diff --git a/.github/workflows/helmsman_esignet.yml b/.github/workflows/helmsman_esignet.yml index 170fb368f..046af52db 100644 --- a/.github/workflows/helmsman_esignet.yml +++ b/.github/workflows/helmsman_esignet.yml @@ -39,17 +39,8 @@ on: description: "PostgreSQL port for eSignet databases (e.g. 5433 for MOSIP platform external postgres)" required: true type: string - mosipid1_domain_name: - description: "MOSIP-ID1 domain name for this environment (e.g. mosipenv1.xyz.net)" - required: false - type: string - enable_mosipid2: - description: "Enable MOSIP-ID2 eSignet instance (deploys softhsm, esignet, oidc-ui, mock-rp for mosipid2)" - required: false - default: false - type: boolean - mosipid2_domain_name: - description: "MOSIP-ID2 domain name for this environment (e.g. qabase.xyz.net)" + mosipid_domain_name: + description: "MOSIP-ID domain name for this environment (e.g. mosipenv.xyz.net) — required for esignet standalone profiles" required: false type: string env_name: @@ -89,22 +80,22 @@ jobs: echo "✓ domain_name = $DOMAIN" echo "✓ env_name = $ENV" echo "✓ esignet_db_port = $ESIGNET_DB_PORT" - # mosipid1_domain_name and mosipid2_domain_name are esignet standalone only. + # mosipid_domain_name is esignet standalone only (both esignet-standalone + # and esignet-standalone-2.0.0 each run a single consolidated mosipid instance). # Push events always target esignet (path filter); dispatch uses explicit profile input. if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then - MOSIPID1_DOMAIN="${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }}" - MOSIPID2_DOMAIN="${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }}" - echo "✓ mosipid1_domain_name = $MOSIPID1_DOMAIN (esignet standalone)" - echo "✓ mosipid2_domain_name = $MOSIPID2_DOMAIN (esignet standalone)" - MOSIPID1_SPRING_LABEL="${{ vars.ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL }}" - MOSIPID2_SPRING_LABEL="${{ vars.ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL }}" - echo "✓ mosipid1_spring_config_label = ${MOSIPID1_SPRING_LABEL:-develop} (esignet standalone, default: develop)" - echo "✓ mosipid2_spring_config_label = ${MOSIPID2_SPRING_LABEL:-develop} (esignet standalone, default: develop)" + MOSIPID_DOMAIN="${{ github.event.inputs.mosipid_domain_name || vars.MOSIPID_DOMAIN_NAME }}" + if [ -z "$MOSIPID_DOMAIN" ]; then + echo "❌ mosipid_domain_name is required for standalone profiles" + exit 1 + fi + echo "✓ mosipid_domain_name = $MOSIPID_DOMAIN (esignet standalone)" + MOSIPID_SPRING_LABEL="${{ vars.ESIGNET_MOSIPID_SPRING_CONFIG_LABEL }}" + echo "✓ mosipid_spring_config_label = ${MOSIPID_SPRING_LABEL:-develop} (esignet standalone, default: develop)" else - MOSIPID1_PROVIDED="${{ github.event.inputs.mosipid1_domain_name }}" - MOSIPID2_PROVIDED="${{ github.event.inputs.mosipid2_domain_name }}" - if [ -n "$MOSIPID1_PROVIDED" ] || [ -n "$MOSIPID2_PROVIDED" ]; then - echo "⚠ mosipid1_domain_name / mosipid2_domain_name are only used for esignet standalone profile — ignoring for profile=$PROFILE" + MOSIPID_PROVIDED="${{ github.event.inputs.mosipid_domain_name }}" + if [ -n "$MOSIPID_PROVIDED" ]; then + echo "⚠ mosipid_domain_name is only used for esignet standalone profiles — ignoring for profile=$PROFILE" fi fi @@ -119,10 +110,8 @@ jobs: KUBECTL_PATH: ${{ github.workspace }}/.local/bin/kubectl domain_name: ${{ github.event.inputs.domain_name || vars.DOMAIN_NAME }} esignet_db_port: ${{ github.event.inputs.esignet_db_port || vars.ESIGNET_DB_PORT }} - mosipid1_domain_name: ${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }} - mosipid2_domain_name: ${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }} + mosipid_domain_name: ${{ github.event.inputs.mosipid_domain_name || vars.MOSIPID_DOMAIN_NAME }} env_name: ${{ github.event.inputs.env_name || vars.ENV_NAME }} - MOSIPID2_ENABLED: ${{ github.event.inputs.enable_mosipid2 == 'true' && 'true' || 'false' }} # All secrets below are ENVIRONMENT secrets (not repository secrets) # Configure them in: Repository → Settings → Environments → → Secrets # Mock Relying Party Service secrets (base64 encoded PEM) @@ -131,23 +120,18 @@ jobs: # eSignet Captcha secrets (plain text from Google reCAPTCHA) ESIGNET_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_CAPTCHA_SITE_KEY }} ESIGNET_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_CAPTCHA_SECRET_KEY }} - # Per-namespace captcha secrets — required for esignet standalone profile only - ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY }} - ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY }} - ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY }} - ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY }} - # MOSIPID1 / MOSIPID2 remote Keycloak admin + Postgres passwords - MOSIPID1_KEYCLOAK_ADMIN_PASSWORD: ${{ secrets.MOSIPID1_KEYCLOAK_ADMIN_PASSWORD }} - MOSIPID2_KEYCLOAK_ADMIN_PASSWORD: ${{ secrets.MOSIPID2_KEYCLOAK_ADMIN_PASSWORD }} - MOSIPID1_POSTGRES_PASSWORD: ${{ secrets.MOSIPID1_POSTGRES_PASSWORD }} - MOSIPID2_POSTGRES_PASSWORD: ${{ secrets.MOSIPID2_POSTGRES_PASSWORD }} + # mosipid captcha secret — required for esignet standalone profiles + ESIGNET_MOSIPID_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_MOSIPID_CAPTCHA_SITE_KEY }} + ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY }} + # MOSIPID remote Keycloak admin + Postgres password (esignet standalone profiles) + MOSIPID_KEYCLOAK_ADMIN_PASSWORD: ${{ secrets.MOSIPID_KEYCLOAK_ADMIN_PASSWORD }} + MOSIPID_POSTGRES_PASSWORD: ${{ secrets.MOSIPID_POSTGRES_PASSWORD }} ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY }} ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY }} # Spring config label per namespace — controls which Git branch/tag the config-server uses # Set as Environment Variables in Repository → Settings → Environments → → Variables # If unset, hooks default to 'develop' - ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL: ${{ vars.ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL }} - ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL: ${{ vars.ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL }} + ESIGNET_MOSIPID_SPRING_CONFIG_LABEL: ${{ vars.ESIGNET_MOSIPID_SPRING_CONFIG_LABEL }} # Cluster access secrets KUBECONFIG_SECRET: ${{ secrets.KUBECONFIG }} CLUSTER_WIREGUARD_WG0: ${{ secrets.CLUSTER_WIREGUARD_WG0 }} @@ -190,8 +174,7 @@ jobs: } save_var "DOMAIN_NAME" "${{ github.event.inputs.domain_name }}" save_var "ESIGNET_DB_PORT" "${{ github.event.inputs.esignet_db_port }}" - save_var "MOSIPID1_DOMAIN_NAME" "${{ github.event.inputs.mosipid1_domain_name }}" - save_var "MOSIPID2_DOMAIN_NAME" "${{ github.event.inputs.mosipid2_domain_name }}" + save_var "MOSIPID_DOMAIN_NAME" "${{ github.event.inputs.mosipid_domain_name }}" save_var "ENV_NAME" "${{ github.event.inputs.env_name }}" - name: Mask sensitive data @@ -203,10 +186,8 @@ jobs: echo "::add-mask::${{ secrets.CLUSTER_WIREGUARD_WG0 }}" echo "::add-mask::${{ secrets.ESIGNET_CAPTCHA_SITE_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_CAPTCHA_SECRET_KEY }}" - echo "::add-mask::${{ secrets.ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY }}" - echo "::add-mask::${{ secrets.ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY }}" - echo "::add-mask::${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY }}" - echo "::add-mask::${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY }}" + echo "::add-mask::${{ secrets.ESIGNET_MOSIPID_CAPTCHA_SITE_KEY }}" + echo "::add-mask::${{ secrets.ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY }}" @@ -326,7 +307,7 @@ jobs: kubectl cluster-info - name: Check if mosip-dsf label is completed - if: ${{ github.event.inputs.skip_mosip_dsf_check != 'true' && vars.ESIGNET_STANDALONE_MODE != 'true' && !startsWith(github.event.inputs.profile, 'esignet-standalone') }} + if: ${{ github.event.inputs.skip_mosip_dsf_check != 'true' && vars.ESIGNET_STANDALONE_MODE != 'true' && !startsWith(env.PROFILE, 'esignet-standalone') }} run: | STATUS=$(kubectl get namespace default -o jsonpath='{.metadata.labels.mosip-dsf}' 2>/dev/null || echo "") if [[ "$STATUS" != "completed" ]]; then @@ -380,10 +361,10 @@ jobs: echo "✅ ESIGNET_CAPTCHA_SECRET_KEY is configured" fi - # Per-namespace captcha secrets — only required for esignet standalone profile + # Per-namespace captcha secrets — only required for esignet standalone profiles if [[ "$PROFILE" == esignet-standalone* ]]; then - echo "--- Validating esignet standalone mosipid1 captcha secrets ---" - for var in ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY \ + echo "--- Validating esignet standalone mosipid captcha secrets ---" + for var in ESIGNET_MOSIPID_CAPTCHA_SITE_KEY ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY \ ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY; do val="${!var:-}" if [ -z "$val" ]; then @@ -393,8 +374,8 @@ jobs: echo "✅ $var is configured" fi done - echo "--- Validating esignet standalone mosipid1 postgres + keycloak secrets ---" - for var in MOSIPID1_POSTGRES_PASSWORD MOSIPID1_KEYCLOAK_ADMIN_PASSWORD; do + echo "--- Validating esignet standalone mosipid postgres + keycloak secrets ---" + for var in MOSIPID_POSTGRES_PASSWORD MOSIPID_KEYCLOAK_ADMIN_PASSWORD; do val="${!var:-}" if [ -z "$val" ]; then echo "❌ $var secret is not configured (required for esignet standalone)" @@ -403,21 +384,6 @@ jobs: echo "✅ $var is configured" fi done - if [ "$MOSIPID2_ENABLED" = "true" ]; then - echo "--- Validating mosipid2 captcha + postgres + keycloak secrets ---" - for var in ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY \ - MOSIPID2_POSTGRES_PASSWORD MOSIPID2_KEYCLOAK_ADMIN_PASSWORD; do - val="${!var:-}" - if [ -z "$val" ]; then - echo "❌ $var secret is not configured (required when enable_mosipid2=true)" - MISSING_SECRETS=1 - else - echo "✅ $var is configured" - fi - done - else - echo "ℹ mosipid2 disabled — skipping mosipid2 secret validation" - fi fi if [ "$MISSING_SECRETS" -eq 1 ]; then @@ -433,13 +399,9 @@ jobs: echo " - ESIGNET_CAPTCHA_SITE_KEY (reCAPTCHA site key - plain text)" echo " - ESIGNET_CAPTCHA_SECRET_KEY (reCAPTCHA secret key - plain text)" if [[ "$PROFILE" == esignet-standalone* ]]; then - echo " - ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY / ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY" + echo " - ESIGNET_MOSIPID_CAPTCHA_SITE_KEY / ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY" echo " - ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY / ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY" - echo " - MOSIPID1_POSTGRES_PASSWORD / MOSIPID1_KEYCLOAK_ADMIN_PASSWORD" - if [ "$MOSIPID2_ENABLED" = "true" ]; then - echo " - ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY / ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY" - echo " - MOSIPID2_POSTGRES_PASSWORD / MOSIPID2_KEYCLOAK_ADMIN_PASSWORD" - fi + echo " - MOSIPID_POSTGRES_PASSWORD / MOSIPID_KEYCLOAK_ADMIN_PASSWORD" fi exit 1 fi @@ -541,8 +503,7 @@ jobs: - name: Show deployment variables run: | echo "domain_name = $domain_name" - echo "mosipid1_domain_name = $mosipid1_domain_name" - echo "mosipid2_domain_name = $mosipid2_domain_name" + echo "mosipid_domain_name = $mosipid_domain_name" echo "env_name = $env_name" - name: Initiate helmsman to apply the DSF configurations @@ -581,17 +542,7 @@ jobs: # Fix: skip softhsm upgrade on re-runs so the PIN in the secret never changes. SKIP_RELEASES_ARG="" if [[ "$PROFILE" == esignet-standalone* ]]; then - case "$PROFILE" in - esignet-standalone) - SOFTHSM_PAIRS=("esignet-softhsm:esignet-mock" "esignet-softhsm-mosipid1:esignet-mosipid1" "esignet-softhsm-mosipid2:esignet-mosipid2" "esignet-softhsm-sunbird:esignet-sunbird") - ;; - esignet-standalone-2.0.0) - SOFTHSM_PAIRS=("esignet-softhsm-go:esignet-go-mock" "esignet-softhsm-go-mosipid1:esignet-go-mosipid1" "esignet-softhsm-go-mosipid2:esignet-go-mosipid2" "esignet-softhsm-go-sunbird:esignet-go-sunbird") - ;; - *) - SOFTHSM_PAIRS=() - ;; - esac + SOFTHSM_PAIRS=("esignet-softhsm:esignet-mock" "esignet-softhsm-mosipid:esignet-mosipid" "esignet-softhsm-sunbird:esignet-sunbird") SKIP_RELEASES="" for pair in "${SOFTHSM_PAIRS[@]}"; do release="${pair%%:*}" @@ -632,7 +583,7 @@ jobs: echo "Commit: ${{ github.sha }}" echo "" echo "Namespaces created/updated:" - kubectl get ns esignet-mock esignet-mosipid1 esignet-mosipid2 esignet-sunbird softhsm keycloak redis postgres 2>/dev/null || echo "Some namespaces may not exist yet" + kubectl get ns esignet-mock esignet-mosipid esignet-sunbird softhsm keycloak redis postgres 2>/dev/null || echo "Some namespaces may not exist yet" echo "" echo "eSignet pods status:" kubectl get pods -n esignet-mock 2>/dev/null || echo "esignet-mock namespace not ready" diff --git a/.github/workflows/helmsman_external.yml b/.github/workflows/helmsman_external.yml index 1700a13e7..fb011f045 100644 --- a/.github/workflows/helmsman_external.yml +++ b/.github/workflows/helmsman_external.yml @@ -224,9 +224,6 @@ jobs: - name: Mask sensitive secrets run: | - MINIO_ROOT_PASSWORD=$(kubectl -n minio get secret minio -o jsonpath='{.data.root-password}' 2>/dev/null | base64 -d || true) - if [ -n "$MINIO_ROOT_PASSWORD" ]; then echo "::add-mask::$MINIO_ROOT_PASSWORD"; fi - echo "MINIO_ROOT_PASSWORD=$MINIO_ROOT_PASSWORD" >> $GITHUB_ENV echo "::add-mask::${{ secrets.ESIGNET_CAPTCHA_SITE_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_CAPTCHA_SECRET_KEY }}" echo "::add-mask::${{ secrets.PREREG_CAPTCHA_SITE_KEY }}" @@ -337,8 +334,20 @@ jobs: kubectl get nodes kubectl cluster-info - # Test istioctl functionality + # Test istioctl functionality istioctl version --remote=false + + - name: Fetch and mask minio root password + run: | + # Must run after WireGuard/kubeconfig are up - kubectl needs cluster + # access to look up the existing secret. Fetching this earlier (as + # part of "Mask sensitive secrets", before the tunnel is up) always + # returned empty, which then failed minio's helm upgrade with + # "auth.rootPassword must not be empty". + MINIO_ROOT_PASSWORD=$(kubectl -n minio get secret minio -o jsonpath='{.data.root-password}' 2>/dev/null | base64 -d || true) + if [ -n "$MINIO_ROOT_PASSWORD" ]; then echo "::add-mask::$MINIO_ROOT_PASSWORD"; fi + echo "MINIO_ROOT_PASSWORD=$MINIO_ROOT_PASSWORD" >> $GITHUB_ENV + - name: Export keycloak client secrets for esignet-keycloak-init if: contains(matrix.dsf_files, 'esignet-standalone/external-dsf.yaml') run: | diff --git a/.github/workflows/helmsman_testrigs.yml b/.github/workflows/helmsman_testrigs.yml index 8a2c5395b..cdd80f7f9 100644 --- a/.github/workflows/helmsman_testrigs.yml +++ b/.github/workflows/helmsman_testrigs.yml @@ -25,17 +25,8 @@ on: description: "Domain name for this environment (e.g. example.xyz.net)" required: true type: string - mosipid1_domain_name: - description: "MOSIP-ID1 domain name (e.g. mosipenv1.xyz.net) — required for esignet profile" - required: false - type: string - enable_mosipid2: - description: "Enable MOSIP-ID2 testrig (only needed if mosipid2 eSignet instance is enabled)" - required: false - default: false - type: boolean - mosipid2_domain_name: - description: "MOSIP-ID2 domain name (e.g. mosipenv2.xyz.net) — required only when