.classpath
.factorypath
.project
+.pydevproject
.settings/
# IntelliJ
project: 'oom'
project_creation_date: '2017-06-15'
lifecycle_state: 'Incubation'
+project_category: ''
project_lead: &onap_releng_ptl
name: 'Mike Elliott'
email: 'mike.elliott@amdocs.com'
type: 'jira'
url: 'https://jira.onap.org/projects/OOM'
key: 'OOM'
+mailing_list:
+ type: 'groups.io'
+ url: 'lists.onap.org'
+ tag: '<[sub-project_name]>'
+realtime_discussion: ''
meetings:
- type: 'zoom'
- agenda: 'https://wiki.onap.org/pages/viewpage.action?pageId=8228913'
- url: 'https://wiki.onap.org/pages/viewpage.action?pageId=8228913'
- server: 'n/a'
- channel: 'n/a'
- repeats: 'weekly'
- time: '14:00 UTC'
+ agenda: 'https://wiki.onap.org/pages/viewpage.action?pageId=8228913'
+ url: 'https://wiki.onap.org/pages/viewpage.action?pageId=8228913'
+ server: 'n/a'
+ channel: 'n/a'
+ repeats: 'weekly'
+ time: '14:00 UTC'
+repositories:
+ - 'oom'
+ - 'oom-offline-installer'
+ - 'oom-registrator'
committers:
- <<: *onap_releng_ptl
- name: 'Alexis de Talhouët'
- email: 'adetalhouet89@gmail.com'
- company: 'Bell Canada'
- id: 'adetalhouet'
- timezone: 'Canada/Montreal'
+ email: 'adetalhouet89@gmail.com'
+ company: 'Bell Canada'
+ id: 'adetalhouet'
+ timezone: 'Canada/Montreal'
- name: 'Borislav Glozman'
- email: 'Borislav.Glozman@amdocs.com'
- company: 'Amdocs'
- id: 'BorislavG'
- timezone: 'Israel/Raanana'
+ email: 'Borislav.Glozman@amdocs.com'
+ company: 'Amdocs'
+ id: 'BorislavG'
+ timezone: 'Israel/Raanana'
- name: 'James MacNider'
- email: 'James.MacNider@amdocs.com'
- company: 'Amdocs'
- id: 'jmac'
- timezone: 'Canada/Ontario'
+ email: 'James.MacNider@amdocs.com'
+ company: 'Amdocs'
+ id: 'jmac'
+ timezone: 'Canada/Ontario'
- name: 'Hong Guan'
- email: 'hg4105@att.com'
- company: 'ATT'
- id: 'hg4105'
- timezone: ''
+ email: 'hg4105@att.com'
+ company: 'ATT'
+ id: 'hg4105'
+ timezone: 'Not/Defined'
- name: 'Jun (Nicolas) Hu'
- email: 'jh245g@att.com'
- company: 'ATT'
- id: 'jh245g'
- timezone: 'America/New York'
+ email: 'jh245g@att.com'
+ company: 'ATT'
+ id: 'jh245g'
+ timezone: 'America/New_York'
- name: 'Xue Gao'
- email: 'xg353y@intl.att.com'
- company: 'ATT'
- id: 'xuegao'
- timezone: 'Belgium/Namur'
+ email: 'xg353y@intl.att.com'
+ company: 'ATT'
+ id: 'xuegao'
+ timezone: 'Belgium/Namur'
tsc:
approval: 'https://lists.onap.org/pipermail/onap-tsc'
"org.openecomp.groups.VfcInstanceGroup",
"org.openecomp.groups.ResourceInstanceGroup"
],
+ "widgetTypes": [
+ {
+ "type": "SERVICE",
+ "name": "service-instance",
+ "deleteFlag": true
+ },
+ {
+ "type": "VF",
+ "name": "generic-vnf",
+ "deleteFlag": false
+ },
+ {
+ "type": "VFC",
+ "name": "vnfc",
+ "deleteFlag": true
+ },
+ {
+ "type": "VSERVER",
+ "name": "vserver",
+ "deleteFlag": true
+ },
+ {
+ "type": "VOLUME",
+ "name": "volume",
+ "deleteFlag": true
+ },
+ {
+ "type": "FLAVOR",
+ "name": "flavor",
+ "deleteFlag": false
+ },
+ {
+ "type": "TENANT",
+ "name": "tenant",
+ "deleteFlag": false
+ },
+ {
+ "type": "VOLUME_GROUP",
+ "name": "volume-group",
+ "deleteFlag": true
+ },
+ {
+ "type": "LINT",
+ "name": "l-interface",
+ "deleteFlag": true
+ },
+ {
+ "type": "L3_NET",
+ "name": "l3-network",
+ "deleteFlag": true
+ },
+ {
+ "type": "VFMODULE",
+ "name": "vf-module",
+ "deleteFlag": true
+ },
+ {
+ "type": "IMAGE",
+ "name": "image",
+ "deleteFlag": false
+ },
+ {
+ "type": "OAM_NETWORK",
+ "name": "oam-network",
+ "deleteFlag": true
+ },
+ {
+ "type": "ALLOTTED_RESOURCE",
+ "name": "allotted-resource",
+ "deleteFlag": true
+ },
+ {
+ "type": "TUNNEL_XCONNECT",
+ "name": "tunnel-xconnect",
+ "deleteFlag": true
+ },
+ {
+ "type": "CONFIGURATION",
+ "name": "configuration",
+ "deleteFlag": true
+ },
+ {
+ "type": "CR",
+ "name": "cr",
+ "deleteFlag": true
+ },
+ {
+ "type": "INSTANCE_GROUP",
+ "name": "instance-group",
+ "deleteFlag": true
+ }
+ ],
"widgetMappings": [
{
"prefix": "org.openecomp.resource.vfc",
</root>
<!-- LOG "com.baeldung*" at TRACE level -->
- <logger name="org.onap.aaf.fproxy" level="trace" additivity="false">
- <appender-ref ref="RollingFile" />
- <appender-ref ref="Console" />
- </logger>
+ <logger name="org.onap.aaf.fproxy" level="info" />
</configuration>
\ No newline at end of file
</appender>
<!-- LOG everything at INFO level -->
- <root level="debug">
+ <root level="info">
<appender-ref ref="RollingFile" />
<appender-ref ref="Console" />
</root>
<!-- LOG "com.baeldung*" at TRACE level -->
- <logger name="org.onap.aaf.rproxy" level="trace" additivity="false">
- <appender-ref ref="RollingFile" />
- <appender-ref ref="Console" />
- </logger>
+ <logger name="org.onap.aaf.rproxy" level="info" />
</configuration>
namespace: {{ include "common.namespace" . }}
data:
{{ tpl (.Files.Glob "resources/rproxy/config/logback-spring.xml").AsConfig . | indent 2 }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: {{ include "common.fullname" . }}-rproxy-uri-auth-config
+ namespace: {{ include "common.namespace" . }}
+data:
+{{ tpl (.Files.Glob "resources/rproxy/config/auth/uri-authorization.json").AsConfig . | indent 2 }}
{{ end }}
\ No newline at end of file
- name: {{ include "common.fullname" . }}-rproxy-log-config
mountPath: /opt/app/rproxy/config/logback-spring.xml
subPath: logback-spring.xml
+ - name: {{ include "common.fullname" . }}-rproxy-uri-auth-config
+ mountPath: /opt/app/rproxy/config/auth/uri-authorization.json
+ subPath: uri-authorization.json
- name: {{ include "common.fullname" . }}-rproxy-auth-config
mountPath: /opt/app/rproxy/config/auth/tomcat_keystore
subPath: tomcat_keystore
- name: {{ include "common.fullname" . }}-rproxy-auth-config
mountPath: /opt/app/rproxy/config/auth/client-cert.p12
subPath: client-cert.p12
- - name: {{ include "common.fullname" . }}-rproxy-auth-config
- mountPath: /opt/app/rproxy/config/auth/uri-authorization.json
- subPath: uri-authorization.json
- name: {{ include "common.fullname" . }}-rproxy-auth-config
mountPath: /opt/app/rproxy/config/auth/aaf_truststore.jks
subPath: aaf_truststore.jks
- name: {{ include "common.fullname" . }}-rproxy-log-config
configMap:
name: {{ include "common.fullname" . }}-rproxy-log-config
+ - name: {{ include "common.fullname" . }}-rproxy-uri-auth-config
+ configMap:
+ name: {{ include "common.fullname" . }}-rproxy-uri-auth-config
- name: {{ include "common.fullname" . }}-rproxy-auth-config
secret:
secretName: {{ include "common.fullname" . }}-rproxy-auth-config
# Global configuration defaults.
#################################################################
global:
- readinessImage: readiness-check:2.0.0
+ readinessImage: readiness-check:2.0.2
loggingImage: beats/filebeat:5.5.0
#################################################################
</root>
<!-- LOG "com.baeldung*" at TRACE level -->
- <logger name="org.onap.aaf.fproxy" level="trace" additivity="false">
- <appender-ref ref="RollingFile" />
- <appender-ref ref="Console" />
- </logger>
-
+ <logger name="org.onap.aaf.fproxy" level="info" />
+
</configuration>
\ No newline at end of file
</appender>
<!-- LOG everything at INFO level -->
- <root level="debug">
+ <root level="info">
<appender-ref ref="RollingFile" />
<appender-ref ref="Console" />
</root>
<!-- LOG "com.baeldung*" at TRACE level -->
- <logger name="org.onap.aaf.rproxy" level="trace" additivity="false">
- <appender-ref ref="RollingFile" />
- <appender-ref ref="Console" />
- </logger>
+ <logger name="org.onap.aaf.rproxy" level="info" />
</configuration>
\ No newline at end of file
namespace: {{ include "common.namespace" . }}
data:
{{ tpl (.Files.Glob "resources/rproxy/config/logback-spring.xml").AsConfig . | indent 2 }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: {{ include "common.fullname" . }}-rproxy-uri-auth-config
+ namespace: {{ include "common.namespace" . }}
+data:
+{{ tpl (.Files.Glob "resources/rproxy/config/auth/uri-authorization.json").AsConfig . | indent 2 }}
{{ end }}
\ No newline at end of file
- name: {{ include "common.fullname" . }}-rproxy-log-config
mountPath: /opt/app/rproxy/config/logback-spring.xml
subPath: logback-spring.xml
+ - name: {{ include "common.fullname" . }}-rproxy-uri-auth-config
+ mountPath: /opt/app/rproxy/config/auth/uri-authorization.json
+ subPath: uri-authorization.json
- name: {{ include "common.fullname" . }}-rproxy-auth-certs
mountPath: /opt/app/rproxy/config/auth/tomcat_keystore
subPath: tomcat_keystore
- name: {{ include "common.fullname" . }}-rproxy-auth-certs
mountPath: /opt/app/rproxy/config/auth/org.onap.aai.p12
subPath: org.onap.aai.p12
- - name: {{ include "common.fullname" . }}-rproxy-auth-config
- mountPath: /opt/app/rproxy/config/auth/uri-authorization.json
- subPath: uri-authorization.json
- name: {{ include "common.fullname" . }}-rproxy-security-config
mountPath: /opt/app/rproxy/config/security/keyfile
subPath: keyfile
- name: {{ include "common.fullname" . }}-rproxy-log-config
configMap:
name: {{ include "common.fullname" . }}-rproxy-log-config
+ - name: {{ include "common.fullname" . }}-rproxy-uri-auth-config
+ configMap:
+ name: {{ include "common.fullname" . }}-rproxy-uri-auth-config
- name: {{ include "common.fullname" . }}-rproxy-auth-config
secret:
secretName: {{ include "common.fullname" . }}-rproxy-auth-config
# Global configuration defaults.
#################################################################
global:
- readinessImage: readiness-check:2.0.0
+ readinessImage: readiness-check:2.0.2
loggingImage: beats/filebeat:5.5.0
#################################################################
--- /dev/null
+#!/bin/sh
+
+/usr/share/elasticsearch/plugins/search-guard-6/tools/sgadmin.sh \
+ -cd /usr/share/elasticsearch/config/sg \
+ -ks /usr/share/elasticsearch/config/sg/auth/{{ .Values.config.adminKeyStore }} \
+ -ts /usr/share/elasticsearch/config/sg/auth/{{ .Values.config.trustStore }} \
+ -kspass {{ .Values.config.adminKeyStorePassword }} \
+ -tspass {{ .Values.config.trustStorePassword}} \
+ -nhnv \
+ -icl \
+ -p {{ .Values.service.internalPort2 }}
\ No newline at end of file
--- /dev/null
+#!/bin/sh
+
+# Wait for ES to start then initialize SearchGuard
+/usr/local/bin/docker-entrypoint.sh eswrapper &
+/usr/share/elasticsearch/bin/wait_until_started.sh
+/usr/share/elasticsearch/bin/init_sg.sh
+
+wait
\ No newline at end of file
--- /dev/null
+#!/bin/sh
+RET=1
+
+while [[ RET -ne 0 ]]; do
+ echo "Waiting for Elasticsearch to become ready before running sgadmin..."
+ curl -XGET -k "https://localhost:{{ .Values.service.internalPort }}/" >/dev/null 2>&1
+ RET=$?
