| diff --git a/kubernetes/appc/values.yaml b/kubernetes/appc/values.yaml |
| index 1c20977..4b47c63 100644 |
| --- a/kubernetes/appc/values.yaml |
| +++ b/kubernetes/appc/values.yaml |
| @@ -29,7 +29,7 @@ global: |
| ################################################################# |
| # application image |
| repository: nexus3.onap.org:10001 |
| -image: onap/appc-image:1.4.0-SNAPSHOT-latest |
| +image: onap/appc-image:1.3.0 |
| pullPolicy: Always |
| |
| # flag to enable debugging - application support required |
| @@ -37,10 +37,7 @@ debugEnabled: false |
| |
| # application configuration |
| config: |
| - aafExtIP: 127.0.0.1 |
| - aafExtFQDN: aaf-onap-beijing-test.osaaf.org |
| dbRootPassword: openECOMP1.0 |
| - enableAAF: false |
| enableClustering: true |
| configDir: /opt/onap/appc/data/properties |
| dmaapTopic: SUCCESS |
| diff --git a/kubernetes/common/dgbuilder/templates/deployment.yaml b/kubernetes/common/dgbuilder/templates/deployment.yaml |
| index 328e058..b359526 100644 |
| --- a/kubernetes/common/dgbuilder/templates/deployment.yaml |
| +++ b/kubernetes/common/dgbuilder/templates/deployment.yaml |
| @@ -35,8 +35,14 @@ spec: |
| - name: {{ include "common.name" . }} |
| image: "{{ include "common.repository" . }}/{{ .Values.image }}" |
| imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} |
| - command: ["/bin/bash"] |
| - args: ["-c", "cd /opt/onap/ccsdk/dgbuilder/ && ./start.sh sdnc1.0 && wait"] |
| + command: |
| + - /bin/bash |
| + - -c |
| + - > |
| + UPDATE_HOSTS_FILE >> /etc/hosts; |
| + UPDATE_NPM_REGISTRY; |
| + cd /opt/onap/ccsdk/dgbuilder/; |
| + ./start.sh sdnc1.0 && wait |
| ports: |
| - containerPort: {{ .Values.service.internalPort }} |
| readinessProbe: |
| @@ -94,3 +100,4 @@ spec: |
| defaultMode: 0755 |
| imagePullSecrets: |
| - name: "{{ include "common.namespace" . }}-docker-registry-key" |
| + |
| diff --git a/kubernetes/dcaegen2/charts/dcae-cloudify-manager/templates/deployment.yaml b/kubernetes/dcaegen2/charts/dcae-cloudify-manager/templates/deployment.yaml |
| index acda520..8fa35f9 100644 |
| --- a/kubernetes/dcaegen2/charts/dcae-cloudify-manager/templates/deployment.yaml |
| +++ b/kubernetes/dcaegen2/charts/dcae-cloudify-manager/templates/deployment.yaml |
| @@ -68,6 +68,8 @@ spec: |
| - mountPath: /etc/localtime |
| name: localtime |
| readOnly: true |
| + - mountPath: /etc/pki/ca-trust/source/anchors |
| + name: root-ca |
| securityContext: |
| privileged: True |
| lifecycle: |
| @@ -80,6 +82,8 @@ spec: |
| set -ex |
| mkdir -p /var/run/secrets/kubernetes.io/ |
| ln -s /secret /var/run/secrets/kubernetes.io/serviceaccount |
| + echo -e '\nREQUESTS_CA_BUNDLE="/etc/ssl/certs/ca-bundle.crt"' >> /etc/sysconfig/cloudify-restservice |
| + update-ca-trust extract |
| volumes: |
| - name: {{ include "common.fullname" . }}-config |
| configMap: |
| @@ -93,5 +97,8 @@ spec: |
| - name: localtime |
| hostPath: |
| path: /etc/localtime |
| + - name: root-ca |
| + hostPath: |
| + path: CERT_PATH |
| imagePullSecrets: |
| - name: "{{ include "common.namespace" . }}-docker-registry-key" |
| diff --git a/kubernetes/dmaap/charts/message-router/templates/deployment.yaml b/kubernetes/dmaap/charts/message-router/templates/deployment.yaml |
| index 379fc24..4802f8b 100644 |
