Alignment of VVP devkit

Alignment of VVP devkit

Change-Id: I7c6dae29faf0a14dce4d40114bd0bc4be8e23e42
Issue-ID: VVP-60
Signed-off-by: Areli, Fuss (af732p) <af732p@att.com>

20 files changed, 215 insertions, 90 deletions

diff --git a/ansible/roles/ansible-vvp-templates/files/configmaps/ci-configmap.yaml b/ansible/roles/ansible-vvp-templates/files/configmaps/ci-configmap.yaml
index 05c15d2..c7ea86d 100644
--- a/ansible/roles/ansible-vvp-templates/files/configmaps/ci-configmap.yaml
+++ b/ansible/roles/ansible-vvp-templates/files/configmaps/ci-configmap.yaml
@@ -68,6 +68,9 @@ data:
 
     ICE_ENVIRONMENT = os.environ['ICE_ENVIRONMENT']
     PROGRAM_NAME_URL_PREFIX = os.environ['PROGRAM_NAME_URL_PREFIX']
+    SERVICE_PROVIDER = os.environ['SERVICE_PROVIDER']
+    PROGRAM_NAME = os.environ['PROGRAM_NAME']
+    SERVICE_PROVIDER_DOMAIN = os.environ['SERVICE_PROVIDER_DOMAIN']
 
     # See https://docs.djangoproject.com/en/1.9/howto/deployment/checklist/
     SECRET_KEY = os.environ["SECRET_KEY"]
@@ -290,7 +293,7 @@ data:
     # ICE-CI Related Configuration
     #############################
     ICE_CONTACT_FROM_ADDRESS = os.getenv('ICE_CONTACT_FROM_ADDRESS')
-    ICE_CONTACT_EMAILS = list(os.getenv('ICE_CONTACT_EMAILS')
+    ICE_CONTACT_EMAILS = list(os.getenv('ICE_CONTACT_EMAILS','user@example.com').split(','))
     ICE_CI_ENVIRONMENT_NAME = os.getenv('ICE_CI_ENVIRONMENT_NAME', 'Dev') # Dev / Docker / Staging
     ICE_EM_URL = "{domain}/{prefix}".format(domain=os.environ['ICE_EM_DOMAIN_NAME'], prefix=PROGRAM_NAME_URL_PREFIX)
     ICE_PORTAL_URL = os.environ['ICE_DOMAIN']
diff --git a/ansible/roles/ansible-vvp-templates/files/configmaps/em-configmap.yaml b/ansible/roles/ansible-vvp-templates/files/configmaps/em-configmap.yaml
index 79ad7b2..467d219 100644
--- a/ansible/roles/ansible-vvp-templates/files/configmaps/em-configmap.yaml
+++ b/ansible/roles/ansible-vvp-templates/files/configmaps/em-configmap.yaml
@@ -93,7 +93,10 @@ data:
 
     ENVIRONMENT = os.environ['ENVIRONMENT']
     PROGRAM_NAME_URL_PREFIX = os.environ['PROGRAM_NAME_URL_PREFIX']
-
+    SERVICE_PROVIDER = os.environ['SERVICE_PROVIDER']
+    PROGRAM_NAME = os.environ['PROGRAM_NAME']
+    SERVICE_PROVIDER_DOMAIN = os.environ['SERVICE_PROVIDER_DOMAIN']
+    
     # See https://docs.djangoproject.com/en/1.9/howto/deployment/checklist/
     SECRET_KEY = os.environ["SECRET_KEY"]
 