+ sleep 5
+done
\ No newline at end of file
# Set a custom port for the node to node communication (9300 by default):
-transport.tcp.port: {{ .Values.config.tcpPort }}
+transport.tcp.port: {{ .Values.service.internalPort2 }}
# Enable compression for all communication between nodes (disabled by default):
transport.tcp.compress: false
### SEARCH GUARD SSL #
### Configuration #
###############################################################################################
-## Uncomment all lines below prefixed with #X# (globally remove #X#) for searchguard
-##
-###############################################################################################
-### Transport layer SSL #
-### #
-###############################################################################################
-### Enable or disable node-to-node ssl encryption (default: true)
-#X#searchguard.ssl.transport.enable_openssl_if_available: true
-#X#searchguard.ssl.transport.enabled: true
-### JKS or PKCS12 (default: JKS)
-#X#searchguard.ssl.transport.keystore_type: JKS
-### Relative path to the keystore file (mandatory, this stores the server certificates), must be placed under the config/ dir
-#X#searchguard.ssl.transport.keystore_filepath: /some/path
-### Alias name (default: first alias which could be found)
-###searchguard.ssl.transport.keystore_alias: localhost
-### Keystore password (default: changeit)
-#X#searchguard.ssl.transport.keystore_password: changeit
-##
-### JKS or PKCS12 (default: JKS)
-#X#searchguard.ssl.transport.truststore_type: JKS
-### Relative path to the truststore file (mandatory, this stores the client/root certificates), must be placed under the config/ dir
-#X#searchguard.ssl.transport.truststore_filepath: truststore.jks
-### Alias name (default: first alias which could be found)
-###searchguard.ssl.transport.truststore_alias: my_alias
-### Truststore password (default: changeit)
-#X#searchguard.ssl.transport.truststore_password: changeit
-### Enforce hostname verification (default: true)
-###searchguard.ssl.transport.enforce_hostname_verification: true
-### If hostname verification specify if hostname should be resolved (default: true)
-###searchguard.ssl.transport.resolve_hostname: true
-### Use native Open SSL instead of JDK SSL if available (default: true)
-###searchguard.ssl.transport.enable_openssl_if_available: false
-##
-###############################################################################################
-### HTTP/REST layer SSL #
-### #
-###############################################################################################
-### Enable or disable rest layer security - https, (default: false)
-#X#searchguard.ssl.http.enable_openssl_if_available: true
-#X#searchguard.ssl.http.enabled: true
-### JKS or PKCS12 (default: JKS)
-#X#searchguard.ssl.http.keystore_type: JKS
-### Relative path to the keystore file (this stores the server certificates), must be placed under the config/ dir
-#X#searchguard.ssl.http.keystore_filepath: /keystore/path
-### Alias name (default: first alias which could be found)
-###searchguard.ssl.http.keystore_alias: my_alias
-### Keystore password (default: changeit)
-#X#searchguard.ssl.http.keystore_password: changeit
-### Do the clients (typically the browser or the proxy) have to authenticate themself to the http server, default is OPTIONAL
-### To enforce authentication use REQUIRE, to completely disable client certificates use NONE
-###searchguard.ssl.http.clientauth_mode: REQUIRE
-### JKS or PKCS12 (default: JKS)
-#X#searchguard.ssl.http.truststore_type: JKS
-### Relative path to the truststore file (this stores the client certificates), must be placed under the config/ dir
-#X#searchguard.ssl.http.truststore_filepath: truststore.jks
-### Alias name (default: first alias which could be found)
-###searchguard.ssl.http.truststore_alias: my_alias
-### Truststore password (default: changeit)
-#X#searchguard.ssl.http.truststore_password: changeit
-### Use native Open SSL instead of JDK SSL if available (default: true)
-###searchguard.ssl.http.enable_openssl_if_available: false
-
-#####################################################
-##### Security manager - Searchguard Configuration
-#####################################################
-#X#security.manager.enabled: false
-#X#searchguard.authcz.admin_dn:
-
-#####################################################
-##### X-Pack Configuration
-#####################################################
+######## Start Search Guard Demo Configuration ########
+
+searchguard.enterprise_modules_enabled: false
+
+searchguard.ssl.transport.keystore_filepath: sg/auth/{{ .Values.config.nodeKeyStore }}
+searchguard.ssl.transport.keystore_password: {{ .Values.config.nodeKeyStorePassword }}
+searchguard.ssl.transport.truststore_filepath: sg/auth/{{ .Values.config.trustStore }}
+searchguard.ssl.transport.truststore_password: {{ .Values.config.trustStorePassword }}
+searchguard.ssl.transport.enforce_hostname_verification: false
+
+searchguard.ssl.http.enabled: true
+searchguard.ssl.http.keystore_filepath: sg/auth/{{ .Values.config.nodeKeyStore }}
+searchguard.ssl.http.keystore_password: {{ .Values.config.nodeKeyStorePassword }}
+searchguard.ssl.http.truststore_filepath: sg/auth/{{ .Values.config.trustStore }}
+searchguard.ssl.http.truststore_password: {{ .Values.config.trustStorePassword }}
+
+searchguard.nodes_dn:
+ - CN=esaai
+
+searchguard.authcz.admin_dn:
+ - CN=sgadmin
+
+# x-pack security conflicts with searchguard
xpack.security.enabled: false
xpack.ml.enabled: false
xpack.monitoring.enabled: false
--- /dev/null
+UNLIMITED:
+ readonly: true
+ permissions:
+ - "*"
+
+###### INDEX LEVEL ######
+
+INDICES_ALL:
+ readonly: true
+ permissions:
+ - "indices:*"
+
+# for backward compatibility
+ALL:
+ readonly: true
+ permissions:
+ - INDICES_ALL
+
+MANAGE:
+ readonly: true
+ permissions:
+ - "indices:monitor/*"
+ - "indices:admin/*"
+
+CREATE_INDEX:
+ readonly: true
+ permissions:
+ - "indices:admin/create"
+ - "indices:admin/mapping/put"
+
+MANAGE_ALIASES:
+ readonly: true
+ permissions:
+ - "indices:admin/aliases*"
+
+# for backward compatibility
+MONITOR:
+ readonly: true
+ permissions:
+ - INDICES_MONITOR
+
+INDICES_MONITOR:
+ readonly: true
+ permissions:
+ - "indices:monitor/*"
+
+DATA_ACCESS:
+ readonly: true
+ permissions:
+ - "indices:data/*"
+ - CRUD
+
+WRITE:
+ readonly: true
+ permissions:
+ - "indices:data/write*"
+ - "indices:admin/mapping/put"
+
+READ:
+ readonly: true
+ permissions:
+ - "indices:data/read*"
+ - "indices:admin/mappings/fields/get*"
+
+DELETE:
+ readonly: true
+ permissions:
+ - "indices:data/write/delete*"
+
+CRUD:
+ readonly: true
+ permissions:
+ - READ
+ - WRITE
+
+SEARCH:
+ readonly: true
+ permissions:
+ - "indices:data/read/search*"
+ - "indices:data/read/msearch*"
+ - SUGGEST
+
+SUGGEST:
+ readonly: true
+ permissions:
+ - "indices:data/read/suggest*"
+
+INDEX:
+ readonly: true
+ permissions:
+ - "indices:data/write/index*"
+ - "indices:data/write/update*"
+ - "indices:admin/mapping/put"
+ - "indices:data/write/bulk*"
+
+GET:
+ readonly: true
+ permissions:
+ - "indices:data/read/get*"
+ - "indices:data/read/mget*"
+
+###### CLUSTER LEVEL ######
+
+CLUSTER_ALL:
+ readonly: true
+ permissions:
+ - "cluster:*"
+
+CLUSTER_MONITOR:
+ readonly: true
+ permissions:
+ - "cluster:monitor/*"
+
+CLUSTER_COMPOSITE_OPS_RO:
+ readonly: true
+ permissions:
+ - "indices:data/read/mget"
+ - "indices:data/read/msearch"
+ - "indices:data/read/mtv"
+ - "indices:data/read/coordinate-msearch*"
+ - "indices:admin/aliases/exists*"
+ - "indices:admin/aliases/get*"
+ - "indices:data/read/scroll"
+
+CLUSTER_COMPOSITE_OPS:
+ readonly: true
+ permissions:
+ - "indices:data/write/bulk"
+ - "indices:admin/aliases*"
+ - "indices:data/write/reindex"
+ - CLUSTER_COMPOSITE_OPS_RO
+
+MANAGE_SNAPSHOTS:
+ readonly: true
+ permissions:
+ - "cluster:admin/snapshot/*"
+ - "cluster:admin/repository/*"
\ No newline at end of file
--- /dev/null
+# This is the main Search Guard configuration file where authentication
+# and authorization is defined.
+#
+# You need to configure at least one authentication domain in the authc of this file.
+# An authentication domain is responsible for extracting the user credentials from
+# the request and for validating them against an authentication backend like Active Directory for example.
+#
+# If more than one authentication domain is configured the first one which succeeds wins.
+# If all authentication domains fail then the request is unauthenticated.
+# In this case an exception is thrown and/or the HTTP status is set to 401.
+#
+# After authentication authorization (authz) will be applied. There can be zero or more authorizers which collect
+# the roles from a given backend for the authenticated user.
+#
+# Both, authc and auth can be enabled/disabled separately for REST and TRANSPORT layer. Default is true for both.
+# http_enabled: true
+# transport_enabled: true
+#
+# 5.x Migration: "enabled: true/false" will also be respected currently but only to provide backward compatibility.
+#
+# For HTTP it is possible to allow anonymous authentication. If that is the case then the HTTP authenticators try to
+# find user credentials in the HTTP request. If credentials are found then the user gets regularly authenticated.
+# If none can be found the user will be authenticated as an "anonymous" user. This user has always the username "sg_anonymous"
+# and one role named "sg_anonymous_backendrole".
+# If you enable anonymous authentication all HTTP authenticators will not challenge.
+#
+#
+# Note: If you define more than one HTTP authenticators make sure to put non-challenging authenticators like "proxy" or "clientcert"
+# first and the challenging one last.
+# Because it's not possible to challenge a client with two different authentication methods (for example
+# Kerberos and Basic) only one can have the challenge flag set to true. You can cope with this situation
+# by using pre-authentication, e.g. sending a HTTP Basic authentication header in the request.
+#
+# Default value of the challenge flag is true.
+#
+#
+# HTTP
+# basic (challenging)
+# proxy (not challenging, needs xff)
+# kerberos (challenging) NOT FREE FOR COMMERCIAL
+# clientcert (not challenging, needs https)
+# jwt (not challenging) NOT FREE FOR COMMERCIAL
+# host (not challenging) #DEPRECATED, will be removed in a future version.
+# host based authentication is configurable in sg_roles_mapping
+
+# Authc
+# internal
+# noop
+# ldap NOT FREE FOR COMMERCIAL USE
+
+# Authz
+# ldap NOT FREE FOR COMMERCIAL USE
+# noop
+
+searchguard:
+ dynamic:
+ # Set filtered_alias_mode to 'disallow' to forbid more than 2 filtered aliases per index
+ # Set filtered_alias_mode to 'warn' to allow more than 2 filtered aliases per index but warns about it (default)
+ # Set filtered_alias_mode to 'nowarn' to allow more than 2 filtered aliases per index silently
+ #filtered_alias_mode: warn
+ #kibana:
+ # Kibana multitenancy - NOT FREE FOR COMMERCIAL USE
+ # see https://github.com/floragunncom/search-guard-docs/blob/master/multitenancy.md
+ # To make this work you need to install https://github.com/floragunncom/search-guard-module-kibana-multitenancy/wiki
+ #multitenancy_enabled: true
+ #server_username: kibanaserver
+ #index: '.kibana'
+ #do_not_fail_on_forbidden: false
+ http:
+ anonymous_auth_enabled: false
+ xff:
+ enabled: false
+ internalProxies: '192\.168\.0\.10|192\.168\.0\.11' # regex pattern
+ #internalProxies: '.*' # trust all internal proxies, regex pattern
+ remoteIpHeader: 'x-forwarded-for'
+ proxiesHeader: 'x-forwarded-by'
+ #trustedProxies: '.*' # trust all external proxies, regex pattern
+ ###### see https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html for regex help
+ ###### more information about XFF https://en.wikipedia.org/wiki/X-Forwarded-For
+ ###### and here https://tools.ietf.org/html/rfc7239
+ ###### and https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Remote_IP_Valve
+ authc:
+ kerberos_auth_domain:
+ http_enabled: false
+ transport_enabled: false
+ order: 6
+ http_authenticator:
+ type: kerberos # NOT FREE FOR COMMERCIAL USE
+ challenge: true
+ config:
+ # If true a lot of kerberos/security related debugging output will be logged to standard out
+ krb_debug: false
+ # If true then the realm will be stripped from the user name
+ strip_realm_from_principal: true
+ authentication_backend:
+ type: noop
+ basic_internal_auth_domain:
+ http_enabled: true
+ transport_enabled: true
+ order: 2
+ http_authenticator:
+ type: basic
+ challenge: true
+ authentication_backend:
+ type: intern
+ proxy_auth_domain:
+ http_enabled: false
+ transport_enabled: false
+ order: 3
+ http_authenticator:
+ type: proxy
+ challenge: false
+ config:
+ user_header: "x-proxy-user"
+ roles_header: "x-proxy-roles"
+ authentication_backend:
+ type: noop
+ jwt_auth_domain:
+ http_enabled: false
+ transport_enabled: false
+ order: 0
+ http_authenticator:
+ type: jwt
+ challenge: false
+ config:
+ signing_key: "base64 encoded HMAC key or public RSA/ECDSA pem key"
+ jwt_header: "Authorization"
+ jwt_url_parameter: null
+ roles_key: null
+ subject_key: null
+ authentication_backend:
+ type: noop
+ clientcert_auth_domain:
+ http_enabled: true
+ transport_enabled: true
+ order: 1
+ http_authenticator:
+ type: clientcert
+ config:
+ username_attribute: cn #optional, if omitted DN becomes username
+ challenge: false
+ authentication_backend:
+ type: noop
+ ldap:
+ http_enabled: false
+ transport_enabled: false
+ order: 5
+ http_authenticator:
+ type: basic
+ challenge: false
+ authentication_backend:
+ # LDAP authentication backend (authenticate users against a LDAP or Active Directory)
+ type: ldap # NOT FREE FOR COMMERCIAL USE
+ config:
+ # enable ldaps
+ enable_ssl: false
+ # enable start tls, enable_ssl should be false
+ enable_start_tls: false
+ # send client certificate
+ enable_ssl_client_auth: false
+ # verify ldap hostname
+ verify_hostnames: true
+ hosts:
+ - localhost:8389
+ bind_dn: null
+ password: null
+ userbase: 'ou=people,dc=example,dc=com'
+ # Filter to search for users (currently in the whole subtree beneath userbase)
+ # {0} is substituted with the username
+ usersearch: '(sAMAccountName={0})'
+ # Use this attribute from the user as username (if not set then DN is used)
+ username_attribute: null
+ authz:
+ roles_from_myldap:
+ http_enabled: false
+ transport_enabled: false
+ authorization_backend:
+ # LDAP authorization backend (gather roles from a LDAP or Active Directory, you have to configure the above LDAP authentication backend settings too)
+ type: ldap # NOT FREE FOR COMMERCIAL USE
+ config:
+ # enable ldaps
+ enable_ssl: false
+ # enable start tls, enable_ssl should be false
+ enable_start_tls: false
+ # send client certificate
+ enable_ssl_client_auth: false
+ # verify ldap hostname
+ verify_hostnames: true
+ hosts:
+ - localhost:8389
+ bind_dn: null
+ password: null
+ rolebase: 'ou=groups,dc=example,dc=com'
+ # Filter to search for roles (currently in the whole subtree beneath rolebase)
+ # {0} is substituted with the DN of the user
+ # {1} is substituted with the username
+ # {2} is substituted with an attribute value from user's directory entry, of the authenticated user. Use userroleattribute to specify the name of the attribute
+ rolesearch: '(member={0})'
+ # Specify the name of the attribute which value should be substituted with {2} above
+ userroleattribute: null
+ # Roles as an attribute of the user entry
+ userrolename: disabled
+ #userrolename: memberOf
+ # The attribute in a role entry containing the name of that role, Default is "name".
+ # Can also be "dn" to use the full DN as rolename.
+ rolename: cn
+ # Resolve nested roles transitive (roles which are members of other roles and so on ...)
+ resolve_nested_roles: true
+ userbase: 'ou=people,dc=example,dc=com'
+ # Filter to search for users (currently in the whole subtree beneath userbase)
+ # {0} is substituted with the username
+ usersearch: '(uid={0})'
+ # Skip users matching a user name, a wildcard or a regex pattern
+ #skip_users:
+ # - 'cn=Michael Jackson,ou*people,o=TEST'
+ # - '/\S*/'
+ roles_from_another_ldap:
+ enabled: false
+ authorization_backend:
+ type: ldap # NOT FREE FOR COMMERCIAL USE
+ #config goes here ...
--- /dev/null
+# This is the internal user database
+# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh
+
+#password is: admin
+admin:
+ readonly: true
+ hash: $2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv..TOG
+ roles:
+ - admin
+ attributes:
+ #no dots allowed in attribute names
+ attribute1: value1
+ attribute2: value2
+ attribute3: value3
+
+#password is: logstash
+logstash:
+ hash: $2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2
+ roles:
+ - logstash
+
+#password is: kibanaserver
+kibanaserver:
+ readonly: true
+ hash: $2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H.
+
+#password is: kibanaro
+kibanaro:
+ hash: $2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC
+ roles:
+ - kibanauser
+ - readall
+
+#password is: readall
+readall:
+ hash: $2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2
+ #password is: readall
+ roles:
+ - readall
+
+#password is: snapshotrestore
+snapshotrestore:
+ hash: $2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W
+ roles:
+ - snapshotrestore
\ No newline at end of file
--- /dev/null
+# Allows everything, but no changes to searchguard configuration index
+sg_all_access:
+ readonly: true
+ cluster:
+ - UNLIMITED
+ indices:
+ '*':
+ '*':
+ - UNLIMITED
+ tenants:
+ admin_tenant: RW
+
+# Read all, but no write permissions
+sg_readall:
+ readonly: true
+ cluster:
+ - CLUSTER_COMPOSITE_OPS_RO
+ indices:
+ '*':
+ '*':
+ - READ
+
+# Read all and monitor, but no write permissions
+sg_readall_and_monitor:
+ cluster:
+ - CLUSTER_MONITOR
+ - CLUSTER_COMPOSITE_OPS_RO
+ indices:
+ '*':
+ '*':
+ - READ
+
+# For users which use kibana, access to indices must be granted separately
+sg_kibana_user:
+ readonly: true
+ cluster:
+ - INDICES_MONITOR
+ - CLUSTER_COMPOSITE_OPS
+ indices:
+ '?kibana':
+ '*':
+ - MANAGE
+ - INDEX
+ - READ
+ - DELETE
+ '?kibana-6':
+ '*':
+ - MANAGE
+ - INDEX
+ - READ
+ - DELETE
+ '?kibana_*':
+ '*':
+ - MANAGE
+ - INDEX
+ - READ
+ - DELETE
+ '?tasks':
+ '*':
+ - INDICES_ALL
+ '?management-beats':
+ '*':
+ - INDICES_ALL
+ '*':
+ '*':
+ - indices:data/read/field_caps*
+ - indices:data/read/xpack/rollup*
+ - indices:admin/mappings/get*
+ - indices:admin/get
+
+# For the kibana server
+sg_kibana_server:
+ readonly: true
+ cluster:
+ - CLUSTER_MONITOR
+ - CLUSTER_COMPOSITE_OPS
+ - cluster:admin/xpack/monitoring*
+ - indices:admin/template*
+ - indices:data/read/scroll*
+ indices:
+ '?kibana':
+ '*':
+ - INDICES_ALL
+ '?kibana-6':
+ '*':
+ - INDICES_ALL
+ '?kibana_*':
+ '*':
+ - INDICES_ALL
+ '?reporting*':
+ '*':
+ - INDICES_ALL
+ '?monitoring*':
+ '*':
+ - INDICES_ALL
+ '?tasks':
+ '*':
+ - INDICES_ALL
+ '?management-beats*':
+ '*':
+ - INDICES_ALL
+ '*':
+ '*':
+ - "indices:admin/aliases*"
+
+# For logstash and beats
+sg_logstash:
+ cluster:
+ - CLUSTER_MONITOR
+ - CLUSTER_COMPOSITE_OPS
+ - indices:admin/template/get
+ - indices:admin/template/put
+ indices:
+ 'logstash-*':
+ '*':
+ - CRUD
+ - CREATE_INDEX
+ '*beat*':
+ '*':
+ - CRUD
+ - CREATE_INDEX
+
+# Allows adding and modifying repositories and creating and restoring snapshots
+sg_manage_snapshots:
+ cluster:
+ - MANAGE_SNAPSHOTS
+ indices:
+ '*':
+ '*':
+ - "indices:data/write/index"
+ - "indices:admin/create"
+
+# Allows each user to access own named index
+sg_own_index:
+ cluster:
+ - CLUSTER_COMPOSITE_OPS
+ indices:
+ '${user_name}':
+ '*':
+ - INDICES_ALL
+
+### X-Pack COMPATIBILITY
+sg_xp_monitoring:
+ readonly: true
+ cluster:
+ - cluster:monitor/xpack/info
+ - cluster:monitor/main
+ - cluster:admin/xpack/monitoring/bulk
+ indices:
+ '?monitor*':
+ '*':
+ - INDICES_ALL
+
+sg_xp_alerting:
+ readonly: true
+ cluster:
+ - indices:data/read/scroll
+ - cluster:admin/xpack/watcher*
+ - cluster:monitor/xpack/watcher*
+ indices:
+ '?watches*':
+ '*':
+ - INDICES_ALL
+ '?watcher-history-*':
+ '*':
+ - INDICES_ALL
+ '?triggered_watches':
+ '*':
+ - INDICES_ALL
+ '*':
+ '*':
+ - READ
+ - indices:admin/aliases/get
+
+sg_xp_machine_learning:
+ readonly: true
+ cluster:
+ - cluster:admin/persistent*
+ - cluster:internal/xpack/ml*
+ - indices:data/read/scroll*
+ - cluster:admin/xpack/ml*
+ - cluster:monitor/xpack/ml*
+ indices:
+ '*':
+ '*':
+ - READ
+ - indices:admin/get*
+ '?ml-*':
+ '*':
+ - "*"
+
+### LEGACY ROLES, FOR COMPATIBILITY ONLY
+### WILL BE REMOVED IN SG7, DO NOT USE ANYMORE
+
+sg_readonly_and_monitor:
+ cluster:
+ - CLUSTER_MONITOR
+ - CLUSTER_COMPOSITE_OPS_RO
+ indices:
+ '*':
+ '*':
+ - READ
+
+# Make xpack monitoring work
+sg_monitor:
+ cluster:
+ - cluster:admin/xpack/monitoring/*
+ - cluster:admin/ingest/pipeline/put
+ - cluster:admin/ingest/pipeline/get
+ - indices:admin/template/get
+ - indices:admin/template/put
+ - CLUSTER_MONITOR
+ - CLUSTER_COMPOSITE_OPS
+ indices:
+ '?monitor*':
+ '*':
+ - INDICES_ALL
+ '?marvel*':
+ '*':
+ - INDICES_ALL
+ '?kibana*':
+ '*':
+ - READ
+ '*':
+ '*':
+ - indices:data/read/field_caps
+
+# Make xpack alerting work
+sg_alerting:
+ cluster:
+ - indices:data/read/scroll
+ - cluster:admin/xpack/watcher/watch/put
+ - cluster:admin/xpack/watcher*
+ - CLUSTER_MONITOR
+ - CLUSTER_COMPOSITE_OPS
+ indices:
+ '?kibana*':
+ '*':
+ - READ
+ '?watches*':
+ '*':
+ - INDICES_ALL
+ '?watcher-history-*':
+ '*':
+ - INDICES_ALL
+ '?triggered_watches':
+ '*':
+ - INDICES_ALL
+ '*':
+ '*':
+ - READ
+
+
+sg_role_test:
+ cluster:
+ - indices:admin/template/get
+ - indices:admin/template/put
+ - CLUSTER_COMPOSITE_OPS
+ indices:
+ '*':
+ '*':
+ - UNLIMITED
--- /dev/null
+# In this file users, backendroles and hosts can be mapped to Search Guard roles.
