kubernetes/dist/*
kubernetes/common/dist/*
Chart.lock
-#**/charts/*.tgz
+**/charts/*.tgz
*.orig
# AAI Schema
company: 'Individual'
id: 'jackl'
timezone: 'USA/EST'
+ - name: 'Fiachra Corcoran'
+ email: 'fiachra.corcoran@est.tech'
+ company: 'ericsson'
+ id: 'efiacor'
+ timezone: 'Europe/Dublin'
+ - name: 'Dan Timoney'
+ email: 'dtimoney@att.com'
+ id: 'djtimoney'
+ company: 'ATT'
+ timezone: 'America/New_York'
tsc:
approval: 'https://lists.onap.org/pipermail/onap-tsc'
changes:
name: 'Jack Lucas'
# yamllint disable-line rule:line-length
link: 'https://wiki.onap.org/display/DW/Committer+Promotion+for+%5BOOM%5D+%3A+Jack+Lucas'
+ - type: 'Addition'
+ name: 'Fiachra Corcoran'
+ # yamllint disable-line rule:line-length
+ link: 'https://wiki.onap.org/display/DW/Committer+Promotion+Request+for+%5BOOM%5D+-+Fiachra+Corcoran'
+ - type: 'Addition'
+ name: 'Dan Timoney'
+ # yamllint disable-line rule:line-length
+ link: 'https://wiki.onap.org/display/DW/Committer+Promotion+Request+for+%5BOOM%5D+-+Dan+Timoney'
local/sdnc-prom 10.0.0 ONAP SDNC Policy Driven Ownership Management
local/sniro-emulator 10.0.0 ONAP Mock Sniro Emulator
local/so 10.0.0 ONAP Service Orchestrator
+local/strimzi 10.0.0 ONAP Strimzi Apache Kafka
local/uui 10.0.0 ONAP uui
local/vfc 10.0.0 ONAP Virtual Function Controller (VF-C)
local/vid 10.0.0 ONAP Virtual Infrastructure Deployment
More details can be found :doc:`here <oom_setup_paas>`.
+**Step 4.1** Install Strimzi Kafka Operator:
+
+- Add the helm repo::
+
+ > helm repo add strimzi https://strimzi.io/charts/
+
+- Install the operator::
+
+ > helm install strimzi-kafka-operator strimzi/strimzi-kafka-operator --namespace strimzi-system --version 0.28.0 --set watchAnyNamespace=true --create-namespace
+
+More details can be found :doc:`here <oom_setup_paas>`.
+
**Step 5.** Customize the Helm charts like `oom/kubernetes/onap/values.yaml` or
an override file like `onap-all.yaml`, `onap-vfw.yaml` or `openstack.yaml` file
to suit your deployment with items like the OpenStack tenant information.
.. Links
.. _Cert-Manager Installation documentation: https://cert-manager.io/docs/installation/kubernetes/
.. _Cert-Manager kubectl plugin documentation: https://cert-manager.io/docs/usage/kubectl-plugin/
+.. _Strimzi Apache Kafka Operator helm Installation documentation: https://strimzi.io/docs/operators/in-development/deploying.html#deploying-cluster-operator-helm-chart-str
.. _oom_setup_paas:
Starting from Honolulu release, Cert-Manager and Prometheus Stack are a part
of k8s PaaS for ONAP operations and can be installed to provide
additional functionality for ONAP engineers.
+Starting from Jakarta release, Strimzi Apache Kafka is deployed to provide
+Apache kafka as the default messaging bus for ONAP.
The versions of PaaS components that are supported by OOM are as follows:
.. table:: ONAP PaaS components
- ============== ============= =================
- Release Cert-Manager Prometheus Stack
- ============== ============= =================
+ ============== ============= ================= =======
+ Release Cert-Manager Prometheus Stack Strimzi
+ ============== ============= ================= =======
honolulu 1.2.0 13.x
istanbul 1.5.4 19.x
- ============== ============= =================
+ jakarta 0.28.0
+ ============== ============= ================= =======
This guide provides instructions on how to install the PaaS
components for ONAP.
:local:
..
+Strimzi Apache Kafka Operator
+=============================
+
+Strimzi provides a way to run an Apache Kafka cluster on Kubernetes
+in various deployment configurations by using kubernetes operators.
+Operators are a method of packaging, deploying, and managing a
+Kubernetes application.
+Strimzi Operators extend Kubernetes functionality, automating common
+and complex tasks related to a Kafka deployment. By implementing
+knowledge of Kafka operations in code, Kafka administration
+tasks are simplified and require less manual intervention.
+
+Installation steps
+------------------
+
+The recommended version of Strimzi for Kubernetes 1.19 is v0.28.0.
+The Strimzi cluster operator is deployed using helm to install the parent chart
+containing all of the required custom resource definitions. This should be done
+by a kubernetes administrator to allow for deployment of custom resources in to
+any kubernetes namespace within the cluster.
+
+Full installation instructions can be found in the
+`Strimzi Apache Kafka Operator helm Installation documentation`_.
