aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2020-02-03Revert "Make cassandra service mesh compliant"Sylvain Desbureaux1-8/+0
This reverts commit 239bb3e18494584587ee1a6eb482f022b9e32d44. Reason for revert: mandatory template functions not merged yet Issue-ID: OOM-2252 Change-Id: I80444a7103e12aea4568f03ded08e348bba927fb Signed-off-by: Sylvain Desbureaux <sylvain.desbureaux@orange.com>
2020-02-02[COMMON] Make cassandra service mesh compliantSylvain Desbureaux1-0/+8
When service mesh is enabled, cassandra needs to listen to `127.0.0.1` instead of POD_IP but must broadcast using POD_IP. Change-Id: If96acd56a092a893f524a69ee83406c9cb70b3e7 Issue-ID: OOM-2252 Signed-off-by: Sylvain Desbureaux <sylvain.desbureaux@orange.com>
2020-02-02Merge "[Modeling] Move mariadb-galera to etsicatalog"Borislav Glozman6-39/+74
2020-02-02Merge "[APPC] Don't hardcode mariadb root password"Borislav Glozman6-26/+16
2020-02-02Merge "[COMMON] Don't create dummy mysql DB by default in a shared instance"Borislav Glozman1-2/+2
2020-02-02Merge "[COMMON] Allow to lint chart without master password"Borislav Glozman1-0/+3
2020-02-02Merge "[COMMON] Make network-name-gen use common secrets template"Borislav Glozman3-19/+15
2020-02-02Merge "[COMMON] Provide convenience templates for mariadb secrets"Borislav Glozman5-8/+45
2020-02-02Merge "[COMMON] Expose common.secret.genName template"Borislav Glozman1-9/+10
2020-02-02Merge "[COMMON] Allow to generate fullname based on passed chart name"Borislav Glozman1-1/+11
2020-02-02Merge "[COMMON] Allow to search secret by uid even if name is Overridden"Borislav Glozman1-3/+6
2020-02-02Merge "[COMMON] Use common secret template in mariadb-init"Borislav Glozman5-44/+54
2020-02-02Merge "Add ONAP core deployment type override"Borislav Glozman1-0/+134
2020-02-02Merge "release 1.7.0 APPC in Frankfurt"Borislav Glozman2-2/+2
2020-02-01[Modeling] Move mariadb-galera to etsicatalogKrzysztof Opasiak6-39/+74
etsicatalog is the only component inside modeling which use this DB thus there is no point to keep it outside of this component. Passwords and other bad stuff is left intentionally as this is just a first patch for this transition. Issue-ID: OOM-2286 Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com> Change-Id: I4f592b736a86c7acf9ee43b0f6e136e5f1506847
2020-02-01[APPC] Don't hardcode mariadb root passwordKrzysztof Opasiak6-26/+16
You should never ever assume that secretpassword is a production ready password for your mariadb-galera instance. Instead let's just share a secret with our instance of mariadb-galera. Issue-ID: OOM-2275 Change-Id: I25486ad81a2ec428dbbd379ab3529c84f55acc4b Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
2020-02-01[COMMON] Don't create dummy mysql DB by default in a shared instanceKrzysztof Opasiak1-2/+2
When deploying a shared mariadb-galera instance using common chart a dummy database is created based on the default values n the chart. This is obviously unnecessary and creates an obviousl security issue. That's why let's make sure that when we deploy a shared mariadb instance no dummy databases are created. Issue-ID: OOM-2053 Change-Id: I1130cb8eb555b15a2d8b365102d69e32259233eb Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
2020-02-01[COMMON] Allow to lint chart without master passwordKrzysztof Opasiak1-0/+3