+# Permissions for Search Guard roles are configured in sg_roles.yml
+
+sg_all_access:
+ readonly: true
+ backendroles:
+ - admin
+
+sg_logstash:
+ backendroles:
+ - logstash
+
+sg_kibana_server:
+ readonly: true
+ users:
+ - kibanaserver
+
+sg_kibana_user:
+ backendroles:
+ - kibanauser
+
+sg_readall:
+ readonly: true
+ backendroles:
+ - readall
+
+sg_manage_snapshots:
+ readonly: true
+ backendroles:
+ - snapshotrestore
+
+sg_own_index:
+ users:
+ - '*'
+
+sg_role_test:
+ users:
+ - test
-# Copyright © 2017 Amdocs, Bell Canada
-# Modifications Copyright © 2018 AT&T
+# Copyright © 2018 Amdocs, Bell Canada, AT&T
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# See the License for the specific language governing permissions and
# limitations under the License.
-#{{ if not .Values.disableAaiElasticsearch }}
apiVersion: v1
kind: ConfigMap
metadata:
- name: {{ include "common.fullname" . }}
+ name: {{ include "common.fullname" . }}-es-config
namespace: {{ include "common.namespace" . }}
labels:
app: {{ include "common.name" . }}
heritage: {{ .Release.Service }}
data:
{{ tpl (.Files.Glob "resources/config/*").AsConfig . | indent 2 }}
-#{{ end }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: {{ include "common.fullname" . }}-sg-scripts
+ namespace: {{ include "common.namespace" . }}
+ labels:
+ app: {{ include "common.name" . }}
+ chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
+data:
+{{ tpl (.Files.Glob "resources/bin/*").AsConfig . | indent 2 }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: {{ include "common.fullname" . }}-sg-config
+ namespace: {{ include "common.namespace" . }}
+ labels:
+ app: {{ include "common.name" . }}
+ chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
+data:
+{{ tpl (.Files.Glob "resources/config/sg/*").AsConfig . | indent 2 }}
release: {{ .Release.Name }}
name: {{ include "common.name" . }}
spec:
+ hostname: {{ include "common.name" . }}
initContainers:
- command:
- /bin/sh
securityContext:
privileged: true
image: {{ .Values.global.dockerhubRepository | default .Values.dockerhubRepository }}/{{ .Values.global.busyboxImage | default .Values.busyboxImage }}
- imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+ imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.pullPolicy }}
name: init-sysctl
volumeMounts:
- name: elasticsearch-data
mountPath: /logroot/
- hostname: {{ include "common.name" . }}
containers:
- name: {{ include "common.name" . }}
- image: {{ .Values.global.loggingRepository | default .Values.loggingRepository }}/{{ .Values.image }}
- imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+ image: "{{ include "common.repository" . }}/{{ .Values.image }}"
+ imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.pullPolicy }}
ports:
- containerPort: {{ .Values.service.internalPort }}
+ - containerPort: {{ .Values.service.internalPort2 }}
# disable liveness probe when breakpoints set in debugger
# so K8s doesn't restart unresponsive container
{{- if eq .Values.liveness.enabled true }}
- name: elasticsearch-config
subPath: log4j2.properties
mountPath: /usr/share/elasticsearch/config/log4j2.properties
+ - name: searchguard-scripts
+ subPath: run.sh
+ mountPath: /usr/share/elasticsearch/bin/run.sh
+ - name: searchguard-scripts
+ subPath: wait_until_started.sh
+ mountPath: /usr/share/elasticsearch/bin/wait_until_started.sh
+ - name: searchguard-scripts
+ subPath: init_sg.sh
+ mountPath: /usr/share/elasticsearch/bin/init_sg.sh
+ - name: searchguard-config
+ mountPath: /usr/share/elasticsearch/config/sg
+ - name: searchguard-auth-config
+ mountPath: /usr/share/elasticsearch/config/sg/auth
- name: elasticsearch-data
mountPath: /usr/share/elasticsearch/data
resources:
-{{ include "common.resources" . }}
+{{ include "common.resources" . | indent 12 }}
{{- if .Values.nodeSelector }}
nodeSelector:
{{ toYaml .Values.nodeSelector | indent 8 }}
path: /etc/localtime
- name: elasticsearch-config
configMap:
- name: {{ include "common.fullname" . }}
+ name: {{ include "common.fullname" . }}-es-config
+ - name: searchguard-scripts
+ configMap:
+ name: {{ include "common.fullname" . }}-sg-scripts
+ defaultMode: 0754
+ - name: searchguard-config
+ configMap:
+ name: {{ include "common.fullname" . }}-sg-config
+ - name: searchguard-auth-config
+ secret:
+ secretName: {{ include "common.fullname" . }}-sg-auth
- name: elasticsearch-data
hostPath:
path: {{ .Values.persistence.mountPath }}/{{ .Release.Name }}/{{ .Values.persistence.mountSubPath }}
+ restartPolicy: {{ .Values.restartPolicy }}
imagePullSecrets:
- name: "{{ include "common.namespace" . }}-docker-registry-key"
-# Copyright © 2017 Amdocs, Bell Canada
+# Copyright © 2018 Amdocs, Bell Canada, AT&T
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# limitations under the License.
apiVersion: v1
-description: ONAP DMaaP Data Router
-name: dmaap-data-router
-version: 1.0
+kind: Secret
+metadata:
+ name: {{ include "common.fullname" . }}-sg-auth
+ namespace: {{ include "common.namespace" . }}
+type: Opaque
+data:
+{{ tpl (.Files.Glob "resources/config/sg/auth/*").AsSecrets . | indent 2 }}
\ No newline at end of file
spec:
type: {{ .Values.service.type }}
ports:
- {{if eq .Values.service.type "NodePort" -}}
- - port: {{ .Values.service.internalPort }}
- nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort }}
- name: {{ .Values.service.portName }}
- {{- else -}}
- - port: {{ .Values.service.internalPort }}
- name: {{ .Values.service.portName }}
- {{- end}}
+ {{if eq .Values.service.type "NodePort" -}}
+ - port: {{ .Values.service.internalPort }}
+ nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort }}
+ name: {{ .Values.service.portName }}
+ - port: {{ .Values.service.internalPort2 }}
+ nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort2 }}
+ name: {{ .Values.service.portName2 }}
+ {{- else -}}
+ - port: {{ .Values.service.internalPort }}
+ name: {{ .Values.service.portName }}
+ - port: {{ .Values.service.internalPort2 }}
+ name: {{ .Values.service.portName2 }}
+ {{- end}}
selector:
app: {{ include "common.name" . }}
release: {{ .Release.Name }}
nodePortPrefix: 302
# application image
-loggingRepository: docker.elastic.co
-image: elasticsearch/elasticsearch:6.1.2
+image: onap/elasticsearch-sg:1.4-STAGING-latest
pullPolicy: Always
+restartPolicy: Always
flavor: small
# application configuration
config:
tcpPort: 8443
-
+ nodeKeyStore: esaai-keystore.jks
+ nodeKeyStorePassword: b87b46d3da7d3d4aadfe
+ adminKeyStore: sgadmin-keystore.p12
+ adminKeyStorePassword: 341274302a70ad691e12
+ trustStore: truststore.jks
+ trustStorePassword: b200926e9da205487f63
# default number of instances
replicaCount: 1
name: aai-elasticsearch
portName: aai-elasticsearch
internalPort: 9200
+ portName2: aai-elasticsearch-tcp
+ internalPort2: 8443
ingress:
enabled: false
<appender-ref ref="Console" />
</root>
- <!-- LOG "com.baeldung*" at TRACE level -->
- <logger name="org.onap.aaf.fproxy" level="trace" additivity="false">
- <appender-ref ref="RollingFile" />
- <appender-ref ref="Console" />
- </logger>
+ <!-- LOG "org.onap.aaf.fproxy*" at INFO level -->
+ <logger name="org.onap.aaf.fproxy" level="info" />
</configuration>
\ No newline at end of file
</appender>
<!-- LOG everything at INFO level -->
- <root level="debug">
+ <root level="info">
<appender-ref ref="RollingFile" />
<appender-ref ref="Console" />
</root>
- <!-- LOG "com.baeldung*" at TRACE level -->
- <logger name="org.onap.aaf.rproxy" level="trace" additivity="false">
- <appender-ref ref="RollingFile" />
- <appender-ref ref="Console" />
- </logger>
+ <!-- LOG "org.onap.aaf.rproxy*" at INFO level -->
+ <logger name="org.onap.aaf.rproxy" level="info" />
</configuration>
namespace: {{ include "common.namespace" . }}
data:
{{ tpl (.Files.Glob "resources/rproxy/config/logback-spring.xml").AsConfig . | indent 2 }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: {{ include "common.fullname" . }}-rproxy-uri-auth-config
+ namespace: {{ include "common.namespace" . }}
+data:
+{{ tpl (.Files.Glob "resources/rproxy/config/auth/uri-authorization.json").AsConfig . | indent 2 }}
{{ end }}
- name: {{ include "common.fullname" . }}-rproxy-log-config
mountPath: /opt/app/rproxy/config/logback-spring.xml
subPath: logback-spring.xml
+ - name: {{ include "common.fullname" . }}-rproxy-uri-auth-config
+ mountPath: /opt/app/rproxy/config/auth/uri-authorization.json
+ subPath: uri-authorization.json
- name: {{ include "common.fullname" . }}-rproxy-auth-certs
mountPath: /opt/app/rproxy/config/auth/tomcat_keystore
subPath: tomcat_keystore
- name: {{ include "common.fullname" . }}-rproxy-auth-certs
mountPath: /opt/app/rproxy/config/auth/org.onap.aai.p12
subPath: org.onap.aai.p12
- - name: {{ include "common.fullname" . }}-rproxy-auth-config
- mountPath: /opt/app/rproxy/config/auth/uri-authorization.json
- subPath: uri-authorization.json
- name: {{ include "common.fullname" . }}-rproxy-security-config
mountPath: /opt/app/rproxy/config/security/keyfile
subPath: keyfile
- name: {{ include "common.fullname" . }}-rproxy-log-config
configMap:
name: {{ include "common.fullname" . }}-rproxy-log-config
+ - name: {{ include "common.fullname" . }}-rproxy-uri-auth-config
+ configMap:
+ name: {{ include "common.fullname" . }}-rproxy-uri-auth-config
- name: {{ include "common.fullname" . }}-rproxy-auth-config
secret:
secretName: {{ include "common.fullname" . }}-rproxy-auth-config
global: # global defaults
nodePortPrefix: 302
readinessRepository: oomk8s
- readinessImage: readiness-check:2.0.0
+ readinessImage: readiness-check:2.0.2
# application image
</root>
<!-- LOG "com.baeldung*" at TRACE level -->
- <logger name="org.onap.aaf.fproxy" level="trace" additivity="false">
- <appender-ref ref="RollingFile" />
- <appender-ref ref="Console" />
- </logger>
+ <logger name="org.onap.aaf.fproxy" level="info" />
</configuration>
\ No newline at end of file
</appender>
<!-- LOG everything at INFO level -->
- <root level="debug">
+ <root level="info">
<appender-ref ref="RollingFile" />
<appender-ref ref="Console" />
</root>
<!-- LOG "com.baeldung*" at TRACE level -->
- <logger name="org.onap.aaf.rproxy" level="trace" additivity="false">
- <appender-ref ref="RollingFile" />
- <appender-ref ref="Console" />
- </logger>
+ <logger name="org.onap.aaf.rproxy" level="info" />
</configuration>
{{ tpl (.Files.Glob "resources/rproxy/config/logback-spring.xml").AsConfig . | indent 2 }}
---
apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: {{ include "common.fullname" . }}-rproxy-uri-auth-config
+ namespace: {{ include "common.namespace" . }}
+data:
+{{ tpl (.Files.Glob "resources/rproxy/config/auth/uri-authorization.json").AsConfig . | indent 2 }}
+---
+apiVersion: v1
kind: Secret
metadata:
name: {{ include "common.fullname" . }}-rproxy-auth-config
- name: {{ include "common.fullname" . }}-rproxy-log-config
mountPath: /opt/app/rproxy/config/logback-spring.xml
subPath: logback-spring.xml
+ - name: {{ include "common.fullname" . }}-rproxy-uri-auth-config
+ mountPath: /opt/app/rproxy/config/auth/uri-authorization.json
+ subPath: uri-authorization.json
- name: {{ include "common.fullname" . }}-rproxy-auth-config
mountPath: /opt/app/rproxy/config/auth/tomcat_keystore
subPath: tomcat_keystore
- name: {{ include "common.fullname" . }}-rproxy-auth-config
mountPath: /opt/app/rproxy/config/auth/client-cert.p12
subPath: client-cert.p12
- - name: {{ include "common.fullname" . }}-rproxy-auth-config
- mountPath: /opt/app/rproxy/config/auth/uri-authorization.json
- subPath: uri-authorization.json
- name: {{ include "common.fullname" . }}-rproxy-auth-config
mountPath: /opt/app/rproxy/config/auth/aaf_truststore.jks
subPath: aaf_truststore.jks
- name: {{ include "common.fullname" . }}-rproxy-log-config
configMap:
name: {{ include "common.fullname" . }}-rproxy-log-config
+ - name: {{ include "common.fullname" . }}-rproxy-uri-auth-config
+ configMap:
+ name: {{ include "common.fullname" . }}-rproxy-uri-auth-config
- name: {{ include "common.fullname" . }}-rproxy-auth-config
secret:
secretName: {{ include "common.fullname" . }}-rproxy-auth-config
global: # global defaults
nodePortPrefix: 302
readinessRepository: oomk8s
- readinessImage: readiness-check:2.0.0
+ readinessImage: readiness-check:2.0.2
# application image
repository: nexus3.onap.org:10001
global: # global defaults
nodePortPrefix: 302
readinessRepository: oomk8s
- readinessImage: readiness-check:2.0.0
+ readinessImage: readiness-check:2.0.2
# application image
repository: nexus3.onap.org:10001
es.cluster-name=ES_AAI
es.ip-address=aai-elasticsearch.{{.Release.Namespace}}
es.http-port={{ .Values.config.elasticsearchHttpPort }}
+es.uri-scheme=https
+es.auth-user=admin
+es.auth-password=OBF:1u2a1toa1w8v1tok1u30
+es.trust-store=auth/tomcat_keystore
+es.trust-store-password=OBF:1y0q1uvc1uum1uvg1pil1pjl1uuq1uvk1uuu1y10
+
global: # global defaults
nodePortPrefix: 302
readinessRepository: oomk8s
- readinessImage: readiness-check:2.0.0
+ readinessImage: readiness-check:2.0.2
# application image
# limitations under the License.
oxm.schemaNodeDir=/opt/app/sparky/onap/oxm
+#schemaServiceTranslator is used to define whether to retreive the oxm from schema service microservice or read from the disk, possible values are schema-service/config
+oxm.schemaServiceTranslatorList=config
+# The end point for onap is https://<hostname>:<port>/onap/schema-service/v1/
+oxm.schemaServiceBaseUrl=https://<schema-service/config>/aai/schema-service/v1/
+oxm.schemaServiceKeystore=file:${CONFIG_HOME}/auth/aai-client-cert.p12
+oxm.schemaServiceTruststore=file:${CONFIG_HOME}/auth/tomcat_keystore
+oxm.schemaServiceKeystorePassword=OBF:1i9a1u2a1unz1lr61wn51wn11lss1unz1u301i6o
+oxm.schemaServiceTruststorePassword=OBF:1i9a1u2a1unz1lr61wn51wn11lss1unz1u301i6o
+
+
+
+# Schema Service need this variable for the time being
+spring.applicationName=sparky
spring.profiles.active=camel,ssl,fe-prod,oxm-schema-prod,oxm-default,resources,sync,portal
+portal.cadiFileLocation={{.Values.config.cadiFileLocation}}
+portal.cadiFileLocation={{.Values.config.cadiFileLocation}}
searchservice.hostname={{.Values.global.searchData.serviceName}}
searchservice.port=9509
searchservice.client-cert=client-cert-onap.p12
searchservice.client-cert-password=1y0q1uvc1uum1uvg1pil1pjl1uuq1uvk1uuu1y10
searchservice.truststore=tomcat_keystore
+
+schema.ingest.file=${CONFIG_HOME}/schemaIngest.properties
--- /dev/null
+cipher.enc.key=AGLDdG4D04BKm2IxIWEr8o==!
################################################################################
# Java class that implements the ECOMP role and user mgt API
-portal.api.impl.class = org.onap.aai.sparky.security.portal.PortalRestAPIServiceImpl
+portal.api.impl.class = org.onap.aai.sparky.security.portal.PortalRestAPICentralServiceImpl
# Instance of ECOMP Portal where the app has been on-boarded
# use insecure http for dev purposes to avoid self-signed certificate
# Toggles use of UEB
ueb_listeners_enable = false
# IDs application withing UEB flow
-ueb_app_key = qFKles9N8gDTV0Zc
+ueb_app_key = ueb_key_7
+# Use this tag if the app is centralized
+role_access_centralized=remote
+
+# Connection and Read timeout values
+ext_req_connection_timeout=15000
+ext_req_read_timeout=20000
+
+#Add AAF namespace if the app is centralized
+auth_namespace={{.Values.config.aafNamespace}}
--- /dev/null
+# Configure AAF
+aaf_locate_url=https://aaf-locate.{{.Release.Namespace}}:8095
+aaf_url=<%=https://AAF_LOCATE_URL/AAF_NS.service:2.0
+
+#aaf_url=https://DME2RESOLVE/service=com.att.authz.AuthorizationService/version=2.0/envContext=TEST/routeOffer=BAU_SE
+# AAF Environment Designation
+
+#if you are running aaf service from a docker image you have to use aaf service IP and port number
+aaf_id={{.Values.config.aafUsername}}
+#Encrypt the password using AAF Jar
+aaf_password={{.Values.config.aafPassword}}
+# Sample CADI Properties, from CADI 1.4.2
+#hostname=org.onap.aai.orr
+csp_domain=PROD
+# Add Absolute path to Keyfile
+cadi_keyfile={{.Values.config.cadiKeyFile}}
+
+# This is required to accept Certificate Authentication from Certman certificates.
+# can be TEST, IST or PROD
+aaf_env=DEV
+
+# DEBUG prints off all the properties. Use to get started.
+cadi_loglevel=DEBUG
+
+# Add Absolute path to truststore2018.jks
+cadi_truststore={{.Values.config.cadiTrustStore}}
+# Note: This is the ONLY password that doesn't have to be encrypted. All Java's TrustStores are this passcode by default, because they are public certs
+cadi_truststore_password={{.Values.config.cadiTrustStorePassword}}
+
+# how to turn on SSL Logging
+#javax.net.debug=ssl
+
+# Use "maps.bing.com" to get Lat and Long for an Address
+AFT_LATITUDE=32.780140
+AFT_LONGITUDE=-96.800451
+AFT_ENVIRONMENT=AFTUAT
+AFT_DME2_CLIENT_IGNORE_SSL_CONFIG=true
+DME2.DEBUG=true
+AFT_DME2_HTTP_EXCHANGE_TRACE_ON=true
+
+cadi_latitude=32.780140
+cadi_longitude=-96.800451
+
+aaf_root_ns=com.att.aaf
+aaf_api_version=2.0
--- /dev/null
+77E_fh-8gTjeg8egAo-JgNkXYm1FGEBPMo44vKPgKyGCJj9Dn0xJqIBct2Ko35X4_HSU3wPq3I2q
+YHIvJCjmzXTVu2zvu4rIGTlwycTtLGDkgPyhOYFytv4GgazbpSs9331MPUeVVrdpkDCQmjtHSB4m
+DThhfEe2lkbZ35ljX3sVSf3JDy4ngRot0ktQwnnY4vxFdgVUl7LzVinXWgFLoqMyXmKh_bGw9aUH
+VMgqFsF_YmqLZY5ZARAraeywktvrU5kXYh5SnfXoJy7XIk0TBjHKqO-1mW-TcIgS3_v6GIGkZnpq
+e1FyE8cS21gTPFlc1KDoWUZE2yoEsQKJc4RFWfjid_mE6nckxym1TOsEn3G2_TlkZvliN_QMDB_c
+RuFLDB9HCChm4YYHpSn-RBqtJFz29bMTHQX8VNVfZ_Zhh-4dWOlEfpSzJvAqm_boo-8y8YDGIusx
+mvKyPXEKVCuBOljHaKhYg0d43nAXIFsssKpjmtQizA2L_TP1Mo_lDFIlCsPcRlHKTvzkTstEAhRj
+JnepzA--olBMwBkPxjm1Y5XQBGZH72i_o4Hr7_NqHb9sP486I2Nd1-owjHkhacGrLO1oORnuBUxp
+_SnaXYywe9tTz3BcfFupXSoDv4Sj7g9B53yPIWmjGggigidql3SNJsui6qOtwDHOejzEDFm23Lj7
+fXD6sb52U_ul9ahi4CoLTzpvMsPRYOqyRCk8K8FVBauZbG5D42oaFPn0S0rCSHOCU1TXbRdTF-Cs
+I2R0pEHNgb33yx6vtInaTSYIQ5cxa3XDA_50AQearV5SuYSlp8dK0BkpVCKgvSQdTn-2WiaV_hvO
+KzG7D2adT1kYY6TjYMXIaUiJ33y1XSNDG0s6r4NG5dNE6Jj7thdpnV-AAZoi0uZh1_bsHKLVmHRr
+NCXAc6DZm1D4N9y5lOJwUprUlJisZXLFTQThGMRY5dtiY_eK9Xjj4FQygXXhuhFXHz2-e4YApORv
+lXDcT29IZuuI1j26bxdNdhNr1wZsqqievBN6l6OQMiP21eIrxAUu1BEmiVOrfOzaEjxldDN2gFum
+4-zf9gsQT9UT8KEuOje64wVeHr09JpWuddV9HOAMvqc6mKTWmvUv_QiLgtK_b39QccMrOfOA1usM
+biRJ9wuTYIr584Q9CjHEcm5e2YufcbF-IDZ4IDui8gNXyYJuusTYdspeKzrtiLKfgI56ZWA3it9G
+SOkN18YyUmhk7HFkx9qEifb4UEbUQPb0dyXBRotf-91c5CPkct-36uV4sZBA_AR1tX3-aRKKB_SQ
+B0zaG-eaEdEqKv-ZYHqk23ZxiEsCX3ZdY7VSMWztE3_D5n8UgEl4et5LVfnjvU-arVVO93WUbXk0
+zi2QrOwytOZ0StAvFdF1nVwWllPg4EYcn8qLJIaaBRvLMlpHixtwRhltwJeMmJl3ExImOxNhVbhF
+6LxVXW6JK8JfMIwb_TE4EShDBjemq76BojQOwrO4OAyPG7B5iUtefdY-Zu1EtjXPhrUgljI_A1tg
+5_2WNjNTCT7Bvig3saFsIRi3cvgIcMAF2H7kJYw3UDvCFnx4LIom2u6vSeyatPxEOhRfpP0KvgEU
+koM9DFJW7VWQ11mB_DcU2NoYHdFKFy_cM62kIvoRwZTADGryEtkLSWEDT8MLpVrGXP2RjSZ3HHqC
+vVpVqQHC2VIqNKi2uHtYCiTEfj81Z0rCrnH3hYIRoOSe5W6m17xyb0RloG0G44uK0oNCfDYLwK0L
+TJaBdWSIBYI__ISsKx8o8r-3XLtbwQPPhv4-LpGwJYd7sIcqnpTYAyNGSrbEM4ECzHCH9Hwf9Duy
+cAQGWqXIbTV9i8ryw8OhcCZPTf3noPZyhzzdegiv6KNT-BBbxsgtDehtP-jvpd9eAhjlfUV_hoFJ
+rBUVMFrIOEDnnItVqBDmnavRdhn6N9ObVjVMv_4inhkvtpBCEVxtVQT2kFuBmZvPu_uHHbXi7_g8
+SVs3AjJ2ya3pZraK6gH3IOYoGtTAH3rKl7XdTMjqWnUCbhepuJqeEOF-DhpsEW7Oo0Lqzbjg
\ No newline at end of file
# prevent the portal interface's login processing from searching for a user\r
# specific cookie, and will instead allow passage if a valid session cookie is discovered.\r
onap_enabled={{.Values.config.portalOnapEnabled}}\r
+onap.user_id_cookie_name={{.Values.config.portalCookieName}}\r
+cookie_decryptor_classname={{.Values.config.cookieDecryptorClass}}\r
+app_roles={{.Values.config.portalAppRoles}}\r
# application image
repository: nexus3.onap.org:10001
-image: onap/sparky-be:1.3.0
+image: onap/sparky-be:1.4-STAGING-latest
pullPolicy: Always
restartPolicy: Always
flavor: small
gerritBranch: 3.0.0-ONAP
gerritProject: http://gerrit.onap.org/r/aai/test-config
portalUsername: aaiui
- portalPassword: 1t2v1vfv1unz1vgz1t3b
+ portalPassword: OBF:1t2v1vfv1unz1vgz1t3b
+ portalCookieName: UserId
+ portalAppRoles: ui_view
+ aafUsername: aai@aai.onap.org
+ aafNamespace: org.onap.aai.aaiui
+ aafPassword: enc:xxYw1FqXU5UpianbPeH5Rezg0YfjzuwQrSiLcCmJGfz
+ cadiKeyFile: /opt/app/sparky/config/portal/keyFile
+ cadiTrustStore: /opt/app/sparky/config/auth/truststoreONAPall.jks
+ cadiFileLocation: /opt/app/sparky/config/portal/cadi.properties
+ cadiTrustStorePassword: changeit
+ cookieDecryptorClass: org.onap.aai.sparky.security.BaseCookieDecryptor
# ONAP Cookie Processing - During initial development, the following flag, if true, will
# prevent the portal interface's login processing from searching for a user
# Global configuration defaults.
#################################################################
global:
- readinessImage: readiness-check:2.0.0
+ readinessImage: readiness-check:2.0.2
loggingImage: beats/filebeat:5.5.0
#################################################################
global: # global defaults
nodePortPrefix: 302
readinessRepository: oomk8s
- readinessImage: readiness-check:2.0.0
+ readinessImage: readiness-check:2.0.2
# application image
busyboxImage: busybox
readinessRepository: oomk8s
- readinessImage: readiness-check:2.0.0
+ readinessImage: readiness-check:2.0.2
loggingRepository: docker.elastic.co
loggingImage: beats/filebeat:5.5.0
version:
# Current version of the REST API
api:
- default: v15
+ default: v16
# Specifies which version the depth parameter is configurable
depth: v11
# List of all the supported versions of the API
- list: v11,v12,v13,v14,v15
+ list: v11,v12,v13,v14,v15,v16
# Specifies from which version related link should appear
related:
link: v11
# application image
repository: nexus3.onap.org:10001
-image: onap/ccsdk-ansible-server-image:0.3.3
+image: onap/ccsdk-ansible-server-image:0.4.1-STAGING-latest
pullPolicy: Always
# flag to enable debugging - application support required
ports:
{{if eq .Values.service.type "NodePort" -}}
- port: {{ .Values.service.externalPort }}
+ targetPort: {{ .Values.service.internalPort }}
nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort }}
name: {{ .Values.service.name }}
{{- else -}}
# application image
repository: nexus3.onap.org:10001
-image: onap/appc-cdt-image:1.4.3
+image: onap/appc-cdt-image:1.5.0-SNAPSHOT-latest
pullPolicy: Always
# application configuration
service:
type: NodePort
name: appc-cdt
- externalPort: 80
- internalPort: 80
+ externalPort: 18080
+ internalPort: 18080
nodePort: 89
ingress:
- name: CASSANDRA_START_RPC
value: {{ default "true" .Values.config.start_rpc | quote }}
- name: CASSANDRA_ENDPOINT_SNITCH
- value: {{ default "SimpleSnitch" .Values.config.endpoint_snitch | quote }}
+ value: {{ default "GossipingPropertyFileSnitch" .Values.config.endpoint_snitch | quote }}
- name: POD_IP
valueFrom:
fieldRef:
superuserName: admin
superuserEmail: admin@onap.org
-repository: docker.io
-image: ninech/netbox:v2.3.5
+repository: netboxcommunity
+image: netbox:v2.5.8
# probe configuration parameters
liveness:
# application image
repository: docker.io
-image: nginx:1.13-alpine
+image: nginx:1.15-alpine
pullPolicy: Always
ingress:
# application image
repository: docker.io
-image: postgres:10.2-alpine
+image: postgres:10.4-alpine
pullPolicy: Always
# application configuration
"config_subpath": "filebeat.yml",
"image" : "{{ .Values.global.loggingRepository }}/{{ .Values.global.loggingImage }}",
"config_map" : "dcae-filebeat-configmap"
+ },
+ "tls":
+ {
+ "cert_path": "/opt/tls/shared",
+ "image": "{{ .Values.global.tlsRepository }}/{{ .Values.global.tlsImage }}"
}
}
readinessImage: readiness-check:2.0.0
loggingRepository: docker.elastic.co
loggingImage: beats/filebeat:5.5.0
+ tlsRepository: nexus3.onap.org:10001
+ tlsImage: onap/org.onap.dcaegen2.deployments.tls-init-container:1.0.1-STAGING-latest
config:
logstashServiceName: log-ls
loggingRepository: docker.elastic.co
loggingImage: beats/filebeat:5.5.0
tlsRepository: nexus3.onap.org:10001
- tlsImage: onap/org.onap.dcaegen2.deployments.tls-init-container:1.0.0
+ tlsImage: onap/org.onap.dcaegen2.deployments.tls-init-container:1.0.1-STAGING-latest
consulLoaderRepository: nexus3.onap.org:10001
consulLoaderImage: onap/org.onap.dcaegen2.deployments.consul-loader-container:1.0.0
repositoryCred:
loggingRepository: docker.elastic.co
loggingImage: beats/filebeat:5.5.0
tlsRepository: nexus3.onap.org:10001
- tlsImage: onap/org.onap.dcaegen2.deployments.tls-init-container:1.0.0
+ tlsImage: onap/org.onap.dcaegen2.deployments.tls-init-container:1.0.1-STAGING-latest
consulLoaderRepository: nexus3.onap.org:10001
consulLoaderImage: onap/org.onap.dcaegen2.deployments.consul-loader-container:1.0.0
repositoryCred:
# Copyright © 2018 AT&T Intellectual Property. All rights reserved.
-# Modifications Copyright © 2018 Amdocs,Bell Canada
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# See the License for the specific language governing permissions and
# limitations under the License.
-make-dmaap: make-bus-controller make-message-router make-dmaap-data-router
+make-dmaap: make-bus-controller make-message-router make-dmaap-dr-node make-dmaap-dr-prov
make-bus-controller:
- cd charts && helm dep up dmaap-bus-controller && helm lint dmaap-bus-controller
+ cd components && helm dep up dmaap-bus-controller && helm lint dmaap-bus-controller
make-message-router:
- cd charts && helm dep up message-router && helm lint message-router
+ cd components && helm dep up message-router && helm lint message-router
-make-dmaap-data-router:
- cd charts && helm dep up dmaap-data-router && helm lint dmaap-data-router
+make-dmaap-dr-node:
+ cd components && helm dep up dmaap-dr-node && helm lint dmaap-dr-node
+
+make-dmaap-dr-prov:
+ cd components && helm dep up dmaap-dr-prov && helm lint dmaap-dr-prov
clean:
@find . -type f -name '*.tgz' -delete
+++ /dev/null
-# Copyright © 2017 Amdocs, Bell Canada
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-#################################################################
-# DMaap Data Router Global config defaults.