+
+Installation can be as simple as:
+
+- Add the helm repo::
+
+ > helm repo add strimzi https://strimzi.io/charts/
+
+- Install the operator::
+
+ > helm install strimzi-kafka-operator strimzi/strimzi-kafka-operator --namespace strimzi-system --version 0.28.0 --set watchAnyNamespace=true --create-namespace
+
Cert-Manager
============
Pre-requisites
--------------
-Your environment must have the Kubernetes `kubectl` with Cert-Manager
+Your environment must have the Kubernetes `kubectl` with Strimzi Apache Kafka, Cert-Manager
and Helm setup as a one time activity.
Install Kubectl
At this point you should see Kubernetes pods running.
-Install Cert-Manager
-~~~~~~~~~~~~~~~~~~~~
-Details on how to install Cert-Manager can be found
-:doc:`here <oom_setup_paas>`.
-
Install Helm
~~~~~~~~~~~~
Helm is used by OOM for package and configuration management. To install Helm,
> helm version
+Install Strimzi Apache Kafka Operator
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Details on how to install Strimzi Apache Kafka can be found
+:doc:`here <oom_setup_paas>`.
+
+Install Cert-Manager
+~~~~~~~~~~~~~~~~~~~~
+Details on how to install Cert-Manager can be found
+:doc:`here <oom_setup_paas>`.
+
Install the Helm Repo
---------------------
Once kubectl and Helm are setup, one needs to setup a local Helm server to
#################################################################
# application image
-image: onap/babel:1.9.3
+image: onap/babel:1.9.5
flavor: small
flavorOverride: small
chown -R {{ .Values.user_id }}:{{ .Values.group_id }} {{ .Values.credsPath }}
# application image
-image: onap/aai-graphadmin:1.9.3
+image: onap/aai-graphadmin:1.9.4
pullPolicy: Always
restartPolicy: Always
flavor: small
chown -R {{ .Values.user_id }}:{{ .Values.group_id }} {{ .Values.credsPath }}
# application image
-image: onap/model-loader:1.9.2
+image: onap/model-loader:1.9.4
pullPolicy: Always
restartPolicy: Always
flavor: small
chown -R 1000 {{ .Values.credsPath }}
# application image
-image: onap/aai-resources:1.9.4
+image: onap/aai-resources:1.9.5
pullPolicy: Always
restartPolicy: Always
flavor: small
chown -R {{ .Values.user_id }}:{{ .Values.group_id }} {{ .Values.credsPath }}
# application image
-image: onap/aai-schema-service:1.9.4
+image: onap/aai-schema-service:1.9.5
pullPolicy: Always
restartPolicy: Always
flavorOverride: small
chown -R 1000 {{ .Values.credsPath }}
# application image
-image: onap/aai-traversal:1.9.4
+image: onap/aai-traversal:1.9.5
pullPolicy: Always
restartPolicy: Always
flavor: small
periodSeconds: 15
timeoutSeconds: 1
path: /healthcheck
- scheme: HTTPS
- port: 8443
+ scheme: HTTP
+ port: 8081
# Service Configuration
service:
# Application configuration defaults.
#################################################################
# application image
-image: onap/org.onap.dcaegen2.analytics.tca-gen2.dcae-analytics-tca-web:1.3.1
+image: onap/org.onap.dcaegen2.analytics.tca-gen2.dcae-analytics-tca-web:1.3.2
pullPolicy: Always
# log directory where logging sidecar should look for log files
# Application Configuration Defaults.
#################################################################
# Application Image
-image: onap/org.onap.dcaegen2.services.mapper.vesadapter.universalvesadaptor:1.3.3
+image: onap/org.onap.dcaegen2.services.mapper.vesadapter.universalvesadaptor:1.4.0
pullPolicy: Always
# Log directory where logging sidecar should look for log files
#============LICENSE_START========================================================
#=================================================================================
-# Copyright (c) 2021 Nokia. All rights reserved.
+# Copyright (c) 2021-2022 Nokia. All rights reserved.
