From: Sylvain Desbureaux <sylvain.desbureaux@orange.com>
Date: Fri, 29 May 2020 06:50:21 +0000 (+0000)
Subject: Merge "[PORTAL] Use common aaf template in portal-app"
X-Git-Tag: 7.0.0~401
X-Git-Url: https://gerrit.onap.org/r/gitweb?a=commitdiff_plain;h=7cf3b1fc96b7f30f71ba7406948a75df7493a21d;hp=57ec338ae0a875591e881f3457ff22bca737f81b;p=oom.git

Merge "[PORTAL] Use common aaf template in portal-app"
---

diff --git a/kubernetes/clamp/charts/mariadb/resources/config/init/docker-entrypoint.sh b/kubernetes/clamp/charts/mariadb/resources/config/init/docker-entrypoint.sh
new file mode 100755
index 0000000000..6c69694011
--- /dev/null
+++ b/kubernetes/clamp/charts/mariadb/resources/config/init/docker-entrypoint.sh
@@ -0,0 +1,193 @@
+#!/bin/bash
+set -eo pipefail
+shopt -s nullglob
+
+# if command starts with an option, prepend mysqld
+if [ "${1:0:1}" = '-' ]; then
+	set -- mysqld "$@"
+fi
+
+# skip setup if they want an option that stops mysqld
+wantHelp=
+for arg; do
+	case "$arg" in
+		-'?'|--help|--print-defaults|-V|--version)
+			wantHelp=1
+			break
+			;;
+	esac
+done
+
+# usage: file_env VAR [DEFAULT]
+#    ie: file_env 'XYZ_DB_PASSWORD' 'example'
+# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of
+#  "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature)
+file_env() {
+	local var="$1"
+	local fileVar="${var}_FILE"
+	local def="${2:-}"
+	if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
+		echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
+		exit 1
+	fi
+	local val="$def"
+	if [ "${!var:-}" ]; then
+		val="${!var}"
+	elif [ "${!fileVar:-}" ]; then
+		val="$(< "${!fileVar}")"
+	fi
+	val=`echo -n $val | sed -e "s/'/''/g"`
+	export "$var"="$val"
+	unset "$fileVar"
+}
+
+_check_config() {
+	toRun=( "$@" --verbose --help --log-bin-index="$(mktemp -u)" )
+	if ! errors="$("${toRun[@]}" 2>&1 >/dev/null)"; then
+		cat >&2 <<-EOM
+
+			ERROR: mysqld failed while attempting to check config
+			command was: "${toRun[*]}"
+
+			$errors
+		EOM
+		exit 1
+	fi
+}
+
+# Fetch value from server config
+# We use mysqld --verbose --help instead of my_print_defaults because the
+# latter only show values present in config files, and not server defaults
+_get_config() {
+	local conf="$1"; shift
+	"$@" --verbose --help --log-bin-index="$(mktemp -u)" 2>/dev/null \
+		| awk '$1 == "'"$conf"'" && /^[^ \t]/ { sub(/^[^ \t]+[ \t]+/, ""); print; exit }'
+	# match "datadir      /some/path with/spaces in/it here" but not "--xyz=abc\n     datadir (xyz)"
+}
+
+# allow the container to be started with `--user`
+if [ "$1" = 'mysqld' -a -z "$wantHelp" -a "$(id -u)" = '0' ]; then
+	_check_config "$@"
+	DATADIR="$(_get_config 'datadir' "$@")"
+	mkdir -p "$DATADIR"
+	find "$DATADIR" \! -user mysql -exec chown mysql '{}' +
+	exec gosu mysql "$BASH_SOURCE" "$@"
+fi
+
+if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then
+	# still need to check config, container may have started with --user
+	_check_config "$@"
+	# Get config
+	DATADIR="$(_get_config 'datadir' "$@")"
+
+	if [ ! -d "$DATADIR/mysql" ]; then
+		file_env 'MYSQL_ROOT_PASSWORD'
+		if [ -z "$MYSQL_ROOT_PASSWORD" -a -z "$MYSQL_ALLOW_EMPTY_PASSWORD" -a -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then
+			echo >&2 'error: database is uninitialized and password option is not specified '
+			echo >&2 '  You need to specify one of MYSQL_ROOT_PASSWORD, MYSQL_ALLOW_EMPTY_PASSWORD and MYSQL_RANDOM_ROOT_PASSWORD'
+			exit 1
+		fi
+
+		mkdir -p "$DATADIR"
+
+		echo 'Initializing database'
+		# "Other options are passed to mysqld." (so we pass all "mysqld" arguments directly here)
+		mysql_install_db --datadir="$DATADIR" --rpm "${@:2}"
+		echo 'Database initialized'
+
