# Mac OS
*DS_Store*
+
+# dist
+dist
cd so/resources/config/mso/
/oom/kubernetes/so/resources/config/mso# echo -n "<openstack tenant password>" | openssl aes-128-ecb -e -K `cat encryption.key` -nosalt | xxd -c 256 -p``
+ Use OS_PASSWORD value from openstack .RC file for "openstack tenant password"
+
c. Generating SO Encrypted Password:
The SO Encrypted Password uses a java based encryption utility since the
Java encryption library is not easy to integrate with openssl/python that
To generate SO ``openStackEncryptedPasswordHere`` and ``openStackSoEncryptedPassword``
ensure `default-jdk` is installed::
- apt-get update; apt-get install default-jdk
+ sudo apt-get update; sudo apt-get install default-jdk
Then execute::
deployment need not worry about this setting but for the demonstration VNFs
the ip asssignment strategy assumes 10.0 ip prefix.
+.. note::
+ Copy below required openstack.yaml file and update the parameters for the variables
+ accordingly from openstack environment (openrc file) and replace
+
Example Keystone v2.0
.. literalinclude:: example-integration-override.yaml
> helm undeploy dev --purge
+.. note::
+ After undeploy follow the below steps to cleanup everything before redeplying ONAP
+
+::
+
+ > kubectl delete namespace onap
+
+ > kubectl delete pv -n onap --all
+
+ > kubectl delete pvc -n onap --all
+
+ > sudo rm -rf /dockerdata-nfs/*
+
More examples of using the deploy and undeploy plugins can be found here: https://wiki.onap.org/display/DW/OOM+Helm+%28un%29Deploy+plugins
.. (c) ONAP Project and its contributors
.. _release_notes_guilin:
+:orphan:
+
*************************************
ONAP Operations Manager Release Notes
*************************************
# publish helm plugins via distrubtion directory
plugins:
- @cp -R $(HELM_BIN) $(PACKAGE_DIR)/
+ @cp -R helm $(PACKAGE_DIR)/
# start up a local helm repo to serve up helm chart packages
# WARNING: Only helm < v3 supported
env:
- name: APP_CONFIG_HOME
value: {{ .Values.config.appConfigDir }}
- - name: USE_SCRIPT_COMPILE_CACHE
- value: {{ .Values.config.useScriptCompileCache | quote }}
- # Cluster should only be enabled when replicaCount is more than 2 and useScriptCompileCache is set to false otherwise it won't work properly
- name: CLUSTER_ENABLED
- value: {{ if and (gt (int (.Values.replicaCount)) 2) (not .Values.config.useScriptCompileCache) }} {{ .Values.cluster.enabled | quote }} {{ else }} "false" {{ end }}
+ value: {{ if (gt (int (.Values.replicaCount)) 2) }} {{ .Values.cluster.enabled | quote }} {{ else }} "false" {{ end }}
- name: CLUSTER_ID
value: {{ .Values.cluster.clusterName }}
- name: CLUSTER_NODE_ID
# application configuration
config:
appConfigDir: /opt/app/onap/config
- useScriptCompileCache: false
sdncDB:
dbService: mariadb-galera
dbPort: 3306
cluster:
# Cannot have cluster enabled if the replicaCount is not at least 3
- # AND config value useScriptCompileCache is not set to false
enabled: true
clusterName: cds-cluster
global:
platform:
certServiceClient:
- image: onap/org.onap.oom.platform.cert-service.oom-certservice-client:2.3.1
+ image: onap/org.onap.oom.platform.cert-service.oom-certservice-client:2.3.2
secretName: oom-cert-service-client-tls-secret
envVariables:
# Certificate related
keystorePassword: "secret"
truststorePassword: "secret"
certPostProcessor:
- image: onap/org.onap.oom.platform.cert-service.oom-certservice-post-processor:2.3.1
+ image: onap/org.onap.oom.platform.cert-service.oom-certservice-post-processor:2.3.2
--- /dev/null
+{{/*#
+# Copyright © 2020, Nokia
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.*/}}
+
+{{/*
+# This is a template for requesting a certificate from the cert-manager (https://cert-manager.io).