| --- a/kubernetes/dmaap/charts/message-router/templates/deployment.yaml |
| +++ b/kubernetes/dmaap/charts/message-router/templates/deployment.yaml |
| @@ -48,6 +48,12 @@ spec: |
| name: {{ include "common.name" . }}-readiness |
| containers: |
| - name: {{ include "common.name" . }} |
| + command: |
| + - /bin/sh |
| + - -c |
| + - > |
| + UPDATE_HOSTS_FILE >> /etc/hosts; |
| + ./startup.sh |
| image: "{{ include "common.repository" . }}/{{ .Values.image }}" |
| imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} |
| ports: |
| diff --git a/kubernetes/onap/values.yaml b/kubernetes/onap/values.yaml |
| index b8f15e1..fadb56e 100644 |
| --- a/kubernetes/onap/values.yaml |
| +++ b/kubernetes/onap/values.yaml |
| @@ -39,7 +39,8 @@ global: |
| loggingRepository: docker.elastic.co |
| |
| # image pull policy |
| - pullPolicy: Always |
| + #pullPolicy: Always |
| + pullPolicy: IfNotPresent |
| |
| # default mount path root directory referenced |
| # by persistent volumes and log files |
| @@ -66,11 +67,11 @@ appc: |
| config: |
| openStackType: OpenStackProvider |
| openStackName: OpenStack |
| - openStackKeyStoneUrl: http://localhost:8181/apidoc/explorer/index.html |
| - openStackServiceTenantName: default |
| - openStackDomain: default |
| - openStackUserName: admin |
| - openStackEncryptedPassword: admin |
| + openStackKeyStoneUrl: FILL-ME |
| + openStackServiceTenantName: FILL-ME |
| + openStackDomain: FILL-ME |
| + openStackUserName: FILL-ME |
| + openStackEncryptedPassword: FILL-ME |
| clamp: |
| enabled: true |
| cli: |
| @@ -97,8 +98,11 @@ nbi: |
| enabled: true |
| config: |
| # openstack configuration |
| - openStackRegion: "Yolo" |
| - openStackVNFTenantId: "1234" |
| + openStackUserName: "FILL-ME" |
| + openStackRegion: "FILL-ME" |
| + openStackKeyStoneUrl: "FILL-ME" |
| + openStackServiceTenantName: "FILL-ME" |
| + openStackEncryptedPasswordHere: "FILL-ME" |
| policy: |
| enabled: true |
| portal: |
| @@ -112,7 +116,11 @@ sdnc: |
| |
| replicaCount: 1 |
| |
| + config: |
| + enableClustering: false |
| + |
| mysql: |
| + disableNfsProvisioner: true |
| replicaCount: 1 |
| so: |
| enabled: true |
| @@ -129,11 +137,11 @@ so: |
| # message router configuration |
| dmaapTopic: "AUTO" |
| # openstack configuration |
| - openStackUserName: "vnf_user" |
| - openStackRegion: "RegionOne" |
| - openStackKeyStoneUrl: "http://1.2.3.4:5000" |
| - openStackServiceTenantName: "service" |
| - openStackEncryptedPasswordHere: "c124921a3a0efbe579782cde8227681e" |
| + openStackUserName: "FILL-ME" |
| + openStackRegion: "FILL-ME" |
| + openStackKeyStoneUrl: "FILL-ME" |
| + openStackServiceTenantName: "FILL-ME" |
| + openStackEncryptedPasswordHere: "FILL-ME" |
| |
| # configure embedded mariadb |
| mariadb: |
| diff --git a/kubernetes/policy/charts/drools/resources/config/opt/policy/config/drools/apps-install.sh b/kubernetes/policy/charts/drools/resources/config/opt/policy/config/drools/apps-install.sh |
| index 72f7a74..f6b3478 100644 |
| --- a/kubernetes/policy/charts/drools/resources/config/opt/policy/config/drools/apps-install.sh |
| +++ b/kubernetes/policy/charts/drools/resources/config/opt/policy/config/drools/apps-install.sh |
| @@ -114,7 +114,7 @@ else |
| url_release |
| fi |
| |
| -wget "${APP_URL}" -O "${DOWNLOAD_DIR}"/apps-"${APP_NAME}".zip |
