fix: 2288 correct captcha version, module names, P12 paths, and mock-rp OIDC config - #310
Open
bhumi46 wants to merge 61 commits into
Open
fix: 2288 correct captcha version, module names, P12 paths, and mock-rp OIDC config#310bhumi46 wants to merge 61 commits into
bhumi46 wants to merge 61 commits into
Conversation
…rp OIDC config - Bump captcha chart to 0.1.1 to match the deployed version - Give each esignet instance a unique captcha module name (esignetgomosipid1/2, esignetgosunbird) - Fix MOSIP_P12_PATH filenames per instance (mosipid1.pfx, mosipid2.pfx, mock.pfx, sunbird.pfx) - Remove duplicate MOSIP_ESIGNET_CAPTCHA_MODULE_NAME entry from mosipid1 extraEnvVars - Add mock-relying-party-ui OIDC client config (CLIENT_ID, ACRS, DISPLAY, GRANT_TYPE, CLAIMS_LOCALES, SCOPE_USER_PROFILE, CLAIMS_USER_PROFILE, CLAIMS_REGISTRATION, FALLBACK_LANG, AUTHORIZE_ENDPOINT, CODE_CHALLENGE) across all instances in both esignet-standalone and esignet-standalone-2.0.0 profiles - Add mock-relying-party-service valuesFile (mock-replying-party.yaml) with PAR-related extraEnvVars, wired into all 4 mock-relying-party-service-go* apps mosip/esignet#2288 Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review (16)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Add inline notes throughout ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md covering the esignet-standalone-2.0.0 (Go) profile alongside the existing esignet-standalone (v1.7.1) instructions: - -go namespace/hostname equivalents in the instances table - shared mosipid1/mosipid2 domain variables and captcha/signup secrets (no separate _GO secrets) across both profiles - profile dropdown values per workflow step, noting Step 1 (external services) always uses esignet-standalone regardless of which esignet profile is deployed - verification commands and expected URLs side by side for both profiles - MOSIP ID onboarding note on allowed-domain-uris when both profiles point at the same remote MOSIP environment Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…E-1.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
…yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
…e/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
…NODE-1.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
…ANE-NODE-1.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
…cretKeyRef CodeRabbit flagged MOSIP_P12_PASSWORD and CRYPTO_ENCRYPTION_KEY as hardcoded credentials (CWE-798), duplicated identically across all 4 esignet-standalone-2.0.0 plugin-values files. Replace with valueFrom.secretKeyRef pointing at a new shared esignet-go-crypto secret. - esignet-preinstall.sh (shared by all 4 esignet-go-* instances) now mints esignet-go-crypto in the captcha namespace from two new required GH Actions secrets (ESIGNET_P12_PASSWORD, ESIGNET_CRYPTO_ENCRYPTION_KEY) and copies it into each instance's namespace, following the same pattern already used for captcha secrets - helmsman_esignet.yml: wire the two new secrets through env passthrough, masking, and validation (required only when profile == esignet-standalone-2.0.0) - Deployment guide updated with the two new secrets Existing values are preserved (not rotated) to avoid breaking anything tied to the current P12 keystore files — the secret material now lives only in GitHub Environment secrets, never committed to the repo. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…ntegration, PKCS12 for mosipid1 Follows mosip/esignet#2331 (Keymanager integration changes), which removed MOSIP_P12_PASSWORD/CRYPTO_ENCRYPTION_KEY from the chart entirely in favor of KEYMANAGER_* config: - mock/mosipid2/sunbird: KEYMANAGER_KEYSTORE_TYPE PKCS11, using each instance's existing esignet-softhsm-go-* secret for KEYMANAGER_PKCS11_PIN; module path corrected to the real /usr/lib/softhsm/libsofthsm2.so from the now-merged upstream chart (was a placeholder) - mosipid1: KEYMANAGER_KEYSTORE_TYPE PKCS12 instead, using the extraVolumes/extraVolumeMounts capability added in mosip/esignet#2333. esignet-mosipid1-preinstall.sh now generates a throwaway self-signed PKCS12 keystore (create-if-missing, so it stays stable across redeploys) in secret esignet-keystore-go-mosipid1, bulk-imported via extraEnvVarsSecret for KEYMANAGER_PKCS12_PASSWORD and mounted at /home/mosip/keys/secret for KEYMANAGER_PKCS12_FILE_PATH - Removed the now-unused ESIGNET_P12_PASSWORD/ESIGNET_CRYPTO_ENCRYPTION_KEY GitHub secrets wiring from helmsman_esignet.yml and the deployment guide — no GH secrets needed for either keystore approach anymore mosip/esignet#2333 Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Use a fixed known value instead of a randomly generated one — this password only protects a throwaway self-signed dummy keystore generated by this hook, not real production key material, so a shared known value is acceptable here. mosip/esignet#2333 Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Correctness/security fixes:
- helmsman_esignet.yml: use env.PROFILE (not the empty push-event input) in the
MOSIP DSF check condition
- helmsman_esignet.yml, helmsman_testrigs.yml: enforce mosipid1_domain_name/
mosipid2_domain_name as required instead of silently accepting empty values
- helmsman_testrigs.yml: bind workflow inputs to env: and reference them as
shell variables instead of interpolating ${{ }} directly into the script
body (GitHub Actions script injection hardening)
- esignet-misp-onboarder-postinstall.sh: always restore Istio injection before
returning, exit nonzero on job failure instead of continuing to restart
dependent workloads, stop masking rollout-status failures
- esignet-misp-onboarder-preinstall.sh: add an EXIT trap to restore Istio
injection if the hook fails partway, so a failed preinstall doesn't leave
the namespace permanently without sidecar injection
- kernel-preinstall.sh: validate MOSIP_API_HOST/MOSIP_API_INTERNAL_HOST before
creating the domain-config configmap instead of silently defaulting to empty
- softhsm-esignet-postinstall.sh: fix the copied configmap name
(esignet-softhsm-share -> esignet-softhsm-go-share, matching what the
mosip/softhsm chart actually creates) and stop suppressing copy failures
- signup-service-preinstall.sh: restart the captcha deployment when the
signup-go secret is updated on an existing deployment, not just on first
creation, so key/secret rotations actually take effect
- trigger-test-jobs-esignet.sh: distinguish genuine NotFound from other
kubectl failures (RBAC, credentials, API errors) in the CronJob existence
check, CronJob list, and Job status polling; separate local declarations
from command-substitution assignments so exit codes are captured correctly;
propagate signup/signup-go job failures into OVERALL_SUCCESS instead of
discarding them
- 4x apitestrig-esignet-*-setup.sh: create the s3-esignet-*-apitestrig and
apitestrig-esignet-*-apitestrig secrets referenced by extraEnvVarsSecret,
which nothing was creating before
- esignet-mosipid1/2-plugin-values-2-0-0.yaml: LOGGING_LEVEL DEBUG -> INFO
Documentation/consistency fixes:
- Replace stale "eSignet 1.7.1" banners/headers with "eSignet Standalone 2.0.0"
across hook scripts, and correct documented env var defaults to match code
- esignet-dsf.yaml, testrigs-dsf.yaml: correct stale v1.7.1 references in
comments and a commented-out postInstall path
- captcha-postinstall.sh: fix header docs to match the actual env var names
and default namespace
- aws.tfvars: close an unclosed <mail-id> placeholder
- Remove stray trailing blank lines / extra blank lines in two values files
- ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md: fix markdownlint MD028/MD029/MD031
violations, correct the Steps 2/4 profile-acceptance note, remove
unconditional signup CronJob verification commands (Step 3 isn't ready for
either profile), and extend the MOSIP-ID2 allowed-domain-uris example to
cover shared MOSIP-ID2 environments
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…id2 cronjob checks in docs
- helmsman_esignet.yml: bind github.event.inputs.enable_mosipid2 to a
step-level env var in the validate-inputs job's "Validate required
variables" step instead of interpolating ${{ }} directly into the shell
condition (same script-injection hardening pattern already applied to
helmsman_testrigs.yml)
- ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md: make the esignet-mosipid2 /
esignet-go-mosipid2 CronJob verification commands conditional on
enable_mosipid2, matching the pattern already used for the pods-check
section earlier in the guide
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…onal to maps Matches the chart-side list-to-map conversion (mosip/esignet#2380, mosip/esignet-mock-services#602): Helm deep-merges map keys across values layers but replaces lists wholesale. Converts all 6 profile override files (esignet base/sunbird/mosipid1/mosipid2 plugin values, mock-identity, mock-relying-party) from list to map format, preserving every entry including the Helmsman-escaped Handlebars template value in MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS (verified byte-identical via diff, and re-rendered against the real charts to confirm no index-keyed garbage and correct final output). Also updates a stale comment describing the old list-replace merge semantics. NOTE: requires the esignet/mock-identity-system/mock-relying-party chart PRs to be merged and republished before this is deployed - until then the charts still expect lists and this would break. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