+		SOCKET="$(_get_config 'socket' "$@")"
+		"$@" --skip-networking --socket="${SOCKET}" &
+		pid="$!"
+
+		mysql=( mysql --protocol=socket -uroot -hlocalhost --socket="${SOCKET}" )
+
+		for i in {30..0}; do
+			if echo 'SELECT 1' | "${mysql[@]}" &> /dev/null; then
+				break
+			fi
+			echo 'MySQL init process in progress...'
+			sleep 1
+		done
+		if [ "$i" = 0 ]; then
+			echo >&2 'MySQL init process failed.'
+			exit 1
+		fi
+
+		if [ -z "$MYSQL_INITDB_SKIP_TZINFO" ]; then
+			# sed is for https://bugs.mysql.com/bug.php?id=20545
+			mysql_tzinfo_to_sql /usr/share/zoneinfo | sed 's/Local time zone must be set--see zic manual page/FCTY/' | "${mysql[@]}" mysql
+		fi
+
+		if [ ! -z "$MYSQL_RANDOM_ROOT_PASSWORD" ]; then
+			export MYSQL_ROOT_PASSWORD="$(pwgen -1 32)"
+			echo "GENERATED ROOT PASSWORD: $MYSQL_ROOT_PASSWORD"
+		fi
+
+		rootCreate=
+		# default root to listen for connections from anywhere
+		file_env 'MYSQL_ROOT_HOST' '%'
+		if [ ! -z "$MYSQL_ROOT_HOST" -a "$MYSQL_ROOT_HOST" != 'localhost' ]; then
+			# no, we don't care if read finds a terminating character in this heredoc
+			# https://unix.stackexchange.com/questions/265149/why-is-set-o-errexit-breaking-this-read-heredoc-expression/265151#265151
+			read -r -d '' rootCreate <<-EOSQL || true
+				CREATE USER 'root'@'${MYSQL_ROOT_HOST}' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}' ;
+				GRANT ALL ON *.* TO 'root'@'${MYSQL_ROOT_HOST}' WITH GRANT OPTION ;
+			EOSQL
+		fi
+
+		"${mysql[@]}" <<-EOSQL
+			-- What's done in this file shouldn't be replicated
+			--  or products like mysql-fabric won't work
+			SET @@SESSION.SQL_LOG_BIN=0;
+
+			DELETE FROM mysql.user WHERE user NOT IN ('mysql.sys', 'mysqlxsys', 'root') OR host NOT IN ('localhost') ;
+			SET PASSWORD FOR 'root'@'localhost'=PASSWORD('${MYSQL_ROOT_PASSWORD}') ;
+			GRANT ALL ON *.* TO 'root'@'localhost' WITH GRANT OPTION ;
+			${rootCreate}
+			DROP DATABASE IF EXISTS test ;
+			FLUSH PRIVILEGES ;
+		EOSQL
+
+		if [ ! -z "$MYSQL_ROOT_PASSWORD" ]; then
+			mysql+=( -p"${MYSQL_ROOT_PASSWORD}" )
+		fi
+
+		file_env 'MYSQL_DATABASE'
+		if [ "$MYSQL_DATABASE" ]; then
+			echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" | "${mysql[@]}"
+			mysql+=( "$MYSQL_DATABASE" )
+		fi
+
+		file_env 'MYSQL_USER'
+		file_env 'MYSQL_PASSWORD'
+		if [ "$MYSQL_USER" -a "$MYSQL_PASSWORD" ]; then
+			echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" | "${mysql[@]}"
+
+			if [ "$MYSQL_DATABASE" ]; then
+				echo "GRANT ALL ON \`$MYSQL_DATABASE\`.* TO '$MYSQL_USER'@'%' ;" | "${mysql[@]}"
+			fi
+		fi
+
+		echo
+		for f in /docker-entrypoint-initdb.d/*; do
+			case "$f" in
+				*.sh)     echo "$0: running $f"; . "$f" ;;
+				*.sql)    echo "$0: running $f"; "${mysql[@]}" < "$f"; echo ;;
+				*.sql.gz) echo "$0: running $f"; gunzip -c "$f" | "${mysql[@]}"; echo ;;
+				*)        echo "$0: ignoring $f" ;;
+			esac
+			echo
+		done
+
+		if ! kill -s TERM "$pid" || ! wait "$pid"; then
+			echo >&2 'MySQL init process failed.'
+			exit 1
+		fi
+
+		echo
+		echo 'MySQL init process done. Ready for start up.'
+		echo
+	fi
+fi
+
+exec "$@"
diff --git a/kubernetes/clamp/charts/mariadb/templates/configmap.yaml b/kubernetes/clamp/charts/mariadb/templates/configmap.yaml
index 522c5f9bf8..01420aa97b 100644
--- a/kubernetes/clamp/charts/mariadb/templates/configmap.yaml
+++ b/kubernetes/clamp/charts/mariadb/templates/configmap.yaml
@@ -39,4 +39,17 @@ metadata:
     heritage: {{ .Release.Service }}
 data:
 {{ tpl (.Files.Glob "resources/config/mariadb/conf.d/conf1/*").AsConfig . | indent 2 }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "common.fullname" . }}
+  namespace: {{ include "common.namespace" . }}
+  labels:
+    app: {{ include "common.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ include "common.release" . }}
+    heritage: {{ .Release.Service }}
+data:
+{{ tpl (.Files.Glob "resources/config/init/*").AsConfig . | indent 2 }}
 #{{ end }}
diff --git a/kubernetes/clamp/charts/mariadb/templates/deployment.yaml b/kubernetes/clamp/charts/mariadb/templates/deployment.yaml
index 7d22930b6a..b6af4e3d0b 100644
--- a/kubernetes/clamp/charts/mariadb/templates/deployment.yaml
+++ b/kubernetes/clamp/charts/mariadb/templates/deployment.yaml
@@ -61,6 +61,9 @@ spec:
           - name: MYSQL_DATABASE
             value: {{ tpl .Values.db.databaseName .}}
           volumeMounts:
+          - mountPath: /docker-entrypoint.sh
+            subPath: docker-entrypoint.sh
+            name: init-script
           - mountPath: /etc/localtime
             name: localtime
             readOnly: true
@@ -97,5 +100,9 @@ spec:
         - name: localtime
           hostPath:
             path: /etc/localtime
+        - name: init-script
+          configMap:
+            name: {{ include "common.fullname" . }}
+            defaultMode: 0755
       imagePullSecrets:
       - name: "{{ include "common.namespace" . }}-docker-registry-key"
diff --git a/kubernetes/common/elasticsearch/requirements.yaml b/kubernetes/common/elasticsearch/requirements.yaml
index 8a02fef7b7..5900f412a1 100644
--- a/kubernetes/common/elasticsearch/requirements.yaml
+++ b/kubernetes/common/elasticsearch/requirements.yaml
@@ -27,3 +27,6 @@ dependencies:
     version: ~6.x-0
     repository: 'file://components/curator'
     condition: elasticsearch.curator.enabled,curator.enabled
+  - name: certInitializer
+    version: ~6.x-0
+    repository: 'file://../certInitializer'
diff --git a/kubernetes/common/elasticsearch/templates/configmap-aaf-add-config.yaml b/kubernetes/common/elasticsearch/templates/configmap-aaf-add-config.yaml
deleted file mode 100644
index b4e0044891..0000000000
--- a/kubernetes/common/elasticsearch/templates/configmap-aaf-add-config.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-
-{{ if .Values.global.aafEnabled }}
-{{/*
-# Copyright © 2020 Bitnami, AT&T, Amdocs, Bell Canada, highstreet technologies
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#       http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-*/}}
-{{- if .Values.aafConfig.addconfig -}}
-apiVersion: v1
-kind: ConfigMap
-{{ $suffix := "aaf-add-config" -}}
-metadata: {{- include "common.resourceMetadata" (dict "suffix" $suffix "dot" . )| nindent 2 }}
-data:
-  aaf-add-config.sh: |-
-    cd /opt/app/osaaf/local
-    mkdir -p certs
-    export $(/opt/app/aaf_config/bin/agent.sh local showpass | grep '^c' | xargs -0)
-    keytool -exportcert -rfc -file certs/cacert.pem -keystore {{ .Values.aafConfig.fqi_namespace }}.trust.jks -alias ca_local_0 -storepass $cadi_truststore_password
-    openssl pkcs12 -in {{ .Values.aafConfig.fqi_namespace }}.p12 -out certs/cert.pem -passin pass:$cadi_keystore_password_p12 -passout pass:$cadi_keystore_password_p12
-    cp {{ .Values.aafConfig.fqi_namespace }}.key certs/key.pem
-    chmod -R 755 certs
-{{- end -}}
-{{- end -}}
diff --git a/kubernetes/common/elasticsearch/templates/coordinating-deploy.yaml b/kubernetes/common/elasticsearch/templates/coordinating-deploy.yaml
index 65a7f462e1..1ab5b59855 100644
--- a/kubernetes/common/elasticsearch/templates/coordinating-deploy.yaml
+++ b/kubernetes/common/elasticsearch/templates/coordinating-deploy.yaml
@@ -61,7 +61,7 @@ spec:
           securityContext:
             privileged: true
       {{- end }}
-          {{ include "common.aaf-config" . | nindent 8}}
+          {{ include "common.certInitializer.initContainer" . | nindent 8 }}
 
