Merge "[COMMON][CERTINIT] Generate cert with certInit"

diff --git a/docs/release-notes.rst b/docs/release-notes.rst
index d8e529a..ae0ea45 100644 (file)
--- a/docs/release-notes.rst
+++ b/docs/release-notes.rst
@@ -42,7 +42,7 @@ Release Data
 | **Release designation**              | Honolulu                             |
 |                                      |                                      |
 +--------------------------------------+--------------------------------------+
-| **Release date**                     | 2020/12/03                           |
+| **Release date**                     | 2021/04/29                           |
 |                                      |                                      |
 +--------------------------------------+--------------------------------------+
 
@@ -52,18 +52,53 @@ New features
 * Kubernetes support for version up to 1.20
 * Helm support for version up to 3.5
 * Limits are set for most of the components
+* Portal-Cassandra image updated to Bitnami, supporting IPv4/IPv6 Dual Stack
+* CMPv2 external issuer implemented which extends Cert-Manager with ability  to
+  enroll X.509 certificates from CMPv2 servers
+* New version for mariadb galera using Bitnami image, supporting IPv4/IPv6 Dual
+  Stack
+* Bump version of common PostgreSQL and ElasticSearch
+* Move to automatic certificates retrieval for 80% of the components
+* Consistent retrieval of docker images, with ability to configure proxy for
+  the 4 repositories used by ONAP
 
 **Bug fixes**
 
 A list of issues resolved in this release can be found here:
-https://jira.onap.org/projects/OOM/versions/10826
+https://jira.onap.org/projects/OOM/versions/11073
 
-**Known Issues**
+major issues solved:
 
-- `<https://github.com/bitnami/bitnami-docker-mariadb-galera/issues/35>`_
-  bitnami mariadb galera image doesn't support single quote in password.
+* Better handling of persistence on PostgreSQL
+* Better Ingress templating
+* Better Service templating
 
+**Known Issues**
 
+- `OOM-2554 <https://jira.onap.org/browse/OOM-2554>`_ Common pods have java 8
+- `OOM-2435 <https://jira.onap.org/browse/OOM-2435>`_ SDNC karaf shell:
+  log:list: Error executing command: Unrecognized configuration
+- `OOM-2629 <https://jira.onap.org/browse/OOM-2629>`_ NetBox demo entry setup
+  not complete
+- `OOM-2706 <https://jira.onap.org/browse/OOM-2706>`_ CDS Blueprint Processor
+  does not work with local DB
+- `OOM-2713 <https://jira.onap.org/browse/OOM-2713>`_ Problem on onboarding
+  custom cert to SDNC ONAP during deployment
+- `OOM-2698 <https://jira.onap.org/browse/OOM-2698>`_ SO helm override fails in
+  for value with multi-level replacement
+- `OOM-2697 <https://jira.onap.org/browse/OOM-2697>`_ SO with local MariaDB
+  deployment fails
+- `OOM-2538 <https://jira.onap.org/browse/OOM-2538>`_ strange error with
+  CertInitializer template
+- `OOM-2547 <https://jira.onap.org/browse/OOM-2547>`_ Health Check failures
+  seen after bringing down/up control plane & worker node VM instances on which
+  ONAP hosted
+- `OOM-2699 <https://jira.onap.org/browse/OOM-2699>`_ SO so-mariadb
+  readinessCheck fails for local MariaDB instance
+- `OOM-2705 <https://jira.onap.org/browse/OOM-2705>`_ SDNC DB installation fails
+  on local MariaDB instance
+- `OOM-2603 <https://jira.onap.org/browse/OOM-2603>`_ [SDNC] allign password for
+  scaleoutUser/restconfUser/odlUser
 
