR_NODE_INTHTTPPORT:-8080} -IntHttpPort={{.Values.global.config.dmaapDrNode.internalPort}} +IntHttpPort={{.Values.config.dmaapDrNode.internalPort}} # # The port number for https as seen within the server # -IntHttpsPort={{.Values.global.config.dmaapDrNode.internalPort2}} +IntHttpsPort={{.Values.config.dmaapDrNode.internalPort2}} # # The external port number for https taking port mapping into account # @@ -83,11 +83,11 @@ KeyStoreFile=/opt/app/datartr/aaf_certs/org.onap.dmaap-dr.jks # # The password for the https keystore # -KeyStorePassword=4*&GD+w58RUM]01No.CYY;z6 +KeyStorePassword=]3V)($O&.Mv]W{f8^]6SxGNL # # The password for the private key in the https keystore # -KeyPassword=4*&GD+w58RUM]01No.CYY;z6 +KeyPassword=]3V)($O&.Mv]W{f8^]6SxGNL # # The type of truststore for https # @@ -99,7 +99,7 @@ TrustStoreFile=/opt/app/datartr/aaf_certs/org.onap.dmaap-dr.trust.jks # # The password for the https truststore # -TrustStorePassword=UDXlT6Iu[F)k,Htk92+B,0Xj +TrustStorePassword=(Rd,&{]%ePdp}4JZjqoJ2G+g # # The path to the file used to trigger an orderly shutdown # diff --git a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-node/templates/NOTES.txt b/kubernetes/dmaap/components/dmaap-dr-node/templates/NOTES.txt index 42d7663182..65597e062f 100644 --- a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-node/templates/NOTES.txt +++ b/kubernetes/dmaap/components/dmaap-dr-node/templates/NOTES.txt @@ -17,17 +17,17 @@ {{- range .Values.ingress.hosts }} http://{{ . }} {{- end }} -{{- else if contains "NodePort" .Values.global.config.dmaapDrNode.servicetype }} +{{- else if contains "NodePort" .Values.config.dmaapDrNode.servicetype }} export NODE_PORT=$(kubectl get --namespace {{ include "common.namespace" . }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "common.name" . }}) export NODE_IP=$(kubectl get nodes --namespace {{ include "common.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}") echo http://$NODE_IP:$NODE_PORT -{{- else if contains "LoadBalancer" .Values.global.config.dmaapDrNode.servicetype }} +{{- else if contains "LoadBalancer" .Values.config.dmaapDrNode.servicetype }} NOTE: It may take a few minutes for the LoadBalancer IP to be available. You can watch the status of by running 'kubectl get svc -w {{ include "common.name" . }}' export SERVICE_IP=$(kubectl get svc --namespace {{ include "common.namespace" . }} {{ include "common.name" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}') - echo http://$SERVICE_IP:{{.Values.global.config.dmaapDrNode.externalPort}} -{{- else if contains "ClusterIP" .Values.global.config.dmaapDrNode.servicetype }} + echo http://$SERVICE_IP:{{.Values.config.dmaapDrNode.externalPort}} +{{- else if contains "ClusterIP" .Values.config.dmaapDrNode.servicetype }} export POD_NAME=$(kubectl get pods --namespace {{ include "common.namespace" . }} -l "app={{ include "common.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") echo "Visit http://127.0.0.1:8080 to use your application" - kubectl port-forward $POD_NAME 8080:{{.Values.global.config.dmaapDrNode.internalPort}} + kubectl port-forward $POD_NAME 8080:{{.Values.config.dmaapDrNode.internalPort}} {{- end }}
\ No newline at end of file diff --git a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-node/templates/configmap.yaml b/kubernetes/dmaap/components/dmaap-dr-node/templates/configmap.yaml index 67392671f8..67392671f8 100644 --- a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-node/templates/configmap.yaml +++ b/kubernetes/dmaap/components/dmaap-dr-node/templates/configmap.yaml diff --git a/kubernetes/dmaap/components/dmaap-dr-node/templates/pv.yaml b/kubernetes/dmaap/components/dmaap-dr-node/templates/pv.yaml new file mode 100644 index 0000000000..016a6ea023 --- /dev/null +++ b/kubernetes/dmaap/components/dmaap-dr-node/templates/pv.yaml @@ -0,0 +1,61 @@ +{{/* + # ============LICENSE_START======================================================= + # Copyright (C) 2019 Nordix Foundation. + # ================================================================================ + # Licensed under the Apache License, Version 2.0 (the "License"); + # you may not use this file except in compliance with the License. + # You may obtain a copy of the License at + # + # http://www.apache.org/licenses/LICENSE-2.0 + # + # Unless required by applicable law or agreed to in writing, software + # distributed under the License is distributed on an "AS IS" BASIS, + # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + # See the License for the specific language governing permissions and + # limitations under the License. + # + # SPDX-License-Identifier: Apache-2.0 + # ============LICENSE_END========================================================= +*/}} + +kind: PersistentVolume +apiVersion: v1 +metadata: + name: {{ include "common.fullname" . }}-spool-data-pv + namespace: {{ include "common.namespace" . }} + labels: + app: {{ include "common.name" . }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" + name: {{ include "common.fullname" . }}-spool-data-pv +spec: + capacity: + storage: {{ .Values.persistence.spoolSize }} + accessModes: + - {{ .Values.persistence.accessMode }} + storageClassName: "{{ include "common.fullname" . }}-spool-data-stcl" + persistentVolumeReclaimPolicy: {{ .Values.persistence.volumeReclaimPolicy }} + hostPath: + path: {{ .Values.persistence.mountPath }}/{{ .Release.Name }}/{{ .Values.persistence.spoolMountSubPath }} +--- +kind: PersistentVolume +apiVersion: v1 +metadata: + name: {{ include "common.fullname" . }}-event-logs-pv + namespace: {{ include "common.namespace" . }} + labels: + app: {{ include "common.name" . }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" + name: {{ include "common.fullname" . }}-event-logs-pv +spec: + capacity: + storage: {{ .Values.persistence.eventLogSize }} + accessModes: + - {{ .Values.persistence.accessMode }} + storageClassName: "{{ include "common.fullname" . }}-event-logs-stcl" + persistentVolumeReclaimPolicy: {{ .Values.persistence.volumeReclaimPolicy }} + hostPath: + path: {{ .Values.persistence.mountPath }}/{{ .Release.Name }}/{{ .Values.persistence.eventLogsMountSubPath }}