       containers:
         - name: {{ include "common.name" . }}-nginx
@@ -82,7 +82,7 @@ spec:
           - name: nginx-server-block
             mountPath: /opt/bitnami/nginx/conf/server_blocks
           {{- end }}
-          {{- include "common.aaf-config-volume-mountpath" . | nindent 10 }}
+          {{- include "common.certInitializer.volumeMount" . | nindent 10 }}
 
         - name: {{ include "common.name" . }}-elasticsearch
           image: {{ printf "%s/%s:%s" (include "common.repository" .)  .Values.image.imageName  .Values.image.tag }}
@@ -163,5 +163,4 @@ spec:
           configMap:
             name: {{ include "common.fullname" . }}-nginx-server-block
         {{- end }}
-        {{- include "common.aaf-config-volumes" . | nindent 8}}
-
+         {{ include "common.certInitializer.volumes" . | nindent 8 }}
diff --git a/kubernetes/common/elasticsearch/values.yaml b/kubernetes/common/elasticsearch/values.yaml
index 3627b2ea97..b1289431a5 100644
--- a/kubernetes/common/elasticsearch/values.yaml
+++ b/kubernetes/common/elasticsearch/values.yaml
@@ -17,7 +17,6 @@
 #################################################################
 global:
   aafEnabled: true
-  aafAgentImage: onap/aaf/aaf_agent:2.1.15
   nodePortPrefix: 302
   readinessRepository: oomk8s
   readinessImage: readiness-check:2.0.2
@@ -275,34 +274,32 @@ service:
   # loadBalancerIP:
   ## Provide functionality to use RBAC
   ##
+
 #################################################################
-# Secrets metaconfig
-#################################################################
-secrets:
-  - uid: &aaf_secret_uid elasticsearch-aaf-deploy-creds
-    type: basicAuth
-    externalSecret: '{{ ternary (tpl (default "" .Values.aafConfig.aafDeployCredsExternalSecret) .) "aafIsDisabled" .Values.global.aafEnabled }}'
-    login: '{{ .Values.aafConfig.aafDeployFqi }}'
-    password: '{{ .Values.aafConfig.aafDeployPass }}'
-    passwordPolicy: required
-#################################################################
-# aaf configuration defaults.
+# Certificate configuration
 #################################################################
-aafConfig:
-  addconfig: true
+certInitializer:
+  nameOverride: elasticsearch-cert-initializer
+  aafDeployFqi: deployer@people.osaaf.org
+  aafDeployPass: demo123456!
+  # aafDeployCredsExternalSecret: some secret
   fqdn: "elastic"
-  image: onap/aaf/aaf_agent:2.1.15
   app_ns: "org.osaaf.aaf"
-  fqi_namespace: org.onap.elastic
+  fqi_namespace: "org.onap.elastic"
   fqi: "elastic@elastic.onap.org"
   public_fqdn: "aaf.osaaf.org"
-  deploy_fqi: "deployer@people.osaaf.org"
-  aafDeployFqi: "deployer@people.osaaf.org"
-  aafDeployPass: demo123456!
-  #aafDeployCredsExternalSecret: some secret
-  #cadi_latitude: "52.5"
-  #cadi_longitude: "13.4"
-  secret_uid: *aaf_secret_uid
+  cadi_longitude: "0.0"
+  cadi_latitude: "0.0"
+  credsPath: /opt/app/osaaf/local
+  aaf_add_config: >
+    cd {{ .Values.credsPath }};
+    mkdir -p certs;
+    export $(/opt/app/aaf_config/bin/agent.sh local showpass | grep '^c' | xargs -0);
+    keytool -exportcert -rfc -file certs/cacert.pem -keystore {{ .Values.fqi_namespace }}.trust.jks -alias ca_local_0 -storepass $cadi_truststore_password;
+    openssl pkcs12 -in {{ .Values.fqi_namespace }}.p12 -out certs/cert.pem -passin pass:$cadi_keystore_password_p12 -passout pass:$cadi_keystore_password_p12;
+    cp {{ .Values.fqi_namespace }}.key certs/key.pem;
+    chmod -R 755 certs;
+
 #################################################################
 # subcharts configuration defaults.
 #################################################################
diff --git a/kubernetes/contrib/components/ejbca/values.yaml b/kubernetes/contrib/components/ejbca/values.yaml
index 0db7ca14be..82bc03c597 100644
--- a/kubernetes/contrib/components/ejbca/values.yaml
+++ b/kubernetes/contrib/components/ejbca/values.yaml
@@ -98,6 +98,7 @@ readiness:
 
 service:
   type: ClusterIP
+  both_tls_and_plain: true
   ports:
     - name: api
       port: 8443
diff --git a/kubernetes/contrib/components/netbox/charts/netbox-app/resources/config/provisioning/provision.sh b/kubernetes/contrib/components/netbox/charts/netbox-app/resources/config/provisioning/provision.sh
index 5db036f708..984801decb 100755
--- a/kubernetes/contrib/components/netbox/charts/netbox-app/resources/config/provisioning/provision.sh
+++ b/kubernetes/contrib/components/netbox/charts/netbox-app/resources/config/provisioning/provision.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/sh
 
 # Create region
 
diff --git a/kubernetes/contrib/components/netbox/charts/netbox-app/templates/job.yaml b/kubernetes/contrib/components/netbox/charts/netbox-app/templates/job.yaml
index f4002773fd..7586a6c95e 100644
--- a/kubernetes/contrib/components/netbox/charts/netbox-app/templates/job.yaml
+++ b/kubernetes/contrib/components/netbox/charts/netbox-app/templates/job.yaml
@@ -48,12 +48,12 @@ spec:
               fieldPath: metadata.namespace
       containers:
       - name: {{ include "common.name" . }}-provisioning-job
-        image: "{{ .Values.global.readinessRepository }}/{{ .Values.global.readinessImage }}"
+        image: "{{ .Values.global.dockerHubRepository }}/{{ .Values.global.curlImage }}"
         volumeMounts:
         - name: {{ include "common.fullname" . }}-provisioning
           mountPath: /tmp
         command:
-        - /bin/bash
+        - /bin/sh
         - ./tmp/provision.sh
       volumes:
         - name: {{ include "common.fullname" . }}-provisioning
diff --git a/kubernetes/contrib/components/netbox/charts/netbox-app/values.yaml b/kubernetes/contrib/components/netbox/charts/netbox-app/values.yaml
index ddfdc4b976..ff02e27b9b 100755
--- a/kubernetes/contrib/components/netbox/charts/netbox-app/values.yaml
+++ b/kubernetes/contrib/components/netbox/charts/netbox-app/values.yaml
@@ -42,6 +42,9 @@ config:
   superuserName: admin
   superuserEmail: admin@onap.org
 