enable_mosipid2 is set" + mosipid_domain_name: + description: "MOSIP-ID domain name (e.g. mosipenv.xyz.net) — required for esignet standalone profiles" required: false type: string db_port: @@ -73,6 +64,9 @@ jobs: name: ${{ github.ref_name }} steps: - name: Validate required variables + env: + IN_MOSIPID_DOMAIN: ${{ github.event.inputs.mosipid_domain_name }} + VAR_MOSIPID_DOMAIN: ${{ vars.MOSIPID_DOMAIN_NAME }} run: | errors=() PROFILE="${{ github.event.inputs.profile }}" @@ -97,18 +91,20 @@ jobs: echo "✓ slack_channel_name = $SLACK_CH" echo "✓ db_port = $DB_PORT" echo "✓ esignet_db_port = $ESIGNET_DB_PORT" - # mosipid1_domain_name and mosipid2_domain_name are esignet standalone only. + # mosipid_domain_name is esignet standalone only (both esignet-standalone + # and esignet-standalone-2.0.0 each run a single consolidated mosipid instance). # Push events always target the esignet profile (path filter); dispatch uses explicit profile input. if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then - MOSIPID1_DOMAIN="${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }}" - MOSIPID2_DOMAIN="${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }}" - echo "✓ mosipid1_domain_name = $MOSIPID1_DOMAIN (esignet standalone)" - echo "✓ mosipid2_domain_name = $MOSIPID2_DOMAIN (esignet standalone)" + MOSIPID_DOMAIN="${IN_MOSIPID_DOMAIN:-$VAR_MOSIPID_DOMAIN}" + if [ -z "$MOSIPID_DOMAIN" ]; then + echo "❌ mosipid_domain_name is required for standalone profiles" + exit 1 + fi + echo "✓ mosipid_domain_name = $MOSIPID_DOMAIN (esignet standalone)" else - MOSIPID1_PROVIDED="${{ github.event.inputs.mosipid1_domain_name }}" - MOSIPID2_PROVIDED="${{ github.event.inputs.mosipid2_domain_name }}" - if [ -n "$MOSIPID1_PROVIDED" ] || [ -n "$MOSIPID2_PROVIDED" ]; then - echo "⚠ mosipid1_domain_name / mosipid2_domain_name are only used for esignet standalone profile — ignoring for profile=$PROFILE" + MOSIPID_PROVIDED="$IN_MOSIPID_DOMAIN" + if [ -n "$MOSIPID_PROVIDED" ]; then + echo "⚠ mosipid_domain_name is only used for esignet standalone profiles — ignoring for profile=$PROFILE" fi fi @@ -122,9 +118,7 @@ jobs: PATH: ${{ github.workspace }}/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin KUBECTL_PATH: ${{ github.workspace }}/.local/bin/kubectl domain_name: ${{ github.event.inputs.domain_name || vars.DOMAIN_NAME }} - mosipid1_domain_name: ${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }} - mosipid2_domain_name: ${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }} - MOSIPID2_ENABLED: ${{ github.event.inputs.enable_mosipid2 == 'true' && 'true' || 'false' }} + mosipid_domain_name: ${{ github.event.inputs.mosipid_domain_name || vars.MOSIPID_DOMAIN_NAME }} db_port: ${{ github.event.inputs.db_port || vars.DB_PORT }} esignet_db_port: ${{ github.event.inputs.esignet_db_port || vars.ESIGNET_DB_PORT }} env_name: ${{ github.event.inputs.env_name || vars.ENV_NAME }} @@ -167,8 +161,7 @@ jobs: fi } save_var "DOMAIN_NAME" "${{ github.event.inputs.domain_name }}" - save_var "MOSIPID1_DOMAIN_NAME" "${{ github.event.inputs.mosipid1_domain_name }}" - save_var "MOSIPID2_DOMAIN_NAME" "${{ github.event.inputs.mosipid2_domain_name }}" + save_var "MOSIPID_DOMAIN_NAME" "${{ github.event.inputs.mosipid_domain_name }}" save_var "DB_PORT" "${{ github.event.inputs.db_port }}" save_var "ESIGNET_DB_PORT" "${{ github.event.inputs.esignet_db_port }}" save_var "ENV_NAME" "${{ github.event.inputs.env_name }}" diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 55e650580..1529f23fa 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -1,19 +1,19 @@ # ============================================================================= # eSignet Profile - eSignet Services DSF (Desired State File) # ============================================================================= -# This DSF deploys eSignet v1.7.1 services for the standalone eSignet profile. +# This DSF deploys eSignet 2.0.0 (Go) services for the standalone eSignet profile. # # Components (in priority order): # 1. Keycloak Init (eSignet-specific clients and roles) -# 2. eSignet service v1.7.1 -# 3. OIDC UI v1.7.1 +# 2. eSignet service 2.0.0-develop (Go) +# 3. OIDC UI 2.0.0-develop (Go) # 4. Mock Identity System (optional, disabled by default) # 5. Mock Relying Party Service (optional) # 6. Mock Relying Party UI (optional) # 7. Partner Onboarder (eSignet + Resident OIDC) # 8. Demo OIDC Partner Onboarder # -# Based on eSignet v1.7.1 deploy scripts: +# Based on eSignet 2.0.0 deploy scripts: # - install-esignet.sh # - initialise-prereq.sh (keycloak-init) # ============================================================================= @@ -28,15 +28,13 @@ helmRepos: mosip: https://mosip.github.io/mosip-helm namespaces: - esignet-go-mock: + esignet-mock: protected: false - softhsm-go: + softhsm: protected: false - esignet-go-mosipid1: + esignet-mosipid: protected: false - esignet-go-mosipid2: - protected: false - esignet-go-sunbird: + esignet-sunbird: protected: false apps: @@ -45,8 +43,8 @@ apps: # --------------------------------------------------------------------------- # Deployed here (not in external-dsf) so esignet-softhsm-share configmap is # available in esignet namespace before eSignet service starts. - esignet-softhsm-go: - namespace: esignet-go-mock + esignet-softhsm: + namespace: esignet-mock enabled: true version: 12.0.1 chart: mosip/softhsm @@ -56,30 +54,19 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh" - esignet-softhsm-go-mosipid1: - namespace: esignet-go-mosipid1 + esignet-softhsm-mosipid: + namespace: esignet-mosipid enabled: true version: 12.0.1 chart: mosip/softhsm - valuesFile: "$WORKDIR/utils/softhsm-esignet-mosipid1-values.yaml" - timeout: 480 - priority: -16 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid1-setup.sh" - - esignet-softhsm-go-mosipid2: - namespace: esignet-go-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 12.0.1 - chart: mosip/softhsm - valuesFile: "$WORKDIR/utils/softhsm-esignet-mosipid2-values.yaml" + valuesFile: "$WORKDIR/utils/softhsm-esignet-mosipid-values.yaml" timeout: 480 priority: -16 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid2-setup.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid-setup.sh" - esignet-softhsm-go-sunbird: - namespace: esignet-go-sunbird + esignet-softhsm-sunbird: + namespace: esignet-sunbird enabled: true version: 12.0.1 chart: mosip/softhsm @@ -89,238 +76,378 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh" - esignet-config-server-go: - namespace: esignet-go-mock - enabled: false - version: 12.0.1 - chart: mosip/config-server - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/config-server-esignet-values-2-0-0.yaml" - wait: true - timeout: 1200 - priority: -15 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh" - postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh" - # --------------------------------------------------------------------------- - # eSignet v1.7.1 + # eSignet # --------------------------------------------------------------------------- - esignet-go-mock: - namespace: esignet-go-mock + esignet-mock: + namespace: esignet-mock enabled: true version: 2.0.0-develop chart: mosip/esignet - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml" set: - image.repository: "mosipqa/esignet" + image.repository: "mosipdev/esignet" image.tag: "develop-go" enable_insecure: "false" springConfigNameEnv: "" activeProfileEnv: "" pluginNameEnv: "esignet-mock-plugin.jar" pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-go-share" + extraEnvVarsCM[0]: "esignet-softhsm-share" #extraEnvVarsCM[1]: "kafka-config" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-go.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-go.${domain_name}" - domainConfig.MOSIP_API_HOST: "api.${domain_name}" - domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" - domainConfig.OIDC_UI_HOSTNAME: "esignet-go.${domain_name}" + domainConfig.OIDC_UI_HOSTNAME: "esignet.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup.${domain_name}" + # esignet-mock has no esignet-global configmap (only the mosipid/sunbird preinstall + # hooks create their own per-namespace esignet-global) - these chart-default extraEnvVars + # entries are tables (valueFrom.configMapKeyRef against esignet-global), so a plain + # string override at the same key produces a "cannot overwrite table with non table" + # coalesce warning (harmless on its own, but risks masking real errors in Helmsman's + # truncated output) and would still fail with CreateContainerConfigError if left as the + # chart default. Null them out entirely instead - MOSIP_API_INTERNAL_HOST/MOSIP_ESIGNET_HOST/ + # MOSIP_SIGNUP_HOST now come from domainConfig (above); MOSIP_ESIGNET_OIDC_UI_HOSTNAME has + # no domainConfig equivalent key so it's set via extraEnvVarsAdditional instead (renders + # after extraEnvVars, no chart-default table to conflict with). "null" (quoted) is + # required: Helmsman's YAML parsing turns a bare `null` into an empty string, not the + # literal text Helm needs to delete a key. + extraEnvVars.MOSIP_API_INTERNAL_HOST: "null" + extraEnvVars.MOSIP_ESIGNET_OIDC_UI_HOSTNAME: "null" + extraEnvVars.MOSIP_ESIGNET_HOST: "null" + extraEnvVars.MOSIP_SIGNUP_HOST: "null" + extraEnvVarsAdditional.MOSIP_ESIGNET_OIDC_UI_HOSTNAME: "esignet.${domain_name}" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignet" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_PROVIDER: "google-recaptcha" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_VALIDATOR_URL: "http://captcha.captcha/v1/captcha/validatecaptcha" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.key: "redis-port" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.name: "redis" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.key: "redis-password" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.key: "database-host" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.key: "database-port" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.key: "database-name" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" + extraEnvVars.MOSIP_ESIGNET_AUTHN_PROVIDER: "mock" + extraEnvVars.NAMESPACE: "mock" + extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" + persistence.enabled: "true" + persistence.pvc_claim_name: "esignet-mock-pkcs12-keystore" + extraEnvVars.OIDC_UI_SCHEME: "https" + extraEnvVars.OIDC_UI_PORT: "443" + extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" + extraEnvVars.OIDC_UI_ERROR_PATH: "/error" + extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" + extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" + extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" + # Overridden directly under extraEnvVars (not extraEnvVarsAdditional) so the + # chart's own PKCS11 defaults for these same keys don't also render into the + # env: list - relying on extraEnvVarsAdditional's last-wins ordering left the + # redundant PKCS11 entries (module path, token label, slot id, PIN secretKeyRef) + # coexisting alongside these, which happened to still work here (esignet-softhsm + # secret exists in this namespace) but is fragile and confusing. + extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS12" + extraEnvVars.KEYMANAGER_PKCS12_FILE_PATH: "/home/mosip/config/keystore.p12" + extraEnvVars.KEYMANAGER_PKCS12_PASSWORD: "localtest" + extraEnvVars.KEYMANAGER_PKCS12_ALLOW_INSECURE_SOFTWARE_KEYSTORE: "true" + extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "" + extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "" + extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "" + # KEYMANAGER_PKCS11_PIN's chart default is a table (valueFrom.secretKeyRef), unlike the + # three plain-string defaults above - an empty-string override here still triggers the + # coalesce "cannot overwrite table with non table" warning, so null it out instead. + extraEnvVars.KEYMANAGER_PKCS11_PIN: "null" timeout: 600 priority: -14 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh" postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh" - esignet-go-mosipid1: - namespace: esignet-go-mosipid1 + esignet-mosipid: + namespace: esignet-mosipid enabled: true version: 2.0.0-develop chart: mosip/esignet - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml" - set: - image.repository: "mosipqa/esignet" - image.tag: "develop-go" - enable_insecure: "false" - springConfigNameEnv: "" - activeProfileEnv: "" - pluginNameEnv: "mosip-identity-plugin.jar" - pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-go-mosipid1-share" - extraEnvVarsCM[1]: "esignet-global" - metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-go-mosipid1.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-go-mosipid1.${domain_name}" - domainConfig.MOSIP_API_HOST: "api.${domain_name}" - domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid1_domain_name}" - domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" - domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" - domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" - domainConfig.installation-domain: "${domain_name}" - domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid1_domain_name}" - domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid1_domain_name}" - domainConfig.IDA_INTERNAL_URL: "https://api-internal.${mosipid1_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL: "https://api-internal.${mosipid1_domain_name}/mosip-certs/ida-partner.cer" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid1_domain_name}/v1/authmanager/authenticate/clientidsecretkey" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid1_domain_name}/v1/auditmanager/audits" - domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid1_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-go-mosipid1.${domain_name}" - domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-go-mosipid1.${domain_name}" - domainConfig.OIDC_UI_HOSTNAME: "esignet-go-mosipid1.${domain_name}" - timeout: 600 - priority: -14 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh" - - esignet-go-mosipid2: - namespace: esignet-go-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 2.0.0-develop - chart: mosip/esignet - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml" set: - image.repository: "mosipqa/esignet" + image.repository: "mosipdev/esignet" image.tag: "develop-go" enable_insecure: "false" springConfigNameEnv: "" activeProfileEnv: "" pluginNameEnv: "mosip-identity-plugin.jar" pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-go-mosipid2-share" - extraEnvVarsCM[1]: "esignet-global" + extraEnvVarsCM[0]: "esignet-softhsm-mosipid-share" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-go-mosipid2.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-go-mosipid2.${domain_name}" - domainConfig.MOSIP_API_HOST: "api.${domain_name}" - domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid2_domain_name}" + domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" - domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid2_domain_name}" - domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid2_domain_name}" - domainConfig.IDA_INTERNAL_URL: "https://api-internal.