2 # Copyright © 2020 Bell Canada, Samsung Electronics
4 # Licensed under the Apache License, Version 2.0 (the "License");
5 # you may not use this file except in compliance with the License.
6 # You may obtain a copy of the License at
8 # http://www.apache.org/licenses/LICENSE-2.0
10 # Unless required by applicable law or agreed to in writing, software
11 # distributed under the License is distributed on an "AS IS" BASIS,
12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 # See the License for the specific language governing permissions and
14 # limitations under the License.
19 {{- define "common.certInitializer._aafConfigVolumeName" -}}
20 {{ include "common.fullname" . }}-aaf-config
23 {{- define "common.certInitializer._aafAddConfigVolumeName" -}}
24 {{ print "aaf-add-config" }}
28 common templates to enable cert initialization for applictaions
30 In deployments/jobs/stateful include:
32 {{ include "common.certInitializer.initContainer" . | nindent XX }}
36 {{- include "common.certInitializer.volumeMount" . | nindent XX }}
38 {{- include "common.certInitializer.volume" . | nindent XX}}
40 {{- define "common.certInitializer._initContainer" -}}
41 {{- $dot := default . .dot -}}
42 {{- $initRoot := default $dot.Values.certInitializer .initRoot -}}
43 {{- $initName := default "certInitializer" -}}
44 {{- $subchartDot := fromJson (include "common.subChartDot" (dict "dot" $dot "initRoot" $initRoot)) }}
45 {{ include "common.readinessCheck.waitFor" $subchartDot }}
46 - name: {{ include "common.name" $dot }}-aaf-config
47 image: {{ include "common.repository" $subchartDot }}/{{ $subchartDot.Values.global.aafAgentImage }}
48 imagePullPolicy: {{ $subchartDot.Values.global.pullPolicy | default $subchartDot.Values.pullPolicy }}
50 - mountPath: {{ $initRoot.mountPath }}
51 name: {{ include "common.certInitializer._aafConfigVolumeName" $dot }}
52 - mountPath: /opt/app/aaf_config/cert/truststoreONAPall.jks.b64
54 subPath: truststoreONAPall.jks.b64
55 - mountPath: /opt/app/aaf_config/cert/truststoreONAP.p12.b64
57 subPath: truststoreONAP.p12.b64
58 {{- if $initRoot.aaf_add_config }}
59 - name: {{ include "common.certInitializer._aafAddConfigVolumeName" $dot }}
60 mountPath: /opt/app/aaf_config/bin/aaf-add-config.sh
61 subPath: aaf-add-config.sh
68 /opt/app/aaf_config/bin/agent.sh
69 {{- if $initRoot.aaf_add_config }}
70 /opt/app/aaf_config/bin/aaf-add-config.sh
74 value: "{{ $initRoot.fqi }}"
75 - name: aaf_locate_url
76 value: "https://aaf-locate.{{ $dot.Release.Namespace}}:8095"
77 - name: aaf_locator_container
79 - name: aaf_locator_container_ns
80 value: "{{ $dot.Release.Namespace }}"
81 - name: aaf_locator_fqdn
82 value: "{{ $initRoot.fqdn }}"
83 - name: aaf_locator_app_ns
84 value: "{{ $initRoot.app_ns }}"
86 {{- include "common.secret.envFromSecretFast" (dict "global" $subchartDot "uid" "deployer-creds" "key" "login") | indent 6 }}
87 - name: DEPLOY_PASSWORD
88 {{- include "common.secret.envFromSecretFast" (dict "global" $subchartDot "uid" "deployer-creds" "key" "password") | indent 6 }}
89 #Note: want to put this on Nodes, eventually
90 - name: cadi_longitude
91 value: "{{ default "52.3" $initRoot.cadi_longitude }}"
93 value: "{{ default "13.2" $initRoot.cadi_latitude }}"
94 #Hello specific. Clients don't don't need this, unless Registering with AAF Locator
95 - name: aaf_locator_public_fqdn
96 value: "{{ $initRoot.public_fqdn | default "" }}"
100 This init container will import custom .pem certificates to truststoreONAPall.jks
101 Custom certificates must be placed in common/certInitializer/resources directory.
103 The feature is enabled by setting Values.global.importCustomCertsEnabled = true
104 It can be used independently of aafEnabled, however it requires the same includes
105 as describe above for _initContainer.
107 When AAF is enabled the truststoreONAPAll.jks (which contains AAF CA) will be used
108 to import custom certificates, otherwise the default java keystore will be used.
