| --- kubernetes/common/dgbuilder/templates/deployment.yaml 2019-01-28 13:01:35.017243076 +0100 |
| +++ kubernetes/common/dgbuilder/templates/deployment.yaml 2019-01-28 13:19:04.238712534 +0100 |
| @@ -49,8 +49,14 @@ |
| - name: {{ include "common.name" . }} |
| image: "{{ include "common.repository" . }}/{{ .Values.image }}" |
| imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} |
| - command: ["/bin/bash"] |
| - args: ["-c", "cd /opt/onap/ccsdk/dgbuilder/ && ./start.sh sdnc1.0 && wait"] |
| + command: |
| + - /bin/bash |
| + - -c |
| + - > |
| + HOSTS_FILE_RECORD >> /etc/hosts; |
| + NPM_REGISTRY_RECORD; |
| + cd /opt/onap/ccsdk/dgbuilder/; |
| + ./start.sh sdnc1.0 && wait |
| ports: |
| - containerPort: {{ .Values.service.internalPort }} |
| readinessProbe: |
| --- kubernetes/sdnc/charts/sdnc-portal/templates/deployment.yaml 2019-01-28 13:01:35.087243698 +0100 |
| +++ kubernetes/sdnc/charts/sdnc-portal/templates/deployment.yaml 2019-01-28 13:29:24.881069646 +0100 |
| @@ -49,8 +49,13 @@ |
| name: {{ include "common.name" . }}-readiness |
| containers: |
| - name: {{ include "common.name" . }} |
| - command: ["/bin/bash"] |
| - args: ["-c", "cd /opt/onap/sdnc/admportal/shell && ./start_portal.sh"] |
| + command: |
| + - /bin/bash |
| + - -c |
| + - > |
| + HOSTS_FILE_RECORD >> /etc/hosts; |
| + NPM_REGISTRY_RECORD; |
| + cd /opt/onap/sdnc/admportal/shell && ./start_portal.sh |
| image: "{{ include "common.repository" . }}/{{ .Values.image }}" |
| imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} |
| ports: |
| --- kubernetes/dcaegen2/charts/dcae-cloudify-manager/templates/deployment.yaml 2019-01-24 09:55:30.000000000 +0100 |
| +++ kubernetes/dcaegen2/charts/dcae-cloudify-manager/templates/deployment.yaml 2019-01-29 18:07:59.057804519 +0100 |
| @@ -70,6 +70,8 @@ |
| - mountPath: /etc/localtime |
| name: localtime |
| readOnly: true |
| + - mountPath: /etc/pki/ca-trust/source/anchors |
| + name: root-ca |
| securityContext: |
| privileged: True |
| lifecycle: |
| @@ -82,6 +84,8 @@ |
| set -ex |
| mkdir -p /var/run/secrets/kubernetes.io/ |
| ln -s /secret /var/run/secrets/kubernetes.io/serviceaccount |
| + echo -e '\nREQUESTS_CA_BUNDLE="/etc/ssl/certs/ca-bundle.crt"' >> /etc/sysconfig/cloudify-restservice |
| + update-ca-trust extract |
| volumes: |
| - name: {{ include "common.fullname" . }}-config |
| configMap: |
| @@ -95,5 +99,8 @@ |
| - name: localtime |
| hostPath: |
| path: /etc/localtime |
| + - name: root-ca |
| + hostPath: |
| + path: /etc/pki/ca-trust/source/anchors |
| imagePullSecrets: |
| - name: "{{ include "common.namespace" . }}-docker-registry-key" |
| --- kubernetes/policy/charts/brmsgw/templates/deployment.yaml 2019-01-24 09:55:33.000000000 +0100 |
| +++ kubernetes/policy/charts/brmsgw/templates/deployment.yaml 2019-01-31 13:01:49.911044498 +0100 |
| @@ -46,6 +46,7 @@ |
| image: "{{ .Values.global.readinessRepository }}/{{ .Values.global.readinessImage }}" |
| imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} |
| name: {{ include "common.name" . }}-readiness |
| +{{ include "common.update-system-ca-store-ubuntu" . | indent 6 }} |
| containers: |
| - command: |
| - /bin/bash |
| @@ -69,6 +70,8 @@ |
| initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }} |
| periodSeconds: {{ .Values.readiness.periodSeconds }} |
| volumeMounts: |
| +{{ include "common.cacert-mount-ubuntu" . | indent 8 }} |
| +{{ include "common.system-ca-store-mount-ubuntu" . | indent 8 }} |
| - mountPath: /etc/localtime |
| name: localtime |
| readOnly: true |
| @@ -95,6 +98,8 @@ |
| {{ toYaml .Values.affinity | indent 10 }} |
| {{- end }} |
| volumes: |
| +{{ include "common.cacert-volume" . | indent 8 }} |
| +{{ include "common.system-ca-store-volume" . | indent 8 }} |
| - name: localtime |
| hostPath: |
| path: /etc/localtime |
| --- kubernetes/policy/charts/drools/templates/statefulset.yaml 2019-01-24 09:55:33.000000000 +0100 |
