Merge "[AAI] Make aai log level configurable"
[oom.git] / kubernetes / so / values.yaml
index b14c014..0d53ea3 100755 (executable)
@@ -1,6 +1,8 @@
 # Copyright © 2018 AT&T USA
 # Copyright © 2020 Huawei
 # Copyright © 2021 Orange
+# Copyright © 2024 Deutsche Telekom Intellectual Property. All rights reserved.
+# Modifications Copyright © 2023 Nordix Foundation
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
 global:
   nodePortPrefix: 302
   nodePortPrefixExt: 304
-  aafAgentImage: onap/aaf/aaf_agent:2.1.20
+  centralizedLoggingEnabled: true
   mariadbGalera:
+    # flag to enable the DB creation via mariadb-operator
+    useOperator: true
     nameOverride: mariadb-galera
-    serviceName: mariadb-galera
     servicePort: '3306'
     service: mariadb-galera
     internalPort: '3306'
-    # mariadbRootPassword: secretpassword
-    # rootPasswordExternalSecret: some secret
-    #This flag allows SO to instantiate its own mariadb-galera cluster,
-    #serviceName and nameOverride should be so-mariadb-galera if this flag is enabled
+    # This flag allows SO to instantiate its own mariadb-galera cluster,
+    # serviceName and nameOverride should be so-mariadb-galera if this flag is enabled
     localCluster: false
+    # (optional) if localCluster=false and an external secret is used set this variable
+    #userRootSecret: <secretName>
   persistence:
     mountPath: /dockerdata-nfs
   #This configuration specifies Service and port for SDNC OAM interface
@@ -45,22 +48,11 @@ global:
     dbPassword: secretpassword
     # dbCredsExternalSecret: some secret
   msbEnabled: true
-  security:
-    aaf:
-      enabled: false
-  aaf:
-    auth:
-      header: Basic c29Ac28ub25hcC5vcmc6ZGVtbzEyMzQ1Ngo=
-      encrypted: 3EDC974C5CD7FE54C47C7490AF4D3B474CDD7D0FFA35A7ACDE3E209631E45F428976EAC0858874F17390A13149E63C90281DD8D20456
   app:
     siteName: onapheat
     auth: 3EDC974C5CD7FE54C47C7490AF4D3B474CDD7D0FFA35A7ACDE3E209631E45F428976EAC0858874F17390A13149E63C90281DD8D20456
     defaultCloudOwner: onap
 
-  certificates:
-    path: /etc/ssl/certs
-    share_path: /usr/local/share/ca-certificates/
-
 readinessCheck:
   wait_for:
     jobs:
@@ -73,11 +65,24 @@ secrets:
   - uid: db-root-pass
     name: &dbRootPassSecretName '{{ include "common.release" . }}-so-db-root-pass'
     type: password
-    externalSecret: '{{ .Values.global.mariadbGalera.localCluster | ternary
-      .Values.global.mariadbGalera.rootPasswordExternalSecret
-      (default (include "common.mariadb.secret.rootPassSecretName"
-        (dict "dot" . "chartName" .Values.global.mariadbGalera.nameOverride))
-        .Values.global.mariadbGalera.rootPasswordExternalSecret)  }}'
+    # If we're using shared mariadb, we need to use the secret name (second
+    # part).
+    # If not, we do the same trick than for user db secret hat allows you
+    # override this secret using external one with the same field that is used
+    # to pass this to subchart.
+    externalSecret: '{{ .Values.global.mariadbGalera.localCluster |
+      ternary (( hasSuffix "so-db-root-pass" (index .Values "mariadb-galera" "rootUser" "externalSecret")) |
+               ternary
+                  ""
+                  (tpl (default "" (index .Values "mariadb-galera" "rootUser" "externalSecret")) .)
+               )
+               ( (not (empty (default "" .Values.global.mariadbGalera.userRootSecret))) |
+                 ternary
+                   .Values.global.mariadbGalera.userRootSecret
+                   (include "common.mariadb.secret.rootPassSecretName"
+                     (dict "dot" . "chartName" .Values.global.mariadbGalera.nameOverride)
+                   )
+               ) }}'
     password: '{{ .Values.global.mariadbGalera.mariadbRootpassword }}'
   - uid: db-backup-creds
     name: &dbBackupCredsSecretName '{{ include "common.release" . }}-so-db-backup-creds'
@@ -128,13 +133,6 @@ secrets:
     login: '{{ .Values.server.bpel.username }}'
     password: '{{ .Values.server.bpel.password }}'
     passwordPolicy: required
-  - uid: so-aaf-creds
-    name: &aaf-secrets '{{ include "common.release" . }}-so-server-aaf-creds'
-    type: basicAuth
-    externalSecret: '{{ tpl (default "" .Values.server.aafCredsExternalSecret) . }}'
-    login: '{{ .Values.server.aaf.username }}'
-    password: '{{ .Values.server.aaf.password }}'
-    passwordPolicy: required
   - uid: so-aai-creds
     name: &aai-secrets '{{ include "common.release" . }}-so-server-aai-creds'
     type: basicAuth
@@ -143,32 +141,7 @@ secrets:
     password: '{{ .Values.server.aai.password }}'
     passwordPolicy: required
 