| +wget "${APP_URL}" -O "${DOWNLOAD_DIR}"/apps-"${APP_NAME}".zip --no-check-certificate |
| if [[ $? != 0 ]]; then |
| echo "ERROR: cannot download ${DOWNLOAD_DIR}/apps-${APP_NAME}.zip" |
| exit 1 |
| diff --git a/kubernetes/policy/charts/drools/resources/scripts/update-vfw-op-policy.sh b/kubernetes/policy/charts/drools/resources/scripts/update-vfw-op-policy.sh |
| index a6c054d..9e48d55 100644 |
| --- a/kubernetes/policy/charts/drools/resources/scripts/update-vfw-op-policy.sh |
| +++ b/kubernetes/policy/charts/drools/resources/scripts/update-vfw-op-policy.sh |
| @@ -84,8 +84,8 @@ echo "Restarting PDP-D .." |
| echo |
| echo |
| |
| -POD=$(kubectl --namespace onap-policy get pods | sed 's/ .*//'| grep drools) |
| -kubectl --namespace onap-policy exec -it ${POD} -- bash -c "source /opt/app/policy/etc/profile.d/env.sh && policy stop && sleep 5 && policy start" |
| +POD=$(kubectl --namespace onap get pods | sed 's/ .*//'| grep drools) |
| +kubectl --namespace onap exec -it ${POD} -- bash -c "source /opt/app/policy/etc/profile.d/env.sh && policy stop && sleep 1 && policy start" |
| |
| sleep 20 |
| |
| diff --git a/kubernetes/policy/resources/config/pe/push-policies.sh b/kubernetes/policy/resources/config/pe/push-policies.sh |
| index dcd3afb..21b3171 100644 |
| --- a/kubernetes/policy/resources/config/pe/push-policies.sh |
| +++ b/kubernetes/policy/resources/config/pe/push-policies.sh |
| @@ -22,7 +22,7 @@ echo "Upload BRMS Param Template" |
| |
| sleep 2 |
| |
| -wget -O cl-amsterdam-template.drl https://git.onap.org/policy/drools-applications/plain/controlloop/templates/archetype-cl-amsterdam/src/main/resources/archetype-resources/src/main/resources/__closedLoopControlName__.drl?h=beijing |
| +wget -O cl-amsterdam-template.drl https://git.onap.org/policy/drools-applications/plain/controlloop/templates/archetype-cl-amsterdam/src/main/resources/archetype-resources/src/main/resources/__closedLoopControlName__.drl?h=beijing --no-check-certificate |
| |
| sleep 2 |
| |
| diff --git a/kubernetes/robot/values.yaml b/kubernetes/robot/values.yaml |
| index aea67c8..06dc17b 100644 |
| --- a/kubernetes/robot/values.yaml |
| +++ b/kubernetes/robot/values.yaml |
| @@ -39,49 +39,49 @@ config: |
| # Password of the lighthttpd server. Used for HTML auth for webpage access |
| lightHttpdPassword: robot |
| # gerrit branch where the latest heat code is checked in |
| - gerritBranch: 2.0.0-ONAP |
| + gerritBranch: master |
| # gerrit project where the latest heat code is checked in |
| gerritProject: http://gerrit.onap.org/r/demo.git |
| |
| |
| # Demo configuration |
| # Nexus demo artifact version. Maps to GLOBAL_INJECTED_ARTIFACTS_VERSION |
| -demoArtifactsVersion: "1.2.0-SNAPSHOT" |
| +demoArtifactsVersion: "1.3.0" |
| # Openstack medium sized flavour name. Maps GLOBAL_INJECTED_VM_FLAVOR |
| openStackFlavourMedium: "m1.medium" |
| # Openstack keystone URL. Maps to GLOBAL_INJECTED_KEYSTONE |
| -openStackKeyStoneUrl: "http://1.2.3.4:5000" |
| +openStackKeyStoneUrl: "FILL-ME" |
| # UUID of the Openstack network that can assign floating ips. Maps to GLOBAL_INJECTED_PUBLIC_NET_ID |
| -openStackPublicNetId: "e8f51958045716781ffc" |
| +openStackPublicNetId: "FILL-ME" |
| # password for Openstack tenant where VNFs will be spawned. Maps to GLOBAL_INJECTED_OPENSTACK_PASSWORD |