# ================================================================================
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# Global values
global:
pullPolicy: Always
-image: onap/org.onap.dcaegen2.platform.ves-openapi-manager:1.0.1
+image: onap/org.onap.dcaegen2.platform.ves-openapi-manager:1.1.0
containerPort: &svc_port 8080
service:
zookeeper:
name: message-router-zookeeper
port: 2181
- replicaCount: 3
+ replicaCount: 1
kafka:
heapOptions: -Xmx5G -Xms1G
debugEnabled: false
# default number of instances
-replicaCount: 3
+replicaCount: 1
# To access Kafka outside cluster, this value must be set to hard and the number of nodes in K8S cluster must be equal or greater then replica count
# default number of instances
-replicaCount: 3
+replicaCount: 1
-zookeeperServers: 3
+zookeeperServers: 1
nodeSelector: {}
echo "$DEPLOY_FLAGS"
}
+
+check_for_dep() {
+ try=0
+ retries=30
+ until (kubectl get deployment -n $RELEASE | grep -P "\b$1\b") &>/dev/null; do
+ (( ++try > retries )) && exit 1
+ echo "$1 not found. Retry $try/$retries"
+ sleep 5
+ done
+ echo "$1 found. Waiting for pod intialisation"
+ sleep 15
+}
+
+deploy_strimzi() {
+ #Deploy the srtimzi-kafka chart in advance. Dependent charts require the entity-operator
+ #for management of the strimzi crds
+ deploy_subchart
+ echo "waiting for ${RELEASE}-strimzi-entity-operator to be deployed"
+ check_for_dep ${RELEASE}-strimzi-entity-operator
+}
+
+deploy_subchart() {
+ if [ -z "$SUBCHART_RELEASE" ] || [ "$SUBCHART_RELEASE" = "$subchart" ]; then
+ LOG_FILE=$LOG_DIR/"${RELEASE}-${subchart}".log
+ :> $LOG_FILE
+
+ helm upgrade -i "${RELEASE}-${subchart}" $CACHE_SUBCHART_DIR/$subchart \
+ $DEPLOY_FLAGS -f $GLOBAL_OVERRIDES -f $SUBCHART_OVERRIDES \
+ > $LOG_FILE 2>&1
+
+ if [ "$VERBOSE" = "true" ]; then
+ cat $LOG_FILE
+ else
+ echo "release \"${RELEASE}-${subchart}\" deployed"
+ fi
+ # Add annotation last-applied-configuration if set-last-applied flag is set
+ if [ "$SET_LAST_APPLIED" = "true" ]; then
+ helm get manifest "${RELEASE}-${subchart}" \
+ | kubectl apply set-last-applied --create-annotation -n onap -f - \
+ > $LOG_FILE.log 2>&1
+ fi
+ fi
+ if [ "$DELAY" = "true" ]; then
+ echo sleep 3m
+ sleep 180
+ fi
+}
+
deploy() {
# validate params
if [ -z "$1" ] || [ -z "$2" ]; then
#“helm ls” is an expensive command in that it can take a long time to execute.
#So cache the results to prevent repeated execution.
ALL_HELM_RELEASES=$(helm ls -q)
- for subchart in * ; do
- SUBCHART_OVERRIDES=$CACHE_SUBCHART_DIR/$subchart/subchart-overrides.yaml
- SUBCHART_ENABLED=0
- if [ -f $SUBCHART_OVERRIDES ]; then
- SUBCHART_ENABLED=$(cat $SUBCHART_OVERRIDES | grep -c "^enabled: true")
- fi
+ for subchart in strimzi cassandra mariadb-galera postgres ; do
+ SUBCHART_OVERRIDES=$CACHE_SUBCHART_DIR/$subchart/subchart-overrides.yaml
- if [ $SUBCHART_ENABLED -eq 1 ]; then
- if [ -z "$SUBCHART_RELEASE" ] || [ "$SUBCHART_RELEASE" = "$subchart" ]; then
- LOG_FILE=$LOG_DIR/"${RELEASE}-${subchart}".log
- :> $LOG_FILE
+ SUBCHART_ENABLED=0
+ if [ -f $SUBCHART_OVERRIDES ]; then
+ SUBCHART_ENABLED=$(cat $SUBCHART_OVERRIDES | grep -c "^enabled: true")
+ fi
+ if [ "${subchart}" = "strimzi" ] && [ $SUBCHART_ENABLED -eq 1 ]; then
+ deploy_strimzi
+ fi
+ # Deploy them at first
+ if [ $SUBCHART_ENABLED -eq 1 ]; then
+ deploy_subchart
+ else
+ array=($(echo "$ALL_HELM_RELEASES" | grep "${RELEASE}-${subchart}"))
+ n=${#array[*]}
+ for i in $(seq $(($n-1)) -1 0); do
+ helm del "${array[i]}"
+ done
+ fi
+ done
- helm upgrade -i "${RELEASE}-${subchart}" $CACHE_SUBCHART_DIR/$subchart \
- $DEPLOY_FLAGS -f $GLOBAL_OVERRIDES -f $SUBCHART_OVERRIDES \
- > $LOG_FILE 2>&1
+ for subchart in * ; do
+ SUBCHART_OVERRIDES=$CACHE_SUBCHART_DIR/$subchart/subchart-overrides.yaml
- if [ "$VERBOSE" = "true" ]; then
- cat $LOG_FILE
- else
- echo "release \"${RELEASE}-${subchart}\" deployed"
- fi
- # Add annotation last-applied-configuration if set-last-applied flag is set
- if [ "$SET_LAST_APPLIED" = "true" ]; then
- helm get manifest "${RELEASE}-${subchart}" \
- | kubectl apply set-last-applied --create-annotation -n onap -f - \
- > $LOG_FILE.log 2>&1
- fi
+ SUBCHART_ENABLED=0
+ if [ -f $SUBCHART_OVERRIDES ]; then
+ SUBCHART_ENABLED=$(cat $SUBCHART_OVERRIDES | grep -c "^enabled: true")
fi
- if [ "$DELAY" = "true" ]; then
- echo sleep 3m
- sleep 180
+ if [ "${subchart}" = "strimzi" ] || [ "${subchart}" = "cassandra" ] || [ "${subchart}" = "mariadb-galera" ] || [ "${subchart}" = "postgres" ]; then