When you type make in kubernetes directory all charts are linted. If one of them try to generate password whole linting process ends with an error because masterPassword has not been provided and there is no default value for it. To avoid this issue but still don't provide any default value whcih would be obviously insecure in this context, let's just test current release name. If it matches "testRelease" we treat whis as a special case and use predefined master key. Security implication: You should never, ever name your productional deployment "testRelease" nor use it as a master password. Issue-ID: OOM-2052 Change-Id: I7a2132e81f6910dfea562e8930c7eacd7aa7a00b Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
2020-02-01[COMMON] Make network-name-gen use common secrets templateKrzysztof Opasiak3-19/+15
For now we use it only for DB secret but in a future also other secrets should be replaced. Issue-ID: OOM-2249 Change-Id: Ie6515806c39c6a2cd94be378b5210156b78f4afb Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
2020-02-01[COMMON] Provide convenience templates for mariadb secretsKrzysztof Opasiak5-8/+45
Usage of plain strings is very fragile especially when you try to change them. That's why instead of depending on strings let's just define a few convenience templates to be used in projects that use mariadb-galera chart. Issue-ID: OOM-2249 Change-Id: Ib867d34090b06a15ea3898a9524f5e3d04a656c0 Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
2020-02-01[COMMON] Expose common.secret.genName templateKrzysztof Opasiak1-9/+10
This template used to be for internal use only but it turned out to be very useful in number of places so let's just expose it. Issue-ID: OOM-2249 Change-Id: I57cd31681fb5edb4ac95b0b7b2446a364ce826d2 Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
2020-02-01[COMMON] Allow to generate fullname based on passed chart nameKrzysztof Opasiak1-1/+11
By default common.fullname uses .Chart.Name or .Values.nameOverride to generate a "full name" used in many places. In some cases it may be convenient to be able to generate this full name for a specific, well known chart name. Issue-ID: OOM-2249 Change-Id: I68034c1c5df81ae9533f5f4bc6fab58f2416623a Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
2020-02-01[COMMON] Allow to search secret by uid even if name is OverriddenKrzysztof Opasiak1-3/+6
In some cases it is useful to bypass default policy for secret name generation and provide a custom name for a secret. In this case current search implementation got confused and couln't find a secret based on uid. This patch fixes the issue by comaring not only name but also uid. Issue-ID: OOM-2246 Change-Id: Iaea7a23fee09aa388968aad792ba7f7e1fbf2f21 Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
2020-02-01[COMMON] Use common secret template in mariadb-initKrzysztof Opasiak5-44/+54
Use common secret template for all passwords that are used inside this chart. Issue-ID: OOM-2248 Change-Id: Ia94b87a4d0316a3d334fd492521be5a255c14b4e Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com> Signed-off-by: Sylvain Desbureaux <sylvain.desbureaux@orange.com>
2020-02-01[ONAP-wide] Replace .Release.Name with common.releaseKrzysztof Opasiak604-1401/+1399
ONAP is too big to be deployed using helm install so we need to use a custom helm plugin helm deploy. This script deloys onap component by component instead of deploying evrything at once. Unfortunately this script also modifies the helm release by appending component name to it. As a result of this behavior our objects are called for example: onap-mariadb-galera-mariadb-galera-0 instead of just being called onap-mariadb-galera-0. This patch simplifies this naming convention by replacing all direct usages of .Release.Name with common.release macro which strips the component specific part from the release name. Issue-ID: OOM-2275 Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com> Change-Id: Ia8cead50d305adb00eef666d0a1ace74479b5183
