</root>
<!-- LOG "com.baeldung*" at TRACE level -->
- <logger name="org.onap.aaf.fproxy" level="trace" additivity="false">
- <appender-ref ref="RollingFile" />
- <appender-ref ref="Console" />
- </logger>
+ <logger name="org.onap.aaf.fproxy" level="info" />
</configuration>
\ No newline at end of file
</appender>
<!-- LOG everything at INFO level -->
- <root level="debug">
+ <root level="info">
<appender-ref ref="RollingFile" />
<appender-ref ref="Console" />
</root>
<!-- LOG "com.baeldung*" at TRACE level -->
- <logger name="org.onap.aaf.rproxy" level="trace" additivity="false">
- <appender-ref ref="RollingFile" />
- <appender-ref ref="Console" />
- </logger>
+ <logger name="org.onap.aaf.rproxy" level="info" />
</configuration>
</root>
<!-- LOG "com.baeldung*" at TRACE level -->
- <logger name="org.onap.aaf.fproxy" level="trace" additivity="false">
- <appender-ref ref="RollingFile" />
- <appender-ref ref="Console" />
- </logger>
-
+ <logger name="org.onap.aaf.fproxy" level="info" />
+
</configuration>
\ No newline at end of file
</appender>
<!-- LOG everything at INFO level -->
- <root level="debug">
+ <root level="info">
<appender-ref ref="RollingFile" />
<appender-ref ref="Console" />
</root>
<!-- LOG "com.baeldung*" at TRACE level -->
- <logger name="org.onap.aaf.rproxy" level="trace" additivity="false">
- <appender-ref ref="RollingFile" />
- <appender-ref ref="Console" />
- </logger>
+ <logger name="org.onap.aaf.rproxy" level="info" />
</configuration>
\ No newline at end of file
--- /dev/null
+#!/bin/sh
+
+/usr/share/elasticsearch/plugins/search-guard-6/tools/sgadmin.sh \
+ -cd /usr/share/elasticsearch/config/sg \
+ -ks /usr/share/elasticsearch/config/sg/auth/{{ .Values.config.adminKeyStore }} \
+ -ts /usr/share/elasticsearch/config/sg/auth/{{ .Values.config.trustStore }} \
+ -kspass {{ .Values.config.adminKeyStorePassword }} \
+ -tspass {{ .Values.config.trustStorePassword}} \
+ -nhnv \
+ -icl \
+ -p {{ .Values.service.internalPort2 }}
\ No newline at end of file
--- /dev/null
+#!/bin/sh
+
+# Wait for ES to start then initialize SearchGuard
+/usr/local/bin/docker-entrypoint.sh eswrapper &
+/usr/share/elasticsearch/bin/wait_until_started.sh
+/usr/share/elasticsearch/bin/init_sg.sh
+
+wait
\ No newline at end of file
--- /dev/null
+#!/bin/sh
+RET=1
+
+while [[ RET -ne 0 ]]; do
+ echo "Waiting for Elasticsearch to become ready before running sgadmin..."
+ curl -XGET -k "https://localhost:{{ .Values.service.internalPort }}/" >/dev/null 2>&1
+ RET=$?
+ sleep 5
+done
\ No newline at end of file
# Set a custom port for the node to node communication (9300 by default):
-transport.tcp.port: {{ .Values.config.tcpPort }}
+transport.tcp.port: {{ .Values.service.internalPort2 }}
# Enable compression for all communication between nodes (disabled by default):
transport.tcp.compress: false
### SEARCH GUARD SSL #
### Configuration #
###############################################################################################
-## Uncomment all lines below prefixed with #X# (globally remove #X#) for searchguard
-##
-###############################################################################################
-### Transport layer SSL #
-### #
-###############################################################################################
-### Enable or disable node-to-node ssl encryption (default: true)
-#X#searchguard.ssl.transport.enable_openssl_if_available: true
-#X#searchguard.ssl.transport.enabled: true
-### JKS or PKCS12 (default: JKS)
-#X#searchguard.ssl.transport.keystore_type: JKS
-### Relative path to the keystore file (mandatory, this stores the server certificates), must be placed under the config/ dir
-#X#searchguard.ssl.transport.keystore_filepath: /some/path
-### Alias name (default: first alias which could be found)
-###searchguard.ssl.transport.keystore_alias: localhost
-### Keystore password (default: changeit)
-#X#searchguard.ssl.transport.keystore_password: changeit
-##
-### JKS or PKCS12 (default: JKS)
-#X#searchguard.ssl.transport.truststore_type: JKS
-### Relative path to the truststore file (mandatory, this stores the client/root certificates), must be placed under the config/ dir
-#X#searchguard.ssl.transport.truststore_filepath: truststore.jks
-### Alias name (default: first alias which could be found)
-###searchguard.ssl.transport.truststore_alias: my_alias
-### Truststore password (default: changeit)
-#X#searchguard.ssl.transport.truststore_password: changeit
-### Enforce hostname verification (default: true)
-###searchguard.ssl.transport.enforce_hostname_verification: true
-### If hostname verification specify if hostname should be resolved (default: true)
-###searchguard.ssl.transport.resolve_hostname: true
-### Use native Open SSL instead of JDK SSL if available (default: true)
-###searchguard.ssl.transport.enable_openssl_if_available: false
-##
-###############################################################################################
-### HTTP/REST layer SSL #
-### #
-###############################################################################################
-### Enable or disable rest layer security - https, (default: false)
-#X#searchguard.ssl.http.enable_openssl_if_available: true
-#X#searchguard.ssl.http.enabled: true
-### JKS or PKCS12 (default: JKS)
-#X#searchguard.ssl.http.keystore_type: JKS
-### Relative path to the keystore file (this stores the server certificates), must be placed under the config/ dir
-#X#searchguard.ssl.http.keystore_filepath: /keystore/path
-### Alias name (default: first alias which could be found)
-###searchguard.ssl.http.keystore_alias: my_alias
-### Keystore password (default: changeit)
-#X#searchguard.ssl.http.keystore_password: changeit
-### Do the clients (typically the browser or the proxy) have to authenticate themself to the http server, default is OPTIONAL
-### To enforce authentication use REQUIRE, to completely disable client certificates use NONE
-###searchguard.ssl.http.clientauth_mode: REQUIRE
-### JKS or PKCS12 (default: JKS)
-#X#searchguard.ssl.http.truststore_type: JKS
-### Relative path to the truststore file (this stores the client certificates), must be placed under the config/ dir
-#X#searchguard.ssl.http.truststore_filepath: truststore.jks
-### Alias name (default: first alias which could be found)
-###searchguard.ssl.http.truststore_alias: my_alias
-### Truststore password (default: changeit)
-#X#searchguard.ssl.http.truststore_password: changeit
-### Use native Open SSL instead of JDK SSL if available (default: true)
-###searchguard.ssl.http.enable_openssl_if_available: false
-
-#####################################################
-##### Security manager - Searchguard Configuration
-#####################################################
-#X#security.manager.enabled: false
-#X#searchguard.authcz.admin_dn:
-
-#####################################################
-##### X-Pack Configuration
-#####################################################
+######## Start Search Guard Demo Configuration ########
+
+searchguard.enterprise_modules_enabled: false
+
+searchguard.ssl.transport.keystore_filepath: sg/auth/{{ .Values.config.nodeKeyStore }}
+searchguard.ssl.transport.keystore_password: {{ .Values.config.nodeKeyStorePassword }}
+searchguard.ssl.transport.truststore_filepath: sg/auth/{{ .Values.config.trustStore }}
+searchguard.ssl.transport.truststore_password: {{ .Values.config.trustStorePassword }}
+searchguard.ssl.transport.enforce_hostname_verification: false
+
+searchguard.ssl.http.enabled: true
+searchguard.ssl.http.keystore_filepath: sg/auth/{{ .Values.config.nodeKeyStore }}
+searchguard.ssl.http.keystore_password: {{ .Values.config.nodeKeyStorePassword }}
+searchguard.ssl.http.truststore_filepath: sg/auth/{{ .Values.config.trustStore }}
+searchguard.ssl.http.truststore_password: {{ .Values.config.trustStorePassword }}
+
+searchguard.nodes_dn:
+ - CN=esaai
+
+searchguard.authcz.admin_dn:
+ - CN=sgadmin
+
+# x-pack security conflicts with searchguard
xpack.security.enabled: false
xpack.ml.enabled: false
xpack.monitoring.enabled: false
--- /dev/null
+UNLIMITED:
+ readonly: true
+ permissions:
+ - "*"
+
+###### INDEX LEVEL ######
+
+INDICES_ALL:
+ readonly: true
+ permissions:
+ - "indices:*"
+
+# for backward compatibility
+ALL:
+ readonly: true
+ permissions:
+ - INDICES_ALL
+
+MANAGE:
+ readonly: true
+ permissions:
+ - "indices:monitor/*"
+ - "indices:admin/*"
+
+CREATE_INDEX:
+ readonly: true
+ permissions:
+ - "indices:admin/create"
+ - "indices:admin/mapping/put"
+
+MANAGE_ALIASES:
+ readonly: true
+ permissions:
+ - "indices:admin/aliases*"
+
+# for backward compatibility
+MONITOR:
+ readonly: true
+ permissions:
+ - INDICES_MONITOR
+
+INDICES_MONITOR:
+ readonly: true
+ permissions:
+ - "indices:monitor/*"
+
+DATA_ACCESS:
+ readonly: true
+ permissions:
+ - "indices:data/*"
+ - CRUD
+
+WRITE:
+ readonly: true
+ permissions:
+ - "indices:data/write*"
+ - "indices:admin/mapping/put"
+
+READ:
+ readonly: true
+ permissions:
+ - "indices:data/read*"
+ - "indices:admin/mappings/fields/get*"
+
+DELETE:
+ readonly: true
+ permissions:
+ - "indices:data/write/delete*"
+
+CRUD:
+ readonly: true
+ permissions:
+ - READ
+ - WRITE
+
+SEARCH:
+ readonly: true
+ permissions:
+ - "indices:data/read/search*"
+ - "indices:data/read/msearch*"
+ - SUGGEST
+
+SUGGEST:
+ readonly: true
+ permissions:
+ - "indices:data/read/suggest*"
+
+INDEX:
+ readonly: true
+ permissions:
+ - "indices:data/write/index*"
+ - "indices:data/write/update*"
+ - "indices:admin/mapping/put"
+ - "indices:data/write/bulk*"
+
+GET:
+ readonly: true
+ permissions:
+ - "indices:data/read/get*"
+ - "indices:data/read/mget*"
+
+###### CLUSTER LEVEL ######
+
+CLUSTER_ALL:
+ readonly: true
+ permissions:
+ - "cluster:*"
+
+CLUSTER_MONITOR:
+ readonly: true
+ permissions:
+ - "cluster:monitor/*"
+
+CLUSTER_COMPOSITE_OPS_RO:
+ readonly: true
+ permissions:
+ - "indices:data/read/mget"
+ - "indices:data/read/msearch"
+ - "indices:data/read/mtv"
+ - "indices:data/read/coordinate-msearch*"
+ - "indices:admin/aliases/exists*"
+ - "indices:admin/aliases/get*"
+ - "indices:data/read/scroll"
+
+CLUSTER_COMPOSITE_OPS:
+ readonly: true
+ permissions:
+ - "indices:data/write/bulk"
+ - "indices:admin/aliases*"
+ - "indices:data/write/reindex"
+ - CLUSTER_COMPOSITE_OPS_RO
+
+MANAGE_SNAPSHOTS:
+ readonly: true
+ permissions:
+ - "cluster:admin/snapshot/*"
+ - "cluster:admin/repository/*"
\ No newline at end of file
--- /dev/null
+# This is the main Search Guard configuration file where authentication
+# and authorization is defined.
+#
+# You need to configure at least one authentication domain in the authc of this file.
+# An authentication domain is responsible for extracting the user credentials from
+# the request and for validating them against an authentication backend like Active Directory for example.
+#
+# If more than one authentication domain is configured the first one which succeeds wins.
+# If all authentication domains fail then the request is unauthenticated.
+# In this case an exception is thrown and/or the HTTP status is set to 401.
+#
+# After authentication authorization (authz) will be applied. There can be zero or more authorizers which collect
+# the roles from a given backend for the authenticated user.
+#
+# Both, authc and auth can be enabled/disabled separately for REST and TRANSPORT layer. Default is true for both.
+# http_enabled: true
+# transport_enabled: true
+#
+# 5.x Migration: "enabled: true/false" will also be respected currently but only to provide backward compatibility.
+#
+# For HTTP it is possible to allow anonymous authentication. If that is the case then the HTTP authenticators try to
+# find user credentials in the HTTP request. If credentials are found then the user gets regularly authenticated.
+# If none can be found the user will be authenticated as an "anonymous" user. This user has always the username "sg_anonymous"
+# and one role named "sg_anonymous_backendrole".
+# If you enable anonymous authentication all HTTP authenticators will not challenge.
+#
+#
+# Note: If you define more than one HTTP authenticators make sure to put non-challenging authenticators like "proxy" or "clientcert"
+# first and the challenging one last.
+# Because it's not possible to challenge a client with two different authentication methods (for example
+# Kerberos and Basic) only one can have the challenge flag set to true. You can cope with this situation
+# by using pre-authentication, e.g. sending a HTTP Basic authentication header in the request.
+#
+# Default value of the challenge flag is true.
+#
+#
+# HTTP
+# basic (challenging)
+# proxy (not challenging, needs xff)
+# kerberos (challenging) NOT FREE FOR COMMERCIAL
+# clientcert (not challenging, needs https)
+# jwt (not challenging) NOT FREE FOR COMMERCIAL
+# host (not challenging) #DEPRECATED, will be removed in a future version.
+# host based authentication is configurable in sg_roles_mapping
+
+# Authc
+# internal
+# noop
+# ldap NOT FREE FOR COMMERCIAL USE
+
+# Authz
+# ldap NOT FREE FOR COMMERCIAL USE
+# noop
+
+searchguard:
+ dynamic:
+ # Set filtered_alias_mode to 'disallow' to forbid more than 2 filtered aliases per index
+ # Set filtered_alias_mode to 'warn' to allow more than 2 filtered aliases per index but warns about it (default)
+ # Set filtered_alias_mode to 'nowarn' to allow more than 2 filtered aliases per index silently
+ #filtered_alias_mode: warn
+ #kibana:
+ # Kibana multitenancy - NOT FREE FOR COMMERCIAL USE
+ # see https://github.com/floragunncom/search-guard-docs/blob/master/multitenancy.md
+ # To make this work you need to install https://github.com/floragunncom/search-guard-module-kibana-multitenancy/wiki
+ #multitenancy_enabled: true
+ #server_username: kibanaserver
+ #index: '.kibana'
+ #do_not_fail_on_forbidden: false
+ http:
+ anonymous_auth_enabled: false
+ xff:
+ enabled: false
+ internalProxies: '192\.168\.0\.10|192\.168\.0\.11' # regex pattern
+ #internalProxies: '.*' # trust all internal proxies, regex pattern
+ remoteIpHeader: 'x-forwarded-for'
+ proxiesHeader: 'x-forwarded-by'
+ #trustedProxies: '.*' # trust all external proxies, regex pattern
+ ###### see https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html for regex help
+ ###### more information about XFF https://en.wikipedia.org/wiki/X-Forwarded-For
+ ###### and here https://tools.ietf.org/html/rfc7239
+ ###### and https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Remote_IP_Valve
+ authc:
+ kerberos_auth_domain:
+ http_enabled: false
+ transport_enabled: false
+ order: 6
+ http_authenticator:
+ type: kerberos # NOT FREE FOR COMMERCIAL USE
+ challenge: true
+ config:
+ # If true a lot of kerberos/security related debugging output will be logged to standard out
+ krb_debug: false
+ # If true then the realm will be stripped from the user name
+ strip_realm_from_principal: true
+ authentication_backend:
+ type: noop
+ basic_internal_auth_domain:
+ http_enabled: true
+ transport_enabled: true
+ order: 2
+ http_authenticator:
+ type: basic
+ challenge: true
+ authentication_backend:
+ type: intern
+ proxy_auth_domain:
+ http_enabled: false
+ transport_enabled: false
+ order: 3
+ http_authenticator:
+ type: proxy
+ challenge: false
+ config:
+ user_header: "x-proxy-user"
+ roles_header: "x-proxy-roles"
+ authentication_backend:
+ type: noop
+ jwt_auth_domain:
+ http_enabled: false
+ transport_enabled: false
+ order: 0
+ http_authenticator:
+ type: jwt
+ challenge: false
+ config:
+ signing_key: "base64 encoded HMAC key or public RSA/ECDSA pem key"
+ jwt_header: "Authorization"
+ jwt_url_parameter: null
+ roles_key: null
+ subject_key: null
+ authentication_backend:
+ type: noop
+ clientcert_auth_domain:
+ http_enabled: true
+ transport_enabled: true
+ order: 1
+ http_authenticator:
+ type: clientcert
+ config:
+ username_attribute: cn #optional, if omitted DN becomes username
+ challenge: false
+ authentication_backend:
+ type: noop
+ ldap:
+ http_enabled: false
+ transport_enabled: false
+ order: 5
+ http_authenticator:
+ type: basic
+ challenge: false
+ authentication_backend:
+ # LDAP authentication backend (authenticate users against a LDAP or Active Directory)
+ type: ldap # NOT FREE FOR COMMERCIAL USE
+ config:
+ # enable ldaps
+ enable_ssl: false
+ # enable start tls, enable_ssl should be false
+ enable_start_tls: false
+ # send client certificate
+ enable_ssl_client_auth: false
+ # verify ldap hostname
+ verify_hostnames: true
+ hosts:
+ - localhost:8389
+ bind_dn: null
+ password: null
+ userbase: 'ou=people,dc=example,dc=com'
+ # Filter to search for users (currently in the whole subtree beneath userbase)
+ # {0} is substituted with the username
+ usersearch: '(sAMAccountName={0})'
+ # Use this attribute from the user as username (if not set then DN is used)
+ username_attribute: null
+ authz:
+ roles_from_myldap:
+ http_enabled: false
+ transport_enabled: false
+ authorization_backend:
+ # LDAP authorization backend (gather roles from a LDAP or Active Directory, you have to configure the above LDAP authentication backend settings too)
+ type: ldap # NOT FREE FOR COMMERCIAL USE
+ config:
+ # enable ldaps
+ enable_ssl: false
+ # enable start tls, enable_ssl should be false
+ enable_start_tls: false
+ # send client certificate
+ enable_ssl_client_auth: false
+ # verify ldap hostname
+ verify_hostnames: true
+ hosts:
+ - localhost:8389
+ bind_dn: null
+ password: null
+ rolebase: 'ou=groups,dc=example,dc=com'
+ # Filter to search for roles (currently in the whole subtree beneath rolebase)
+ # {0} is substituted with the DN of the user
+ # {1} is substituted with the username
+ # {2} is substituted with an attribute value from user's directory entry, of the authenticated user. Use userroleattribute to specify the name of the attribute
+ rolesearch: '(member={0})'
+ # Specify the name of the attribute which value should be substituted with {2} above
+ userroleattribute: null
+ # Roles as an attribute of the user entry
+ userrolename: disabled
+ #userrolename: memberOf
+ # The attribute in a role entry containing the name of that role, Default is "name".
+ # Can also be "dn" to use the full DN as rolename.
+ rolename: cn
+ # Resolve nested roles transitive (roles which are members of other roles and so on ...)
+ resolve_nested_roles: true
+ userbase: 'ou=people,dc=example,dc=com'
+ # Filter to search for users (currently in the whole subtree beneath userbase)
+ # {0} is substituted with the username
+ usersearch: '(uid={0})'
+ # Skip users matching a user name, a wildcard or a regex pattern
+ #skip_users:
+ # - 'cn=Michael Jackson,ou*people,o=TEST'
+ # - '/\S*/'
+ roles_from_another_ldap:
+ enabled: false
+ authorization_backend:
+ type: ldap # NOT FREE FOR COMMERCIAL USE
+ #config goes here ...
