blob: 5a8e84cd8c28bfbd94df8ab3d164e34f34821624 [file] [log] [blame]
Krzysztof Opasiak020cdb92020-05-01 01:46:37 +02001{{/*
Jozsef Csongvai9d4d5af2020-07-13 11:10:25 -04002# Copyright © 2020 Bell Canada, Samsung Electronics
Krzysztof Opasiak020cdb92020-05-01 01:46:37 +02003#
4# Licensed under the Apache License, Version 2.0 (the "License");
5# you may not use this file except in compliance with the License.
6# You may obtain a copy of the License at
7#
8# http://www.apache.org/licenses/LICENSE-2.0
9#
10# Unless required by applicable law or agreed to in writing, software
11# distributed under the License is distributed on an "AS IS" BASIS,
12# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13# See the License for the specific language governing permissions and
14# limitations under the License.
15*/}}
16
17
18
19{{- define "common.certInitializer._aafConfigVolumeName" -}}
20 {{ include "common.fullname" . }}-aaf-config
21{{- end -}}
22
23{{- define "common.certInitializer._aafAddConfigVolumeName" -}}
24 {{ print "aaf-add-config" }}
25{{- end -}}
26
27{{/*
28 common templates to enable cert initialization for applictaions
29
30 In deployments/jobs/stateful include:
31 initContainers:
32 {{ include "common.certInitializer.initContainer" . | nindent XX }}
33
34 containers:
35 volumeMounts:
36 {{- include "common.certInitializer.volumeMount" . | nindent XX }}
37 volumes:
38 {{- include "common.certInitializer.volume" . | nindent XX}}
39*/}}
40{{- define "common.certInitializer._initContainer" -}}
41{{- $dot := default . .dot -}}
42{{- $initRoot := default $dot.Values.certInitializer .initRoot -}}
43{{- $initName := default "certInitializer" -}}
Sylvain Desbureaux41cf72f2020-05-15 17:25:52 +020044{{- $subchartDot := fromJson (include "common.subChartDot" (dict "dot" $dot "initRoot" $initRoot)) }}
Krzysztof Opasiake9754a02020-07-16 21:06:39 +020045{{ include "common.readinessCheck.waitFor" $subchartDot }}
Krzysztof Opasiak020cdb92020-05-01 01:46:37 +020046- name: {{ include "common.name" $dot }}-aaf-config
Sylvain Desbureaux145140b2020-11-19 16:48:39 +010047 image: {{ include "repositoryGenerator.repository" $subchartDot }}/{{ $subchartDot.Values.global.aafAgentImage }}
Krzysztof Opasiak3e5fa9a2020-05-19 00:44:12 +020048 imagePullPolicy: {{ $subchartDot.Values.global.pullPolicy | default $subchartDot.Values.pullPolicy }}
Krzysztof Opasiak020cdb92020-05-01 01:46:37 +020049 volumeMounts:
50 - mountPath: {{ $initRoot.mountPath }}
51 name: {{ include "common.certInitializer._aafConfigVolumeName" $dot }}
Krzysztof Opasiak95a5f842020-05-06 23:27:18 +020052 - mountPath: /opt/app/aaf_config/cert/truststoreONAPall.jks.b64
53 name: aaf-agent-certs
54 subPath: truststoreONAPall.jks.b64
55 - mountPath: /opt/app/aaf_config/cert/truststoreONAP.p12.b64
56 name: aaf-agent-certs
57 subPath: truststoreONAP.p12.b64
Krzysztof Opasiak020cdb92020-05-01 01:46:37 +020058{{- if $initRoot.aaf_add_config }}
59 - name: {{ include "common.certInitializer._aafAddConfigVolumeName" $dot }}
60 mountPath: /opt/app/aaf_config/bin/aaf-add-config.sh
61 subPath: aaf-add-config.sh
62{{- end }}
63 command:
64 - sh
65 - -c
66 - |
67 #!/usr/bin/env bash
68 /opt/app/aaf_config/bin/agent.sh
69{{- if $initRoot.aaf_add_config }}
70 /opt/app/aaf_config/bin/aaf-add-config.sh
71{{- end }}
72 env:
73 - name: APP_FQI
74 value: "{{ $initRoot.fqi }}"
75 - name: aaf_locate_url
76 value: "https://aaf-locate.{{ $dot.Release.Namespace}}:8095"
77 - name: aaf_locator_container
78 value: "oom"
79 - name: aaf_locator_container_ns
80 value: "{{ $dot.Release.Namespace }}"
81 - name: aaf_locator_fqdn
82 value: "{{ $initRoot.fqdn }}"
83 - name: aaf_locator_app_ns
84 value: "{{ $initRoot.app_ns }}"
85 - name: DEPLOY_FQI
86 {{- include "common.secret.envFromSecretFast" (dict "global" $subchartDot "uid" "deployer-creds" "key" "login") | indent 6 }}
87 - name: DEPLOY_PASSWORD
88 {{- include "common.secret.envFromSecretFast" (dict "global" $subchartDot "uid" "deployer-creds" "key" "password") | indent 6 }}
89 #Note: want to put this on Nodes, eventually
90 - name: cadi_longitude
91 value: "{{ default "52.3" $initRoot.cadi_longitude }}"
92 - name: cadi_latitude
93 value: "{{ default "13.2" $initRoot.cadi_latitude }}"
94 #Hello specific. Clients don't don't need this, unless Registering with AAF Locator
95 - name: aaf_locator_public_fqdn
96 value: "{{ $initRoot.public_fqdn | default "" }}"