| -openStackPassword: "tenantPassword" |
| +openStackPassword: "FILL-ME" |
| # Openstack region. Maps to GLOBAL_INJECTED_REGION |
| openStackRegion: "RegionOne" |
| # Openstack tenant UUID where VNFs will be spawned. Maps to GLOBAL_INJECTED_OPENSTACK_TENANT_ID |
| -openStackTenantId: "47899782ed714295b1151681fdfd51f5" |
| +openStackTenantId: "FILL-ME" |
| # username for Openstack tenant where VNFs will be spawned. Maps to GLOBAL_INJECTED_OPENSTACK_USERNAME |
| -openStackUserName: "tenantUsername" |
| +openStackUserName: "FILL-ME" |
| # Openstack glance image name for Ubuntu 14. Maps to GLOBAL_INJECTED_UBUNTU_1404_IMAGE |
| -ubuntu14Image: "Ubuntu_14_trusty" |
| +ubuntu14Image: "FILL-ME" |
| # Openstack glance image name for Ubuntu 16. Maps to GLOBAL_INJECTED_UBUNTU_1604_IMAGE |
| -ubuntu16Image: "Ubuntu_16_xenial" |
| +ubuntu16Image: "FILL-ME" |
| # GLOBAL_INJECTED_SCRIPT_VERSION. Maps to GLOBAL_INJECTED_SCRIPT_VERSION |
| -scriptVersion: "1.2.0-SNAPSHOT" |
| +scriptVersion: "1.2.1" |
| # Openstack network to which VNFs will bind their primary (first) interface. Maps to GLOBAL_INJECTED_NETWORK |
| -openStackPrivateNetId: "e8f51956-00dd-4425-af36-045716781ffc" |
| +openStackPrivateNetId: "FILL-ME" |
| |
| # SDNC Preload configuration |
| # Openstack subnet UUID for the network defined by openStackPrivateNetId. Maps to onap_private_subnet_id |
| -openStackPrivateSubnetId: "e8f51956-00dd-4425-af36-045716781ffc" |
| +openStackPrivateSubnetId: "FILL-ME" |
| # CIDR notation for the Openstack private network where VNFs will be spawned. Maps to onap_private_net_cidr |
| -openStackPrivateNetCidr: "10.0.0.0/8" |
| +openStackPrivateNetCidr: "FILL-ME" |
| # The first 2 octets of the private Openstack subnet where VNFs will be spawned. |
| # Needed because sdnc preload templates hardcodes things like this 10.0.${ecompnet}.X |
| openStackOamNetworkCidrPrefix: "10.0" |
| # Override with Pub Key for access to VNF |
| -vnfPubKey: "FILL_IN_WITH_PUB_KEY" |
| -# Override with DCAE VES Collector external IP |
| -dcaeCollectorIp: "FILL_IN_WITH_DCAE_VES_COLLECTOR_IP" |
| +vnfPubKey: "FILL-ME" |
| +# Override with DCAE VES Collector external IP |
| +dcaeCollectorIp: "FILL-ME" |
| |
| # default number of instances |
| replicaCount: 1 |
| @@ -156,4 +156,4 @@ persistence: |
| accessMode: ReadWriteMany |
| size: 2Gi |
| mountPath: /dockerdata-nfs |
| - mountSubPath: robot/logs |
| \ No newline at end of file |
| + mountSubPath: robot/logs |
| diff --git a/kubernetes/sdnc/charts/sdnc-ansible-server/templates/deployment.yaml b/kubernetes/sdnc/charts/sdnc-ansible-server/templates/deployment.yaml |
| index a19c33a..b49e2c4 100644 |
| --- a/kubernetes/sdnc/charts/sdnc-ansible-server/templates/deployment.yaml |
| +++ b/kubernetes/sdnc/charts/sdnc-ansible-server/templates/deployment.yaml |
| @@ -47,8 +47,17 @@ spec: |
| name: {{ include "common.name" . }}-readiness |
| containers: |
| - name: {{ include "common.name" . }} |
| - command: ["/bin/bash"] |
| - args: ["-c", "cd /opt/onap/sdnc && ./startAnsibleServer.sh"] |
| + command: |
| + - bash |
| + - "-c" |
| + - | |
| + pip install /root/ansible_pkg/*.whl |
| + dpkg -i /root/ansible_pkg/*.deb |
| + cp /etc/ansible/ansible.cfg /etc/ansible/ansible.cfg.orig |