--- /dev/null
+# This is the internal user database
+# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh
+
+#password is: admin
+admin:
+ readonly: true
+ hash: $2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv..TOG
+ roles:
+ - admin
+ attributes:
+ #no dots allowed in attribute names
+ attribute1: value1
+ attribute2: value2
+ attribute3: value3
+
+#password is: logstash
+logstash:
+ hash: $2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2
+ roles:
+ - logstash
+
+#password is: kibanaserver
+kibanaserver:
+ readonly: true
+ hash: $2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H.
+
+#password is: kibanaro
+kibanaro:
+ hash: $2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC
+ roles:
+ - kibanauser
+ - readall
+
+#password is: readall
+readall:
+ hash: $2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2
+ #password is: readall
+ roles:
+ - readall
+
+#password is: snapshotrestore
+snapshotrestore:
+ hash: $2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W
+ roles:
+ - snapshotrestore
\ No newline at end of file
--- /dev/null
+# Allows everything, but no changes to searchguard configuration index
+sg_all_access:
+ readonly: true
+ cluster:
+ - UNLIMITED
+ indices:
+ '*':
+ '*':
+ - UNLIMITED
+ tenants:
+ admin_tenant: RW
+
+# Read all, but no write permissions
+sg_readall:
+ readonly: true
+ cluster:
+ - CLUSTER_COMPOSITE_OPS_RO
+ indices:
+ '*':
+ '*':
+ - READ
+
+# Read all and monitor, but no write permissions
+sg_readall_and_monitor:
+ cluster:
+ - CLUSTER_MONITOR
+ - CLUSTER_COMPOSITE_OPS_RO
+ indices:
+ '*':
+ '*':
+ - READ
+
+# For users which use kibana, access to indices must be granted separately
+sg_kibana_user:
+ readonly: true
+ cluster:
+ - INDICES_MONITOR
+ - CLUSTER_COMPOSITE_OPS
+ indices:
+ '?kibana':
+ '*':
+ - MANAGE
+ - INDEX
+ - READ
+ - DELETE
+ '?kibana-6':
+ '*':
+ - MANAGE
+ - INDEX
+ - READ
+ - DELETE
+ '?kibana_*':
+ '*':
+ - MANAGE
+ - INDEX
+ - READ
+ - DELETE
+ '?tasks':
+ '*':
+ - INDICES_ALL
+ '?management-beats':
+ '*':
+ - INDICES_ALL
+ '*':
+ '*':
+ - indices:data/read/field_caps*
+ - indices:data/read/xpack/rollup*
+ - indices:admin/mappings/get*
+ - indices:admin/get
+
+# For the kibana server
+sg_kibana_server:
+ readonly: true
+ cluster:
+ - CLUSTER_MONITOR
+ - CLUSTER_COMPOSITE_OPS
+ - cluster:admin/xpack/monitoring*
+ - indices:admin/template*
+ - indices:data/read/scroll*
+ indices:
+ '?kibana':
+ '*':
+ - INDICES_ALL
+ '?kibana-6':
+ '*':
+ - INDICES_ALL
+ '?kibana_*':
+ '*':
+ - INDICES_ALL
+ '?reporting*':
+ '*':
+ - INDICES_ALL
+ '?monitoring*':
+ '*':
+ - INDICES_ALL
+ '?tasks':
+ '*':
+ - INDICES_ALL
+ '?management-beats*':
+ '*':
+ - INDICES_ALL
+ '*':
+ '*':
+ - "indices:admin/aliases*"
+
+# For logstash and beats
+sg_logstash:
+ cluster:
+ - CLUSTER_MONITOR
+ - CLUSTER_COMPOSITE_OPS
+ - indices:admin/template/get
+ - indices:admin/template/put
+ indices:
+ 'logstash-*':
+ '*':
+ - CRUD
+ - CREATE_INDEX
+ '*beat*':
+ '*':
+ - CRUD
+ - CREATE_INDEX
+
+# Allows adding and modifying repositories and creating and restoring snapshots
+sg_manage_snapshots:
+ cluster:
+ - MANAGE_SNAPSHOTS
+ indices:
+ '*':
+ '*':
+ - "indices:data/write/index"
+ - "indices:admin/create"
+
+# Allows each user to access own named index
+sg_own_index:
+ cluster:
+ - CLUSTER_COMPOSITE_OPS
+ indices:
+ '${user_name}':
+ '*':
+ - INDICES_ALL
+
+### X-Pack COMPATIBILITY
+sg_xp_monitoring:
+ readonly: true
+ cluster:
+ - cluster:monitor/xpack/info
+ - cluster:monitor/main
+ - cluster:admin/xpack/monitoring/bulk
+ indices:
+ '?monitor*':
+ '*':
+ - INDICES_ALL
+
+sg_xp_alerting:
+ readonly: true
+ cluster:
+ - indices:data/read/scroll
+ - cluster:admin/xpack/watcher*
+ - cluster:monitor/xpack/watcher*
+ indices:
+ '?watches*':
+ '*':
+ - INDICES_ALL
+ '?watcher-history-*':
+ '*':
+ - INDICES_ALL
+ '?triggered_watches':
+ '*':
+ - INDICES_ALL
+ '*':
+ '*':
+ - READ
+ - indices:admin/aliases/get
+
+sg_xp_machine_learning:
+ readonly: true
+ cluster:
+ - cluster:admin/persistent*
+ - cluster:internal/xpack/ml*
+ - indices:data/read/scroll*
+ - cluster:admin/xpack/ml*
+ - cluster:monitor/xpack/ml*
+ indices:
+ '*':
+ '*':
+ - READ
+ - indices:admin/get*
+ '?ml-*':
+ '*':
+ - "*"
+
+### LEGACY ROLES, FOR COMPATIBILITY ONLY
+### WILL BE REMOVED IN SG7, DO NOT USE ANYMORE
+
+sg_readonly_and_monitor:
+ cluster:
+ - CLUSTER_MONITOR
+ - CLUSTER_COMPOSITE_OPS_RO
+ indices:
+ '*':
+ '*':
+ - READ
+
+# Make xpack monitoring work
+sg_monitor:
+ cluster:
+ - cluster:admin/xpack/monitoring/*
+ - cluster:admin/ingest/pipeline/put
+ - cluster:admin/ingest/pipeline/get
+ - indices:admin/template/get
+ - indices:admin/template/put
+ - CLUSTER_MONITOR
+ - CLUSTER_COMPOSITE_OPS
+ indices:
+ '?monitor*':
+ '*':
+ - INDICES_ALL
+ '?marvel*':
+ '*':
+ - INDICES_ALL
+ '?kibana*':
+ '*':
+ - READ
+ '*':
+ '*':
+ - indices:data/read/field_caps
+
+# Make xpack alerting work
+sg_alerting:
+ cluster:
+ - indices:data/read/scroll
+ - cluster:admin/xpack/watcher/watch/put
+ - cluster:admin/xpack/watcher*
+ - CLUSTER_MONITOR
+ - CLUSTER_COMPOSITE_OPS
+ indices:
+ '?kibana*':
+ '*':
+ - READ
+ '?watches*':
+ '*':
+ - INDICES_ALL
+ '?watcher-history-*':
+ '*':
+ - INDICES_ALL
+ '?triggered_watches':
+ '*':
+ - INDICES_ALL
+ '*':
+ '*':
+ - READ
+
+
+sg_role_test:
+ cluster:
+ - indices:admin/template/get
+ - indices:admin/template/put
+ - CLUSTER_COMPOSITE_OPS
+ indices:
+ '*':
+ '*':
+ - UNLIMITED
--- /dev/null
+# In this file users, backendroles and hosts can be mapped to Search Guard roles.
+# Permissions for Search Guard roles are configured in sg_roles.yml
+
+sg_all_access:
+ readonly: true
+ backendroles:
+ - admin
+
+sg_logstash:
+ backendroles:
+ - logstash
+
+sg_kibana_server:
+ readonly: true
+ users:
+ - kibanaserver
+
+sg_kibana_user:
+ backendroles:
+ - kibanauser
+
+sg_readall:
+ readonly: true
+ backendroles:
+ - readall
+
+sg_manage_snapshots:
+ readonly: true
+ backendroles:
+ - snapshotrestore
+
+sg_own_index:
+ users:
+ - '*'
+
+sg_role_test:
+ users:
+ - test
-# Copyright © 2017 Amdocs, Bell Canada
-# Modifications Copyright © 2018 AT&T
+# Copyright © 2018 Amdocs, Bell Canada, AT&T
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# See the License for the specific language governing permissions and
# limitations under the License.
-#{{ if not .Values.disableAaiElasticsearch }}
apiVersion: v1
kind: ConfigMap
metadata:
- name: {{ include "common.fullname" . }}
+ name: {{ include "common.fullname" . }}-es-config
namespace: {{ include "common.namespace" . }}
labels:
app: {{ include "common.name" . }}
heritage: {{ .Release.Service }}
data:
{{ tpl (.Files.Glob "resources/config/*").AsConfig . | indent 2 }}
-#{{ end }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: {{ include "common.fullname" . }}-sg-scripts
+ namespace: {{ include "common.namespace" . }}
+ labels:
+ app: {{ include "common.name" . }}
+ chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
+data:
+{{ tpl (.Files.Glob "resources/bin/*").AsConfig . | indent 2 }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: {{ include "common.fullname" . }}-sg-config
+ namespace: {{ include "common.namespace" . }}
+ labels:
+ app: {{ include "common.name" . }}
+ chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
+data:
+{{ tpl (.Files.Glob "resources/config/sg/*").AsConfig . | indent 2 }}
release: {{ .Release.Name }}
name: {{ include "common.name" . }}
spec:
+ hostname: {{ include "common.name" . }}
initContainers:
- command:
- /bin/sh
securityContext:
privileged: true
image: {{ .Values.global.dockerhubRepository | default .Values.dockerhubRepository }}/{{ .Values.global.busyboxImage | default .Values.busyboxImage }}
- imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+ imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.pullPolicy }}
name: init-sysctl
volumeMounts:
- name: elasticsearch-data
mountPath: /logroot/
- hostname: {{ include "common.name" . }}
containers:
- name: {{ include "common.name" . }}
- image: {{ .Values.global.loggingRepository | default .Values.loggingRepository }}/{{ .Values.image }}
- imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+ image: "{{ include "common.repository" . }}/{{ .Values.image }}"
+ imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.pullPolicy }}
ports:
- containerPort: {{ .Values.service.internalPort }}
+ - containerPort: {{ .Values.service.internalPort2 }}
# disable liveness probe when breakpoints set in debugger
# so K8s doesn't restart unresponsive container
{{- if eq .Values.liveness.enabled true }}
- name: elasticsearch-config
subPath: log4j2.properties
mountPath: /usr/share/elasticsearch/config/log4j2.properties
+ - name: searchguard-scripts
+ subPath: run.sh
+ mountPath: /usr/share/elasticsearch/bin/run.sh
+ - name: searchguard-scripts
+ subPath: wait_until_started.sh
+ mountPath: /usr/share/elasticsearch/bin/wait_until_started.sh
+ - name: searchguard-scripts
+ subPath: init_sg.sh
+ mountPath: /usr/share/elasticsearch/bin/init_sg.sh
+ - name: searchguard-config
+ mountPath: /usr/share/elasticsearch/config/sg
+ - name: searchguard-auth-config
+ mountPath: /usr/share/elasticsearch/config/sg/auth
- name: elasticsearch-data
mountPath: /usr/share/elasticsearch/data
resources:
-{{ include "common.resources" . }}
+{{ include "common.resources" . | indent 12 }}
{{- if .Values.nodeSelector }}
nodeSelector:
{{ toYaml .Values.nodeSelector | indent 8 }}
path: /etc/localtime
- name: elasticsearch-config
configMap:
- name: {{ include "common.fullname" . }}
+ name: {{ include "common.fullname" . }}-es-config
+ - name: searchguard-scripts
+ configMap:
+ name: {{ include "common.fullname" . }}-sg-scripts
+ defaultMode: 0754
+ - name: searchguard-config
+ configMap:
+ name: {{ include "common.fullname" . }}-sg-config
+ - name: searchguard-auth-config
+ secret:
+ secretName: {{ include "common.fullname" . }}-sg-auth
- name: elasticsearch-data
hostPath:
path: {{ .Values.persistence.mountPath }}/{{ .Release.Name }}/{{ .Values.persistence.mountSubPath }}
+ restartPolicy: {{ .Values.restartPolicy }}
imagePullSecrets:
- name: "{{ include "common.namespace" . }}-docker-registry-key"
--- /dev/null
+# Copyright © 2018 Amdocs, Bell Canada, AT&T
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: Secret
+metadata:
+ name: {{ include "common.fullname" . }}-sg-auth
+ namespace: {{ include "common.namespace" . }}
+type: Opaque
+data:
+{{ tpl (.Files.Glob "resources/config/sg/auth/*").AsSecrets . | indent 2 }}
\ No newline at end of file
spec:
type: {{ .Values.service.type }}
ports:
- {{if eq .Values.service.type "NodePort" -}}
- - port: {{ .Values.service.internalPort }}
- nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort }}
- name: {{ .Values.service.portName }}
- {{- else -}}
- - port: {{ .Values.service.internalPort }}
- name: {{ .Values.service.portName }}
- {{- end}}
+ {{if eq .Values.service.type "NodePort" -}}
+ - port: {{ .Values.service.internalPort }}
+ nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort }}
+ name: {{ .Values.service.portName }}
+ - port: {{ .Values.service.internalPort2 }}
+ nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort2 }}
+ name: {{ .Values.service.portName2 }}
+ {{- else -}}
+ - port: {{ .Values.service.internalPort }}
+ name: {{ .Values.service.portName }}
+ - port: {{ .Values.service.internalPort2 }}
+ name: {{ .Values.service.portName2 }}
+ {{- end}}
selector:
app: {{ include "common.name" . }}
release: {{ .Release.Name }}
nodePortPrefix: 302
# application image
-loggingRepository: docker.elastic.co
-image: elasticsearch/elasticsearch:6.1.2
+image: onap/elasticsearch-sg:1.4-STAGING-latest
pullPolicy: Always
+restartPolicy: Always
flavor: small
# application configuration
config:
tcpPort: 8443
-
+ nodeKeyStore: esaai-keystore.jks
+ nodeKeyStorePassword: b87b46d3da7d3d4aadfe
+ adminKeyStore: sgadmin-keystore.p12
+ adminKeyStorePassword: 341274302a70ad691e12
+ trustStore: truststore.jks
+ trustStorePassword: b200926e9da205487f63
# default number of instances
replicaCount: 1
name: aai-elasticsearch
portName: aai-elasticsearch
internalPort: 9200
+ portName2: aai-elasticsearch-tcp
+ internalPort2: 8443
ingress:
enabled: false
<appender-ref ref="Console" />
</root>
- <!-- LOG "com.baeldung*" at TRACE level -->
- <logger name="org.onap.aaf.fproxy" level="trace" additivity="false">
- <appender-ref ref="RollingFile" />
- <appender-ref ref="Console" />
- </logger>
+ <!-- LOG "org.onap.aaf.fproxy*" at INFO level -->
+ <logger name="org.onap.aaf.fproxy" level="info" />
</configuration>
\ No newline at end of file
</appender>
<!-- LOG everything at INFO level -->
- <root level="debug">
+ <root level="info">
<appender-ref ref="RollingFile" />
<appender-ref ref="Console" />
</root>
- <!-- LOG "com.baeldung*" at TRACE level -->
- <logger name="org.onap.aaf.rproxy" level="trace" additivity="false">
- <appender-ref ref="RollingFile" />
- <appender-ref ref="Console" />
- </logger>
+ <!-- LOG "org.onap.aaf.rproxy*" at INFO level -->
+ <logger name="org.onap.aaf.rproxy" level="info" />
</configuration>
</root>
<!-- LOG "com.baeldung*" at TRACE level -->
- <logger name="org.onap.aaf.fproxy" level="trace" additivity="false">
- <appender-ref ref="RollingFile" />
- <appender-ref ref="Console" />
- </logger>
+ <logger name="org.onap.aaf.fproxy" level="info" />
</configuration>
\ No newline at end of file
</appender>
<!-- LOG everything at INFO level -->
- <root level="debug">
+ <root level="info">
<appender-ref ref="RollingFile" />
<appender-ref ref="Console" />
</root>
<!-- LOG "com.baeldung*" at TRACE level -->
- <logger name="org.onap.aaf.rproxy" level="trace" additivity="false">
- <appender-ref ref="RollingFile" />
- <appender-ref ref="Console" />
- </logger>
+ <logger name="org.onap.aaf.rproxy" level="info" />
</configuration>
# limitations under the License.
oxm.schemaNodeDir=/opt/app/sparky/onap/oxm
+#schemaServiceTranslator is used to define whether to retreive the oxm from schema service microservice or read from the disk, possible values are schema-service/config
+oxm.schemaServiceTranslatorList=config
+# The end point for onap is https://<hostname>:<port>/onap/schema-service/v1/
+oxm.schemaServiceBaseUrl=https://<schema-service/config>/aai/schema-service/v1/
+oxm.schemaServiceKeystore=file:${CONFIG_HOME}/auth/aai-client-cert.p12
+oxm.schemaServiceTruststore=file:${CONFIG_HOME}/auth/tomcat_keystore
+oxm.schemaServiceKeystorePassword=OBF:1i9a1u2a1unz1lr61wn51wn11lss1unz1u301i6o
+oxm.schemaServiceTruststorePassword=OBF:1i9a1u2a1unz1lr61wn51wn11lss1unz1u301i6o
+
+
+
+# Schema Service need this variable for the time being
+spring.applicationName=sparky
spring.profiles.active=camel,ssl,fe-prod,oxm-schema-prod,oxm-default,resources,sync,portal
+portal.cadiFileLocation={{.Values.config.cadiFileLocation}}
+portal.cadiFileLocation={{.Values.config.cadiFileLocation}}
searchservice.hostname={{.Values.global.searchData.serviceName}}
searchservice.port=9509
searchservice.client-cert=client-cert-onap.p12
searchservice.client-cert-password=1y0q1uvc1uum1uvg1pil1pjl1uuq1uvk1uuu1y10
searchservice.truststore=tomcat_keystore
+
+schema.ingest.file=${CONFIG_HOME}/schemaIngest.properties
--- /dev/null
+cipher.enc.key=AGLDdG4D04BKm2IxIWEr8o==!
################################################################################
# Java class that implements the ECOMP role and user mgt API
-portal.api.impl.class = org.onap.aai.sparky.security.portal.PortalRestAPIServiceImpl
+portal.api.impl.class = org.onap.aai.sparky.security.portal.PortalRestAPICentralServiceImpl
# Instance of ECOMP Portal where the app has been on-boarded
# use insecure http for dev purposes to avoid self-signed certificate
# Toggles use of UEB
ueb_listeners_enable = false
# IDs application withing UEB flow
-ueb_app_key = qFKles9N8gDTV0Zc
+ueb_app_key = ueb_key_7
+# Use this tag if the app is centralized
+role_access_centralized=remote
+
+# Connection and Read timeout values
+ext_req_connection_timeout=15000
+ext_req_read_timeout=20000
+
+#Add AAF namespace if the app is centralized
+auth_namespace={{.Values.config.aafNamespace}}
--- /dev/null
+# Configure AAF
+aaf_locate_url=https://aaf-locate.{{.Release.Namespace}}:8095
+aaf_url=<%=https://AAF_LOCATE_URL/AAF_NS.service:2.0
+
+#aaf_url=https://DME2RESOLVE/service=com.att.authz.AuthorizationService/version=2.0/envContext=TEST/routeOffer=BAU_SE
+# AAF Environment Designation
+
+#if you are running aaf service from a docker image you have to use aaf service IP and port number
+aaf_id={{.Values.config.aafUsername}}
+#Encrypt the password using AAF Jar
+aaf_password={{.Values.config.aafPassword}}
+# Sample CADI Properties, from CADI 1.4.2
+#hostname=org.onap.aai.orr
+csp_domain=PROD
+# Add Absolute path to Keyfile
+cadi_keyfile={{.Values.config.cadiKeyFile}}
+
+# This is required to accept Certificate Authentication from Certman certificates.