+  curlImage: curlimages/curl:7.69.1
+  dockerHubRepository: docker.io
+
 repository: netboxcommunity
 image: netbox:v2.5.8
 
diff --git a/kubernetes/oof/charts/oof-has/resources/config/conductor.conf b/kubernetes/oof/charts/oof-has/resources/config/conductor.conf
index 94a47fed2f..881ed22562 100755
--- a/kubernetes/oof/charts/oof-has/resources/config/conductor.conf
+++ b/kubernetes/oof/charts/oof-has/resources/config/conductor.conf
@@ -238,7 +238,7 @@ server_url = https://{{.Values.config.aai.serviceName}}.{{ include "common.names
 #aai_retries = 3
 
 # The version of A&AI in v# format. (string value)
-server_url_version = v14
+server_url_version = v19
 
 # SSL/TLS certificate file in pem format. This certificate must be registered
 # with the A&AI endpoint. (string value)
diff --git a/kubernetes/oof/charts/oof-has/values.yaml b/kubernetes/oof/charts/oof-has/values.yaml
index f4debe93fc..309b59ca86 100755
--- a/kubernetes/oof/charts/oof-has/values.yaml
+++ b/kubernetes/oof/charts/oof-has/values.yaml
@@ -25,7 +25,7 @@ global:
   commonConfigPrefix: onap-oof-has
   image:
     readiness: oomk8s/readiness-check:2.0.0
-    optf_has: onap/optf-has:2.0.3
+    optf_has: onap/optf-has:2.0.4
     filebeat: docker.elastic.co/beats/filebeat:5.5.0
 
 pullPolicy: Always
diff --git a/kubernetes/oof/resources/config/common_config.yaml b/kubernetes/oof/resources/config/common_config.yaml
index bfee39b967..9515f30fc0 100644
--- a/kubernetes/oof/resources/config/common_config.yaml
+++ b/kubernetes/oof/resources/config/common_config.yaml
@@ -44,8 +44,7 @@ osdf_temp:  # special configuration required for "workarounds" or testing
         slice_selection_policy_dir_urllc_1: "./test/policy-local-files/"
         slice_selection_policy_files_urllc_1:
             - vnfPolicy_URLLC_Core_1.json
-            - thresholdPolicy_URLLC_Core_1_reliability.json
-            - thresholdPolicy_URLLC_Core_1_latency.json
+            - thresholdPolicy_URLLC_Core_1.json
             - subscriber_policy_URLLC_1.json
 
 service_info:
diff --git a/kubernetes/oof/values.yaml b/kubernetes/oof/values.yaml
index 5205a1df1f..13e0045858 100644
--- a/kubernetes/oof/values.yaml
+++ b/kubernetes/oof/values.yaml
@@ -27,7 +27,7 @@ global:
 #################################################################
 # application image
 repository: nexus3.onap.org:10001
-image: onap/optf-osdf:2.0.3
+image: onap/optf-osdf:2.0.4
 pullPolicy: Always
 
 # flag to enable debugging - application support required
@@ -49,7 +49,7 @@ config:
 
   # Url and credentials for Conductor.
   conductorUrl: https://oof-has-api:8091/v1/plans/
-  conductorPingWaitTime: 60
+  conductorPingWaitTime: 10
   conductorMaxRetries: 30
   # versions to be set in HTTP header
   conductorMinorVersion: 0
diff --git a/kubernetes/policy/charts/pap/templates/deployment.yaml b/kubernetes/policy/charts/pap/templates/deployment.yaml
index 39ac8a81ec..e8c96cee77 100644
--- a/kubernetes/policy/charts/pap/templates/deployment.yaml
+++ b/kubernetes/policy/charts/pap/templates/deployment.yaml
@@ -1,20 +1,11 @@
 apiVersion: extensions/v1beta1
 kind: Deployment
-metadata:
-  name: {{ include "common.fullname" . }}
-  namespace: {{ include "common.namespace" . }}
-  labels:
-    app: {{ include "common.name" . }}
-    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
-    release: {{ include "common.release" . }}
-    heritage: {{ .Release.Service }}
+metadata: {{- include "common.resourceMetadata" . | nindent 2 }}
 spec:
+  selector: {{- include "common.selectors" . | nindent 4 }}
   replicas: {{ .Values.replicaCount }}
   template:
-    metadata:
-      labels:
-        app: {{ include "common.name" . }}
-        release: {{ include "common.release" . }}
+    metadata: {{- include "common.templateMetadata" . | nindent 6 }}
     spec:
       initContainers:
       - command:
@@ -68,20 +59,19 @@ spec:
           imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
           command: ["/opt/app/policy/pap/bin/policy-pap.sh"]
           args: ["/opt/app/policy/pap/etc/mounted/config.json"]
-          ports:
-          - containerPort: {{ .Values.service.internalPort }}
+          ports: {{ include "common.containerPorts" . | nindent 12  }}
           # disable liveness probe when breakpoints set in debugger
           # so K8s doesn't restart unresponsive container
           {{- if eq .Values.liveness.enabled true }}
           livenessProbe:
             tcpSocket:
-              port: {{ .Values.service.internalPort }}
+              port: {{ .Values.liveness.port }}
             initialDelaySeconds: {{ .Values.liveness.initialDelaySeconds }}
             periodSeconds: {{ .Values.liveness.periodSeconds }}
           {{ end -}}
           readinessProbe:
             tcpSocket:
-              port: {{ .Values.service.internalPort }}
+              port: {{ .Values.readiness.port }}
             initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }}
             periodSeconds: {{ .Values.readiness.periodSeconds }}
           volumeMounts:
diff --git a/kubernetes/policy/charts/pap/templates/service.yaml b/kubernetes/policy/charts/pap/templates/service.yaml
index b6deb5c75e..5c4061e831 100644
--- a/kubernetes/policy/charts/pap/templates/service.yaml
+++ b/kubernetes/policy/charts/pap/templates/service.yaml
@@ -18,28 +18,4 @@
 #  SPDX-License-Identifier: Apache-2.0
 #  ============LICENSE_END=========================================================
 