| + cat /etc/ansible/ansible.cfg.orig | sed -e 's/#host_key_checking/host_key_checking/' > /etc/ansible/ansible.cfg |
| + touch /tmp/.ansible-server-installed |
| + cd /opt/onap/sdnc |
| + ./startAnsibleServer.sh |
| image: "{{ include "common.repository" . }}/{{ .Values.image }}" |
| imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} |
| ports: |
| @@ -74,6 +83,8 @@ spec: |
| - mountPath: {{ .Values.config.configDir }}/RestServer_config |
| name: config |
| subPath: RestServer_config |
| + - mountPath: /root/ansible_pkg |
| + name: ansible-pkg |
| resources: |
| {{ toYaml .Values.resources | indent 12 }} |
| {{- if .Values.nodeSelector }} |
| @@ -92,5 +103,9 @@ spec: |
| configMap: |
| name: {{ include "common.fullname" . }} |
| defaultMode: 0644 |
| + - name: ansible-pkg |
| + hostPath: |
| + path: /root/ansible_pkg |
| imagePullSecrets: |
| - - name: "{{ include "common.namespace" . }}-docker-registry-key" |
| \ No newline at end of file |
| + - name: "{{ include "common.namespace" . }}-docker-registry-key" |
| + |
| diff --git a/kubernetes/sdnc/charts/sdnc-portal/templates/deployment.yaml b/kubernetes/sdnc/charts/sdnc-portal/templates/deployment.yaml |
| index 87ed6aa..5da236d 100644 |
| --- a/kubernetes/sdnc/charts/sdnc-portal/templates/deployment.yaml |
| +++ b/kubernetes/sdnc/charts/sdnc-portal/templates/deployment.yaml |
| @@ -49,8 +49,13 @@ spec: |
| name: {{ include "common.name" . }}-readiness |
| containers: |
| - name: {{ include "common.name" . }} |
| - command: ["/bin/bash"] |
| - args: ["-c", "cd /opt/onap/sdnc/admportal/shell && ./start_portal.sh"] |
| + command: |
| + - /bin/bash |
| + - -c |
| + - > |
| + UPDATE_HOSTS_FILE >> /etc/hosts; |
| + UPDATE_NPM_REGISTRY; |
| + cd /opt/onap/sdnc/admportal/shell && ./start_portal.sh |
| image: "{{ include "common.repository" . }}/{{ .Values.image }}" |
| imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} |
| ports: |
| diff --git a/kubernetes/uui/charts/uui-server/templates/deployment.yaml b/kubernetes/uui/charts/uui-server/templates/deployment.yaml |
| index accdff9..fa83daf 100644 |
| --- a/kubernetes/uui/charts/uui-server/templates/deployment.yaml |
| +++ b/kubernetes/uui/charts/uui-server/templates/deployment.yaml |
| @@ -34,6 +34,12 @@ spec: |
| - name: {{ include "common.name" . }} |
| image: "{{ include "common.repository" . }}/{{ .Values.image }}" |
| imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} |
| + command: |
| + - /bin/bash |
| + - -c |
| + - > |
| + chown -R mysql:mysql /var/lib/mysql /var/run/mysqld; |
| + /home/uui/bin/run.sh |
| ports: |
| - containerPort: {{ .Values.service.internalPort }} |
| # disable liveness probe when breakpoints set in debugger |
| --- oom/kubernetes/common/common/templates/_cacert.tpl 1970-01-01 00:00:00.000000000 +0000 |
| +++ onap-dev/install/onap-offline/resources/oom/kubernetes/common/common/templates/_cacert.tpl 2018-11-02 15:09:31.781688957 +0000 |
| @@ -0,0 +1,62 @@ |
| +#This template adds volume for access to ca certificate. |
| +#Template is ignored when cacert not set. |
| +{{- define "common.cacert-volume" }} |
| +{{- if .Values.global.cacert }} |
| +- name: cacert |
| + configMap: |
| + name: {{ include "common.namespace" . }}-root-ca-cert |
| +{{- end }} |
| +{{- end }} |
| + |
| +#This template mounts the CA certificate in an ubuntu compatible way. |