+#
+# To request a certificate following steps are to be done:
+# - create an object 'certificates' in the values.yaml
+# - create a file templates/certificates.yaml and invoke the function "commom.certificate".
+#
+# Here is an example of the certificate request for a component:
+#
+# Directory structure:
+# component
+# templates
+# certifictes.yaml
+# values.yaml
+#
+# To be added in the file certificates.yamll
+#
+# To be added in the file values.yaml
+# 1. Minimal version (certificates only in PEM format)
+# certificates:
+# - name: onap-component-certificate
+# secretName: onap-component-certificate
+# commonName: component.onap.org
+# 2. Extended version (with defined own issuer and additional certificate format):
+# certificates:
+# - name: onap-component-certificate
+# secretName: onap-component-certificate
+# commonName: component.onap.org
+# dnsNames:
+# - component.onap.org
+# issuer:
+# group: certmanager.onap.org
+# kind: CMPv2Issuer
+# name: cmpv2-issuer-for-the-component
+# p12Keystore:
+# create: true
+# passwordSecretRef:
+# name: secret-name
+# key: secret-key
+# jksKeystore:
+# create: true
+# passwordSecretRef:
+# name: secret-name
+# key: secret-key
+#
+# Fields 'name', 'secretName' and 'commonName' are mandatory and required to be defined.
+# Other mandatory fields for the certificate definition do not have to be defined directly,
+# in that case they will be taken from default values.
+#
+# Default values are defined in file onap/values.yaml (see-> global.certificate.default)
+# and can be overriden during onap installation process.
+#
+*/}}
+
+{{- define "common.certificate" -}}
+{{- $dot := default . .dot -}}
+{{- $certificates := $dot.Values.certificates -}}
+
+{{ range $certificate := $certificates }}
+{{/*# General certifiacate attributes #*/}}
+{{- $name := $certificate.name -}}
+{{- $secretName := $certificate.secretName -}}
+{{- $commonName := default $dot.Values.global.certificate.default.commonName $certificate.commonName -}}
+{{- $renewBefore := default $dot.Values.global.certificate.default.renewBefore $certificate.renewBefore -}}
+{{- $duration := $certificate.duration -}}
+{{- $namespace := default $dot.Release.Namespace $dot.Values.global.certificate.default.namespace -}}
+{{- if $certificate.namespace -}}
+{{- $namespace = default $namespace $certificate.namespace -}}
+{{- end -}}
+{{/*# SAN's #*/}}
+{{- $dnsNames := default $dot.Values.global.certificate.default.dnsNames $certificate.dnsNames -}}
+{{- $ipAddresses := default $dot.Values.global.certificate.default.ipAddresses $certificate.ipAddresses -}}
+{{- $uris := default $dot.Values.global.certificate.default.uris $certificate.uris -}}
+{{- $emailAddresses := default $dot.Values.global.certificate.default.emailAddresses $certificate.emailAddresses -}}
+{{/*# Subject #*/}}
+{{- $subject := $dot.Values.global.certificate.default.subject -}}
+{{- if $certificate.subject -}}
+{{- $subject = mergeOverwrite $subject $certificate.subject -}}
+{{- end -}}
+{{/*# Issuer #*/}}
+{{- $issuer := $dot.Values.global.certificate.default.issuer -}}
+{{- if $certificate.issuer -}}