+# can be TEST, IST or PROD
+aaf_env=DEV
+
+# DEBUG prints off all the properties. Use to get started.
+cadi_loglevel=DEBUG
+
+# Add Absolute path to truststore2018.jks
+cadi_truststore={{.Values.config.cadiTrustStore}}
+# Note: This is the ONLY password that doesn't have to be encrypted. All Java's TrustStores are this passcode by default, because they are public certs
+cadi_truststore_password={{.Values.config.cadiTrustStorePassword}}
+
+# how to turn on SSL Logging
+#javax.net.debug=ssl
+
+# Use "maps.bing.com" to get Lat and Long for an Address
+AFT_LATITUDE=32.780140
+AFT_LONGITUDE=-96.800451
+AFT_ENVIRONMENT=AFTUAT
+AFT_DME2_CLIENT_IGNORE_SSL_CONFIG=true
+DME2.DEBUG=true
+AFT_DME2_HTTP_EXCHANGE_TRACE_ON=true
+
+cadi_latitude=32.780140
+cadi_longitude=-96.800451
+
+aaf_root_ns=com.att.aaf
+aaf_api_version=2.0
--- /dev/null
+77E_fh-8gTjeg8egAo-JgNkXYm1FGEBPMo44vKPgKyGCJj9Dn0xJqIBct2Ko35X4_HSU3wPq3I2q
+YHIvJCjmzXTVu2zvu4rIGTlwycTtLGDkgPyhOYFytv4GgazbpSs9331MPUeVVrdpkDCQmjtHSB4m
+DThhfEe2lkbZ35ljX3sVSf3JDy4ngRot0ktQwnnY4vxFdgVUl7LzVinXWgFLoqMyXmKh_bGw9aUH
+VMgqFsF_YmqLZY5ZARAraeywktvrU5kXYh5SnfXoJy7XIk0TBjHKqO-1mW-TcIgS3_v6GIGkZnpq
+e1FyE8cS21gTPFlc1KDoWUZE2yoEsQKJc4RFWfjid_mE6nckxym1TOsEn3G2_TlkZvliN_QMDB_c
+RuFLDB9HCChm4YYHpSn-RBqtJFz29bMTHQX8VNVfZ_Zhh-4dWOlEfpSzJvAqm_boo-8y8YDGIusx
+mvKyPXEKVCuBOljHaKhYg0d43nAXIFsssKpjmtQizA2L_TP1Mo_lDFIlCsPcRlHKTvzkTstEAhRj
+JnepzA--olBMwBkPxjm1Y5XQBGZH72i_o4Hr7_NqHb9sP486I2Nd1-owjHkhacGrLO1oORnuBUxp
+_SnaXYywe9tTz3BcfFupXSoDv4Sj7g9B53yPIWmjGggigidql3SNJsui6qOtwDHOejzEDFm23Lj7
+fXD6sb52U_ul9ahi4CoLTzpvMsPRYOqyRCk8K8FVBauZbG5D42oaFPn0S0rCSHOCU1TXbRdTF-Cs
+I2R0pEHNgb33yx6vtInaTSYIQ5cxa3XDA_50AQearV5SuYSlp8dK0BkpVCKgvSQdTn-2WiaV_hvO
+KzG7D2adT1kYY6TjYMXIaUiJ33y1XSNDG0s6r4NG5dNE6Jj7thdpnV-AAZoi0uZh1_bsHKLVmHRr
+NCXAc6DZm1D4N9y5lOJwUprUlJisZXLFTQThGMRY5dtiY_eK9Xjj4FQygXXhuhFXHz2-e4YApORv
+lXDcT29IZuuI1j26bxdNdhNr1wZsqqievBN6l6OQMiP21eIrxAUu1BEmiVOrfOzaEjxldDN2gFum
+4-zf9gsQT9UT8KEuOje64wVeHr09JpWuddV9HOAMvqc6mKTWmvUv_QiLgtK_b39QccMrOfOA1usM
+biRJ9wuTYIr584Q9CjHEcm5e2YufcbF-IDZ4IDui8gNXyYJuusTYdspeKzrtiLKfgI56ZWA3it9G
+SOkN18YyUmhk7HFkx9qEifb4UEbUQPb0dyXBRotf-91c5CPkct-36uV4sZBA_AR1tX3-aRKKB_SQ
+B0zaG-eaEdEqKv-ZYHqk23ZxiEsCX3ZdY7VSMWztE3_D5n8UgEl4et5LVfnjvU-arVVO93WUbXk0
+zi2QrOwytOZ0StAvFdF1nVwWllPg4EYcn8qLJIaaBRvLMlpHixtwRhltwJeMmJl3ExImOxNhVbhF
+6LxVXW6JK8JfMIwb_TE4EShDBjemq76BojQOwrO4OAyPG7B5iUtefdY-Zu1EtjXPhrUgljI_A1tg
+5_2WNjNTCT7Bvig3saFsIRi3cvgIcMAF2H7kJYw3UDvCFnx4LIom2u6vSeyatPxEOhRfpP0KvgEU
+koM9DFJW7VWQ11mB_DcU2NoYHdFKFy_cM62kIvoRwZTADGryEtkLSWEDT8MLpVrGXP2RjSZ3HHqC
+vVpVqQHC2VIqNKi2uHtYCiTEfj81Z0rCrnH3hYIRoOSe5W6m17xyb0RloG0G44uK0oNCfDYLwK0L
+TJaBdWSIBYI__ISsKx8o8r-3XLtbwQPPhv4-LpGwJYd7sIcqnpTYAyNGSrbEM4ECzHCH9Hwf9Duy
+cAQGWqXIbTV9i8ryw8OhcCZPTf3noPZyhzzdegiv6KNT-BBbxsgtDehtP-jvpd9eAhjlfUV_hoFJ
+rBUVMFrIOEDnnItVqBDmnavRdhn6N9ObVjVMv_4inhkvtpBCEVxtVQT2kFuBmZvPu_uHHbXi7_g8
+SVs3AjJ2ya3pZraK6gH3IOYoGtTAH3rKl7XdTMjqWnUCbhepuJqeEOF-DhpsEW7Oo0Lqzbjg
\ No newline at end of file
# prevent the portal interface's login processing from searching for a user\r
# specific cookie, and will instead allow passage if a valid session cookie is discovered.\r
onap_enabled={{.Values.config.portalOnapEnabled}}\r
+onap.user_id_cookie_name={{.Values.config.portalCookieName}}\r
+cookie_decryptor_classname={{.Values.config.cookieDecryptorClass}}\r
+app_roles={{.Values.config.portalAppRoles}}\r
# application image
repository: nexus3.onap.org:10001
-image: onap/sparky-be:1.3.0
+image: onap/sparky-be:1.4-STAGING-latest
pullPolicy: Always
restartPolicy: Always
flavor: small
gerritBranch: 3.0.0-ONAP
gerritProject: http://gerrit.onap.org/r/aai/test-config
portalUsername: aaiui
- portalPassword: 1t2v1vfv1unz1vgz1t3b
+ portalPassword: OBF:1t2v1vfv1unz1vgz1t3b
+ portalCookieName: UserId
+ portalAppRoles: ui_view
+ aafUsername: aai@aai.onap.org
+ aafNamespace: org.onap.aai.aaiui
+ aafPassword: enc:xxYw1FqXU5UpianbPeH5Rezg0YfjzuwQrSiLcCmJGfz
+ cadiKeyFile: /opt/app/sparky/config/portal/keyFile
+ cadiTrustStore: /opt/app/sparky/config/auth/truststoreONAPall.jks
+ cadiFileLocation: /opt/app/sparky/config/portal/cadi.properties
+ cadiTrustStorePassword: changeit
+ cookieDecryptorClass: org.onap.aai.sparky.security.BaseCookieDecryptor
# ONAP Cookie Processing - During initial development, the following flag, if true, will
# prevent the portal interface's login processing from searching for a user
version:
# Current version of the REST API
api:
- default: v15
+ default: v16
# Specifies which version the depth parameter is configurable
depth: v11
# List of all the supported versions of the API
- list: v11,v12,v13,v14,v15
+ list: v11,v12,v13,v14,v15,v16
# Specifies from which version related link should appear
related:
link: v11
# Copyright © 2017 Amdocs, Bell Canada
+# Modifications Copyright © 2018 Orange
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# limitations under the License.
apiVersion: v1
-description: ONAP DMaaP Data Router
-name: dmaap-data-router
-version: 1.0
+description: ONAP Common Design Studio
+name: cds
+version: 4.0.0
--- /dev/null
+# CDS
+
+## Introduction
+
+CDS stands for Common Design Studio. It helps developping service specific
+artifacts for pre instanciation and post configuration.
+
+Full description is on [ONAP Read the Doc](https://docs.onap.org/en/latest/submodules/ccsdk/cds.git/docs/index.html).
+
+Charts has an UI and blueprints processort and controllers.
+Trigger to enable it is on SDNC chart has of today.
+
+## Requirements
+
+CDS needs the following ONAP projects to work:
+
+- AAI
+- SO
+- SDC
+- SDNC
# Copyright © 2017 Amdocs, Bell Canada
+# Modifications Copyright © 2018 Orange
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
- name: common
version: ~4.x-0
repository: '@local'
- - name: mariadb-galera
- alias: mariadb
- version: ~4.x-0
- repository: '@local'
-
--- /dev/null
+# Copyright © 2018 Orange
+# Modifications Copyright © 2018 Amdocs, Bell Canada
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+ name: {{ include "common.fullname" . }}
+ namespace: {{ include "common.namespace" . }}
+ labels:
+ app: {{ include "common.name" . }}
+ chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
+spec:
+ replicas: {{ .Values.replicaCount }}
+ template:
+ metadata:
+ labels:
+ app: {{ include "common.name" . }}
+ release: {{ .Release.Name }}
+ name: {{ include "common.fullname" . }}
+ spec:
+ containers:
+ - name: {{ include "common.name" . }}
+ image: "{{ include "common.repository" . }}/{{ .Values.image }}"
+ imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+ ports:
+ - containerPort: {{ .Values.service.internalPort }}
+ # disable liveness probe when breakpoints set in debugger
+ # so K8s doesn't restart unresponsive container
+ {{ if .Values.liveness.enabled }}
+ livenessProbe:
+ tcpSocket:
+ port: {{ .Values.service.internalPort }}
+ initialDelaySeconds: {{ .Values.liveness.initialDelaySeconds }}
+ periodSeconds: {{ .Values.liveness.periodSeconds }}
+ {{ end }}
+ env:
+ - name: HOST
+ value: 0.0.0.0
+ readinessProbe:
+ tcpSocket:
+ port: {{ .Values.service.internalPort }}
+ initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }}
+ periodSeconds: {{ .Values.readiness.periodSeconds }}
+ volumeMounts:
+ - mountPath: /etc/localtime
+ name: localtime
+ readOnly: true
+ resources:
+{{ include "common.resources" . | indent 12 }}
+ {{- if .Values.nodeSelector }}
+ nodeSelector:
+{{ toYaml .Values.nodeSelector | indent 10 }}
+ {{- end -}}
+ {{- if .Values.affinity }}
+ affinity:
+{{ toYaml .Values.affinity | indent 10 }}
+ {{- end }}
+ # side car containers
+ # - name: filebeat-onap
+ # image: "{{ .Values.global.loggingRepository }}/{{ .Values.global.loggingImage }}"
+ # imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+ # volumeMounts:
+ # - mountPath: /usr/share/filebeat/filebeat.yml
+ # name: filebeat-conf
+ # subPath: filebeat.yml
+ # - mountPath: /home/esr/works/logs
+ # name: esr-server-logs
+ # - mountPath: /usr/share/filebeat/data
+ # name: esr-server-filebeat
+ volumes:
+ - name: localtime
+ hostPath:
+ path: /etc/localtime
+ # - name: filebeat-conf
+ # configMap:
+ # name: {{ include "common.fullname" . }}-esr-filebeat
+ # - name: esr-server-logs
+ # emptyDir: {}
+ # - name: esr-server-filebeat
+ # emptyDir: {}
+ # - name: esrserver-log
+ # configMap:
+ # name: {{ include "common.fullname" . }}-esr-esrserver-log
+ imagePullSecrets:
+ - name: "{{ include "common.namespace" . }}-docker-registry-key"
--- /dev/null
+# Copyright © 2017 Amdocs, Bell Canada, Orange
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: Service
+metadata:
+ name: {{ include "common.servicename" . }}
+ namespace: {{ include "common.namespace" . }}
+ labels:
+ app: {{ include "common.name" . }}
+ chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
+spec:
+ type: {{ .Values.service.type }}
+ ports:
+ {{if eq .Values.service.type "NodePort" -}}
+ - port: {{ .Values.service.internalPort }}
+ nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort }}
+ name: {{ .Values.service.portName }}-{{ .Values.service.internalPort }}
+ {{- else -}}
+ - port: {{ .Values.service.externalPort }}
+ targetPort: {{ .Values.service.internalPort }}
+ name: {{ .Values.service.portName }}
+ {{- end}}
+ selector:
+ app: {{ include "common.name" . }}
+ release: {{ .Release.Name }}
-# Copyright © 2017 Amdocs, Bell Canada
+# Copyright © 2018 Orange
+# Modifications Copyright © 2018 Amdocs, Bell Canada
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# Global configuration defaults.
#################################################################
global:
- nodePortPrefix: 302
+ nodePortPrefix: 303
readinessRepository: oomk8s
- readinessImage: readiness-check:2.0.0
+ readinessImage: readiness-check:1.1.0
loggingRepository: docker.elastic.co
loggingImage: beats/filebeat:5.5.0
-#################################################################
-# Application configuration defaults.
-#################################################################
+subChartsOnly:
+ enabled: true
+
# application image
repository: nexus3.onap.org:10001
-image: onap/dmaap/datarouter-prov:2.0.0
+image: onap/ccsdk-cds-ui:1.0.0-STAGING-latest
pullPolicy: Always
-# flag to enable debugging - application support required
-debugEnabled: false
+# application configuration
+config:
-# application configuration - see parent values chart
# default number of instances
replicaCount: 1
# probe configuration parameters
liveness:
+ httpGet:
+ path: /
+ port: 3000
initialDelaySeconds: 30
periodSeconds: 10
# necessary to disable liveness probe when setting breakpoints
enabled: true
readiness:
+ httpGet:
+ path: /ping
+ port: 3000
initialDelaySeconds: 30
periodSeconds: 10
-## Persist data to a persitent volume
-persistence:
- enabled: false
+service:
+ type: NodePort
+ portName: ui
+ name: cds
+ nodePort: 97
+ internalPort: 3000
ingress:
enabled: false
-
# Resource Limit flavor -By Default using small
flavor: small
# Segregation for Different environment (Small and Large)
resources:
small:
limits:
- cpu: 2000m
- memory: 4Gi
- requests:
- cpu: 500m
+ cpu: 1
memory: 1Gi
+ requests:
+ cpu: 10m
+ memory: 100Mi
large:
limits:
- cpu: 4000m
- memory: 8Gi
- requests:
- cpu: 1000m
+ cpu: 2
memory: 2Gi
+ requests:
+ cpu: 200m
+ memory: 200Mi
unlimited: {}
--- /dev/null
+{{- if .Values.configOverrides }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: {{ include "common.fullname" . }}-configOverrides
+ namespace: {{ include "common.namespace" . }}
+ labels:
+ app: {{ include "common.name" . }}
+ chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
+data:
+{{ toYaml .Values.configOverrides | indent 2 }}
+{{- end }}
+
# See the License for the specific language governing permissions and
# limitations under the License.
-#{{ if .Values.persistence.enabled }}
+{{ if .Values.persistence.enabled }}
{{- $root := . -}}
{{ range $i, $e := until (int $root.Values.replicaCount) }}
---
path: {{ $root.Values.persistence.mountPath }}/{{ $root.Release.Name }}/{{ $root.Values.persistence.mountSubPath }}-{{ $i }}
persistentVolumeReclaimPolicy: {{ $root.Values.persistence.volumeReclaimPolicy }}
{{ end }}
-#{{ end }}
+{{ end }}
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
+ annotations:
+ service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
spec:
type: {{ .Values.service.type }}
+ publishNotReadyAddresses: true
ports:
- {{if eq .Values.service.type "NodePort" -}}
- - port: {{ .Values.service.externalPort }}
- targetPort: {{ .Values.service.internalPort }}
- nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort }}
- name: {{ .Values.service.portName }}
- - port: {{ .Values.service.externalPort2 }}
- targetPort: {{ .Values.service.internalPort2 }}
- nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort2 }}
- name: {{ .Values.service.portName }}2
- - port: {{ .Values.service.externalPort3 }}
- targetPort: {{ .Values.service.internalPort3 }}
- nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort3 }}
- name: {{ .Values.service.portName }}3
- - port: {{ .Values.service.externalPort4 }}
- targetPort: {{ .Values.service.internalPort4 }}
- nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort4 }}
- name: {{ .Values.service.portName }}4
- - port: {{ .Values.service.externalPort5 }}
- targetPort: {{ .Values.service.internalPort5 }}
- nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort5 }}
- name: {{ .Values.service.portName }}5
-
- {{- else -}}
- - port: {{ .Values.service.externalPort }}
- targetPort: {{ .Values.service.internalPort }}
- name: {{ .Values.service.portName }}
- - port: {{ .Values.service.externalPort2 }}
- targetPort: {{ .Values.service.internalPort2 }}
- name: {{ .Values.service.portName }}2
- - port: {{ .Values.service.externalPort3 }}
- targetPort: {{ .Values.service.internalPort3 }}
- name: {{ .Values.service.portName }}3
- - port: {{ .Values.service.externalPort4 }}
- targetPort: {{ .Values.service.internalPort4 }}
- name: {{ .Values.service.portName }}4
- - port: {{ .Values.service.externalPort5 }}
- targetPort: {{ .Values.service.internalPort5 }}
- name: {{ .Values.service.portName }}5
- {{- end}}
+ {{if eq .Values.service.type "NodePort" -}}
+ {{- $global := . }}
+ {{- range $index, $ports := .Values.service.ports }}
+ - port: {{ $ports.port }}
+ targetPort: {{ $ports.port }}
+ nodePort: {{ $global.Values.global.nodePortPrefix | default $global.Values.nodePortPrefix }}{{ $ports.nodePort }}
+ name: {{ $ports.name }}
+ {{- end }}
+{{- else -}}
+ {{- range $index, $ports := .Values.service.ports }}
+ - port: {{ $ports.port }}
+ targetPort: {{ $ports.port }}
+ name: {{ $ports.name }}
+ {{- end }}
+{{- end}}
selector:
app: {{ include "common.name" . }}
release: {{ .Release.Name }}
+ clusterIP: None
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
spec:
+ selector:
+ matchLabels:
+ app: {{ include "common.name" . }}
+ release: {{ .Release.Name }}
serviceName: {{ include "common.servicename" . }}
replicas: {{ .Values.replicaCount }}
podManagementPolicy: {{ .Values.podManagementPolicy }}
release: {{ .Release.Name }}
name: {{ include "common.name" . }}
spec:
+ hostNetwork: {{ .Values.hostNetwork }}
containers:
- name: {{ include "common.name" . }}
image: {{ .Values.image }}
imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
ports:
- - containerPort: {{ .Values.service.internalPort }}
- - containerPort: {{ .Values.service.internalPort2 }}
- - containerPort: {{ .Values.service.internalPort3 }}
- - containerPort: {{ .Values.service.internalPort4 }}
- - containerPort: {{ .Values.service.internalPort5 }}
+ {{- range $index, $ports := .Values.service.ports }}
+ - containerPort: {{ $ports.port }}
+ {{- end }}
volumeMounts:
- - name: {{ .Values.service.name }}
+ - name: cassandra-data
mountPath: /var/lib/cassandra
- {{ if eq .Values.configmapping true }}
- - name: {{ .Values.service.name }}-docker-entry-initd
- mountPath: /{{ .Values.service.name }}-docker-entrypoint-initdb.d/cassandra.cql
- subPath: cassandra.cql
- {{ end }}
+ - name: localtime
+ mountPath: /etc/localtime
+ readOnly: true
+ {{- range $key, $value := .Values.configOverrides }}
+ - name: cassandra-config-{{ $key | replace "." "-" }}
+ mountPath: /etc/cassandra/{{ $key }}
+ subPath: {{ $key }}
+ {{- end }}
{{- if eq .Values.liveness.enabled true }}
livenessProbe:
exec:
- nodetool status | grep $POD_IP | awk '$1!="UN" { exit 1; }'
initialDelaySeconds: {{ .Values.liveness.initialDelaySeconds }}
periodSeconds: {{ .Values.liveness.periodSeconds }}
+ timeoutSeconds: {{ .Values.liveness.timeoutSeconds }}
+ successThreshold: {{ .Values.liveness.successThreshold }}
+ failureThreshold: {{ .Values.liveness.failureThreshold }}
{{ end -}}
readinessProbe:
exec:
- -c
- nodetool status | grep $POD_IP | awk '$1!="UN" { exit 1; }'
initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }}
- timeoutSeconds: {{ .Values.liveness.periodSeconds }}
+ periodSeconds: {{ .Values.readiness.periodSeconds }}
+ timeoutSeconds: {{ .Values.readiness.timeoutSeconds }}
+ successThreshold: {{ .Values.readiness.successThreshold }}
+ failureThreshold: {{ .Values.readiness.failureThreshold }}
env:
- {{- $seed_size := default 1 .Values.replicaCount | int -}}
- {{- $global := . }}
+ {{- $seed_size := default 1 .Values.replicaCount | int -}}
+ {{- $global := . }}
+ - name: CASSANDRA_SEEDS
+ {{- if .Values.hostNetwork }}
+ value: {{ required "You must fill \".Values.config.seeds\" with list of Cassandra seeds when hostNetwork is set to true" .Values.config.seeds | quote }}
+ {{- else }}
+ value: "{{- range $i, $e := until $seed_size }}{{ template "common.fullname" $global }}-{{ $i }}.{{ template "common.servicename" $global }}.{{ $global.Release.Namespace }}.svc.{{ $global.Values.config.cluster_domain }}{{- if (lt ( add1 $i ) $seed_size ) }},{{- end }}{{- end }}"
+ {{- end }}
- name: MAX_HEAP_SIZE
value: {{ .Values.config.heap.max }}
- name: HEAP_NEWSIZE
value: {{ .Values.config.rackName | quote }}
- name: CASSANDRA_AUTO_BOOTSTRAP
value: {{ .Values.config.autoBootstrap | quote }}
+ - name: CASSANDRA_START_RPC
+ value: {{ default "true" .Values.config.start_rpc | quote }}
+ - name: CASSANDRA_ENDPOINT_SNITCH
+ value: {{ default "SimpleSnitch" .Values.config.endpoint_snitch | quote }}
- name: POD_IP
valueFrom:
fieldRef:
fieldPath: status.podIP
- {{ if eq .Values.configmapping true }}
lifecycle:
- postStart:
+ preStop:
exec:
- command:
- - /bin/sh
- - -c
- - >
- /bin/sleep {{ .Values.readiness.initialDelaySeconds }};
- cd /{{ .Values.service.name }}-docker-entrypoint-initdb.d;
- cqlsh -u root -p root -f cassandra.cql
- {{ end }}
+ {{- if not .Values.persistence.enabled }}
+ command: ["/bin/sh", "-c", "exec nodetool decommission"]
+ {{- else }}
+ command: ["/bin/sh", "-c", "PID=$(pidof java) && kill $PID && while ps -p $PID > /dev/null; do sleep 1; done"]
+ {{- end }}
resources:
{{ toYaml .Values.resources | indent 10 }}
{{- if .Values.nodeSelector }}
- name: localtime
hostPath:
path: /etc/localtime
- {{ if eq .Values.configmapping true }}
- - name: {{ .Values.service.name }}-docker-entry-initd
+ {{- range $key, $value := .Values.configOverrides }}
+ - name: cassandra-config-{{ $key | replace "." "-" }}
configMap:
- name: {{ .Values.service.name }}-docker-entry-initd
- {{ end }}
+ name: {{ include "common.fullname" . }}-configOverrides
+ {{- end }}
{{- if not .Values.persistence.enabled }}
- - name: {{ .Values.service.name }}
+ - name: cassandra-data
emptyDir: {}
{{- else }}
volumeClaimTemplates:
- metadata:
- name: {{ .Values.service.name }}
+ name: cassandra-data
labels:
app: {{ template "common.fullname" . }}
- chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
annotations:
# flag to enable debugging - application support required
debugEnabled: false
-# configmapping detail whether it exist locally or not
-# by default it is false, if you wanna configure it then mention
-# locally TRUE value in local values.yaml.
-
-configmapping: false
-
# application configuration
config:
+ cluster_domain: cluster.local
heap:
max: 512M
min: 100M
dataCenter: Pod
rackName: Rack
autoBootstrap: true
- cassandraUsername: root
- cassandraPassword: root
+ # If hostNetwork is true then provide the comma separated list of seeds.
+ #seeds:seed1,seed2
# default number of instances
-replicaCount: 1
+replicaCount: 3
+
+hostNetwork: false
nodeSelector: {}
liveness:
initialDelaySeconds: 60
periodSeconds: 10
+ timeoutSeconds: 3
+ successThreshold: 1
+ failureThreshold: 3
# necessary to disable liveness probe when setting breakpoints
# in debugger so K8s doesn't restart unresponsive container
enabled: true
readiness:
initialDelaySeconds: 60
periodSeconds: 10
+ timeoutSeconds: 3
+ successThreshold: 1
+ failureThreshold: 3
service:
type: ClusterIP
name: cassandra
- portName: cassandra
- externalPort: 9160
- internalPort: 9160
- externalPort2: 7000
- internalPort2: 7000
- externalPort3: 7001
- internalPort3: 7001
- externalPort4: 7199
- internalPort4: 7199
- externalPort5: 9042
- internalPort5: 9042
+ ports:
+ - name: intra
+ port: 7000
+ - name: tls
+ port: 7001
+ - name: jmx
+ port: 7199
+ - name: cql
+ port: 9042
+ - name: thrift
+ port: 9160
+ - name: agent
+ port: 61621
podManagementPolicy: OrderedReady
updateStrategy:
- type: OnDelete
+ type: RollingUpdate
ingress:
enabled: false
storageType: local
storageClass: ""
+configOverrides: {}
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# Copyright © 2018 AT&T Intellectual Property. All rights reserved.
-# Modifications Copyright © 2018 Amdocs,Bell Canada
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# See the License for the specific language governing permissions and
# limitations under the License.
-make-dmaap: make-bus-controller make-message-router make-dmaap-data-router
+make-dmaap: make-bus-controller make-message-router make-dmaap-dr-node make-dmaap-dr-prov
make-bus-controller:
- cd charts && helm dep up dmaap-bus-controller && helm lint dmaap-bus-controller
+ cd components && helm dep up dmaap-bus-controller && helm lint dmaap-bus-controller
make-message-router:
- cd charts && helm dep up message-router && helm lint message-router
+ cd components && helm dep up message-router && helm lint message-router
-make-dmaap-data-router:
- cd charts && helm dep up dmaap-data-router && helm lint dmaap-data-router
+make-dmaap-dr-node:
+ cd components && helm dep up dmaap-dr-node && helm lint dmaap-dr-node
+
+make-dmaap-dr-prov:
+ cd components && helm dep up dmaap-dr-prov && helm lint dmaap-dr-prov
clean:
@find . -type f -name '*.tgz' -delete
+++ /dev/null
-# Copyright © 2017 Amdocs, Bell Canada
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-#################################################################
-# DMaap Data Router Global config defaults.
-#################################################################
-global:
- env:
- name: AUTO
- ubuntuInitRepository: oomk8s
- ubuntuInitImage: ubuntu-init:1.0.0
-
- config:
-# dr provisioning server configuration
- dmaapDrProv:
- servicetype: NodePort
- name: dmaap-dr-prov
- externalPort: 8080
- externalPort2: 8443
- internalPort: 8080
- internalPort2: 8443
- portName: dr-prov-port
- portName2: dr-prov-port2
- nodePort: 59
- nodePort2: 69
-# dr node server configuration
- dmaapDrNode:
- servicetype: ClusterIP
- name: dmaap-dr-node
- externalPort: 8080
- externalPort2: 8443
- internalPort: 8080
- internalPort2: 8443
- portName: dr-node-port
- portName2: dr-node-port2
-# dr-prov db configuration
- dmaapDrDb:
- mariadbServiceName: dmaap-dr-db-svc
- mariadbServicePort: 3306
- mariadbContName: dmaap-dr-db
-
-# mariadb-galera configuration
-mariadb:
- name: dmaap-dr-db
- nameOverride: dmaap-dr-db
- replicaCount: 2
- config:
- mariadbRootPassword: datarouter
- userName: datarouter
- userPassword: datarouter
- mysqlDatabase: datarouter
- service:
- name: dmaap-dr-db-svc
- portName: dmaap-dr-db-svc
- nfsprovisionerPrefix: dmaap-dr-db
- persistence:
- size: 1Gi
- mountSubPath: data-router/dr-db-data
- disableNfsProvisioner: true
\ No newline at end of file
# application images
repository: nexus3.onap.org:10001
-image: onap/dmaap/buscontroller:1.0.26
+image: onap/dmaap/buscontroller:1.0.23
# application configuration
apiVersion: v1
description: ONAP DMaaP Data Router Node Server
name: dmaap-dr-node
-version: 1.0
+version: 4.0.0
--- /dev/null
+#
+# ============LICENSE_START=======================================================
+# Copyright (C) 2019 Nordix Foundation.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+#
+
+dependencies:
+ - name: common
+ version: ~4.x-0
+ repository: '@local'
#!/bin/sh
-dr_prov_url="{{.Values.global.config.dmaapDrProv.name}}:{{.Values.global.config.dmaapDrProv.internalPort2}}"
+dr_prov_url="{{.Values.config.dmaapDrProv.name}}:{{.Values.config.dmaapDrProv.internalPort2}}"
ct_header="Content-Type:application/vnd.dmaap-dr.feed"
obo_header="X-DMAAP-DR-ON-BEHALF-OF:dradmin"
feed_payload=/opt/app/datartr/etc/dedicatedFeed.json
--- /dev/null
+<!--
+ ============LICENSE_START=======================================================
+ Copyright (C) 2019 Nordix Foundation.
+ ================================================================================
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+ SPDX-License-Identifier: Apache-2.0
+ ============LICENSE_END=========================================================
+-->
+<configuration scan="true" scanPeriod="3 seconds" debug="true">
+
+ <property name="generalLogName" value="apicalls" />
+ <property name="errorLogName" value="errors" />
+ <property name="jettyAndNodeLogName" value="node"/>
+
+ <property name="defaultPattern" value="%d{MM/dd-HH:mm:ss.SSS}|%logger|%X{RequestId}|%X{ServiceInstanceId}|%thread|%X{ServiceName}|%X{InstanceUUID}|%.-5level|%X{AlertSeverity}|%X{ServerIPAddress}|%X{ServerFQDN}|%X{RemoteHost}|%X{Timer}|%msg%n" />
+ <property name="jettyAndNodeLoggerPattern" value="%d{MM/dd-HH:mm:ss.SSS}|%logger|%thread|%.-5level|%msg%n" />
+ <property name="debugLoggerPattern" value="%d{MM/dd-HH:mm:ss.SSS}|%X{RequestId}|%X{ServiceInstanceId}|%thread|%X{ServiceName}|%X{InstanceUUID}|%.-5level|%X{AlertSeverity}|%X{ServerIPAddress}|%X{ServerFQDN}|%X{RemoteHost}|%X{Timer}|[%caller{3}]|%msg%n" />
+
+ <property name="logDirectory" value="/opt/app/datartr/logs" />
+
+ <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
+ <encoder>
+ <pattern>${defaultPattern}</pattern>
+ </encoder>
+ </appender>
+
+ <!-- ============================================================================ -->
+ <!-- EELF Appenders -->
+ <!-- ============================================================================ -->
+
+ <appender name="EELF"
+ class="ch.qos.logback.core.rolling.RollingFileAppender">
+ <file>${logDirectory}/${generalLogName}.log</file>
+ <filter class="ch.qos.logback.classic.filter.LevelFilter">
+ <level>INFO</level>
+ <onMatch>ACCEPT</onMatch>
+ <onMismatch>DENY</onMismatch>
+ </filter>
+ <rollingPolicy
+ class="ch.qos.logback.core.rolling.FixedWindowRollingPolicy">
+ <fileNamePattern>${logDirectory}/${generalLogName}.%i.log.zip
+ </fileNamePattern>
+ <minIndex>1</minIndex>
+ <maxIndex>9</maxIndex>
+ </rollingPolicy>
+ <triggeringPolicy
+ class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
+ <maxFileSize>5MB</maxFileSize>
+ </triggeringPolicy>
+ <encoder>
+ <pattern>${defaultPattern}</pattern>
+ </encoder>
+ </appender>
+
+ <appender name="asyncEELF" class="ch.qos.logback.classic.AsyncAppender">
+ <queueSize>256</queueSize>
+ <appender-ref ref="EELF" />
+ </appender>
+
+ <appender name="EELFError"
+ class="ch.qos.logback.core.rolling.RollingFileAppender">
+ <file>${logDirectory}/${errorLogName}.log</file>
+ <filter class="ch.qos.logback.classic.filter.LevelFilter">
+ <level>ERROR</level>
+ <onMatch>ACCEPT</onMatch>
+ <onMismatch>DENY</onMismatch>
+ </filter>
+ <rollingPolicy
+ class="ch.qos.logback.core.rolling.FixedWindowRollingPolicy">
+ <fileNamePattern>${logDirectory}/${errorLogName}.%i.log.zip
+ </fileNamePattern>
+ <minIndex>1</minIndex>
+ <maxIndex>9</maxIndex>
+ </rollingPolicy>
+ <triggeringPolicy
+ class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
+ <maxFileSize>5MB</maxFileSize>
+ </triggeringPolicy>
+ <encoder>
+ <pattern>${defaultPattern}</pattern>
+ </encoder>
+ </appender>
+
+ <appender name="asyncEELFError" class="ch.qos.logback.classic.AsyncAppender">
+ <queueSize>256</queueSize>
+ <appender-ref ref="EELFError"/>
+ </appender>
+
+ <!-- ============================================================================ -->
+ <appender name="jettyAndNodelog"
+ class="ch.qos.logback.core.rolling.RollingFileAppender">
+ <file>${logDirectory}/${jettyAndNodeLogName}.log</file>
+ <filter class="org.onap.dmaap.datarouter.node.eelf.EELFFilter" />
+ <rollingPolicy
+ class="ch.qos.logback.core.rolling.FixedWindowRollingPolicy">
+ <fileNamePattern>${logDirectory}/${jettyAndNodeLogName}.%i.log.zip
+ </fileNamePattern>
+ <minIndex>1</minIndex>
+ <maxIndex>9</maxIndex>
+ </rollingPolicy>
+ <triggeringPolicy
+ class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
+ <maxFileSize>5MB</maxFileSize>
+ </triggeringPolicy>
+ <encoder>
+ <pattern>${jettyAndNodeLoggerPattern}</pattern>
+ </encoder>
+ </appender>
+
+ <appender name="asyncEELFjettyAndNodelog" class="ch.qos.logback.classic.AsyncAppender">
+ <queueSize>256</queueSize>
+ <appender-ref ref="jettyAndNodelog" />
+ <includeCallerData>true</includeCallerData>
+ </appender>
+
+ <!-- ============================================================================ -->
+ <!-- EELF loggers -->
+ <!-- ============================================================================ -->
+ <logger name="com.att.eelf" level="info" additivity="false">
+ <appender-ref ref="asyncEELF" />
+ </logger>
+
+ <logger name="com.att.eelf.error" level="error" additivity="false">
+ <appender-ref ref="asyncEELFError" />
+ </logger>
+
+ <logger name="log4j.logger.org.eclipse.jetty" additivity="false" level="info">
+ <appender-ref ref="asyncEELFjettyAndNodelog"/>
+ </logger>
+
+ <root level="INFO">
+ <appender-ref ref="asyncEELF" />
+ <appender-ref ref="asyncEELFError" />
+ <appender-ref ref="asyncEELFjettyAndNodelog" />
+ </root>
+
+</configuration>
# URL to retrieve dynamic configuration
#
#ProvisioningURL: ${DRTR_PROV_INTURL}
-ProvisioningURL=https://{{.Values.global.config.dmaapDrProv.name}}:{{.Values.global.config.dmaapDrProv.externalPort2}}/internal/prov
+ProvisioningURL=https://{{.Values.config.dmaapDrProv.name}}:{{.Values.config.dmaapDrProv.externalPort2}}/internal/prov
#
# URL to upload PUB/DEL/EXP logs
#
#LogUploadURL: ${DRTR_LOG_URL}
-LogUploadURL=https://{{.Values.global.config.dmaapDrProv.name}}:{{.Values.global.config.dmaapDrProv.externalPort2}}/internal/logs
+LogUploadURL=https://{{.Values.config.dmaapDrProv.name}}:{{.Values.config.dmaapDrProv.externalPort2}}/internal/logs
#
# The port number for http as seen within the server
#
#IntHttpPort: ${DRTR_NODE_INTHTTPPORT:-8080}
-IntHttpPort={{.Values.global.config.dmaapDrNode.internalPort}}
+IntHttpPort={{.Values.config.dmaapDrNode.internalPort}}
#
# The port number for https as seen within the server
#
-IntHttpsPort={{.Values.global.config.dmaapDrNode.internalPort2}}
+IntHttpsPort={{.Values.config.dmaapDrNode.internalPort2}}
#
# The external port number for https taking port mapping into account
#
#
# The password for the https keystore
#
-KeyStorePassword=4*&GD+w58RUM]01No.CYY;z6
+KeyStorePassword=]3V)($O&.Mv]W{f8^]6SxGNL
#
# The password for the private key in the https keystore
#
-KeyPassword=4*&GD+w58RUM]01No.CYY;z6
+KeyPassword=]3V)($O&.Mv]W{f8^]6SxGNL
#
# The type of truststore for https
#
#
# The password for the https truststore
#
-TrustStorePassword=UDXlT6Iu[F)k,Htk92+B,0Xj
+TrustStorePassword=(Rd,&{]%ePdp}4JZjqoJ2G+g
#
# The path to the file used to trigger an orderly shutdown
#
{{- range .Values.ingress.hosts }}
http://{{ . }}
{{- end }}
-{{- else if contains "NodePort" .Values.global.config.dmaapDrNode.servicetype }}
+{{- else if contains "NodePort" .Values.config.dmaapDrNode.servicetype }}
export NODE_PORT=$(kubectl get --namespace {{ include "common.namespace" . }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "common.name" . }})
export NODE_IP=$(kubectl get nodes --namespace {{ include "common.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}")
echo http://$NODE_IP:$NODE_PORT
-{{- else if contains "LoadBalancer" .Values.global.config.dmaapDrNode.servicetype }}
+{{- else if contains "LoadBalancer" .Values.config.dmaapDrNode.servicetype }}
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
You can watch the status of by running 'kubectl get svc -w {{ include "common.name" . }}'
export SERVICE_IP=$(kubectl get svc --namespace {{ include "common.namespace" . }} {{ include "common.name" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
- echo http://$SERVICE_IP:{{.Values.global.config.dmaapDrNode.externalPort}}
-{{- else if contains "ClusterIP" .Values.global.config.dmaapDrNode.servicetype }}
+ echo http://$SERVICE_IP:{{.Values.config.dmaapDrNode.externalPort}}
+{{- else if contains "ClusterIP" .Values.config.dmaapDrNode.servicetype }}
export POD_NAME=$(kubectl get pods --namespace {{ include "common.namespace" . }} -l "app={{ include "common.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
echo "Visit http://127.0.0.1:8080 to use your application"
- kubectl port-forward $POD_NAME 8080:{{.Values.global.config.dmaapDrNode.internalPort}}
+ kubectl port-forward $POD_NAME 8080:{{.Values.config.dmaapDrNode.internalPort}}
{{- end }}
\ No newline at end of file
heritage: {{ .Release.Service }}
data:
{{ tpl (.Files.Glob "resources/config/feeds/*").AsConfig . | indent 2 }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: {{ include "common.fullname" . }}-log
+ namespace: {{ include "common.namespace" . }}
+data:
+{{ tpl (.Files.Glob "resources/config/logback.xml").AsConfig . | indent 2 }}
--- /dev/null
+{{/*
+ # ============LICENSE_START=======================================================
+ # Copyright (C) 2019 Nordix Foundation.