… entries Now that extraEnvVars/extraEnvVarsAdditional are maps (commit 1f8713a), every key can be expressed as an individual dot-path set: entry directly in esignet-dsf.yaml, matching the convention already used for domainConfig.KEY/extraEnvVarsCM[n] in this same file. Removes the valuesFile: reference and deletes the source file for each of the 6 converted apps (esignet base/sunbird/mosipid1/mosipid2, mock-identity, mock-relying-party x4) once nothing references it. Verified: full-manifest helm template diff (not just env:) for every app, comparing the original valuesFile + baseline set: render against the new set:-only render - byte-identical in every case. Checked for key overlap against existing domainConfig.*/set: entries first (none found) so nothing is duplicated. Two values (MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS, CLAIMS_USER_PROFILE) are JSON-like blobs full of commas and braces, which --set's mini-language treats specially. Escaped with \, \{ \} per Helm's strvals rules, wrapped in YAML single-quoted strings in the DSF (double-quoted YAML does NOT accept these as valid escapes - caught and fixed one instance of this during implementation). Verified end-to-end three ways: Helm's strvals parser directly, YAML round-trip via an independent parser, and Helmsman's own real binary (-dry-run -debug against a local, unreachable fake kubeconfig, network-free) - its internal "values to override from env" dump shows both escaped values recovered exactly as intended before being handed to Helm. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
The extraVolumes/extraVolumeMounts chart feature these referenced was deleted from the esignet chart. Drop the corresponding set: entries. extraEnvVarsSecret[0] stays - it's the chart's pre-existing envFrom secretRef mechanism, unrelated to the removed volume-mount feature, even though it happened to reference the same secret name. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
esignet-keystore-go-mosipid1 secret is not being used. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…ne-2.0.0 DSF The Go rewrite profile used a -go suffix on release/namespace/hostnames solely to avoid colliding with the parallel v1.7.1 (non-Go) profile. That profile is retired, so the suffix is no longer needed. Also consolidates the separate mosipid1 (PKCS12) and mosipid2 (PKCS11) instances into a single mosipid instance, keeping mosipid2's PKCS11 config as canonical. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…ne-2.0.0 hooks Updates namespace/secret/configmap names and kubectl patches in all hook scripts to match the DSF rename, removes the 7 mosipid1-only scripts (superseded by the consolidated mosipid instance), and deletes 2 dead scripts that duplicated the shared external-dsf.yaml's own hooks and were never referenced by any DSF file. Also adds explicit cleanup of stale pre-rename captcha env var names on the shared captcha Deployment (captcha-postinstall.sh, esignet-mosipid-preinstall.sh, esignet-sunbird-preinstall.sh), so renaming the underlying secrets doesn't leave orphaned env vars pointing at secrets that no longer exist. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…sf.yaml Consolidates mosip_esignet_go_mosipid1/mosipid2 into a single mosip_esignet_go_mosipid entry, matching the DSF's mosipid consolidation. Also fixes a naming collision the plain "-go" removal would have caused: this file packs both the v1.7.1 and Go profiles' database definitions into the same flat set: maps (postgres-init-esignet, postgres-init-signup), distinguished only by the _go suffix. Dropping _go from mosip_esignet_go/_sunbird, mosip_mockidentitysystem_go, mosip_audit_go, mosip_kernel_go, and mosip_otp_go would produce duplicate keys colliding with the still-present (retired) v1.7.1 entries. Instead these 6 entries are disabled and the Go profile's hooks now point at the same physical databases the v1.7.1 profile already defines, avoiding both the collision and redundant isolated databases. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…kflows
The esignet-standalone-2.0.0 DSFs now use a single \${mosipid_domain_name}
variable instead of mosipid1/mosipid2. The v1.7.1 esignet-standalone
profile still runs two separate mosipid1/mosipid2 instances, so its
existing inputs, secrets, and MOSIPID2_ENABLED toggle are left as-is;
mosipid_domain_name and the new ESIGNET_MOSIPID_CAPTCHA_*,
MOSIPID_POSTGRES_PASSWORD, MOSIPID_KEYCLOAK_ADMIN_PASSWORD, and
ESIGNET_MOSIPID_SPRING_CONFIG_LABEL secrets/vars are added alongside
them, with validation now branching by exact profile name. Also updates
the SOFTHSM_PAIRS release/namespace list for esignet-standalone-2.0.0 to
match the renamed releases.