-#################################################################
-global:
- env:
- name: AUTO
- ubuntuInitRepository: oomk8s
- ubuntuInitImage: ubuntu-init:1.0.0
- loggingDirectory: /opt/app/datartr/logs
-
- config:
-# dr provisioning server configuration
- dmaapDrProv:
- servicetype: NodePort
- name: dmaap-dr-prov
- externalPort: 8080
- externalPort2: 8443
- internalPort: 8080
- internalPort2: 8443
- portName: dr-prov-port
- portName2: dr-prov-port2
- nodePort: 59
- nodePort2: 69
-# dr node server configuration
- dmaapDrNode:
- servicetype: ClusterIP
- name: dmaap-dr-node
- externalPort: 8080
- externalPort2: 8443
- internalPort: 8080
- internalPort2: 8443
- portName: dr-node-port
- portName2: dr-node-port2
-# dr-prov db configuration
- dmaapDrDb:
- mariadbServiceName: dmaap-dr-db-svc
- mariadbServicePort: 3306
- mariadbContName: dmaap-dr-db
-
-# mariadb-galera configuration
-mariadb:
- name: dmaap-dr-db
- nameOverride: dmaap-dr-db
- replicaCount: 2
- config:
- mariadbRootPassword: datarouter
- userName: datarouter
- userPassword: datarouter
- mysqlDatabase: datarouter
- service:
- name: dmaap-dr-db-svc
- portName: dmaap-dr-db-svc
- nfsprovisionerPrefix: dmaap-dr-db
- persistence:
- size: 1Gi
- mountSubPath: data-router/dr-db-data
- disableNfsProvisioner: true
\ No newline at end of file
+++ /dev/null
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
# application images
repository: nexus3.onap.org:10001
-image: onap/dmaap/buscontroller:1.0.26
+image: onap/dmaap/buscontroller:1.0.23
# application configuration
apiVersion: v1
description: ONAP DMaaP Data Router Node Server
name: dmaap-dr-node
-version: 1.0
+version: 4.0.0
--- /dev/null
+#
+# ============LICENSE_START=======================================================
+# Copyright (C) 2019 Nordix Foundation.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+#
+
+dependencies:
+ - name: common
+ version: ~4.x-0
+ repository: '@local'
#!/bin/sh
-dr_prov_url="{{.Values.global.config.dmaapDrProv.name}}:{{.Values.global.config.dmaapDrProv.internalPort2}}"
+dr_prov_url="{{.Values.config.dmaapDrProv.name}}:{{.Values.config.dmaapDrProv.internalPort2}}"
ct_header="Content-Type:application/vnd.dmaap-dr.feed"
obo_header="X-DMAAP-DR-ON-BEHALF-OF:dradmin"
feed_payload=/opt/app/datartr/etc/dedicatedFeed.json
# URL to retrieve dynamic configuration
#
#ProvisioningURL: ${DRTR_PROV_INTURL}
-ProvisioningURL=https://{{.Values.global.config.dmaapDrProv.name}}:{{.Values.global.config.dmaapDrProv.externalPort2}}/internal/prov
+ProvisioningURL=https://{{.Values.config.dmaapDrProv.name}}:{{.Values.config.dmaapDrProv.externalPort2}}/internal/prov
#
# URL to upload PUB/DEL/EXP logs
#
#LogUploadURL: ${DRTR_LOG_URL}
-LogUploadURL=https://{{.Values.global.config.dmaapDrProv.name}}:{{.Values.global.config.dmaapDrProv.externalPort2}}/internal/logs
+LogUploadURL=https://{{.Values.config.dmaapDrProv.name}}:{{.Values.config.dmaapDrProv.externalPort2}}/internal/logs
#
# The port number for http as seen within the server
#
#IntHttpPort: ${DRTR_NODE_INTHTTPPORT:-8080}
-IntHttpPort={{.Values.global.config.dmaapDrNode.internalPort}}
+IntHttpPort={{.Values.config.dmaapDrNode.internalPort}}
#
# The port number for https as seen within the server
#
-IntHttpsPort={{.Values.global.config.dmaapDrNode.internalPort2}}
+IntHttpsPort={{.Values.config.dmaapDrNode.internalPort2}}
#
# The external port number for https taking port mapping into account
#
#
# The password for the https keystore
#
-KeyStorePassword=4*&GD+w58RUM]01No.CYY;z6
+KeyStorePassword=]3V)($O&.Mv]W{f8^]6SxGNL
#
# The password for the private key in the https keystore
#
-KeyPassword=4*&GD+w58RUM]01No.CYY;z6
+KeyPassword=]3V)($O&.Mv]W{f8^]6SxGNL
#
# The type of truststore for https
#
#
# The password for the https truststore
#
-TrustStorePassword=UDXlT6Iu[F)k,Htk92+B,0Xj
+TrustStorePassword=(Rd,&{]%ePdp}4JZjqoJ2G+g
#
# The path to the file used to trigger an orderly shutdown
#
{{- range .Values.ingress.hosts }}
http://{{ . }}
{{- end }}
-{{- else if contains "NodePort" .Values.global.config.dmaapDrNode.servicetype }}
+{{- else if contains "NodePort" .Values.config.dmaapDrNode.servicetype }}
export NODE_PORT=$(kubectl get --namespace {{ include "common.namespace" . }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "common.name" . }})
export NODE_IP=$(kubectl get nodes --namespace {{ include "common.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}")
echo http://$NODE_IP:$NODE_PORT
-{{- else if contains "LoadBalancer" .Values.global.config.dmaapDrNode.servicetype }}
+{{- else if contains "LoadBalancer" .Values.config.dmaapDrNode.servicetype }}
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
You can watch the status of by running 'kubectl get svc -w {{ include "common.name" . }}'
export SERVICE_IP=$(kubectl get svc --namespace {{ include "common.namespace" . }} {{ include "common.name" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
- echo http://$SERVICE_IP:{{.Values.global.config.dmaapDrNode.externalPort}}
-{{- else if contains "ClusterIP" .Values.global.config.dmaapDrNode.servicetype }}
+ echo http://$SERVICE_IP:{{.Values.config.dmaapDrNode.externalPort}}
+{{- else if contains "ClusterIP" .Values.config.dmaapDrNode.servicetype }}
export POD_NAME=$(kubectl get pods --namespace {{ include "common.namespace" . }} -l "app={{ include "common.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
echo "Visit http://127.0.0.1:8080 to use your application"
- kubectl port-forward $POD_NAME 8080:{{.Values.global.config.dmaapDrNode.internalPort}}
+ kubectl port-forward $POD_NAME 8080:{{.Values.config.dmaapDrNode.internalPort}}
{{- end }}
\ No newline at end of file
--- /dev/null
+{{/*
+ # ============LICENSE_START=======================================================
+ # Copyright (C) 2019 Nordix Foundation.
+ # ================================================================================
+ # Licensed under the Apache License, Version 2.0 (the "License");
+ # you may not use this file except in compliance with the License.
+ # You may obtain a copy of the License at
+ #
+ # http://www.apache.org/licenses/LICENSE-2.0
+ #
+ # Unless required by applicable law or agreed to in writing, software
+ # distributed under the License is distributed on an "AS IS" BASIS,
+ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ # See the License for the specific language governing permissions and
+ # limitations under the License.
+ #
+ # SPDX-License-Identifier: Apache-2.0
+ # ============LICENSE_END=========================================================
+*/}}
+
+kind: PersistentVolume
+apiVersion: v1
+metadata:
+ name: {{ include "common.fullname" . }}-spool-data-pv
+ namespace: {{ include "common.namespace" . }}
+ labels:
+ app: {{ include "common.name" . }}
+ chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
+ release: "{{ .Release.Name }}"
+ heritage: "{{ .Release.Service }}"
+ name: {{ include "common.fullname" . }}-spool-data-pv
+spec:
+ capacity:
+ storage: {{ .Values.persistence.spoolSize }}
+ accessModes:
+ - {{ .Values.persistence.accessMode }}
+ storageClassName: "{{ include "common.fullname" . }}-spool-data-stcl"
+ persistentVolumeReclaimPolicy: {{ .Values.persistence.volumeReclaimPolicy }}
+ hostPath:
+ path: {{ .Values.persistence.mountPath }}/{{ .Release.Name }}/{{ .Values.persistence.spoolMountSubPath }}
+---
+kind: PersistentVolume
+apiVersion: v1
+metadata:
+ name: {{ include "common.fullname" . }}-event-logs-pv
+ namespace: {{ include "common.namespace" . }}
+ labels:
+ app: {{ include "common.name" . }}
+ chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
+ release: "{{ .Release.Name }}"
+ heritage: "{{ .Release.Service }}"
+ name: {{ include "common.fullname" . }}-event-logs-pv
+spec:
+ capacity:
+ storage: {{ .Values.persistence.eventLogSize }}
+ accessModes:
+ - {{ .Values.persistence.accessMode }}
+ storageClassName: "{{ include "common.fullname" . }}-event-logs-stcl"
+ persistentVolumeReclaimPolicy: {{ .Values.persistence.volumeReclaimPolicy }}
+ hostPath:
+ path: {{ .Values.persistence.mountPath }}/{{ .Release.Name }}/{{ .Values.persistence.eventLogsMountSubPath }}
\ No newline at end of file
apiVersion: v1
kind: Service
metadata:
- name: {{.Values.global.config.dmaapDrNode.name}}
+ name: {{.Values.config.dmaapDrNode.name}}
namespace: {{ include "common.namespace" . }}
labels:
app: {{ include "common.name" . }}
annotations:
service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
spec:
- type: {{.Values.global.config.dmaapDrNode.servicetype}}
+ type: {{.Values.config.dmaapDrNode.servicetype}}
ports:
- {{if eq .Values.global.config.dmaapDrNode.servicetype "NodePort" -}}
- - port: {{.Values.global.config.dmaapDrNode.externalPort}}
- targetPort: {{.Values.global.config.dmaapDrNode.internalPort}}
- nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{.Values.global.config.dmaapDrNode.nodePort}}
- name: {{.Values.global.config.dmaapDrNode.name}}
- - port: {{.Values.global.config.dmaapDrNode.externalPort2}}
- targetPort: {{.Values.global.config.dmaapDrNode.internalPort2}}
- nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{.Values.global.config.dmaapDrNode.nodePort2}}
- name: {{.Values.global.config.dmaapDrNode.name}}2
+ {{if eq .Values.config.dmaapDrNode.servicetype "NodePort" -}}
+ - port: {{.Values.config.dmaapDrNode.externalPort}}
+ targetPort: {{.Values.config.dmaapDrNode.internalPort}}
+ nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{.Values.config.dmaapDrNode.nodePort}}
+ name: {{.Values.config.dmaapDrNode.name}}
+ - port: {{.Values.config.dmaapDrNode.externalPort2}}
+ targetPort: {{.Values.config.dmaapDrNode.internalPort2}}
+ nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{.Values.config.dmaapDrNode.nodePort2}}
+ name: {{.Values.config.dmaapDrNode.name}}2
{{- else -}}
- - port: {{.Values.global.config.dmaapDrNode.externalPort}}
- targetPort: {{.Values.global.config.dmaapDrNode.internalPort}}
- name: {{.Values.global.config.dmaapDrNode.name}}
- - port: {{.Values.global.config.dmaapDrNode.externalPort2}}
- targetPort: {{.Values.global.config.dmaapDrNode.internalPort2}}
- name: {{.Values.global.config.dmaapDrNode.name}}2
+ - port: {{.Values.config.dmaapDrNode.externalPort}}
+ targetPort: {{.Values.config.dmaapDrNode.internalPort}}
+ name: {{.Values.config.dmaapDrNode.name}}
+ - port: {{.Values.config.dmaapDrNode.externalPort2}}
+ targetPort: {{.Values.config.dmaapDrNode.internalPort2}}
+ name: {{.Values.config.dmaapDrNode.name}}2
{{- end}}
selector:
app: {{ include "common.name" . }}
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
-apiVersion: extensions/v1beta1
-kind: Deployment
+apiVersion: apps/v1beta1
+kind: StatefulSet
metadata:
name: {{ include "common.fullname" . }}
namespace: {{ include "common.namespace" . }}
heritage: {{ .Release.Service }}
spec:
replicas: {{ .Values.replicaCount }}
+ serviceName: {{ .Values.config.dmaapDrNode.name }}
template:
metadata:
labels:
app: {{ include "common.name" . }}
release: {{ .Release.Name }}
spec:
- hostname: {{.Values.global.config.dmaapDrNode.name}}
initContainers:
- name: {{ include "common.name" . }}-readiness
image: "{{ .Values.global.readinessRepository }}/{{ .Values.global.readinessImage }}"
- /root/ready.py
args:
- --container-name
- - {{.Values.global.config.dmaapDrProv.name}}
+ - dmaap-dr-prov
env:
- name: NAMESPACE
valueFrom:
image: "{{ include "common.repository" . }}/{{ .Values.image }}"
imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
ports:
- - containerPort: {{.Values.global.config.dmaapDrNode.externalPort}}
- - containerPort: {{.Values.global.config.dmaapDrNode.externalPort2}}
+ - containerPort: {{.Values.config.dmaapDrNode.externalPort}}
+ - containerPort: {{.Values.config.dmaapDrNode.externalPort2}}
{{- if eq .Values.liveness.enabled true }}
livenessProbe:
tcpSocket:
- port: {{.Values.global.config.dmaapDrNode.internalPort}}
+ port: {{.Values.config.dmaapDrNode.internalPort}}
initialDelaySeconds: {{ .Values.liveness.initialDelaySeconds }}
periodSeconds: {{ .Values.liveness.periodSeconds }}
{{ end -}}
readinessProbe:
tcpSocket:
- port: {{.Values.global.config.dmaapDrNode.internalPort}}
+ port: {{.Values.config.dmaapDrNode.internalPort}}
initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }}
periodSeconds: {{ .Values.readiness.periodSeconds }}
volumeMounts:
+ - mountPath: {{ .Values.persistence.spoolPath }}
+ name: {{ include "common.fullname" . }}-spool-data-pvc
+ - mountPath: {{ .Values.persistence.eventLogsPath }}
+ name: {{ include "common.fullname" . }}-event-logs-pvc
- mountPath: /etc/localtime
name: localtime
readOnly: false
- mountPath: /opt/app/datartr/etc/node.properties
subPath: node.properties
name: node-props
- - name: {{ include "common.fullname" . }}-logs
- mountPath: {{ .Values.global.loggingDirectory }}
lifecycle:
postStart:
exec:
command:
- - /opt/app/datartr/etc/createFeed.sh
+ - /opt/app/datartr/etc/createFeed.sh
resources:
{{ include "common.resources" . | indent 12 }}
{{- if .Values.nodeSelector }}
affinity:
{{ toYaml .Values.affinity | indent 10 }}
{{- end }}
-
# Filebeat sidecar container
- name: {{ include "common.name" . }}-filebeat-onap
image: "{{ .Values.global.loggingRepository }}/{{ .Values.global.loggingImage }}"
subPath: filebeat.yml
- name: {{ include "common.fullname" . }}-data-filebeat
mountPath: /usr/share/filebeat/data
- - name: {{ include "common.fullname" . }}-logs
+ - name: {{ include "common.fullname" . }}-event-logs-pvc
mountPath: /var/log/onap/datarouter-node
- volumes:
- - name: localtime
- hostPath:
- path: /etc/localtime
- - name: create-feed
- configMap:
- name: {{ include "common.fullname" . }}-create-feed-configmap
- defaultMode: 0755
- - name: node-props
- configMap:
- name: {{ include "common.fullname" . }}-node-props-configmap
- - name: dr-node-data
- {{- if .Values.persistence.enabled }}
- persistentVolumeClaim:
- claimName: {{ include "common.fullname" . }}
- {{- else }}
- emptyDir: {}
- {{- end }}
- - name: {{ include "common.fullname" . }}-log-conf
- configMap:
- name: {{ include "common.fullname" . }}-log
- - name: {{ include "common.fullname" . }}-filebeat-conf
- configMap:
- name: {{ .Release.Name }}-dmaap-filebeat-configmap
- - name: {{ include "common.fullname" . }}-data-filebeat
- emptyDir: {}
- - name: {{ include "common.fullname" . }}-logs
- emptyDir: {}
imagePullSecrets:
- name: "{{ include "common.namespace" . }}-docker-registry-key"
+ volumes:
+ - name: localtime
+ hostPath:
+ path: /etc/localtime
+ - name: create-feed
+ configMap:
+ name: {{ include "common.fullname" . }}-create-feed-configmap
+ defaultMode: 0755
+ - name: node-props
+ configMap:
+ name: {{ include "common.fullname" . }}-node-props-configmap
+ - name: {{ include "common.fullname" . }}-log-conf
+ configMap:
+ name: {{ include "common.fullname" . }}-log
+ - name: {{ include "common.fullname" . }}-filebeat-conf
+ configMap:
+ name: {{ .Release.Name }}-dmaap-filebeat-configmap
+ - name: {{ include "common.fullname" . }}-data-filebeat
+ emptyDir: {}
+ - name: {{ include "common.fullname" . }}-event-logs-pvc
+ emptyDir: {}
+ volumeClaimTemplates:
+ - metadata:
+ name: {{ include "common.fullname" . }}-spool-data-pvc
+ labels:
+ name: {{ include "common.fullname" . }}
+ spec:
+ accessModes: [ {{ .Values.persistence.accessMode }} ]
+ storageClassName: {{ include "common.fullname" . }}-spool-data-stcl
+ resources:
+ requests:
+ storage: {{ .Values.persistence.spoolSize }}
+ selector:
+ matchLabels:
+ name: {{ include "common.fullname" . }}-spool-data-pv
+ - metadata:
+ name: {{ include "common.fullname" . }}-event-logs-pvc
+ labels:
+ name: {{ include "common.fullname" . }}
+ spec:
+ accessModes: [ {{ .Values.persistence.accessMode }} ]
+ storageClassName: {{ include "common.fullname" . }}-event-logs-stcl
+ resources:
+ requests:
+ storage: {{ .Values.persistence.eventLogSize }}
+ selector:
+ matchLabels:
+ name: {{ include "common.fullname" . }}-event-logs-pv
readinessImage: readiness-check:2.0.0
loggingRepository: docker.elastic.co
loggingImage: beats/filebeat:5.5.0
+ loggingDirectory: /opt/app/datartr/logs
#################################################################
# Application configuration defaults.
#################################################################
# application image
repository: nexus3.onap.org:10001
-image: onap/dmaap/datarouter-node:2.0.0
+image: onap/dmaap/datarouter-node:2.0.1
pullPolicy: Always
# flag to enable debugging - application support required
## Persist data to a persitent volume
persistence:
- enabled: false
+ volumeReclaimPolicy: Retain
+ accessMode: ReadWriteMany
+ mountPath: /dockerdata-nfs
+
+ spoolMountSubPath: data-router/dr-node/spool-data
+ spoolSize: 1Gi
+ spoolPath: /opt/app/datartr/spool
+
+ eventLogsMountSubPath: data-router/dr-node/event-logs
+ eventLogSize: 1Gi
+ eventLogsPath: /opt/app/datartr/logs
ingress:
enabled: false
cpu: 1000m
memory: 2Gi
unlimited: {}
+
+config:
+ # dr node server configuration
+ dmaapDrNode:
+ servicetype: ClusterIP
+ name: dmaap-dr-node
+ externalPort: 8080
+ externalPort2: 8443
+ internalPort: 8080
+ internalPort2: 8443
+ portName: dr-node-port
+ portName2: dr-node-port2
+
+# dr provisioning server configuration
+ dmaapDrProv:
+ name: dmaap-dr-prov
+ externalPort2: 8443
+ internalPort2: 8443
apiVersion: v1
description: ONAP DMaaP Data Router Provisioning Server
name: dmaap-dr-prov
-version: 1.0
+version: 4.0.0
-# Copyright © 2017 Amdocs, Bell Canada
#
+# ============LICENSE_START=======================================================
+# Copyright (C) 2019 Nordix Foundation.
+# ================================================================================
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
-# http://www.apache.org/licenses/LICENSE-2.0
+# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+#
dependencies:
- name: common
- name: mariadb-galera
alias: mariadb
version: ~4.x-0
- repository: '@local'
-
+ repository: '@local'
\ No newline at end of file
#Jetty Server properties
-org.onap.dmaap.datarouter.provserver.http.port = {{.Values.global.config.dmaapDrProv.externalPort}}
-org.onap.dmaap.datarouter.provserver.https.port = {{.Values.global.config.dmaapDrProv.externalPort2}}
+org.onap.dmaap.datarouter.provserver.http.port = {{.Values.config.dmaapDrProv.externalPort}}
+org.onap.dmaap.datarouter.provserver.https.port = {{.Values.config.dmaapDrProv.externalPort2}}
org.onap.dmaap.datarouter.provserver.https.relaxation = true
-org.onap.dmaap.datarouter.provserver.keymanager.password = Qgw77oaQcdP*F8Pwa[&.,.Ab
+org.onap.dmaap.datarouter.provserver.keymanager.password = AT{];bvaDiytVD&oWhMZj0N5
org.onap.dmaap.datarouter.provserver.keystore.type = jks
org.onap.dmaap.datarouter.provserver.keystore.path = /opt/app/datartr/aaf_certs/org.onap.dmaap-dr.jks
-org.onap.dmaap.datarouter.provserver.keystore.password = Qgw77oaQcdP*F8Pwa[&.,.Ab
+org.onap.dmaap.datarouter.provserver.keystore.password = AT{];bvaDiytVD&oWhMZj0N5
org.onap.dmaap.datarouter.provserver.truststore.path = /opt/app/datartr/aaf_certs/org.onap.dmaap-dr.trust.jks
-org.onap.dmaap.datarouter.provserver.truststore.password = 9M?)?:KAj1z6gpLhNrVUG@0T
+org.onap.dmaap.datarouter.provserver.truststore.password = ljlS@Y}0]{UO(TnwvEWkgJ%]
org.onap.dmaap.datarouter.provserver.accesslog.dir = /opt/app/datartr/logs
org.onap.dmaap.datarouter.provserver.spooldir = /opt/app/datartr/spool
org.onap.dmaap.datarouter.provserver.dbscripts = /opt/app/datartr/etc/misc
# Database access
org.onap.dmaap.datarouter.db.driver = org.mariadb.jdbc.Driver
-org.onap.dmaap.datarouter.db.url = jdbc:mariadb://{{.Values.global.config.dmaapDrDb.mariadbServiceName}}:{{.Values.global.config.dmaapDrDb.mariadbServicePort}}/datarouter
+org.onap.dmaap.datarouter.db.url = jdbc:mariadb://{{.Values.config.dmaapDrDb.mariadbServiceName}}:{{.Values.config.dmaapDrDb.mariadbServicePort}}/datarouter
org.onap.dmaap.datarouter.db.login = datarouter
org.onap.dmaap.datarouter.db.password = datarouter
{{- range .Values.ingress.hosts }}
http://{{ . }}
{{- end }}
-{{- else if contains "NodePort" .Values.global.config.dmaapDrProv.servicetype }}
+{{- else if contains "NodePort" .Values.config.dmaapDrProv.servicetype }}
export NODE_PORT=$(kubectl get --namespace {{ include "common.namespace" . }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "common.name" . }})
export NODE_IP=$(kubectl get nodes --namespace {{ include "common.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}")
echo http://$NODE_IP:$NODE_PORT
-{{- else if contains "LoadBalancer" .Values.global.config.dmaapDrProv.servicetype }}
+{{- else if contains "LoadBalancer" .Values.config.dmaapDrProv.servicetype }}
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
You can watch the status of by running 'kubectl get svc -w {{ include "common.name" . }}'
export SERVICE_IP=$(kubectl get svc --namespace {{ include "common.namespace" . }} {{ include "common.name" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
- echo http://$SERVICE_IP:{{.Values.global.config.dmaapDrProv.externalPort}}
-{{- else if contains "ClusterIP" .Values.global.config.dmaapDrProv.servicetype }}
+ echo http://$SERVICE_IP:{{.Values.config.dmaapDrProv.externalPort}}
+{{- else if contains "ClusterIP" .Values.config.dmaapDrProv.servicetype }}
export POD_NAME=$(kubectl get pods --namespace {{ include "common.namespace" . }} -l "app={{ include "common.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
echo "Visit http://127.0.0.1:8080 to use your application"
- kubectl port-forward $POD_NAME 8080:{{.Values.global.config.dmaapDrProv.internalPort}}
+ kubectl port-forward $POD_NAME 8080:{{.Values.config.dmaapDrProv.internalPort}}
{{- end }}
app: {{ include "common.name" . }}
release: {{ .Release.Name }}
spec:
- hostname: {{.Values.global.config.dmaapDrProv.name}}
+ hostname: {{.Values.config.dmaapDrProv.name}}
initContainers:
- command:
- /root/ready.py
args:
- --container-name
- - {{.Values.global.config.dmaapDrDb.mariadbContName}}
+ - {{.Values.config.dmaapDrDb.mariadbContName}}
env:
- name: NAMESPACE
valueFrom:
image: "{{ include "common.repository" . }}/{{ .Values.image }}"
imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
ports:
- - containerPort: {{.Values.global.config.dmaapDrProv.externalPort}}
- - containerPort: {{.Values.global.config.dmaapDrProv.externalPort2}}
+ - containerPort: {{.Values.config.dmaapDrProv.externalPort}}
+ - containerPort: {{.Values.config.dmaapDrProv.externalPort2}}
{{- if eq .Values.liveness.enabled true }}
livenessProbe:
tcpSocket:
- port: {{.Values.global.config.dmaapDrProv.externalPort}}
+ port: {{.Values.config.dmaapDrProv.externalPort}}
initialDelaySeconds: {{ .Values.liveness.initialDelaySeconds }}
periodSeconds: {{ .Values.liveness.periodSeconds }}
{{ end -}}
readinessProbe:
tcpSocket:
- port: {{.Values.global.config.dmaapDrProv.externalPort}}
+ port: {{.Values.config.dmaapDrProv.externalPort}}
initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }}
periodSeconds: {{ .Values.readiness.periodSeconds }}
volumeMounts:
affinity:
{{ toYaml .Values.affinity | indent 10 }}
{{- end }}
-
# Filebeat sidecar container
- name: {{ include "common.name" . }}-filebeat-onap
image: "{{ .Values.global.loggingRepository }}/{{ .Values.global.loggingImage }}"
- name: prov-props
configMap:
name: {{ include "common.fullname" . }}-prov-props-configmap
- - name: dr-prov-data
- {{- if .Values.persistence.enabled }}
- persistentVolumeClaim:
- claimName: {{ include "common.fullname" . }}
- {{- else }}
- emptyDir: {}
- {{- end }}
- name: {{ include "common.fullname" . }}-log-conf
configMap:
name: {{ include "common.fullname" . }}-log
apiVersion: v1
kind: Service
metadata:
- name: {{.Values.global.config.dmaapDrProv.name}}
+ name: {{.Values.config.dmaapDrProv.name}}
namespace: {{ include "common.namespace" . }}
labels:
app: {{ include "common.name" . }}
service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
msb.onap.org/service-info: '[
{
- "serviceName": "{{.Values.global.config.dmaapDrProv.name}}",
+ "serviceName": "{{.Values.config.dmaapDrProv.name}}",
"version": "v1",
"url": "/",
"protocol": "REST",
- "port": "{{.Values.global.config.dmaapDrProv.externalPort}}",
+ "port": "{{.Values.config.dmaapDrProv.externalPort}}",
"visualRange":"1"
}
]'
spec:
- type: {{.Values.global.config.dmaapDrProv.servicetype}}
+ type: {{.Values.config.dmaapDrProv.servicetype}}
ports:
- {{if eq .Values.global.config.dmaapDrProv.servicetype "NodePort" -}}
- - port: {{.Values.global.config.dmaapDrProv.externalPort}}
- targetPort: {{.Values.global.config.dmaapDrProv.internalPort}}
- nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{.Values.global.config.dmaapDrProv.nodePort}}
- name: {{.Values.global.config.dmaapDrProv.name}}
- - port: {{.Values.global.config.dmaapDrProv.externalPort2}}
- targetPort: {{.Values.global.config.dmaapDrProv.internalPort2}}
- nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{.Values.global.config.dmaapDrProv.nodePort2}}
- name: {{.Values.global.config.dmaapDrProv.name}}2
+ {{if eq .Values.config.dmaapDrProv.servicetype "NodePort" -}}
+ - port: {{.Values.config.dmaapDrProv.externalPort}}
+ targetPort: {{.Values.config.dmaapDrProv.internalPort}}
+ nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{.Values.config.dmaapDrProv.nodePort}}
+ name: {{.Values.config.dmaapDrProv.name}}
+ - port: {{.Values.config.dmaapDrProv.externalPort2}}
+ targetPort: {{.Values.config.dmaapDrProv.internalPort2}}
+ nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{.Values.config.dmaapDrProv.nodePort2}}
+ name: {{.Values.config.dmaapDrProv.name}}2
{{- else -}}
- - port: {{.Values.global.config.dmaapDrProv.externalPort}}
- targetPort: {{.Values.global.config.dmaapDrProv.internalPort}}
- name: {{.Values.global.config.dmaapDrProv.name}}
- - port: {{.Values.global.config.dmaapDrProv.externalPort2}}
- targetPort: {{.Values.global.config.dmaapDrProv.internalPort2}}
- name: {{.Values.global.config.dmaapDrProv.name}}2
+ - port: {{.Values.config.dmaapDrProv.externalPort}}
+ targetPort: {{.Values.config.dmaapDrProv.internalPort}}
+ name: {{.Values.config.dmaapDrProv.name}}
+ - port: {{.Values.config.dmaapDrProv.externalPort2}}
+ targetPort: {{.Values.config.dmaapDrProv.internalPort2}}
+ name: {{.Values.config.dmaapDrProv.name}}2
{{- end}}
selector:
app: {{ include "common.name" . }}
readinessImage: readiness-check:2.0.0
loggingRepository: docker.elastic.co
loggingImage: beats/filebeat:5.5.0
+ loggingDirectory: /opt/app/datartr/logs
#################################################################
# Application configuration defaults.
#################################################################
# application image
repository: nexus3.onap.org:10001
-image: onap/dmaap/datarouter-prov:2.0.0
+image: onap/dmaap/datarouter-prov:2.0.1
pullPolicy: Always
# flag to enable debugging - application support required
cpu: 1000m
memory: 2Gi
unlimited: {}
+
+config:
+ # dr provisioning server configuration
+ dmaapDrProv:
+ servicetype: NodePort
+ name: dmaap-dr-prov
+ externalPort: 8080
+ externalPort2: 8443
+ internalPort: 8080
+ internalPort2: 8443
+ portName: dr-prov-port
+ portName2: dr-prov-port2
+ nodePort: 59
+ nodePort2: 69
+ # dr-prov db configuration
+ dmaapDrDb:
+ mariadbServiceName: dmaap-dr-db-svc
+ mariadbServicePort: 3306
+ mariadbContName: dmaap-dr-db
+
+# mariadb-galera configuration
+mariadb:
+ name: dmaap-dr-db
+ nameOverride: dmaap-dr-db
+ replicaCount: 2
+ config:
+ mariadbRootPassword: datarouter
+ userName: datarouter
+ userPassword: datarouter
+ mysqlDatabase: datarouter
+ service:
+ name: dmaap-dr-db-svc
+ portName: dmaap-dr-db-svc
+ nfsprovisionerPrefix: dmaap-dr-db
+ persistence:
+ size: 1Gi
+ mountSubPath: data-router/dr-db-data
+ disableNfsProvisioner: true
\ No newline at end of file
spec:
selector:
matchLabels:
- app: {{ include "common.fullname" . }}
+ app: {{ include "common.name" . }}
maxUnavailable: 1
values:
- {{ include "common.name" . }}
topologyKey: "kubernetes.io/hostname"
+ {{- if .Values.nodeAffinity }}
+ nodeAffinity:
+ {{ toYaml .Values.nodeAffinity | indent 10 }}
+ {{- end }}
initContainers:
- name: {{ include "common.name" . }}-initcontainer
image: "{{ .Values.global.ubuntuInitRepository }}/{{ .Values.ubuntuInitImage }}"
name: docker-socket
- mountPath: /kafka
name: kafka-data
+ {{- if .Values.tolerations }}
+ tolerations:
+ {{ toYaml .Values.tolerations | indent 10 }}
+ {{- end }}
volumes:
- name: localtime
hostPath:
# defult partitions
defaultpartitions: 3
-
nodeSelector: {}
+nodeAffinity: {}
+
affinity: {}
+tolerations: {}
+
# probe configuration parameters
liveness:
initialDelaySeconds: 60
spec:
selector:
matchLabels:
- app: {{ include "common.fullname" . }}
- maxUnavailable: 1
+ app: {{ include "common.name" . }}
+ maxUnavailable: {{ div (sub .Values.replicaCount 1) 2 }}
values:
- {{ include "common.name" . }}
topologyKey: "kubernetes.io/hostname"
+ {{- if .Values.nodeAffinity }}
+ nodeAffinity:
+ {{ toYaml .Values.nodeAffinity | indent 10 }}
+ {{- end }}
initContainers:
- name: {{ include "common.name" . }}-seed-topics-apikeys
command:
readOnly: true
- mountPath: /var/lib/zookeeper/data
name: zookeeper-data
+ {{- if .Values.tolerations }}
+ tolerations:
+ {{ toYaml .Values.tolerations | indent 10 }}
+ {{- end }}
volumes:
- name: localtime
hostPath:
nodeSelector: {}
+nodeAffinity: {}
+
affinity: {}
+tolerations: {}
+
# probe configuration parameters
liveness:
initialDelaySeconds: 10
- name: common
version: ~4.x-0
repository: '@local'
+ - name: message-router
+ version: ~4.x-0
+ repository: 'file://components/message-router'
+ condition: message-router.enabled
+ - name: dmaap-bus-controller
+ version: ~4.x-0
+ repository: 'file://components/dmaap-bus-controller'
+ condition: dmaap-bus-controller.enabled
+ - name: dmaap-dr-node
+ version: ~4.x-0
+ repository: 'file://components/dmaap-dr-node'
+ condition: dmaap-dr-node.enabled
+ - name: dmaap-dr-prov
+ version: ~4.x-0
+ repository: 'file://components/dmaap-dr-prov'
+ condition: dmaap-dr-prov.enabled
config:
logstashServiceName: log-ls
logstashPort: 5044
+
+message-router:
+ enabled: true
+dmaap-bus-controller:
+ enabled: true
+dmaap-dr-node:
+ enabled: true
+dmaap-dr-prov:
+ enabled: true
\ No newline at end of file
--set-string stringArray set STRING values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2)
-f, --values valueFiles specify values in a YAML file or a URL(can specify multiple) (default [])
--verbose enables full helm install/upgrade output during deploy
+ --set-last-applied set the last-applied-configuration annotation on all objects.This annotation is required to restore services using Ark/Veloro backup restore.