${mosipid2_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL: "https://api-internal.${mosipid2_domain_name}/mosip-certs/ida-partner.cer" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid2_domain_name}/v1/authmanager/authenticate/clientidsecretkey" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid2_domain_name}/v1/auditmanager/audits" - domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid2_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-go-mosipid2.${domain_name}" - domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-go-mosipid2.${domain_name}" - domainConfig.OIDC_UI_HOSTNAME: "esignet-go-mosipid2.${domain_name}" + domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid_domain_name}" + domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid_domain_name}" + domainConfig.IDA_INTERNAL_URL: "https://api-internal.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL: "https://api-internal.${mosipid_domain_name}/mosip-certs/ida-partner.cer" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid_domain_name}/v1/authmanager/authenticate/clientidsecretkey" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid_domain_name}/v1/auditmanager/audits" + domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-mosipid.${domain_name}" + domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-mosipid.${domain_name}" + domainConfig.OIDC_UI_HOSTNAME: "esignet-mosipid.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-mosipid.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup-mosipid.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid_domain_name}" + # Chart-default extraEnvVars.MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/MOSIP_API_INTERNAL_HOST + # are tables (valueFrom.configMapKeyRef against esignet-global). A plain string override + # at the same key produces a "cannot overwrite table with non table" coalesce warning + # (harmless on its own, but noisy) and still leaves domainConfig's own same-named entry + # as a genuinely separate list item - so null the chart-default keys out entirely + # instead, letting domainConfig (above) be the sole source, matching the pattern used + # for KEYMANAGER_PKCS11_* elsewhere in this file. "null" (quoted) is required: Helmsman's + # YAML parsing turns a bare `null` into an empty string, not the literal text Helm needs + # to delete a key. + extraEnvVars.MOSIP_ESIGNET_HOST: "null" + extraEnvVars.MOSIP_SIGNUP_HOST: "null" + extraEnvVars.MOSIP_API_INTERNAL_HOST: "null" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.key: "redis-port" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.name: "redis" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.key: "redis-password" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.key: "database-host" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.key: "database-port" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.key: "database-name" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" + # Chart-default extraEnvVars.KEYMANAGER_PKCS11_PIN points at a plain "esignet-softhsm" + # secret that doesn't exist in this namespace (only esignet-softhsm-mosipid does) - + # override directly under extraEnvVars (not extraEnvVarsAdditional) so the chart's + # own defaults for these same keys don't also coexist redundantly in the rendered env. + extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" + extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" + extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" + extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" + extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "null" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets-mosipid" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" + extraEnvVars.MOSIP_ESIGNET_AUTHN_PROVIDER: "mosip" + extraEnvVars.NAMESPACE: "mosipid" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_PROVIDER: "google-recaptcha" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_VALIDATOR_URL: "http://captcha.captcha/v1/captcha/validatecaptcha" + extraEnvVarsAdditional.hsm_client_zip_url_env: "https://raw.githubusercontent.com/mosip/artifactory-ref-impl/master/artifacts/src/hsm/client.zip" + extraEnvVars.OIDC_UI_SCHEME: "https" + extraEnvVars.OIDC_UI_PORT: "443" + extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" + extraEnvVars.OIDC_UI_ERROR_PATH: "/error" + extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" + extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" + extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetmosipid" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha-mosipid" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" + extraEnvVarsAdditional.plugin_name_env: "mosip-identity-plugin.jar" + extraEnvVarsAdditional.SPRING_KAFKA_CONSUMER_GROUP_ID: "esignet-consumer-esignet-mosipid" + extraEnvVarsAdditional.MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE: "esignet-mosipid-signup-esqa020" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS: 'email,phone' + extraEnvVarsAdditional.MOSIP_ESIGNET_SEND_OTP_ATTEMPTS: "300" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: "300" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS: "600" + extraEnvVarsAdditional.MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS: "600" + extraEnvVarsAdditional.MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX: "@phone" + extraEnvVarsAdditional.MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS.value: '\{\{ "\{\{" \}\} ''id'': ''mobile'', ''svg'': ''mobile_icon'', ''prefixes'': \{\{ "\{\{" \}\}''label'': ''IND'', ''value'': ''+91'', ''maxLength'': '''', ''regex'': ''''\},\{''label'': ''KHM'', ''value'': ''+855'', ''regex'': ''''\{\{ "\}\}" \}\}, ''postfix'': ''@phone'', ''maxLength'': '''', ''regex'': '''' \}, \{ ''id'': ''nrc'', ''svg'': ''nrc_id_icon'', ''prefixes'': '''', ''postfix'': ''@nrc'', ''maxLength'': '''', ''regex'': '''' \}, \{ ''id'': ''vid'', ''svg'': ''vid_icon'', ''prefixes'': '''', ''postfix'': '''', ''maxLength'': '''', ''regex'': '''' \}, \{ ''id'': ''email'', ''svg'': ''email_icon'', ''prefixes'': '''', ''postfix'': ''@email'', ''maxLength'': '''', ''regex'': '''' \{\{ "\}\}" \}\}' + extraEnvVarsAdditional.LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT: "INFO" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_URL: "http://captcha.captcha" + extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY.valueFrom.secretKeyRef.name: "esignet-misp-onboarder-key" + extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY.valueFrom.secretKeyRef.key: "mosip-esignet-misp-key" timeout: 600 priority: -14 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh" - esignet-go-sunbird: - namespace: esignet-go-sunbird + esignet-sunbird: + namespace: esignet-sunbird enabled: true version: 2.0.0-develop chart: mosip/esignet - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml" set: - image.repository: "mosipqa/esignet" + image.repository: "mosipdev/esignet" image.tag: "develop-go" enable_insecure: "false" springConfigNameEnv: "" activeProfileEnv: "" pluginNameEnv: "sunbird-rc-plugin.jar" pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-go-sunbird-share" + extraEnvVarsCM[0]: "esignet-softhsm-sunbird-share" #extraEnvVarsCM[1]: "kafka-config" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-go-sunbird.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-go-sunbird.${domain_name}" - domainConfig.MOSIP_API_HOST: "api.${domain_name}" - domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" - domainConfig.MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid1_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL: "https://registry.${mosipid1_domain_name}/api/v1/Insurance/search" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid1_domain_name}/api/v1/Insurance/" - domainConfig.OIDC_UI_HOSTNAME: "esignet-go-sunbird.${domain_name}" + domainConfig.MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL: "https://registry.${mosipid_domain_name}/api/v1/Insurance/search" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid_domain_name}/api/v1/Insurance/" + domainConfig.OIDC_UI_HOSTNAME: "esignet-sunbird.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-sunbird.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup-sunbird.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" + # Chart-default extraEnvVars.MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/MOSIP_API_INTERNAL_HOST + # are tables (valueFrom.configMapKeyRef against esignet-global). A plain string override + # at the same key produces a "cannot overwrite table with non table" coalesce warning + # (harmless on its own, but noisy) and still leaves domainConfig's own same-named entry + # as a genuinely separate list item - so null the chart-default keys out entirely + # instead, letting domainConfig (above) be the sole source, matching the pattern used + # for KEYMANAGER_PKCS11_* elsewhere in this file. "null" (quoted) is required: Helmsman's + # YAML parsing turns a bare `null` into an empty string, not the literal text Helm needs + # to delete a key. + extraEnvVars.MOSIP_ESIGNET_HOST: "null" + extraEnvVars.MOSIP_SIGNUP_HOST: "null" + extraEnvVars.MOSIP_API_INTERNAL_HOST: "null" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetsunbird" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.key: "redis-port" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.name: "redis" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.key: "redis-password" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.key: "database-host" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.key: "database-port" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.key: "database-name" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" + # Chart-default extraEnvVars.KEYMANAGER_PKCS11_PIN points at a plain "esignet-softhsm" + # secret that doesn't exist in this namespace (only esignet-softhsm-sunbird does) - + # override directly under extraEnvVars (not extraEnvVarsAdditional) so the chart's + # own defaults for these same keys don't also coexist redundantly in the rendered env. + extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" + extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" + extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" + extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" + extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "null" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" + extraEnvVars.MOSIP_ESIGNET_AUTHN_PROVIDER: "sunbird" + extraEnvVars.NAMESPACE: "sunbird" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_PROVIDER: "google-recaptcha" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_VALIDATOR_URL: "http://captcha.captcha/v1/captcha/validatecaptcha" + extraEnvVarsAdditional.hsm_client_zip_url_env: "https://raw.githubusercontent.com/mosip/artifactory-ref-impl/master/artifacts/src/hsm/client.zip" + extraEnvVars.OIDC_UI_SCHEME: "https" + extraEnvVars.OIDC_UI_PORT: "443" + extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" + extraEnvVars.OIDC_UI_ERROR_PATH: "/error" + extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" + extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" + extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha-sunbird" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" + extraEnvVarsAdditional.MOSIP_ESIGNET_INTEGRATION_AUDIT_PLUGIN: "LoggerAuditService" + extraEnvVarsAdditional.MOSIP_ESIGNET_INTEGRATION_KEY_BINDER: "NoOpKeyBinder" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: "300" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATOR_DEFAULT_AUTH_FACTOR_KBI_INDIVIDUAL_ID_FIELD: "policyNumber" timeout: 600 priority: -14 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh" # --------------------------------------------------------------------------- - # OIDC UI v1.7.1 + # OIDC UI # --------------------------------------------------------------------------- - oidc-ui-go: - namespace: esignet-go-mock + oidc-ui: + namespace: esignet-mock enabled: true - version: 0.0.1-develop + version: 2.0.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" image.tag: "develop-go" - istio.hosts[0]: "esignet-go.${domain_name}" - oidc_ui.oidc_service_host: "esignet-go-mock.esignet-go-mock" - oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-go-mock.esignet-go-mock/v1/esignet" - oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-go-mock.esignet-go-mock" + istio.hosts[0]: "esignet.${domain_name}" + oidc_ui.oidc_service_host: "esignet-mock.esignet-mock" + oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mock.esignet-mock/v1/esignet" + oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mock.esignet-mock" + timeout: 1200 priority: -13 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh" - oidc-ui-go-mosipid1: - namespace: esignet-go-mosipid1 + oidc-ui-mosipid: + namespace: esignet-mosipid enabled: true - version: 0.1.0-develop - chart: mosip/oidc-ui - set: - image.repository: "mosipqa/oidc-ui" - image.tag: "develop-go" - istio.hosts[0]: "esignet-go-mosipid1.${domain_name}" - oidc_ui.oidc_service_host: "esignet-go-mosipid1.esignet-go-mosipid1" - oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-go-mosipid1.esignet-go-mosipid1/v1/esignet" - oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-go-mosipid1.esignet-go-mosipid1" - timeout: 1200 - priority: -13 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh" - - oidc-ui-go-mosipid2: - namespace: esignet-go-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop + version: 2.0.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" image.tag: "develop-go" - istio.hosts[0]: "esignet-go-mosipid2.${domain_name}" - oidc_ui.oidc_service_host: "esignet-go-mosipid2.esignet-go-mosipid2" - oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-go-mosipid2.esignet-go-mosipid2/v1/esignet" - oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-go-mosipid2.esignet-go-mosipid2" + istio.hosts[0]: "esignet-mosipid.${domain_name}" + oidc_ui.oidc_service_host: "esignet-mosipid.esignet-mosipid" + oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mosipid.esignet-mosipid/v1/esignet" + oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mosipid.esignet-mosipid" timeout: 1200 priority: -13 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid-preinstall.sh" - oidc-ui-go-sunbird: - namespace: esignet-go-sunbird + oidc-ui-sunbird: + namespace: esignet-sunbird enabled: true - version: 0.0.1-develop + version: 2.0.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" image.tag: "develop-go" - istio.hosts[0]: "esignet-go-sunbird.${domain_name}" - oidc_ui.oidc_service_host: "esignet-go-sunbird.esignet-go-sunbird" - oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-go-sunbird.esignet-go-sunbird/v1/esignet" - oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-go-sunbird.esignet-go-sunbird" + istio.hosts[0]: "esignet-sunbird.