Note: the new MOSIPID_* secrets/vars need to be configured in the GitHub
environment before a real esignet-standalone-2.0.0 deployment run.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…net-standalone Applies the same consolidation already done for the Go profile to the v1.7.1 esignet-standalone profile: mosipid1 was always-enabled with a more complete config (captcha explicitly configured) while mosipid2 was optional and off by default, so mosipid1's config becomes canonical. Deletes mosipid2's app blocks, hook scripts, and plugin-values file, and renames mosipid1's to the consolidated mosipid name throughout the DSF, testrigs DSF, and hooks. Also fixes softhsm-esignet-mosipid1/2-values.yaml references that were left dangling by the earlier Go-profile task: those files were shared with the Go profile and got renamed/deleted there without accounting for this profile's own use of them, silently breaking this profile's softhsm-mosipid app. Both profiles now correctly share the single softhsm-esignet-mosipid-values.yaml file. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…mosipid instance Updates 7 docs/*.md files that still described the retired two-instance architecture (separate mosipid1/mosipid2 namespaces, the enable_mosipid2 toggle, split MOSIPID1_*/MOSIPID2_* secrets and variables). Several sections needed real restructuring rather than renaming — e.g. the deployment guide's "When do you need mosipid1?" / "When do you need mosipid2?" subsections collapse into one, since mosipid is now always deployed with no toggle, and its "up to 4 instances" framing becomes 3. Also corrects now-stale "-go" references intermixed in the same sentences/tables (separate -go-suffixed namespaces/hostnames, a two-column esignet-standalone vs esignet-standalone-2.0.0 URL table) left over from the earlier, separately-completed -go removal work — both profiles use identical namespaces/hostnames now, so most of these collapse to a single description instead of two parallel ones. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…ne profiles esignet-config-server, pms-partner-mosipid, and pms-policy-mosipid were already enabled: false in both esignet-standalone and esignet-standalone-2.0.0's esignet-dsf.yaml. Removes the app blocks entirely along with their dedicated hook scripts and values files, rather than leaving disabled dead weight in the DSFs. Also removes the now-dangling partnermanager=pms-mosipid.*/ policymanager=pms-mosipid.* entries from testrigs-dsf.yaml's mosip_components_base_urls (in both profiles), which would otherwise point the apitestrig at a service that no longer exists. Left untouched: the shared external-dsf.yaml's mosip_pms_client_secret Keycloak client-secret provisioning and the PMS_CLIENT_SECRET_KEY/VALUE fetch step in helmsman_esignet.yml — harmless if unused, and removing them would mean re-indexing a 5-entry array shared across profiles, a separate change from this app removal. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…net-standalone-2.0.0)
esignet-mock now uses KEYMANAGER_KEYSTORE_TYPE=PKCS12 instead of SoftHSM/
PKCS11, with a PVC (persistence.enabled, chart-managed) mounted at the
chart's default /home/mosip/config/ so the keystore file survives pod
restarts. The app generates the PKCS12 keystore itself on first run
when it doesn't already exist at KEYMANAGER_PKCS12_FILE_PATH — no init
container or preinstall hook needed.
Uses a fixed known password ("localtest"), matching the precedent this
repo already established for the same throwaway/self-signed keystore
use case (mosipid1's now-removed PKCS12 setup) — esignet-mock is a mock/
demo instance, not production key material.
esignet-mosipid and esignet-sunbird are untouched and remain on PKCS11/
SoftHSM.
Verified via `helm template` against the local esignet chart checkout
(PVC created, env vars wired to the right mount) and `helmsman -dry-run
-debug` against the DSF (19 apps, correct per-instance keystore values).