@@ -305,7 +308,7 @@ data:
     # VVP Related Configuration
     #############################
     CONTACT_FROM_ADDRESS =  os.getenv('CONTACT_FROM_ADDRESS', 'dummy@example.com')
-    CONTACT_EMAILS = [s.strip() for s in os.getenv('CONTACT_EMAILS', 'dummy@example.com')
+    CONTACT_EMAILS = [s.strip() for s in os.getenv('CONTACT_EMAILS', 'user@example.com').split(',') if s]
     DOMAIN = os.getenv('EM_DOMAIN_NAME')
     TOKEN_EXPIRATION_IN_HOURS = 48
     DAILY_SCHEDULED_JOB_HOUR = 20
diff --git a/ansible/roles/ansible-vvp-templates/files/configmaps/imagescanner-configmap.yaml b/ansible/roles/ansible-vvp-templates/files/configmaps/imagescanner-configmap.yaml
new file mode 100644
index 0000000..23c2be8
--- /dev/null
+++ b/ansible/roles/ansible-vvp-templates/files/configmaps/imagescanner-configmap.yaml
@@ -0,0 +1,28 @@
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: imagescanner-settings
+  namespace: default
+data:
+  imagescannerconfig.py: |
+    import os
+    from pathlib import Path
+    from awsauth import S3Auth
+    # A mapping from host names to Requests Authentication Objects; see
+    # http://docs.python-requests.org/en/master/user/authentication/
+    AUTHS = {}
+    if 'S3_HOST' in os.environ:
+        AUTHS[os.environ['S3_HOST']] = S3Auth(
+            os.environ['AWS_ACCESS_KEY_ID'],
+            os.environ['AWS_SECRET_ACCESS_KEY'],
+            service_url='https://%s/' % os.environ['S3_HOST']
+            )
+    LOGS_PATH = Path(os.environ['IMAGESCANNER_LOGS_PATH'])
+    STATUSFILE = LOGS_PATH/'status.txt'
+    # A dict passed as kwargs to jenkins.Jenkins constructor.
+    JENKINS = {
+      'url': 'http://jenkins:8080',
+      'username': 'admin',
+      'password': os.environ['SECRET_JENKINS_PASSWORD'],
+      }
diff --git a/ansible/roles/ansible-vvp-templates/files/configmaps/portal-nginx-configmap.yaml b/ansible/roles/ansible-vvp-templates/files/configmaps/portal-nginx-configmap.yaml
deleted file mode 100644
index 4d0e4e8..0000000
--- a/ansible/roles/ansible-vvp-templates/files/configmaps/portal-nginx-configmap.yaml
+++ /dev/null
@@ -1,66 +0,0 @@
-# -*- encoding: utf-8 -*- 
-# ============LICENSE_START======================================================= 
-# org.onap.vvp/engagementmgr
-# ===================================================================
-# Copyright © 2017 AT&T Intellectual Property. All rights reserved.
-# ===================================================================
-#
-# Unless otherwise specified, all software contained herein is licensed
-# under the Apache License, Version 2.0 (the “License”);
-# you may not use this software except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#             http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-#
-#
-# Unless otherwise specified, all documentation contained herein is licensed
-# under the Creative Commons License, Attribution 4.0 Intl. (the “License”);
-# you may not use this documentation except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#             https://creativecommons.org/licenses/by/4.0/
-#
-# Unless required by applicable law or agreed to in writing, documentation
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# ============LICENSE_END============================================
-#
-# ECOMP is a trademark and service mark of AT&T Intellectual Property.
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: portal-nginx-config
-  namespace: default
-data:
-  file: |
-    pid /nginx.pid;
-    error_log  /dev/stdout warn;
-
-    http {
-      access_log /dev/stdout;
-      server {
-        listen 0.0.0.0:8181;
-
-        location / {
-        include /etc/nginx/mime.types;
-        root /usr/share/nginx/html/;
-        }
-
-      }
-
-    }
-
-    events {
-        worker_connections  4096;
-    }
diff --git a/ansible/roles/ansible-vvp-templates/tasks/render.yml b/ansible/roles/ansible-vvp-templates/tasks/render.yml
index ec6900d..aed9593 100644
--- a/ansible/roles/ansible-vvp-templates/tasks/render.yml
+++ b/ansible/roles/ansible-vvp-templates/tasks/render.yml
@@ -55,7 +55,6 @@
     dest: "{{k8_config_dir}}/{{item|dirname|basename}}/{{item|basename|splitext|first}}"
   with_fileglob:
     - ../templates/configmaps/*
-    - ../templates/jobs/*
     - ../templates/deployments/*
     - ../templates/secrets/*
     - ../templates/services/*