\ No newline at end of file diff --git a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-node/templates/service.yaml b/kubernetes/dmaap/components/dmaap-dr-node/templates/service.yaml index e13e854d3b..b7207017da 100644 --- a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-node/templates/service.yaml +++ b/kubernetes/dmaap/components/dmaap-dr-node/templates/service.yaml @@ -15,7 +15,7 @@ apiVersion: v1 kind: Service metadata: - name: {{.Values.global.config.dmaapDrNode.name}} + name: {{.Values.config.dmaapDrNode.name}} namespace: {{ include "common.namespace" . }} labels: app: {{ include "common.name" . }} @@ -25,24 +25,24 @@ metadata: annotations: service.alpha.kubernetes.io/tolerate-unready-endpoints: "true" spec: - type: {{.Values.global.config.dmaapDrNode.servicetype}} + type: {{.Values.config.dmaapDrNode.servicetype}} ports: - {{if eq .Values.global.config.dmaapDrNode.servicetype "NodePort" -}} - - port: {{.Values.global.config.dmaapDrNode.externalPort}} - targetPort: {{.Values.global.config.dmaapDrNode.internalPort}} - nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{.Values.global.config.dmaapDrNode.nodePort}} - name: {{.Values.global.config.dmaapDrNode.name}} - - port: {{.Values.global.config.dmaapDrNode.externalPort2}} - targetPort: {{.Values.global.config.dmaapDrNode.internalPort2}} - nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{.Values.global.config.dmaapDrNode.nodePort2}} - name: {{.Values.global.config.dmaapDrNode.name}}2 + {{if eq .Values.config.dmaapDrNode.servicetype "NodePort" -}} + - port: {{.Values.config.dmaapDrNode.externalPort}} + targetPort: {{.Values.config.dmaapDrNode.internalPort}} + nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{.Values.config.dmaapDrNode.nodePort}} + name: {{.Values.config.dmaapDrNode.name}} + - port: {{.Values.config.dmaapDrNode.externalPort2}} + targetPort: {{.Values.config.dmaapDrNode.internalPort2}} + nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{.Values.config.dmaapDrNode.nodePort2}} + name: {{.Values.config.dmaapDrNode.name}}2 {{- else -}} - - port: {{.Values.global.config.dmaapDrNode.externalPort}} - targetPort: {{.Values.global.config.dmaapDrNode.internalPort}} - name: {{.Values.global.config.dmaapDrNode.name}} - - port: {{.Values.global.config.dmaapDrNode.externalPort2}} - targetPort: {{.Values.global.config.dmaapDrNode.internalPort2}} - name: {{.Values.global.config.dmaapDrNode.name}}2 + - port: {{.Values.config.dmaapDrNode.externalPort}} + targetPort: {{.Values.config.dmaapDrNode.internalPort}} + name: {{.Values.config.dmaapDrNode.name}} + - port: {{.Values.config.dmaapDrNode.externalPort2}} + targetPort: {{.Values.config.dmaapDrNode.internalPort2}} + name: {{.Values.config.dmaapDrNode.name}}2 {{- end}} selector: app: {{ include "common.name" . }} diff --git a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-node/templates/deployment.yaml b/kubernetes/dmaap/components/dmaap-dr-node/templates/statefulset.yaml index a06b3854c3..2c4b0de63b 100644 --- a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-node/templates/deployment.yaml +++ b/kubernetes/dmaap/components/dmaap-dr-node/templates/statefulset.yaml @@ -11,8 +11,8 @@ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. -apiVersion: extensions/v1beta1 -kind: Deployment +apiVersion: apps/v1beta1 +kind: StatefulSet metadata: name: {{ include "common.fullname" . }} namespace: {{ include "common.namespace" . }} @@ -23,13 +23,13 @@ metadata: heritage: {{ .Release.Service }} spec: replicas: {{ .Values.replicaCount }} + serviceName: {{ .Values.config.dmaapDrNode.name }} template: metadata: labels: app: {{ include "common.name" . }} release: {{ .Release.Name }} spec: - hostname: {{.Values.global.config.dmaapDrNode.name}} initContainers: - name: {{ include "common.name" . }}-readiness image: "{{ .Values.global.readinessRepository }}/{{ .Values.global.readinessImage }}" @@ -38,7 +38,7 @@ spec: - /root/ready.py args: - --container-name - - {{.Values.global.config.dmaapDrProv.name}} + - dmaap-dr-prov env: - name: NAMESPACE valueFrom: @@ -50,21 +50,25 @@ spec: image: "{{ include "common.repository" . }}/{{ .Values.image }}" imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} ports: - - containerPort: {{.Values.global.config.dmaapDrNode.externalPort}} - - containerPort: {{.Values.global.config.dmaapDrNode.externalPort2}} + - containerPort: {{.Values.config.dmaapDrNode.externalPort}} + - containerPort: {{.Values.config.dmaapDrNode.externalPort2}} {{- if eq .Values.liveness.enabled true }} livenessProbe: tcpSocket: - port: {{.Values.global.config.dmaapDrNode.internalPort}} + port: {{.Values.config.dmaapDrNode.internalPort}} initialDelaySeconds: {{ .Values.liveness.initialDelaySeconds }} periodSeconds: {{ .Values.liveness.periodSeconds }} {{ end -}} readinessProbe: tcpSocket: - port: {{.Values.global.config.dmaapDrNode.internalPort}} + port: {{.Values.config.dmaapDrNode.internalPort}} initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }} periodSeconds: {{ .Values.readiness.periodSeconds }} volumeMounts: + - mountPath: {{ .Values.persistence.spoolPath }} + name: {{ include "common.fullname" . }}-spool-data-pvc + - mountPath: {{ .Values.persistence.eventLogsPath }} + name: {{ include "common.fullname" . }}-event-logs-pvc - mountPath: /etc/localtime name: localtime readOnly: false @@ -77,13 +81,11 @@ spec: - mountPath: /opt/app/datartr/etc/node.properties subPath: node.properties name: node-props - - name: {{ include "common.fullname" . }}-logs - mountPath: {{ .Values.global.loggingDirectory }} lifecycle: postStart: exec: command: - - /opt/app/datartr/etc/createFeed.sh + - /opt/app/datartr/etc/createFeed.sh resources: {{ include "common.resources" . | indent 12 }} {{- if .Values.nodeSelector }} @@ -94,7 +96,6 @@ spec: affinity: {{ toYaml .Values.affinity | indent 10 }} {{- end }} - # Filebeat sidecar container - name: {{ include "common.name" . }}-filebeat-onap image: "{{ .Values.global.loggingRepository }}/{{ .Values.global.loggingImage }}" @@ -105,35 +106,55 @@ spec: subPath: filebeat.yml - name: {{ include "common.fullname" . }}-data-filebeat mountPath: /usr/share/filebeat/data - - name: {{ include "common.fullname" . }}-logs + - name: {{ include "common.fullname" . }}-event-logs-pvc mountPath: /var/log/onap/datarouter-node - volumes: - - name: localtime - hostPath: - path: /etc/localtime - - name: create-feed - configMap: - name: {{ include "common.fullname" . }}-create-feed-configmap - defaultMode: 0755 - - name: node-props - configMap: - name: {{ include "common.fullname" . }}-node-props-configmap - - name: dr-node-data - {{- if .Values.persistence.enabled }} - persistentVolumeClaim: - claimName: {{ include "common.fullname" . }} - {{- else }} - emptyDir: {} - {{- end }} - - name: {{ include "common.fullname" . }}-log-conf - configMap: - name: {{ include "common.fullname" . }}-log - - name: {{ include "common.fullname" . }}-filebeat-conf - configMap: - name: {{ .Release.Name }}-dmaap-filebeat-configmap - - name: {{ include "common.fullname" . }}-data-filebeat - emptyDir: {} - - name: {{ include "common.fullname" . }}-logs - emptyDir: {} imagePullSecrets: - name: "{{ include "common.namespace" . }}-docker-registry-key" + volumes: + - name: localtime + hostPath: + path: /etc/localtime + - name: create-feed + configMap: + name: {{ include "common.fullname" . }}-create-feed-configmap + defaultMode: 0755 + - name: node-props + configMap: + name: {{ include "common.fullname" . }}-node-props-configmap + - name: {{ include "common.fullname" . }}-log-conf + configMap: + name: {{ include "common.fullname" . }}-log + - name: {{ include "common.fullname" . }}-filebeat-conf + configMap: + name: {{ .Release.Name }}-dmaap-filebeat-configmap + - name: {{ include "common.fullname" . }}-data-filebeat + emptyDir: {} + - name: {{ include "common.fullname" . }}-event-logs-pvc + emptyDir: {} + volumeClaimTemplates: + - metadata: + name: {{ include "common.fullname" . }}-spool-data-pvc + labels: + name: {{ include "common.fullname" . }} + spec: + accessModes: [ {{ .Values.persistence.accessMode }} ] + storageClassName: {{ include "common.fullname" . }}-spool-data-stcl + resources: + requests: + storage: {{ .Values.persistence.spoolSize }} + selector: + matchLabels: + name: {{ include "common.fullname" . }}-spool-data-pv + - metadata: + name: {{ include "common.fullname" . }}-event-logs-pvc + labels: + name: {{ include "common.fullname" . }} + spec: + accessModes: [ {{ .Values.persistence.accessMode }} ] + storageClassName: {{ include "common.fullname" . }}-event-logs-stcl + resources: + requests: + storage: {{ .Values.persistence.eventLogSize }} + selector: + matchLabels: + name: {{ include "common.fullname" . }}-event-logs-pv diff --git a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-node/values.yaml b/kubernetes/dmaap/components/dmaap-dr-node/values.yaml index 610b577e06..f223026357 100644 --- a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-node/values.yaml +++ b/kubernetes/dmaap/components/dmaap-dr-node/values.yaml @@ -20,13 +20,14 @@ global: readinessImage: readiness-check:2.0.0 loggingRepository: docker.elastic.co loggingImage: beats/filebeat:5.5.0 + loggingDirectory: /opt/app/datartr/logs ################################################################# # Application configuration defaults. ################################################################# # application image repository: nexus3.onap.org:10001 -image: onap/dmaap/datarouter-node:2.0.0 +image: onap/dmaap/datarouter-node:2.0.1 pullPolicy: Always # flag to enable debugging - application support required @@ -55,7 +56,17 @@ readiness: ## Persist data to a persitent volume persistence: - enabled: false + volumeReclaimPolicy: Retain + accessMode: ReadWriteMany + mountPath: /dockerdata-nfs + + spoolMountSubPath: data-router/dr-node/spool-data + spoolSize: 1Gi + spoolPath: /opt/app/datartr/spool + + eventLogsMountSubPath: data-router/dr-node/event-logs + eventLogSize: 1Gi + eventLogsPath: /opt/app/datartr/logs ingress: enabled: false @@ -79,3 +90,21 @@ resources: cpu: 1000m memory: 2Gi unlimited: {} + +config: + # dr node server configuration + dmaapDrNode: + servicetype: ClusterIP + name: dmaap-dr-node + externalPort: 8080 + externalPort2: 8443 + internalPort: 8080 + internalPort2: 8443 + portName: dr-node-port + portName2: dr-node-port2 + +# dr provisioning server configuration + dmaapDrProv: + name: dmaap-dr-prov + externalPort2: 8443 + internalPort2: 8443 diff --git a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-node/.helmignore b/kubernetes/dmaap/components/dmaap-dr-prov/.helmignore index f0c1319444..f0c1319444 100644 --- a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-node/.helmignore +++ b/kubernetes/dmaap/components/dmaap-dr-prov/.helmignore diff --git a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-prov/Chart.yaml b/kubernetes/dmaap/components/dmaap-dr-prov/Chart.yaml index 591e9e011d..fd9a51a6ef 100644 --- a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-prov/Chart.yaml +++ b/kubernetes/dmaap/components/dmaap-dr-prov/Chart.yaml @@ -15,4 +15,4 @@ apiVersion: v1 description: ONAP DMaaP Data Router Provisioning Server name: dmaap-dr-prov -version: 1.0 +version: 4.0.0 diff --git a/kubernetes/dmaap/charts/dmaap-data-router/requirements.yaml b/kubernetes/dmaap/components/dmaap-dr-prov/requirements.yaml index 020808ed36..949b5bbdc6 100644 --- a/kubernetes/dmaap/charts/dmaap-data-router/requirements.yaml +++ b/kubernetes/dmaap/components/dmaap-dr-prov/requirements.yaml @@ -1,16 +1,22 @@ -# Copyright © 2017 Amdocs, Bell Canada # +# ============LICENSE_START======================================================= +# Copyright (C) 2019 Nordix Foundation. +# ================================================================================ # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # -# http://www.apache.org/licenses/LICENSE-2.0 +# http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. +# +# SPDX-License-Identifier: Apache-2.0 +# ============LICENSE_END========================================================= +# dependencies: - name: common @@ -19,5 +25,4 @@ dependencies: - name: mariadb-galera alias: mariadb version: ~4.x-0 - repository: '@local' - + repository: '@local'
\ No newline at end of file diff --git a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-prov/resources/config/logback.xml b/kubernetes/dmaap/components/dmaap-dr-prov/resources/config/logback.xml index 942d898695..942d898695 100644 --- a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-prov/resources/config/logback.xml +++ b/kubernetes/dmaap/components/dmaap-dr-prov/resources/config/logback.xml diff --git a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-prov/resources/config/provserver.properties b/kubernetes/dmaap/components/dmaap-dr-prov/resources/config/provserver.properties index dea4862acd..bb24d99dea 100644 --- a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-prov/resources/config/provserver.properties +++ b/kubernetes/dmaap/components/dmaap-dr-prov/resources/config/provserver.properties @@ -23,16 +23,16 @@ #Jetty Server properties -org.onap.dmaap.datarouter.provserver.http.port = {{.Values.global.config.dmaapDrProv.externalPort}} -org.onap.dmaap.datarouter.provserver.https.port = {{.Values.global.config.dmaapDrProv.externalPort2}} +org.onap.dmaap.datarouter.provserver.http.port = {{.Values.config.dmaapDrProv.externalPort}} +org.onap.dmaap.datarouter.provserver.https.port = {{.Values.config.dmaapDrProv.externalPort2}} org.onap.dmaap.datarouter.provserver.https.relaxation = true -org.onap.dmaap.datarouter.provserver.keymanager.password = Qgw77oaQcdP*F8Pwa[&.,.Ab +org.onap.dmaap.datarouter.provserver.keymanager.password = AT{];bvaDiytVD&oWhMZj0N5 org.onap.dmaap.datarouter.provserver.keystore.type = jks org.onap.dmaap.datarouter.provserver.keystore.path = /opt/app/datartr/aaf_certs/org.onap.dmaap-dr.jks -org.onap.dmaap.datarouter.provserver.keystore.password = Qgw77oaQcdP*F8Pwa[&.,.Ab +org.onap.dmaap.datarouter.provserver.keystore.password = AT{];bvaDiytVD&oWhMZj0N5 org.onap.dmaap.datarouter.provserver.truststore.path = /opt/app/datartr/aaf_certs/org.onap.dmaap-dr.trust.jks -org.onap.dmaap.datarouter.provserver.truststore.password = 9M?)?:KAj1z6gpLhNrVUG@0T +org.onap.dmaap.datarouter.provserver.truststore.password = ljlS@Y}0]{UO(TnwvEWkgJ%] org.onap.dmaap.datarouter.provserver.accesslog.dir = /opt/app/datartr/logs org.onap.dmaap.datarouter.provserver.spooldir = /opt/app/datartr/spool org.onap.dmaap.datarouter.provserver.dbscripts = /opt/app/datartr/etc/misc @@ -44,6 +44,6 @@ org.onap.dmaap.datarouter.provserver.isaddressauthenabled = false # Database access org.onap.dmaap.datarouter.db.driver = org.mariadb.jdbc.Driver -org.onap.dmaap.datarouter.db.url = jdbc:mariadb://{{.Values.global.config.dmaapDrDb.mariadbServiceName}}:{{.Values.global.config.dmaapDrDb.mariadbServicePort}}/datarouter +org.onap.dmaap.datarouter.db.url = jdbc:mariadb://{{.Values.config.dmaapDrDb.mariadbServiceName}}:{{.Values.config.dmaapDrDb.mariadbServicePort}}/datarouter org.onap.dmaap.datarouter.db.login = datarouter org.onap.dmaap.datarouter.db.password = datarouter diff --git a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-prov/templates/NOTES.txt b/kubernetes/dmaap/components/dmaap-dr-prov/templates/NOTES.txt index 64e6abf1d5..8d29cf9e66 100644 --- a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-prov/templates/NOTES.txt +++ b/kubernetes/dmaap/components/dmaap-dr-prov/templates/NOTES.txt @@ -17,17 +17,17 @@ {{- range .Values.ingress.hosts }} http://{{ . }} {{- end }} -{{- else if contains "NodePort" .Values.global.config.dmaapDrProv.servicetype }} +{{- else if contains "NodePort" .Values.config.dmaapDrProv.servicetype }} export NODE_PORT=$(kubectl get --namespace {{ include "common.namespace" . }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "common.name" . }}) export NODE_IP=$(kubectl get nodes --namespace {{ include "common.