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…onal extraEnvVars is merged with the chart's own default extraEnvVars map before rendering, so removing the previous explicit PKCS11 overrides just let the chart's PKCS11 defaults resurface for the same keys instead of disappearing. extraEnvVarsAdditional renders after extraEnvVars in the container's env: list, so with Kubernetes' last-wins behavior for duplicate env var names, setting KEYMANAGER_KEYSTORE_TYPE/KEYMANAGER_PKCS12_FILE_PATH/ KEYMANAGER_PKCS12_PASSWORD there correctly overrides the chart's PKCS11 defaults instead of merely coexisting with them. Verified via `helm template` against the local esignet chart checkout: both a PKCS11 (chart default, from extraEnvVars) and PKCS12 (from extraEnvVarsAdditional) KEYMANAGER_KEYSTORE_TYPE entry appear in the rendered container env list, in that order, with PKCS12 taking effect. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…sAdditional Relocates KEYMANAGER_DB_SCHEMA/KEYMANAGER_KEYSTORE_TYPE/KEYMANAGER_PKCS11_* from extraEnvVars to extraEnvVarsAdditional for both instances, using the generic chart-default values (pkcs11-proxy module path/token label, shared esignet-softhsm secret name) as specified, replacing the previous per-instance values (real softhsm module path, "esignet" token label, esignet-softhsm-mosipid/esignet-softhsm-sunbird secrets). Verified via `helmsman -dry-run -debug`: 19 apps, both instances' resolved values match exactly. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…sunbird Keeps the generic pkcs11-proxy module path/token label, but the PIN secret must be the instance-specific one (esignet-softhsm-mosipid, esignet-softhsm-sunbird) since that's where each instance's actual SoftHSM PIN lives - a shared esignet-softhsm secret doesn't exist in those namespaces. Verified via helmsman -dry-run -debug: 19 apps, both instances resolve to their correct per-instance secret name. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
mosip/captcha's chart default extraEnvVars only contains
MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_PREREGISTRATION, sourced from a
mosip-captcha/prereg-captcha-secret-key secret that doesn't exist in
this deployment (no preregistration module in the esignet-standalone
profiles), causing a config error on the captcha pod. Sets
extraEnvVars: "" to empty it out — the chart's extraEnvVars is a raw
YAML block string (common.tplvalues.render'd, not a list or map like
other charts in this repo), so an empty string is what skips the
{{- if .Values.extraEnvVars }} block entirely.
esignet/mosipid/sunbird/signup captcha secrets are unaffected — those
are wired up separately via kubectl patch in the *-preinstall.sh /
captcha-postinstall.sh hooks, not through this chart value.
Verified via `helm template` against the actual mosip/captcha v0.1.1
chart (env var gone, everything else byte-identical) and
`helmsman -dry-run -debug` against external-dsf.yaml.
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…nbird KEYMANAGER_PKCS11_TOKEN_LABEL corrected from pkcs11-proxy to mosip-token for esignet-mosipid and esignet-sunbird. Adds hsm_client_zip_url_env, a plain container env var (not a chart value) read directly by esignet-service's docker-entrypoint.sh at startup - if set, it downloads and unzips a PKCS11 client library from the given URL into hsm_local_dir_env before the app starts. The esignet-service Dockerfile only bakes this in via a build-arg with no default, so without setting it at runtime the KEYMANAGER_PKCS11_MODULE_PATH (/usr/local/lib/softhsm/libpkcs11-proxy.so) referenced by these two instances may not actually exist in the container. Note: hsm_local_dir_env defaults to a relative "hsm-client" dir (under work_dir, i.e. /home/mosip/hsm-client) per the Dockerfile, not /usr/local/lib/softhsm - not touched here since it wasn't part of what was asked, but worth checking that the downloaded zip's contents actually land at the configured module path. Verified via helmsman -dry-run -debug: 19 apps, both instances resolve to the correct values. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
extraEnvVarsCM[1]: "esignet-global" removed from esignet-mosipid's set block. extraEnvVarsCM[0] (esignet-softhsm-mosipid-share) is untouched. Verified via helmsman -dry-run -debug: 19 apps, esignet-mosipid's extraEnvVarsCM resolves to just the softhsm-share entry. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…et-mosipid
Root cause (verified against Helmsman v3.17.1 source,
internal/app/release.go getSetValues()): Helmsman unconditionally
escapes every literal comma in every set: value via
strings.ReplaceAll(v, ",", "\\,") before passing it to `helm --set`,
regardless of whether the value already contains a manually-escaped
\, sequence. Values in this file that were hand-escaped per Helm's own
strvals convention (\, for a literal comma) got double-escaped into
\\, by Helmsman, which strvals then parses as "literal backslash
followed by an unescaped separator comma" - splitting the value
mid-string and producing dangling tokens like the "phone" segment of
MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS's postfix values.