+ SUBCHART_ENABLED=0
fi
- else
- array=($(echo "$ALL_HELM_RELEASES" | grep "${RELEASE}-${subchart}"))
- n=${#array[*]}
- for i in $(seq $(($n-1)) -1 0); do
- helm del "${array[i]}"
- done
- fi
- done
+ # Deploy the others
+ if [ $SUBCHART_ENABLED -eq 1 ]; then
+ deploy_subchart
+ else
+ array=($(echo "$ALL_HELM_RELEASES" | grep "${RELEASE}-${subchart}"))
+ n=${#array[*]}
+ for i in $(seq $(($n-1)) -1 0); do
+ helm del "${array[i]}"
+ done
+ fi
+ done
# report on success/failures of installs/upgrades
helm ls --all-namespaces | grep -i FAILED | grep $RELEASE
version: ~10.x-0
repository: '@local'
condition: so.enabled
+ - name: strimzi
+ version: ~10.x-0
+ repository: '@local'
+ condition: strimzi.enabled
- name: uui
version: ~10.x-0
repository: '@local'
so-vnfm-adapter:
ingress:
enabled: true
+strimzi:
+ enabled: true
uui:
enabled: true
vfc:
enabled: true
so:
enabled: true
+strimzi:
+ enabled: true
uui:
enabled: true
vfc:
enabled: true
so:
enabled: true
+strimzi:
+ enabled: true
vid:
enabled: true
openStackKeyStoneUrl: "$OPENSTACK_KEYSTONE_URL"
openStackServiceTenantName: "$OPENSTACK_TENANT_NAME"
openStackEncryptedPasswordHere: "$OPENSTACK_ENCRYPTED_PASSWORD"
+strimzi:
+ enabled: false
uui:
enabled: false
vid:
# server:
# monitoring:
# password: demo123456!
+strimzi:
+ enabled: false
uui:
enabled: false
vfc:
version: ~10.x-0
repository: 'file://components/policy-clamp-be'
condition: policy-clamp-be.enabled
- - name: policy-clamp-fe
- version: ~10.x-0
- repository: 'file://components/policy-clamp-fe'
- condition: policy-clamp-fe.enabled
- name: policy-clamp-cl-k8s-ppnt
version: ~10.x-0
repository: 'file://components/policy-clamp-cl-k8s-ppnt'
+++ /dev/null
-server {
-
- listen 2443 default ssl;
- ssl_protocols TLSv1.2;
- {{ if .Values.global.aafEnabled }}
- ssl_certificate {{.Values.certInitializer.credsPath}}/{{.Values.certInitializer.clamp_pem}};
- ssl_certificate_key {{.Values.certInitializer.credsPath}}/{{.Values.certInitializer.clamp_key}};
- {{ else }}
- ssl_certificate /etc/ssl/clamp.pem;
- ssl_certificate_key /etc/ssl/clamp.key;
- {{ end }}
-
- ssl_verify_client optional_no_ca;
- location /restservices/clds/ {
- proxy_pass https://policy-clamp-be:8443;
- proxy_set_header X-SSL-Cert $ssl_client_escaped_cert;
- }
-
- location / {
- root /usr/share/nginx/html;
- index index.html index.htm;
- try_files $uri $uri/ /index.html;
- }
-
- error_page 500 502 503 504 /50x.html;
-
- location = /50x.html {
- root /usr/share/nginx/html;
- }
-
-}
+++ /dev/null
-{{/*
-# Copyright © 2018 AT&T, Amdocs, Bell Canada Intellectual Property. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-*/}}
-filebeat.prospectors:
-#it is mandatory, in our case it's log
-- input_type: log
- #This is the canolical path as mentioned in logback.xml, *.* means it will monitor all files in the directory.
- paths:
- - /var/log/onap/*/*/*/*.log
- - /var/log/onap/*/*/*.log
- - /var/log/onap/*/*.log
- #Files older than this should be ignored.In our case it will be 48 hours i.e. 2 days. It is a helping flag for clean_inactive
- ignore_older: 48h
- # Remove the registry entry for a file that is more than the specified time. In our case it will be 96 hours, i.e. 4 days. It will help to keep registry records with in limit
- clean_inactive: 96h
-
-# Name of the registry file. If a relative path is used, it is considered relative to the
-# data path. Else full qualified file name.
-#filebeat.registry_file: ${path.data}/registry
-
-
-output.logstash:
- #List of logstash server ip addresses with port number.
- #But, in our case, this will be the loadbalancer IP address.
- #For the below property to work the loadbalancer or logstash should expose 5044 port to listen the filebeat events or port in the property should be changed appropriately.
- hosts: ["{{.Values.config.log.logstashServiceName}}:{{.Values.config.log.logstashPort}}"]
- #If enable will do load balancing among availabe Logstash, automatically.
- loadbalance: true
-
- #The list of root certificates for server verifications.
- #If certificate_authorities is empty or not set, the trusted
- #certificate authorities of the host system are used.
- #ssl.certificate_authorities: $ssl.certificate_authorities
-
- #The path to the certificate for SSL client authentication. If the certificate is not specified,
- #client authentication is not available.