diff --git a/ansible/roles/ansible-vvp-templates/templates/configmaps/haproxy-cfg-configmap.yaml.j2 b/ansible/roles/ansible-vvp-templates/templates/configmaps/haproxy-cfg-configmap.yaml.j2
index 3fd9055..8b9012c 100644
--- a/ansible/roles/ansible-vvp-templates/templates/configmaps/haproxy-cfg-configmap.yaml.j2
+++ b/ansible/roles/ansible-vvp-templates/templates/configmaps/haproxy-cfg-configmap.yaml.j2
@@ -95,7 +95,7 @@ data:
    frontend portal
        mode http
        redirect scheme https if !{ ssl_fc }
-       acl is_api_call path_beg -i /ice
+       acl is_api_call path_beg -i /vvp
        acl is_s3       hdr_beg(host) s3.  staging-s3.  dev-s3.
        use_backend api if is_api_call
        use_backend s3 if is_s3
diff --git a/ansible/roles/ansible-vvp-templates/templates/configmaps/portal-nginx-configmap.yaml.j2 b/ansible/roles/ansible-vvp-templates/templates/configmaps/portal-nginx-configmap.yaml.j2
new file mode 100644
index 0000000..34cc2d3
--- /dev/null
+++ b/ansible/roles/ansible-vvp-templates/templates/configmaps/portal-nginx-configmap.yaml.j2
@@ -0,0 +1,39 @@
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: portal-nginx-config
+  namespace: default
+data:
+  file: |
+    pid /nginx.pid;
+    error_log  /dev/stdout warn;
+
+    http {
+      access_log /dev/stdout;
+      server {
+        listen 0.0.0.0:8181;
+
+        location / {
+        include /etc/nginx/mime.types;
+        root /usr/share/nginx/html/;
+        }
+
+      }
+
+    }
+
+    events {
+        worker_connections  4096;
+    }
+
+  service_provider.json: |
+    {
+      "serviceProvider": {
+          "name": "{{service_provider}}"
+      },
+      "program": {
+          "name": "{{program_name}}"
+      }
+    }
+
diff --git a/ansible/roles/ansible-vvp-templates/templates/configmaps/site-certificate-configmap.yaml.j2 b/ansible/roles/ansible-vvp-templates/templates/configmaps/site-certificate-configmap.yaml.j2
new file mode 100644
index 0000000..2d56741
--- /dev/null
+++ b/ansible/roles/ansible-vvp-templates/templates/configmaps/site-certificate-configmap.yaml.j2
@@ -0,0 +1,30 @@
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: site-certificate
+  namespace: default
+data:
+  site.crt: |
+    {{ site_pem_cert|indent }}
+  wrapper.sh: |
+    #!/bin/sh
+    # This script is meant to be used as a wrapper, so that it can be easily
+    # used with docker or kubernetes' container command specification.
+    #
+    # Kubernetes' volumeMount creates symlinks for configMapped files at the
+    # target directory.
+    # Alpine's update-ca-certificates ignores symlinks.
+    # So we must contrive to copy the contents of the mounted cert (a symlink)
+    # into place as a normal file.
+    dev_cert="${0%/*}/site.crt"
+    echo >&2 "$0: Checking for site CA certificate at $dev_cert..."
+    if [ -s "$dev_cert" ]; then
+        echo >&2 "$0: Updating container CA certificate bundle with site certificate..."
+        cp -L "$dev_cert" /usr/local/share/ca-certificates/
+        update-ca-certificates
+    else
+        echo >&2 "$0: No site CA certificate found."
+    fi
+    echo >&2 "$0: Launching command: $@"
+    exec "$@"
diff --git a/ansible/roles/ansible-vvp-templates/templates/deployments/10-gitlab-deployment.yaml.j2 b/ansible/roles/ansible-vvp-templates/templates/deployments/10-gitlab-deployment.yaml.j2
index 6771b1f..8b14661 100644
--- a/ansible/roles/ansible-vvp-templates/templates/deployments/10-gitlab-deployment.yaml.j2
+++ b/ansible/roles/ansible-vvp-templates/templates/deployments/10-gitlab-deployment.yaml.j2
@@ -48,9 +48,11 @@ spec:
       labels:
         run: gitlab
     spec:
+      imagePullSecrets:
+      - name: onapkey
       containers:
       - name: gitlab
-        image: {{container_uri}}rkt-gitlab:{{container_tag}}
+        image: {{container_uri}}gitlab:{{container_tag}}
         ports:
         - containerPort: 80
         - containerPort: 22
diff --git a/ansible/roles/ansible-vvp-templates/templates/deployments/10-postgresql-deployment.yaml.j2 b/ansible/roles/ansible-vvp-templates/templates/deployments/10-postgresql-deployment.yaml.j2
index e78bfc9..bd5c10f 100644
--- a/ansible/roles/ansible-vvp-templates/templates/deployments/10-postgresql-deployment.yaml.j2
+++ b/ansible/roles/ansible-vvp-templates/templates/deployments/10-postgresql-deployment.yaml.j2
