Merge changes from topic "disabletca"

* changes:
  [DCAEMOD] Guilin updates for SECCOM and other enhancements
  [DCAE] Exclude TCA/cdap from bootstrap

diff --git a/kubernetes/aai b/kubernetes/aai
index 46961c4..5071da2 160000 (submodule)
--- a/kubernetes/aai
+++ b/kubernetes/aai
@@ -1 +1 @@
-Subproject commit 46961c4794a17f72643bd491af6c159ea7e53380
+Subproject commit 5071da297b9e7f58c796bad7d4ae1e3415a039c4

diff --git a/kubernetes/common/certInitializer/resources/import-custom-certs.sh b/kubernetes/common/certInitializer/resources/import-custom-certs.sh
new file mode 100755 (executable)
index 0000000..dd31183
--- /dev/null
+++ b/kubernetes/common/certInitializer/resources/import-custom-certs.sh
@@ -0,0 +1,61 @@
+#!/bin/bash
+
+# Copyright © 2020 Bell Canada
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+CERTS_DIR=${CERTS_DIR:-/certs}
+WORK_DIR=${WORK_DIR:-/updatedTruststore}
+ONAP_TRUSTSTORE=${ONAP_TRUSTSTORE:-truststoreONAPall.jks}
+JRE_TRUSTSTORE=${JRE_TRUSTSTORE:-$JAVA_HOME/lib/security/cacerts}
+TRUSTSTORE_OUTPUT_FILENAME=${TRUSTSTORE_OUTPUT_FILENAME:-truststore.jks}
+
+mkdir -p $WORK_DIR
+
+# Decrypt and move relevant files to WORK_DIR
+for f in $CERTS_DIR/*; do
+  if [[ $AAF_ENABLED == false ]] && [[ $f == *$ONAP_TRUSTSTORE* ]]; then
+    # Dont use onap truststore when aaf is disabled
+    continue
+  fi
+  if [[ $f == *.sh ]]; then
+    continue
+  fi
+  if [[ $f == *.b64 ]]
+    then
+      base64 -d $f > $WORK_DIR/`basename $f .b64`
+    else
+      cp $f $WORK_DIR/.
+  fi
+done
+
+# Prepare truststore output file
+if [[ $AAF_ENABLED == true ]]
+  then
+    mv $WORK_DIR/$ONAP_TRUSTSTORE $WORK_DIR/$TRUSTSTORE_OUTPUT_FILENAME
+  else
+    echo "AAF is disabled, using JRE truststore"
+    cp $JRE_TRUSTSTORE $WORK_DIR/$TRUSTSTORE_OUTPUT_FILENAME
+fi
+
+# Import Custom Certificates
+for f in $WORK_DIR/*; do
+  if [[ $f == *.pem ]]; then
+    echo "importing certificate: $f"
+    keytool -import -file $f -alias `basename $f` -keystore $WORK_DIR/$TRUSTSTORE_OUTPUT_FILENAME -storepass $TRUSTSTORE_PASSWORD -noprompt
+    if [[ $? != 0 ]]; then
+      echo "failed importing certificate: $f"
+      exit 1
+    fi
+  fi
+done

diff --git a/kubernetes/common/certInitializer/templates/_certInitializer.yaml b/kubernetes/common/certInitializer/templates/_certInitializer.yaml
index 1250c12..c453f11 100644 (file)
--- a/kubernetes/common/certInitializer/templates/_certInitializer.yaml
+++ b/kubernetes/common/certInitializer/templates/_certInitializer.yaml
@@ -1,5 +1,5 @@
 {{/*
-# Copyright © 2020 Samsung Electronics
+# Copyright © 2020 Bell Canada, Samsung Electronics
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -96,6 +96,51 @@
       value: "{{ $initRoot.public_fqdn | default "" }}"
 {{- end -}}
 