Fix: remove the manual \, escaping (plain commas), since Helmsman
already adds it automatically. \{ and \} escaping is untouched -
Helmsman's ReplaceAll only touches commas.
None of this was caught by this session's earlier helmsman -dry-run
verifications because dry-run against a fake/unreachable kubeconfig
fails at namespace creation, before Helmsman ever reaches the
getSetValues() call that happens right before invoking `helm upgrade
--install`.
Verified by replicating Helmsman's exact getSetValues() transform
(one --set flag per key, ReplaceAll(",", "\\,") per value) against
the real esignet-mock/esignet-mosipid/esignet-sunbird set: blocks with
a local helm template call: reproduced the exact "key \"phone\" has no
value" failure before the fix, confirmed clean parsing with the
correct final values (e.g. LOGIN_ID_OPTIONS renders its Handlebars
wrapper and postfix values intact, IDA_OTP_CHANNELS renders as
"email,phone") after it. Also re-ran helmsman -dry-run -debug: 19 apps
parse correctly.
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…nbird Root cause: the mosip/esignet chart's own default extraEnvVars entries reference cluster resources that don't exist in every namespace this profile deploys into, and Kubernetes fails the whole pod if any single env entry references a missing ConfigMap/Secret key - even when a working duplicate (added via our own extraEnvVars/extraEnvVarsAdditional overrides) exists elsewhere in the same env: list. esignet-mock: MOSIP_API_INTERNAL_HOST, MOSIP_ESIGNET_OIDC_UI_HOSTNAME, MOSIP_ESIGNET_HOST, MOSIP_SIGNUP_HOST default to configMapKeyRefs against an "esignet-global" configmap that only exists for the mosipid/sunbird instances (created by their own preinstall hooks) - esignet-mock's hook never creates one. Overridden to plain hostname strings matching domainConfig's already-correct values. esignet-mosipid/esignet-sunbird: KEYMANAGER_PKCS11_PIN defaults to a secretKeyRef against a plain "esignet-softhsm" secret that only exists in the mock namespace. Each instance already had this correctly overridden under extraEnvVarsAdditional, but that doesn't remove the broken chart-default entry under extraEnvVars - both instances now also override it directly under extraEnvVars, pointing at their own esignet-softhsm-mosipid/esignet-softhsm-sunbird secret. Verified via helmsman -dry-run -debug: 19 apps, all three instances' resolved values are correct and consistent with their domainConfig/ extraEnvVarsAdditional counterparts. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Set via extraEnvVarsAdditional alongside the other PKCS12 keymanager overrides for this instance, consistent with the existing convention (renders after extraEnvVars, so it reliably takes effect regardless of chart defaults for the same key). Verified via helmsman -dry-run -debug: 19 apps, value resolves correctly for esignet-mock only. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Keeps persistence.mountDir at the chart default (/home/mosip/config/) rather than /home/mosip - the latter is the container's WORKDIR where entrypoint.sh, esignet.exe, and data/ are baked in per the Dockerfile (ENTRYPOINT ["/home/mosip/entrypoint.sh"], CMD ["/home/mosip/esignet.exe"]), so mounting the PVC there would hide them and likely crash the container on start. The file still lands on the persistent volume, just renamed from esignet.pfx to keystore.p12. Verified via helmsman -dry-run -debug: 19 apps, value resolves correctly. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY (hyphen) never matched the real MOSIP_ESIGNET_CAPTCHA_SITE_KEY env var read by the chart, so the captcha site key was silently unset for esignet-mosipid. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…/sunbird Chart-default extraEnvVars.KEYMANAGER_KEYSTORE_TYPE/PKCS11_MODULE_PATH/ PKCS11_TOKEN_LABEL/PKCS11_SLOT_ID/PKCS11_PIN/DB_SCHEMA were being overridden only via extraEnvVarsAdditional, which relies on rendering order to win rather than replacing the chart-default extraEnvVars entries. That left redundant/confusing duplicate env entries in the rendered manifest for all three esignet-standalone-2.0.0 instances. Override these keys directly under extraEnvVars instead so only one entry per key renders. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
The MINIO_ROOT_PASSWORD fetch in helmsman_external.yml ran before WireGuard/kubeconfig were set up, so kubectl could never reach the cluster and the value was always empty. Moved the fetch to its own step after cluster access is verified, and wired auth.rootPassword into the minio app's set: block in external-dsf.yaml so the fetched password actually reaches helm upgrade (previously it was fetched but never consumed by the minio release itself). Signed-off-by: bhumi46 <thisisbn46@gmail.com>
… databases Previously these three namespaces silently shared their Postgres database with the retired v1.7.1 esignet-standalone profile (mosip_esignet / mosip_esignet_sunbird / mosip_esignet_mosipid, branch develop) despite comments claiming isolation. Enable the existing but unused/orphaned mosip_esignet_go / mosip_esignet_go_sunbird / mosip_esignet_go_mosipid entries, set their branch to develop-go, and repoint the three esignet-standalone-2.0.0 preinstall hooks' postgres-config patches at these dedicated db names/users so the isolation is actually real. Note: this starts these three namespaces on fresh, empty databases - no data carries over from the previously shared ones. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Changed image.repository from mosipqa/esignet to mosipdev/esignet for esignet-mock, esignet-mosipid, and esignet-sunbird (tag stays develop-go). Also removed the redundant extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID override for mosipid/sunbird - it duplicated the chart's own default (0), which already renders correctly without an explicit override. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…osipid/sunbird extraEnvVars.AUTHN_PROVIDER wasn't the env var the chart/app actually reads (chart default key is MOSIP_ESIGNET_AUTHN_PROVIDER: mosip) - our override under the wrong name never took effect, so all three instances silently ran with the chart default 'mosip' regardless of what we set. Renamed to MOSIP_ESIGNET_AUTHN_PROVIDER with correct per-instance values (mock/mosip/ sunbird), and added NAMESPACE (mock/mosipid/sunbird respectively) which previously only existed for mosipid, and only via extraEnvVarsAdditional. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
… esignet-mock/mosipid/sunbird Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…_HOST env entries Both domainConfig and the chart's own extraEnvVars defaults set these same three key names, rendering as two separate entries with the same 'name' in the container's env: list. Kubernetes' strategic-merge-patch can't compute a consistent $setElementOrder when the merge key isn't unique, causing 'Diffing release... failed' errors on upgrade for esignet-mosipid and esignet-sunbird. esignet-mock already had correct extraEnvVars overrides for these keys (needed separately to avoid a missing esignet-global configmap crash) - just removed the redundant domainConfig copies there. esignet-mosipid/esignet-sunbird only had domainConfig entries; moved them into extraEnvVars unchanged. This also matters for correctness, not just dedup: the chart-default extraEnvVars values (sourced from the esignet-global configmap) are missing the https:// scheme, and for mosipid specifically point at the wrong domain (domain_name instead of mosipid_domain_name) - letting the chart default become the sole source would have silently broken the mosip-identity-plugin's actual endpoints. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Was set under both extraEnvVars and extraEnvVarsAdditional with identical values, rendering as two same-named entries in the env: list - same duplicate-key class as the recent MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/ MOSIP_API_INTERNAL_HOST fix, confirmed via the live deployed pod spec. Kept the extraEnvVars entry, removed the redundant extraEnvVarsAdditional copy. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…or esignet-mock Same duplicate-key class as the recent env var fixes - set under both extraEnvVars and extraEnvVarsAdditional with identical values. Kept the extraEnvVars entry, removed the redundant extraEnvVarsAdditional copy. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…_INTERNAL_HOST instead of string-overriding for mosipid/sunbird The previous fix overrode these chart-default extraEnvVars entries (tables, via valueFrom.configMapKeyRef) with plain string values at the same key. That still eliminated the duplicate-name issue, but Helm's coalesce logic emits a 'cannot overwrite table with non table' warning for every such override - confirmed via a real Helm 3.17.1 binary (matching what CI installs) that this warning is harmless on its own (the override still applies correctly), but it's very likely eating into Helmsman's truncated error output and masking whatever the actual 'Diffing release... failed with exit code 2' error is for esignet-mosipid/esignet-sunbird (esignet-mock has the same warning pattern today without failing, ruling out the warning itself as the cause). Switched to nulling the chart-default keys entirely (null, quoted - a bare YAML null unmarshals to an empty string via Helmsman's sigs.k8s.io/yaml parsing, not the literal text Helm needs) and moved the actual values back to domainConfig, which no longer conflicts since extraEnvVars no longer supplies these keys at all. Verified against a real Helm 3.17.1 binary: zero warnings, single correct entry per key. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…IP_SIGNUP_HOST/MOSIP_API_INTERNAL_HOST/MOSIP_ESIGNET_OIDC_UI_HOSTNAME/KEYMANAGER_PKCS11_PIN Same fix as the recent mosipid/sunbird change, applied to mock for consistency. These five chart-default extraEnvVars entries are all tables (valueFrom.configMapKeyRef or secretKeyRef), and mock's plain-value overrides at the same keys triggered 'cannot overwrite table with non table' coalesce warnings - confirmed harmless on their own via a real Helm 3.17.1 binary, but still worth removing since verbose warnings risk masking real errors in Helmsman's truncated CI output. MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/MOSIP_API_INTERNAL_HOST: nulled under extraEnvVars, values moved to domainConfig (safe for mock specifically - no esignet-global configmap reference survives since the chart-default key is fully deleted, not just given a literal value). MOSIP_ESIGNET_OIDC_UI_HOSTNAME: nulled under extraEnvVars, value moved to extraEnvVarsAdditional (no domainConfig equivalent key exists for this one). KEYMANAGER_PKCS11_PIN: changed from an empty-string override to null - same functional result (PKCS11 unused, PKCS12 is the active keystore type) but as a real deletion instead of a type-conflicting empty string. Verified against a real Helm 3.17.1 binary with mock's full 90-key --set list: exit 0, zero warnings, single correct entry per key. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Same class of bug as the recent esignet-mock/mosipid/sunbird fixes, found while auditing mock-identity-system, mock-relying-party-service/-ui, and oidc-ui for similar issues. domainConfig.MOSIP_ESIGNET_HOST was set, but the chart-default extraEnvVars.MOSIP_ESIGNET_HOST (a table referencing the esignet-global configmap, which doesn't exist in the esignet-mock namespace) was never nulled - producing both a duplicate-named env entry and a CreateContainerConfigError crash risk. Verified via helm template: single entry, correct value, zero warnings. mock-relying-party-service/-ui and oidc-ui were also audited - their chart defaults for extraEnvVars/domainConfig are empty or unused by this DSF, so no equivalent issue exists there. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Previously left unset (chart default '0' rendered implicitly). Now explicitly deleted so it doesn't render at all, matching the pattern used for the other KEYMANAGER_* keys. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
The esignet-misp-onboarder-key secret only ever holds an empty value, since the onboarder app that would populate it with a real MISP license key is disabled (and has unrelated ordering/namespace-targeting issues of its own). An empty MISP key makes the Go esignet service Fatal on startup during plugin provider init, blocking esignet-mosipid entirely. Set a literal placeholder value directly instead, to be replaced with the real MISP license key once available. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
The secretKeyRef wiring itself is correct and was already there. The reason it wasn't reflecting on the live esignet-mosipid pod is almost certainly the value/valueFrom merge-patch conflict from before (commit acf6b09) blocking upgrades entirely for that release, not a problem with this specific config. Once the live Deployment is deleted and recreated (as discussed), it should pick up correctly. The secret's value itself is still empty pending either the onboarder being properly wired for mosipid or a real MISP license key being supplied. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
0.1.1to match the deployed version (esignet-standalone/external-dsf.yaml)esignetgomosipid1,esignetgomosipid2,esignetgosunbird) so module names don't collide across servicesMOSIP_P12_PATHfilenames per instance (mosipid1.pfx,mosipid2.pfx,mock.pfx,sunbird.pfx)MOSIP_ESIGNET_CAPTCHA_MODULE_NAMEentry from the mosipid1extraEnvVarsCLIENT_ID,ACRS,DISPLAY,GRANT_TYPE,CLAIMS_LOCALES,SCOPE_USER_PROFILE,CLAIMS_USER_PROFILE,CLAIMS_REGISTRATION,FALLBACK_LANG,AUTHORIZE_ENDPOINT,CODE_CHALLENGE) across all instances in bothesignet-standaloneandesignet-standalone-2.0.0profilesmock-relying-party-servicevaluesFile (mock-replying-party.yaml) with PAR-relatedextraEnvVars, wired into all 4mock-relying-party-service-go*appsFixes #2288
Test plan
helmsman -f Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml --applydry-run validates cleanlyesignet-standalone-2.0.0profile and confirm captcha module names resolve without collision🤖 Generated with Claude Code