+ # ================================================================================
+ # Licensed under the Apache License, Version 2.0 (the "License");
+ # you may not use this file except in compliance with the License.
+ # You may obtain a copy of the License at
+ #
+ # http://www.apache.org/licenses/LICENSE-2.0
+ #
+ # Unless required by applicable law or agreed to in writing, software
+ # distributed under the License is distributed on an "AS IS" BASIS,
+ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ # See the License for the specific language governing permissions and
+ # limitations under the License.
+ #
+ # SPDX-License-Identifier: Apache-2.0
+ # ============LICENSE_END=========================================================
+*/}}
+
+kind: PersistentVolume
+apiVersion: v1
+metadata:
+ name: {{ include "common.fullname" . }}-spool-data-pv
+ namespace: {{ include "common.namespace" . }}
+ labels:
+ app: {{ include "common.name" . }}
+ chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
+ release: "{{ .Release.Name }}"
+ heritage: "{{ .Release.Service }}"
+ name: {{ include "common.fullname" . }}-spool-data-pv
+spec:
+ capacity:
+ storage: {{ .Values.persistence.spoolSize }}
+ accessModes:
+ - {{ .Values.persistence.accessMode }}
+ storageClassName: "{{ include "common.fullname" . }}-spool-data-stcl"
+ persistentVolumeReclaimPolicy: {{ .Values.persistence.volumeReclaimPolicy }}
+ hostPath:
+ path: {{ .Values.persistence.mountPath }}/{{ .Release.Name }}/{{ .Values.persistence.spoolMountSubPath }}
+---
+kind: PersistentVolume
+apiVersion: v1
+metadata:
+ name: {{ include "common.fullname" . }}-event-logs-pv
+ namespace: {{ include "common.namespace" . }}
+ labels:
+ app: {{ include "common.name" . }}
+ chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
+ release: "{{ .Release.Name }}"
+ heritage: "{{ .Release.Service }}"
+ name: {{ include "common.fullname" . }}-event-logs-pv
+spec:
+ capacity:
+ storage: {{ .Values.persistence.eventLogSize }}
+ accessModes:
+ - {{ .Values.persistence.accessMode }}
+ storageClassName: "{{ include "common.fullname" . }}-event-logs-stcl"
+ persistentVolumeReclaimPolicy: {{ .Values.persistence.volumeReclaimPolicy }}
+ hostPath:
+ path: {{ .Values.persistence.mountPath }}/{{ .Release.Name }}/{{ .Values.persistence.eventLogsMountSubPath }}
\ No newline at end of file
apiVersion: v1
kind: Service
metadata:
- name: {{.Values.global.config.dmaapDrNode.name}}
+ name: {{.Values.config.dmaapDrNode.name}}
namespace: {{ include "common.namespace" . }}
labels:
app: {{ include "common.name" . }}
annotations:
service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
spec:
- type: {{.Values.global.config.dmaapDrNode.servicetype}}
+ type: {{.Values.config.dmaapDrNode.servicetype}}
ports:
- {{if eq .Values.global.config.dmaapDrNode.servicetype "NodePort" -}}
- - port: {{.Values.global.config.dmaapDrNode.externalPort}}
- targetPort: {{.Values.global.config.dmaapDrNode.internalPort}}
- nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{.Values.global.config.dmaapDrNode.nodePort}}
- name: {{.Values.global.config.dmaapDrNode.name}}
- - port: {{.Values.global.config.dmaapDrNode.externalPort2}}
- targetPort: {{.Values.global.config.dmaapDrNode.internalPort2}}
- nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{.Values.global.config.dmaapDrNode.nodePort2}}
- name: {{.Values.global.config.dmaapDrNode.name}}2
+ {{if eq .Values.config.dmaapDrNode.servicetype "NodePort" -}}
+ - port: {{.Values.config.dmaapDrNode.externalPort}}
+ targetPort: {{.Values.config.dmaapDrNode.internalPort}}
+ nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{.Values.config.dmaapDrNode.nodePort}}
+ name: {{.Values.config.dmaapDrNode.name}}
+ - port: {{.Values.config.dmaapDrNode.externalPort2}}
+ targetPort: {{.Values.config.dmaapDrNode.internalPort2}}
+ nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{.Values.config.dmaapDrNode.nodePort2}}
+ name: {{.Values.config.dmaapDrNode.name}}2
{{- else -}}
- - port: {{.Values.global.config.dmaapDrNode.externalPort}}
- targetPort: {{.Values.global.config.dmaapDrNode.internalPort}}
- name: {{.Values.global.config.dmaapDrNode.name}}
- - port: {{.Values.global.config.dmaapDrNode.externalPort2}}
- targetPort: {{.Values.global.config.dmaapDrNode.internalPort2}}
- name: {{.Values.global.config.dmaapDrNode.name}}2
+ - port: {{.Values.config.dmaapDrNode.externalPort}}
+ targetPort: {{.Values.config.dmaapDrNode.internalPort}}
+ name: {{.Values.config.dmaapDrNode.name}}
+ - port: {{.Values.config.dmaapDrNode.externalPort2}}
+ targetPort: {{.Values.config.dmaapDrNode.internalPort2}}
+ name: {{.Values.config.dmaapDrNode.name}}2
{{- end}}
selector:
app: {{ include "common.name" . }}
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
-apiVersion: extensions/v1beta1
-kind: Deployment
+apiVersion: apps/v1beta1
+kind: StatefulSet
metadata:
name: {{ include "common.fullname" . }}
namespace: {{ include "common.namespace" . }}
heritage: {{ .Release.Service }}
spec:
replicas: {{ .Values.replicaCount }}
+ serviceName: {{ .Values.config.dmaapDrNode.name }}
template:
metadata:
labels:
app: {{ include "common.name" . }}
release: {{ .Release.Name }}
spec:
- hostname: {{.Values.global.config.dmaapDrNode.name}}
initContainers:
- name: {{ include "common.name" . }}-readiness
image: "{{ .Values.global.readinessRepository }}/{{ .Values.global.readinessImage }}"
- /root/ready.py
args:
- --container-name
- - {{.Values.global.config.dmaapDrProv.name}}
+ - dmaap-dr-prov
env:
- name: NAMESPACE
valueFrom:
image: "{{ include "common.repository" . }}/{{ .Values.image }}"
imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
ports:
- - containerPort: {{.Values.global.config.dmaapDrNode.externalPort}}
- - containerPort: {{.Values.global.config.dmaapDrNode.externalPort2}}
+ - containerPort: {{.Values.config.dmaapDrNode.externalPort}}
+ - containerPort: {{.Values.config.dmaapDrNode.externalPort2}}
{{- if eq .Values.liveness.enabled true }}
livenessProbe:
tcpSocket:
- port: {{.Values.global.config.dmaapDrNode.internalPort}}
+ port: {{.Values.config.dmaapDrNode.internalPort}}
initialDelaySeconds: {{ .Values.liveness.initialDelaySeconds }}
periodSeconds: {{ .Values.liveness.periodSeconds }}
{{ end -}}
readinessProbe:
tcpSocket:
- port: {{.Values.global.config.dmaapDrNode.internalPort}}
+ port: {{.Values.config.dmaapDrNode.internalPort}}
initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }}
periodSeconds: {{ .Values.readiness.periodSeconds }}
volumeMounts:
+ - mountPath: {{ .Values.persistence.spoolPath }}
+ name: {{ include "common.fullname" . }}-spool-data-pvc
+ - mountPath: {{ .Values.persistence.eventLogsPath }}
+ name: {{ include "common.fullname" . }}-event-logs-pvc
- mountPath: /etc/localtime
name: localtime
readOnly: false
postStart:
exec:
command:
- - /opt/app/datartr/etc/createFeed.sh
+ - /opt/app/datartr/etc/createFeed.sh
resources:
{{ include "common.resources" . | indent 12 }}
{{- if .Values.nodeSelector }}
affinity:
{{ toYaml .Values.affinity | indent 10 }}
{{- end }}
- volumes:
- - name: localtime
- hostPath:
- path: /etc/localtime
- - name: create-feed
- configMap:
- name: {{ include "common.fullname" . }}-create-feed-configmap
- defaultMode: 0755
- - name: node-props
- configMap:
- name: {{ include "common.fullname" . }}-node-props-configmap
- - name: dr-node-data
- {{- if .Values.persistence.enabled }}
- persistentVolumeClaim:
- claimName: {{ include "common.fullname" . }}
- {{- else }}
- emptyDir: {}
- {{- end }}
+ # Filebeat sidecar container
+ - name: {{ include "common.name" . }}-filebeat-onap
+ image: "{{ .Values.global.loggingRepository }}/{{ .Values.global.loggingImage }}"
+ imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+ volumeMounts:
+ - name: {{ include "common.fullname" . }}-filebeat-conf
+ mountPath: /usr/share/filebeat/filebeat.yml
+ subPath: filebeat.yml
+ - name: {{ include "common.fullname" . }}-data-filebeat
+ mountPath: /usr/share/filebeat/data
+ - name: {{ include "common.fullname" . }}-event-logs-pvc
+ mountPath: /var/log/onap/datarouter-node
imagePullSecrets:
- name: "{{ include "common.namespace" . }}-docker-registry-key"
+ volumes:
+ - name: localtime
+ hostPath:
+ path: /etc/localtime
+ - name: create-feed
+ configMap:
+ name: {{ include "common.fullname" . }}-create-feed-configmap
+ defaultMode: 0755
+ - name: node-props
+ configMap:
+ name: {{ include "common.fullname" . }}-node-props-configmap
+ - name: {{ include "common.fullname" . }}-log-conf
+ configMap:
+ name: {{ include "common.fullname" . }}-log
+ - name: {{ include "common.fullname" . }}-filebeat-conf
+ configMap:
+ name: {{ .Release.Name }}-dmaap-filebeat-configmap
+ - name: {{ include "common.fullname" . }}-data-filebeat
+ emptyDir: {}
+ - name: {{ include "common.fullname" . }}-event-logs-pvc
+ emptyDir: {}
+ volumeClaimTemplates:
+ - metadata:
+ name: {{ include "common.fullname" . }}-spool-data-pvc
+ labels:
+ name: {{ include "common.fullname" . }}
+ spec:
+ accessModes: [ {{ .Values.persistence.accessMode }} ]
+ storageClassName: {{ include "common.fullname" . }}-spool-data-stcl
+ resources:
+ requests:
+ storage: {{ .Values.persistence.spoolSize }}
+ selector:
+ matchLabels:
+ name: {{ include "common.fullname" . }}-spool-data-pv
+ - metadata:
+ name: {{ include "common.fullname" . }}-event-logs-pvc
+ labels:
+ name: {{ include "common.fullname" . }}
+ spec:
+ accessModes: [ {{ .Values.persistence.accessMode }} ]
+ storageClassName: {{ include "common.fullname" . }}-event-logs-stcl
+ resources:
+ requests:
+ storage: {{ .Values.persistence.eventLogSize }}
+ selector:
+ matchLabels:
+ name: {{ include "common.fullname" . }}-event-logs-pv
readinessImage: readiness-check:2.0.0
loggingRepository: docker.elastic.co
loggingImage: beats/filebeat:5.5.0
+ loggingDirectory: /opt/app/datartr/logs
#################################################################
# Application configuration defaults.
#################################################################
# application image
repository: nexus3.onap.org:10001
-image: onap/dmaap/datarouter-node:2.0.0
+image: onap/dmaap/datarouter-node:2.0.1
pullPolicy: Always
# flag to enable debugging - application support required
## Persist data to a persitent volume
persistence:
- enabled: false
+ volumeReclaimPolicy: Retain
+ accessMode: ReadWriteMany
+ mountPath: /dockerdata-nfs
+
+ spoolMountSubPath: data-router/dr-node/spool-data
+ spoolSize: 1Gi
+ spoolPath: /opt/app/datartr/spool
+
+ eventLogsMountSubPath: data-router/dr-node/event-logs
+ eventLogSize: 1Gi
+ eventLogsPath: /opt/app/datartr/logs
ingress:
enabled: false
cpu: 1000m
memory: 2Gi
unlimited: {}
+
+config:
+ # dr node server configuration
+ dmaapDrNode:
+ servicetype: ClusterIP
+ name: dmaap-dr-node
+ externalPort: 8080
+ externalPort2: 8443
+ internalPort: 8080
+ internalPort2: 8443
+ portName: dr-node-port
+ portName2: dr-node-port2
+
+# dr provisioning server configuration
+ dmaapDrProv:
+ name: dmaap-dr-prov
+ externalPort2: 8443
+ internalPort2: 8443
apiVersion: v1
description: ONAP DMaaP Data Router Provisioning Server
name: dmaap-dr-prov
-version: 1.0
+version: 4.0.0
--- /dev/null
+#
+# ============LICENSE_START=======================================================
+# Copyright (C) 2019 Nordix Foundation.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+#
+
+dependencies:
+ - name: common
+ version: ~4.x-0
+ repository: '@local'
+ - name: mariadb-galera
+ alias: mariadb
+ version: ~4.x-0
+ repository: '@local'
\ No newline at end of file
--- /dev/null
+<!--
+ ============LICENSE_START=======================================================
+ Copyright (C) 2019 Nordix Foundation.