+{{/*
+  This init container will import custom .pem certificates to truststoreONAPall.jks
+  Custom certificates must be placed in common/certInitializer/resources directory.
+
+  The feature is enabled by setting Values.global.importCustomCertsEnabled = true
+  It can be used independently of aafEnabled, however it requires the same includes
+  as describe above for _initContainer.
+
+  When AAF is enabled the truststoreONAPAll.jks (which contains AAF CA) will be used
+  to import custom certificates, otherwise the default java keystore will be used.
+
+  The updated truststore file will be placed in /updatedTruststore and can be mounted per component
+  to a specific path by defining Values.certInitializer.truststoreMountpath (see _trustStoreVolumeMount)
+  The truststore file will be available to mount even if no custom certificates were imported.
+*/}}
+{{- define "common.certInitializer._initImportCustomCertsContainer" -}}
+{{-   $dot := default . .dot -}}
+{{-   $initRoot := default $dot.Values.certInitializer .initRoot -}}
+{{- $subchartDot := fromJson (include "common.subChartDot" (dict "dot" $dot "initRoot" $initRoot)) }}
+- name: {{ include "common.name" $dot }}-import-custom-certs
+  image: {{ $subchartDot.Values.global.jreImage }}
+  imagePullPolicy: {{ $subchartDot.Values.global.pullPolicy | default $subchartDot.Values.pullPolicy }}
+  securityContext:
+    runAsUser: 0
+  command:
+    - /bin/bash
+    - -c
+    - /root/import-custom-certs.sh
+  env:
+    - name: AAF_ENABLED
+      value: "{{  $subchartDot.Values.global.aafEnabled }}"
+    - name: TRUSTSTORE_OUTPUT_FILENAME
+      value: "{{ $initRoot.truststoreOutputFileName }}"
+    - name: TRUSTSTORE_PASSWORD
+    {{- include "common.secret.envFromSecretFast" (dict "global" $subchartDot "uid" "truststore-creds" "key" "password") | indent 6 }}
+  volumeMounts:
+    - mountPath: /certs
+      name: aaf-agent-certs
+    - mountPath: /root/import-custom-certs.sh
+      name: aaf-agent-certs
+      subPath: import-custom-certs.sh
+    - mountPath: /updatedTruststore
+      name: updated-truststore
+{{- end -}}
+
 {{- define "common.certInitializer._volumeMount" -}}
 {{-   $dot := default . .dot -}}
 {{-   $initRoot := default $dot.Values.certInitializer .initRoot -}}
@@ -103,6 +148,21 @@
   name: {{ include "common.certInitializer._aafConfigVolumeName" $dot }}
 {{- end -}}
 
+{{/*
+  This is used together with _initImportCustomCertsContainer
+  It mounts the updated truststore (with imported custom certificates) to the
+  truststoreMountpath defined in the values file for the component.
+*/}}
+{{- define "common.certInitializer._trustStoreVolumeMount" -}}
+{{-   $dot := default . .dot -}}
+{{-   $initRoot := default $dot.Values.certInitializer .initRoot -}}
+{{- if gt (len $initRoot.truststoreMountpath) 0 }}
+- mountPath: {{ $initRoot.truststoreMountpath }}/{{ $initRoot.truststoreOutputFileName }}
+  name: updated-truststore
+  subPath: {{ $initRoot.truststoreOutputFileName }}
+{{- end -}}
+{{- end -}}
+
 {{- define "common.certInitializer._volumes" -}}
 {{-   $dot := default . .dot -}}
 {{-   $initRoot := default $dot.Values.certInitializer .initRoot -}}
@@ -121,10 +181,17 @@
     name: {{ include "common.fullname" $subchartDot }}-add-config
     defaultMode: 0700
 {{-     end -}}
+{{-     if $dot.Values.global.importCustomCertsEnabled }}
+- name: updated-truststore
+  emptyDir: {}
+{{-     end -}}
 {{- end -}}
 
 {{- define "common.certInitializer.initContainer" -}}
 {{-   $dot := default . .dot -}}
+  {{- if $dot.Values.global.importCustomCertsEnabled }}
+    {{ include "common.certInitializer._initImportCustomCertsContainer" . }}
+  {{- end -}}
   {{- if $dot.Values.global.aafEnabled }}
     {{ include "common.certInitializer._initContainer" . }}
   {{- end -}}
@@ -135,11 +202,14 @@
   {{- if $dot.Values.global.aafEnabled }}
     {{- include "common.certInitializer._volumeMount" . }}
   {{- end -}}
+  {{- if $dot.Values.global.importCustomCertsEnabled }}
+    {{- include "common.certInitializer._trustStoreVolumeMount" . }}
+  {{- end -}}
 {{- end -}}
 