+{{- $issuer = mergeOverwrite $issuer $certificate.issuer -}}
+{{- end -}}
+{{/*# Keystores #*/}}
+{{- $createJksKeystore := $dot.Values.global.certificate.default.jksKeystore.create -}}
+{{- $jksKeystorePasswordSecretName := $dot.Values.global.certificate.default.jksKeystore.passwordSecretRef.name -}}
+{{- $jksKeystorePasswordSecreKey := $dot.Values.global.certificate.default.jksKeystore.passwordSecretRef.key -}}
+{{- $createP12Keystore := $dot.Values.global.certificate.default.p12Keystore.create -}}
+{{- $p12KeystorePasswordSecretName := $dot.Values.global.certificate.default.p12Keystore.passwordSecretRef.name -}}
+{{- $p12KeystorePasswordSecreKey := $dot.Values.global.certificate.default.p12Keystore.passwordSecretRef.key -}}
+{{- if $certificate.jksKeystore -}}
+{{- $createJksKeystore = default $createJksKeystore $certificate.jksKeystore.create -}}
+{{- if $certificate.jksKeystore.passwordSecretRef -}}
+{{- $jksKeystorePasswordSecretName = default $jksKeystorePasswordSecretName $certificate.jksKeystore.passwordSecretRef.name -}}
+{{- $jksKeystorePasswordSecreKey = default $jksKeystorePasswordSecreKey $certificate.jksKeystore.passwordSecretRef.key -}}
+{{- end -}}
+{{- end -}}
+{{- if $certificate.p12Keystore -}}
+{{- $createP12Keystore = default $createP12Keystore $certificate.p12Keystore.create -}}
+{{- if $certificate.p12Keystore.passwordSecretRef -}}
+{{- $p12KeystorePasswordSecretName = default $p12KeystorePasswordSecretName $certificate.p12Keystore.passwordSecretRef.name -}}
+{{- $p12KeystorePasswordSecreKey = default $p12KeystorePasswordSecreKey $certificate.p12Keystore.passwordSecretRef.key -}}
+{{- end -}}
+{{- end -}}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+ name: {{ $name }}
+ namespace: {{ $namespace }}
+spec:
+ secretName: {{ $secretName }}
+ commonName: {{ $commonName }}
+ renewBefore: {{ $renewBefore }}
+ {{- if $duration }}
+ duration: {{ $duration }}
+ {{- end }}
+ subject:
+ organizations:
+ - {{ $subject.organization }}
+ countries:
+ - {{ $subject.country }}
+ localities:
+ - {{ $subject.locality }}
+ provinces:
+ - {{ $subject.province }}
+ organizationalUnits:
+ - {{ $subject.organizationalUnit }}
+ {{- if $dnsNames }}
+ dnsNames:
+ {{- range $dnsName := $dnsNames }}
+ - {{ $dnsName }}
+ {{- end }}
+ {{- end }}
+ {{- if $ipAddresses }}
+ ipAddresses:
+ {{- range $ipAddress := $ipAddresses }}
+ - {{ $ipAddress }}
+ {{- end }}
+ {{- end }}
+ {{- if $uris }}
+ uris:
+ {{- range $uri := $uris }}
+ - {{ $uri }}
+ {{- end }}
+ {{- end }}
+ {{- if $emailAddresses }}
+ emailAddresses:
+ {{- range $emailAddress := $emailAddresses }}
+ - {{ $emailAddress }}
+ {{- end }}
+ {{- end }}
+ issuerRef:
+ group: {{ $issuer.group }}
+ kind: {{ $issuer.kind }}
+ name: {{ $issuer.name }}
+ {{- if or $createJksKeystore $createP12Keystore }}
+ keystores:
+ {{- if $createJksKeystore }}
+ jks:
+ create: {{ $createJksKeystore }}
+ passwordSecretRef:
+ name: {{ $jksKeystorePasswordSecretName }}
+ key: {{ $jksKeystorePasswordSecreKey }}
+ {{- end }}
+ {{- if $createP12Keystore }}
+ pkcs12:
+ create: {{ $createP12Keystore }}
+ passwordSecretRef:
+ name: {{ $p12KeystorePasswordSecretName }}
+ key: {{ $p12KeystorePasswordSecreKey }}
+ {{- end }}
+ {{- end }}
+{{ end }}
+
+{{- end -}}
fieldPath: metadata.name
- name: BITNAMI_DEBUG
value: {{ ternary "true" "false" .Values.debug | quote }}
- - name: DB_INIT_SLEEP_TIME
+ - name: MARIADB_INIT_SLEEP_TIME
value: {{ .Values.init_sleep_time | quote }}
- name: MARIADB_GALERA_CLUSTER_NAME
value: {{ .Values.galera.name | quote }}
--- /dev/null
+components/dist
disableNfsProvisioner: true
# application image
-image: onap/org.onap.dcaegen2.deployments.k8s-bootstrap-container:2.2.1
+image: onap/org.onap.dcaegen2.deployments.k8s-bootstrap-container:2.2.3
default_k8s_location: central
# DCAE component images to be deployed via Cloudify Manager
# Application configuration defaults.
#################################################################
# application image
-image: onap/org.onap.dcaegen2.deployments.cm-container:3.4.1
+image: onap/org.onap.dcaegen2.deployments.cm-container:3.4.2
pullPolicy: Always
# name of shared ConfigMap with kubeconfig for multiple clusters
aafEnabled: true
aafAgentImage: onap/aaf/aaf_agent:2.1.20
+ # default values for certificates
+ certificate:
+ default:
+ renewBefore: 8h
+ subject:
+ organization: "Linux-Foundation"
+ country: "US"
+ locality: "San-Francisco"
+ province: "California"
+ organizationalUnit: "ONAP"
+ issuer:
+ group: certmanager.onap.org
+ kind: CMPv2Issuer
+ name: cmpv2-issuer-onap
+ p12Keystore:
+ create: false
+ passwordSecretRef:
+ name: ""
+ key: ""
+ jksKeystore:
+ create: false
+ passwordSecretRef:
+ name: ""
+ key: ""
+
# Enabling CMPv2
cmpv2Enabled: true
+ CMPv2CertManagerIntegration: false
platform:
certServiceClient:
- image: onap/org.onap.oom.platform.cert-service.oom-certservice-client:2.3.1
+ image: onap/org.onap.oom.platform.cert-service.oom-certservice-client:2.3.2
secret:
name: oom-cert-service-client-tls-secret
mountPath: /etc/onap/oom/certservice/certs/
# Deployment configuration
deployment:
name: oom-certservice-cmpv2issuer
- image: onap/org.onap.oom.platform.cert-service.oom-certservice-k8s-external-provider:2.3.0
+ image: onap/org.onap.oom.platform.cert-service.oom-certservice-k8s-external-provider:2.3.2
proxyImage: gcr.io/kubebuilder/kube-rbac-proxy:v0.4.0
# fol local development use IfNotPresent
pullPolicy: Always
# Deployment configuration
repository: "nexus3.onap.org:10001"
-image: onap/org.onap.oom.platform.cert-service.oom-certservice-api:2.3.1
+image: onap/org.onap.oom.platform.cert-service.oom-certservice-api:2.3.2
pullPolicy: Always
replicaCount: 1
--- /dev/null
+{{/*
+# Copyright © 2020 Nokia
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+*/}}
+
+{{ if .Values.global.CMPv2CertManagerIntegration }}
+{{ include "common.certificate" . }}
+{{ end }}
service: mariadb-galera
# Enabling CMPv2
cmpv2Enabled: true
+ CMPv2CertManagerIntegration: false
platform:
certServiceClient:
- image: onap/org.onap.oom.platform.cert-service.oom-certservice-client:2.3.1
+ image: onap/org.onap.oom.platform.cert-service.oom-certservice-client:2.3.2
secret:
name: oom-cert-service-client-tls-secret
mountPath: /etc/onap/oom/certservice/certs/
login: '{{ .Values.config.scaleoutUser }}'
password: '{{ .Values.config.scaleoutPassword }}'
passwordPolicy: required
+ - uid: keystore-password
+ type: password
+ password: secret
+ passwordPolicy: required
+#################################################################
+# Certificates
+#################################################################
+certificates:
+ - name: onap-sdnc-certificate
+ secretName: onap-sdnc-certificate
+ commonName: sdnc.simpledemo.onap.org
+ dnsNames:
+ - sdnc.simpledemo.onap.org
+ p12Keystore:
+ create: true
+ passwordSecretRef:
+ name: keystore-password
+ key: password
+ jksKeystore:
+ create: true
+ passwordSecretRef:
+ name: keystore-password
+ key: password
#################################################################
# Application configuration defaults.
#################################################################
# application image
repository: nexus3.onap.org:10001
-image: onap/usecase-ui-server:3.0.6
+image: onap/usecase-ui-server:3.0.7
pullPolicy: Always
# application configuration
Code Review / oom.git / commitdiff