| +#It is mounted to /usr/local/share/ca-certificates/cacert.crt. |
| +#Template is ignored if cacert not set. |
| +{{- define "common.cacert-mount-ubuntu" }} |
| +{{- if .Values.global.cacert }} |
| +- mountPath: "/usr/local/share/ca-certificates/cacert.crt" |
| + name: cacert |
| + subPath: certificate |
| +{{- end }} |
| +{{- end }} |
| + |
| +#This template creates an empty volume used to store system certificates (includes java keystore). |
| +{{- define "common.system-ca-store-volume" }} |
| +{{- if .Values.global.cacert }} |
| +- name: system-ca-store |
| + emptyDir: |
| +{{- end }} |
| +{{- end }} |
| + |
| +#This template mounts system ca store volume to /etc/ssl/certs (ubuntu specific). |
| +#Template is ignored in case cacert is not given. |
| +{{- define "common.system-ca-store-mount-ubuntu" }} |
| +{{- if .Values.global.cacert }} |
| +- mountPath: "/etc/ssl/certs" |
| + name: system-ca-store |
| +{{- end }} |
| +{{- end }} |
| + |
| +#This template is a template for an init container. |
| +#This init container can be declared to update system's ca store for ubuntu containers. |
| +#It runs as root using the same image as the main one. |
| +#It expects /etc/ssl/certs to be mounted as a volume. |
| +#It has to be shared with the main container. |
| +#This template is ignored if cacert is not given as helm value. |
| +{{- define "common.update-system-ca-store-ubuntu" }} |
| +{{- if .Values.global.cacert }} |
| +- command: |
| + - "/bin/bash" |
| + - "-c" |
| + - | |
| + mkdir -p /etc/ssl/certs/java |
| + update-ca-certificates |
| + name: update-system-ca-store |
| + imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} |
| + image: {{ include "common.repository" . }}/{{ .Values.image }} |
| + securityContext: |
| + runAsUser: 0 |
| + volumeMounts: |
| +{{ include "common.cacert-mount-ubuntu" . | indent 2 }} |
| +{{ include "common.system-ca-store-mount-ubuntu" . | indent 2 }} |
| +{{- end }} |
| +{{- end }} |
| --- oom/kubernetes/onap/templates/configmap.yaml 1970-01-01 00:00:00.000000000 +0000 |
| +++ onap-dev/install/onap-offline/resources/oom/kubernetes/onap/templates/configmap.yaml 2018-11-02 15:09:31.804689107 +0000 |
| @@ -0,0 +1,15 @@ |
| +{{ if .Values.global.cacert -}} |
| +apiVersion: v1 |
| +kind: ConfigMap |
| +metadata: |
| + name: {{ include "common.namespace" . }}-root-ca-cert |
| + namespace: {{ include "common.namespace" . }} |
| + labels: |
| + app: {{ include "common.name" . }} |
| + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} |
| + release: {{ .Release.Name }} |
| + heritage: {{ .Release.Service }} |
| +data: |
| + certificate: | |
| +{{ .Values.global.cacert | indent 4 }} |
| +{{- end }} |
| --- oom/kubernetes/policy/charts/brmsgw/templates/deployment.yaml 2018-11-06 07:38:46.341849402 +0000 |
| +++ onap-dev/install/onap-offline/resources/oom/kubernetes/policy/charts/brmsgw/templates/deployment.yaml 2018-11-02 15:09:31.808689133 +0000 |
| @@ -45,6 +45,7 @@ |
| image: "{{ .Values.global.readinessRepository }}/{{ .Values.global.readinessImage }}" |
| imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} |
| name: {{ include "common.name" . }}-readiness |
| +{{ include "common.update-system-ca-store-ubuntu" . | indent 6 }} |
| containers: |
| - command: |
| - /bin/bash |