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}") echo http://$NODE_IP:$NODE_PORT -{{- else if contains "LoadBalancer" .Values.global.config.dmaapDrProv.servicetype }} +{{- else if contains "LoadBalancer" .Values.config.dmaapDrProv.servicetype }} NOTE: It may take a few minutes for the LoadBalancer IP to be available. You can watch the status of by running 'kubectl get svc -w {{ include "common.name" . }}' export SERVICE_IP=$(kubectl get svc --namespace {{ include "common.namespace" . }} {{ include "common.name" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}') - echo http://$SERVICE_IP:{{.Values.global.config.dmaapDrProv.externalPort}} -{{- else if contains "ClusterIP" .Values.global.config.dmaapDrProv.servicetype }} + echo http://$SERVICE_IP:{{.Values.config.dmaapDrProv.externalPort}} +{{- else if contains "ClusterIP" .Values.config.dmaapDrProv.servicetype }} export POD_NAME=$(kubectl get pods --namespace {{ include "common.namespace" . }} -l "app={{ include "common.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") echo "Visit http://127.0.0.1:8080 to use your application" - kubectl port-forward $POD_NAME 8080:{{.Values.global.config.dmaapDrProv.internalPort}} + kubectl port-forward $POD_NAME 8080:{{.Values.config.dmaapDrProv.internalPort}} {{- end }} diff --git a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-prov/templates/configmap.yaml b/kubernetes/dmaap/components/dmaap-dr-prov/templates/configmap.yaml index f9884d7827..f9884d7827 100644 --- a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-prov/templates/configmap.yaml +++ b/kubernetes/dmaap/components/dmaap-dr-prov/templates/configmap.yaml diff --git a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-prov/templates/deployment.yaml b/kubernetes/dmaap/components/dmaap-dr-prov/templates/deployment.yaml index c1035105b2..d2c653eb6f 100644 --- a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-prov/templates/deployment.yaml +++ b/kubernetes/dmaap/components/dmaap-dr-prov/templates/deployment.yaml @@ -29,13 +29,13 @@ spec: app: {{ include "common.name" . }} release: {{ .Release.Name }} spec: - hostname: {{.Values.global.config.dmaapDrProv.name}} + hostname: {{.Values.config.dmaapDrProv.name}} initContainers: - command: - /root/ready.py args: - --container-name - - {{.Values.global.config.dmaapDrDb.mariadbContName}} + - {{.Values.config.dmaapDrDb.mariadbContName}} env: - name: NAMESPACE valueFrom: @@ -50,18 +50,18 @@ spec: image: "{{ include "common.repository" . }}/{{ .Values.image }}" imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} ports: - - containerPort: {{.Values.global.config.dmaapDrProv.externalPort}} - - containerPort: {{.Values.global.config.dmaapDrProv.externalPort2}} + - containerPort: {{.Values.config.dmaapDrProv.externalPort}} + - containerPort: {{.Values.config.dmaapDrProv.externalPort2}} {{- if eq .Values.liveness.enabled true }} livenessProbe: tcpSocket: - port: {{.Values.global.config.dmaapDrProv.externalPort}} + port: {{.Values.config.dmaapDrProv.externalPort}} initialDelaySeconds: {{ .Values.liveness.initialDelaySeconds }} periodSeconds: {{ .Values.liveness.periodSeconds }} {{ end -}} readinessProbe: tcpSocket: - port: {{.Values.global.config.dmaapDrProv.externalPort}} + port: {{.Values.config.dmaapDrProv.externalPort}} initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }} periodSeconds: {{ .Values.readiness.periodSeconds }} volumeMounts: @@ -83,7 +83,6 @@ spec: affinity: {{ toYaml .Values.affinity | indent 10 }} {{- end }} - # Filebeat sidecar container - name: {{ include "common.name" . }}-filebeat-onap image: "{{ .Values.global.loggingRepository }}/{{ .Values.global.loggingImage }}" @@ -103,13 +102,6 @@ spec: - name: prov-props configMap: name: {{ include "common.fullname" . }}-prov-props-configmap - - name: dr-prov-data - {{- if .Values.persistence.enabled }} - persistentVolumeClaim: - claimName: {{ include "common.fullname" . }} - {{- else }} - emptyDir: {} - {{- end }} - name: {{ include "common.fullname" . }}-log-conf configMap: name: {{ include "common.fullname" . }}-log diff --git a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-prov/templates/service.yaml b/kubernetes/dmaap/components/dmaap-dr-prov/templates/service.yaml index 15059c6bcc..691c9dcc9f 100644 --- a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-prov/templates/service.yaml +++ b/kubernetes/dmaap/components/dmaap-dr-prov/templates/service.yaml @@ -15,7 +15,7 @@ apiVersion: v1 kind: Service metadata: - name: {{.Values.global.config.dmaapDrProv.name}} + name: {{.Values.config.dmaapDrProv.name}} namespace: {{ include "common.namespace" . }} labels: app: {{ include "common.name" . }} @@ -26,34 +26,34 @@ metadata: service.alpha.kubernetes.io/tolerate-unready-endpoints: "true" msb.onap.org/service-info: '[ { - "serviceName": "{{.Values.global.config.dmaapDrProv.name}}", + "serviceName": "{{.Values.config.dmaapDrProv.name}}", "version": "v1", "url": "/", "protocol": "REST", - "port": "{{.Values.global.config.dmaapDrProv.externalPort}}", + "port": "{{.Values.config.dmaapDrProv.externalPort}}", "visualRange":"1" } ]' spec: - type: {{.Values.global.config.dmaapDrProv.servicetype}} + type: {{.Values.config.dmaapDrProv.servicetype}} ports: - {{if eq .Values.global.config.dmaapDrProv.servicetype "NodePort" -}} - - port: {{.Values.global.config.dmaapDrProv.externalPort}} - targetPort: {{.Values.global.config.dmaapDrProv.internalPort}} - nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{.Values.global.config.dmaapDrProv.nodePort}} - name: {{.Values.global.config.dmaapDrProv.name}} - - port: {{.Values.global.config.dmaapDrProv.externalPort2}} - targetPort: {{.Values.global.config.dmaapDrProv.internalPort2}} - nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{.Values.global.config.dmaapDrProv.nodePort2}} - name: {{.Values.global.config.dmaapDrProv.name}}2 + {{if eq .Values.config.dmaapDrProv.servicetype "NodePort" -}} + - port: {{.Values.config.dmaapDrProv.externalPort}} + targetPort: {{.Values.config.dmaapDrProv.internalPort}} + nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{.Values.config.dmaapDrProv.nodePort}} + name: {{.Values.config.dmaapDrProv.name}} + - port: {{.Values.config.dmaapDrProv.externalPort2}} + targetPort: {{.Values.config.dmaapDrProv.internalPort2}} + nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{.Values.config.dmaapDrProv.nodePort2}} + name: {{.Values.config.dmaapDrProv.name}}2 {{- else -}} - - port: {{.Values.global.config.dmaapDrProv.externalPort}} - targetPort: {{.Values.global.config.dmaapDrProv.internalPort}} - name: {{.Values.global.config.dmaapDrProv.name}} - - port: {{.Values.global.config.dmaapDrProv.externalPort2}} - targetPort: {{.Values.global.config.dmaapDrProv.internalPort2}} - name: {{.Values.global.config.dmaapDrProv.name}}2 + - port: {{.Values.config.dmaapDrProv.externalPort}} + targetPort: {{.Values.config.dmaapDrProv.internalPort}} + name: {{.Values.config.dmaapDrProv.name}} + - port: {{.Values.config.dmaapDrProv.externalPort2}} + targetPort: {{.Values.config.dmaapDrProv.internalPort2}} + name: {{.Values.config.dmaapDrProv.name}}2 {{- end}} selector: app: {{ include "common.name" . }} diff --git a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-prov/values.yaml b/kubernetes/dmaap/components/dmaap-dr-prov/values.yaml index e9a966e0a7..9f08ad2958 100644 --- a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-prov/values.yaml +++ b/kubernetes/dmaap/components/dmaap-dr-prov/values.yaml @@ -21,13 +21,14 @@ global: readinessImage: readiness-check:2.0.0 loggingRepository: docker.elastic.co loggingImage: beats/filebeat:5.5.0 + loggingDirectory: /opt/app/datartr/logs ################################################################# # Application configuration defaults. ################################################################# # application image repository: nexus3.onap.org:10001 -image: onap/dmaap/datarouter-prov:2.0.0 +image: onap/dmaap/datarouter-prov:2.0.1 pullPolicy: Always # flag to enable debugging - application support required @@ -80,3 +81,41 @@ resources: cpu: 1000m memory: 2Gi unlimited: {} + +config: + # dr provisioning server configuration + dmaapDrProv: + servicetype: NodePort + name: dmaap-dr-prov + externalPort: 8080 + externalPort2: 8443 + internalPort: 8080 + internalPort2: 8443 + portName: dr-prov-port + portName2: dr-prov-port2 + nodePort: 59 + nodePort2: 69 + # dr-prov db configuration + dmaapDrDb: + mariadbServiceName: dmaap-dr-db-svc + mariadbServicePort: 3306 + mariadbContName: dmaap-dr-db + +# mariadb-galera configuration +mariadb: + name: dmaap-dr-db + nameOverride: dmaap-dr-db + replicaCount: 2 + config: + mariadbRootPassword: datarouter + userName: datarouter + userPassword: datarouter + mysqlDatabase: datarouter + service: + name: dmaap-dr-db-svc + portName: dmaap-dr-db-svc + nfsprovisionerPrefix: dmaap-dr-db + persistence: + size: 1Gi + mountSubPath: data-router/dr-db-data + disableNfsProvisioner: true
\ No newline at end of file diff --git a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-prov/.helmignore b/kubernetes/dmaap/components/message-router/.helmignore index f0c1319444..f0c1319444 100644 --- a/kubernetes/dmaap/charts/dmaap-data-router/charts/dmaap-dr-prov/.helmignore +++ b/kubernetes/dmaap/components/message-router/.helmignore diff --git a/kubernetes/dmaap/charts/message-router/Chart.yaml b/kubernetes/dmaap/components/message-router/Chart.yaml index 1a05378712..1a05378712 100644 --- a/kubernetes/dmaap/charts/message-router/Chart.yaml +++ b/kubernetes/dmaap/components/message-router/Chart.yaml diff --git a/kubernetes/dmaap/charts/message-router/.helmignore b/kubernetes/dmaap/components/message-router/charts/message-router-kafka/.helmignore index f0c1319444..f0c1319444 100644 --- a/kubernetes/dmaap/charts/message-router/.helmignore +++ b/kubernetes/dmaap/components/message-router/charts/message-router-kafka/.helmignore diff --git a/kubernetes/dmaap/charts/message-router/charts/message-router-kafka/Chart.yaml b/kubernetes/dmaap/components/message-router/charts/message-router-kafka/Chart.yaml index 0f7c27701d..0f7c27701d 100644 --- a/kubernetes/dmaap/charts/message-router/charts/message-router-kafka/Chart.yaml +++ b/kubernetes/dmaap/components/message-router/charts/message-router-kafka/Chart.yaml diff --git a/kubernetes/dmaap/charts/message-router/charts/message-router-kafka/templates/NOTES.txt b/kubernetes/dmaap/components/message-router/charts/message-router-kafka/templates/NOTES.txt index a44d0f76ee..a44d0f76ee 100644 --- a/kubernetes/dmaap/charts/message-router/charts/message-router-kafka/templates/NOTES.txt +++ b/kubernetes/dmaap/components/message-router/charts/message-router-kafka/templates/NOTES.txt diff --git a/kubernetes/dmaap/charts/message-router/charts/message-router-kafka/templates/poddisruptionbudget.yaml b/kubernetes/dmaap/components/message-router/charts/message-router-kafka/templates/poddisruptionbudget.yaml index 0bc64e7682..5c2db8c1e4 100644 --- a/kubernetes/dmaap/charts/message-router/charts/message-router-kafka/templates/poddisruptionbudget.yaml +++ b/kubernetes/dmaap/components/message-router/charts/message-router-kafka/templates/poddisruptionbudget.yaml @@ -24,5 +24,5 @@ metadata: spec: selector: matchLabels: - app: {{ include "common.fullname" . }} + app: {{ include "common.name" . }} maxUnavailable: 1 diff --git a/kubernetes/dmaap/charts/message-router/charts/message-router-kafka/templates/pv.yaml b/kubernetes/dmaap/components/message-router/charts/message-router-kafka/templates/pv.yaml index 44c9576abe..44c9576abe 100644 --- a/kubernetes/dmaap/charts/message-router/charts/message-router-kafka/templates/pv.yaml +++ b/kubernetes/dmaap/components/message-router/charts/message-router-kafka/templates/pv.yaml diff --git a/kubernetes/dmaap/charts/message-router/charts/message-router-kafka/templates/service.yaml b/kubernetes/dmaap/components/message-router/charts/message-router-kafka/templates/service.yaml index 88de96b2d5..88de96b2d5 100644 --- a/kubernetes/dmaap/charts/message-router/charts/message-router-kafka/templates/service.yaml +++ b/kubernetes/dmaap/components/message-router/charts/message-router-kafka/templates/service.yaml diff --git a/kubernetes/dmaap/charts/message-router/charts/message-router-kafka/templates/statefulset.yaml b/kubernetes/dmaap/components/message-router/charts/message-router-kafka/templates/statefulset.yaml index 163bbc23b6..163bbc23b6 100644 --- a/kubernetes/dmaap/charts/message-router/charts/message-router-kafka/templates/statefulset.yaml +++ b/kubernetes/dmaap/components/message-router/charts/message-router-kafka/templates/statefulset.yaml diff --git a/kubernetes/dmaap/charts/message-router/charts/message-router-kafka/values.yaml b/kubernetes/dmaap/components/message-router/charts/message-router-kafka/values.yaml index 6c121f9693..6c121f9693 100644 --- a/kubernetes/dmaap/charts/message-router/charts/message-router-kafka/values.yaml +++ b/kubernetes/dmaap/components/message-router/charts/message-router-kafka/values.yaml diff --git a/kubernetes/dmaap/charts/message-router/charts/message-router-kafka/.helmignore b/kubernetes/dmaap/components/message-router/charts/message-router-zookeeper/.helmignore index f0c1319444..f0c1319444 100644 --- a/kubernetes/dmaap/charts/message-router/charts/message-router-kafka/.helmignore +++ b/kubernetes/dmaap/components/message-router/charts/message-router-zookeeper/.helmignore diff --git a/kubernetes/dmaap/charts/message-router/charts/message-router-zookeeper/Chart.yaml b/kubernetes/dmaap/components/message-router/charts/message-router-zookeeper/Chart.yaml index a6a73b5d3d..a6a73b5d3d 100644 --- a/kubernetes/dmaap/charts/message-router/charts/message-router-zookeeper/Chart.yaml +++ b/kubernetes/dmaap/components/message-router/charts/message-router-zookeeper/Chart.yaml diff --git a/kubernetes/dmaap/charts/message-router/charts/message-router-zookeeper/templates/NOTES.txt b/kubernetes/dmaap/components/message-router/charts/message-router-zookeeper/templates/NOTES.txt