@@ -48,9 +48,11 @@ spec:
       labels:
         run: postgresql
     spec:
+      imagePullSecrets:
+      - name: onapkey
       containers:
       - name: postgresql
-        image: {{container_uri}}rkt-postgresql:{{container_tag}}
+        image: {{container_uri}}postgresql:{{container_tag}}
         ports:
         - containerPort: 5432
         volumeMounts:
diff --git a/ansible/roles/ansible-vvp-templates/templates/deployments/20-ci-uwsgi-deployment.yaml.j2 b/ansible/roles/ansible-vvp-templates/templates/deployments/20-ci-uwsgi-deployment.yaml.j2
index 98a04b5..1846ad5 100644
--- a/ansible/roles/ansible-vvp-templates/templates/deployments/20-ci-uwsgi-deployment.yaml.j2
+++ b/ansible/roles/ansible-vvp-templates/templates/deployments/20-ci-uwsgi-deployment.yaml.j2
@@ -57,9 +57,11 @@ spec:
         hostPath:
           path: /var/devenv/ice-ci/
 {% endif %}
+      imagePullSecrets:
+      - name: onapkey
       containers:
       - name: ci-uwsgi
-        image: {{container_uri}}rkt-ice-ci:{{container_tag}}
+        image: {{container_uri}}test-engine:{{container_tag}}
         ports:
         - containerPort: 80
         - containerPort: 8282
@@ -77,7 +79,13 @@ spec:
         - name: ICE_ENVIRONMENT
           value: "{{ice_environment}}"
         - name: PROGRAM_NAME_URL_PREFIX
-          value: "ice"
+          value: "{{program_name_url_prefix}}"
+        - name: SERVICE_PROVIDER
+          value: "{{service_provider}}"
+        - name: PROGRAM_NAME
+          value: "{{program_name}}"
+        - name: SERVICE_PROVIDER_DOMAIN
+          value: "{{service_provider_domain}}"
         - name: SECRET_KEY
           valueFrom:
             secretKeyRef: {name: em-secret, key: key}
diff --git a/ansible/roles/ansible-vvp-templates/templates/deployments/20-cms-uwsgi-deployment.yaml.j2 b/ansible/roles/ansible-vvp-templates/templates/deployments/20-cms-uwsgi-deployment.yaml.j2
index 8b601e9..6217054 100644
--- a/ansible/roles/ansible-vvp-templates/templates/deployments/20-cms-uwsgi-deployment.yaml.j2
+++ b/ansible/roles/ansible-vvp-templates/templates/deployments/20-cms-uwsgi-deployment.yaml.j2
@@ -44,9 +44,11 @@ metadata:
 spec:
   template:
     spec:
+      imagePullSecrets:
+      - name: onapkey
       containers:
       - name: cms-uwsgi
-        image: {{container_uri}}rkt-ice-cms:{{container_tag}}
+        image: {{container_uri}}cms:{{container_tag}}
         ports:
         - containerPort: 80
         - containerPort: 9000
diff --git a/ansible/roles/ansible-vvp-templates/templates/deployments/20-em-uwsgi-deployment.yaml.j2 b/ansible/roles/ansible-vvp-templates/templates/deployments/20-em-uwsgi-deployment.yaml.j2
index 8cedd29..a97bcc7 100644
--- a/ansible/roles/ansible-vvp-templates/templates/deployments/20-em-uwsgi-deployment.yaml.j2
+++ b/ansible/roles/ansible-vvp-templates/templates/deployments/20-em-uwsgi-deployment.yaml.j2
@@ -56,9 +56,11 @@ spec:
       - name: em-settings
         configMap:
           name: em-settings
+      imagePullSecrets:
+      - name: onapkey
       containers:
       - name: em-uwsgi
-        image: {{container_uri}}rkt-engagementmgr:{{container_tag}}
+        image: {{container_uri}}engagementmgr:{{container_tag}}
         ports:
         - containerPort: 80
         - containerPort: 9000
@@ -75,7 +77,13 @@ spec:
         - name: ENVIRONMENT
           value: "{{ice_environment}}"
         - name: PROGRAM_NAME_URL_PREFIX
-          value: "ice"
+          value: "{{program_name_url_prefix}}"
+        - name: SERVICE_PROVIDER
+          value: "{{service_provider}}"
+        - name: PROGRAM_NAME
+          value: "{{program_name}}"
+        - name: SERVICE_PROVIDER_DOMAIN
+          value: "{{service_provider_domain}}"
         - name: SECRET_KEY
           valueFrom:
             secretKeyRef: {name: em-secret, key: key}
diff --git a/ansible/roles/ansible-vvp-templates/templates/deployments/20-imagescanner.yaml.j2 b/ansible/roles/ansible-vvp-templates/templates/deployments/20-imagescanner.yaml.j2
index 775d341..b8f2f66 100644
--- a/ansible/roles/ansible-vvp-templates/templates/deployments/20-imagescanner.yaml.j2
+++ b/ansible/roles/ansible-vvp-templates/templates/deployments/20-imagescanner.yaml.j2
@@ -44,11 +44,16 @@ metadata:
 spec:
   template:
     spec:
+      imagePullSecrets:
+      - name: onapkey
 