 Deliverables
 ------------

diff --git a/kubernetes/common/cassandra/templates/statefulset.yaml b/kubernetes/common/cassandra/templates/statefulset.yaml
index 953c89d..3553cd4 100644 (file)
--- a/kubernetes/common/cassandra/templates/statefulset.yaml
+++ b/kubernetes/common/cassandra/templates/statefulset.yaml
@@ -71,6 +71,17 @@ spec:
           timeoutSeconds: {{ .Values.readiness.timeoutSeconds }}
           successThreshold: {{ .Values.readiness.successThreshold }}
           failureThreshold: {{ .Values.readiness.failureThreshold }}
+        startupProbe:
+          exec:
+            command:
+            - /bin/bash
+            - -c
+            - nodetool status | grep $POD_IP | awk '$1!="UN" { exit 1; }'
+          initialDelaySeconds: {{ .Values.startup.initialDelaySeconds }}
+          periodSeconds: {{ .Values.startup.periodSeconds }}
+          timeoutSeconds: {{ .Values.startup.timeoutSeconds }}
+          successThreshold: {{ .Values.startup.successThreshold }}
+          failureThreshold: {{ .Values.startup.failureThreshold }}
         env:
           {{- $seed_size := default 1 .Values.replicaCount | int -}}
           {{- $global := . }}

diff --git a/kubernetes/common/cassandra/values.yaml b/kubernetes/common/cassandra/values.yaml
index c3d22ce..5a50d8e 100644 (file)
--- a/kubernetes/common/cassandra/values.yaml
+++ b/kubernetes/common/cassandra/values.yaml
@@ -54,8 +54,8 @@ affinity: {}
 
 # probe configuration parameters
 liveness:
-  initialDelaySeconds: 60
-  periodSeconds: 20
+  initialDelaySeconds: 1
+  periodSeconds: 10
   timeoutSeconds: 10
   successThreshold: 1
   failureThreshold: 3
@@ -64,12 +64,19 @@ liveness:
   enabled: true
 
 readiness:
-  initialDelaySeconds: 120
-  periodSeconds: 20
+  initialDelaySeconds: 1
+  periodSeconds: 10
   timeoutSeconds: 10
   successThreshold: 1
   failureThreshold: 3
 
+startup:
+  initialDelaySeconds: 10
+  periodSeconds: 10
+  timeoutSeconds: 10
+  successThreshold: 1
+  failureThreshold: 90
+
 service:
   name: cassandra
   headless:

diff --git a/kubernetes/common/cert-wrapper/resources/import-custom-certs.sh b/kubernetes/common/cert-wrapper/resources/import-custom-certs.sh
index d955ecd..ec1ce94 100755 (executable)
--- a/kubernetes/common/cert-wrapper/resources/import-custom-certs.sh
+++ b/kubernetes/common/cert-wrapper/resources/import-custom-certs.sh
@@ -17,6 +17,7 @@
 */}}
 
 CERTS_DIR=${CERTS_DIR:-/certs}
+MORE_CERTS_DIR=${MORE_CERTS_DIR:-/more_certs}
 WORK_DIR=${WORK_DIR:-/updatedTruststore}
 ONAP_TRUSTSTORE=${ONAP_TRUSTSTORE:-truststoreONAPall.jks}
 JRE_TRUSTSTORE=${JRE_TRUSTSTORE:-$JAVA_HOME/lib/security/cacerts}
@@ -47,6 +48,13 @@ for f in $CERTS_DIR/*; do
   fi
 done
 
+for f in $MORE_CERTS_DIR/*; do
+  if [ ${f: -4} == ".pem" ]
+    then
+      cp $f $WORK_DIR/.
+  fi
+done
+
 # Prepare truststore output file
 if [ "$AAF_ENABLED" = "true" ]
   then