97{{- end -}}
98
Jozsef Csongvai9d4d5af2020-07-13 11:10:25 -040099{{/*
100 This init container will import custom .pem certificates to truststoreONAPall.jks
101 Custom certificates must be placed in common/certInitializer/resources directory.
102
103 The feature is enabled by setting Values.global.importCustomCertsEnabled = true
104 It can be used independently of aafEnabled, however it requires the same includes
105 as describe above for _initContainer.
106
107 When AAF is enabled the truststoreONAPAll.jks (which contains AAF CA) will be used
108 to import custom certificates, otherwise the default java keystore will be used.
109
110 The updated truststore file will be placed in /updatedTruststore and can be mounted per component
111 to a specific path by defining Values.certInitializer.truststoreMountpath (see _trustStoreVolumeMount)
112 The truststore file will be available to mount even if no custom certificates were imported.
113*/}}
114{{- define "common.certInitializer._initImportCustomCertsContainer" -}}
115{{- $dot := default . .dot -}}
116{{- $initRoot := default $dot.Values.certInitializer .initRoot -}}
117{{- $subchartDot := fromJson (include "common.subChartDot" (dict "dot" $dot "initRoot" $initRoot)) }}
118- name: {{ include "common.name" $dot }}-import-custom-certs
Sylvain Desbureaux145140b2020-11-19 16:48:39 +0100119 image: {{ include "repositoryGenerator.image.jre" $subchartDot }}
Jozsef Csongvai9d4d5af2020-07-13 11:10:25 -0400120 imagePullPolicy: {{ $subchartDot.Values.global.pullPolicy | default $subchartDot.Values.pullPolicy }}
121 securityContext:
122 runAsUser: 0
123 command:
Sylvain Desbureaux36389672021-01-19 14:51:24 +0100124 - /bin/sh
Jozsef Csongvai9d4d5af2020-07-13 11:10:25 -0400125 - -c
126 - /root/import-custom-certs.sh
127 env:
128 - name: AAF_ENABLED
129 value: "{{ $subchartDot.Values.global.aafEnabled }}"
130 - name: TRUSTSTORE_OUTPUT_FILENAME
131 value: "{{ $initRoot.truststoreOutputFileName }}"
132 - name: TRUSTSTORE_PASSWORD
133 {{- include "common.secret.envFromSecretFast" (dict "global" $subchartDot "uid" "truststore-creds" "key" "password") | indent 6 }}
134 volumeMounts:
135 - mountPath: /certs
136 name: aaf-agent-certs
137 - mountPath: /root/import-custom-certs.sh
138 name: aaf-agent-certs
139 subPath: import-custom-certs.sh
140 - mountPath: /updatedTruststore
141 name: updated-truststore
142{{- end -}}
143
Krzysztof Opasiak020cdb92020-05-01 01:46:37 +0200144{{- define "common.certInitializer._volumeMount" -}}
145{{- $dot := default . .dot -}}
146{{- $initRoot := default $dot.Values.certInitializer .initRoot -}}
krishnaa96edf6f372020-09-09 09:30:58 +0530147- mountPath: {{ $initRoot.appMountPath }}
Krzysztof Opasiak020cdb92020-05-01 01:46:37 +0200148 name: {{ include "common.certInitializer._aafConfigVolumeName" $dot }}
149{{- end -}}
150
Jozsef Csongvai9d4d5af2020-07-13 11:10:25 -0400151{{/*
152 This is used together with _initImportCustomCertsContainer
153 It mounts the updated truststore (with imported custom certificates) to the
154 truststoreMountpath defined in the values file for the component.