index a44d0f76ee..a44d0f76ee 100644 --- a/kubernetes/dmaap/charts/message-router/charts/message-router-zookeeper/templates/NOTES.txt +++ b/kubernetes/dmaap/components/message-router/charts/message-router-zookeeper/templates/NOTES.txt diff --git a/kubernetes/dmaap/charts/message-router/charts/message-router-zookeeper/templates/poddisruptionbudget.yaml b/kubernetes/dmaap/components/message-router/charts/message-router-zookeeper/templates/poddisruptionbudget.yaml index 0bc64e7682..2d251e90b0 100644 --- a/kubernetes/dmaap/charts/message-router/charts/message-router-zookeeper/templates/poddisruptionbudget.yaml +++ b/kubernetes/dmaap/components/message-router/charts/message-router-zookeeper/templates/poddisruptionbudget.yaml @@ -24,5 +24,5 @@ metadata: spec: selector: matchLabels: - app: {{ include "common.fullname" . }} - maxUnavailable: 1 + app: {{ include "common.name" . }} + maxUnavailable: {{ div (sub .Values.replicaCount 1) 2 }} diff --git a/kubernetes/dmaap/charts/message-router/charts/message-router-zookeeper/templates/pv.yaml b/kubernetes/dmaap/components/message-router/charts/message-router-zookeeper/templates/pv.yaml index 44c9576abe..44c9576abe 100644 --- a/kubernetes/dmaap/charts/message-router/charts/message-router-zookeeper/templates/pv.yaml +++ b/kubernetes/dmaap/components/message-router/charts/message-router-zookeeper/templates/pv.yaml diff --git a/kubernetes/dmaap/charts/message-router/charts/message-router-zookeeper/templates/service.yaml b/kubernetes/dmaap/components/message-router/charts/message-router-zookeeper/templates/service.yaml index da494b0ba5..da494b0ba5 100644 --- a/kubernetes/dmaap/charts/message-router/charts/message-router-zookeeper/templates/service.yaml +++ b/kubernetes/dmaap/components/message-router/charts/message-router-zookeeper/templates/service.yaml diff --git a/kubernetes/dmaap/charts/message-router/charts/message-router-zookeeper/templates/statefulset.yaml b/kubernetes/dmaap/components/message-router/charts/message-router-zookeeper/templates/statefulset.yaml index 14f27949a7..14f27949a7 100644 --- a/kubernetes/dmaap/charts/message-router/charts/message-router-zookeeper/templates/statefulset.yaml +++ b/kubernetes/dmaap/components/message-router/charts/message-router-zookeeper/templates/statefulset.yaml diff --git a/kubernetes/dmaap/charts/message-router/charts/message-router-zookeeper/values.yaml b/kubernetes/dmaap/components/message-router/charts/message-router-zookeeper/values.yaml index 6eeafccb00..6eeafccb00 100644 --- a/kubernetes/dmaap/charts/message-router/charts/message-router-zookeeper/values.yaml +++ b/kubernetes/dmaap/components/message-router/charts/message-router-zookeeper/values.yaml diff --git a/kubernetes/dmaap/charts/message-router/requirements.yaml b/kubernetes/dmaap/components/message-router/requirements.yaml index a13c53da2c..a13c53da2c 100644 --- a/kubernetes/dmaap/charts/message-router/requirements.yaml +++ b/kubernetes/dmaap/components/message-router/requirements.yaml diff --git a/kubernetes/dmaap/charts/message-router/resources/config/dmaap/MsgRtrApi.properties b/kubernetes/dmaap/components/message-router/resources/config/dmaap/MsgRtrApi.properties index d40d2a1468..d40d2a1468 100755 --- a/kubernetes/dmaap/charts/message-router/resources/config/dmaap/MsgRtrApi.properties +++ b/kubernetes/dmaap/components/message-router/resources/config/dmaap/MsgRtrApi.properties diff --git a/kubernetes/dmaap/charts/message-router/resources/config/dmaap/cadi.properties b/kubernetes/dmaap/components/message-router/resources/config/dmaap/cadi.properties index a79bb8d40a..a79bb8d40a 100755 --- a/kubernetes/dmaap/charts/message-router/resources/config/dmaap/cadi.properties +++ b/kubernetes/dmaap/components/message-router/resources/config/dmaap/cadi.properties diff --git a/kubernetes/dmaap/charts/message-router/resources/config/dmaap/mykey b/kubernetes/dmaap/components/message-router/resources/config/dmaap/mykey index c2b8b8779b..c2b8b8779b 100755 --- a/kubernetes/dmaap/charts/message-router/resources/config/dmaap/mykey +++ b/kubernetes/dmaap/components/message-router/resources/config/dmaap/mykey diff --git a/kubernetes/dmaap/charts/message-router/templates/NOTES.txt b/kubernetes/dmaap/components/message-router/templates/NOTES.txt index a44d0f76ee..a44d0f76ee 100644 --- a/kubernetes/dmaap/charts/message-router/templates/NOTES.txt +++ b/kubernetes/dmaap/components/message-router/templates/NOTES.txt diff --git a/kubernetes/dmaap/charts/message-router/templates/configmap.yaml b/kubernetes/dmaap/components/message-router/templates/configmap.yaml index 1ed788893f..1ed788893f 100644 --- a/kubernetes/dmaap/charts/message-router/templates/configmap.yaml +++ b/kubernetes/dmaap/components/message-router/templates/configmap.yaml diff --git a/kubernetes/dmaap/charts/message-router/templates/secrets.yaml b/kubernetes/dmaap/components/message-router/templates/secrets.yaml index 023b5a1614..023b5a1614 100644 --- a/kubernetes/dmaap/charts/message-router/templates/secrets.yaml +++ b/kubernetes/dmaap/components/message-router/templates/secrets.yaml diff --git a/kubernetes/dmaap/charts/message-router/templates/service.yaml b/kubernetes/dmaap/components/message-router/templates/service.yaml index dfd90b28f2..dfd90b28f2 100644 --- a/kubernetes/dmaap/charts/message-router/templates/service.yaml +++ b/kubernetes/dmaap/components/message-router/templates/service.yaml diff --git a/kubernetes/dmaap/charts/message-router/templates/statefulset.yaml b/kubernetes/dmaap/components/message-router/templates/statefulset.yaml index bdd134ac64..bdd134ac64 100644 --- a/kubernetes/dmaap/charts/message-router/templates/statefulset.yaml +++ b/kubernetes/dmaap/components/message-router/templates/statefulset.yaml diff --git a/kubernetes/dmaap/charts/message-router/values.yaml b/kubernetes/dmaap/components/message-router/values.yaml index 5d01e55077..5d01e55077 100644 --- a/kubernetes/dmaap/charts/message-router/values.yaml +++ b/kubernetes/dmaap/components/message-router/values.yaml diff --git a/kubernetes/dmaap/requirements.yaml b/kubernetes/dmaap/requirements.yaml index fd35bf77f4..b5b9902276 100644 --- a/kubernetes/dmaap/requirements.yaml +++ b/kubernetes/dmaap/requirements.yaml @@ -17,3 +17,19 @@ dependencies: - name: common version: ~4.x-0 repository: '@local' + - name: message-router + version: ~4.x-0 + repository: 'file://components/message-router' + condition: message-router.enabled + - name: dmaap-bus-controller + version: ~4.x-0 + repository: 'file://components/dmaap-bus-controller' + condition: dmaap-bus-controller.enabled + - name: dmaap-dr-node + version: ~4.x-0 + repository: 'file://components/dmaap-dr-node' + condition: dmaap-dr-node.enabled + - name: dmaap-dr-prov + version: ~4.x-0 + repository: 'file://components/dmaap-dr-prov' + condition: dmaap-dr-prov.enabled diff --git a/kubernetes/dmaap/values.yaml b/kubernetes/dmaap/values.yaml index 8e33abff14..af39ede9d3 100644 --- a/kubernetes/dmaap/values.yaml +++ b/kubernetes/dmaap/values.yaml @@ -26,3 +26,12 @@ global: config: logstashServiceName: log-ls logstashPort: 5044 + +message-router: + enabled: true +dmaap-bus-controller: + enabled: true +dmaap-dr-node: + enabled: true +dmaap-dr-prov: + enabled: true