+ ================================================================================
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+ SPDX-License-Identifier: Apache-2.0
+ ============LICENSE_END=========================================================
+-->
+<configuration scan="true" scanPeriod="3 seconds" debug="true">
+
+ <property name="generalLogName" value="apicalls" />
+ <property name="errorLogName" value="errors" />
+ <property name="jettyLogName" value="jetty"/>
+
+ <property name="defaultPattern" value="%d{MM/dd-HH:mm:ss.SSS}|%logger|%X{RequestId}|%X{ServiceInstanceId}|%thread|%X{ServiceName}|%X{InstanceUUID}|%.-5level|%X{AlertSeverity}|%X{ServerIPAddress}|%X{ServerFQDN}|%X{RemoteHost}|%X{Timer}|%msg%n" />
+ <property name="jettyLoggerPattern" value="%d{MM/dd-HH:mm:ss.SSS}|%logger|%thread|%.-5level|%msg%n" />
+ <property name="debugLoggerPattern" value="%d{MM/dd-HH:mm:ss.SSS}|%X{RequestId}|%X{ServiceInstanceId}|%thread|%X{ServiceName}|%X{InstanceUUID}|%.-5level|%X{AlertSeverity}|%X{ServerIPAddress}|%X{ServerFQDN}|%X{RemoteHost}|%X{Timer}|[%caller{3}]|%msg%n" />
+
+ <property name="logDirectory" value="/opt/app/datartr/logs" />
+
+ <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
+ <encoder>
+ <pattern>${defaultPattern}</pattern>
+ </encoder>
+ </appender>
+
+ <!-- ============================================================================ -->
+ <!-- EELF Appenders -->
+ <!-- ============================================================================ -->
+
+ <appender name="EELF"
+ class="ch.qos.logback.core.rolling.RollingFileAppender">
+ <file>${logDirectory}/${generalLogName}.log</file>
+ <filter class="ch.qos.logback.classic.filter.LevelFilter">
+ <level>INFO</level>
+ <onMatch>ACCEPT</onMatch>
+ <onMismatch>DENY</onMismatch>
+ </filter>
+ <rollingPolicy
+ class="ch.qos.logback.core.rolling.FixedWindowRollingPolicy">
+ <fileNamePattern>${logDirectory}/${generalLogName}.%i.log.zip
+ </fileNamePattern>
+ <minIndex>1</minIndex>
+ <maxIndex>9</maxIndex>
+ </rollingPolicy>
+ <triggeringPolicy
+ class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
+ <maxFileSize>5MB</maxFileSize>
+ </triggeringPolicy>
+ <encoder>
+ <pattern>${defaultPattern}</pattern>
+ </encoder>
+ </appender>
+
+ <appender name="asyncEELF" class="ch.qos.logback.classic.AsyncAppender">
+ <queueSize>256</queueSize>
+ <appender-ref ref="EELF" />
+ </appender>
+
+ <appender name="EELFError"
+ class="ch.qos.logback.core.rolling.RollingFileAppender">
+ <file>${logDirectory}/${errorLogName}.log</file>
+ <filter class="ch.qos.logback.classic.filter.LevelFilter">
+ <level>ERROR</level>
+ <onMatch>ACCEPT</onMatch>
+ <onMismatch>DENY</onMismatch>
+ </filter>
+ <rollingPolicy
+ class="ch.qos.logback.core.rolling.FixedWindowRollingPolicy">
+ <fileNamePattern>${logDirectory}/${errorLogName}.%i.log.zip
+ </fileNamePattern>
+ <minIndex>1</minIndex>
+ <maxIndex>9</maxIndex>
+ </rollingPolicy>
+ <triggeringPolicy
+ class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
+ <maxFileSize>5MB</maxFileSize>
+ </triggeringPolicy>
+ <encoder>
+ <pattern>${defaultPattern}</pattern>
+ </encoder>
+ </appender>
+
+ <appender name="asyncEELFError" class="ch.qos.logback.classic.AsyncAppender">
+ <queueSize>256</queueSize>
+ <appender-ref ref="EELFError"/>
+ </appender>
+
+ <!-- ============================================================================ -->
+ <appender name="jettylog"
+ class="ch.qos.logback.core.rolling.RollingFileAppender">
+ <file>${logDirectory}/${jettyLogName}.log</file>
+ <filter class="org.onap.dmaap.datarouter.provisioning.eelf.JettyFilter" />
+ <rollingPolicy
+ class="ch.qos.logback.core.rolling.FixedWindowRollingPolicy">
+ <fileNamePattern>${logDirectory}/${jettyLogName}.%i.log.zip
+ </fileNamePattern>
+ <minIndex>1</minIndex>
+ <maxIndex>9</maxIndex>
+ </rollingPolicy>
+ <triggeringPolicy
+ class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
+ <maxFileSize>5MB</maxFileSize>
+ </triggeringPolicy>
+ <encoder>
+ <pattern>${jettyLoggerPattern}</pattern>
+ </encoder>
+ </appender>
+
+ <appender name="asyncEELFjettylog" class="ch.qos.logback.classic.AsyncAppender">
+ <queueSize>256</queueSize>
+ <appender-ref ref="jettylog" />
+ <includeCallerData>true</includeCallerData>
+ </appender>
+
+ <!-- ============================================================================ -->
+ <!-- EELF loggers -->
+ <!-- ============================================================================ -->
+ <logger name="com.att.eelf" level="info" additivity="false">
+ <appender-ref ref="asyncEELF" />
+ </logger>
+
+ <logger name="com.att.eelf.error" level="error" additivity="false">
+ <appender-ref ref="asyncEELFError" />
+ </logger>
+
+ <logger name="log4j.logger.org.eclipse.jetty" additivity="false" level="info">
+ <appender-ref ref="asyncEELFjettylog"/>
+ </logger>
+
+ <root level="INFO">
+ <appender-ref ref="asyncEELF" />
+ <appender-ref ref="asyncEELFError" />
+ <appender-ref ref="asyncEELFjettylog" />
+ </root>
+
+</configuration>
#Jetty Server properties
-org.onap.dmaap.datarouter.provserver.http.port = {{.Values.global.config.dmaapDrProv.externalPort}}
-org.onap.dmaap.datarouter.provserver.https.port = {{.Values.global.config.dmaapDrProv.externalPort2}}
+org.onap.dmaap.datarouter.provserver.http.port = {{.Values.config.dmaapDrProv.externalPort}}
+org.onap.dmaap.datarouter.provserver.https.port = {{.Values.config.dmaapDrProv.externalPort2}}
org.onap.dmaap.datarouter.provserver.https.relaxation = true
-org.onap.dmaap.datarouter.provserver.keymanager.password = Qgw77oaQcdP*F8Pwa[&.,.Ab
+org.onap.dmaap.datarouter.provserver.keymanager.password = AT{];bvaDiytVD&oWhMZj0N5
org.onap.dmaap.datarouter.provserver.keystore.type = jks
org.onap.dmaap.datarouter.provserver.keystore.path = /opt/app/datartr/aaf_certs/org.onap.dmaap-dr.jks
-org.onap.dmaap.datarouter.provserver.keystore.password = Qgw77oaQcdP*F8Pwa[&.,.Ab
+org.onap.dmaap.datarouter.provserver.keystore.password = AT{];bvaDiytVD&oWhMZj0N5
org.onap.dmaap.datarouter.provserver.truststore.path = /opt/app/datartr/aaf_certs/org.onap.dmaap-dr.trust.jks
-org.onap.dmaap.datarouter.provserver.truststore.password = 9M?)?:KAj1z6gpLhNrVUG@0T
+org.onap.dmaap.datarouter.provserver.truststore.password = ljlS@Y}0]{UO(TnwvEWkgJ%]
org.onap.dmaap.datarouter.provserver.accesslog.dir = /opt/app/datartr/logs
org.onap.dmaap.datarouter.provserver.spooldir = /opt/app/datartr/spool
org.onap.dmaap.datarouter.provserver.dbscripts = /opt/app/datartr/etc/misc
# Database access
org.onap.dmaap.datarouter.db.driver = org.mariadb.jdbc.Driver
-org.onap.dmaap.datarouter.db.url = jdbc:mariadb://{{.Values.global.config.dmaapDrDb.mariadbServiceName}}:{{.Values.global.config.dmaapDrDb.mariadbServicePort}}/datarouter
+org.onap.dmaap.datarouter.db.url = jdbc:mariadb://{{.Values.config.dmaapDrDb.mariadbServiceName}}:{{.Values.config.dmaapDrDb.mariadbServicePort}}/datarouter
org.onap.dmaap.datarouter.db.login = datarouter
org.onap.dmaap.datarouter.db.password = datarouter
{{- range .Values.ingress.hosts }}
http://{{ . }}
{{- end }}
-{{- else if contains "NodePort" .Values.global.config.dmaapDrProv.servicetype }}
+{{- else if contains "NodePort" .Values.config.dmaapDrProv.servicetype }}
export NODE_PORT=$(kubectl get --namespace {{ include "common.namespace" . }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "common.name" . }})
export NODE_IP=$(kubectl get nodes --namespace {{ include "common.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}")
echo http://$NODE_IP:$NODE_PORT
-{{- else if contains "LoadBalancer" .Values.global.config.dmaapDrProv.servicetype }}
+{{- else if contains "LoadBalancer" .Values.config.dmaapDrProv.servicetype }}
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
You can watch the status of by running 'kubectl get svc -w {{ include "common.name" . }}'
export SERVICE_IP=$(kubectl get svc --namespace {{ include "common.namespace" . }} {{ include "common.name" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
- echo http://$SERVICE_IP:{{.Values.global.config.dmaapDrProv.externalPort}}
-{{- else if contains "ClusterIP" .Values.global.config.dmaapDrProv.servicetype }}
+ echo http://$SERVICE_IP:{{.Values.config.dmaapDrProv.externalPort}}
+{{- else if contains "ClusterIP" .Values.config.dmaapDrProv.servicetype }}
export POD_NAME=$(kubectl get pods --namespace {{ include "common.namespace" . }} -l "app={{ include "common.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
echo "Visit http://127.0.0.1:8080 to use your application"
- kubectl port-forward $POD_NAME 8080:{{.Values.global.config.dmaapDrProv.internalPort}}
+ kubectl port-forward $POD_NAME 8080:{{.Values.config.dmaapDrProv.internalPort}}
{{- end }}
heritage: {{ .Release.Service }}
data:
{{ tpl (.Files.Glob "resources/config/provserver.properties").AsConfig . | indent 2 }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: {{ include "common.fullname" . }}-log
+ namespace: {{ include "common.namespace" . }}
+data:
+{{ tpl (.Files.Glob "resources/config/logback.xml").AsConfig . | indent 2 }}
app: {{ include "common.name" . }}
release: {{ .Release.Name }}
spec:
- hostname: {{.Values.global.config.dmaapDrProv.name}}
+ hostname: {{.Values.config.dmaapDrProv.name}}
initContainers:
- command:
- /root/ready.py
args:
- --container-name
- - {{.Values.global.config.dmaapDrDb.mariadbContName}}
+ - {{.Values.config.dmaapDrDb.mariadbContName}}
env:
- name: NAMESPACE
valueFrom:
image: "{{ include "common.repository" . }}/{{ .Values.image }}"
imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
ports:
- - containerPort: {{.Values.global.config.dmaapDrProv.externalPort}}
- - containerPort: {{.Values.global.config.dmaapDrProv.externalPort2}}
+ - containerPort: {{.Values.config.dmaapDrProv.externalPort}}
+ - containerPort: {{.Values.config.dmaapDrProv.externalPort2}}
{{- if eq .Values.liveness.enabled true }}
livenessProbe:
tcpSocket:
- port: {{.Values.global.config.dmaapDrProv.externalPort}}
+ port: {{.Values.config.dmaapDrProv.externalPort}}
initialDelaySeconds: {{ .Values.liveness.initialDelaySeconds }}
periodSeconds: {{ .Values.liveness.periodSeconds }}
{{ end -}}
readinessProbe:
tcpSocket:
- port: {{.Values.global.config.dmaapDrProv.externalPort}}
+ port: {{.Values.config.dmaapDrProv.externalPort}}
initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }}
periodSeconds: {{ .Values.readiness.periodSeconds }}
volumeMounts:
- mountPath: /opt/app/datartr/etc/provserver.properties
subPath: provserver.properties
name: prov-props
+ - name: {{ include "common.fullname" . }}-logs
+ mountPath: {{ .Values.global.loggingDirectory }}
resources:
{{ include "common.resources" . | indent 12 }}
{{- if .Values.nodeSelector }}
affinity:
{{ toYaml .Values.affinity | indent 10 }}
{{- end }}
+ # Filebeat sidecar container
+ - name: {{ include "common.name" . }}-filebeat-onap
+ image: "{{ .Values.global.loggingRepository }}/{{ .Values.global.loggingImage }}"
+ imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+ volumeMounts:
+ - name: {{ include "common.fullname" . }}-filebeat-conf
+ mountPath: /usr/share/filebeat/filebeat.yml
+ subPath: filebeat.yml
+ - name: {{ include "common.fullname" . }}-data-filebeat
+ mountPath: /usr/share/filebeat/data
+ - name: {{ include "common.fullname" . }}-logs
+ mountPath: /var/log/onap/datarouter-prov
volumes:
- name: localtime
hostPath:
- name: prov-props
configMap:
name: {{ include "common.fullname" . }}-prov-props-configmap
- - name: dr-prov-data
- {{- if .Values.persistence.enabled }}
- persistentVolumeClaim:
- claimName: {{ include "common.fullname" . }}
- {{- else }}
+ - name: {{ include "common.fullname" . }}-log-conf
+ configMap:
+ name: {{ include "common.fullname" . }}-log
+ - name: {{ include "common.fullname" . }}-filebeat-conf
+ configMap:
+ name: {{ .Release.Name }}-dmaap-filebeat-configmap
+ - name: {{ include "common.fullname" . }}-data-filebeat
+ emptyDir: {}
+ - name: {{ include "common.fullname" . }}-logs
emptyDir: {}
- {{- end }}
imagePullSecrets:
- name: "{{ include "common.namespace" . }}-docker-registry-key"
apiVersion: v1
kind: Service
metadata:
- name: {{.Values.global.config.dmaapDrProv.name}}
+ name: {{.Values.config.dmaapDrProv.name}}
namespace: {{ include "common.namespace" . }}
labels:
app: {{ include "common.name" . }}
service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
msb.onap.org/service-info: '[
{
- "serviceName": "{{.Values.global.config.dmaapDrProv.name}}",
+ "serviceName": "{{.Values.config.dmaapDrProv.name}}",
"version": "v1",
"url": "/",
"protocol": "REST",
- "port": "{{.Values.global.config.dmaapDrProv.externalPort}}",
+ "port": "{{.Values.config.dmaapDrProv.externalPort}}",
"visualRange":"1"
}
]'
spec:
- type: {{.Values.global.config.dmaapDrProv.servicetype}}
+ type: {{.Values.config.dmaapDrProv.servicetype}}
ports:
- {{if eq .Values.global.config.dmaapDrProv.servicetype "NodePort" -}}
- - port: {{.Values.global.config.dmaapDrProv.externalPort}}
- targetPort: {{.Values.global.config.dmaapDrProv.internalPort}}
- nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{.Values.global.config.dmaapDrProv.nodePort}}
- name: {{.Values.global.config.dmaapDrProv.name}}
- - port: {{.Values.global.config.dmaapDrProv.externalPort2}}
- targetPort: {{.Values.global.config.dmaapDrProv.internalPort2}}
- nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{.Values.global.config.dmaapDrProv.nodePort2}}
- name: {{.Values.global.config.dmaapDrProv.name}}2
+ {{if eq .Values.config.dmaapDrProv.servicetype "NodePort" -}}
+ - port: {{.Values.config.dmaapDrProv.externalPort}}
+ targetPort: {{.Values.config.dmaapDrProv.internalPort}}
+ nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{.Values.config.dmaapDrProv.nodePort}}
+ name: {{.Values.config.dmaapDrProv.name}}
+ - port: {{.Values.config.dmaapDrProv.externalPort2}}
+ targetPort: {{.Values.config.dmaapDrProv.internalPort2}}
+ nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{.Values.config.dmaapDrProv.nodePort2}}
+ name: {{.Values.config.dmaapDrProv.name}}2
{{- else -}}
- - port: {{.Values.global.config.dmaapDrProv.externalPort}}
- targetPort: {{.Values.global.config.dmaapDrProv.internalPort}}
- name: {{.Values.global.config.dmaapDrProv.name}}
- - port: {{.Values.global.config.dmaapDrProv.externalPort2}}
- targetPort: {{.Values.global.config.dmaapDrProv.internalPort2}}
- name: {{.Values.global.config.dmaapDrProv.name}}2
+ - port: {{.Values.config.dmaapDrProv.externalPort}}
+ targetPort: {{.Values.config.dmaapDrProv.internalPort}}
+ name: {{.Values.config.dmaapDrProv.name}}
+ - port: {{.Values.config.dmaapDrProv.externalPort2}}
+ targetPort: {{.Values.config.dmaapDrProv.internalPort2}}
+ name: {{.Values.config.dmaapDrProv.name}}2
{{- end}}
selector:
app: {{ include "common.name" . }}
--- /dev/null
+# Copyright © 2017 Amdocs, Bell Canada
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#################################################################
+# Global configuration defaults.
+#################################################################
+global:
+ nodePortPrefix: 302
+ readinessRepository: oomk8s
+ readinessImage: readiness-check:2.0.0
+ loggingRepository: docker.elastic.co
+ loggingImage: beats/filebeat:5.5.0
+ loggingDirectory: /opt/app/datartr/logs
+
+#################################################################
+# Application configuration defaults.
+#################################################################
+# application image
+repository: nexus3.onap.org:10001
+image: onap/dmaap/datarouter-prov:2.0.1
+pullPolicy: Always
+
+# flag to enable debugging - application support required
+debugEnabled: false
+
+# application configuration - see parent values chart
+
+# default number of instances
+replicaCount: 1
+
+nodeSelector: {}
+
+affinity: {}
+
+# probe configuration parameters
+liveness:
+ initialDelaySeconds: 30
+ periodSeconds: 10
+ # necessary to disable liveness probe when setting breakpoints
+ # in debugger so K8s doesn't restart unresponsive container
+ enabled: true
+
+readiness:
+ initialDelaySeconds: 30
+ periodSeconds: 10
+
+## Persist data to a persitent volume
+persistence:
+ enabled: false
+
+ingress:
+ enabled: false
+
+# Resource Limit flavor -By Default using small
+flavor: small
+# Segregation for Different environment (Small and Large)
+resources:
+ small:
+ limits:
+ cpu: 2000m
+ memory: 4Gi
+ requests:
+ cpu: 500m
+ memory: 1Gi
+ large:
+ limits:
+ cpu: 4000m
+ memory: 8Gi
+ requests:
+ cpu: 1000m
+ memory: 2Gi
+ unlimited: {}
+
+config:
+ # dr provisioning server configuration
+ dmaapDrProv:
+ servicetype: NodePort
+ name: dmaap-dr-prov
+ externalPort: 8080
+ externalPort2: 8443
+ internalPort: 8080
+ internalPort2: 8443
+ portName: dr-prov-port
+ portName2: dr-prov-port2
+ nodePort: 59
+ nodePort2: 69
+ # dr-prov db configuration
+ dmaapDrDb:
+ mariadbServiceName: dmaap-dr-db-svc
+ mariadbServicePort: 3306
+ mariadbContName: dmaap-dr-db
+
+# mariadb-galera configuration
+mariadb:
+ name: dmaap-dr-db
+ nameOverride: dmaap-dr-db
+ replicaCount: 2
+ config:
+ mariadbRootPassword: datarouter
+ userName: datarouter
+ userPassword: datarouter
+ mysqlDatabase: datarouter
+ service:
+ name: dmaap-dr-db-svc
+ portName: dmaap-dr-db-svc
+ nfsprovisionerPrefix: dmaap-dr-db
+ persistence:
+ size: 1Gi
+ mountSubPath: data-router/dr-db-data
+ disableNfsProvisioner: true
\ No newline at end of file
spec:
selector:
matchLabels:
- app: {{ include "common.fullname" . }}
+ app: {{ include "common.name" . }}
maxUnavailable: 1
name: docker-socket
- mountPath: /kafka
name: kafka-data
+ {{- if .Values.tolerations }}
+ tolerations:
+ {{ toYaml .Values.tolerations | indent 10 }}
+ {{- end }}
volumes:
- name: localtime
hostPath:
affinity: {}
+tolerations: {}
+
# probe configuration parameters
liveness:
initialDelaySeconds: 60
spec:
selector:
matchLabels:
- app: {{ include "common.fullname" . }}
- maxUnavailable: 1
+ app: {{ include "common.name" . }}
+ maxUnavailable: {{ div (sub .Values.replicaCount 1) 2 }}
readOnly: true
- mountPath: /var/lib/zookeeper/data
name: zookeeper-data
+ {{- if .Values.tolerations }}
+ tolerations:
+ {{ toYaml .Values.tolerations | indent 10 }}
+ {{- end }}
volumes:
- name: localtime
hostPath:
affinity: {}
+tolerations: {}
+
# probe configuration parameters
liveness:
initialDelaySeconds: 10
- name: common
version: ~4.x-0
repository: '@local'
+ - name: message-router
+ version: ~4.x-0
+ repository: 'file://components/message-router'
+ condition: message-router.enabled
+ - name: dmaap-bus-controller
+ version: ~4.x-0
+ repository: 'file://components/dmaap-bus-controller'
+ condition: dmaap-bus-controller.enabled
+ - name: dmaap-dr-node
+ version: ~4.x-0
+ repository: 'file://components/dmaap-dr-node'
+ condition: dmaap-dr-node.enabled
+ - name: dmaap-dr-prov
+ version: ~4.x-0
+ repository: 'file://components/dmaap-dr-prov'
+ condition: dmaap-dr-prov.enabled
--- /dev/null
+# ============LICENSE_START=======================================================
+# Copyright (C) 2019 The Nordix Foundation. All rights reserved.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+
+filebeat.prospectors:
+#it is mandatory, in our case it's log
+- input_type: log
+ #This is the canolical path as mentioned in logback.xml, *.* means it will monitor all files in the directory.
+ paths:
+ - /var/log/onap/*/*/*/*.log
+ - /var/log/onap/*/*/*.log
+ - /var/log/onap/*/*.log
+ - /opt/app/datartr/logs/*.log
+ #Files older than this should be ignored.In our case it will be 48 hours i.e. 2 days. It is a helping flag for clean_inactive
+ ignore_older: 48h
+ # Remove the registry entry for a file that is more than the specified time. In our case it will be 96 hours, i.e. 4 days. It will help to keep registry records with in limit
+ clean_inactive: 96h
+
+
+# Name of the registry file. If a relative path is used, it is considered relative to the
+# data path. Else full qualified file name.
+#filebeat.registry_file: ${path.data}/registry
+
+
+output.logstash:
+ #List of logstash server ip addresses with port number.
+ #But, in our case, this will be the loadbalancer IP address.
+ #For the below property to work the loadbalancer or logstash should expose 5044 port to listen the filebeat events or port in the property should be changed appropriately.
+ hosts: ["{{.Values.config.logstashServiceName}}.{{.Release.Namespace}}:{{.Values.config.logstashPort}}"]
+ #If enable will do load balancing among available Logstash, automatically.
+ loadbalance: true
+
+ #The list of root certificates for server verifications.
+ #If certificate_authorities is empty or not set, the trusted
+ #certificate authorities of the host system are used.
+ #ssl.certificate_authorities: $ssl.certificate_authorities
+
+ #The path to the certificate for SSL client authentication. If the certificate is not specified,
+ #client authentication is not available.
+ #ssl.certificate: $ssl.certificate
+
+ #The client certificate key used for client authentication.
+ #ssl.key: $ssl.key
+
+ #The passphrase used to decrypt an encrypted key stored in the configured key file
+ #ssl.key_passphrase: $ssl.key_passphrase
\ No newline at end of file
--- /dev/null
+#
+# ============LICENSE_START=======================================================
+# Copyright (C) 2019 Nordix Foundation.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+#
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: {{ .Release.Name }}-dmaap-filebeat-configmap
+ namespace: {{ include "common.namespace" . }}
+data:
+{{ tpl (.Files.Glob "resources/config/log/filebeat/filebeat.yml").AsConfig . | indent 2 }}
\ No newline at end of file
readinessImage: readiness-check:2.0.0
loggingRepository: docker.elastic.co
loggingImage: beats/filebeat:5.5.0
+# application configuration
+config:
+ logstashServiceName: log-ls
+ logstashPort: 5044
+
+message-router:
+ enabled: true
+dmaap-bus-controller:
+ enabled: true
+dmaap-dr-node:
+ enabled: true
+dmaap-dr-prov:
+ enabled: true
\ No newline at end of file
version: ~4.x-0
repository: '@local'
condition: appc.enabled
+ - name: cassandra
+ version: ~4.x-0
+ repository: '@local'
+ condition: cassandra.enabled
- name: clamp
version: ~4.x-0
repository: '@local'
enabled: false
appc:
enabled: false
+cassandra:
+ enabled: false
clamp:
enabled: false
cli:
--- /dev/null
+# Copyright © 2019 Amdocs, Bell Canada
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+###################################################################
+# This override file enables helm charts for all ONAP applications.