EOF
}
FLAGS="$(echo $FLAGS| sed -n 's/--verbose//p')"
VERBOSE="true"
fi
+ # determine if set-last-applied flag is enabled
+ SET_LAST_APPLIED="false"
+ if [[ $FLAGS = *"--set-last-applied"* ]]; then
+ FLAGS="$(echo $FLAGS| sed -n 's/--set-last-applied//p')"
+ SET_LAST_APPLIED="true"
+ fi
if [[ $FLAGS = *"--dry-run"* ]]; then
VERBOSE="true"
FLAGS="$FLAGS --debug"
else
echo "release \"$RELEASE\" deployed"
fi
+ # Add annotation last-applied-configuration if set-last-applied flag is set
+ if [[ $SET_LAST_APPLIED == "true" ]]; then
+ helm get manifest ${RELEASE} \
+ | kubectl apply set-last-applied --create-annotation -n onap -f - \
+ > $LOG_FILE.log 2>&1
+ fi
fi
# upgrade/install each "enabled" subchart
else
echo "release \"${RELEASE}-${subchart}\" deployed"
fi
+ # Add annotation last-applied-configuration if set-last-applied flag is set
+ if [[ $SET_LAST_APPLIED == "true" ]]; then
+ helm get manifest "${RELEASE}-${subchart}" \
+ | kubectl apply set-last-applied --create-annotation -n onap -f - \
+ > $LOG_FILE.log 2>&1
+ fi
fi
else
array=($(helm ls -q | grep "${RELEASE}-${subchart}"))
#################################################################
# application image
dockerHubRepository: registry.hub.docker.com
-image: library/consul:0.9.3
+image: library/consul:1.4.3
pullPolicy: Always
istioSidecar: true
requests:
cpu: 20m
memory: 100Mi
- unlimited: {}
\ No newline at end of file
+ unlimited: {}
#################################################################
# application image
repository: nexus3.onap.org:10001
-image: onap/msb/msb_discovery:1.2.1
+image: onap/msb/msb_discovery:1.2.3-STAGING-latest
pullPolicy: Always
istioSidecar: true
requests:
cpu: 400m
memory: 400Mi
- unlimited: {}
\ No newline at end of file
+ unlimited: {}
#################################################################
# application image
repository: nexus3.onap.org:10001
-image: onap/msb/msb_apigateway:1.2.1
+image: onap/msb/msb_apigateway:1.2.4-STAGING-latest
pullPolicy: Always
istioSidecar: true
requests:
cpu: 200m
memory: 400Mi
- unlimited: {}
\ No newline at end of file
+ unlimited: {}
#################################################################
# application image
repository: nexus3.onap.org:10001
-image: onap/msb/msb_apigateway:1.2.1
+image: onap/msb/msb_apigateway:1.2.4-STAGING-latest
pullPolicy: Always
istioSidecar: true
requests:
cpu: 100m
memory: 400Mi
- unlimited: {}
\ No newline at end of file
+ unlimited: {}
#################################################################
# application image
repository: nexus3.onap.org:10001
-image: onap/multicloud/openstack-ocata:1.2.2
+image: onap/multicloud/openstack-ocata:1.3.0-SNAPSHOT
pullPolicy: Always
#Istio sidecar injection policy
#################################################################
# application image
repository: nexus3.onap.org:10001
-image: onap/multicloud/openstack-pike:1.2.2
+image: onap/multicloud/openstack-pike:1.3.0-SNAPSHOT
pullPolicy: Always
#Istio sidecar injection policy
#################################################################
# application image
repository: nexus3.onap.org:10001
-image: onap/multicloud/openstack-windriver:1.2.2
+image: onap/multicloud/openstack-windriver:1.3.0-SNAPSHOT
pullPolicy: Always
#Istio sidecar injection policy
- name: SO_HEADER_AUTHORIZATION
value: {{ .Values.so_authorization }}
{{- end }}
+ - name: DMAAP_HOST
+ value: "http://message-router.{{ include "common.namespace" . }}:3904"
- name: LOGGING_LEVEL_ORG_ONAP_NBI
value: {{ .Values.config.loglevel }}
- name: MSB_ENABLED
version: ~4.x-0
repository: '@local'
condition: sniro-emulator.enabled
+ - name: mariadb-galera
+ version: ~4.x-0
+ repository: '@local'
+ condition: mariadb-galera.enabled
- name: msb
version: ~4.x-0
repository: '@local'
enabled: false
oof:
enabled: false
+mariadb-galera:
+ enabled: false
msb:
enabled: false
multicloud:
enabled: false
sniro-emulator:
enabled: false
+mariadb-galera:
+ enabled: false
msb:
enabled: false
multicloud:
enabled: false
log:
enabled: false
+mariadb-galera:
+ enabled: true
msb:
enabled: false
multicloud:
vfc:
enabled: false
vnfsdk:
- enabled: false
\ No newline at end of file
+ enabled: false
initialDelaySeconds: 120
readiness:
initialDelaySeconds: 120
+mariadb-galera:
+ mariadb-galera-server:
+ liveness:
+ initialDelaySeconds: 120
+ readiness:
+ initialDelaySeconds: 120
+
enabled: false
oof:
enabled: false
+mariadb-galera:
+ enabled: false
msb:
enabled: false
multicloud:
POLICY_HOME=/opt/app/policy
POLICY_LOGS=/var/log/onap/policy/pdpd
-JAVA_HOME=/usr/lib/jvm/java-8-openjdk-amd64
+JAVA_HOME=/usr/lib/jvm/java-1.8-openjdk
KEYSTORE_PASSWD=Pol1cy_0nap
TRUSTSTORE_PASSWD=Pol1cy_0nap
# See the License for the specific language governing permissions and
# limitations under the License.
-JAVA_HOME=/usr/lib/jvm/java-8-openjdk-amd64
+JAVA_HOME=/usr/lib/jvm/java-1.8-openjdk
POLICY_HOME=/opt/app/policy
POLICY_LOGS=/var/log/onap
KEYSTORE_PASSWD=Pol1cy_0nap
http.userId={{ .Values.config.httpUserId }}
http.password={{ .Values.config.httpPassword }}
-aai.searchNodeQuery=/aai/v13/search/nodes-query?search-node-type=service-instance&filter=service-instance-id:EQUALS:
+aai.searchNodeQuery=/aai/v13/nodes/service-instance/{0}
#Servlet context parameters
server.context_parameters.p-name=value #context parameter with p-name as key and value as value.
+++ /dev/null
-#!/bin/sh
-
-# Get the list of topic from curl ressult
-dmaap_mr_host=message-router
-dmaap_mr_port=3904
-temp_output_file=".tmpoutput"
-curl -X GET http://$dmaap_mr_host:$dmaap_mr_port/topics > $temp_output_file
-
-# Test topic POA-AUDIT-INIT, POA-AUDIT-RESULT, POA-RULE-VALIDATION
-TOPICS="POA-AUDIT-INIT POA-RULE-VALIDATION POA-AUDIT-RESULT"
-for i_topic in $TOPICS
-do
- echo "Looping ... topic: $i_topic"
- if grep -iFq "$i_topic" $temp_output_file
- then
- # code if found
- echo "$i_topic found."
- else
- # code if not found
- echo "$i_topic NOT found."
- curl -X POST -H "content-type: application/json" --data '{"event":"create topic"}' http://$dmaap_mr_host:$dmaap_mr_port/events/$i_topic
- fi
-done
-
-# remove the temp file
-rm -f $temp_output_file
---
apiVersion: v1
kind: ConfigMap
-metadata:
- name: {{ include "common.fullname" . }}-pre-start-configmap
- namespace: {{ include "common.namespace" . }}
-data:
-{{ tpl (.Files.Glob "resources/bin/*").AsConfig . | indent 2 }}
----
-apiVersion: v1
-kind: ConfigMap
metadata:
name: {{ include "common.fullname" . }}-log
namespace: {{ include "common.namespace" . }}
data:
-{{ tpl (.Files.Glob "resources/config/logback.xml").AsConfig . | indent 2 }}
\ No newline at end of file
+{{ tpl (.Files.Glob "resources/config/logback.xml").AsConfig . | indent 2 }}
- mountPath: /opt/app/config/builders
name: {{ include "common.fullname" . }}-config-builders
readOnly: true
- - mountPath: /opt/app/bin/pre_start.sh
- name: {{ include "common.fullname" . }}-pre-start
- subPath: pre_start.sh
- readOnly: false
- name: {{ include "common.fullname" . }}-logs
mountPath: /opt/app/logs
readOnly: false
affinity:
{{- toYaml .Values.affinity | indent 10 }}
{{- end }}
+
+ # Filebeat sidecar container
+ - name: {{ include "common.name" . }}-filebeat-onap
+ image: "{{ .Values.global.loggingRepository }}/{{ .Values.global.loggingImage }}"
+ imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+ volumeMounts:
+ - name: {{ include "common.fullname" . }}-filebeat-conf
+ mountPath: /usr/share/filebeat/filebeat.yml
+ subPath: filebeat.yml
+ - name: {{ include "common.fullname" . }}-data-filebeat
+ mountPath: /usr/share/filebeat/data
+ - name: {{ include "common.fullname" . }}-logs
+ mountPath: /opt/app/logs
+
volumes:
- name: localtime
hostPath:
- name: {{ include "common.fullname" . }}-config-builders
configMap:
name: {{ include "common.fullname" . }}-configmap-builders
- - name: {{ include "common.fullname" . }}-pre-start
+ - name: {{ include "common.fullname" . }}-filebeat-conf
configMap:
- name: {{ include "common.fullname" . }}-pre-start-configmap
- defaultMode: 0777
+ name: {{ .Release.Name }}-pomba-filebeat-configmap
+ - name: {{ include "common.fullname" . }}-data-filebeat
+ emptyDir: {}
- name: {{ include "common.fullname" . }}-logs
emptyDir: {}
- name: {{ include "common.fullname" . }}-log-conf
port: {{ .Values.service.internalPort }}
initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }}
periodSeconds: {{ .Values.readiness.periodSeconds }}
+
+ # Filebeat sidecar container
+ - name: {{ include "common.name" . }}-filebeat-onap
+ image: "{{ .Values.global.loggingRepository }}/{{ .Values.global.loggingImage }}"
+ imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+ volumeMounts:
+ - name: {{ include "common.fullname" . }}-filebeat-conf
+ mountPath: /usr/share/filebeat/filebeat.yml
+ subPath: filebeat.yml
+ - name: {{ include "common.fullname" . }}-data-filebeat
+ mountPath: /usr/share/filebeat/data
+ - name: {{ include "common.fullname" . }}-logs
+ mountPath: /opt/app/logs
+
volumes:
- name: localtime
hostPath:
path: data-router.properties
- key: schemaIngest.properties
path: schemaIngest.properties
+ - name: {{ include "common.fullname" . }}-filebeat-conf
+ configMap:
+ name: {{ .Release.Name }}-pomba-filebeat-configmap
+ - name: {{ include "common.fullname" . }}-data-filebeat
+ emptyDir: {}
- name: {{ include "common.fullname" . }}-dynamic-route
configMap:
name: {{ include "common.fullname" . }}-dynamic
{{ toYaml .Values.affinity | indent 10 }}
{{- end }}
+ # Filebeat sidecar container
+ - name: {{ include "common.name" . }}-filebeat-onap
+ image: "{{ .Values.global.loggingRepository }}/{{ .Values.global.loggingImage }}"
+ imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+ volumeMounts:
+ - name: {{ include "common.fullname" . }}-filebeat-conf
+ mountPath: /usr/share/filebeat/filebeat.yml
+ subPath: filebeat.yml
+ - name: {{ include "common.fullname" . }}-data-filebeat
+ mountPath: /usr/share/filebeat/data
+ - name: {{ include "common.fullname" . }}-logs
+ mountPath: /opt/app/logs
+
volumes:
- name: localtime
hostPath:
- name: {{ include "common.fullname" . }}-log-conf
configMap:
name: {{ include "common.fullname" . }}-log
+ - name: {{ include "common.fullname" . }}-filebeat-conf
+ configMap:
+ name: {{ .Release.Name }}-pomba-filebeat-configmap
+ - name: {{ include "common.fullname" . }}-data-filebeat
+ emptyDir: {}
- name: {{ include "common.fullname" . }}-logs-eelf
emptyDir: {}
imagePullSecrets:
aai.http.userId={{ .Values.config.aaiHttpUserId }}
aai.http.password={{ .Values.config.aaiHttpPassword }}
-aai.searchNodeQuery=/aai/v13/search/nodes-query?search-node-type=service-instance&filter=service-instance-id:EQUALS:
-aai.customerQuery=/aai/v13/business/customers/customer/
-aai.serviceInstancePath=/aai/v13/business/customers/customer/{0}/service-subscriptions/service-subscription/{1}/service-instances/service-instance/{2}
+aai.serviceInstanceQuery=/aai/v13/nodes/service-instance/{0}
# SDNC REST Client Configuration
sdnc.serviceName={{ .Values.config.sdncServiceName }}.{{.Release.Namespace}}
-<configuration>\r
- <property name="p_tim" value="%d{"yyyy-MM-dd'T'HH:mm:ss.SSSXXX", UTC}"/>\r
- <property name="p_lvl" value="%level"/>\r
- <property name="p_log" value="%logger"/>\r
- <property name="p_mdc" value="%replace(%replace(%mdc){'\t','\\\\t'}){'\n', '\\\\n'}"/>\r
- <property name="p_msg" value="%replace(%replace(%msg){'\t', '\\\\t'}){'\n','\\\\n'}"/>\r
- <property name="p_exc" value="%replace(%replace(%rootException){'\t', '\\\\t'}){'\n','\\\\n'}"/>\r
- <!-- tabs -->\r
- <property name="p_mak" value="%replace(%replace(%marker){'\t', '\\\\t'}){'\n','\\\\n'}"/>\r
- <property name="p_thr" value="%thread"/>\r
- <property name="pattern" value="%nopexception${p_tim}\t${p_thr}\t${p_lvl}\t${p_log}\t${p_mdc}\t${p_msg}\t${p_exc}\t${p_mak}\t%n"/>\r
- <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">\r
- <encoder>\r
- <pattern>${pattern}</pattern>\r
- </encoder>\r
- </appender>\r
- <appender name="FILE" class="ch.qos.logback.core.FileAppender">\r
- <file>output.log</file>\r
- <encoder>\r
- <pattern>${pattern}</pattern>\r
- </encoder>\r
- </appender>\r
- <logger level="INFO" name="org.onap.logging.ref.slf4j" additivity="false">\r
- <appender-ref ref="STDOUT" />\r
- <appender-ref ref="FILE" />\r
- </logger>\r
- <root level="INFO">\r
- <appender-ref ref="STDOUT" />\r
- </root>\r
-</configuration>\r
+<configuration>
+ <property name="p_tim" value="%d{"yyyy-MM-dd'T'HH:mm:ss.SSSXXX", UTC}"/>
+ <property name="p_lvl" value="%level"/>
+ <property name="p_log" value="%logger"/>
+ <property name="p_mdc" value="%replace(%replace(%mdc){'\t','\\\\t'}){'\n', '\\\\n'}"/>
+ <property name="p_msg" value="%replace(%replace(%msg){'\t', '\\\\t'}){'\n','\\\\n'}"/>
+ <property name="p_exc" value="%replace(%replace(%rootException){'\t', '\\\\t'}){'\n','\\\\n'}"/>
+ <!-- tabs -->
+ <property name="p_mak" value="%replace(%replace(%marker){'\t', '\\\\t'}){'\n','\\\\n'}"/>
+ <property name="p_thr" value="%thread"/>
+ <property name="pattern" value="%nopexception${p_tim}\t${p_thr}\t${p_lvl}\t${p_log}\t${p_mdc}\t${p_msg}\t${p_exc}\t${p_mak}\t%n"/>
+ <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
+ <encoder>
+ <pattern>${pattern}</pattern>
+ </encoder>
+ </appender>
+ <appender name="FILE" class="ch.qos.logback.core.FileAppender">
+ <file>logs/EELF/output.log</file>
+ <encoder>
+ <pattern>${pattern}</pattern>
+ </encoder>
+ </appender>
+ <logger level="INFO" name="org.onap.logging.ref.slf4j" additivity="false">
+ <appender-ref ref="STDOUT" />
+ <appender-ref ref="FILE" />
+ </logger>
+ <root level="INFO">
+ <appender-ref ref="STDOUT" />
+ <appender-ref ref="FILE" />
+ </root>
+</configuration>
\ No newline at end of file
{{ toYaml .Values.affinity | indent 10 }}
{{- end }}
+ # Filebeat sidecar container
+ - name: {{ include "common.name" . }}-filebeat-onap
+ image: "{{ .Values.global.loggingRepository }}/{{ .Values.global.loggingImage }}"
+ imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+ volumeMounts:
+ - name: {{ include "common.fullname" . }}-filebeat-conf
+ mountPath: /usr/share/filebeat/filebeat.yml
+ subPath: filebeat.yml
+ - name: {{ include "common.fullname" . }}-data-filebeat
+ mountPath: /usr/share/filebeat/data
+ - name: {{ include "common.fullname" . }}-logs
+ mountPath: /opt/app/logs
+
volumes:
- name: localtime
hostPath:
path: /etc/localtime
+ - name: {{ include "common.fullname" . }}-filebeat-conf
+ configMap:
+ name: {{ .Release.Name }}-pomba-filebeat-configmap
+ - name: {{ include "common.fullname" . }}-data-filebeat
+ emptyDir: {}
- name: root-config-app-prop
configMap:
name: {{ include "common.fullname" . }}-root-config
defaultMode: 0644
+ - name: {{ include "common.fullname" . }}-logs
+ emptyDir: {}
- name: properties
configMap:
name: {{ include "common.fullname" . }}-config-properties
- input_type: log
#This is the canolical path as mentioned in logback.xml, *.* means it will monitor all files in the directory.