-aafConfig:
-  permission_user: 1000
-  permission_group: 999
-
-aaf:
-  trustore: org.onap.so.trust.jks
-
-#################################################################
-# AAF part for Ingress
-#################################################################
-certInitializer:
-  nameOverride: so-tls-cert
-  aafDeployFqi: deployer@people.osaaf.org
-  aafDeployPass: demo123456!
-  # aafDeployCredsExternalSecret: some secret
-  fqdn: so
-  fqi: so@so.onap.org
-  public_fqdn: so.onap.org
-  fqi_namespace: org.onap.so
-  cadi_longitude: '0.0'
-  cadi_latitude: '0.0'
-  app_ns: org.osaaf.aaf
-  credsPath: /opt/app/osaaf/local
-  ingressTlsSecret: '{{ include "common.release" . }}-so-ingress-certs'
-
-#################################################################
+##################################################################
 # Application configuration defaults.
 #################################################################
 
@@ -181,13 +154,9 @@ dbCreds:
   userName: so_user
   adminName: so_admin
 
-image: onap/so/api-handler-infra:1.9.2
+image: onap/so/api-handler-infra:1.12.2
 
 server:
-  aaf:
-    username: so@so.onap.org
-    password: demo123456
-  # aafCredsExternalSecret: some secret
   aai:
     username: aai@aai.onap.org
     password: demo123456!
@@ -209,45 +178,405 @@ logPath: ./logs/apih/
 app: api-handler-infra
 service:
   type: NodePort
-  nodePort: 77
   internalPort: *containerPort
-  externalPort: *containerPort
-  portName: so-apih-port
+  ports:
+    - name: http
+      port: *containerPort
+      nodePort: '77'
+  annotations:
+    msb.onap.org/service-info: |
+      {{ if .Values.global.msbEnabled -}}[
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/cloudResources/{version:[vV][1]}/operationalEnvironments",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/cloudResources/{version:[vV][1]}/operationalEnvironments/{operationalEnvironmentId}/activate",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/cloudResources/{version:[vV][1]}/operationalEnvironments/{operationalEnvironmentId}/deactivate",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/cloudResourcesRequests/{version:[vV][1]}/{requestId}/unlock",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/cloudResourcesRequests/{version:[vV][1]}",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/orchestrationRequests/{version:[vV][4-7]}/{requestId}",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/orchestrationRequests/{version:[vV][4-7]}",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/orchestrationRequests/{version:[vV][4-7]}/{requestId}/unlock",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiation/{version:[vV][5-7]}/serviceInstances",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiation/{version:[vV][5-7]}/serviceInstances/{serviceInstanceId}/activate",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiation/{version:[vV][5-7]}/serviceInstances/{serviceInstanceId}/deactivate",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiationRequests/{version:[vV][5-7]}/serviceInstances/{serviceInstanceId}",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiationRequests/{version:[vV][7]}/serviceInstances/assign",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiation/{version:[vV][7]}/serviceInstances/{serviceInstanceId}/unassign",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiation/{version:[vV][5-7]}/serviceInstances/{serviceInstanceId}/configurations",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiation/{version:[vV][5-7]}/serviceInstances/{serviceInstanceId}/configurations/{configurationInstanceId}",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiation/{version:[vV][5-7]}/serviceInstances/{serviceInstanceId}/configurations/{configurationInstanceId}/enablePort",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiation/{version:[vV][5-7]}/serviceInstances/{serviceInstanceId}/configurations/{configurationInstanceId}/disablePort",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiation/{version:[vV][5-7]}/serviceInstances/{serviceInstanceId}/configurations/{configurationInstanceId}/activate",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiationRequests/{version:[vV][5-7]}/serviceInstances/{serviceInstanceId}/configurations/{configurationInstanceId}/deactivate",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiationRequests/{version:[vV][6-7]}/serviceInstances/{serviceInstanceId}/addRelationships",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiation/{version:[vV][6-7]}/serviceInstances/{serviceInstanceId}/removeRelationships",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiation/{version:[vV][5-7]}/serviceInstances/{serviceInstanceId}/vnfs",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiation/{version:[vV][5-7]}/serviceInstances/{serviceInstanceId}/vnfs/{vnfInstanceId}/replace",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiation/{version:[vV][5-7]}/serviceInstances/{serviceInstanceId}/vnfs/{vnfInstanceId}",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiation/{version:[vV][6-7]}/serviceInstances/{serviceInstanceId}/vnfs/{vnfInstanceId}/applyUpdatedConfig",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiation/{version:[vV][5-7]}/serviceInstances/{serviceInstanceId}/vnfs/{vnfInstanceId}",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiationRequests/{version:[vV][5-7]}/serviceInstances/{serviceInstanceId}/vnfs/{vnfInstanceId}/vfModules",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiationRequests/{version:[vV][5-7]}/serviceInstances/{serviceInstanceId}/vnfs/{vnfInstanceId}/vfModules/{vfmoduleInstanceId}/replace",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiationRequests/{version:[vV][5-7]}/serviceInstances/{serviceInstanceId}/vnfs/{vnfInstanceId}/vfModules/{vfmoduleInstanceId}",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiationRequests/{version:[vV][6-7]}/serviceInstances/{serviceInstanceId}/vnfs/{vnfInstanceId}/inPlaceSoftwareUpdate",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiationRequests/{version:[vV][5-7]}/serviceInstances/{serviceInstanceId}/vnfs/{vnfInstanceId}/vfModules/{vfmoduleInstanceId}",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiation/{version:[vV][7]}/serviceInstances/{serviceInstanceId}/vnfs/{vnfInstanceId}/vfModules/{vfmoduleInstanceId}/deactivateAndCloudDelete",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiation/{version:[vV][7]}/serviceInstances/{serviceInstanceId}/vnfs/{vnfInstanceId}/vfModules/scaleOut",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiation/{version:[vV][5-7]}/serviceInstances/{serviceInstanceId}/vnfs/{vnfInstanceId}/volumeGroups",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiationRequests/{version:[vV][5-7]}/serviceInstances/{serviceInstanceId}/vnfs/{vnfInstanceId}/volumeGroups/{volumeGroupInstanceId}",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiationRequests/{version:[vV][5-7]}/serviceInstances/{serviceInstanceId}/vnfs/{vnfInstanceId}/volumeGroups/{volumeGroupInstanceId}",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiation/{version:[vV][5-7]}/serviceInstances/{serviceInstanceId}/networks",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiationRequests/{version:[vV][5-7]}/serviceInstances/{serviceInstanceId}/networks/{networkInstanceId}",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        },
+        {
+          "serviceName": "so",
+          "version": "v1",
+          "url": "/onap/so/infra/serviceInstantiationRequests/{version:[vV][5-7]}/serviceInstances/{serviceInstanceId}/networks/{networkInstanceId}",
+          "protocol": "REST",
+          "port": "{{ .Values.service.internalPort }}",
+          "visualRange":"0",
+          "lb_policy":"ip_hash"
+        }
+      ]{{ end }}
+
 updateStrategy:
   type: RollingUpdate
   maxUnavailable: 1
   maxSurge: 1
 