- #ssl.certificate: $ssl.certificate
-
- #The client certificate key used for client authentication.
- #ssl.key: $ssl.key
-
- #The passphrase used to decrypt an encrypted key stored in the configured key file
- #ssl.key_passphrase: $ssl.key_passphrase
+++ /dev/null
-# Copyright © 2018 AT&T, Amdocs, Bell Canada Intellectual Property. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-1. Get the application URL by running these commands:
-{{- if .Values.ingress.enabled }}
-{{- range .Values.ingress.hosts }}
- http://{{ . }}
-{{- end }}
-{{- else if contains "NodePort" .Values.service.type }}
- export NODE_PORT=$(kubectl get --namespace {{ include "common.namespace" . }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "common.name" . }})
- export NODE_IP=$(kubectl get nodes --namespace {{ include "common.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}")
- echo http://$NODE_IP:$NODE_PORT
-{{- else if contains "LoadBalancer" .Values.service.type }}
- NOTE: It may take a few minutes for the LoadBalancer IP to be available.
- You can watch the status of by running 'kubectl get svc -w {{ include "common.name" . }}'
- export SERVICE_IP=$(kubectl get svc --namespace {{ include "common.namespace" . }} {{ include "common.name" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
- echo http://$SERVICE_IP:{{ .Values.service.externalPort }}
-{{- else if contains "ClusterIP" .Values.service.type }}
- export POD_NAME=$(kubectl get pods --namespace {{ include "common.namespace" . }} -l "app={{ template "common.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
- echo "Visit https://127.0.0.1:8443 to use your application"
- kubectl port-forward $POD_NAME 8443:{{ .Values.service.internalPort }}
-{{- end }}
+++ /dev/null
-{{/*
-# Copyright © 2017 Amdocs, Bell Canada
-# Modifications Copyright © 2018 AT&T
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-*/}}
-
-apiVersion: apps/v1
-kind: Deployment
-metadata:
- name: {{ include "common.fullname" . }}
- namespace: {{ include "common.namespace" . }}
- labels:
- app: {{ include "common.name" . }}
- chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
- release: {{ include "common.release" . }}
- heritage: {{ .Release.Service }}
-spec:
- replicas: {{ .Values.replicaCount }}
- selector:
- matchLabels:
- app: {{ include "common.name" . }}
- template:
- metadata:
- labels:
- app: {{ include "common.name" . }}
- release: {{ include "common.release" . }}
- spec:
- initContainers:
- - command:
- - /app/ready.py
- args:
- - --container-name
- - policy-clamp-be
- env:
- - name: NAMESPACE
- valueFrom:
- fieldRef:
- apiVersion: v1
- fieldPath: metadata.namespace
- image: {{ include "repositoryGenerator.image.readiness" . }}
- imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
- name: {{ include "common.name" . }}-readiness
-{{ include "common.certInitializer.initContainer" . | nindent 6 }}
- containers:
- # side car containers
- {{ if .Values.global.centralizedLoggingEnabled }}{{ include "common.log.sidecar" . | nindent 8 }}{{ end }}
- # main container
- - name: {{ include "common.name" . }}
- image: {{ include "repositoryGenerator.repository" . }}/{{ .Values.image }}
- imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
- ports:
- - containerPort: {{ .Values.service.internalPort }}
- # disable liveness probe when breakpoints set in debugger
- # so K8s doesn't restart unresponsive container
- {{- if eq .Values.liveness.enabled true }}
- livenessProbe:
- tcpSocket:
- port: {{ .Values.service.internalPort }}
- initialDelaySeconds: {{ .Values.liveness.initialDelaySeconds }}
- periodSeconds: {{ .Values.liveness.periodSeconds }}
- {{ end -}}
- readinessProbe:
- tcpSocket:
- port: {{ .Values.service.internalPort }}
- initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }}
- periodSeconds: {{ .Values.readiness.periodSeconds }}
- volumeMounts: {{ include "common.certInitializer.volumeMount" . | nindent 10 }}
- - name: logs
- mountPath: {{ .Values.log.path }}
- - mountPath: /etc/nginx/conf.d/default.conf
- name: {{ include "common.fullname" . }}-config
- subPath: default.conf
- resources:
-{{ include "common.resources" . | indent 12 }}
- {{- if .Values.nodeSelector }}
- nodeSelector:
-{{ toYaml .Values.nodeSelector | indent 10 }}
- {{- end -}}
- {{- if .Values.affinity }}
- affinity:
-{{ toYaml .Values.affinity | indent 10 }}
- {{- end }}
- serviceAccountName: {{ include "common.fullname" (dict "suffix" "read" "dot" . )}}
- volumes: {{ include "common.certInitializer.volumes" . | nindent 8 }}
- - name: {{ include "common.fullname" . }}-config
- configMap:
- name: {{ include "common.fullname" . }}
- items:
- - key: default.conf
- path: default.conf
- - name: logs
- emptyDir: {}
- {{ if .Values.global.centralizedLoggingEnabled }}{{ include "common.log.volumes" . | nindent 8 }}{{ end }}
- imagePullSecrets:
- - name: "{{ include "common.namespace" . }}-docker-registry-key"
+++ /dev/null
-{{ include "common.ingress" . }}
+++ /dev/null
-{{/*
-# Copyright © 2017 Amdocs, Bell Canada
-# Modifications Copyright © 2018 AT&T
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-*/}}
-
-apiVersion: v1
-kind: Service
-metadata:
- name: {{ .Values.service.name }}
- namespace: {{ include "common.namespace" . }}
- labels:
- app: {{ include "common.name" . }}
- chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
- release: {{ include "common.release" . }}
- heritage: {{ .Release.Service }}
-spec:
- type: {{ .Values.service.type }}
- ports:
- {{if eq .Values.service.type "NodePort" -}}
- - port: {{ .Values.service.internalPort }}
- nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort }}
- name: {{ .Values.service.portName }}
- {{- else -}}
- - port: {{ .Values.service.externalPort }}
- targetPort: {{ .Values.service.internalPort }}
- name: {{ .Values.service.portName }}
- {{- end}}
- selector:
- app: {{ include "common.name" . }}
- release: {{ include "common.release" . }}
----
+++ /dev/null
-# Copyright © 2017 Amdocs, Bell Canada
-# Modifications Copyright © 2018-2021 AT&T
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-#################################################################
-# Global configuration defaults.