| @@ -68,6 +69,8 @@ |
| initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }} |
| periodSeconds: {{ .Values.readiness.periodSeconds }} |
| volumeMounts: |
| +{{ include "common.cacert-mount-ubuntu" . | indent 8 }} |
| +{{ include "common.system-ca-store-mount-ubuntu" . | indent 8 }} |
| - mountPath: /etc/localtime |
| name: localtime |
| readOnly: true |
| @@ -94,6 +97,8 @@ |
| {{ toYaml .Values.affinity | indent 10 }} |
| {{- end }} |
| volumes: |
| +{{ include "common.cacert-volume" . | indent 8 }} |
| +{{ include "common.system-ca-store-volume" . | indent 8 }} |
| - name: localtime |
| hostPath: |
| path: /etc/localtime |
| --- oom/kubernetes/policy/charts/drools/templates/statefulset.yaml 2018-11-06 07:38:46.343849404 +0000 |
| +++ onap-dev/install/onap-offline/resources/oom/kubernetes/policy/charts/drools/templates/statefulset.yaml 2018-11-02 15:09:31.810689146 +0000 |
| @@ -51,6 +51,8 @@ |
| image: "{{ .Values.global.readinessRepository }}/{{ .Values.global.readinessImage }}" |
| imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} |
| name: {{ include "common.name" . }}-readiness |
| +{{ include "common.update-system-ca-store-ubuntu" . | indent 6 }} |
| +{{ include "policy.update-policy-keystore" . | indent 6 }} |
| containers: |
| - name: {{ include "common.name" . }} |
| image: "{{ include "common.repository" . }}/{{ .Values.image }}" |
| @@ -78,6 +80,9 @@ |
| - name: REPLICAS |
| value: "{{ .Values.replicaCount }}" |
| volumeMounts: |
| +{{ include "common.cacert-mount-ubuntu" . | indent 10 }} |
| +{{ include "common.system-ca-store-mount-ubuntu" . | indent 10 }} |
| +{{ include "policy.keystore-mount" . | indent 10 }} |
| - mountPath: /etc/localtime |
| name: localtime |
| readOnly: true |
| @@ -136,6 +141,9 @@ |
| {{ toYaml .Values.affinity | indent 10 }} |
| {{- end }} |
| volumes: |
| +{{ include "common.cacert-volume" . | indent 8 }} |
| +{{ include "common.system-ca-store-volume" . | indent 8 }} |
| +{{ include "policy.keystore-storage-volume" . | indent 8 }} |
| - name: localtime |
| hostPath: |
| path: /etc/localtime |
| --- oom/kubernetes/policy/charts/pdp/templates/statefulset.yaml 2018-11-06 07:38:46.345849405 +0000 |
| +++ onap-dev/install/onap-offline/resources/oom/kubernetes/policy/charts/pdp/templates/statefulset.yaml 2018-11-02 15:09:31.812689159 +0000 |
| @@ -49,6 +49,7 @@ |
| image: "{{ .Values.global.readinessRepository }}/{{ .Values.global.readinessImage }}" |
| imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} |
| name: {{ include "common.name" . }}-readiness |
| +{{ include "common.update-system-ca-store-ubuntu" . | indent 6 }} |
| containers: |
| - command: |
| - /bin/bash |
| @@ -72,6 +73,8 @@ |
| initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }} |
| periodSeconds: {{ .Values.readiness.periodSeconds }} |
| volumeMounts: |
| +{{ include "common.cacert-mount-ubuntu" . | indent 8 }} |
| +{{ include "common.system-ca-store-mount-ubuntu" . | indent 8 }} |
| - mountPath: /etc/localtime |
| name: localtime |
| readOnly: true |
| @@ -121,6 +124,8 @@ |
| {{ toYaml .Values.affinity | indent 10 }} |
| {{- end }} |
| volumes: |
| +{{ include "common.cacert-volume" . | indent 6 }} |
| +{{ include "common.system-ca-store-volume" . | indent 6 }} |
| - name: localtime |
| hostPath: |
