EmmettCox | bca68e0 | 2020-02-27 14:20:52 +0000 | [diff] [blame] | 1 | # Copyright © 2020, Nokia |
Sylvain Desbureaux | 0de302a | 2020-06-05 15:19:22 +0200 | [diff] [blame] | 2 | # Modifications Copyright © 2020, Nordix Foundation, Orange |
Maciej Malewski | 955e39d | 2020-08-27 10:43:09 +0200 | [diff] [blame] | 3 | # Modifications Copyright © 2020 Nokia |
EmmettCox | bca68e0 | 2020-02-27 14:20:52 +0000 | [diff] [blame] | 4 | # |
| 5 | # Licensed under the Apache License, Version 2.0 (the "License"); |
| 6 | # you may not use this file except in compliance with the License. |
| 7 | # You may obtain a copy of the License at |
| 8 | # |
| 9 | # http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | # |
| 11 | # Unless required by applicable law or agreed to in writing, software |
| 12 | # distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | # See the License for the specific language governing permissions and |
| 15 | # limitations under the License. |
| 16 | |
| 17 | # Global |
| 18 | global: |
| 19 | envsubstImage: dibi/envsubst |
Sylvain Desbureaux | 0de302a | 2020-06-05 15:19:22 +0200 | [diff] [blame] | 20 | nodePortPrefix: 302 |
| 21 | # Readiness image |
Sylvain Desbureaux | 1694e1d | 2020-08-21 09:58:25 +0200 | [diff] [blame] | 22 | readinessImage: onap/oom/readiness:3.0.1 |
Sylvain Desbureaux | 0de302a | 2020-06-05 15:19:22 +0200 | [diff] [blame] | 23 | # Ubuntu Init image |
| 24 | ubuntuInitRepository: registry.hub.docker.com |
| 25 | ubuntuInitImage: oomk8s/ubuntu-init:2.0.0 |
| 26 | # Logging image |
| 27 | loggingRepository: docker.elastic.co |
| 28 | loggingImage: beats/filebeat:5.5.0 |
| 29 | # BusyBox image |
| 30 | busyboxRepository: registry.hub.docker.com |
| 31 | busyboxImage: library/busybox:1.31 |
| 32 | persistence: |
| 33 | enabled: true |
| 34 | # Standard OOM |
| 35 | pullPolicy: "Always" |
| 36 | repository: "nexus3.onap.org:10001" |
| 37 | |
EmmettCox | bca68e0 | 2020-02-27 14:20:52 +0000 | [diff] [blame] | 38 | |
| 39 | # Service configuration |
| 40 | service: |
| 41 | type: ClusterIP |
| 42 | ports: |
| 43 | - name: http |
| 44 | port: 8443 |
| 45 | port_protocol: http |
| 46 | |
| 47 | |
| 48 | # Deployment configuration |
| 49 | repository: nexus3.onap.org:10001 |
Maciej Malewski | 955e39d | 2020-08-27 10:43:09 +0200 | [diff] [blame] | 50 | image: onap/org.onap.oom.platform.cert-service.oom-certservice-api:2.0.0 |
EmmettCox | bca68e0 | 2020-02-27 14:20:52 +0000 | [diff] [blame] | 51 | pullPolicy: Always |
| 52 | replicaCount: 1 |
| 53 | |
| 54 | liveness: |
| 55 | initialDelaySeconds: 60 |
| 56 | periodSeconds: 10 |
| 57 | command: curl https://localhost:$HTTPS_PORT/actuator/health --cacert $ROOT_CERT --cert-type p12 --cert $KEYSTORE_P12_PATH --pass $KEYSTORE_PASSWORD |
| 58 | readiness: |
| 59 | initialDelaySeconds: 30 |
| 60 | periodSeconds: 10 |
| 61 | command: curl https://localhost:$HTTPS_PORT/ready --cacert $ROOT_CERT --cert-type p12 --cert $KEYSTORE_P12_PATH --pass $KEYSTORE_PASSWORD |
| 62 | |
| 63 | flavor: small |
| 64 | resources: |
| 65 | small: |
| 66 | limits: |
| 67 | cpu: 0.5 |
| 68 | memory: 1Gi |
| 69 | requests: |
| 70 | cpu: 0.2 |
| 71 | memory: 512Mi |
| 72 | large: |
| 73 | limits: |
| 74 | cpu: 1 |
| 75 | memory: 2Gi |
| 76 | requests: |
| 77 | cpu: 0.4 |
| 78 | memory: 1Gi |
| 79 | unlimited: {} |
| 80 | |
| 81 | |
| 82 | # Application configuration |
| 83 | cmpServers: |
| 84 | secret: |
Maciej Malewski | 955e39d | 2020-08-27 10:43:09 +0200 | [diff] [blame] | 85 | name: oom-cert-service-secret |
EmmettCox | bca68e0 | 2020-02-27 14:20:52 +0000 | [diff] [blame] | 86 | volume: |
Maciej Malewski | 955e39d | 2020-08-27 10:43:09 +0200 | [diff] [blame] | 87 | name: oom-cert-service-volume |
| 88 | mountPath: /etc/onap/oom/certservice |
EmmettCox | bca68e0 | 2020-02-27 14:20:52 +0000 | [diff] [blame] | 89 | |
| 90 | tls: |