 {{- define "common.certInitializer.volumes" -}}
 {{-   $dot := default . .dot -}}
-  {{- if $dot.Values.global.aafEnabled }}
+  {{- if or ($dot.Values.global.aafEnabled ) ($dot.Values.global.importCustomCertsEnabled) }}
     {{- include "common.certInitializer._volumes" . }}
   {{- end -}}
 {{- end -}}

diff --git a/kubernetes/common/certInitializer/values.yaml b/kubernetes/common/certInitializer/values.yaml
index 416282f..271e410 100644 (file)
--- a/kubernetes/common/certInitializer/values.yaml
+++ b/kubernetes/common/certInitializer/values.yaml
@@ -1,4 +1,4 @@
-# Copyright © 2020 Samsung Electronics
+# Copyright © 2020 Bell Canada, Samsung Electronics
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,6 +16,7 @@ global:
   repository: nexus3.onap.org:10001
   aafAgentImage: onap/aaf/aaf_agent:2.1.20
   aafEnabled: true
+  jreImage: registry.gitlab.com/onap-integration/docker/onap-java
 
 pullPolicy: Always
 
@@ -26,6 +27,11 @@ secrets:
     login: '{{ .Values.aafDeployFqi }}'
     password: '{{ .Values.aafDeployPass }}'
     passwordPolicy: required
+  - uid: truststore-creds
+    type: password
+    externalSecret: '{{ tpl (default "" .Values.truststoreCredsExternalSecret) . }}'
+    password: '{{ .Values.truststorePassword }}'
+    passwordPolicy: required
 
 readinessCheck:
   wait_for:
@@ -45,3 +51,7 @@ cadi_latitude: "38.0"
 cadi_longitude: "-72.0"
 aaf_add_config: ""
 mountPath: "/opt/app/osaaf"
+importCustomCertsEnabled: false
+truststoreMountpath: ""
+truststoreOutputFileName: truststore.jks
+truststorePassword: changeit

diff --git a/kubernetes/common/logConfiguration/Chart.yaml b/kubernetes/common/logConfiguration/Chart.yaml
new file mode 100644 (file)
index 0000000..1d13dcb
--- /dev/null
+++ b/kubernetes/common/logConfiguration/Chart.yaml
@@ -0,0 +1,18 @@
+# Copyright © 2017 Amdocs, Bell Canada
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+description: Template used to create same STDOUT log configuration
+name: logConfiguration
+version: 6.0.0

diff --git a/kubernetes/common/logConfiguration/requirements.yaml b/kubernetes/common/logConfiguration/requirements.yaml
new file mode 100644 (file)
index 0000000..237f1d1
--- /dev/null
+++ b/kubernetes/common/logConfiguration/requirements.yaml
@@ -0,0 +1,18 @@
+# Copyright © 2018 Amdocs, Bell Canada
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+dependencies:
+  - name: common
+    version: ~6.x-0
+    repository: 'file://../common'

diff --git a/kubernetes/common/logConfiguration/templates/_log.tpl b/kubernetes/common/logConfiguration/templates/_log.tpl
new file mode 100644 (file)
index 0000000..bf19f21
--- /dev/null
+++ b/kubernetes/common/logConfiguration/templates/_log.tpl
@@ -0,0 +1,41 @@
+{{/*
+# Copyright © 2020 Orange
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+*/}}
+
+{{/*
+  Resolve the level of the logs.
+  The value for .Values.logLevel is used by default,
+  unless either override mechanism is used.
+
+  - .Values.global.logLevel  : override default log level for all components
+  - .Values.logLevelOverride : override global and default log level on a per
+                               component basis
+
+  The function can takes below arguments (inside a dictionary):
+     - .dot : environment (.)
+     - .initRoot : the root dictionary of logConfiguration submodule
+                   (default to .Values.logConfiguration)
+*/}}
+{{- define "common.log.level" -}}
+{{-   $dot := default . .dot -}}
+{{-   $initRoot := default $dot.Values.logConfiguration .initRoot -}}
+{{/*  Our version of helm doesn't support deepCopy so we need this nasty trick */}}
+{{-   $subchartDot := fromJson (include "common.subChartDot" (dict "dot" $dot "initRoot" $initRoot)) }}
+  {{- if $subchartDot.Values.logLevelOverride }}
+    {{- printf "%s" $subchartDot.Values.logLevelOverride -}}
+  {{- else }}
+    {{- default $subchartDot.Values.logLevel $subchartDot.Values.global.logLevel -}}
+  {{- end }}
+{{- end -}}