155*/}}
156{{- define "common.certInitializer._trustStoreVolumeMount" -}}
157{{- $dot := default . .dot -}}
158{{- $initRoot := default $dot.Values.certInitializer .initRoot -}}
159{{- if gt (len $initRoot.truststoreMountpath) 0 }}
160- mountPath: {{ $initRoot.truststoreMountpath }}/{{ $initRoot.truststoreOutputFileName }}
161 name: updated-truststore
162 subPath: {{ $initRoot.truststoreOutputFileName }}
163{{- end -}}
164{{- end -}}
165
Krzysztof Opasiak020cdb92020-05-01 01:46:37 +0200166{{- define "common.certInitializer._volumes" -}}
167{{- $dot := default . .dot -}}
168{{- $initRoot := default $dot.Values.certInitializer .initRoot -}}
Krzysztof Opasiak3e5fa9a2020-05-19 00:44:12 +0200169{{- $subchartDot := mergeOverwrite (deepCopy (omit $dot "Values")) (dict "Chart" (set (fromJson (toJson $dot.Chart)) "Name" $initRoot.nameOverride) "Values" (mergeOverwrite (deepCopy $initRoot) (dict "global" $dot.Values.global))) }}
Krzysztof Opasiak020cdb92020-05-01 01:46:37 +0200170- name: {{ include "common.certInitializer._aafConfigVolumeName" $dot }}
171 emptyDir:
172 medium: Memory
Krzysztof Opasiak95a5f842020-05-06 23:27:18 +0200173- name: aaf-agent-certs
174 configMap:
Krzysztof Opasiak75f18752020-09-09 20:32:56 +0200175 name: {{ tpl $subchartDot.Values.certsCMName $subchartDot }}
Krzysztof Opasiak95a5f842020-05-06 23:27:18 +0200176 defaultMode: 0700
177
Krzysztof Opasiak108483c2020-05-14 01:44:30 +0200178{{- if $initRoot.aaf_add_config }}
179- name: {{ include "common.certInitializer._aafAddConfigVolumeName" $dot }}
180 configMap:
181 name: {{ include "common.fullname" $subchartDot }}-add-config
182 defaultMode: 0700
Krzysztof Opasiak020cdb92020-05-01 01:46:37 +0200183{{- end -}}
Jozsef Csongvai9d4d5af2020-07-13 11:10:25 -0400184{{- if $dot.Values.global.importCustomCertsEnabled }}
185- name: updated-truststore
186 emptyDir: {}
187{{- end -}}
Krzysztof Opasiak020cdb92020-05-01 01:46:37 +0200188{{- end -}}
189
190{{- define "common.certInitializer.initContainer" -}}
191{{- $dot := default . .dot -}}
Jozsef Csongvai9d4d5af2020-07-13 11:10:25 -0400192 {{- if $dot.Values.global.importCustomCertsEnabled }}
193 {{ include "common.certInitializer._initImportCustomCertsContainer" . }}
194 {{- end -}}
Krzysztof Opasiak020cdb92020-05-01 01:46:37 +0200195 {{- if $dot.Values.global.aafEnabled }}
196 {{ include "common.certInitializer._initContainer" . }}
197 {{- end -}}
198{{- end -}}
199
200{{- define "common.certInitializer.volumeMount" -}}
201{{- $dot := default . .dot -}}
202 {{- if $dot.Values.global.aafEnabled }}
203 {{- include "common.certInitializer._volumeMount" . }}
204 {{- end -}}
Jozsef Csongvai9d4d5af2020-07-13 11:10:25 -0400205 {{- if $dot.Values.global.importCustomCertsEnabled }}
206 {{- include "common.certInitializer._trustStoreVolumeMount" . }}
207 {{- end -}}
Krzysztof Opasiak020cdb92020-05-01 01:46:37 +0200208{{- end -}}
209
210{{- define "common.certInitializer.volumes" -}}
211{{- $dot := default . .dot -}}
Jozsef Csongvai9d4d5af2020-07-13 11:10:25 -0400212 {{- if or ($dot.Values.global.aafEnabled ) ($dot.Values.global.importCustomCertsEnabled) }}
Krzysztof Opasiak020cdb92020-05-01 01:46:37 +0200213 {{- include "common.certInitializer._volumes" . }}
214 {{- end -}}
215{{- end -}}