       containers:
       - name: imagescanner-worker
-        image: {{container_uri}}ice-image-scanner:{{container_tag}}
-        command: ["/usr/local/bin/imagescanner-worker"]
+        image: {{container_uri}}image-scanner:{{container_tag}}
+        command:
+        - "sh"
+        - "/opt/site-certificate/wrapper.sh"
+        - "/usr/local/bin/imagescanner-worker"
         securityContext:
           privileged: true
         volumeMounts:
@@ -58,9 +63,30 @@ spec:
           mountPath: /dev
         - name: logs
           mountPath: /var/log/imagescanner
+        - name: imagescanner-settings
+          mountPath: /opt/imagescanner-settings
+        - name: site-certificate
+          mountPath: /opt/site-certificate
+        env:
+        - name: PYTHONPATH
+          value: /opt/imagescanner-settings
+        - name: S3_HOST
+          value: "{{s3_dns_name}}"
+        - name: S3_PORT
+          value: "443"
+        - name: AWS_ACCESS_KEY_ID
+          valueFrom:
+            secretKeyRef: {name: em-secret, key: aws_access_key_id}
+        - name: AWS_SECRET_ACCESS_KEY
+          valueFrom:
+            secretKeyRef: {name: em-secret, key: aws_secret_access_key}
+        - name: SECRET_JENKINS_PASSWORD
+          value: ''
+        - name: REQUESTS_CA_BUNDLE
+          value: /etc/ssl/certs/ca-certificates.crt
 