2020-02-01Remove additional _helpers filesKrzysztof Opasiak4-67/+4
Helm by default creates some useful templates in _helpers.tpl file. This is fine for stand alone charts but when they become part of ONAP those helpers are no longer needed as our common components already provides all required functions Issue-ID: OOM-2278 Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com> Change-Id: I659e4b45b031e87cc87f7bbbb22bf9e23cd74e61
2020-01-30Update git submodulesMarco Platania1-0/+0
* Update kubernetes/robot from branch 'master' to 091f164a832479cb40ad6f5d7e4960269e75f87f - Merge "Adjust ETE runner for security tests" - Adjust ETE runner for security tests This patch adds gathering data which cannot be easily obtained from within "robot" pod (without granting it access to "kubectl" tool and as a side effect - cluster modifications). It introduces dependency to python3 on operator's machine (to convert "kubectl" tool filtered output to JSON). Issue-ID: SECCOM-261 Change-Id: Ie5057f65f79337896191b51cfad1b3e06623f80b Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
2020-01-30Merge "Revert "basic auth for so-monitoring""Morgan Richomme1-8/+0
2020-01-29Add ONAP core deployment type overridePawel Wieczorek1-0/+134
This patch makes heavy use of Orange accomplishments [1][2][3]. This deployment override will probably succeed "minimal-onap.yaml" used in e.g. "integration/bootstrap/vagrant-minimal-onap" setup. Cassandra replicaCount is increased to 3 to allow reaching quorum. [1] https://gitlab.com/Orange-OpenSource/lfn/onap/onap_oom_automatic_installation [2] https://wiki.lfnetworking.org/display/LN/Call%20for%20ONAP%20DDF%20Topics%20-%20Prague%202020#CallforONAPDDFTopics-Prague2020-OOM-IntroductionofServicemesh [3] https://wiki.lfnetworking.org/download/attachments/25364127/OOM%20Service%20Mesh%20Prague.pptx Issue-ID: ONAPARC-551 Change-Id: Ibaec41f088f11f7fb4e7c476f742d12d29c5740b Signed-off-by: Pawel Wieczorek <p.wieczorek2@samsung.com>
2020-01-29Merge changes Ia6344de1,I642bdc7aMorgan Richomme2-3/+3
* changes: VID: Update to version 6.0.2 (Frankfurt wave 1) VID logging adjustments to portal-sdk 2.6.0
2020-01-28Merge "Add VID to onap-vfw overrides"Morgan Richomme1-1/+3
2020-01-28Update git submodulesKrzysztof Opasiak1-0/+0
* Update kubernetes/aai from branch 'master' to f636b1cc2bf7d391dc76956e906a6f497ef1b092 - Remove space from file name Remove the awkward space from the file name and replace it with a dash. Issue-ID: OOM-2275 Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com> Change-Id: Ia0d55fae839d5ef865ac53659d93cbda5ba4212a
2020-01-27release 1.7.0 APPC in FrankfurtTaka Cho2-2/+2
Neon SR1 ODL version compliance APPC docker image released Issue-ID: APPC-1816 Change-Id: I8f6a04eab39e3876bffc232ad1329931711ba60b Signed-off-by: Taka Cho <takamune.cho@att.com>
2020-01-27VID: Update to version 6.0.2 (Frankfurt wave 1)Ittay Stern1-1/+1
Issue-ID: VID-716 Change-Id: Ia6344de1aa524d25a8818e18bfe693cacffc26c8 Signed-off-by: Ittay Stern <ittay.stern@att.com>
2020-01-27VID logging adjustments to portal-sdk 2.6.0Ittay Stern1-2/+2
Issue-ID: VID-253 Issue-ID: VID-471 Change-Id: I642bdc7a3926bf3be897f959aa1886617b2978d6 Signed-off-by: Ittay Stern <ittay.stern@att.com>
2020-01-26Merge "[AAF] Fix PVC for sshsm"Borislav Glozman1-3/+0
2020-01-26Merge "[COMMON] Fix PV/PVC for postgres"Borislav Glozman4-0/+13
2020-01-23Update git submodulesForsyth, James (jf2512)1-0/+0