diff --git a/kubernetes/common/logConfiguration/values.yaml b/kubernetes/common/logConfiguration/values.yaml
new file mode 100644 (file)
index 0000000..7ebb0ff
--- /dev/null
+++ b/kubernetes/common/logConfiguration/values.yaml
@@ -0,0 +1,15 @@
+# Copyright © 2020 Samsung Electronics
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+logLevel: INFO

diff --git a/kubernetes/dmaap/components/dmaap-bc/templates/dmaap-provisioning-job.yaml b/kubernetes/dmaap/components/dmaap-bc/templates/dmaap-provisioning-job.yaml
index cde35af..f8ef8d1 100644 (file)
--- a/kubernetes/dmaap/components/dmaap-bc/templates/dmaap-provisioning-job.yaml
+++ b/kubernetes/dmaap/components/dmaap-bc/templates/dmaap-provisioning-job.yaml
@@ -5,7 +5,7 @@ metadata:
   namespace: {{ include "common.namespace" . }}
   labels: {{- include "common.labels" . | nindent 4 }}
 spec:
-  backoffLimit: 5
+  backoffLimit: 20
   template:
     metadata: {{- include "common.templateMetadata" . | nindent 6 }}
     spec:

diff --git a/kubernetes/multicloud/charts/multicloud-k8s/resources/config/config.json b/kubernetes/multicloud/charts/multicloud-k8s/resources/config/config.json
index 27df701..2ce2d85 100644 (file)
--- a/kubernetes/multicloud/charts/multicloud-k8s/resources/config/config.json
+++ b/kubernetes/multicloud/charts/multicloud-k8s/resources/config/config.json
@@ -45,7 +45,8 @@
                     "HEAT_VOL",
                     "OTHER",
                     "VF_MODULES_METADATA",
-                    "CLOUD_TECHNOLOGY_SPECIFIC_ARTIFACT"
+                    "CLOUD_TECHNOLOGY_SPECIFIC_ARTIFACT",
+                    "HELM"
                 ],
                 "consumerGroup": "multicloud-k8s-group",
                 "environmentName": "AUTO",

diff --git a/kubernetes/onap/values.yaml b/kubernetes/onap/values.yaml
index b96385c..dd80323 100755 (executable)
--- a/kubernetes/onap/values.yaml
+++ b/kubernetes/onap/values.yaml
@@ -90,6 +90,12 @@ global:
   # flag to enable debugging - application support required
   debugEnabled: false
 
+  # configuration to set log level to all components (the one that are using
+  # "common.log.level" to set this)
+  # can be overrided per components by setting logConfiguration.logLevelOverride
+  # to the desired value
+  # logLevel: DEBUG
+
   #Global ingress configuration
   ingress:
     enabled: false

diff --git a/kubernetes/sdnc/requirements.yaml b/kubernetes/sdnc/requirements.yaml
index a283678..c1d679b 100644 (file)
--- a/kubernetes/sdnc/requirements.yaml
+++ b/kubernetes/sdnc/requirements.yaml
@@ -19,6 +19,9 @@ dependencies:
   - name: certInitializer
     version: ~6.x-0
     repository: '@local'
+  - name: logConfiguration
+    version: ~6.x-0
+    repository: '@local'
   - name: network-name-gen
     version: ~6.x-0
     repository: '@local'

diff --git a/kubernetes/sdnc/resources/config/log/org.ops4j.pax.logging.cfg b/kubernetes/sdnc/resources/config/log/org.ops4j.pax.logging.cfg
index a2daef1..8a608f0 100644 (file)
--- a/kubernetes/sdnc/resources/config/log/org.ops4j.pax.logging.cfg
+++ b/kubernetes/sdnc/resources/config/log/org.ops4j.pax.logging.cfg
@@ -42,7 +42,7 @@ log4j2.rootLogger.appenderRef.Console.ref = Console
 log4j2.rootLogger.appenderRef.DebugFile.ref = DebugFile
 log4j2.rootLogger.appenderRef.ErrorFile.ref = ErrorFile
 log4j2.rootLogger.appenderRef.Console.filter.threshold.type = ThresholdFilter
-log4j2.rootLogger.appenderRef.Console.filter.threshold.level = ${karaf.log.console:-OFF}
+log4j2.rootLogger.appenderRef.Console.filter.threshold.level = ${env:KARAF_CONSOLE_LOG_LEVEL\:-OFF}
 