-#################################################################
-global: # global defaults
- nodePortPrefix: 302
- centralizedLoggingEnabled: true
- #AAF service
- aafEnabled: true
-
-#################################################################
-# AAF part
-#################################################################
-certInitializer:
- permission_user: 1000
- permission_group: 999
- addconfig: true
- keystoreFile: "org.onap.clamp.p12"
- truststoreFile: "org.onap.clamp.trust.jks"
- keyFile: "org.onap.clamp.keyfile"
- truststoreFileONAP: "truststoreONAPall.jks"
- clamp_key: "clamp.key"
- clamp_pem: "clamp.pem"
- clamp_ca_certs_pem: "clamp-ca-certs.pem"
- nameOverride: clamp-cert-initializer
- aafDeployFqi: deployer@people.osaaf.org
- aafDeployPass: demo123456!
- # aafDeployCredsExternalSecret: some secret
- fqdn: clamp
- fqi: clamp@clamp.onap.org
- public_fqdn: clamp.onap.org
- cadi_longitude: "0.0"
- cadi_latitude: "0.0"
- app_ns: org.osaaf.aaf
- credsPath: /opt/app/osaaf/local
- aaf_add_config: >
- cd {{ .Values.credsPath }};
- openssl pkcs12 -in {{ .Values.keystoreFile }} -nocerts -nodes -passin pass:$cadi_keystore_password_p12 > {{ .Values.clamp_key }};
- openssl pkcs12 -in {{ .Values.keystoreFile }} -clcerts -nokeys -passin pass:$cadi_keystore_password_p12 > {{ .Values.clamp_pem }};
- openssl pkcs12 -in {{ .Values.keystoreFile }} -cacerts -nokeys -chain -passin pass:$cadi_keystore_password_p12 > {{ .Values.clamp_ca_certs_pem }};
- chmod a+rx *;
-
-subChartsOnly:
- enabled: true
-
-flavor: small
-
-# application image
-image: onap/policy-clamp-frontend:6.2.0
-pullPolicy: Always
-
-# flag to enable debugging - application support required
-debugEnabled: false
-
-# log configuration
-log:
- path: /var/log/nginx/
-
-#################################################################
-# Application configuration defaults.
-#################################################################
-config:
- log:
- logstashServiceName: log-ls
- logstashPort: 5044
- dataRootDir: /dockerdata-nfs
-
-# default number of instances
-replicaCount: 1
-
-nodeSelector: {}
-
-affinity: {}
-
-# probe configuration parameters
-liveness:
- initialDelaySeconds: 120
- periodSeconds: 10
- timeoutSeconds: 3
- # necessary to disable liveness probe when setting breakpoints
- # in debugger so K8s doesn't restart unresponsive container
- enabled: true
-
-readiness:
- initialDelaySeconds: 10
- periodSeconds: 10
- timeoutSeconds: 3
-
-service:
- type: NodePort
- name: policy-clamp-fe
- portName: policy-clamp-fe
- internalPort: 2443
- nodePort: 58
-
- # as of 20180904 port 58 is reserved for clamp from log/logdemonode
- # see https://wiki.onap.org/display/DW/OOM+NodePort+List
-
-ingress:
- enabled: false
- service:
- - baseaddr: "clamp.api"
- name: "clamp"
- port: 2443
- config:
- ssl: "redirect"
-
-#resources: {}
- # We usually recommend not to specify default resources and to leave this as a conscious
- # choice for the user. This also increases chances charts run on environments with little
- # resources, such as Minikube. If you do want to specify resources, uncomment the following
- # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
- #
- # Example:
- # Configure resource requests and limits
- # ref: http://kubernetes.io/docs/user-guide/compute-resources/
- # Minimum memory for development is 2 CPU cores and 4GB memory
- # Minimum memory for production is 4 CPU cores and 8GB memory
-resources:
- small:
- limits:
- cpu: 1
- memory: 200Mi
- requests:
- cpu: 1m
- memory: 50Mi
- large:
- limits:
- cpu: 1
- memory: 500Mi
- requests:
- cpu: 10m
- memory: 50Mi
- unlimited: {}
-
-#Pods Service Account
-serviceAccount:
- nameOverride: policy-clamp-fe
- roles:
- - read
db: *dbSecretsHook
config:
appUserExternalSecret: *policyAppCredsSecret
-policy-clamp-fe:
- enabled: true
policy-clamp-cl-k8s-ppnt:
enabled: true
policy-clamp-cl-pf-ppnt:
GLOBAL_INJECTED_APPC_CDT_IP_ADDR = '{{include "robot.ingress.svchost" (dict "root" . "hostname" "appc-cdt") }}'
GLOBAL_INJECTED_ARTIFACTS_VERSION = '{{.Values.demoArtifactsVersion}}'
GLOBAL_INJECTED_ARTIFACTS_REPO_URL = "{{ .Values.demoArtifactsRepoUrl }}"
-GLOBAL_INJECTED_CLAMP_IP_ADDR = '{{include "robot.ingress.svchost" (dict "root" . "hostname" "policy-clamp-fe") }}'
+GLOBAL_INJECTED_CLAMP_IP_ADDR = '{{include "robot.ingress.svchost" (dict "root" . "hostname" "policy-gui") }}'
GLOBAL_INJECTED_CLI_IP_ADDR = '{{include "robot.ingress.svchost" (dict "root" . "hostname" "cli") }}'
GLOBAL_INJECTED_CLOUD_ENV = 'openstack'
GLOBAL_INJECTED_DCAE_COLLECTOR_IP = "{{ .Values.dcaeCollectorIp }}"
GLOBAL_SDC_AUTHENTICATION = [GLOBAL_SDC_USERNAME, GLOBAL_SDC_PASSWORD]
# clamp info - everything is from the private oam network (also called onap private network)
GLOBAL_CLAMP_SERVER_PROTOCOL = "https"
-GLOBAL_CLAMP_SERVER_PORT = '{{include "robot.ingress.port" (dict "root" . "hostname" "policy-clamp-fe" "port" 2443) }}'
+GLOBAL_CLAMP_SERVER_PORT = '{{include "robot.ingress.port" (dict "root" . "hostname" "policy-gui" "port" 2443) }}'
# nbi info - everything is from the private oam network (also called onap private network)
GLOBAL_NBI_SERVER_PROTOCOL = "https"
GLOBAL_NBI_SERVER_PORT = '{{include "robot.ingress.port" (dict "root" . "hostname" "nbi" "port" 8443) }}'
--- /dev/null
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+Chart.lock
-# Copyright © 2017 Amdocs, Bell Canada
-# Modifications Copyright © 2018 AT&T
-# Modifications Copyright © 2021 Orange
-# Modifications Copyright © 2021 Nordix Foundation
+# Copyright © 2022 Nordix Foundation
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# limitations under the License.
apiVersion: v2
-description: ONAP Policy Clamp Frontend
-name: policy-clamp-fe
+description: ONAP Strimzi kafka
+name: strimzi
version: 10.0.0
dependencies:
- - name: certInitializer
+ - name: common
version: ~10.x-0
+ # local reference to common chart, as it is
+ # a part of this chart's package and will not
+ # be published independently to a repo (at this point)
repository: '@local'
- name: repositoryGenerator
version: ~10.x-0
- name: serviceAccount
version: ~10.x-0
repository: '@local'
+
--- /dev/null
+# Copyright © 2020 Samsung Electronics
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+ROOT_DIR := $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))
+OUTPUT_DIR := $(ROOT_DIR)/../dist
+PACKAGE_DIR := $(OUTPUT_DIR)/packages
+SECRET_DIR := $(OUTPUT_DIR)/secrets
+
+EXCLUDES := dist resources templates charts docker
+HELM_BIN := helm
+HELM_CHARTS := $(filter-out $(EXCLUDES), $(sort $(patsubst %/.,%,$(wildcard */.))))
+
+.PHONY: $(EXCLUDES) $(HELM_CHARTS)
+
+all: $(HELM_CHARTS)
+
+$(HELM_CHARTS):
+ @echo "\n[$@]"
+ @make package-$@
+
+make-%:
+ @if [ -f $*/Makefile ]; then make -C $*; fi
+
+dep-%: make-%
+ @if [ -f $*/Chart.yaml ]; then $(HELM_BIN) dep up $*; fi
+
+lint-%: dep-%
+ @if [ -f $*/Chart.yaml ]; then $(HELM_BIN) lint $*; fi
+
+package-%: lint-%
+ @mkdir -p $(PACKAGE_DIR)
+ @if [ -f $*/Chart.yaml ]; then $(HELM_BIN) package -d $(PACKAGE_DIR) $*; fi
+ @$(HELM_BIN) repo index $(PACKAGE_DIR)
+
+clean:
+ @rm -f */Chart.lock
+ @rm -f *tgz */charts/*tgz
+ @rm -rf $(PACKAGE_DIR)
+%:
+ @:
{{/*
-# Copyright © 2017 Amdocs, Bell Canada
-# Modifications Copyright © 2018 AT&T
+# Copyright © 2022 Nordix Foundation
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# See the License for the specific language governing permissions and