\ No newline at end of file diff --git a/kubernetes/policy/charts/drools/resources/config/opt/policy/config/drools/base.conf b/kubernetes/policy/charts/drools/resources/config/opt/policy/config/drools/base.conf index 3d1a591ac7..841aa3a6a7 100644 --- a/kubernetes/policy/charts/drools/resources/config/opt/policy/config/drools/base.conf +++ b/kubernetes/policy/charts/drools/resources/config/opt/policy/config/drools/base.conf @@ -20,7 +20,7 @@ JVM_OPTIONS=-server -Xms1024m -Xmx2048m POLICY_HOME=/opt/app/policy POLICY_LOGS=/var/log/onap/policy/pdpd -JAVA_HOME=/usr/lib/jvm/java-8-openjdk-amd64 +JAVA_HOME=/usr/lib/jvm/java-1.8-openjdk KEYSTORE_PASSWD=Pol1cy_0nap TRUSTSTORE_PASSWD=Pol1cy_0nap diff --git a/kubernetes/policy/charts/policy-common/resources/config/pe/base.conf b/kubernetes/policy/charts/policy-common/resources/config/pe/base.conf index 93dad89255..44e754b90b 100644 --- a/kubernetes/policy/charts/policy-common/resources/config/pe/base.conf +++ b/kubernetes/policy/charts/policy-common/resources/config/pe/base.conf @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -JAVA_HOME=/usr/lib/jvm/java-8-openjdk-amd64 +JAVA_HOME=/usr/lib/jvm/java-1.8-openjdk POLICY_HOME=/opt/app/policy POLICY_LOGS=/var/log/onap KEYSTORE_PASSWD=Pol1cy_0nap diff --git a/kubernetes/pomba/charts/pomba-aaictxbuilder/resources/config/application.properties b/kubernetes/pomba/charts/pomba-aaictxbuilder/resources/config/application.properties index 790707914d..e171d173aa 100644 --- a/kubernetes/pomba/charts/pomba-aaictxbuilder/resources/config/application.properties +++ b/kubernetes/pomba/charts/pomba-aaictxbuilder/resources/config/application.properties @@ -43,7 +43,7 @@ aai.readTimeout={{ .Values.config.aaiReadTimeout }} http.userId={{ .Values.config.httpUserId }} http.password={{ .Values.config.httpPassword }} -aai.searchNodeQuery=/aai/v13/search/nodes-query?search-node-type=service-instance&filter=service-instance-id:EQUALS: +aai.searchNodeQuery=/aai/v13/nodes/service-instance/{0} #Servlet context parameters server.context_parameters.p-name=value #context parameter with p-name as key and value as value. diff --git a/kubernetes/pomba/charts/pomba-sdncctxbuilder/resources/config/application.properties b/kubernetes/pomba/charts/pomba-sdncctxbuilder/resources/config/application.properties index 991c77df7c..455198223c 100644 --- a/kubernetes/pomba/charts/pomba-sdncctxbuilder/resources/config/application.properties +++ b/kubernetes/pomba/charts/pomba-sdncctxbuilder/resources/config/application.properties @@ -53,9 +53,7 @@ aai.readTimeout={{ .Values.config.aaiReadTimeout }} aai.http.userId={{ .Values.config.aaiHttpUserId }} aai.http.password={{ .Values.config.aaiHttpPassword }} -aai.searchNodeQuery=/aai/v13/search/nodes-query?search-node-type=service-instance&filter=service-instance-id:EQUALS: -aai.customerQuery=/aai/v13/business/customers/customer/ -aai.serviceInstancePath=/aai/v13/business/customers/customer/{0}/service-subscriptions/service-subscription/{1}/service-instances/service-instance/{2} +aai.serviceInstanceQuery=/aai/v13/nodes/service-instance/{0} # SDNC REST Client Configuration sdnc.serviceName={{ .Values.config.sdncServiceName }}.{{.Release.Namespace}} diff --git a/kubernetes/pomba/charts/pomba-servicedecomposition/resources/config/log/logback.xml b/kubernetes/pomba/charts/pomba-servicedecomposition/resources/config/log/logback.xml index 1f00cbddce..3b02684b68 100644 --- a/kubernetes/pomba/charts/pomba-servicedecomposition/resources/config/log/logback.xml +++ b/kubernetes/pomba/charts/pomba-servicedecomposition/resources/config/log/logback.xml @@ -1,30 +1,31 @@ -<configuration>
- <property name="p_tim" value="%d{"yyyy-MM-dd'T'HH:mm:ss.SSSXXX", UTC}"/>
- <property name="p_lvl" value="%level"/>
- <property name="p_log" value="%logger"/>
- <property name="p_mdc" value="%replace(%replace(%mdc){'\t','\\\\t'}){'\n', '\\\\n'}"/>
- <property name="p_msg" value="%replace(%replace(%msg){'\t', '\\\\t'}){'\n','\\\\n'}"/>
- <property name="p_exc" value="%replace(%replace(%rootException){'\t', '\\\\t'}){'\n','\\\\n'}"/>
- <!-- tabs -->
- <property name="p_mak" value="%replace(%replace(%marker){'\t', '\\\\t'}){'\n','\\\\n'}"/>
- <property name="p_thr" value="%thread"/>
- <property name="pattern" value="%nopexception${p_tim}\t${p_thr}\t${p_lvl}\t${p_log}\t${p_mdc}\t${p_msg}\t${p_exc}\t${p_mak}\t%n"/>
- <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
- <encoder>
- <pattern>${pattern}</pattern>
- </encoder>
- </appender>
- <appender name="FILE" class="ch.qos.logback.core.FileAppender">
- <file>output.log</file>
- <encoder>
- <pattern>${pattern}</pattern>
- </encoder>
- </appender>
- <logger level="INFO" name="org.onap.logging.ref.slf4j" additivity="false">
- <appender-ref ref="STDOUT" />
- <appender-ref ref="FILE" />
- </logger>
- <root level="INFO">
- <appender-ref ref="STDOUT" />
- </root>
-</configuration>
+<configuration> + <property name="p_tim" value="%d{"yyyy-MM-dd'T'HH:mm:ss.SSSXXX", UTC}"/> + <property name="p_lvl" value="%level"/> + <property name="p_log" value="%logger"/> + <property name="p_mdc" value="%replace(%replace(%mdc){'\t','\\\\t'}){'\n', '\\\\n'}"/> + <property name="p_msg" value="%replace(%replace(%msg){'\t', '\\\\t'}){'\n','\\\\n'}"/> + <property name="p_exc" value="%replace(%replace(%rootException){'\t', '\\\\t'}){'\n','\\\\n'}"/> + <!-- tabs --> + <property name="p_mak" value="%replace(%replace(%marker){'\t', '\\\\t'}){'\n','\\\\n'}"/> + <property name="p_thr" value="%thread"/> + <property name="pattern" value="%nopexception${p_tim}\t${p_thr}\t${p_lvl}\t${p_log}\t${p_mdc}\t${p_msg}\t${p_exc}\t${p_mak}\t%n"/> + <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender"> + <encoder> + <pattern>${pattern}</pattern> + </encoder> + </appender> + <appender name="FILE" class="ch.qos.logback.core.FileAppender"> + <file>logs/EELF/output.log</file> + <encoder> + <pattern>${pattern}</pattern> + </encoder> + </appender> + <logger level="INFO" name="org.onap.logging.ref.slf4j" additivity="false"> + <appender-ref ref="STDOUT" /> + <appender-ref ref="FILE" /> + </logger> + <root level="INFO"> + <appender-ref ref="STDOUT" /> + <appender-ref ref="FILE" /> + </root> +</configuration>
\ No newline at end of file diff --git a/kubernetes/portal/charts/portal-mariadb/resources/config/mariadb/oom_updates.sql b/kubernetes/portal/charts/portal-mariadb/resources/config/mariadb/oom_updates.sql index f34d247c88..e3fdb19778 100644 --- a/kubernetes/portal/charts/portal-mariadb/resources/config/mariadb/oom_updates.sql +++ b/kubernetes/portal/charts/portal-mariadb/resources/config/mariadb/oom_updates.sql @@ -72,4 +72,4 @@ update fn_app set app_username='Default', app_password='2VxipM8Z3SETg32m3Gp0FvKS -- vid update fn_app set app_username='Default', app_password='2VxipM8Z3SETg32m3Gp0FvKS6zZ2uCbCw46WDyK6T5E=', ueb_key='2Re7Pvdkgw5aeAUD', auth_central = 'Y' , auth_namespace = 'org.onap.vid' where app_id = 6; -- aai sparky -update fn_app set app_username='aaiui', app_password='4LK69amiIFtuzcl6Gsv97Tt7MLhzo03aoOx7dTvdjKQ=', ueb_key='ueb_key' where app_id = 7;
\ No newline at end of file +update fn_app set app_username='aaiui', app_password='4LK69amiIFtuzcl6Gsv97Tt7MLhzo03aoOx7dTvdjKQ=', ueb_key='ueb_key_7' where app_id = 7;