| path: /etc/localtime |
| --- oom/kubernetes/policy/charts/policy-common/templates/_keystore.tpl 1970-01-01 00:00:00.000000000 +0000 |
| +++ onap-dev/install/onap-offline/resources/oom/kubernetes/policy/charts/policy-common/templates/_keystore.tpl 2018-11-02 15:09:31.812689159 +0000 |
| @@ -0,0 +1,43 @@ |
| +#This template creates a volume for storing policy-keystore with imported ca. |
| +#It is ignored if cacert was not given. |
| +{{- define "policy.keystore-storage-volume" }} |
| +{{- if .Values.global.cacert }} |
| +- name: keystore-storage |
| + emptyDir: |
| +{{- end }} |
| +{{- end }} |
| + |
| +#This template mounts policy-keystore in appropriate place for policy components to take it. |
| +#It is ignored if cacert is not given. |
| +{{- define "policy.keystore-mount" }} |
| +{{- if .Values.global.cacert }} |
| +- mountPath: "/tmp/policy-install/config/policy-keystore" |
| + name: keystore-storage |
| + subPath: policy-keystore |
| +{{- end }} |
| +{{- end }} |
| + |
| +#This will extract a policy keystore and then import |
| +#the root cacert of offline nexus into it. |
| +#This template expects a volume named keystore-storage where policy-keystore will be put. |
| +#It also expects volume named cacert where the file "certificate" will contain the cert to import. |
| +#Template is ignored if ca certificate not given. |
| +{{- define "policy.update-policy-keystore" }} |
| +{{- if .Values.global.cacert }} |
| +- command: |
| + - "/bin/bash" |
| + - "-c" |
| + - | |
| + set -e |
| + tar -xzf base-*.tar.gz etc/ssl/policy-keystore |
| + cp etc/ssl/policy-keystore keystore-storage/ |
| + keytool -import -keystore keystore-storage/policy-keystore -storepass "Pol1cy_0nap" -noprompt -file /usr/local/share/ca-certificates/cacert.crt |
| + name: update-policy-keystore |
| + imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} |
| + image: {{ include "common.repository" . }}/{{ .Values.image }} |
| + volumeMounts: |
| + - mountPath: "/tmp/policy-install/keystore-storage" |
| + name: keystore-storage |
| +{{ include "common.cacert-mount-ubuntu" . | indent 2 }} |
| +{{- end }} |
| +{{- end }} |
| --- oom/kubernetes/policy/templates/deployment.yaml 2018-11-06 07:38:46.346849406 +0000 |
| +++ onap-dev/install/onap-offline/resources/oom/kubernetes/policy/templates/deployment.yaml 2018-11-02 15:09:31.813689166 +0000 |
| @@ -45,6 +45,7 @@ |
| image: "{{ .Values.global.readinessRepository }}/{{ .Values.global.readinessImage }}" |
| imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} |
| name: {{ include "common.name" . }}-readiness |
| +{{ include "common.update-system-ca-store-ubuntu" . | indent 6 }} |
| containers: |
| - command: |
| - /bin/bash |
| @@ -72,6 +73,8 @@ |
| - name: PRELOAD_POLICIES |
| value: "{{ .Values.config.preloadPolicies }}" |
| volumeMounts: |
| +{{ include "common.cacert-mount-ubuntu" . | indent 10 }} |
| +{{ include "common.system-ca-store-mount-ubuntu" . | indent 10 }} |
| - mountPath: /etc/localtime |
| name: localtime |
| readOnly: true |
| @@ -136,6 +139,8 @@ |
| {{ toYaml .Values.affinity | indent 10 }} |
| {{- end }} |
| volumes: |
| +{{ include "common.cacert-volume" . | indent 8 }} |
| +{{ include "common.system-ca-store-volume" . | indent 8 }} |
| - name: localtime |
| hostPath: |
| path: /etc/localtime |