${domain_name}" + oidc_ui.oidc_service_host: "esignet-sunbird.esignet-sunbird" + oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-sunbird.esignet-sunbird/v1/esignet" + oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-sunbird.esignet-sunbird" timeout: 1200 priority: -13 hooks: @@ -330,8 +457,8 @@ apps: # Mock Identity System (Optional) # --------------------------------------------------------------------------- # Enable for testing with mock identity data. - softhsm-mock-identity-system-go: - namespace: softhsm-go + softhsm-mock-identity-system: + namespace: softhsm enabled: true version: 12.0.1 chart: mosip/softhsm @@ -345,19 +472,18 @@ apps: preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh" postUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh" - mock-identity-system-go: - namespace: esignet-go-mock + mock-identity-system: + namespace: esignet-mock enabled: true version: 0.0.1-develop chart: mosip/mock-identity-system - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml" set: image.repository: "mosipqa/mock-identity-system" image.tag: "develop" enable_insecure: "false" - extraEnvVarsCM[0]: "softhsm-mock-identity-system-go-share" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-go.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-go.${domain_name}" + extraEnvVarsCM[0]: "softhsm-mock-identity-system-share" + domainConfig.MOSIP_ESIGNET_HOST: "esignet.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "signup.${domain_name}" domainConfig.MOSIP_API_HOST: "api.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" @@ -367,6 +493,32 @@ apps: domainConfig.installation-domain: "${domain_name}" domainConfig.MOSIP_MOCK_IDA_IDENTITY_SCHEMA_URL: "https://raw.githubusercontent.com/prathmeshj12/addidentityschema_testing/refs/heads/main/email-signup-schema-testing.json" domainConfig.MOSIP_MOCK_UI_SPEC_SCHEMA_URL: "https://raw.githubusercontent.com/prathmeshj12/addidentityschema_testing/refs/heads/main/ui_spec_reset_password_phone.json" + # Chart-default extraEnvVars.MOSIP_ESIGNET_HOST is a table (valueFrom.configMapKeyRef + # against esignet-global), which doesn't exist in the esignet-mock namespace - left + # unset it would both crash with CreateContainerConfigError and duplicate the + # domainConfig.MOSIP_ESIGNET_HOST entry above in the rendered env: list. Null it out + # so domainConfig is the sole source, same pattern as the esignet chart apps. + extraEnvVars.MOSIP_ESIGNET_HOST: "null" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.name: "mockid-postgres-config" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.key: "database-host" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.name: "mockid-postgres-config" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.key: "database-port" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.name: "mockid-postgres-config" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.key: "database-name" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.name: "mockid-postgres-config" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" + extraEnvVars.SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN.valueFrom.secretKeyRef.name: "softhsm-mock-identity-system" + extraEnvVars.SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.hsm_local_dir_name: "hsm-client" + extraEnvVars.MOSIP_ESIGNET_MOCK_SUPPORTED_FIELDS: 'individualId,password' + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.key: "redis-port" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.name: "redis" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.key: "redis-password" timeout: 480 priority: -11 hooks: @@ -375,226 +527,216 @@ apps: # --------------------------------------------------------------------------- # Mock Relying Party (Optional) # --------------------------------------------------------------------------- - mock-relying-party-service-go: - namespace: esignet-go-mock + mock-relying-party-service: + namespace: esignet-mock enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service set: image.repository: "mosipqa/mock-relying-party-service" image.tag: "develop-go" - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-mock.esignet-go-mock/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go.${domain_name}/v1/esignet/oauth/v2/token" + mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet.${domain_name}/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet.${domain_name}" + mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet.${domain_name}/v1/esignet/oauth2/par" + mock_relying_party_service.REDIRECT_URI: "https://healthservices.${domain_name}/userprofile" + mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + extraEnvVars.CLIENT_ID: "I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM" + extraEnvVars.ACRS.value: "mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet%20mosip:idp:acr:password%20mosip:idp:acr:knowledge" + extraEnvVars.DISPLAY: "page" + extraEnvVars.GRANT_TYPE: "authorization_code" + extraEnvVars.CLAIMS_LOCALES: "en" + extraEnvVars.SCOPE_USER_PROFILE: "openid profile" + extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\},"phone_number":\{"essential":true\},"email":\{"essential":true\},"picture":\{"essential":false\},"gender":\{"essential":false\},"birthdate":\{"essential":false\},"address":\{"essential":false\}\},"id_token":\{\}\}' + mock_relying_party_service.host: "" + mock_relying_party_service.mountDir: "" + mock_relying_party_service.healthCheckUrl: null + mock_relying_party_service.mock_relying_party_serviceMountDIr: "/home/mosip/oidc/" + mock_relying_party_service.puburl: null + mock_relying_party_service.privurl: null + mock_relying_party_service.USERINFO_RESPONSE_TYPE: "jwt" timeout: 480 priority: -10 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh" - mock-relying-party-service-go-mosipid1: - namespace: esignet-go-mosipid1 + mock-relying-party-service-mosipid: + namespace: esignet-mosipid enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service set: image.repository: "mosipqa/mock-relying-party-service" - image.tag: "develop-go" - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-mosipid1.esignet-go-mosipid1/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid1.${domain_name}/v1/esignet/oauth/v2/token" - enable_insecure: "false" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" - timeout: 480 - priority: -10 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh" - - mock-relying-party-service-go-mosipid2: - namespace: esignet-go-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/mock-relying-party-service - set: - image.repository: "mosipqa/mock-relying-party-service" - image.tag: "develop-go" - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-mosipid2.esignet-go-mosipid2/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid2.${domain_name}/v1/esignet/oauth/v2/token" + image.tag: "develop-go" + mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-mosipid.${domain_name}/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-mosipid.${domain_name}" + mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-mosipid.${domain_name}/v1/esignet/oauth2/par" + mock_relying_party_service.REDIRECT_URI: "https://healthservices-mosipid.${domain_name}/userprofile" + mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-mosipid.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + extraEnvVars.CLIENT_ID: "I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM" + extraEnvVars.ACRS.value: "mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet%20mosip:idp:acr:password%20mosip:idp:acr:knowledge" + extraEnvVars.DISPLAY: "page" + extraEnvVars.GRANT_TYPE: "authorization_code" + extraEnvVars.CLAIMS_LOCALES: "en" + extraEnvVars.SCOPE_USER_PROFILE: "openid profile" + extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\},"phone_number":\{"essential":true\},"email":\{"essential":true\},"picture":\{"essential":false\},"gender":\{"essential":false\},"birthdate":\{"essential":false\},"address":\{"essential":false\}\},"id_token":\{\}\}' + mock_relying_party_service.host: "" + mock_relying_party_service.mountDir: "" + mock_relying_party_service.healthCheckUrl: null + mock_relying_party_service.mock_relying_party_serviceMountDIr: "/home/mosip/oidc/" + mock_relying_party_service.puburl: null + mock_relying_party_service.privurl: null + mock_relying_party_service.USERINFO_RESPONSE_TYPE: "jwt" timeout: 480 priority: -10 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid-preinstall.sh" - mock-relying-party-service-go-sunbird: - namespace: esignet-go-sunbird + mock-relying-party-service-sunbird: + namespace: esignet-sunbird enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service set: image.repository: "mosipqa/mock-relying-party-service" image.tag: "develop-go" - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-sunbird.esignet-go-sunbird/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-sunbird.${domain_name}/v1/esignet/oauth/v2/token" + mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-sunbird.${domain_name}/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-sunbird.${domain_name}" + mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-sunbird.${domain_name}/v1/esignet/oauth2/par" + mock_relying_party_service.REDIRECT_URI: "https://healthservices-sunbird.${domain_name}/userprofile" + mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-sunbird.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + extraEnvVars.CLIENT_ID: "I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM" + extraEnvVars.ACRS.value: "mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet%20mosip:idp:acr:password%20mosip:idp:acr:knowledge" + extraEnvVars.DISPLAY: "page" + extraEnvVars.GRANT_TYPE: "authorization_code" + extraEnvVars.CLAIMS_LOCALES: "en" + extraEnvVars.SCOPE_USER_PROFILE: "openid profile" + extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\},"phone_number":\{"essential":true\},"email":\{"essential":true\},"picture":\{"essential":false\},"gender":\{"essential":false\},"birthdate":\{"essential":false\},"address":\{"essential":false\}\},"id_token":\{\}\}' + mock_relying_party_service.host: "" + mock_relying_party_service.mountDir: "" + mock_relying_party_service.healthCheckUrl: null + mock_relying_party_service.mock_relying_party_serviceMountDIr: "/home/mosip/oidc/" + mock_relying_party_service.puburl: null + mock_relying_party_service.privurl: null + mock_relying_party_service.USERINFO_RESPONSE_TYPE: "jwt" timeout: 480 priority: -10 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh" - mock-relying-party-ui-go: - namespace: esignet-go-mock + mock-relying-party-ui: + namespace: esignet-mock enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-ui set: image.repository: "mosipqa/mock-relying-party-ui" image.tag: "develop-go" - mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-go.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-go.esignet-go-mock" - mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-go.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-go.${domain_name}/mock-relying-party-service" - mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go.${domain_name}/userprofile" - mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go.${domain_name}/registration" - mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go.${domain_name}/plugins/sign-in-button-plugin.js" - istio.hosts[0]: "healthservices-go.${domain_name}" + mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service.esignet-mock" + mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices.${domain_name}/mock-relying-party-service" + mock_relying_party_ui.REDIRECT_URI: "https://healthservices.${domain_name}/userprofile" + mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices.${domain_name}/registration" + mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge + istio.hosts[0]: "healthservices.${domain_name}" wait: true timeout: 480 priority: -9 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh" - mock-relying-party-ui-go-mosipid1: - namespace: esignet-go-mosipid1 + mock-relying-party-ui-mosipid: + namespace: esignet-mosipid enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-ui set: image.repository: "mosipqa/mock-relying-party-ui" image.tag: "develop-go" - mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-go-mosipid1.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-go-mosipid1.esignet-go-mosipid1" - mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-go-mosipid1.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-go-mosipid1.${domain_name}/mock-relying-party-service" - mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go-mosipid1.${domain_name}/userprofile" - mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go-mosipid1.${domain_name}/registration" - mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go-mosipid1.${domain_name}/plugins/sign-in-button-plugin.js" - istio.hosts[0]: "healthservices-go-mosipid1.${domain_name}" - wait: true - timeout: 480 - priority: -9 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh" - - mock-relying-party-ui-go-mosipid2: - namespace: esignet-go-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/mock-relying-party-ui - set: - image.repository: "mosipqa/mock-relying-party-ui" - image.tag: "develop-go" - mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-go-mosipid2.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-go-mosipid2.esignet-go-mosipid2" - mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-go-mosipid2.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-go-mosipid2.${domain_name}/mock-relying-party-service" - mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go-mosipid2.${domain_name}/userprofile" - mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go-mosipid2.${domain_name}/registration" - mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go-mosipid2.${domain_name}/plugins/sign-in-button-plugin.js" - istio.hosts[0]: "healthservices-go-mosipid2.${domain_name}" + mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-mosipid.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-mosipid.esignet-mosipid" + mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-mosipid.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-mosipid.${domain_name}/mock-relying-party-service" + mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid.${domain_name}/userprofile" + mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid.${domain_name}/registration" + mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge + istio.hosts[0]: "healthservices-mosipid.${domain_name}" wait: true timeout: 480 priority: -9 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid-preinstall.sh" - mock-relying-party-ui-go-sunbird: - namespace: esignet-go-sunbird + mock-relying-party-ui-sunbird: + namespace: esignet-sunbird enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-ui set: image.repository: "mosipqa/mock-relying-party-ui" image.tag: "develop-go" - mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-go-sunbird.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-go-sunbird.esignet-go-sunbird" - mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-go-sunbird.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-go-sunbird.${domain_name}/mock-relying-party-service" - mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go-sunbird.${domain_name}/userprofile" - mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go-sunbird.