\ No newline at end of file diff --git a/kubernetes/so/charts/so-bpmn-infra/resources/config/overrides/override.yaml b/kubernetes/so/charts/so-bpmn-infra/resources/config/overrides/override.yaml index 929a37de0a..807bfaba0a 100755 --- a/kubernetes/so/charts/so-bpmn-infra/resources/config/overrides/override.yaml +++ b/kubernetes/so/charts/so-bpmn-infra/resources/config/overrides/override.yaml @@ -12,12 +12,16 @@ # See the License for the specific language governing permissions and # limitations under the License. aai: - auth: 65885E7C4E860E420808030D8BC653073E6782CB5026EC8F49E3E5C6F3E27F6A + auth: 221187EFA3AD4E33600DE0488F287099934CE65C3D0697BCECC00BB58E784E07CD74A24581DC31DBC086FF63DF116378776E9BE3D1325885 dme2: timeout: '30000' endpoint: https://aai.{{ include "common.namespace" . }}:8443 workflowAaiDistributionDelay: PT30S pnfEntryNotificationTimeout: P14D +cds: + endpoint: blueprints-processor + port: 9111 + auth: Basic Y2NzZGthcHBzOmNjc2RrYXBwcw== camunda: bpm: admin-user: @@ -72,7 +76,6 @@ mso: endpoint: http://so-request-db-adapter.{{ include "common.namespace" . }}:8083/services/RequestsDbAdapter po: auth: A3745B5DBE165EFCF101D85A6FC81C211AB8BF604F8861B6C413D5DC90F8F30E0139DE44B8A342F4EF70AF - password: 8B52F17C0E46591D4D1A5206825231FC9276B8382A7941A1E6659D31F1994B22B46356B8DB86 sdnc: endpoint: http://so-sdnc-adapter.{{ include "common.namespace" . }}:8086/adapters/SDNCAdapter rest: diff --git a/kubernetes/so/charts/so-openstack-adapter/resources/config/overrides/override.yaml b/kubernetes/so/charts/so-openstack-adapter/resources/config/overrides/override.yaml index ea9051e55c..592c390084 100755 --- a/kubernetes/so/charts/so-openstack-adapter/resources/config/overrides/override.yaml +++ b/kubernetes/so/charts/so-openstack-adapter/resources/config/overrides/override.yaml @@ -64,6 +64,7 @@ org: retrycount: 5 retryinterval: -15 retrylist: 408,429,500,502,503,504,900 + encryptionKey: 07a7159d3bf51a0e53be7a8f89699be7 tenant: default_keystone_url_version: /v2.0 default_keystone_reg_ex: "/[vV][0-9]" diff --git a/kubernetes/so/charts/so-sdc-controller/resources/config/overrides/override.yaml b/kubernetes/so/charts/so-sdc-controller/resources/config/overrides/override.yaml index f5672ebc1e..bee68e6470 100755 --- a/kubernetes/so/charts/so-sdc-controller/resources/config/overrides/override.yaml +++ b/kubernetes/so/charts/so-sdc-controller/resources/config/overrides/override.yaml @@ -32,11 +32,6 @@ request: username: ${DB_USERNAME} password: ${DB_PASSWORD} driver-class-name: org.mariadb.jdbc.Driver - dbcp2: - initial-size: 5 - max-total: 20 - validation-query: select 1 - test-on-borrow: true mso: msoKey: 07a7159d3bf51a0e53be7a8f89699be7 logPath: ./logs/sdc diff --git a/kubernetes/so/charts/so-sdnc-adapter/resources/config/overrides/override.yaml b/kubernetes/so/charts/so-sdnc-adapter/resources/config/overrides/override.yaml index e5bd11bf23..c313dd563c 100755 --- a/kubernetes/so/charts/so-sdnc-adapter/resources/config/overrides/override.yaml +++ b/kubernetes/so/charts/so-sdnc-adapter/resources/config/overrides/override.yaml @@ -100,22 +100,8 @@ org: changedelete: POST|270000|sdncurl6|sdnc-request-header|org:onap:sdnctl:vnf delete: POST|270000|sdncurl6|sdnc-request-header|org:onap:sdnctl:vnf rollback: POST|270000|sdncurl6|sdnc-request-header|org:onap:sdnctl:vnf - bpelauth: 5941FFEAA9F9E227EC924269B99503FB509A98271C7D2433C0D5B6E507307E1C1DC54BA69CCBD06C6F6D4DE81B4F416E + bpelauth: 4C18603C5AE7E3A42A6CED95CDF9C0BA9B2109B3725747662E5D34E5FDF63DA9ADEBB08185098F14699195FDE9475100 bpelurl: http://so-bpmn-infra.{{ include "common.namespace" . }}:8081/mso/SDNCAdapterCallbackService - gammainternet: - '': - query: GET|60000|sdncurl4|sdnc-request-header|com:att:sdnctl:firewallapi - service-configuration-operation: - activate: POST|90000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api - changeactivate: POST|60000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api - changedelete: POST|250000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api - changereserve: POST|60000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api - delete: POST|250000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api - reserve: POST|60000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api - turnup: POST|60000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api - svc-topology-operation: - assign: POST|60000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api - delete: POST|250000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api generic-resource: network-topology-operation: create: POST|270000|sdncurl10|sdnc-request-header|org:onap:sdnc:northbound:generic-resource @@ -153,7 +139,7 @@ org: myurl: http://so-sdnc-adapter{{ include "common.namespace" . }}:8086/adapters/rest/SDNCNotify rest: bpelurl: http://so-bpmn-infra.{{ include "common.namespace" . }}:8081/mso/WorkflowMessage - sdncauth: E2FF8D1140A1502DD3DC244825F1608ED0EA8F1B107E9C39C036B9E6D217D0968ECF42AB8C8955120C8386147A0C04934F3066304DC21B835ADB2970BE0D9E8271EF7E35424729BA71C0DAA871 + sdncauth: ED07A7EE5F099FA53369C3DF2240AD68A00154676EEDBC6F8C16BAA83B1912941B8941ABD48683D2C1072DA7040659692DE936A59BBF42A038CF71DE67B4A375190071EC76EA657801B033C135 sdncconnecttime: 5000 sdncurl10: 'http://sdnc.{{ include "common.namespace" . }}:8282/restconf/operations/GENERIC-RESOURCE-API:' sdncurl11: 'http://sdnc.{{ include "common.namespace" . }}:8282/restconf/operations/VNFTOPOLOGYAIC-API:' @@ -172,6 +158,8 @@ org: vfmodule: '': query: GET|60000|sdncurl12| + network: + encryptionKey: 07a7159d3bf51a0e53be7a8f89699be7 spring: security: usercredentials: diff --git a/kubernetes/so/charts/so-vfc-adapter/resources/config/overrides/override.yaml b/kubernetes/so/charts/so-vfc-adapter/resources/config/overrides/override.yaml index b06a975333..72a2f615d7 100755 --- a/kubernetes/so/charts/so-vfc-adapter/resources/config/overrides/override.yaml +++ b/kubernetes/so/charts/so-vfc-adapter/resources/config/overrides/override.yaml @@ -19,11 +19,6 @@ spring: url: jdbc:mariadb://${DB_HOST}:${DB_PORT}/requestdb username: ${DB_USERNAME} password: ${DB_PASSWORD} - dbcp2: - initial-size: 5 - max-total: 20 - validation-query: select 1 - test-on-borrow: true security: usercredentials: - username: bpel diff --git a/kubernetes/so/resources/config/overrides/override.yaml b/kubernetes/so/resources/config/overrides/override.yaml index 3b75e0c426..e4542a25b5 100755 --- a/kubernetes/so/resources/config/overrides/override.yaml +++ b/kubernetes/so/resources/config/overrides/override.yaml @@ -48,7 +48,7 @@ mso: count: 3 aai: endpoint: https://aai.{{ include "common.namespace" . }}:8443 - auth: 2CCB5208FA9CAA5B3039190D4846DD9E1B66F2F7442AE64EACBD3DA5249B8671F64BFC + auth: 6E081E10B1CA43A843E303733A74D9B23B601A6E22A21C7EF2C7F15A42F81A1A4E85E65268C2661F71321052C7F3E55B96A8E1E951F8BF6F so: operational-environment: dmaap: @@ -92,8 +92,10 @@ request: username: ${DB_USERNAME} password: ${DB_PASSWORD} driver-class-name: org.mariadb.jdbc.Driver - dbcp2: - initial-size: 5 - max-total: 20 - validation-query: select 1 - test-on-borrow: true +org: + onap: + so: + cloud-owner: onap + adapters: + network: + encryptionKey: 07a7159d3bf51a0e53be7a8f89699be7 |