diff --git a/kubernetes/common/certInitializer/templates/_certInitializer.yaml b/kubernetes/common/certInitializer/templates/_certInitializer.yaml
index 68bea64..f3ba8a2 100644 (file)
--- a/kubernetes/common/certInitializer/templates/_certInitializer.yaml
+++ b/kubernetes/common/certInitializer/templates/_certInitializer.yaml
@@ -146,6 +146,8 @@
   volumeMounts:
     - mountPath: /certs
       name: aaf-agent-certs
+    - mountPath: /more_certs
+      name: provided-custom-certs
     - mountPath: /root/import-custom-certs.sh
       name: aaf-agent-certs
       subPath: import-custom-certs.sh
@@ -186,6 +188,21 @@
   configMap:
     name: {{ tpl $subchartDot.Values.certsCMName $subchartDot }}
     defaultMode: 0700
+{{- if $dot.Values.global.importCustomCertsEnabled }}
+- name: provided-custom-certs
+{{-   if $dot.Values.global.customCertsSecret }}
+  secret:
+    secretName: {{ $dot.Values.global.customCertsSecret }}
+{{-   else }}
+{{-     if $dot.Values.global.customCertsConfigMap }}
+  configMap:
+    name: {{ $dot.Values.global.customCertsConfigMap }}
+{{-     else }}
+  emptyDir:
+    medium: Memory
+{{-     end }}
+{{-   end }}
+{{- end }}
 - name: {{ include "common.certInitializer._aafAddConfigVolumeName" $dot }}
   configMap:
     name: {{ include "common.fullname" $subchartDot }}-add-config

diff --git a/kubernetes/common/certInitializer/values.yaml b/kubernetes/common/certInitializer/values.yaml
index 2ef6e2d..747c94f 100644 (file)
--- a/kubernetes/common/certInitializer/values.yaml
+++ b/kubernetes/common/certInitializer/values.yaml
@@ -15,6 +15,15 @@
 global:
   aafAgentImage: onap/aaf/aaf_agent:2.1.20
   aafEnabled: true
+  # Give the name of a config map where certInitializer will onboard all certs
+  # given (certs must be in pem format)
+  customCertsConfigMap:
+  # Give the name of a secret where certInitializer will onboard all certs given
+  # (certs must be in pem format)
+  # this one superseedes previous one (so if both are given, only certs from
+  # secret will be onboarded).
+  customCertsSecret:
+
 
 pullPolicy: Always
 
@@ -37,7 +46,6 @@ readinessCheck:
     - aaf-cm
     - aaf-service
 
-aafDeployFqi: "changeme"
 fqdn: ""
 app_ns: "org.osaaf.aaf"
 fqi: ""

diff --git a/kubernetes/common/music/values.yaml b/kubernetes/common/music/values.yaml
index 25cab91..f578949 100644 (file)
--- a/kubernetes/common/music/values.yaml
+++ b/kubernetes/common/music/values.yaml
@@ -164,5 +164,4 @@ certInitializer:
   credsPath: /opt/app/osaaf/local
   appMountPath: /opt/app/aafcertman
   aaf_add_config: >
-    cd {{ .Values.credsPath }};
-    /opt/app/aaf_config/bin/agent.sh local showpass {{.Values.fqi}} {{ .Values.fqdn }} | grep cadi_keystore_password_jks= | cut -d= -f 2 > {{ .Values.credsPath }}/.pass 2>&1;
+    echo "$cadi_keystore_password_jks" > {{ .Values.credsPath }}/.pass;

diff --git a/kubernetes/policy/components/policy-clamp-be/resources/config/create-db-tables.sh b/kubernetes/policy/components/policy-clamp-be/resources/config/create-db-tables.sh
index 329479f..ad9984c 100755 (executable)
--- a/kubernetes/policy/components/policy-clamp-be/resources/config/create-db-tables.sh
+++ b/kubernetes/policy/components/policy-clamp-be/resources/config/create-db-tables.sh
@@ -16,4 +16,4 @@
 # limitations under the License.
 */}}
 
-mysql -h"${MYSQL_HOST}" -P"${MYSQL_PORT}" -u"${MYSQL_USER}" -p"${MYSQL_PASSWORD}" policyclamp < /dbcmd-config/policy-clamp-create-tables.sql
+mysql -h"${MYSQL_HOST}" -P"${MYSQL_PORT}" -u"${MYSQL_USER}" -p"${MYSQL_PASSWORD}" -f policyclamp < /dbcmd-config/policy-clamp-create-tables.sql