${domain_name}/registration" - mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go-sunbird.${domain_name}/plugins/sign-in-button-plugin.js" - istio.hosts[0]: "healthservices-go-sunbird.${domain_name}" + mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-sunbird.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-sunbird.esignet-sunbird" + mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-sunbird.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-sunbird.${domain_name}/mock-relying-party-service" + mock_relying_party_ui.REDIRECT_URI: "https://healthservices-sunbird.${domain_name}/userprofile" + mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-sunbird.${domain_name}/registration" + mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-sunbird.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge + istio.hosts[0]: "healthservices-sunbird.${domain_name}" wait: true timeout: 480 priority: -9 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh" - pms-partner-go-mosipid1: - namespace: esignet-go-mosipid1 - enabled: false - version: 12.2.3 - chart: mosip/pms-partner - set: - # image.repository: "mosipid/partner-management-service" - # image.tag: "1.2.2.3" - istio.gateways[0]: "pms-partner-mosipid1-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-go-mosipid1.${domain_name}" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-go-share" - priority: -9 - timeout: 1200 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/pms-partner-mosipid1-preinstall.sh" - - pms-policy-go-mosipid1: - namespace: esignet-go-mosipid1 - enabled: false - version: 12.2.3 - chart: mosip/pms-policy - set: - # image.repository: "mosipid/policy-management-service" - # image.tag: "1.2.2.2" - istio.gateways[0]: "pms-partner-mosipid1-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-go-mosipid1.${domain_name}" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-go-share" - priority: -9 - timeout: 1200 - - pms-partner-go-mosipid2: - namespace: esignet-go-mosipid2 - enabled: false - version: 12.2.3 - chart: mosip/pms-partner - set: - # image.repository: "mosipid/partner-management-service" - # image.tag: "1.2.2.3" - istio.gateways[0]: "pms-partner-mosipid2-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-go-mosipid2.${domain_name}" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-go-share" - priority: -9 - timeout: 1200 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/pms-partner-mosipid2-preinstall.sh" - - pms-policy-go-mosipid2: - namespace: esignet-go-mosipid2 - enabled: false - version: 12.2.3 - chart: mosip/pms-policy - set: - # image.repository: "mosipid/policy-management-service" - # image.tag: "1.2.2.2" - istio.gateways[0]: "pms-partner-mosipid2-gateway" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-go-share" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-go-mosipid2.${domain_name}" - priority: -9 - timeout: 1200 - # --------------------------------------------------------------------------- # Partner Onboarders # --------------------------------------------------------------------------- @@ -606,8 +748,8 @@ apps: # Onboards the eSignet MISP client — only needed with mosip-identity-plugin (plugin 2). # Runs FIRST so the MISP license key is written before mock-rp-onboarder starts. # After completion, restarts the esignet deployment to pick up the new MISP license key. - esignet-misp-onboarder-go: - namespace: esignet-go-mock + esignet-misp-onboarder: + namespace: esignet-mock enabled: false version: 0.0.1-develop chart: mosip/partner-onboarder @@ -619,7 +761,7 @@ apps: onboarding.configmaps.s3.s3-region: "" onboarding.configmaps.s3.s3-bucket-name: "onboarder" onboarding.secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" - onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-go-mock" + onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-mock" onboarding.variables.push_reports_to_s3: "true" onboarding.variables.mosipid: "false" extraEnvVarsCM[0]: "keycloak-env-vars" @@ -628,7 +770,7 @@ apps: extraEnvVarsSecret[1]: "keycloak-client-secrets" domainConfig.mosip-api-internal-host: "api-internal.${domain_name}" domainConfig.mosip-api-host: "api.${domain_name}" - domainConfig.mosip-esignet-host: "esignet-go.${domain_name}" + domainConfig.mosip-esignet-host: "esignet.${domain_name}" domainConfig.mosip-esignet-insurance-host: "esignet-insurance.${domain_name}" domainConfig.mosip-resident-host: "resident.${domain_name}" domainConfig.installation-domain: "${domain_name}" @@ -645,8 +787,8 @@ apps: # Mock RP OIDC Partner Onboarder # Onboards the mock relying party as an OIDC client. # Enable for plugin 1 (mock) or plugin 3 (sunbird-rc). Set mosipid: "true" for mosip-identity-plugin. - esignet-mock-rp-onboarder-go: - namespace: esignet-go-mock + esignet-mock-rp-onboarder: + namespace: esignet-mock enabled: true version: 0.0.1-develop chart: mosip/partner-onboarder @@ -660,14 +802,14 @@ apps: onboarding.configmaps.s3.s3-region: "" onboarding.secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" onboarding.configmaps.s3.s3-bucket-name: "onboarder" - onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-go-mock" + onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-mock" onboarding.variables.mosipid: "false" onboarding.variables.push_reports_to_s3: "true" extraEnvVarsCM[0]: "keycloak-env-vars" extraEnvVarsCM[1]: "keycloak-host" domainConfig.mosip-api-internal-host: "api-internal.${domain_name}" domainConfig.mosip-api-host: "api.${domain_name}" - domainConfig.mosip-esignet-host: "esignet-go.${domain_name}" + domainConfig.mosip-esignet-host: "esignet.${domain_name}" domainConfig.mosip-esignet-insurance-host: "esignet-insurance.${domain_name}" domainConfig.mosip-resident-host: "resident.${domain_name}" domainConfig.installation-domain: "${domain_name}" diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml index 1139c2973..dc2f0a5e4 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml @@ -35,11 +35,11 @@ helmRepos: mosip: https://mosip.github.io/mosip-helm namespaces: - signup-go: + signup: protected: false - kernel-go: + kernel: protected: false - mock-smtp-go: + mock-smtp: protected: false apps: @@ -48,8 +48,8 @@ apps: # --------------------------------------------------------------------------- # Creates mosip-signup-client with required roles in Keycloak. # Propagates mosip_signup_client_secret between keycloak and signup namespaces. - signup-keycloak-init-go: - namespace: signup-go + signup-keycloak-init: + namespace: signup enabled: false version: 12.0.2 chart: mosip/keycloak-init @@ -73,8 +73,8 @@ apps: # Required for audit logging (auditmanager), OTP generation (otpmanager), # auth token validation (authmanager), and email/SMS dispatch (notifier). # kernel-preinstall.sh creates kernel namespace and domain-config configmap. - authmanager-go: - namespace: kernel-go + authmanager: + namespace: kernel enabled: false version: 12.0.1 chart: mosip/authmanager @@ -87,8 +87,8 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" - auditmanager-go: - namespace: kernel-go + auditmanager: + namespace: kernel enabled: false version: 12.0.1 chart: mosip/auditmanager @@ -101,8 +101,8 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" - otpmanager-go: - namespace: kernel-go + otpmanager: + namespace: kernel enabled: false version: 12.0.1 chart: mosip/otpmanager @@ -113,8 +113,8 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" - notifier-go: - namespace: kernel-go + notifier: + namespace: kernel enabled: false version: 12.0.1 chart: mosip/notifier @@ -128,8 +128,8 @@ apps: # --------------------------------------------------------------------------- # Mock SMTP (Optional — dev/test email and SMS) # --------------------------------------------------------------------------- - mock-smtp-go: - namespace: mock-smtp-go + mock-smtp: + namespace: mock-smtp enabled: false version: 1.0.0 chart: mosip/mock-smtp @@ -145,8 +145,8 @@ apps: # signup-service-preinstall.sh copies redis secrets, creates keycloak-host # configmap, signup-captcha and signup-keystore secrets, and msg-gateway # configmap/secret pointing to mock-smtp. - signup-go: - namespace: signup-go + signup: + namespace: signup enabled: false version: 1.2.2 chart: mosip/signup @@ -155,8 +155,8 @@ apps: image.tag: "1.2.2" enable_insecure: "false" plugin_name_env: "esignet-mock-plugin.jar" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-go.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-go.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "esignet.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "signup.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" wait: true timeout: 600 @@ -168,18 +168,18 @@ apps: # --------------------------------------------------------------------------- # Signup UI # --------------------------------------------------------------------------- - signup-ui-go: - namespace: signup-go + signup-ui: + namespace: signup enabled: false version: 1.2.2 chart: mosip/signup-ui set: image.repository: "mosipid/signup-ui" image.tag: "1.2.2" - istio.hosts[0]: "signup-go.${domain_name}" - signup_ui.signup_service_host: "signup-go.signup-go" - signup_ui.configmaps.signup-ui.REACT_APP_API_BASE_URL: "http://signup-go.signup-go/v1/signup" - signup_ui.configmaps.signup-ui.REACT_APP_SBI_DOMAIN_URI: "http://signup-go.signup-go" + istio.hosts[0]: "signup.${domain_name}" + signup_ui.signup_service_host: "signup.signup" + signup_ui.configmaps.signup-ui.REACT_APP_API_BASE_URL: "http://signup.signup/v1/signup" + signup_ui.configmaps.signup-ui.REACT_APP_SBI_DOMAIN_URI: "http://signup.signup" wait: true timeout: 600 priority: -3 diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml index f243acad9..a23036792 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml @@ -8,32 +8,29 @@ helmRepos: mosip: https://mosip.github.io/mosip-helm # Apitestrigs deploy into service namespaces (no dedicated testrig namespaces): -# esignet-apitestrig → esignet ns -# esignet-mosipid1-apitestrig → esignet-mosipid1 ns -# esignet-mosipid2-apitestrig → esignet-mosipid2 ns -# esignet-sunbird-apitestrig → esignet-sunbird ns -# esignet-signup-apitestrig → signup ns (disabled — enable if signup deployed) -# signup-uitestrig → signup-uitestrig (disabled — enable if signup deployed) +# esignet-apitestrig → esignet-mock ns +# esignet-mosipid-apitestrig → esignet-mosipid ns +# esignet-sunbird-apitestrig → esignet-sunbird ns +# esignet-signup-apitestrig → signup ns (disabled — enable if signup deployed) +# signup-uitestrig → signup-uitestrig (disabled — enable if signup deployed) namespaces: - esignet-go-mosipid1: + esignet-mock: protected: false - esignet-go-mock: + esignet-mosipid: protected: false - esignet-go-mosipid2: + esignet-sunbird: protected: false - esignet-go-sunbird: + signup: protected: false - signup-go: - protected: false - signup-uitestrig-go: + signup-uitestrig: protected: false apps: # --------------------------------------------------------------------------- # eSignet API Testrig — main esignet namespace # --------------------------------------------------------------------------- - esignet-apitestrig-go: - namespace: esignet-go-mock + esignet-apitestrig: + namespace: esignet-mock enabled: true version: 0.0.1-develop chart: mosip/apitestrig @@ -61,12 +58,12 @@ apps: apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-go-mock" + apitestrig.configmaps.apitestrig.NS: "esignet-mock" apitestrig.configmaps.apitestrig.servicesNotDeployed: '' apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-go.${domain_name}" + apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet.${domain_name}" apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" @@ -75,10 +72,10 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh" # --------------------------------------------------------------------------- - # eSignet API Testrig — esignet-mosipid1 namespace (mosip-identity-plugin) + # eSignet API Testrig — esignet-mosipid namespace (mosip-identity-plugin) # --------------------------------------------------------------------------- - esignet-go-mosipid1-apitestrig: - namespace: esignet-go-mosipid1 + esignet-mosipid-apitestrig: + namespace: esignet-mosipid enabled: true version: 0.0.1-develop chart: mosip/apitestrig @@ -89,61 +86,15 @@ apps: extraEnvVarsCM[2]: "keycloak-host" extraEnvVarsCM[3]: "db" extraEnvVarsCM[4]: "apitestrig" - extraEnvVarsSecret[0]: "apitestrig-esignet-mosipid1-apitestrig" - extraEnvVarsSecret[1]: "s3-esignet-mosipid1-apitestrig" - extraEnvVarsSecret[2]: "keycloak-client-secrets" - extraEnvVarsSecret[3]: "postgres-postgresql" - crontime: "0 2 * * *" - apitestrig.configmaps.s3.s3-host: 'http://minio.minio:9000' - apitestrig.configmaps.s3.s3-user-key: 'admin' - apitestrig.configmaps.s3.s3-region: '' - apitestrig.configmaps.db.db-server: "api-internal.${mosipid1_domain_name}" - apitestrig.configmaps.db.db-su-user: "postgres" - apitestrig.configmaps.db.db-port: "${esignet_db_port}" - apitestrig.configmaps.apitestrig.ENV_USER: "api-internal.${env_name}" - apitestrig.configmaps.apitestrig.ENV_ENDPOINT: "https://api-internal.${domain_name}" - apitestrig.configmaps.apitestrig.ENV_TESTLEVEL: "smokeAndRegression" - apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" - apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" - apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-go-mosipid1" - apitestrig.configmaps.apitestrig.servicesNotDeployed: 'sunbirdrc' - apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" - apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" - apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-go-mosipid1.${domain_name}" - apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid1_domain_name};idrepository=api-internal.${mosipid1_domain_name};authmanager=api-internal.${mosipid1_domain_name};resident=api-internal.${mosipid1_domain_name};partnermanager=pms-go-mosipid1.${mosipid1_domain_name};idauthentication=api-internal.${mosipid1_domain_name};masterdata=api-internal.${mosipid1_domain_name};idgenerator=api-internal.${mosipid1_domain_name};policymanager=pms-go-mosipid1.${mosipid1_domain_name};preregistration=api-internal.${mosipid1_domain_name};keymanager=api-internal.${mosipid1_domain_name};" - secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" - apitestrig.variables.push_reports_to_s3: "yes" - priority: -4 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh" - - # --------------------------------------------------------------------------- - # eSignet API Testrig — esignet-mosipid2 namespace (mosip-identity-plugin) - # --------------------------------------------------------------------------- - esignet-go-mosipid2-apitestrig: - namespace: esignet-go-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/apitestrig - valuesFile: "$WORKDIR/utils/esignet-apitestrig-values.yaml" - set: - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "s3" - extraEnvVarsCM[2]: "keycloak-host" - extraEnvVarsCM[3]: "db" - extraEnvVarsCM[4]: "apitestrig" - extraEnvVarsSecret[0]: "apitestrig-esignet-mosipid2-apitestrig" - extraEnvVarsSecret[1]: "s3-esignet-mosipid2-apitestrig" + extraEnvVarsSecret[0]: "apitestrig-esignet-mosipid-apitestrig" + extraEnvVarsSecret[1]: "s3-esignet-mosipid-apitestrig" extraEnvVarsSecret[2]: "keycloak-client-secrets" extraEnvVarsSecret[3]: "postgres-postgresql" crontime: "0 2 * * *" apitestrig.configmaps.s3.s3-host: 'http://minio.minio:9000' apitestrig.configmaps.s3.s3-user-key: 'admin' apitestrig.configmaps.s3.s3-region: '' - apitestrig.configmaps.db.db-server: "api-internal.