# limitations under the License.
*/}}
-
-apiVersion: v1
-kind: ConfigMap
-metadata:
- name: {{ include "common.fullname" . }}
- namespace: {{ include "common.namespace" . }}
- labels:
- app: {{ include "common.name" . }}
- chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
- release: {{ include "common.release" . }}
- heritage: {{ .Release.Service }}
-data:
-{{ tpl (.Files.Glob "resources/config/*").AsConfig . | indent 2 }}
-
-{{ include "common.log.configMap" . }}
+{{ include "common.replicaPV" (dict "dot" . "suffix" "kafka" "persistenceInfos" .Values.persistenceKafka) }}
{{/*
-# Copyright © 2017 Amdocs, Bell Canada
-# Modifications Copyright © 2018 AT&T
+# Copyright © 2022 Nordix Foundation
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# limitations under the License.
*/}}
-{{ include "common.secretFast" . }}
+{{ include "common.replicaPV" (dict "dot" . "suffix" "zk" "persistenceInfos" .Values.persistenceZk) }}
--- /dev/null
+{{/*
+# Copyright © 2022 Nordix Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+*/}}
+apiVersion: kafka.strimzi.io/v1beta2
+kind: Kafka
+metadata:
+ name: {{ include "common.fullname" . }}
+ namespace: {{ include "common.namespace" . }}
+ labels:
+ app: {{ include "common.name" . }}
+ chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+ release: {{ include "common.release" . }}
+ heritage: {{ .Release.Service }}
+spec:
+ kafka:
+ version: {{ .Values.version }}
+ replicas: {{ .Values.replicaCount }}
+ listeners:
+ - name: plain
+ port: {{ .Values.kafkaInternalPort }}
+ type: internal
+ tls: false
+ authentication:
+ type: {{ .Values.saslMechanism }}
+ - name: tls
+ port: 9093
+ type: internal
+ tls: true
+ authentication:
+ type: tls
+ - name: external
+ port: 9094
+ type: nodeport
+ tls: true
+ authentication:
+ type: tls
+ authorization:
+ type: simple
+ superUsers:
+ - {{ include "common.release" . }}-{{ .Values.kafkaStrimziAdminUser }}
+ template:
+ pod:
+ securityContext:
+ runAsUser: 0
+ fsGroup: 0
+ config:
+ offsets.topic.replication.factor: {{ .Values.replicaCount }}
+ transaction.state.log.replication.factor: {{ .Values.replicaCount }}
+ transaction.state.log.min.isr: 2
+ log.message.format.version: "3.0"
+ inter.broker.protocol.version: "3.0"
+ storage:
+ type: jbod
+ class: {{ include "common.storageClass" (dict "dot" . "suffix" "kafka" "persistenceInfos" .Values.persistenceKafka) }}
+ volumes:
+ - id: 0
+ type: persistent-claim
+ size: {{ .Values.persistenceKafka.size }}
+ deleteClaim: true
+ class: {{ include "common.storageClass" (dict "dot" . "suffix" "kafka" "persistenceInfos" .Values.persistenceKafka) }}
+ zookeeper:
+ template:
+ pod:
+ securityContext:
+ runAsUser: 0
+ fsGroup: 0
+ replicas: {{ .Values.replicaCount }}
+ config:
+ ssl.hostnameVerification: false
+ storage:
+ type: persistent-claim
+ size: {{ .Values.persistenceZk.size }}
+ deleteClaim: true
+ class: {{ include "common.storageClass" (dict "dot" . "suffix" "zk" "persistenceInfos" .Values.persistenceZk) }}
+ entityOperator:
+ topicOperator: {}
+ userOperator: {}
+
--- /dev/null
+# Copyright © 2022 Nordix Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#################################################################
+# Global configuration defaults.
+#################################################################
+global:
+ nodePortPrefix: 302
+ persistence:
+ mountPath: /dockerdata-nfs
+
+#################################################################
+# Application configuration defaults.
+#################################################################
+replicaCount: 2
+kafkaInternalPort: 9092
+saslMechanism: scram-sha-512
+version: 3.0.0
+kafkaStrimziAdminUser: strimzi-kafka-admin
+persistence: {}
+
+persistenceKafka:
+ enabled: true
+ size: 2Gi
+ volumeReclaimPolicy: Retain
+ accessMode: ReadWriteOnce
+ mountPath: /dockerdata-nfs
+ mountSubPath: strimzi-kafka/kafka
+persistenceZk:
+ enabled: true
+ size: 2Gi
+ volumeReclaimPolicy: Retain
+ accessMode: ReadWriteOnce
+ mountPath: /dockerdata-nfs
+ mountSubPath: strimzi-kafka/zk
+
+#Pods Service Account
+serviceAccount:
+ nameOverride: strimzi-kafka
+ roles:
+ - read
Code Review / oom.git / commitdiff