| +++ kubernetes/policy/charts/drools/templates/statefulset.yaml 2019-01-31 13:04:00.848634430 +0100 |
| @@ -52,6 +52,8 @@ |
| image: "{{ .Values.global.readinessRepository }}/{{ .Values.global.readinessImage }}" |
| imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} |
| name: {{ include "common.name" . }}-readiness |
| +{{ include "common.update-system-ca-store-ubuntu" . | indent 6 }} |
| +{{ include "policy.update-policy-keystore" . | indent 6 }} |
| containers: |
| - name: {{ include "common.name" . }} |
| image: "{{ include "common.repository" . }}/{{ .Values.image }}" |
| @@ -79,6 +81,9 @@ |
| - name: REPLICAS |
| value: "{{ .Values.replicaCount }}" |
| volumeMounts: |
| +{{ include "common.cacert-mount-ubuntu" . | indent 10 }} |
| +{{ include "common.system-ca-store-mount-ubuntu" . | indent 10 }} |
| +{{ include "policy.keystore-mount" . | indent 10 }} |
| - mountPath: /etc/localtime |
| name: localtime |
| readOnly: true |
| @@ -137,6 +142,9 @@ |
| {{ toYaml .Values.affinity | indent 10 }} |
| {{- end }} |
| volumes: |
| +{{ include "common.cacert-volume" . | indent 8 }} |
| +{{ include "common.system-ca-store-volume" . | indent 8 }} |
| +{{ include "policy.keystore-storage-volume" . | indent 8 }} |
| - name: localtime |
| hostPath: |
| path: /etc/localtime |
| --- kubernetes/policy/charts/pdp/templates/statefulset.yaml 2019-01-24 09:55:33.000000000 +0100 |
| +++ kubernetes/policy/charts/pdp/templates/statefulset.yaml 2019-01-31 13:07:16.161006088 +0100 |
| @@ -50,6 +50,7 @@ |
| image: "{{ .Values.global.readinessRepository }}/{{ .Values.global.readinessImage }}" |
| imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} |
| name: {{ include "common.name" . }}-readiness |
| +{{ include "common.update-system-ca-store-ubuntu" . | indent 6 }} |
| containers: |
| - command: |
| - /bin/bash |
| @@ -75,6 +76,8 @@ |
| initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }} |
| periodSeconds: {{ .Values.readiness.periodSeconds }} |
| volumeMounts: |
| +{{ include "common.cacert-mount-ubuntu" . | indent 8 }} |
| +{{ include "common.system-ca-store-mount-ubuntu" . | indent 8 }} |
| - mountPath: /etc/localtime |
| name: localtime |
| readOnly: true |
| @@ -114,6 +117,8 @@ |
| - mountPath: /usr/share/filebeat/data |
| name: policy-data-filebeat |
| volumes: |
| +{{ include "common.cacert-volume" . | indent 6 }} |
| +{{ include "common.system-ca-store-volume" . | indent 6 }} |
| - name: localtime |
| hostPath: |
| path: /etc/localtime |
| --- kubernetes/common/common/templates/_cacert.tpl 2019-01-31 13:09:54.170924801 +0100 |
| +++ kubernetes/common/common/templates/_cacert.tpl 2019-01-31 13:10:54.650659206 +0100 |
| @@ -0,0 +1,80 @@ |
| +# COPYRIGHT NOTICE STARTS HERE |
| +# |
| +# Copyright 2018 © Samsung Electronics Co., Ltd. |
| +# |
| +# Licensed under the Apache License, Version 2.0 (the "License"); |
| +# you may not use this file except in compliance with the License. |
| +# You may obtain a copy of the License at |
| +# |
| +# http://www.apache.org/licenses/LICENSE-2.0 |
| +# |
| +# Unless required by applicable law or agreed to in writing, software |
| +# distributed under the License is distributed on an "AS IS" BASIS, |
| +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| +# See the License for the specific language governing permissions and |
| +# limitations under the License. |
| +# |
| +# COPYRIGHT NOTICE ENDS HERE |
| + |
| +#This template adds volume for access to ca certificate. |
| +#Template is ignored when cacert not set. |
| +{{- define "common.cacert-volume" }} |
| +{{- if .Values.global.cacert }} |
| +- name: cacert |
| + configMap: |
| + name: {{ include "common.namespace" . }}-root-ca-cert |
| +{{- end }} |
| +{{- end }} |
| + |
| +#This template mounts the CA certificate in an ubuntu compatible way. |
| +#It is mounted to /usr/local/share/ca-certificates/cacert.crt. |
| +#Template is ignored if cacert not set. |
| +{{- define "common.cacert-mount-ubuntu" }} |