${mosipid2_domain_name}" + apitestrig.configmaps.db.db-server: "api-internal.${mosipid_domain_name}" apitestrig.configmaps.db.db-su-user: "postgres" apitestrig.configmaps.db.db-port: "${esignet_db_port}" apitestrig.configmaps.apitestrig.ENV_USER: "api-internal.${env_name}" @@ -152,26 +103,26 @@ apps: apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-go-mosipid2" + apitestrig.configmaps.apitestrig.NS: "esignet-mosipid" apitestrig.configmaps.apitestrig.servicesNotDeployed: 'sunbirdrc' apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-go-mosipid2.${domain_name}" + apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-mosipid.${domain_name}" apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid2_domain_name};idrepository=api-internal.${mosipid2_domain_name};authmanager=api-internal.${mosipid2_domain_name};resident=api-internal.${mosipid2_domain_name};partnermanager=pms-go-mosipid2.${mosipid2_domain_name};idauthentication=api-internal.${mosipid2_domain_name};masterdata=api-internal.${mosipid2_domain_name};idgenerator=api-internal.${mosipid2_domain_name};policymanager=pms-go-mosipid2.${mosipid2_domain_name};preregistration=api-internal.${mosipid2_domain_name};keymanager=api-internal.${mosipid2_domain_name};" + apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid_domain_name};idrepository=api-internal.${mosipid_domain_name};authmanager=api-internal.${mosipid_domain_name};resident=api-internal.${mosipid_domain_name};idauthentication=api-internal.${mosipid_domain_name};masterdata=api-internal.${mosipid_domain_name};idgenerator=api-internal.${mosipid_domain_name};preregistration=api-internal.${mosipid_domain_name};keymanager=api-internal.${mosipid_domain_name};" secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" priority: -3 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid-setup.sh" # --------------------------------------------------------------------------- # eSignet API Testrig — esignet-sunbird namespace (sunbird-rc-plugin) # postInstall triggers all four testrig namespaces after last one deploys. # --------------------------------------------------------------------------- - esignet-go-sunbird-apitestrig: - namespace: esignet-go-sunbird + esignet-sunbird-apitestrig: + namespace: esignet-sunbird enabled: true version: 0.0.1-develop chart: mosip/apitestrig @@ -199,27 +150,27 @@ apps: apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-go-sunbird" + apitestrig.configmaps.apitestrig.NS: "esignet-sunbird" apitestrig.configmaps.apitestrig.servicesNotDeployed: '' apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-go-sunbird.${domain_name}" + apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-sunbird.${domain_name}" apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.sunBirdBaseURL: "https://registry.${mosipid1_domain_name}" + apitestrig.configmaps.apitestrig.sunBirdBaseURL: "https://registry.${mosipid_domain_name}" secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" priority: -2 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh" - # postInstall: "$WORKDIR/hooks/esignet-standalone/trigger-test-jobs-esignet.sh" + # postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh" # --------------------------------------------------------------------------- # Signup API Test Rig — disabled by default # Enable only if signup stack (signup-dsf) is deployed. # --------------------------------------------------------------------------- - esignet-signup-apitestrig-go: - namespace: signup-go + esignet-signup-apitestrig: + namespace: signup enabled: false version: 0.0.1-develop chart: mosip/apitestrig @@ -238,7 +189,7 @@ apps: apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "signup-go" + apitestrig.configmaps.apitestrig.NS: "signup" apitestrig.configmaps.apitestrig.servicesNotDeployed: '' secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" @@ -250,8 +201,8 @@ apps: # Signup UI Test Rig — disabled by default # Enable only if signup stack (signup-dsf) is deployed. # --------------------------------------------------------------------------- - signup-uitestrig-go: - namespace: signup-uitestrig-go + signup-uitestrig: + namespace: signup-uitestrig enabled: false version: 0.0.1-develop chart: mosip/uitestrig @@ -269,7 +220,7 @@ apps: uitestrig.configmaps.uitestrig.reportExpirationInDays: "3" uitestrig.configmaps.uitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" uitestrig.configmaps.uitestrig.eSignetDeployed: "yes" - uitestrig.configmaps.uitestrig.NS: "signup-uitestrig-go" + uitestrig.configmaps.uitestrig.NS: "signup-uitestrig" uitestrig.variables.push_reports_to_s3: "yes" priority: -1 hooks: diff --git a/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml index bdeb831ef..8a5660497 100644 --- a/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml @@ -32,9 +32,7 @@ namespaces: protected: false softhsm: protected: false - esignet-mosipid1: - protected: false - esignet-mosipid2: + esignet-mosipid: protected: false esignet-sunbird: protected: false @@ -56,27 +54,16 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/softhsm-esignet-setup.sh" - esignet-softhsm-mosipid1: - namespace: esignet-mosipid1 + esignet-softhsm-mosipid: + namespace: esignet-mosipid enabled: true version: 12.0.1 chart: mosip/softhsm - valuesFile: "$WORKDIR/utils/softhsm-esignet-mosipid1-values.yaml" + valuesFile: "$WORKDIR/utils/softhsm-esignet-mosipid-values.yaml" timeout: 480 priority: -16 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/softhsm-esignet-mosipid1-setup.sh" - - esignet-softhsm-mosipid2: - namespace: esignet-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 12.0.1 - chart: mosip/softhsm - valuesFile: "$WORKDIR/utils/softhsm-esignet-mosipid2-values.yaml" - timeout: 480 - priority: -16 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/softhsm-esignet-mosipid2-setup.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/softhsm-esignet-mosipid-setup.sh" esignet-softhsm-sunbird: namespace: esignet-sunbird @@ -89,19 +76,6 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/softhsm-esignet-sunbird-setup.sh" - esignet-config-server: - namespace: esignet-mock - enabled: false - version: 12.0.1 - chart: mosip/config-server - valuesFile: "$WORKDIR/utils/config-server-esignet-values.yaml" - wait: true - timeout: 1200 - priority: -15 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/config-server-esignet-setup.sh" - postInstall: "$WORKDIR/hooks/esignet-standalone/config-server-esignet-postinstall.sh" - # --------------------------------------------------------------------------- # eSignet v1.7.1 # --------------------------------------------------------------------------- @@ -136,12 +110,12 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/esignet-preinstall.sh" - esignet-mosipid1: - namespace: esignet-mosipid1 + esignet-mosipid: + namespace: esignet-mosipid enabled: true version: 0.1.0-develop chart: mosip/esignet - valuesFile: "$WORKDIR/utils/esignet-mosipid1-plugin-values.yaml" + valuesFile: "$WORKDIR/utils/esignet-mosipid-plugin-values.yaml" set: image.repository: "mosipqa/esignet-with-plugins" image.tag: "develop" @@ -150,71 +124,31 @@ apps: activeProfileEnv: "" pluginNameEnv: "mosip-identity-plugin.jar" pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-mosipid1-share" + extraEnvVarsCM[0]: "esignet-softhsm-mosipid-share" extraEnvVarsCM[1]: "esignet-global" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-mosipid1.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-mosipid1.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "esignet-mosipid.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "signup-mosipid.${domain_name}" domainConfig.MOSIP_API_HOST: "api.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid1_domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid_domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" - domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid1_domain_name}" - domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid1_domain_name}" - domainConfig.IDA_INTERNAL_URL: "https://api-internal.${mosipid1_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL: "https://api-internal.${mosipid1_domain_name}/mosip-certs/ida-partner.cer" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid1_domain_name}/v1/authmanager/authenticate/clientidsecretkey" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid1_domain_name}/v1/auditmanager/audits" - domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid1_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-mosipid1.${domain_name}" - domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-mosipid1.${domain_name}" + domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid_domain_name}" + domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid_domain_name}" + domainConfig.IDA_INTERNAL_URL: "https://api-internal.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL: "https://api-internal.${mosipid_domain_name}/mosip-certs/ida-partner.cer" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid_domain_name}/v1/authmanager/authenticate/clientidsecretkey" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid_domain_name}/v1/auditmanager/audits" + domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-mosipid.${domain_name}" + domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-mosipid.${domain_name}" timeout: 600 priority: -14 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/esignet-mosipid1-preinstall.sh" - - esignet-mosipid2: - namespace: esignet-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/esignet - valuesFile: "$WORKDIR/utils/esignet-mosipid2-plugin-values.yaml" - set: - image.repository: "mosipqa/esignet-with-plugins" - image.tag: "develop" - enable_insecure: "false" - springConfigNameEnv: "" - activeProfileEnv: "" - pluginNameEnv: "mosip-identity-plugin.jar" - pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-mosipid2-share" - extraEnvVarsCM[1]: "esignet-global" - metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-mosipid2.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-mosipid2.${domain_name}" - domainConfig.MOSIP_API_HOST: "api.${domain_name}" - domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid2_domain_name}" - domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" - domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" - domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" - domainConfig.installation-domain: "${domain_name}" - domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid2_domain_name}" - domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid2_domain_name}" - domainConfig.IDA_INTERNAL_URL: "https://api-internal.${mosipid2_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL: "https://api-internal.${mosipid2_domain_name}/mosip-certs/ida-partner.cer" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid2_domain_name}/v1/authmanager/authenticate/clientidsecretkey" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid2_domain_name}/v1/auditmanager/audits" - domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid2_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-mosipid2.${domain_name}" - domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-mosipid2.${domain_name}" - timeout: 600 - priority: -14 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/esignet-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/esignet-mosipid-preinstall.sh" esignet-sunbird: namespace: esignet-sunbird @@ -242,9 +176,9 @@ apps: domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" - domainConfig.MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid1_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL: "https://registry.${mosipid1_domain_name}/api/v1/Insurance/search" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid1_domain_name}/api/v1/Insurance/" + domainConfig.MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL: "https://registry.${mosipid_domain_name}/api/v1/Insurance/search" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid_domain_name}/api/v1/Insurance/" timeout: 600 priority: -14 hooks: @@ -270,39 +204,22 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/oidc-ui-preinstall.sh" - oidc-ui-mosipid1: - namespace: esignet-mosipid1 + oidc-ui-mosipid: + namespace: esignet-mosipid enabled: true version: 0.1.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" image.tag: "develop" - istio.hosts[0]: "esignet-mosipid1.${domain_name}" - oidc_ui.oidc_service_host: "esignet-mosipid1.esignet-mosipid1" - oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mosipid1.esignet-mosipid1/v1/esignet" - oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mosipid1.esignet-mosipid1" - timeout: 1200 - priority: -13 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/oidc-ui-mosipid1-preinstall.sh" - - oidc-ui-mosipid2: - namespace: esignet-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/oidc-ui - set: - image.repository: "mosipqa/oidc-ui" - image.tag: "develop" - istio.hosts[0]: "esignet-mosipid2.${domain_name}" - oidc_ui.oidc_service_host: "esignet-mosipid2.esignet-mosipid2" - oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mosipid2.esignet-mosipid2/v1/esignet" - oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mosipid2.esignet-mosipid2" + istio.hosts[0]: "esignet-mosipid.${domain_name}" + oidc_ui.oidc_service_host: "esignet-mosipid.esignet-mosipid" + oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mosipid.esignet-mosipid/v1/esignet" + oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mosipid.esignet-mosipid" timeout: 1200 priority: -13 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/oidc-ui-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/oidc-ui-mosipid-preinstall.sh" oidc-ui-sunbird: namespace: esignet-sunbird @@ -385,35 +302,20 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-service-preinstall.sh" - mock-relying-party-service-mosipid1: - namespace: esignet-mosipid1 + mock-relying-party-service-mosipid: + namespace: esignet-mosipid enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service set: - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-mosipid1.esignet-mosipid1/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-mosipid1.${domain_name}/v1/esignet/oauth/v2/token" - enable_insecure: "false" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" - timeout: 480 - priority: -10 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-service-mosipid1-preinstall.sh" - - mock-relying-party-service-mosipid2: - namespace: esignet-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/mock-relying-party-service - set: - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-mosipid2.esignet-mosipid2/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-mosipid2.