-#################################################################
+################################################################
 # soHelpers part
 #################################################################
 soHelpers:
-  nameOverride: so-apih-cert-init
-  certInitializer:
-    nameOverride: so-apih-cert-init
-  credsPath: /opt/app/osaaf/local
   containerPort: *containerPort
 
 # Resource Limit flavor -By Default using small
 flavor: small
 # Segregation for Different environment (Small and Large)
-persistence:
-  certificatesPath: /certificates
 resources:
   small:
     limits:
-      cpu: 2000m
-      memory: 4Gi
+      cpu: "1"
+      memory: "4Gi"
     requests:
-      cpu: 500m
-      memory: 1Gi
+      cpu: "0.5"
+      memory: "1Gi"
   large:
     limits:
-      cpu: 4000m
-      memory: 8Gi
+      cpu: "2"
+      memory: "8Gi"
     requests:
-      cpu: 1000m
-      memory: 2Gi
+      cpu: "1"
+      memory: "2Gi"
   unlimited: {}
 
 nodeSelector: {}
@@ -265,11 +594,18 @@ config:
 #                                                       --set so.global.mariadbGalera.localCluster=true \
 #                                                       --set so.global.mariadbGalera.nameOverride=so-mariadb-galera \
 #                                                       --set so.global.mariadbGalera.serviceName=so-mariadb-galera
-mariadb-galera:
+mariadb-galera: &mariadbGalera
   rootUser:
     externalSecret: *dbRootPassSecretName
   nameOverride: &so-mariadb so-mariadb-galera
   replicaCount: 1
+  service:
+    name: *so-mariadb
+    portName: *so-mariadb
+    internalPort: 3306
+  mariadbOperator:
+    galera:
+      enabled: false
   persistence:
     mountSubPath: so/mariadb-galera/data
     enabled: true
@@ -279,12 +615,21 @@ mariadb-galera:
 ingress:
   enabled: false
   service:
-    - baseaddr: 'so.api'
+    - baseaddr: 'so-api'
       name: 'so'
       port: 8080
-  config:
-    tls:
-      secret: '{{ include "common.release" . }}-so-ingress-certs'
+
+serviceMesh:
+  authorizationPolicy:
+    authorizedPrincipals:
+      - serviceAccount: consul-read
+      - serviceAccount: consul-server-read
+      - serviceAccount: nbi-read
+      - serviceAccount: policy-drools-pdp-read
+      - serviceAccount: so-bpmn-infra-read
+      - serviceAccount: robot-read
+      - serviceAccount: istio-ingress
+        namespace: istio-ingress
 
 mso:
   adapters:
@@ -307,48 +652,69 @@ mso:
   health:
     auth: basic bXNvX2FkbWlufHBhc3N3b3JkMSQ=
 
-so-appc-orchestrator:
-  enabled: false
-  server:
-    actuatorCredsExternalSecret: *actuator-secrets
-  db:
-    <<: *dbSecrets
-
 so-bpmn-infra:
+  mariadb-galera:
+    <<: *mariadbGalera
   db:
     <<: *dbSecrets
+  logConfigMapNamePrefix: '{{ include "common.release" . }}-so'
 
 so-catalog-db-adapter:
   enabled: true
+  mariadb-galera:
+    <<: *mariadbGalera
   db:
     <<: *dbSecrets
 
 so-cnf-adapter:
   enabled: true
+  mariadb-galera:
+    <<: *mariadbGalera
   db:
     <<: *dbSecrets
   server:
-    aafCredsExternalSecret: *aaf-secrets
     aaiCredsExternalSecret: *aai-secrets
     actuatorCredsExternalSecret: *actuator-secrets
   mso:
     msoKeySecret: *mso-key
 