| 91 | server: |
| 92 | secret: |
Maciej Malewski | 955e39d | 2020-08-27 10:43:09 +0200 | [diff] [blame] | 93 | name: oom-cert-service-server-tls-secret |
EmmettCox | bca68e0 | 2020-02-27 14:20:52 +0000 | [diff] [blame] | 94 | volume: |
Maciej Malewski | 955e39d | 2020-08-27 10:43:09 +0200 | [diff] [blame] | 95 | name: oom-cert-service-server-tls-volume |
| 96 | mountPath: /etc/onap/oom/certservice/certs/ |
EmmettCox | bca68e0 | 2020-02-27 14:20:52 +0000 | [diff] [blame] | 97 | client: |
| 98 | secret: |
Maciej Malewski | 955e39d | 2020-08-27 10:43:09 +0200 | [diff] [blame] | 99 | defaultName: oom-cert-service-client-tls-secret |
EmmettCox | bca68e0 | 2020-02-27 14:20:52 +0000 | [diff] [blame] | 100 | |
| 101 | envs: |
| 102 | keystore: |
| 103 | jksName: certServiceServer-keystore.jks |
| 104 | p12Name: certServiceServer-keystore.p12 |
| 105 | truststore: |
| 106 | jksName: truststore.jks |
| 107 | crtName: root.crt |
| 108 | httpsPort: 8443 |
| 109 | |
| 110 | # External secrets with credentials can be provided to override default credentials defined below, |
| 111 | # by uncommenting and filling appropriate *ExternalSecret value |
| 112 | credentials: |
| 113 | tls: |
| 114 | keystorePassword: secret |
| 115 | truststorePassword: secret |
| 116 | #keystorePasswordExternalSecret: |
| 117 | #truststorePasswordExternalSecret: |
| 118 | # Below cmp values contain credentials for EJBCA test instance and are relevant only if global addTestingComponents flag is enabled |
| 119 | cmp: |
Maciej Malewski | 955e39d | 2020-08-27 10:43:09 +0200 | [diff] [blame] | 120 | clientIakExternalSecret: '{{ include "common.release" . }}-ejbca-client-iak' |
EmmettCox | bca68e0 | 2020-02-27 14:20:52 +0000 | [diff] [blame] | 121 | #clientRvExternalSecret: |
Maciej Malewski | 955e39d | 2020-08-27 10:43:09 +0200 | [diff] [blame] | 122 | raIakExternalSecret: '{{ include "common.release" . }}-ejbca-ra-iak' |
EmmettCox | bca68e0 | 2020-02-27 14:20:52 +0000 | [diff] [blame] | 123 | #raRvExternalSecret: |
| 124 | client: {} |
| 125 | # iak: mypassword |
| 126 | # rv: unused |
| 127 | ra: {} |
| 128 | # iak: mypassword |
| 129 | # rv: unused |
| 130 | |
| 131 | secrets: |
| 132 | - uid: keystore-password |
| 133 | name: '{{ include "common.release" . }}-keystore-password' |
| 134 | type: password |
| 135 | externalSecret: '{{ tpl (default "" .Values.credentials.tls.keystorePasswordExternalSecret) . }}' |
| 136 | password: '{{ .Values.credentials.tls.keystorePassword }}' |
| 137 | passwordPolicy: required |
| 138 | - uid: truststore-password |
| 139 | name: '{{ include "common.release" . }}-truststore-password' |
| 140 | type: password |
| 141 | externalSecret: '{{ tpl (default "" .Values.credentials.tls.truststorePasswordExternalSecret) . }}' |
| 142 | password: '{{ .Values.credentials.tls.truststorePassword }}' |
| 143 | passwordPolicy: required |
| 144 | # Below values are relevant only if global addTestingComponents flag is enabled |
| 145 | - uid: ejbca-server-client-iak |
| 146 | type: password |
| 147 | externalSecret: '{{ tpl (default "" .Values.credentials.cmp.clientIakExternalSecret) . }}' |
| 148 | password: '{{ .Values.credentials.cmp.client.iak }}' |
| 149 | - uid: cmp-config-client-rv |
| 150 | type: password |
| 151 | externalSecret: '{{ tpl (default "" .Values.credentials.cmp.clientRvExternalSecret) . }}' |
| 152 | password: '{{ .Values.credentials.cmp.client.rv }}' |
| 153 | - uid: ejbca-server-ra-iak |
| 154 | type: password |
| 155 | externalSecret: '{{ tpl (default "" .Values.credentials.cmp.raIakExternalSecret) . }}' |
| 156 | password: '{{ .Values.credentials.cmp.ra.iak }}' |
| 157 | - uid: cmp-config-ra-rv |
| 158 | type: password |
| 159 | externalSecret: '{{ tpl (default "" .Values.credentials.cmp.raRvExternalSecret) . }}' |
| 160 | password: '{{ .Values.credentials.cmp.ra.rv }}' |