${domain_name}/v1/esignet/oauth/v2/token" + mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-mosipid.esignet-mosipid/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-mosipid.${domain_name}/v1/esignet/oauth/v2/token" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" timeout: 480 priority: -10 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-service-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-service-mosipid-preinstall.sh" mock-relying-party-service-sunbird: namespace: esignet-sunbird @@ -443,6 +345,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices.${domain_name}" wait: true timeout: 480 @@ -450,45 +366,39 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-ui-preinstall.sh" - mock-relying-party-ui-mosipid1: - namespace: esignet-mosipid1 + mock-relying-party-ui-mosipid: + namespace: esignet-mosipid enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-ui set: - mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-mosipid1.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-mosipid1.esignet-mosipid1" - mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-mosipid1.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-mosipid1.${domain_name}/mock-relying-party-service" - mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid1.${domain_name}/userprofile" - mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid1.${domain_name}/registration" - mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid1.${domain_name}/plugins/sign-in-button-plugin.js" - istio.hosts[0]: "healthservices-mosipid1.${domain_name}" + mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-mosipid.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-mosipid.esignet-mosipid" + mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-mosipid.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-mosipid.${domain_name}/mock-relying-party-service" + mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid.${domain_name}/userprofile" + mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid.${domain_name}/registration" + mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge + istio.hosts[0]: "healthservices-mosipid.${domain_name}" wait: true timeout: 480 priority: -9 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-ui-mosipid1-preinstall.sh" - - mock-relying-party-ui-mosipid2: - namespace: esignet-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/mock-relying-party-ui - set: - mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-mosipid2.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-mosipid2.esignet-mosipid2" - mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-mosipid2.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-mosipid2.${domain_name}/mock-relying-party-service" - mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid2.${domain_name}/userprofile" - mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid2.${domain_name}/registration" - mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid2.${domain_name}/plugins/sign-in-button-plugin.js" - istio.hosts[0]: "healthservices-mosipid2.${domain_name}" - wait: true - timeout: 480 - priority: -9 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-ui-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-ui-mosipid-preinstall.sh" mock-relying-party-ui-sunbird: namespace: esignet-sunbird @@ -503,6 +413,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices-sunbird.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-sunbird.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-sunbird.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices-sunbird.${domain_name}" wait: true timeout: 480 @@ -510,81 +434,6 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-ui-sunbird-preinstall.sh" - pms-partner-mosipid1: - namespace: esignet-mosipid1 - enabled: false - version: 12.2.3 - chart: mosip/pms-partner - set: - # image.repository: "mosipid/partner-management-service" - # image.tag: "1.2.2.3" - istio.gateways[0]: "pms-partner-mosipid1-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid1.${domain_name}" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-share" - priority: -9 - timeout: 1200 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/pms-partner-mosipid1-preinstall.sh" - - pms-policy-mosipid1: - namespace: esignet-mosipid1 - enabled: false - version: 12.2.3 - chart: mosip/pms-policy - set: - # image.repository: "mosipid/policy-management-service" - # image.tag: "1.2.2.2" - istio.gateways[0]: "pms-partner-mosipid1-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid1.${domain_name}" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-share" - priority: -9 - timeout: 1200 - - pms-partner-mosipid2: - namespace: esignet-mosipid2 - enabled: false - version: 12.2.3 - chart: mosip/pms-partner - set: - # image.repository: "mosipid/partner-management-service" - # image.tag: "1.2.2.3" - istio.gateways[0]: "pms-partner-mosipid2-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid2.${domain_name}" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-share" - priority: -9 - timeout: 1200 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/pms-partner-mosipid2-preinstall.sh" - - pms-policy-mosipid2: - namespace: esignet-mosipid2 - enabled: false - version: 12.2.3 - chart: mosip/pms-policy - set: - # image.repository: "mosipid/policy-management-service" - # image.tag: "1.2.2.2" - istio.gateways[0]: "pms-partner-mosipid2-gateway" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-share" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid2.${domain_name}" - priority: -9 - timeout: 1200 - - # --------------------------------------------------------------------------- - # Partner Onboarders - # --------------------------------------------------------------------------- - # Two onboarders for eSignet standalone — enable the one matching your plugin: - # esignet-mock-rp-onboarder: for mock plugin (plugin 1) and sunbird-rc (plugin 3) - # esignet-misp-onboarder: for mosip-identity-plugin (plugin 2) only - - # eSignet MISP Partner Onboarder - # Onboards the eSignet MISP client — only needed with mosip-identity-plugin (plugin 2). - # Runs FIRST so the MISP license key is written before mock-rp-onboarder starts. - # After completion, restarts the esignet deployment to pick up the new MISP license key. esignet-misp-onboarder: namespace: esignet-mock enabled: false diff --git a/Helmsman/dsf/esignet-standalone/external-dsf.yaml b/Helmsman/dsf/esignet-standalone/external-dsf.yaml index c25538342..9b1ec09e4 100644 --- a/Helmsman/dsf/esignet-standalone/external-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/external-dsf.yaml @@ -114,43 +114,27 @@ apps: databases.mosip_esignet.su.user: "postgres" databases.mosip_esignet.su.secret.name: "postgres-postgresql" databases.mosip_esignet.su.secret.key: "postgres-password" - databases.mosip_esignet_mosipid1.repoUrl: "https://github.com/mosip/esignet.git" - databases.mosip_esignet_mosipid1.defaultDb: "postgres" - databases.mosip_esignet_mosipid1.su.user: "postgres" - databases.mosip_esignet_mosipid1.su.secret.name: "postgres-postgresql" - databases.mosip_esignet_mosipid1.su.secret.key: "postgres-password" + databases.mosip_esignet_mosipid.repoUrl: "https://github.com/mosip/esignet.git" + databases.mosip_esignet_mosipid.defaultDb: "postgres" + databases.mosip_esignet_mosipid.su.user: "postgres" + databases.mosip_esignet_mosipid.su.secret.name: "postgres-postgresql" + databases.mosip_esignet_mosipid.su.secret.key: "postgres-password" # --------------------------------------------------------------------------- - # esignet-mosipid1 namespace (plugin 2 - mosip-identity) + # esignet-mosipid namespace (plugin 2 - mosip-identity) # --------------------------------------------------------------------------- - databases.mosip_esignet_mosipid1.enabled: "true" - databases.mosip_esignet_mosipid1.scriptsDir: "mosip_esignet" - databases.mosip_esignet_mosipid1.dbName: "mosip_esignet_mosipid1" - databases.mosip_esignet_mosipid1.dbUser: "esignetuser_mosipid1" - databases.mosip_esignet_mosipid1.branch: "develop" - databases.mosip_esignet_mosipid1.host: "postgres.${domain_name}" - databases.mosip_esignet_mosipid1.port: ${esignet_db_port} - databases.mosip_esignet_mosipid1.dml: 1 - databases.mosip_esignet_mosipid1.repoUrl: "https://github.com/mosip/esignet.git" - databases.mosip_esignet_mosipid1.defaultDb: "postgres" - databases.mosip_esignet_mosipid1.su.user: "postgres" - databases.mosip_esignet_mosipid1.su.secret.name: "postgres-postgresql" - databases.mosip_esignet_mosipid1.su.secret.key: "postgres-password" - # --------------------------------------------------------------------------- - # esignet-mosipid2 namespace (plugin 2 - mosip-identity) - # --------------------------------------------------------------------------- - databases.mosip_esignet_mosipid2.enabled: "true" - databases.mosip_esignet_mosipid2.scriptsDir: "mosip_esignet" - databases.mosip_esignet_mosipid2.dbName: "mosip_esignet_mosipid2" - databases.mosip_esignet_mosipid2.dbUser: "esignetuser_mosipid2" - databases.mosip_esignet_mosipid2.branch: "develop" - databases.mosip_esignet_mosipid2.host: "postgres.${domain_name}" - databases.mosip_esignet_mosipid2.port: ${esignet_db_port} - databases.mosip_esignet_mosipid2.dml: 1 - databases.mosip_esignet_mosipid2.repoUrl: "https://github.com/mosip/esignet.git" - databases.mosip_esignet_mosipid2.defaultDb: "postgres" - databases.mosip_esignet_mosipid2.su.user: "postgres" - databases.mosip_esignet_mosipid2.su.secret.name: "postgres-postgresql" - databases.mosip_esignet_mosipid2.su.secret.key: "postgres-password" + databases.mosip_esignet_mosipid.enabled: "true" + databases.mosip_esignet_mosipid.scriptsDir: "mosip_esignet" + databases.mosip_esignet_mosipid.dbName: "mosip_esignet_mosipid" + databases.mosip_esignet_mosipid.dbUser: "esignetuser_mosipid" + databases.mosip_esignet_mosipid.branch: "develop" + databases.mosip_esignet_mosipid.host: "postgres.${domain_name}" + databases.mosip_esignet_mosipid.port: ${esignet_db_port} + databases.mosip_esignet_mosipid.dml: 1 + databases.mosip_esignet_mosipid.repoUrl: "https://github.com/mosip/esignet.git" + databases.mosip_esignet_mosipid.defaultDb: "postgres" + databases.mosip_esignet_mosipid.su.user: "postgres" + databases.mosip_esignet_mosipid.su.secret.name: "postgres-postgresql" + databases.mosip_esignet_mosipid.su.secret.key: "postgres-password" # --------------------------------------------------------------------------- # esignet-sunbird namespace (plugin 3 - sunbird-rc) # --------------------------------------------------------------------------- @@ -184,13 +168,22 @@ apps: databases.mosip_mockidentitysystem.su.secret.name: "postgres-postgresql" databases.mosip_mockidentitysystem.su.secret.key: "postgres-password" # --------------------------------------------------------------------------- - # esignet-standalone-2.0.0 profile — isolated databases (own data, shared postgres) + # esignet-standalone-2.0.0 profile databases # --------------------------------------------------------------------------- + # mosip_esignet_go / mosip_esignet_go_sunbird / mosip_esignet_go_mosipid are + # isolated databases dedicated to the Go profile, separate from the (retired) + # v1.7.1 profile's mosip_esignet / mosip_esignet_sunbird / mosip_esignet_mosipid + # above. Kept with the _go suffix so the key stays distinct from the v1.7.1 + # entries above in this flat set: map. branch: develop-go matches the esignet + # repo branch these three namespaces' images/DB-init scripts are built from. + # The esignet-standalone-2.0.0 preinstall hooks (esignet-preinstall.sh, + # esignet-sunbird-preinstall.sh, esignet-mosipid-preinstall.sh) must point + # postgres-config at these same db names/users. databases.mosip_esignet_go.enabled: "true" databases.mosip_esignet_go.scriptsDir: "mosip_esignet" databases.mosip_esignet_go.dbName: "mosip_esignet_go" databases.mosip_esignet_go.dbUser: "esignetuser_go" - databases.mosip_esignet_go.branch: "develop" + databases.mosip_esignet_go.branch: "develop-go" databases.mosip_esignet_go.host: "postgres.${domain_name}" databases.mosip_esignet_go.port: ${esignet_db_port} databases.mosip_esignet_go.dml: 1 @@ -199,37 +192,24 @@ apps: databases.mosip_esignet_go.su.user: "postgres" databases.mosip_esignet_go.su.secret.name: "postgres-postgresql" databases.mosip_esignet_go.su.secret.key: "postgres-password" - databases.mosip_esignet_go_mosipid1.enabled: "true" - databases.mosip_esignet_go_mosipid1.scriptsDir: "mosip_esignet" - databases.mosip_esignet_go_mosipid1.dbName: "mosip_esignet_go_mosipid1" - databases.mosip_esignet_go_mosipid1.dbUser: "esignetuser_go_mosipid1" - databases.mosip_esignet_go_mosipid1.branch: "develop" - databases.mosip_esignet_go_mosipid1.host: "postgres.${domain_name}" - databases.mosip_esignet_go_mosipid1.port: ${esignet_db_port} - databases.mosip_esignet_go_mosipid1.dml: 1 - databases.mosip_esignet_go_mosipid1.repoUrl: "https://github.com/mosip/esignet.git" - databases.mosip_esignet_go_mosipid1.defaultDb: "postgres" - databases.mosip_esignet_go_mosipid1.su.user: "postgres" - databases.mosip_esignet_go_mosipid1.su.secret.name: "postgres-postgresql" - databases.mosip_esignet_go_mosipid1.su.secret.key: "postgres-password" - databases.mosip_esignet_go_mosipid2.enabled: "true" - databases.mosip_esignet_go_mosipid2.scriptsDir: "mosip_esignet" - databases.mosip_esignet_go_mosipid2.dbName: "mosip_esignet_go_mosipid2" - databases.mosip_esignet_go_mosipid2.dbUser: "esignetuser_go_mosipid2" - databases.mosip_esignet_go_mosipid2.branch: "develop" - databases.mosip_esignet_go_mosipid2.host: "postgres.${domain_name}" - databases.mosip_esignet_go_mosipid2.port: ${esignet_db_port} - databases.mosip_esignet_go_mosipid2.dml: 1 - databases.mosip_esignet_go_mosipid2.repoUrl: "https://github.com/mosip/esignet.git" - databases.mosip_esignet_go_mosipid2.defaultDb: "postgres" - databases.mosip_esignet_go_mosipid2.su.user: "postgres" - databases.mosip_esignet_go_mosipid2.su.secret.name: "postgres-postgresql" - databases.mosip_esignet_go_mosipid2.su.secret.key: "postgres-password" + databases.mosip_esignet_go_mosipid.enabled: "true" + databases.mosip_esignet_go_mosipid.scriptsDir: "mosip_esignet" + databases.mosip_esignet_go_mosipid.dbName: "mosip_esignet_go_mosipid" + databases.mosip_esignet_go_mosipid.dbUser: "esignetuser_go_mosipid" + databases.mosip_esignet_go_mosipid.branch: "develop-go" + databases.mosip_esignet_go_mosipid.host: "postgres.${domain_name}" + databases.mosip_esignet_go_mosipid.port: ${esignet_db_port} + databases.mosip_esignet_go_mosipid.dml: 1 + databases.mosip_esignet_go_mosipid.repoUrl: "https://github.com/mosip/esignet.git" + databases.mosip_esignet_go_mosipid.defaultDb: "postgres" + databases.mosip_esignet_go_mosipid.su.user: "postgres" + databases.mosip_esignet_go_mosipid.su.secret.name: "postgres-postgresql" + databases.mosip_esignet_go_mosipid.su.secret.key: "postgres-password" databases.mosip_esignet_go_sunbird.enabled: "true" databases.mosip_esignet_go_sunbird.scriptsDir: "mosip_esignet" databases.mosip_esignet_go_sunbird.dbName: "mosip_esignet_go_sunbird" databases.mosip_esignet_go_sunbird.dbUser: "esignetuser_go_sunbird" - databases.mosip_esignet_go_sunbird.branch: "develop" + databases.mosip_esignet_go_sunbird.branch: "develop-go" databases.mosip_esignet_go_sunbird.host: "postgres.