 log4j2.bundle.info = %X{bundle.id} - %.50X{bundle.name} - %X{bundle.version}
 # Veracode: Address Improper Output Neutralization for Logs CWE ID 117 flaw
@@ -113,7 +113,6 @@ log4j2.appender.error.strategy.max = ${maxBackupIndex}
 log4j2.appender.error.strategy.fileIndex = min
 log4j2.appender.error.filter.threshold.type = ThresholdFilter
 log4j2.appender.error.filter.threshold.level = WARN
-log4j2.appender.error.filter.threshold.match = ACCEPT
 
 log4j2.appender.metric.type = RollingRandomAccessFile
 log4j2.appender.metric.name = MetricFile
@@ -163,7 +162,7 @@ log4j2.appender.rr.strategy.max = 100
 log4j2.appender.rr.strategy.fileIndex = min
 
 log4j2.appender.security.type = RollingRandomAccessFile
-log4j2.appender.security.name = securityRollingFile
+log4j2.appender.security.name = SecurityFile
 log4j2.appender.security.fileName = ${logDirectory}/${securityLogName}.log
 log4j2.appender.security.filePattern = ${logDirectory}/${securityLogName}.log.%i
 log4j2.appender.security.append = true
@@ -177,7 +176,7 @@ log4j2.appender.security.policies.size.size = ${maxFileSize}
 log4j2.logger.security.name = org.apache.karaf.jaas.modules.audit
 log4j2.logger.security.level = INFO
 log4j2.logger.security.additivity = false
-log4j2.logger.security.appenderRef.AuditRollingFile.ref = AuditRollingFile
+log4j2.logger.security.appenderRef.SecurityFile.ref = SecurityFile
 
 log4j2.logger.audit.name = org.onap.logging.filter.base.AbstractAuditLogFilter
 log4j2.logger.audit.level = INFO

diff --git a/kubernetes/sdnc/templates/statefulset.yaml b/kubernetes/sdnc/templates/statefulset.yaml
index 437cb31..265d3af 100644 (file)
--- a/kubernetes/sdnc/templates/statefulset.yaml
+++ b/kubernetes/sdnc/templates/statefulset.yaml
@@ -99,7 +99,14 @@ spec:
 
       - name: {{ include "common.name" . }}-chown
         image: "busybox"
-        command: ["sh", "-c", "chown -R {{ .Values.config.odlUid }}:{{ .Values.config.odlGid}} {{ .Values.persistence.mdsalPath }} ; chown -R {{ .Values.config.odlUid }}:{{ .Values.config.odlGid}} {{ .Values.certInitializer.credsPath }}"]
+        command:
+        - sh
+        args:
+        - -c
+        - chown -R {{ .Values.config.odlUid }}:{{ .Values.config.odlGid}} {{ .Values.persistence.mdsalPath }}
+{{- if .Values.global.aafEnabled }}
+        - chown -R {{ .Values.config.odlUid }}:{{ .Values.config.odlGid}} {{ .Values.certInitializer.credsPath }}
+{{- end }}
         volumeMounts:
 {{ include "common.certInitializer.volumeMount" . | indent 10 }}
           - mountPath: {{ .Values.persistence.mdsalPath }}
@@ -151,6 +158,8 @@ spec:
             value: {{ include "common.mariadbService" . }}
           - name: JAVA_HOME
             value: "{{ .Values.config.javaHome}}"
+          - name: KARAF_CONSOLE_LOG_LEVEL
+            value: "{{ include "common.log.level" . }}"
           volumeMounts:
 {{ include "common.certInitializer.volumeMount" . | indent 10 }}
           - mountPath: /etc/localtime

diff --git a/kubernetes/sdnc/values.yaml b/kubernetes/sdnc/values.yaml
index f16f3b1..805bed3 100644 (file)
--- a/kubernetes/sdnc/values.yaml
+++ b/kubernetes/sdnc/values.yaml
@@ -190,6 +190,7 @@ config:
 # dependency / sub-chart configuration
 certInitializer:
   nameOverride: sdnc-cert-initializer
+  truststoreMountpath: /opt/onap/sdnc/data/stores
   fqdn: "sdnc"
   app_ns: "org.osaaf.aaf"
   fqi: "sdnc@sdnc.onap.org"