+###################################################################
+aaf:
+ enabled: true
+aai:
+ enabled: true
+appc:
+ enabled: true
+cassandra:
+ enabled: true
+clamp:
+ enabled: true
+cli:
+ enabled: true
+consul:
+ enabled: true
+contrib:
+ enabled: true
+dcaegen2:
+ enabled: true
+dmaap:
+ enabled: true
+esr:
+ enabled: true
+log:
+ enabled: true
+sniro-emulator:
+ enabled: true
+oof:
+ enabled: true
+msb:
+ enabled: true
+multicloud:
+ enabled: true
+nbi:
+ enabled: true
+policy:
+ enabled: true
+pomba:
+ enabled: true
+portal:
+ enabled: true
+robot:
+ enabled: true
+sdc:
+ enabled: true
+sdnc:
+ enabled: true
+so:
+ enabled: true
+uui:
+ enabled: true
+vfc:
+ enabled: true
+vid:
+ enabled: true
+vnfsdk:
+ enabled: true
# to customize the ONAP deployment.
#################################################################
aaf:
- enabled: true
+ enabled: false
aai:
- enabled: true
+ enabled: false
appc:
- enabled: true
+ enabled: false
config:
openStackType: OpenStackProvider
openStackName: OpenStack
openStackDomain: default
openStackUserName: admin
openStackEncryptedPassword: admin
+cassandra:
+ enabled: false
clamp:
- enabled: true
+ enabled: false
cli:
- enabled: true
+ enabled: false
consul:
- enabled: true
+ enabled: false
contrib:
- enabled: true
+ enabled: false
dcaegen2:
- enabled: true
+ enabled: false
pnda:
enabled: false
dmaap:
- enabled: true
+ enabled: false
esr:
- enabled: true
+ enabled: false
log:
- enabled: true
+ enabled: false
sniro-emulator:
- enabled: true
+ enabled: false
oof:
- enabled: true
+ enabled: false
msb:
- enabled: true
+ enabled: false
multicloud:
- enabled: true
+ enabled: false
nbi:
- enabled: true
+ enabled: false
config:
# openstack configuration
openStackRegion: "Yolo"
openStackVNFTenantId: "1234"
policy:
- enabled: true
+ enabled: false
pomba:
- enabled: true
+ enabled: false
portal:
- enabled: true
+ enabled: false
robot:
- enabled: true
+ enabled: false
config:
# openStackEncryptedPasswordHere should match the encrypted string used in SO and APPC and overridden per environment
openStackEncryptedPasswordHere: "c124921a3a0efbe579782cde8227681e"
sdc:
- enabled: true
+ enabled: false
sdnc:
- enabled: true
+ enabled: false
replicaCount: 1
mysql:
replicaCount: 1
so:
- enabled: true
+ enabled: false
replicaCount: 1
liveness:
# necessary to disable liveness probe when setting breakpoints
# in debugger so K8s doesn't restart unresponsive container
- enabled: true
+ enabled: false
# so server configuration
config:
config:
mariadbRootPassword: password
uui:
- enabled: true
+ enabled: false
vfc:
- enabled: true
+ enabled: false
vid:
- enabled: true
+ enabled: false
vnfsdk:
- enabled: true
+ enabled: false
# See the License for the specific language governing permissions and
# limitations under the License.
+# JVM options
+
+JVM_OPTIONS=-server -Xms1024m -Xmx2048m
+
# SYSTEM software configuration
POLICY_HOME=/opt/app/policy
POLICY_LOGS=/var/log/onap/policy/pdpd
-JAVA_HOME=/usr/lib/jvm/java-8-openjdk-amd64
+JAVA_HOME=/usr/lib/jvm/java-1.8-openjdk
KEYSTORE_PASSWD=Pol1cy_0nap
TRUSTSTORE_PASSWD=Pol1cy_0nap
PDPD_CONFIGURATION_CONSUMER_INSTANCE=
PDPD_CONFIGURATION_PARTITION_KEY=
+# PAP-PDP configuration channel
+
+POLICY_PDP_PAP_TOPIC=POLICY-PDP-PAP
+POLICY_PDP_PAP_API_KEY=
+POLICY_PDP_PAP_API_SECRET=
+
# PAP
PAP_HOST={{.Values.global.pap.nameOverride}}
--- /dev/null
+# ============LICENSE_START=======================================================
+# Copyright (C) 2019 AT&T Intellectual Property. All rights reserved.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+
+apiVersion: v1
+description: ONAP Policy Design API
+name: policy-api
+version: 4.0.0
--- /dev/null
+# ============LICENSE_START=======================================================
+# Copyright (C) 2019 AT&T Intellectual Property. All rights reserved.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+
+dependencies:
+ - name: common
+ version: ~4.x-0
+ repository: '@local'
--- /dev/null
+# ============LICENSE_START=======================================================
+# Copyright (C) 2019 AT&T Intellectual Property. All rights reserved.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+{
+ "name":"ApiGroup",
+ "restServerParameters":{
+ "host":"0.0.0.0",
+ "port":6969,
+ "userName":"healthcheck",
+ "password":"zb!XztG34"
+ }
+}
--- /dev/null
+# ============LICENSE_START=======================================================
+# Copyright (C) 2019 AT&T Intellectual Property. All rights reserved.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: {{ include "common.fullname" . }}-configmap
+ namespace: {{ include "common.namespace" . }}
+data:
+{{ tpl (.Files.Glob "resources/config/config.json").AsConfig . | indent 2 }}
--- /dev/null
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+ name: {{ include "common.fullname" . }}
+ namespace: {{ include "common.namespace" . }}
+ labels:
+ app: {{ include "common.name" . }}
+ chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
+spec:
+ replicas: {{ .Values.replicaCount }}
+ template:
+ metadata:
+ labels:
+ app: {{ include "common.name" . }}
+ release: {{ .Release.Name }}
+ spec:
+ containers:
+ - name: {{ include "common.name" . }}
+ image: "{{ include "common.repository" . }}/{{ .Values.image }}"
+ imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+ command: ["/opt/app/policy/api/bin/policy-api.sh"]
+ args: ["/opt/app/policy/api/etc/mounted/config.json"]
+ ports:
+ - containerPort: {{ .Values.service.internalPort }}
+ # disable liveness probe when breakpoints set in debugger
+ # so K8s doesn't restart unresponsive container
+ {{- if eq .Values.liveness.enabled true }}
+ livenessProbe:
+ tcpSocket:
+ port: {{ .Values.service.internalPort }}
+ initialDelaySeconds: {{ .Values.liveness.initialDelaySeconds }}
+ periodSeconds: {{ .Values.liveness.periodSeconds }}
+ {{ end -}}
+ readinessProbe:
+ tcpSocket:
+ port: {{ .Values.service.internalPort }}
+ initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }}
+ periodSeconds: {{ .Values.readiness.periodSeconds }}
+ volumeMounts:
+ - mountPath: /etc/localtime
+ name: localtime
+ readOnly: true
+ - mountPath: /opt/app/policy/api/etc/mounted
+ name: apiconfig
+ resources:
+{{ include "common.resources" . | indent 12 }}
+ {{- if .Values.nodeSelector }}
+ nodeSelector:
+{{ toYaml .Values.nodeSelector | indent 10 }}
+ {{- end -}}
+ {{- if .Values.affinity }}
+ affinity:
+{{ toYaml .Values.affinity | indent 10 }}
+ {{- end }}
+ volumes:
+ - name: localtime
+ hostPath:
+ path: /etc/localtime
+ - name: apiconfig
+ configMap:
+ name: {{ include "common.fullname" . }}-configmap
+ defaultMode: 0755
+ imagePullSecrets:
+ - name: "{{ include "common.namespace" . }}-docker-registry-key"
--- /dev/null
+# ============LICENSE_START=======================================================
+# Copyright (C) 2019 AT&T Intellectual Property. All rights reserved.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+
+apiVersion: v1
+kind: Service
+metadata:
+ name: {{ include "common.servicename" . }}
+ namespace: {{ include "common.namespace" . }}
+ labels:
+ app: {{ include "common.name" . }}
+ chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
+spec:
+ type: {{ .Values.service.type }}
+ ports:
+ {{if eq .Values.service.type "NodePort" -}}
+ - port: {{ .Values.service.internalPort }}
+ nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort }}
+ name: {{ .Values.service.portName }}
+ {{- else -}}
+ - port: {{ .Values.service.internalPort }}
+ targetPort: {{ .Values.service.internalPort }}
+ name: {{ .Values.service.portName }}
+ {{- end}}
+ selector:
+ app: {{ include "common.name" . }}
+ release: {{ .Release.Name }}
--- /dev/null
+# ============LICENSE_START=======================================================
+# Copyright (C) 2019 AT&T Intellectual Property. All rights reserved.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+
+#################################################################
+# Global configuration defaults.
+#################################################################
+global:
+ nodePortPrefix: 304
+ persistence: {}
+
+#################################################################
+# Application configuration defaults.
+#################################################################
+# application image
+repository: nexus3.onap.org:10001
+image: onap/policy-api:2.0.0-SNAPSHOT-latest
+pullPolicy: Always
+
+# flag to enable debugging - application support required
+debugEnabled: false
+
+# application configuration
+
+# default number of instances
+replicaCount: 1
+
+nodeSelector: {}
+
+affinity: {}
+
+# probe configuration parameters
+liveness:
+ initialDelaySeconds: 20
+ periodSeconds: 10
+ # necessary to disable liveness probe when setting breakpoints
+ # in debugger so K8s doesn't restart unresponsive container
+ enabled: true
+
+readiness:
+ initialDelaySeconds: 20
+ periodSeconds: 10
+
+service:
+ type: ClusterIP
+ name: policy-api
+ portName: policy-api
+ internalPort: 6969
+ nodePort: 40
+
+ingress:
+ enabled: false
+
+resources: {}
# See the License for the specific language governing permissions and
# limitations under the License.
-JAVA_HOME=/usr/lib/jvm/java-8-openjdk-amd64
+JAVA_HOME=/usr/lib/jvm/java-1.8-openjdk
POLICY_HOME=/opt/app/policy
POLICY_LOGS=/var/log/onap
KEYSTORE_PASSWD=Pol1cy_0nap
--- /dev/null
+# ============LICENSE_START=======================================================
+# Copyright (C) 2019 Nordix Foundation.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+
+apiVersion: v1
+description: ONAP Policy Administration (PAP)
+name: policy-pap
+version: 4.0.0
--- /dev/null
+# ============LICENSE_START=======================================================
+# Copyright (C) 2019 Nordix Foundation.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+
+dependencies:
+ - name: common
+ version: ~4.x-0
+ repository: '@local'
--- /dev/null
+# ============LICENSE_START=======================================================
+# Copyright (C) 2019 Nordix Foundation.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+{
+ "name":"PapGroup",
+ "restServerParameters":{
+ "host":"0.0.0.0",
+ "port":6969,
+ "userName":"healthcheck",
+ "password":"zb!XztG34"
+ }
+}
--- /dev/null
+# ============LICENSE_START=======================================================
+# Copyright (C) 2019 Nordix Foundation.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range .Values.ingress.hosts }}
+ http://{{ . }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+ export NODE_PORT=$(kubectl get --namespace {{ include "common.namespace" . }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "common.name" . }})
+ export NODE_IP=$(kubectl get nodes --namespace {{ include "common.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}")
+ echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+ NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+ You can watch the status of by running 'kubectl get svc -w {{ include "common.name" . }}'
+ export SERVICE_IP=$(kubectl get svc --namespace {{ include "common.namespace" . }} {{ include "common.name" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
+ echo http://$SERVICE_IP:{{ .Values.service.externalPort }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+ export POD_NAME=$(kubectl get pods --namespace {{ include "common.namespace" . }} -l "app={{ include "common.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+ echo "Visit http://127.0.0.1:8080 to use your application"
+ kubectl port-forward $POD_NAME 8080:{{ .Values.service.internalPort }}
+{{- end }}
--- /dev/null
+# ============LICENSE_START=======================================================
+# Copyright (C) 2019 Nordix Foundation.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: {{ include "common.fullname" . }}-configmap
+ namespace: {{ include "common.namespace" . }}
+data:
+{{ tpl (.Files.Glob "resources/config/config.json").AsConfig . | indent 2 }}
+
--- /dev/null
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+ name: {{ include "common.fullname" . }}
+ namespace: {{ include "common.namespace" . }}
+ labels:
+ app: {{ include "common.name" . }}
+ chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
+spec:
+ replicas: {{ .Values.replicaCount }}
+ template:
+ metadata:
+ labels:
+ app: {{ include "common.name" . }}
+ release: {{ .Release.Name }}
+ spec:
+ containers:
+ - name: {{ include "common.name" . }}
+ image: "{{ include "common.repository" . }}/{{ .Values.image }}"
+ imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+ command: ["/opt/app/policy/pap/bin/policy-pap.sh"]
+ args: ["/opt/app/policy/pap/etc/mounted/config.json"]
+ ports:
+ - containerPort: {{ .Values.service.internalPort }}
+ # disable liveness probe when breakpoints set in debugger
+ # so K8s doesn't restart unresponsive container
+ {{- if eq .Values.liveness.enabled true }}
+ livenessProbe:
+ tcpSocket:
+ port: {{ .Values.service.internalPort }}
+ initialDelaySeconds: {{ .Values.liveness.initialDelaySeconds }}
+ periodSeconds: {{ .Values.liveness.periodSeconds }}
+ {{ end -}}
+ readinessProbe:
+ tcpSocket:
+ port: {{ .Values.service.internalPort }}
+ initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }}
+ periodSeconds: {{ .Values.readiness.periodSeconds }}
+ volumeMounts:
+ - mountPath: /etc/localtime
+ name: localtime
+ readOnly: true
+ - mountPath: /opt/app/policy/pap/etc/mounted
+ name: papconfig
+ resources:
+{{ include "common.resources" . | indent 12 }}
+ {{- if .Values.nodeSelector }}
+ nodeSelector:
+{{ toYaml .Values.nodeSelector | indent 10 }}
+ {{- end -}}
+ {{- if .Values.affinity }}
+ affinity:
+{{ toYaml .Values.affinity | indent 10 }}
+ {{- end }}
+ volumes:
+ - name: localtime
+ hostPath:
+ path: /etc/localtime
+ - name: papconfig
+ configMap:
+ name: {{ include "common.fullname" . }}-configmap
+ defaultMode: 0755
+ imagePullSecrets:
+ - name: "{{ include "common.namespace" . }}-docker-registry-key"
--- /dev/null
+# ============LICENSE_START=======================================================
+# Copyright (C) 2019 Nordix Foundation.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+
+apiVersion: v1
+kind: Service
+metadata:
+ name: {{ include "common.servicename" . }}
+ namespace: {{ include "common.namespace" . }}
+ labels:
+ app: {{ include "common.name" . }}
+ chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
+spec:
+ ports:
+ - port: {{ .Values.service.internalPort }}
+ name: {{ .Values.service.portName }}
+ selector:
+ app: {{ include "common.name" . }}
+ release: {{ .Release.Name }}
+ clusterIP: None
--- /dev/null
+# ============LICENSE_START=======================================================
+# Copyright (C) 2019 Nordix Foundation.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+
+#################################################################
+# Global configuration defaults.
+#################################################################
+global:
+ persistence: {}
+
+#################################################################
+# Application configuration defaults.
+#################################################################
+# application image
+repository: nexus3.onap.org:10001
+image: onap/policy-pap:2.0.0-SNAPSHOT-latest
+pullPolicy: Always
+
+# flag to enable debugging - application support required
+debugEnabled: false
+
+# application configuration
+
+# default number of instances
+replicaCount: 1
+
+nodeSelector: {}
+
+affinity: {}
+
+# probe configuration parameters
+liveness:
+ initialDelaySeconds: 20
+ periodSeconds: 10
+ # necessary to disable liveness probe when setting breakpoints
+ # in debugger so K8s doesn't restart unresponsive container
+ enabled: true
+
+readiness:
+ initialDelaySeconds: 20
+ periodSeconds: 10
+
+service:
+ type: ClusterIP
+ name: policy-pap
+ portName: policy-pap
+ internalPort: 6969
+
+ingress:
+ enabled: false
+
+resources: {}
http.userId={{ .Values.config.httpUserId }}
http.password={{ .Values.config.httpPassword }}
-aai.searchNodeQuery=/aai/v13/search/nodes-query?search-node-type=service-instance&filter=service-instance-id:EQUALS:
+aai.searchNodeQuery=/aai/v13/nodes/service-instance/{0}
#Servlet context parameters
server.context_parameters.p-name=value #context parameter with p-name as key and value as value.