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "common.servicename" . }}
-  namespace: {{ include "common.namespace" . }}
-  labels:
-    app: {{ include "common.name" . }}
-    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
-    release: {{ include "common.release" . }}
-    heritage: {{ .Release.Service }}
-spec:
-  type: {{ .Values.service.type }}
-  ports:
-    {{if eq .Values.service.type "NodePort" -}}
-    - port: {{ .Values.service.internalPort }}
-      nodePort: {{ .Values.global.nodePortPrefixExt | default .Values.nodePortPrefixExt }}{{ .Values.service.nodePort }}
-      name: {{ .Values.service.portName }}
-    {{- else -}}
-    - port: {{ .Values.service.externalPort }}
-      targetPort: {{ .Values.service.internalPort }}
-      name: {{ .Values.service.portName }}
-    {{- end}}
-  selector:
-    app: {{ include "common.name" . }}
-    release: {{ include "common.release" . }}
+{{ include "common.service" . }}
diff --git a/kubernetes/policy/charts/pap/values.yaml b/kubernetes/policy/charts/pap/values.yaml
index dc7a58d804..2bbefa1e16 100644
--- a/kubernetes/policy/charts/pap/values.yaml
+++ b/kubernetes/policy/charts/pap/values.yaml
@@ -96,18 +96,21 @@ liveness:
   # necessary to disable liveness probe when setting breakpoints
   # in debugger so K8s doesn't restart unresponsive container
   enabled: true
+  port: http-api
 
 readiness:
   initialDelaySeconds: 20
   periodSeconds: 10
+  port: http-api
 
 service:
   type: ClusterIP
   name: policy-pap
-  portName: policy-pap
-  internalPort: 6969
-  externalPort: 6969
-  nodePort: 42
+  useNodePortExt: true
+  ports:
+  - name: http-api
+    port: 6969
+    nodePort: 42
 
 ingress:
   enabled: false
diff --git a/kubernetes/portal/components/portal-app/values.yaml b/kubernetes/portal/components/portal-app/values.yaml
index d118c84faf..9564723b17 100644
--- a/kubernetes/portal/components/portal-app/values.yaml
+++ b/kubernetes/portal/components/portal-app/values.yaml
@@ -33,7 +33,7 @@ global:
 
 # application image
 repository: nexus3.onap.org:10001
-image: onap/portal-app:3.2.2
+image: onap/portal-app:3.2.3
 pullPolicy: Always
 
 #AAF local config
diff --git a/kubernetes/portal/components/portal-mariadb/values.yaml b/kubernetes/portal/components/portal-mariadb/values.yaml
index 0ae7f4eaab..08157f7b92 100644
--- a/kubernetes/portal/components/portal-mariadb/values.yaml
+++ b/kubernetes/portal/components/portal-mariadb/values.yaml
@@ -25,7 +25,7 @@ global: # global defaults
 
 # application image
 repository: nexus3.onap.org:10001
-image: onap/portal-db:3.2.2
+image: onap/portal-db:3.2.3
 pullPolicy: Always
 
 
diff --git a/kubernetes/portal/components/portal-widget/values.yaml b/kubernetes/portal/components/portal-widget/values.yaml
index 3692579c6a..079847c7e7 100644
--- a/kubernetes/portal/components/portal-widget/values.yaml
+++ b/kubernetes/portal/components/portal-widget/values.yaml
@@ -29,7 +29,7 @@ global:
 #################################################################
 # application image
 repository: nexus3.onap.org:10001
-image: onap/portal-wms:3.2.2
+image: onap/portal-wms:3.2.3
 pullPolicy: Always
 
