[PLATFROM] Update cert-manager release to 2.6.0

[oom.git] / kubernetes / platform / components / oom-cert-service / values.yaml

diff --git a/kubernetes/platform/components/oom-cert-service/values.yaml b/kubernetes/platform/components/oom-cert-service/values.yaml
index 759ebc3..d9c215c 100644 (file)
--- a/kubernetes/platform/components/oom-cert-service/values.yaml
+++ b/kubernetes/platform/components/oom-cert-service/values.yaml
@@ -1,4 +1,4 @@
-# Copyright © 2020, Nokia
+# Copyright © 2020-2021, Nokia
 # Modifications Copyright  © 2020, Nordix Foundation, Orange
 # Modifications Copyright © 2020 Nokia
 #
@@ -22,7 +22,16 @@ global:
   # Standard OOM
   pullPolicy: "Always"
   repository: "nexus3.onap.org:10001"
-  offlineDeploymentBuild: false
+  ingress:
+    enabled: true
+    # All http requests via ingress will be redirected
+    config:
+      ssl: "redirect"
+    # you can set an own Secret containing a certificate
+    #  tls:
+    #    secret: 'my-ingress-cert'
+    # optional: Namespace of the Istio IngressGateway
+    namespace: &ingressNamespace istio-ingress
 
 
 # Service configuration
@@ -33,12 +42,9 @@ service:
       port: 8443
       port_protocol: http
 
-# Certificates generation configuration
-certificateGenerationImage: onap/integration-java11:7.1.0
-
 # Deployment configuration
 repository: "nexus3.onap.org:10001"
-image: onap/org.onap.oom.platform.cert-service.oom-certservice-api:2.3.1
+image: onap/org.onap.oom.platform.cert-service.oom-certservice-api:2.6.0
 pullPolicy: Always
 replicaCount: 1
 
@@ -79,9 +85,24 @@ cmpServers:
     mountPath: /etc/onap/oom/certservice
 
 tls:
+  issuer:
+    selfsigning:
+      name: &selfSigningIssuer cmpv2-selfsigning-issuer
+    ca:
+      name: &caIssuer cmpv2-issuer-onap
+      secret:
+        name: &caKeyPairSecret  cmpv2-ca-key-pair
+    ingressSelfsigned:
+      name: ingress-selfsigned-issuer
+      namespace: *ingressNamespace
+    ingressCa:
+      name: ingress-ca-issuer
+      namespace: *ingressNamespace
+      secret:
+        name: ingress-ca-key-pair
   server:
     secret:
-      name: oom-cert-service-server-tls-secret
+      name: &serverSecret oom-cert-service-server-tls-secret
     volume:
       name: oom-cert-service-server-tls-volume
       mountPath: /etc/onap/oom/certservice/certs/
@@ -91,21 +112,21 @@ tls:
 
 envs:
   keystore:
-    jksName: certServiceServer-keystore.jks
-    p12Name: certServiceServer-keystore.p12
+    jksName: keystore.jks
+    p12Name: keystore.p12
+    pemName: tls.crt
   truststore:
     jksName: truststore.jks
-    crtName: root.crt
+    crtName: ca.crt
+    pemName: tls.crt
   httpsPort: 8443
 
 # External secrets with credentials can be provided to override default credentials defined below,
 # by uncommenting and filling appropriate *ExternalSecret value
 credentials:
   tls:
-    keystorePassword: secret
-    truststorePassword: secret
-    #keystorePasswordExternalSecret:
-    #truststorePasswordExternalSecret:
+    certificatesPassword: secret
+    #certificatesPasswordExternalSecret:
   # Below cmp values contain credentials for EJBCA test instance and are relevant only if global addTestingComponents flag is enabled
   cmp:
     # Used only if cmpv2 testing is enabled
@@ -121,17 +142,11 @@ credentials:
       # rv: unused
 
 secrets:
-  - uid: keystore-password
-    name: '{{ include "common.release" . }}-keystore-password'
+  - uid: certificates-password
+    name: &certificatesPasswordSecretName '{{ .Values.cmpv2Config.global.platform.certificates.keystorePasswordSecretName }}'
     type: password
-    externalSecret: '{{ tpl (default "" .Values.credentials.tls.keystorePasswordExternalSecret) . }}'
-    password: '{{ .Values.credentials.tls.keystorePassword }}'
-    passwordPolicy: required
-  - uid: truststore-password
-    name: '{{ include "common.release" . }}-truststore-password'
-    type: password
-    externalSecret: '{{ tpl (default "" .Values.credentials.tls.truststorePasswordExternalSecret) . }}'
-    password: '{{ .Values.credentials.tls.truststorePassword }}'
+    externalSecret: '{{ tpl (default "" .Values.credentials.tls.certificatesPasswordExternalSecret) . }}'
+    password: '{{ .Values.credentials.tls.certificatesPassword }}'
     passwordPolicy: required
   # Below values are relevant only if global addTestingComponents flag is enabled
   - uid: ejbca-server-client-iak
@@ -150,3 +165,65 @@ secrets:
     type: password
     externalSecret: '{{ tpl (default "" .Values.credentials.cmp.raRvExternalSecret) . }}'
     password: '{{ .Values.credentials.cmp.ra.rv }}'
+
+# Certificates definitions
+certificates:
+  - name: selfsigned-cert
+    secretName: *caKeyPairSecret
+    isCA: true
+    commonName: root.com
+    subject:
+      organization: Root Company
+      country: PL
+      locality: Wroclaw
+      province: Dolny Slask
+      organizationalUnit: Root Org
+    issuer:
+      name: *selfSigningIssuer
+      kind: Issuer
+  - name: cert-service-server-cert
+    secretName: *serverSecret
+    commonName: oom-cert-service
+    dnsNames:
+      - oom-cert-service
+      - localhost
+    subject:
+      organization: certServiceServer org
+      country: PL
+      locality: Wroclaw
+      province: Dolny Slask
+      organizationalUnit: certServiceServer company
+    usages:
+      - server auth
+      - client auth
+    keystore:
+      outputType:
+        - jks
+        - p12
+      passwordSecretRef:
+        name: *certificatesPasswordSecretName
+        key: password
+    issuer:
+      name: *caIssuer
+      kind: Issuer
+  - name: cert-service-client-cert
+    secretName: '{{ .Values.cmpv2Config.global.platform.certificates.clientSecretName | default .Values.tls.client.secret.defaultName }}'
+    commonName: certServiceClient.com
+    subject:
+      organization: certServiceClient org
+      country: PL
+      locality: Wroclaw
+      province: Dolny Slask
+      organizationalUnit: certServiceClient company
+    usages:
+      - server auth
+      - client auth
+    keystore:
+      outputType:
+        - jks
+      passwordSecretRef:
+        name: *certificatesPasswordSecretName
+        key: password
+    issuer:
+      name: *caIssuer
+      kind: Issuer