+so-cnfm-lcm:
+  enabled: true
+  mariadb-galera:
+    <<: *mariadbGalera
+  db:
+    <<: *dbSecrets
+
 so-etsi-nfvo-ns-lcm:
   enabled: true
+  mariadb-galera:
+    <<: *mariadbGalera
   db:
     <<: *dbSecrets
 
 so-mariadb:
+  mariadb-galera:
+    <<: *mariadbGalera
   db:
     rootPasswordExternalSecretLocalDb: *dbRootPassSecretName
-    rootPasswordExternalSecret: '{{ ternary .Values.db.rootPasswordExternalSecretLocalDb (include "common.mariadb.secret.rootPassSecretName" (dict "dot" . "chartName" .Values.global.mariadbGalera.nameOverride)) .Values.global.mariadbGalera.localCluster }}'
+    #rootPasswordExternalSecretLocalDb: *dbRootPassSecretName
+    rootPasswordExternalSecret: '{{ .Values.global.mariadbGalera.localCluster |
+      ternary (tpl .Values.db.rootPasswordExternalSecretLocalDb .)
+               ( (not (empty (default "" .Values.global.mariadbGalera.userRootSecret))) |
+                 ternary
+                   .Values.global.mariadbGalera.userRootSecret
+                   (include "common.mariadb.secret.rootPassSecretName"
+                     (dict "dot" . "chartName" .Values.global.mariadbGalera.nameOverride)
+                   )
+               ) }}'
     backupCredsExternalSecret: *dbBackupCredsSecretName
     userCredsExternalSecret: *dbUserCredsSecretName
     adminCredsExternalSecret: *dbAdminCredsSecretName
 
 so-admin-cockpit:
   enabled: true
+  mariadb-galera:
+    <<: *mariadbGalera
   db:
     <<: *dbSecrets
 
@@ -357,11 +723,15 @@ so-nssmf-adapter:
   server:
     actuatorCredsExternalSecret: *actuator-secrets
     bpelCredsExternalSecret: *bpel-secrets
+  mariadb-galera:
+    <<: *mariadbGalera
   db:
     <<: *dbSecrets
 
 so-oof-adapter:
   enabled: true
+  mariadb-galera:
+    <<: *mariadbGalera
   db:
     <<: *dbSecrets
   mso:
@@ -369,32 +739,46 @@ so-oof-adapter:
     camundaAuth: AE2E9BE6EF9249085AF98689C4EE087736A5500629A72F35068FFB88813A023581DD6E765071F1C04075B36EA4213A
     oof:
       authSecret: *mso-oof-auth
+  logConfigMapNamePrefix: '{{ include "common.release" . }}-so'
 
 so-openstack-adapter:
   enabled: true
+  mariadb-galera:
+    <<: *mariadbGalera
   db:
     <<: *dbSecrets
+  logConfigMapNamePrefix: '{{ include "common.release" . }}-so'
 
 so-request-db-adapter:
+  mariadb-galera:
+    <<: *mariadbGalera
   db:
     <<: *dbSecrets
 
 so-sdc-controller:
+  mariadb-galera:
+    <<: *mariadbGalera
   db:
     <<: *dbSecrets
+  logConfigMapNamePrefix: '{{ include "common.release" . }}-so'
 
 so-sdnc-adapter:
   enabled: true
+  mariadb-galera:
+    <<: *mariadbGalera
   db:
     <<: *dbSecrets
   mso:
     msoKeySecret: *mso-key
+  logConfigMapNamePrefix: '{{ include "common.release" . }}-so'
 
 so-ve-vnfm-adapter:
   enabled: false
 
 so-etsi-sol005-adapter:
   enabled: true
+  mariadb-galera:
+    <<: *mariadbGalera
   db:
     <<: *dbSecrets
 
@@ -406,3 +790,7 @@ serviceAccount:
   nameOverride: so
   roles:
     - read
+
+#Log configuration
+log:
+  path: /var/log/onap