       - name: notifications-worker
-        image: {{container_uri}}ice-image-scanner:{{container_tag}}
+        image: {{container_uri}}image-scanner:{{container_tag}}
         command: ["/usr/local/bin/notifications-worker"]
         securityContext:
           privileged: true
@@ -70,9 +96,17 @@ spec:
             secretKeyRef: {name: slack-tokens, key: notifications}
         - name: DOMAIN
           value: "{{em_internal_dns_name}}"
+        - name: PYTHONPATH
+          value: /opt/imagescanner-settings
+        - name: SECRET_JENKINS_PASSWORD
+          valueFrom:
+            secretKeyRef: {name: em-secret, key: jenkins_admin_password}
+        volumeMounts:
+        - name: imagescanner-settings
+          mountPath: /opt/imagescanner-settings
 
       - name: imagescanner-frontend
-        image: {{container_uri}}ice-image-scanner:{{container_tag}}
+        image: {{container_uri}}image-scanner:{{container_tag}}
         command: ["/usr/local/bin/imagescanner-frontend"]
         {#
             FIXME: No, the frontend does not require a privileged container.
@@ -87,9 +121,13 @@ spec:
         volumeMounts:
         - name: logs
           mountPath: /var/log/imagescanner
+        - name: imagescanner-settings
+          mountPath: /opt/imagescanner-settings
         env:
         - name: DEFAULT_SLACK_CHANNEL
           value: "#notifications"
+        - name: SECRET_JENKINS_PASSWORD
+          value: ''
 