* Update kubernetes/aai from branch 'master' to 69f85c4ba9f621e5f5172c0dd637048fe7ef3cfd - Update charts for released containers Issue-ID: AAI-2763 Change-Id: Ie005febc51040e1dd7fffb104171ee1ee2ccdd98 Signed-off-by: Forsyth, James (jf2512) <jf2512@att.com>
2020-01-23Merge "[COMMON] Add missing ! in db_init.sh script"Sylvain Desbureaux1-2/+2
2020-01-23[COMMON] Fix PV/PVC for postgresSylvain Desbureaux4-0/+13
When creating https://gerrit.onap.org/r/c/oom/+/99478, forgot to backport storage class part of https://gerrit.onap.org/r/c/oom/+/98962. Issue-ID: OOM-2234 Issue-ID: OOM-1227 Signed-off-by: Sylvain Desbureaux <sylvain.desbureaux@orange.com> Change-Id: I3c42b28ad5bea67eda004b0209c8a21783b539f1
2020-01-23[AAF] Fix PVC for sshsmSylvain Desbureaux1-3/+0
https://gerrit.onap.org/r/c/oom/+/98938 forgot to remove selectors for PVC and prevent it to work with storage class. Issue-ID: OOM-1227 Signed-off-by: Sylvain Desbureaux <sylvain.desbureaux@orange.com> Change-Id: Ieb45ecbe8c046d6c3bc72e47776df3c9d64de2e5
2020-01-22[COMMON] Add missing ! in db_init.sh scriptKrzysztof Opasiak1-2/+2
For some reason unknown to me I was stupid enough to forget to put ! in a front of variable name in the final vesion of script. Let's just quickly fix that so that not too many people notice;) Issue-ID: OOM-2248 Change-Id: I0b8891b94856b21f4b1fad1d6731c461bae2c1aa Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
2020-01-22Update git submodulesSylvain Desbureaux1-0/+0
* Update kubernetes/robot from branch 'master' to 4bd799e5dbcbf2131a685bf73319e962ace86f5c - Move Storage access to RWO Today when deploying Robot with OOM, the PersistentVolumeClaim needs the "ReadWriteMany" (or "RWX") capability. According to Kubernetes Documentation (https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes), ReadWriteMany stands for "the volume can be mounted as read-write by many nodes". That means that a particular PVC needs to be read and written from many pods. That also means that your code takes that into account and do the work to avoid write at the same place at the same time. An issue on RWX mode is that most "official" storage driver from Kubernetes doesn't support it (13 over the 19 drivers doesn't support it, espacially OpenStack, Amazon and Google storage classes). Robot PVC is used only for one Robot instance. Thus we don't need RWX. Issue-ID: INT-1230 Signed-off-by: Sylvain Desbureaux <sylvain.desbureaux@orange.com> Change-Id: I300e34a9d4be40b36153812d2a99c458cae6b2c9
2020-01-22Merge "aaf auto cert generation"Sylvain Desbureaux6-3/+108
2020-01-21aaf auto cert generationAgarwal, Ruchira (ra1926)6-3/+108
Add support for AAF init container for config and cert generation Issue-ID: SDNC-755 Signed-off-by: Agarwal, Ruchira (ra1926) <ra1926@att.com> Change-Id: I06ee7921b6dbb1b4b9ca64cf276a374256af3a45 Signed-off-by: Agarwal, Ruchira (ra1926) <ra1926@att.com>
2020-01-21Merge "Add CDS application properties for custom headers for aai calls"Sylvain Desbureaux1-0/+3
2020-01-21Merge "[COMMON] Improve mariadb-init job script"Sylvain Desbureaux2-17/+26
2020-01-21Merge "Update SO-VNFM-Adapter override.yaml for ETSI"Sylvain Desbureaux2-1/+10
2020-01-20Merge "[COMMON] Use deployment for postgresql"Mike Elliott36-9/+1894
2020-01-20Update git submodulesDaniel Rose1-0/+0
* Update kubernetes/robot from branch 'master' to 80a8b8c11d94af39ed26701dc10f2d3fc9e9a042 - Merge "Add ingress controler support to ROBOT" - Add ingress controler support to ROBOT Issue-ID: OOM-2186 Signed-off-by: Lucjan Bryndza <l.bryndza@samsung.com> Change-Id: Id6b6f6d1a5d9ea83f73b914509098f7711a6418a