paths:
+ - /opt/app/logs/EELF/*/*.log
+ - /opt/app/logs/EELF/*.log
- /var/log/onap/*/*/*/*.log
- /var/log/onap/*/*/*.log
- /var/log/onap/*/*.log
+ - /var/log/onap/*.log
+ - /logs/*/*.log
+ - /logs/*.log
+
#Files older than this should be ignored.In our case it will be 48 hours i.e. 2 days. It is a helping flag for clean_inactive
ignore_older: 48h
# Remove the registry entry for a file that is more than the specified time. In our case it will be 96 hours, i.e. 4 days. It will help to keep registry records with in limit
-- vid
update fn_app set app_username='Default', app_password='2VxipM8Z3SETg32m3Gp0FvKS6zZ2uCbCw46WDyK6T5E=', ueb_key='2Re7Pvdkgw5aeAUD', auth_central = 'Y' , auth_namespace = 'org.onap.vid' where app_id = 6;
-- aai sparky
-update fn_app set app_username='aaiui', app_password='4LK69amiIFtuzcl6Gsv97Tt7MLhzo03aoOx7dTvdjKQ=', ueb_key='ueb_key' where app_id = 7;
\ No newline at end of file
+update fn_app set app_username='aaiui', app_password='4LK69amiIFtuzcl6Gsv97Tt7MLhzo03aoOx7dTvdjKQ=', ueb_key='ueb_key_7' where app_id = 7;
\ No newline at end of file
GLOBAL_APPC_USERNAME = "{{ .Values.appcUsername }}"
GLOBAL_APPC_PASSWORD = "{{ .Values.appcPassword }}"
GLOBAL_APPC_CDT_SERVER_PROTOCOL = "http"
-GLOBAL_APPC_CDT_SERVER_PORT = "80"
+GLOBAL_APPC_CDT_SERVER_PORT = "18080"
GLOBAL_APPC_CDT_USERNAME = "demo"
# sdc info - everything is from the private oam network (also called onap private network)
GLOBAL_ASDC_SERVER_PROTOCOL = "http"
release: {{ .Release.Name }}
spec:
initContainers:
+ {{- if .Values.initJob.enabled }}
- name: {{ include "common.name" . }}-job-completion
image: "{{ .Values.global.readinessRepository }}/{{ .Values.global.readinessImage }}"
imagePullPolicy: "{{ .Values.global.pullPolicy | default .Values.pullPolicy }}"
fieldRef:
apiVersion: v1
fieldPath: metadata.namespace
+ {{ end }}
containers:
- name: {{ include "common.name" . }}
image: "{{ include "common.repository" . }}/{{ .Values.image }}"
# See the License for the specific language governing permissions and
# limitations under the License.
+{{ if .Values.initJob.enabled }}
apiVersion: batch/v1
kind: Job
metadata:
secretKeyRef: {name: {{ .Release.Name }}-sdc-cs-secrets, key: sdc_password}
imagePullSecrets:
- name: "{{ include "common.namespace" . }}-docker-registry-key"
+{{ end }}
\ No newline at end of file
# flag to enable debugging - application support required
debugEnabled: false
+initJob:
+ enabled: true
+
config:
javaOptions: "-Xdebug -agentlib:jdwp=transport=dt_socket,address=7001,server=y,suspend=n -Xmx1536m -Xms1536m"
cassandaAuthenticationEnabled: true
path: {{ .Values.global.persistence.mountPath | default .Values.persistence.mountPath }}/{{ .Release.Name }}/{{ .Values.persistence.mountSubPath }}2
{{ end }}
{{- end -}}
+{{ if .Values.certpersistence.enabled }}
+---
+kind: PersistentVolume
+apiVersion: v1
+metadata:
+ name: {{ include "common.fullname" . }}-pv-certs
+ namespace: {{ include "common.namespace" . }}
+ labels:
+ app: {{ include "common.name" . }}-pv-certs
+ chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
+ release: "{{ .Release.Name }}"
+ heritage: "{{ .Release.Service }}"
+ name: {{ include "common.fullname" . }}-certs
+spec:
+ capacity:
+ storage: {{ .Values.certpersistence.size }}
+ accessModes:
+ - {{ .Values.certpersistence.accessMode }}
+{{- if .Values.certpersistence.storageClass }}
+{{- if (eq "-" .Values.certpersistence.storageClass) }}
+ storageClassName: ""
+{{- else }}
+ storageClassName: "{{ .Values.certpersistence.storageClass }}"
+{{- end }}
+{{- end }}
+ persistentVolumeReclaimPolicy: {{ .Values.certpersistence.volumeReclaimPolicy }}
+ hostPath:
+ path: {{ .Values.global.persistence.mountPath | default .Values.certpersistence.mountPath }}/{{ .Values.certpersistence.mountSubPath }}
+{{ end }}
+
+
+
--- /dev/null
+{{- if and .Values.certpersistence.enabled (not .Values.certpersistence.existingClaim) -}}
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+ name: {{ include "common.fullname" .}}-pvc-certs
+ namespace: {{ include "common.namespace" . }}
+ labels:
+ app: {{ include "common.name" . }}-pvc-certs
+ chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+ release: "{{ .Release.Name }}"
+ heritage: "{{ .Release.Service }}"
+{{- if .Values.certpersistence.annotations }}
+ annotations:
+{{ toYaml .Values.certpersistence.annotations | indent 4 }}
+{{- end }}
+spec:
+ selector:
+ matchLabels:
+ app: {{ include "common.name" . }}-pv-certs
+ accessModes:
+ - {{ .Values.certpersistence.accessMode }}
+ resources:
+ requests:
+ storage: {{ .Values.certpersistence.size }}
+{{- if .Values.certpersistence.storageClass }}
+{{- if (eq "-" .Values.certpersistence.storageClass) }}
+ storageClassName: ""
+{{- else }}
+ storageClassName: "{{ .Values.certpersistence.storageClass }}"
+{{- end }}
+{{- end }}
+{{- end -}}
\ No newline at end of file
name: {{ include "common.fullname" . }}-mdsal
- mountPath: /var/log/onap
name: logs
+ - mountPath: {{ .Values.certpersistence.certPath }}
+ name: {{ include "common.fullname" . }}-certs
resources:
{{ include "common.resources" . | indent 12 }}
{{- if .Values.nodeSelector }}
configMap:
name: {{ include "common.fullname" . }}-properties
defaultMode: 0644
+ - name: {{ include "common.fullname" . }}-certs
+ {{ if .Values.certpersistence.enabled }}
+ persistentVolumeClaim:
+ claimName: {{ include "common.fullname" . }}-pvc-certs
+ {{ else }}
+ emptyDir: {}
+ {{ end }}
{{ if not .Values.persistence.enabled }}
- name: {{ include "common.fullname" . }}-mdsal
emptyDir: {}
selector:
matchLabels:
name: {{ include "common.fullname" . }}
- {{ end }}
+ {{ end }}
\ No newline at end of file
mountSubPath: sdnc/mdsal
mdsalPath: /opt/opendaylight/current/daexim
+certpersistence:
+ enabled: true
+
+ ## A manually managed Persistent Volume and Claim
+ ## Requires persistence.enabled: true
+ ## If defined, PVC must be created manually before volume will be bound
+ # existingClaim:
+
+ volumeReclaimPolicy: Retain
+ accessMode: ReadWriteOnce
+ size: 50Mi
+ mountPath: /dockerdata-nfs
+ mountSubPath: sdnc/certs
+ certPath: /opt/opendaylight/current/certs
+ ##storageClass: "manual"
+
ingress:
enabled: false
# See the License for the specific language governing permissions and
# limitations under the License.
aai:
- auth: 65885E7C4E860E420808030D8BC653073E6782CB5026EC8F49E3E5C6F3E27F6A
+ auth: 221187EFA3AD4E33600DE0488F287099934CE65C3D0697BCECC00BB58E784E07CD74A24581DC31DBC086FF63DF116378776E9BE3D1325885
dme2:
timeout: '30000'
endpoint: https://aai.{{ include "common.namespace" . }}:8443
workflowAaiDistributionDelay: PT30S
pnfEntryNotificationTimeout: P14D
+cds:
+ endpoint: blueprints-processor
+ port: 9111
+ auth: Basic Y2NzZGthcHBzOmNjc2RrYXBwcw==
camunda:
bpm:
admin-user:
endpoint: http://so-request-db-adapter.{{ include "common.namespace" . }}:8083/services/RequestsDbAdapter
po:
auth: A3745B5DBE165EFCF101D85A6FC81C211AB8BF604F8861B6C413D5DC90F8F30E0139DE44B8A342F4EF70AF
- password: 8B52F17C0E46591D4D1A5206825231FC9276B8382A7941A1E6659D31F1994B22B46356B8DB86
sdnc:
endpoint: http://so-sdnc-adapter.{{ include "common.namespace" . }}:8086/adapters/SDNCAdapter
rest:
#################################################################
# application image
repository: nexus3.onap.org:10001
-image: mariadb:10.1.11
+image: mariadb:10.1.38
pullPolicy: Always
ubuntuInitImage: oomk8s/ubuntu-init:2.0.0
retrycount: 5
retryinterval: -15
retrylist: 408,429,500,502,503,504,900
+ encryptionKey: 07a7159d3bf51a0e53be7a8f89699be7
tenant:
default_keystone_url_version: /v2.0
default_keystone_reg_ex: "/[vV][0-9]"
username: ${DB_USERNAME}
password: ${DB_PASSWORD}
driver-class-name: org.mariadb.jdbc.Driver
- dbcp2:
- initial-size: 5
- max-total: 20
- validation-query: select 1
- test-on-borrow: true
mso:
msoKey: 07a7159d3bf51a0e53be7a8f89699be7
logPath: ./logs/sdc
changedelete: POST|270000|sdncurl6|sdnc-request-header|org:onap:sdnctl:vnf
delete: POST|270000|sdncurl6|sdnc-request-header|org:onap:sdnctl:vnf
rollback: POST|270000|sdncurl6|sdnc-request-header|org:onap:sdnctl:vnf
- bpelauth: 5941FFEAA9F9E227EC924269B99503FB509A98271C7D2433C0D5B6E507307E1C1DC54BA69CCBD06C6F6D4DE81B4F416E
+ bpelauth: 4C18603C5AE7E3A42A6CED95CDF9C0BA9B2109B3725747662E5D34E5FDF63DA9ADEBB08185098F14699195FDE9475100
bpelurl: http://so-bpmn-infra.{{ include "common.namespace" . }}:8081/mso/SDNCAdapterCallbackService
- gammainternet:
- '':
- query: GET|60000|sdncurl4|sdnc-request-header|com:att:sdnctl:firewallapi
- service-configuration-operation:
- activate: POST|90000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api
- changeactivate: POST|60000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api
- changedelete: POST|250000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api
- changereserve: POST|60000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api
- delete: POST|250000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api
- reserve: POST|60000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api
- turnup: POST|60000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api
- svc-topology-operation:
- assign: POST|60000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api
- delete: POST|250000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api
generic-resource:
network-topology-operation:
create: POST|270000|sdncurl10|sdnc-request-header|org:onap:sdnc:northbound:generic-resource
myurl: http://so-sdnc-adapter{{ include "common.namespace" . }}:8086/adapters/rest/SDNCNotify
rest:
bpelurl: http://so-bpmn-infra.{{ include "common.namespace" . }}:8081/mso/WorkflowMessage
- sdncauth: E2FF8D1140A1502DD3DC244825F1608ED0EA8F1B107E9C39C036B9E6D217D0968ECF42AB8C8955120C8386147A0C04934F3066304DC21B835ADB2970BE0D9E8271EF7E35424729BA71C0DAA871
+ sdncauth: ED07A7EE5F099FA53369C3DF2240AD68A00154676EEDBC6F8C16BAA83B1912941B8941ABD48683D2C1072DA7040659692DE936A59BBF42A038CF71DE67B4A375190071EC76EA657801B033C135
sdncconnecttime: 5000
sdncurl10: 'http://sdnc.{{ include "common.namespace" . }}:8282/restconf/operations/GENERIC-RESOURCE-API:'
sdncurl11: 'http://sdnc.{{ include "common.namespace" . }}:8282/restconf/operations/VNFTOPOLOGYAIC-API:'
vfmodule:
'':
query: GET|60000|sdncurl12|
+ network:
+ encryptionKey: 07a7159d3bf51a0e53be7a8f89699be7
spring:
security:
usercredentials:
url: jdbc:mariadb://${DB_HOST}:${DB_PORT}/requestdb
username: ${DB_USERNAME}
password: ${DB_PASSWORD}
- dbcp2:
- initial-size: 5
- max-total: 20
- validation-query: select 1
- test-on-borrow: true
security:
usercredentials:
- username: bpel
count: 3
aai:
endpoint: https://aai.{{ include "common.namespace" . }}:8443
- auth: 2CCB5208FA9CAA5B3039190D4846DD9E1B66F2F7442AE64EACBD3DA5249B8671F64BFC
+ auth: 6E081E10B1CA43A843E303733A74D9B23B601A6E22A21C7EF2C7F15A42F81A1A4E85E65268C2661F71321052C7F3E55B96A8E1E951F8BF6F
so:
operational-environment:
dmaap:
username: testuser
password: VjR5NDcxSzA=
host: http://dmaap-bc.{{ include "common.namespace" . }}:8080
+ auth: 51EA5414022D7BE536E7516C4D1A6361416921849B72C0D6FC1C7F262FD9F2BBC2AD124190A332D9845A188AD80955567A4F975C84C221EEA8243BFD92FFE6896CDD1EA16ADD34E1E3D47D4A
publisher:
topic: com.att.ecomp.mso.operationalEnvironmentEvent
spring:
username: ${DB_USERNAME}
password: ${DB_PASSWORD}
driver-class-name: org.mariadb.jdbc.Driver
- dbcp2:
- initial-size: 5
- max-total: 20
- validation-query: select 1
- test-on-borrow: true
+org:
+ onap:
+ so:
+ cloud-owner: onap
+ adapters:
+ network:
+ encryptionKey: 07a7159d3bf51a0e53be7a8f89699be7
# application image
repository: nexus3.onap.org:10001
-image: onap/vid:3.2.2
+image: onap/vid:4.0-STAGING-latest
pullPolicy: Always
# mariadb image for initializing
Code Review / oom.git / commitdiff