110 The updated truststore file will be placed in /updatedTruststore and can be mounted per component
111 to a specific path by defining Values.certInitializer.truststoreMountpath (see _trustStoreVolumeMount)
112 The truststore file will be available to mount even if no custom certificates were imported.
114 {{- define "common.certInitializer._initImportCustomCertsContainer" -}}
115 {{- $dot := default . .dot -}}
116 {{- $initRoot := default $dot.Values.certInitializer .initRoot -}}
117 {{- $subchartDot := fromJson (include "common.subChartDot" (dict "dot" $dot "initRoot" $initRoot)) }}
118 - name: {{ include "common.name" $dot }}-import-custom-certs
119 image: {{ $subchartDot.Values.global.jreImage }}
120 imagePullPolicy: {{ $subchartDot.Values.global.pullPolicy | default $subchartDot.Values.pullPolicy }}
126 - /root/import-custom-certs.sh
129 value: "{{ $subchartDot.Values.global.aafEnabled }}"
130 - name: TRUSTSTORE_OUTPUT_FILENAME
131 value: "{{ $initRoot.truststoreOutputFileName }}"
132 - name: TRUSTSTORE_PASSWORD
133 {{- include "common.secret.envFromSecretFast" (dict "global" $subchartDot "uid" "truststore-creds" "key" "password") | indent 6 }}
136 name: aaf-agent-certs
137 - mountPath: /root/import-custom-certs.sh
138 name: aaf-agent-certs
139 subPath: import-custom-certs.sh
140 - mountPath: /updatedTruststore
141 name: updated-truststore
144 {{- define "common.certInitializer._volumeMount" -}}
145 {{- $dot := default . .dot -}}
146 {{- $initRoot := default $dot.Values.certInitializer .initRoot -}}
147 - mountPath: {{ $initRoot.appMountPath }}
148 name: {{ include "common.certInitializer._aafConfigVolumeName" $dot }}
152 This is used together with _initImportCustomCertsContainer
153 It mounts the updated truststore (with imported custom certificates) to the
154 truststoreMountpath defined in the values file for the component.
156 {{- define "common.certInitializer._trustStoreVolumeMount" -}}
157 {{- $dot := default . .dot -}}
158 {{- $initRoot := default $dot.Values.certInitializer .initRoot -}}
159 {{- if gt (len $initRoot.truststoreMountpath) 0 }}
160 - mountPath: {{ $initRoot.truststoreMountpath }}/{{ $initRoot.truststoreOutputFileName }}
161 name: updated-truststore
162 subPath: {{ $initRoot.truststoreOutputFileName }}
166 {{- define "common.certInitializer._volumes" -}}
167 {{- $dot := default . .dot -}}
168 {{- $initRoot := default $dot.Values.certInitializer .initRoot -}}
169 {{- $subchartDot := mergeOverwrite (deepCopy (omit $dot "Values")) (dict "Chart" (set (fromJson (toJson $dot.Chart)) "Name" $initRoot.nameOverride) "Values" (mergeOverwrite (deepCopy $initRoot) (dict "global" $dot.Values.global))) }}
170 - name: {{ include "common.certInitializer._aafConfigVolumeName" $dot }}
173 - name: aaf-agent-certs
175 name: {{ tpl $subchartDot.Values.certsCMName $subchartDot }}
178 {{- if $initRoot.aaf_add_config }}
179 - name: {{ include "common.certInitializer._aafAddConfigVolumeName" $dot }}
181 name: {{ include "common.fullname" $subchartDot }}-add-config
184 {{- if $dot.Values.global.importCustomCertsEnabled }}
185 - name: updated-truststore
190 {{- define "common.certInitializer.initContainer" -}}
191 {{- $dot := default . .dot -}}
192 {{- if $dot.Values.global.importCustomCertsEnabled }}
193 {{ include "common.certInitializer._initImportCustomCertsContainer" . }}
195 {{- if $dot.Values.global.aafEnabled }}
196 {{ include "common.certInitializer._initContainer" . }}
200 {{- define "common.certInitializer.volumeMount" -}}
201 {{- $dot := default . .dot -}}
202 {{- if $dot.Values.global.aafEnabled }}
203 {{- include "common.certInitializer._volumeMount" . }}
205 {{- if $dot.Values.global.importCustomCertsEnabled }}
206 {{- include "common.certInitializer._trustStoreVolumeMount" . }}
210 {{- define "common.certInitializer.volumes" -}}
211 {{- $dot := default . .dot -}}
212 {{- if or ($dot.Values.global.aafEnabled ) ($dot.Values.global.importCustomCertsEnabled) }}
213 {{- include "common.certInitializer._volumes" . }}