 # flag to enable debugging - application support required
diff --git a/kubernetes/readiness/src/main/scripts/ready.py b/kubernetes/readiness/src/main/scripts/ready.py
index 93932073cd..b932b04284 100644
--- a/kubernetes/readiness/src/main/scripts/ready.py
+++ b/kubernetes/readiness/src/main/scripts/ready.py
@@ -60,10 +60,8 @@ def wait_for_statefulset_complete(statefulset_name):
     try:
         response = api.read_namespaced_stateful_set(statefulset_name, namespace)
         s = response.status
-        if (s.updated_replicas == response.spec.replicas and
-                s.replicas == response.spec.replicas and
+        if (s.replicas == response.spec.replicas and
                 s.ready_replicas == response.spec.replicas and
-                s.current_replicas == response.spec.replicas and
                 s.observed_generation == response.metadata.generation):
             log.info("Statefulset " + statefulset_name + "  is ready")
             return True
diff --git a/kubernetes/robot b/kubernetes/robot
index 77f1d25542..51322d3b37 160000
--- a/kubernetes/robot
+++ b/kubernetes/robot
@@ -1 +1 @@
-Subproject commit 77f1d25542848d7a5fd32f57436c9f413e0a5919
+Subproject commit 51322d3b374588a051b4a5522fbd25ac92ffb328
diff --git a/kubernetes/sdnc/values.yaml b/kubernetes/sdnc/values.yaml
index c8e974562e..cbb13417b4 100644
--- a/kubernetes/sdnc/values.yaml
+++ b/kubernetes/sdnc/values.yaml
@@ -302,7 +302,7 @@ localElasticCluster: true
 elasticsearch:
   nameOverride: sdnrdb
   name: sdnrdb-cluster
-  aafConfig:
+  certInitializer:
     fqdn: "sdnc"
     fqi_namespace: org.onap.sdnc
     fqi: "sdnc@sdnc.onap.org"
diff --git a/kubernetes/so/charts/so-bpmn-infra/values.yaml b/kubernetes/so/charts/so-bpmn-infra/values.yaml
index 71c7ceef1a..b6ba63e051 100755
--- a/kubernetes/so/charts/so-bpmn-infra/values.yaml
+++ b/kubernetes/so/charts/so-bpmn-infra/values.yaml
@@ -57,7 +57,7 @@ secrets:
 # Application configuration defaults.
 #################################################################
 repository: nexus3.onap.org:10001
-image: onap/so/bpmn-infra:1.6.1
+image: onap/so/bpmn-infra:1.6.2
 pullPolicy: Always
 
 db:
diff --git a/kubernetes/so/charts/so-catalog-db-adapter/values.yaml b/kubernetes/so/charts/so-catalog-db-adapter/values.yaml
index 4d30ae76c2..70d008b106 100755
--- a/kubernetes/so/charts/so-catalog-db-adapter/values.yaml
+++ b/kubernetes/so/charts/so-catalog-db-adapter/values.yaml
@@ -54,7 +54,7 @@ secrets:
 # Application configuration defaults.
 #################################################################
 repository: nexus3.onap.org:10001
-image: onap/so/catalog-db-adapter:1.6.1
+image: onap/so/catalog-db-adapter:1.6.2
 pullPolicy: Always
 
 db:
diff --git a/kubernetes/so/charts/so-monitoring/values.yaml b/kubernetes/so/charts/so-monitoring/values.yaml
index e3f5c3cc81..1272dbdb57 100644
--- a/kubernetes/so/charts/so-monitoring/values.yaml
+++ b/kubernetes/so/charts/so-monitoring/values.yaml
@@ -57,7 +57,7 @@ secrets:
 # Application configuration defaults.
 #################################################################
 repository: nexus3.onap.org:10001
-image: onap/so/so-monitoring:1.6.1
+image: onap/so/so-monitoring:1.6.2
 pullPolicy: Always
 
 db:
diff --git a/kubernetes/so/charts/so-nssmf-adapter/values.yaml b/kubernetes/so/charts/so-nssmf-adapter/values.yaml
index 6a5f5fbd30..7412dfa809 100755
--- a/kubernetes/so/charts/so-nssmf-adapter/values.yaml
+++ b/kubernetes/so/charts/so-nssmf-adapter/values.yaml
@@ -69,7 +69,7 @@ secrets:
 # Application configuration defaults.
 #################################################################
 repository: nexus3.onap.org:10001
-image: onap/so/nssmf-adapter:1.6.1
+image: onap/so/nssmf-adapter:1.6.2
 pullPolicy: Always
 
 db:
diff --git a/kubernetes/so/charts/so-openstack-adapter/values.yaml b/kubernetes/so/charts/so-openstack-adapter/values.yaml
index f2cd74d1c9..e611ee301b 100755
--- a/kubernetes/so/charts/so-openstack-adapter/values.yaml
+++ b/kubernetes/so/charts/so-openstack-adapter/values.yaml
@@ -51,7 +51,7 @@ secrets:
 #################################################################
 # Application configuration defaults.
 #################################################################
-image: onap/so/openstack-adapter:1.6.1
+image: onap/so/openstack-adapter:1.6.2
 pullPolicy: Always
 repository: nexus3.onap.org:10001
 
diff --git a/kubernetes/so/charts/so-request-db-adapter/values.yaml b/kubernetes/so/charts/so-request-db-adapter/values.yaml
index 9018c099bd..2541d0e92b 100755
--- a/kubernetes/so/charts/so-request-db-adapter/values.yaml
+++ b/kubernetes/so/charts/so-request-db-adapter/values.yaml
@@ -52,7 +52,7 @@ secrets:
 # Application configuration defaults.
 #################################################################
 repository: nexus3.onap.org:10001
-image: onap/so/request-db-adapter:1.6.1
+image: onap/so/request-db-adapter:1.6.2
 pullPolicy: Always
 