| +{{- if .Values.global.cacert }} |
| +- mountPath: "/usr/local/share/ca-certificates/cacert.crt" |
| + name: cacert |
| + subPath: certificate |
| +{{- end }} |
| +{{- end }} |
| + |
| +#This template creates an empty volume used to store system certificates (includes java keystore). |
| +{{- define "common.system-ca-store-volume" }} |
| +{{- if .Values.global.cacert }} |
| +- name: system-ca-store |
| + emptyDir: |
| +{{- end }} |
| +{{- end }} |
| + |
| +#This template mounts system ca store volume to /etc/ssl/certs (ubuntu specific). |
| +#Template is ignored in case cacert is not given. |
| +{{- define "common.system-ca-store-mount-ubuntu" }} |
| +{{- if .Values.global.cacert }} |
| +- mountPath: "/etc/ssl/certs" |
| + name: system-ca-store |
| +{{- end }} |
| +{{- end }} |
| + |
| +#This template is a template for an init container. |
| +#This init container can be declared to update system's ca store for ubuntu containers. |
| +#It runs as root using the same image as the main one. |
| +#It expects /etc/ssl/certs to be mounted as a volume. |
| +#It has to be shared with the main container. |
| +#This template is ignored if cacert is not given as helm value. |
| +{{- define "common.update-system-ca-store-ubuntu" }} |
| +{{- if .Values.global.cacert }} |
| +- command: |
| + - "/bin/bash" |
| + - "-c" |
| + - | |
| + mkdir -p /etc/ssl/certs/java |
| + update-ca-certificates |
| + name: update-system-ca-store |
| + imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} |
| + image: {{ include "common.repository" . }}/{{ .Values.image }} |
| + securityContext: |
| + runAsUser: 0 |
| + volumeMounts: |
| +{{ include "common.cacert-mount-ubuntu" . | indent 2 }} |
| +{{ include "common.system-ca-store-mount-ubuntu" . | indent 2 }} |
| +{{- end }} |
| +{{- end }} |
| --- kubernetes/onap/templates/configmap.yaml 2019-01-31 13:09:54.170924801 +0100 |
| +++ kubernetes/onap/templates/configmap.yaml 2019-01-31 13:11:24.628023219 +0100 |
| @@ -0,0 +1,33 @@ |
| +# COPYRIGHT NOTICE STARTS HERE |
| +# |
| +# Copyright 2018 © Samsung Electronics Co., Ltd. |
| +# |
| +# Licensed under the Apache License, Version 2.0 (the "License"); |
| +# you may not use this file except in compliance with the License. |
| +# You may obtain a copy of the License at |
| +# |
| +# http://www.apache.org/licenses/LICENSE-2.0 |
| +# |
| +# Unless required by applicable law or agreed to in writing, software |
| +# distributed under the License is distributed on an "AS IS" BASIS, |
| +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| +# See the License for the specific language governing permissions and |
| +# limitations under the License. |
| +# |
| +# COPYRIGHT NOTICE ENDS HERE |
| + |
| +{{ if .Values.global.cacert -}} |
| +apiVersion: v1 |
| +kind: ConfigMap |
| +metadata: |
| + name: {{ include "common.namespace" . }}-root-ca-cert |
| + namespace: {{ include "common.namespace" . }} |
| + labels: |
| + app: {{ include "common.name" . }} |
| + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} |
| + release: {{ .Release.Name }} |
| + heritage: {{ .Release.Service }} |
| +data: |
| + certificate: | |
| +{{ .Values.global.cacert | indent 4 }} |
| +{{- end }} |
| --- kubernetes/policy/charts/policy-common/templates/_keystore.tpl 2019-01-31 13:09:54.170924801 +0100 |
| +++ kubernetes/policy/charts/policy-common/templates/_keystore.tpl 2019-01-31 13:11:49.122320657 +0100 |
| @@ -0,0 +1,61 @@ |
| +# COPYRIGHT NOTICE STARTS HERE |
| +# |
| +# Copyright 2018 © Samsung Electronics Co., Ltd. |
| +# |
| +# Licensed under the Apache License, Version 2.0 (the "License"); |
| +# you may not use this file except in compliance with the License. |
| +# You may obtain a copy of the License at |
| +# |
| +# http://www.apache.org/licenses/LICENSE-2.0 |
| +# |
| +# Unless required by applicable law or agreed to in writing, software |
| +# distributed under the License is distributed on an "AS IS" BASIS, |