       volumes:
       - name: imagescanner-ssh
@@ -101,6 +139,12 @@ spec:
           path: /dev
       - name: logs
         emptyDir: {}
+      - name: imagescanner-settings
+        configMap:
+          name: imagescanner-settings
+      - name: site-certificate
+        configMap:
+          name: site-certificate
 
     metadata:
       labels:
diff --git a/ansible/roles/ansible-vvp-templates/templates/deployments/20-jenkins-deployment.yaml.j2 b/ansible/roles/ansible-vvp-templates/templates/deployments/20-jenkins-deployment.yaml.j2
index 61504f1..1b4289a 100644
--- a/ansible/roles/ansible-vvp-templates/templates/deployments/20-jenkins-deployment.yaml.j2
+++ b/ansible/roles/ansible-vvp-templates/templates/deployments/20-jenkins-deployment.yaml.j2
@@ -44,9 +44,11 @@ metadata:
 spec:
   template:
     spec:
+      imagePullSecrets:
+      - name: onapkey
       containers:
       - name: jenkins
-        image: {{container_uri}}rkt-jenkins:{{container_tag}}
+        image: {{container_uri}}jenkins:{{container_tag}}
         ports:
         - containerPort: 8080
         volumeMounts:
diff --git a/ansible/roles/ansible-vvp-templates/templates/deployments/30-portal-deployment.yaml.j2 b/ansible/roles/ansible-vvp-templates/templates/deployments/30-portal-deployment.yaml.j2
index f3505e5..5c898d3 100644
--- a/ansible/roles/ansible-vvp-templates/templates/deployments/30-portal-deployment.yaml.j2
+++ b/ansible/roles/ansible-vvp-templates/templates/deployments/30-portal-deployment.yaml.j2
@@ -48,9 +48,11 @@ spec:
       labels:
         run: portal
     spec:
+      imagePullSecrets:
+      - name: onapkey
       containers:
       - name: portal
-        image: {{container_uri}}rkt-ice-portal:{{container_tag}}
+        image: {{container_uri}}portal:{{container_tag}}
         ports:
         - containerPort: 8181
         command: ["nginx", "-g", "daemon off;", "-c", "/tmp/nginx.conf"]
@@ -68,3 +70,10 @@ spec:
           items:
           - key: file
             path: nginx.conf
+          - key: service_provider.json
+            path: service_provider.json
+{% if devenv is defined %}
+      - name: portal-rsync
+        hostPath:
+          path: /var/devenv/rkt-ice-portal/d2ice.att.io/app
+{% endif %}
diff --git a/ansible/roles/ansible-vvp-templates/templates/secrets/email-secret.yaml.j2 b/ansible/roles/ansible-vvp-templates/templates/secrets/email-secret.yaml.j2
index 29d1319..41597d6 100644
--- a/ansible/roles/ansible-vvp-templates/templates/secrets/email-secret.yaml.j2
+++ b/ansible/roles/ansible-vvp-templates/templates/secrets/email-secret.yaml.j2
@@ -37,10 +37,11 @@
 #
 # ECOMP is a trademark and service mark of AT&T Intellectual Property.
 ---
-apiVersion: v1
 kind: Secret
+apiVersion: v1
 metadata:
   name: email-secret
+  namespace: default
 type: Opaque
 data:
-  password: "{{vault_email_host_password | b64encode }}"
+  password: "{{vault_email_host_password|b64encode}}"
diff --git a/ansible/roles/ansible-vvp-templates/templates/secrets/onap-secret.yaml.j2 b/ansible/roles/ansible-vvp-templates/templates/secrets/onap-secret.yaml.j2
new file mode 100644
index 0000000..f253c3c
--- /dev/null
+++ b/ansible/roles/ansible-vvp-templates/templates/secrets/onap-secret.yaml.j2
@@ -0,0 +1,9 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: onapkey
+  namespace: default
+data:
+  .dockercfg: {{ dockerconfig|to_json|b64encode }}
+type: kubernetes.io/dockercfg
diff --git a/ansible/roles/ansible-vvp-templates/templates/secrets/site-crt-secret.yaml.j2 b/ansible/roles/ansible-vvp-templates/templates/secrets/site-crt-secret.yaml.j2
index f529dcf..1f92c42 100644
--- a/ansible/roles/ansible-vvp-templates/templates/secrets/site-crt-secret.yaml.j2
+++ b/ansible/roles/ansible-vvp-templates/templates/secrets/site-crt-secret.yaml.j2
@@ -37,11 +37,12 @@
 #
 # ECOMP is a trademark and service mark of AT&T Intellectual Property.
 ---
-apiVersion: v1
 kind: Secret
+apiVersion: v1
 metadata:
   name: site-crt
+  namespace: default
 type: Opaque
 data:
   # the public part of the certificate, not actually a secret.
-  site.crt: "{{ site_pem_cert | b64encode }}"
+  site.crt: "{{site_pem_cert|b64encode}}"
diff --git a/ansible/roles/ansible-vvp-templates/templates/secrets/site-pem-secret.yaml.j2 b/ansible/roles/ansible-vvp-templates/templates/secrets/site-pem-secret.yaml.j2
index d045770..7ed5e26 100644
--- a/ansible/roles/ansible-vvp-templates/templates/secrets/site-pem-secret.yaml.j2
+++ b/ansible/roles/ansible-vvp-templates/templates/secrets/site-pem-secret.yaml.j2
@@ -37,10 +37,11 @@
 #
 # ECOMP is a trademark and service mark of AT&T Intellectual Property.
 ---
-apiVersion: v1
 kind: Secret
+apiVersion: v1
 metadata:
   name: site-pem
+  namespace: default
 type: Opaque
 data:
-  site.pem: "{{ site_pem | b64encode }}"
+  site.pem: "{{site_pem|b64encode}}"