 db:
diff --git a/kubernetes/so/charts/so-sdc-controller/values.yaml b/kubernetes/so/charts/so-sdc-controller/values.yaml
index 31fdb63b45..3cba4a0fd6 100755
--- a/kubernetes/so/charts/so-sdc-controller/values.yaml
+++ b/kubernetes/so/charts/so-sdc-controller/values.yaml
@@ -52,7 +52,7 @@ secrets:
 # Application configuration defaults.
 #################################################################
 repository: nexus3.onap.org:10001
-image: onap/so/sdc-controller:1.6.1
+image: onap/so/sdc-controller:1.6.2
 pullPolicy: Always
 
 db:
diff --git a/kubernetes/so/charts/so-sdnc-adapter/values.yaml b/kubernetes/so/charts/so-sdnc-adapter/values.yaml
index ce42af00b7..0ea7e69348 100755
--- a/kubernetes/so/charts/so-sdnc-adapter/values.yaml
+++ b/kubernetes/so/charts/so-sdnc-adapter/values.yaml
@@ -55,7 +55,7 @@ secrets:
 # Application configuration defaults.
 #################################################################
 repository: nexus3.onap.org:10001
-image: onap/so/sdnc-adapter:1.6.1
+image: onap/so/sdnc-adapter:1.6.2
 pullPolicy: Always
 
 db:
diff --git a/kubernetes/so/charts/so-ve-vnfm-adapter/values.yaml b/kubernetes/so/charts/so-ve-vnfm-adapter/values.yaml
index 434a3e166f..5f9d5842cf 100755
--- a/kubernetes/so/charts/so-ve-vnfm-adapter/values.yaml
+++ b/kubernetes/so/charts/so-ve-vnfm-adapter/values.yaml
@@ -37,7 +37,7 @@ secrets:
 #################################################################
 # Application configuration defaults.
 #################################################################
-image: onap/so/ve-vnfm-adapter:1.6.1
+image: onap/so/ve-vnfm-adapter:1.6.2
 pullPolicy: Always
 replicaCount: 1
 service:
diff --git a/kubernetes/so/charts/so-vfc-adapter/values.yaml b/kubernetes/so/charts/so-vfc-adapter/values.yaml
index 28ca7016ef..d139b4968d 100755
--- a/kubernetes/so/charts/so-vfc-adapter/values.yaml
+++ b/kubernetes/so/charts/so-vfc-adapter/values.yaml
@@ -52,7 +52,7 @@ secrets:
 # Application configuration defaults.
 #################################################################
 repository: nexus3.onap.org:10001
-image: onap/so/vfc-adapter:1.6.1
+image: onap/so/vfc-adapter:1.6.2
 pullPolicy: Always
 
 db:
diff --git a/kubernetes/so/charts/so-vnfm-adapter/values.yaml b/kubernetes/so/charts/so-vnfm-adapter/values.yaml
index f911e499cd..9ddc0dd835 100755
--- a/kubernetes/so/charts/so-vnfm-adapter/values.yaml
+++ b/kubernetes/so/charts/so-vnfm-adapter/values.yaml
@@ -40,7 +40,7 @@ secrets:
 # Application configuration defaults.
 #################################################################
 repository: nexus3.onap.org:10001
-image: onap/so/vnfm-adapter:1.6.1
+image: onap/so/vnfm-adapter:1.6.2
 pullPolicy: Always
 
 replicaCount: 1
diff --git a/kubernetes/so/values.yaml b/kubernetes/so/values.yaml
index a8910b2a1d..a6f2c8cd7b 100755
--- a/kubernetes/so/values.yaml
+++ b/kubernetes/so/values.yaml
@@ -137,7 +137,7 @@ dbCreds:
   adminName: so_admin
 
 repository: nexus3.onap.org:10001
-image: onap/so/api-handler-infra:1.6.1
+image: onap/so/api-handler-infra:1.6.2
 pullPolicy: Always
 replicaCount: 1
 minReadySeconds: 10
diff --git a/kubernetes/uui/charts/uui-server/values.yaml b/kubernetes/uui/charts/uui-server/values.yaml
index 03265d4014..be34e3e57f 100644
--- a/kubernetes/uui/charts/uui-server/values.yaml
+++ b/kubernetes/uui/charts/uui-server/values.yaml
@@ -25,7 +25,7 @@ flavor: small
 
 # application image
 repository: nexus3.onap.org:10001
-image: onap/usecase-ui-server:3.0.1
+image: onap/usecase-ui-server:3.0.4
 pullPolicy: Always
 
 # application configuration
diff --git a/kubernetes/uui/values.yaml b/kubernetes/uui/values.yaml
index 2c15c9683c..79b649c63d 100644
--- a/kubernetes/uui/values.yaml
+++ b/kubernetes/uui/values.yaml
@@ -25,7 +25,7 @@ flavor: small
 
 # application image
 repository: nexus3.onap.org:10001
-image: onap/usecase-ui:3.0.1
+image: onap/usecase-ui:3.0.4
 pullPolicy: Always
 
 # application configuration