aai.http.userId={{ .Values.config.aaiHttpUserId }}
aai.http.password={{ .Values.config.aaiHttpPassword }}
-aai.searchNodeQuery=/aai/v13/search/nodes-query?search-node-type=service-instance&filter=service-instance-id:EQUALS:
-aai.customerQuery=/aai/v13/business/customers/customer/
-aai.serviceInstancePath=/aai/v13/business/customers/customer/{0}/service-subscriptions/service-subscription/{1}/service-instances/service-instance/{2}
+aai.serviceInstanceQuery=/aai/v13/nodes/service-instance/{0}
# SDNC REST Client Configuration
sdnc.serviceName={{ .Values.config.sdncServiceName }}.{{.Release.Namespace}}
-<configuration>\r
- <property name="p_tim" value="%d{"yyyy-MM-dd'T'HH:mm:ss.SSSXXX", UTC}"/>\r
- <property name="p_lvl" value="%level"/>\r
- <property name="p_log" value="%logger"/>\r
- <property name="p_mdc" value="%replace(%replace(%mdc){'\t','\\\\t'}){'\n', '\\\\n'}"/>\r
- <property name="p_msg" value="%replace(%replace(%msg){'\t', '\\\\t'}){'\n','\\\\n'}"/>\r
- <property name="p_exc" value="%replace(%replace(%rootException){'\t', '\\\\t'}){'\n','\\\\n'}"/>\r
- <!-- tabs -->\r
- <property name="p_mak" value="%replace(%replace(%marker){'\t', '\\\\t'}){'\n','\\\\n'}"/>\r
- <property name="p_thr" value="%thread"/>\r
- <property name="pattern" value="%nopexception${p_tim}\t${p_thr}\t${p_lvl}\t${p_log}\t${p_mdc}\t${p_msg}\t${p_exc}\t${p_mak}\t%n"/>\r
- <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">\r
- <encoder>\r
- <pattern>${pattern}</pattern>\r
- </encoder>\r
- </appender>\r
- <appender name="FILE" class="ch.qos.logback.core.FileAppender">\r
- <file>output.log</file>\r
- <encoder>\r
- <pattern>${pattern}</pattern>\r
- </encoder>\r
- </appender>\r
- <logger level="INFO" name="org.onap.logging.ref.slf4j" additivity="false">\r
- <appender-ref ref="STDOUT" />\r
- <appender-ref ref="FILE" />\r
- </logger>\r
- <root level="INFO">\r
- <appender-ref ref="STDOUT" />\r
- </root>\r
-</configuration>\r
+<configuration>
+ <property name="p_tim" value="%d{"yyyy-MM-dd'T'HH:mm:ss.SSSXXX", UTC}"/>
+ <property name="p_lvl" value="%level"/>
+ <property name="p_log" value="%logger"/>
+ <property name="p_mdc" value="%replace(%replace(%mdc){'\t','\\\\t'}){'\n', '\\\\n'}"/>
+ <property name="p_msg" value="%replace(%replace(%msg){'\t', '\\\\t'}){'\n','\\\\n'}"/>
+ <property name="p_exc" value="%replace(%replace(%rootException){'\t', '\\\\t'}){'\n','\\\\n'}"/>
+ <!-- tabs -->
+ <property name="p_mak" value="%replace(%replace(%marker){'\t', '\\\\t'}){'\n','\\\\n'}"/>
+ <property name="p_thr" value="%thread"/>
+ <property name="pattern" value="%nopexception${p_tim}\t${p_thr}\t${p_lvl}\t${p_log}\t${p_mdc}\t${p_msg}\t${p_exc}\t${p_mak}\t%n"/>
+ <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
+ <encoder>
+ <pattern>${pattern}</pattern>
+ </encoder>
+ </appender>
+ <appender name="FILE" class="ch.qos.logback.core.FileAppender">
+ <file>logs/EELF/output.log</file>
+ <encoder>
+ <pattern>${pattern}</pattern>
+ </encoder>
+ </appender>
+ <logger level="INFO" name="org.onap.logging.ref.slf4j" additivity="false">
+ <appender-ref ref="STDOUT" />
+ <appender-ref ref="FILE" />
+ </logger>
+ <root level="INFO">
+ <appender-ref ref="STDOUT" />
+ <appender-ref ref="FILE" />
+ </root>
+</configuration>
\ No newline at end of file
name 'Attribute-comparison'
attributes 'context-list.ndcb.vnfList[*].vfModuleList[*].vmList[*]', 'context-list.aai.vnfList[*].vfModuleList[*].vmList[*]'
}
+
+ // NDCB-AAI comparison: P-Interface list
+ useRule {
+ name 'Attribute-comparison'
+ attributes 'context-list.ndcb.pnfList[*].pInterfaceList[*]', 'context-list.aai.pnfList[*].pInterfaceList[*]'
+ }
// SDNC-AAI comparison: Context level
-- vid
update fn_app set app_username='Default', app_password='2VxipM8Z3SETg32m3Gp0FvKS6zZ2uCbCw46WDyK6T5E=', ueb_key='2Re7Pvdkgw5aeAUD', auth_central = 'Y' , auth_namespace = 'org.onap.vid' where app_id = 6;
-- aai sparky
-update fn_app set app_username='aaiui', app_password='4LK69amiIFtuzcl6Gsv97Tt7MLhzo03aoOx7dTvdjKQ=', ueb_key='ueb_key' where app_id = 7;
\ No newline at end of file
+update fn_app set app_username='aaiui', app_password='4LK69amiIFtuzcl6Gsv97Tt7MLhzo03aoOx7dTvdjKQ=', ueb_key='ueb_key_7' where app_id = 7;
\ No newline at end of file
--- /dev/null
+# Copyright © 2018 Amdocs, Bell Canada
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+{{- if .Values.ingress.enabled }}
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+ name: {{ include "common.fullname" . }}-ingress
+ namespace: {{ include "common.namespace" . }}
+ labels:
+ app: {{ include "common.name" . }}
+ chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
+{{- with .Values.ingress.annotations }}
+ annotations:
+{{ toYaml . | indent 4 }}
+{{- end }}
+spec:
+ rules:
+ - http:
+ paths:
+ - path: /workflows/
+ backend:
+ serviceName: {{.Values.service.name}}
+ servicePort: {{.Values.service.internalPort}}
+{{ end }}
+
ingress:
enabled: false
+ annotations:
+ ingress.kubernetes.io/secure-backends: "false"
+ nginx.ingress.kubernetes.io/secure-backends: "false"
+ nginx.ingress.kubernetes.io/proxy-body-size: "0"
+ nginx.ingress.kubernetes.io/ssl-redirect: "true"
+ nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+ nginx.ingress.kubernetes.io/rewrite-target: /workflows/
+ nginx.ingress.kubernetes.io/server-snippet: |
+ underscores_in_headers on;
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
- name: common
version: ~4.x-0
repository: '@local'
- - name: controller-blueprints
+ - name: cds
version: ~4.x-0
repository: '@local'
+ condition: cds.enabled
- name: mysql
version: ~4.x-0
repository: '@local'
javaHome: /usr/lib/jvm/java-1.8-openjdk
# dependency / sub-chart configuration
+cds:
+ enabled: true
+
dmaap-listener:
nameOverride: sdnc-dmaap-listener
config:
# See the License for the specific language governing permissions and
# limitations under the License.
aai:
- auth: 65885E7C4E860E420808030D8BC653073E6782CB5026EC8F49E3E5C6F3E27F6A
+ auth: 221187EFA3AD4E33600DE0488F287099934CE65C3D0697BCECC00BB58E784E07CD74A24581DC31DBC086FF63DF116378776E9BE3D1325885
dme2:
timeout: '30000'
endpoint: https://aai.{{ include "common.namespace" . }}:8443
workflowAaiDistributionDelay: PT30S
pnfEntryNotificationTimeout: P14D
+cds:
+ endpoint: blueprints-processor
+ port: 9111
+ auth: Basic Y2NzZGthcHBzOmNjc2RrYXBwcw==
camunda:
bpm:
admin-user:
endpoint: http://so-request-db-adapter.{{ include "common.namespace" . }}:8083
auth: Basic YnBlbDpwYXNzd29yZDEk
db:
- auth: 33293332AEC4930F655D8E2E8BB08937
+ auth: A3745B5DBE165EFCF101D85A6FC81C211AB8BF604F8861B6C413D5DC90F8F30E0139DE44B8A342F4EF70AF
password: wLg4sjrAFUS8rfVfdvTXeQ==
endpoint: http://so-request-db-adapter.{{ include "common.namespace" . }}:8083/services/RequestsDbAdapter
spring:
db:
endpoint: http://so-request-db-adapter.{{ include "common.namespace" . }}:8083/services/RequestsDbAdapter
po:
- auth: 33293332AEC4930F655D8E2E8BB08937
- password: B8EBDE0311F0AF355CF3F2FD505A8CAD
+ auth: A3745B5DBE165EFCF101D85A6FC81C211AB8BF604F8861B6C413D5DC90F8F30E0139DE44B8A342F4EF70AF
sdnc:
endpoint: http://so-sdnc-adapter.{{ include "common.namespace" . }}:8086/adapters/SDNCAdapter
rest:
endpoint: http://so-request-db-adapter.{{ include "common.namespace" . }}:8083/
rollback: 'true'
sdnc:
- password: 3141634BF7E070AA289CF2892C986C0B
+ password: 1D78CFC35382B6938A989066A7A7EAEF4FE933D2919BABA99EB4763737F39876C333EE5F
service:
agnostic:
sniro:
#Actuator
management:
context-path: /manage
+cloud_config:
+ identity_services:
+ RAX_KEYSTONE:
+ identity_url: "https://identity.api.rackspacecloud.com/v2.0"
+ mso_id: "RACKSPACE_ACCOUNT_ID"
+ mso_pass: "RACKSPACE_ACCOUNT_APIKEY"
+ admin_tenant: "{{ .Values.config.openStackServiceTenantName }}"
+ member_role: "admin"
+ tenant_metadata: true
+ identity_server_type: "KEYSTONE"
+ identity_authentication_type: "RACKSPACE_APIKEY"
+ DEFAULT_KEYSTONE:
+ identity_url: "{{ .Values.config.openStackKeyStoneUrl }}"
+ mso_id: "{{ .Values.config.openStackUserName }}"
+ mso_pass: "{{ .Values.config.openStackEncryptedPasswordHere }}"
+ admin_tenant: "{{ .Values.config.openStackServiceTenantName }}"
+ member_role: "admin"
+ tenant_metadata: true
+ identity_server_type: "KEYSTONE"
+ identity_authentication_type: "USERNAME_PASSWORD"
+ cloud_sites:
+ Dallas:
+ region_id: "DFW"
+ clli: "DFW"
+ aic_version: "2.5"
+ identity_service_id: "RAX_KEYSTONE"
+ Northern Virginia:
+ region_id: "IAD"
+ clli: "IAD"
+ aic_version: "2.5"
+ identity_service_id: "RAX_KEYSTONE"
+ Chicago:
+ region_id: "ORD"
+ clli: "ORD"
+ aic_version: "2.5"
+ identity_service_id: "RAX_KEYSTONE"
+ RegionOne:
+ region_id: "RegionOne"
+ clli: "RegionOne"
+ aic_version: "2.5"
+ identity_service_id: "DEFAULT_KEYSTONE"
+ DEFAULT:
+ region_id: "{{ .Values.config.openStackRegion }}"
+ clli: "{{ .Values.config.openStackRegion }}"
+ aic_version: "2.5"
+ identity_service_id: "DEFAULT_KEYSTONE"
nameOverride: so-mariadb
ingress:
enabled: false
+config:
+ openStackUserName: "vnf_user"
+ openStackRegion: "RegionOne"
+ openStackKeyStoneUrl: "http://1.2.3.4:5000/v2.0"
+ openStackServiceTenantName: "service"
+ openStackEncryptedPasswordHere: "c124921a3a0efbe579782cde8227681e"
+ openStackTenantId: "d570c718cbc545029f40e50b75eb13df"
nodeSelector: {}
tolerations: []
affinity: {}
config:
mariadbRootPassword: password
# gerrit branch where the latest heat code is checked in
- gerritBranch: 3.0.0-ONAP
+ gerritBranch: master
# gerrit project where the latest heat code is checked in
gerritProject: http://gerrit.onap.org/r/so/docker-config.git
# default number of instances
default_keystone_url_version: /v2.0
default_keystone_reg_ex: "/[vV][0-9]"
vnf:
- bpelauth: A7FC9B308B7AF7A269072BA729A345625E0381E3071DE7EE50603677CB69C515
+ bpelauth: D1A67FA93B6A6419132D0F83CC771AF774FD3C60853C50C22C8C6FC5088CC79E9E81EDE9EA39F22B2F66A0068E
checkRequiredParameters: true
addGetFilesOnVolumeReq: false
sockettimeout: 30
valet_enabled: false
fail_requests_on_valet_failure: false
network:
- bpelauth: A7FC9B308B7AF7A269072BA729A345625E0381E3071DE7EE50603677CB69C515
+ bpelauth: D1A67FA93B6A6419132D0F83CC771AF774FD3C60853C50C22C8C6FC5088CC79E9E81EDE9EA39F22B2F66A0068E
sockettimeout: 5
connecttimeout: 5
retrycount: 5
retryinterval: -15
retrylist: 408,429,500,502,503,504,900
+ encryptionKey: 07a7159d3bf51a0e53be7a8f89699be7
tenant:
default_keystone_url_version: /v2.0
default_keystone_reg_ex: "/[vV][0-9]"
pollTimeout: 7500
pollInterval: 15
mso:
- auth: F35F6A4C9EC66785785AF7E5C03494ED4D87955A32DAF5D6F54AB2DCDC8F2F8EAE168B4F5AD52D9298184019E304C968BE23
+ auth: D1A67FA93B6A6419132D0F83CC771AF774FD3C60853C50C22C8C6FC5088CC79E9E81EDE9EA39F22B2F66A0068E
logPath: ./logs/openstack
workflow:
- endpoint: http://so-bpmn-infra-svc:8081/sobpmnengine
+ endpoint: http://so-bpmn-infra.{{ include "common.namespace" . }}:8081/sobpmnengine
msoKey: 07a7159d3bf51a0e53be7a8f89699be7
config:
cadi:
- aafId: infraportal
+ aafId: poBpmn
catalog:
db:
spring:
core-pool-size: 50
max-pool-size: 50
queue-capacity: 500
-cloud_config:
- identity_services:
- RAX_KEYSTONE:
- identity_url: "https://identity.api.rackspacecloud.com/v2.0"
- mso_id: "RACKSPACE_ACCOUNT_ID"
- mso_pass: "RACKSPACE_ACCOUNT_APIKEY"
- admin_tenant: "{{ .Values.config.openStackServiceTenantName }}"
- member_role: "admin"
- tenant_metadata: true
- identity_server_type: "KEYSTONE"
- identity_authentication_type: "RACKSPACE_APIKEY"
- DEFAULT_KEYSTONE:
- identity_url: "{{ .Values.config.openStackKeyStoneUrl }}"
- mso_id: "{{ .Values.config.openStackUserName }}"
- mso_pass: "{{ .Values.config.openStackEncryptedPasswordHere }}"
- admin_tenant: "{{ .Values.config.openStackServiceTenantName }}"
- member_role: "admin"
- tenant_metadata: true
- identity_server_type: "KEYSTONE"
- identity_authentication_type: "USERNAME_PASSWORD"
- cloud_sites:
- Dallas:
- region_id: "DFW"
- clli: "DFW"
- aic_version: "2.5"
- identity_service_id: "RAX_KEYSTONE"
- Northern Virginia:
- region_id: "IAD"
- clli: "IAD"
- aic_version: "2.5"
- identity_service_id: "RAX_KEYSTONE"
- Chicago:
- region_id: "ORD"
- clli: "ORD"
- aic_version: "2.5"
- identity_service_id: "RAX_KEYSTONE"
- RegionOne:
- region_id: "RegionOne"
- clli: "RegionOne"
- aic_version: "2.5"
- identity_service_id: "DEFAULT_KEYSTONE"
- DEFAULT:
- region_id: "{{ .Values.config.openStackRegion }}"
- clli: "{{ .Values.config.openStackRegion }}"
- aic_version: "2.5"
- identity_service_id: "DEFAULT_KEYSTONE"
# See the License for the specific language governing permissions and
# limitations under the License.
aai:
- auth: 65885E7C4E860E420808030D8BC653073E6782CB5026EC8F49E3E5C6F3E27F6A
+ auth: 2A11B07DB6214A839394AA1EC5844695F5114FC407FF5422625FB00175A3DCB8A1FF745F22867EFA72D5369D599BBD88DA8BED4233CF5586
server:
port: {{ index .Values.containerPort }}
spring:
username: ${DB_USERNAME}
password: ${DB_PASSWORD}
driver-class-name: org.mariadb.jdbc.Driver
- dbcp2:
- initial-size: 5
- max-total: 20
- validation-query: select 1
- test-on-borrow: true
mso:
msoKey: 07a7159d3bf51a0e53be7a8f89699be7
logPath: ./logs/sdc
consumerId: SO-COpenSource-Env11
environmentName: AUTO
asdcAddress: sdc-be.{{ include "common.namespace" . }}:8443
- password: 613AF3483E695524F9857643B697FA51C7A9A0951094F53791485BF3458F9EADA37DBACCCEBD0CB242B85B4062745247
+ password: 76966BDD3C7414A03F7037264FF2E6C8EEC6C28F2B67F2840A1ED857C0260FEE731D73F47F828E5527125D29FD25D3E0DE39EE44C058906BF1657DE77BF897EECA93BDC07FA64F
pollingInterval: 60
pollingTimeout: 60
relevantArtifactTypes: HEAT,HEAT_ENV,HEAT_VOL
changedelete: POST|270000|sdncurl6|sdnc-request-header|org:onap:sdnctl:vnf
delete: POST|270000|sdncurl6|sdnc-request-header|org:onap:sdnctl:vnf
rollback: POST|270000|sdncurl6|sdnc-request-header|org:onap:sdnctl:vnf
- bpelauth: 023A0244AB819A0DE0131DBC3AC5FAB4D8544E1CB1A7FE3CE60F6E3292AC0D93
+ bpelauth: 4C18603C5AE7E3A42A6CED95CDF9C0BA9B2109B3725747662E5D34E5FDF63DA9ADEBB08185098F14699195FDE9475100
bpelurl: http://so-bpmn-infra.{{ include "common.namespace" . }}:8081/mso/SDNCAdapterCallbackService
- gammainternet:
- '':
- query: GET|60000|sdncurl4|sdnc-request-header|com:att:sdnctl:firewallapi
- service-configuration-operation:
- activate: POST|90000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api
- changeactivate: POST|60000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api
- changedelete: POST|250000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api
- changereserve: POST|60000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api
- delete: POST|250000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api
- reserve: POST|60000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api
- turnup: POST|60000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api
- svc-topology-operation:
- assign: POST|60000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api
- delete: POST|250000|sdncurl1|sdnc-request-header|com:att:sdnctl:l3api
generic-resource:
network-topology-operation:
create: POST|270000|sdncurl10|sdnc-request-header|org:onap:sdnc:northbound:generic-resource
myurl: http://so-sdnc-adapter{{ include "common.namespace" . }}:8086/adapters/rest/SDNCNotify
rest:
bpelurl: http://so-bpmn-infra.{{ include "common.namespace" . }}:8081/mso/WorkflowMessage
- sdncauth: 263f7d5f944d4d0c76db74b4148bec67d0bc796a874bc0d2a2a12aae89a866aa69133f700f391f784719a37f6a68d29bf5a2fbae1dab0402db7788c800c5ba73
+ sdncauth: ED07A7EE5F099FA53369C3DF2240AD68A00154676EEDBC6F8C16BAA83B1912941B8941ABD48683D2C1072DA7040659692DE936A59BBF42A038CF71DE67B4A375190071EC76EA657801B033C135
sdncconnecttime: 5000
sdncurl10: 'http://sdnc.{{ include "common.namespace" . }}:8282/restconf/operations/GENERIC-RESOURCE-API:'
sdncurl11: 'http://sdnc.{{ include "common.namespace" . }}:8282/restconf/operations/VNFTOPOLOGYAIC-API:'
vfmodule:
'':
query: GET|60000|sdncurl12|
+ network:
+ encryptionKey: 07a7159d3bf51a0e53be7a8f89699be7
spring:
security:
usercredentials:
url: jdbc:mariadb://${DB_HOST}:${DB_PORT}/requestdb
username: ${DB_USERNAME}
password: ${DB_PASSWORD}
- dbcp2:
- initial-size: 5
- max-total: 20
- validation-query: select 1
- test-on-borrow: true
security:
usercredentials:
- username: bpel
default:
testApi: GR_API
camundaURL: http://so-bpmn-infra.{{ include "common.namespace" . }}:8081/
- camundaAuth: 1D9003AB8BAFFA0D2104B67FA89040AD70B5B495B2A5DF931DE236484EBC1681
+ camundaAuth: AE2E9BE6EF9249085AF98689C4EE087736A5500629A72F35068FFB88813A023581DD6E765071F1C04075B36EA4213A
async:
core-pool-size: 50
max-pool-size: 50
queue-capacity: 500
sdc:
client:
- auth: F3473596C526938329DF877495B494DC374D1C4198ED3AD305EA3ADCBBDA1862
+ auth: 878785F4F31BC9CFA5AB52A172008212D8845ED2DE08AD5E56AF114720A4E49768B8F95CDA2EB971765D28EDCDAA24
activate:
instanceid: test
userid: cs0008
count: 3
aai:
endpoint: https://aai.{{ include "common.namespace" . }}:8443
- auth: 2630606608347B7124C244AB0FE34F6F
+ auth: 6E081E10B1CA43A843E303733A74D9B23B601A6E22A21C7EF2C7F15A42F81A1A4E85E65268C2661F71321052C7F3E55B96A8E1E951F8BF6F
so:
operational-environment:
dmaap:
username: ${DB_USERNAME}
password: ${DB_PASSWORD}
driver-class-name: org.mariadb.jdbc.Driver
- dbcp2:
- initial-size: 5
- max-total: 20
- validation-query: select 1
- test-on-borrow: true
+org:
+ onap:
+ so:
+ cloud-owner: onap
+ adapters:
+ network:
+ encryptionKey: 07a7159d3bf51a0e53be7a8f89699be7
Code Review / oom.git / commitdiff