| +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| +# See the License for the specific language governing permissions and |
| +# limitations under the License. |
| +# |
| +# COPYRIGHT NOTICE ENDS HERE |
| + |
| +#This template creates a volume for storing policy-keystore with imported ca. |
| +#It is ignored if cacert was not given. |
| +{{- define "policy.keystore-storage-volume" }} |
| +{{- if .Values.global.cacert }} |
| +- name: keystore-storage |
| + emptyDir: |
| +{{- end }} |
| +{{- end }} |
| + |
| +#This template mounts policy-keystore in appropriate place for policy components to take it. |
| +#It is ignored if cacert is not given. |
| +{{- define "policy.keystore-mount" }} |
| +{{- if .Values.global.cacert }} |
| +- mountPath: "/tmp/policy-install/config/policy-keystore" |
| + name: keystore-storage |
| + subPath: policy-keystore |
| +{{- end }} |
| +{{- end }} |
| + |
| +#This will extract a policy keystore and then import |
| +#the root cacert of offline nexus into it. |
| +#This template expects a volume named keystore-storage where policy-keystore will be put. |
| +#It also expects volume named cacert where the file "certificate" will contain the cert to import. |
| +#Template is ignored if ca certificate not given. |
| +{{- define "policy.update-policy-keystore" }} |
| +{{- if .Values.global.cacert }} |
| +- command: |
| + - "/bin/bash" |
| + - "-c" |
| + - | |
| + set -e |
| + tar -xzf base-*.tar.gz etc/ssl/policy-keystore |
| + cp etc/ssl/policy-keystore keystore-storage/ |
| + keytool -import -keystore keystore-storage/policy-keystore -storepass "Pol1cy_0nap" -noprompt -file /usr/local/share/ca-certificates/cacert.crt |
| + name: update-policy-keystore |
| + imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} |
| + image: {{ include "common.repository" . }}/{{ .Values.image }} |
| + volumeMounts: |
| + - mountPath: "/tmp/policy-install/keystore-storage" |
| + name: keystore-storage |
| +{{ include "common.cacert-mount-ubuntu" . | indent 2 }} |
| +{{- end }} |
| +{{- end }} |
| --- kubernetes/appc/charts/appc-ansible-server/templates/deployment.yaml 2019-02-01 13:40:02.349210360 +0100 |
| +++ kubernetes/appc/charts/appc-ansible-server/templates/deployment.yaml 2019-02-01 15:29:52.182542898 +0100 |
| @@ -47,8 +47,16 @@ |
| name: {{ include "common.name" . }}-readiness |
| containers: |
| - name: {{ include "common.name" . }} |
| - command: ["/bin/bash"] |
| - args: ["-c", "cd /opt/onap/ccsdk && ./startAnsibleServer.sh"] |
| + command: |
| + - /bin/bash |
| + - -c |
| + - > |
| + pip install -i http://nexus3.onap.org/repository/pypi-private/simple/ |
| + --trusted-host nexus3.onap.org |
| + PyMySQL cherrypy requests; |
| + curl -s repo.infra-server/ubuntu/xenial/onap.list > /etc/apt/sources.list; |
| + apt-get update; |
| + cd /opt/onap/ccsdk && ./startAnsibleServer.sh |
| image: "{{ include "common.repository" . }}/{{ .Values.image }}" |
| imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} |
| ports: |
| --- kubernetes/sdnc/charts/sdnc-ansible-server/templates/deployment.yaml 2019-02-01 13:40:02.415877026 +0100 |
| +++ kubernetes/sdnc/charts/sdnc-ansible-server/templates/deployment.yaml 2019-02-01 15:29:39.399209565 +0100 |
| @@ -47,8 +47,16 @@ |
| name: {{ include "common.name" . }}-readiness |
| containers: |
| - name: {{ include "common.name" . }} |
| - command: ["/bin/bash"] |
| - args: ["-c", "cd /opt/onap/ccsdk && ./startAnsibleServer.sh"] |
| + command: |
| + - /bin/bash |
| + - -c |
| + - > |
| + pip install -i http://nexus3.onap.org/repository/pypi-private/simple/ |
| + --trusted-host nexus3.onap.org |
| + PyMySQL cherrypy requests; |
| + curl -s repo.infra-server/ubuntu/xenial/onap.list > /etc/apt/sources.list; |
| + apt-get update; |
| + cd /opt/onap/ccsdk && ./startAnsibleServer.sh |
| image: "{{ include "common.repository" . }}/{{ .Values.image }}" |
| imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} |
| ports: |