${domain_name}" databases.mosip_esignet_go_sunbird.port: ${esignet_db_port} databases.mosip_esignet_go_sunbird.dml: 1 @@ -238,7 +218,7 @@ apps: databases.mosip_esignet_go_sunbird.su.user: "postgres" databases.mosip_esignet_go_sunbird.su.secret.name: "postgres-postgresql" databases.mosip_esignet_go_sunbird.su.secret.key: "postgres-password" - databases.mosip_mockidentitysystem_go.enabled: "true" + databases.mosip_mockidentitysystem_go.enabled: "false" databases.mosip_mockidentitysystem_go.scriptsDir: "mosip_mockidentitysystem" databases.mosip_mockidentitysystem_go.dbName: "mosip_mockidentitysystem_go" databases.mosip_mockidentitysystem_go.dbUser: "mockidentityuser_go" @@ -308,21 +288,25 @@ apps: databases.mosip_otp.port: ${esignet_db_port} databases.mosip_otp.dml: 0 # --------------------------------------------------------------------------- - # esignet-standalone-2.0.0 profile — isolated signup/kernel databases + # esignet-standalone-2.0.0 profile — signup/kernel databases # --------------------------------------------------------------------------- - databases.mosip_audit_go.enabled: "true" + # Disabled — the Go profile shares the same physical mosip_audit/mosip_kernel/ + # mosip_otp databases as above instead of maintaining isolated duplicates. Kept + # with the _go suffix (rather than deleted) so the key stays distinct from the + # entries above in this flat set: map. + databases.mosip_audit_go.enabled: "false" databases.mosip_audit_go.branch: "v1.2.0.1" databases.mosip_audit_go.repoUrl: "https://github.com/mosip/audit-manager.git" databases.mosip_audit_go.host: "postgres.${domain_name}" databases.mosip_audit_go.port: ${esignet_db_port} databases.mosip_audit_go.dml: 0 - databases.mosip_kernel_go.enabled: "true" + databases.mosip_kernel_go.enabled: "false" databases.mosip_kernel_go.branch: "v1.2.0.1" databases.mosip_kernel_go.repoUrl: "https://github.com/mosip/commons.git" databases.mosip_kernel_go.host: "postgres.${domain_name}" databases.mosip_kernel_go.port: ${esignet_db_port} databases.mosip_kernel_go.dml: 0 - databases.mosip_otp_go.enabled: "true" + databases.mosip_otp_go.enabled: "false" databases.mosip_otp_go.branch: "v1.2.0.1" databases.mosip_otp_go.repoUrl: "https://github.com/mosip/otp-manager.git" databases.mosip_otp_go.host: "postgres.${domain_name}" @@ -512,10 +496,17 @@ apps: captcha: namespace: captcha enabled: true - version: 0.1.0-beta.1 + version: 0.1.1 chart: mosip/captcha set: metrics.serviceMonitor.enabled: "false" + # Chart default extraEnvVars only contains MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_PREREGISTRATION, + # sourced from a mosip-captcha/prereg-captcha-secret-key secret that doesn't exist in this + # deployment (no preregistration module here) — empty it out so the chart doesn't try to + # wire up a nonexistent secret. esignet/mosipid/sunbird/signup captcha env vars are added + # separately via kubectl patch in the *-preinstall.sh / captcha-postinstall.sh hooks, not + # through this chart value. + extraEnvVars: "" wait: true timeout: 480 priority: -10 @@ -530,6 +521,11 @@ apps: set: image.repository: "mosipid/minio" image.tag: "2022.2.7-debian-10-r0" + # Required on upgrade - the chart's Bitnami-based validation rejects an + # empty auth.rootPassword once the release already exists. MINIO_ROOT_PASSWORD + # is fetched from the existing "minio" secret by the CI workflow before + # helmsman runs; empty on first install, which the chart auto-generates for. + auth.rootPassword: "${MINIO_ROOT_PASSWORD}" metrics.serviceMonitor.enabled: "true" extraEnvVars[0].name: "MINIO_PROMETHEUS_URL" extraEnvVars[0].value: "http://rancher-monitoring-prometheus.cattle-monitoring-system:9090" diff --git a/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml b/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml index d07899ae8..8acfb445c 100644 --- a/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml @@ -9,18 +9,15 @@ helmRepos: # Apitestrigs deploy into service namespaces (no dedicated testrig namespaces): # esignet-apitestrig → esignet ns -# esignet-mosipid1-apitestrig → esignet-mosipid1 ns -# esignet-mosipid2-apitestrig → esignet-mosipid2 ns +# esignet-mosipid-apitestrig → esignet-mosipid ns # esignet-sunbird-apitestrig → esignet-sunbird ns # esignet-signup-apitestrig → signup ns (disabled — enable if signup deployed) # signup-uitestrig → signup-uitestrig (disabled — enable if signup deployed) namespaces: - esignet-mosipid1: + esignet-mosipid: protected: false esignet-mock: protected: false - esignet-mosipid2: - protected: false esignet-sunbird: protected: false signup: @@ -75,10 +72,10 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone/apitestrig-esignet-setup.sh" # --------------------------------------------------------------------------- - # eSignet API Testrig — esignet-mosipid1 namespace (mosip-identity-plugin) + # eSignet API Testrig — esignet-mosipid namespace (mosip-identity-plugin) # --------------------------------------------------------------------------- - esignet-mosipid1-apitestrig: - namespace: esignet-mosipid1 + esignet-mosipid-apitestrig: + namespace: esignet-mosipid enabled: true version: 0.0.1-develop chart: mosip/apitestrig @@ -89,15 +86,15 @@ apps: extraEnvVarsCM[2]: "keycloak-host" extraEnvVarsCM[3]: "db" extraEnvVarsCM[4]: "apitestrig" - extraEnvVarsSecret[0]: "apitestrig-esignet-mosipid1-apitestrig" - extraEnvVarsSecret[1]: "s3-esignet-mosipid1-apitestrig" + extraEnvVarsSecret[0]: "apitestrig-esignet-mosipid-apitestrig" + extraEnvVarsSecret[1]: "s3-esignet-mosipid-apitestrig" extraEnvVarsSecret[2]: "keycloak-client-secrets" extraEnvVarsSecret[3]: "postgres-postgresql" crontime: "0 2 * * *" apitestrig.configmaps.s3.s3-host: 'http://minio.minio:9000' apitestrig.configmaps.s3.s3-user-key: 'admin' apitestrig.configmaps.s3.s3-region: '' - apitestrig.configmaps.db.db-server: "api-internal.${mosipid1_domain_name}" + apitestrig.configmaps.db.db-server: "api-internal.${mosipid_domain_name}" apitestrig.configmaps.db.db-su-user: "postgres" apitestrig.configmaps.db.db-port: "${esignet_db_port}" apitestrig.configmaps.apitestrig.ENV_USER: "api-internal.${env_name}" @@ -106,70 +103,20 @@ apps: apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-mosipid1" + apitestrig.configmaps.apitestrig.NS: "esignet-mosipid" apitestrig.configmaps.apitestrig.servicesNotDeployed: 'sunbirdrc' apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-mosipid1.${domain_name}" + apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-mosipid.${domain_name}" apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid1_domain_name};idrepository=api-internal.${mosipid1_domain_name};authmanager=api-internal.${mosipid1_domain_name};resident=api-internal.${mosipid1_domain_name};partnermanager=pms-mosipid1.${mosipid1_domain_name};idauthentication=api-internal.${mosipid1_domain_name};masterdata=api-internal.${mosipid1_domain_name};idgenerator=api-internal.${mosipid1_domain_name};policymanager=pms-mosipid1.${mosipid1_domain_name};preregistration=api-internal.${mosipid1_domain_name};keymanager=api-internal.${mosipid1_domain_name};" + apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid_domain_name};idrepository=api-internal.${mosipid_domain_name};authmanager=api-internal.${mosipid_domain_name};resident=api-internal.${mosipid_domain_name};idauthentication=api-internal.${mosipid_domain_name};masterdata=api-internal.${mosipid_domain_name};idgenerator=api-internal.${mosipid_domain_name};preregistration=api-internal.${mosipid_domain_name};keymanager=api-internal.${mosipid_domain_name};" secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" priority: -4 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/apitestrig-esignet-mosipid1-setup.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/apitestrig-esignet-mosipid-setup.sh" - # --------------------------------------------------------------------------- - # eSignet API Testrig — esignet-mosipid2 namespace (mosip-identity-plugin) - # --------------------------------------------------------------------------- - esignet-mosipid2-apitestrig: - namespace: esignet-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/apitestrig - valuesFile: "$WORKDIR/utils/esignet-apitestrig-values.yaml" - set: - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "s3" - extraEnvVarsCM[2]: "keycloak-host" - extraEnvVarsCM[3]: "db" - extraEnvVarsCM[4]: "apitestrig" - extraEnvVarsSecret[0]: "apitestrig-esignet-mosipid2-apitestrig" - extraEnvVarsSecret[1]: "s3-esignet-mosipid2-apitestrig" - extraEnvVarsSecret[2]: "keycloak-client-secrets" - extraEnvVarsSecret[3]: "postgres-postgresql" - crontime: "0 2 * * *" - apitestrig.configmaps.s3.s3-host: 'http://minio.minio:9000' - apitestrig.configmaps.s3.s3-user-key: 'admin' - apitestrig.configmaps.s3.s3-region: '' - apitestrig.configmaps.db.db-server: "api-internal.${mosipid2_domain_name}" - apitestrig.configmaps.db.db-su-user: "postgres" - apitestrig.configmaps.db.db-port: "${esignet_db_port}" - apitestrig.configmaps.apitestrig.ENV_USER: "api-internal.${env_name}" - apitestrig.configmaps.apitestrig.ENV_ENDPOINT: "https://api-internal.${domain_name}" - apitestrig.configmaps.apitestrig.ENV_TESTLEVEL: "smokeAndRegression" - apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" - apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" - apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-mosipid2" - apitestrig.configmaps.apitestrig.servicesNotDeployed: 'sunbirdrc' - apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" - apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" - apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-mosipid2.${domain_name}" - apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid2_domain_name};idrepository=api-internal.${mosipid2_domain_name};authmanager=api-internal.${mosipid2_domain_name};resident=api-internal.${mosipid2_domain_name};partnermanager=pms-mosipid2.${mosipid2_domain_name};idauthentication=api-internal.${mosipid2_domain_name};masterdata=api-internal.${mosipid2_domain_name};idgenerator=api-internal.${mosipid2_domain_name};policymanager=pms-mosipid2.${mosipid2_domain_name};preregistration=api-internal.${mosipid2_domain_name};keymanager=api-internal.${mosipid2_domain_name};" - secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" - apitestrig.variables.push_reports_to_s3: "yes" - priority: -3 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/apitestrig-esignet-mosipid2-setup.sh" - - # --------------------------------------------------------------------------- - # eSignet API Testrig — esignet-sunbird namespace (sunbird-rc-plugin) - # postInstall triggers all four testrig namespaces after last one deploys. - # --------------------------------------------------------------------------- esignet-sunbird-apitestrig: namespace: esignet-sunbird enabled: true @@ -206,7 +153,7 @@ apps: apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-sunbird.${domain_name}" apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.sunBirdBaseURL: "https://registry.${mosipid1_domain_name}" + apitestrig.configmaps.apitestrig.sunBirdBaseURL: "https://registry.${mosipid_domain_name}" secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" priority: -2 diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid-setup.sh new file mode 100755 index 000000000..085a41dfb --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid-setup.sh @@ -0,0 +1,39 @@ +#!/bin/bash +# ============================================================================= +# eSignet Standalone 2.0.0 - eSignet-MOSIPID API Testrig Pre-install Setup +# ============================================================================= +# Prepares the esignet-mosipid namespace for the esignet-mosipid-apitestrig release. +# keycloak-host and keycloak-client-secrets are already present in esignet-mosipid +# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, +# and the s3-esignet-mosipid-apitestrig / apitestrig-esignet-mosipid-apitestrig +# secrets referenced by extraEnvVarsSecret are created here (chart doesn't create +# them itself); stale testrig CMs are deleted so the chart recreates them. +# ============================================================================= +set -euo pipefail + +NS=esignet-mosipid +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" +MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" + +echo "================================================" +echo "eSignet Standalone 2.0.0 - eSignet-MOSIPID API Testrig Pre-install" +echo "================================================" + +echo "Deleting stale testrig configmaps in $NS" +kubectl -n "$NS" delete --ignore-not-found=true configmap s3 +kubectl -n "$NS" delete --ignore-not-found=true configmap db +kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig + +echo "Creating s3-esignet-mosipid-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic s3-esignet-mosipid-apitestrig \ + --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Creating apitestrig-esignet-mosipid-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic apitestrig-esignet-mosipid-apitestrig \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Copying postgres-postgresql secret to $NS" +$COPY_UTIL secret postgres-postgresql postgres "$NS" + +echo "eSignet-MOSIPID API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh deleted file mode 100755 index adbdcadfb..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh +++ /dev/null @@ -1,27 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - eSignet-MOSIPID1 API Testrig Pre-install Setup -# ============================================================================= -# Prepares the esignet-mosipid1 namespace for the esignet-mosipid1-apitestrig release. -# keycloak-host and keycloak-client-secrets are already present in esignet-mosipid1 -# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql -# needs to be copied; stale testrig CMs are deleted so the chart recreates them. -# ============================================================================= -set -euo pipefail - -NS=esignet-go-mosipid1 -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" - -echo "================================================" -echo "eSignet 1.7.1 - eSignet-MOSIPID1 API Testrig Pre-install" -echo "================================================" - -echo "Deleting stale testrig configmaps in $NS" -kubectl -n "$NS" delete --ignore-not-found=true configmap s3 -kubectl -n "$NS" delete --ignore-not-found=true configmap db -kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig - -echo "Copying postgres-postgresql secret to $NS" -$COPY_UTIL secret postgres-postgresql postgres "$NS" - -echo "eSignet-MOSIPID1 API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh deleted file mode 100755 index bb5f2d9e2..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh +++ /dev/null @@ -1,27 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - eSignet-MOSIPID2 API Testrig Pre-install Setup -# ============================================================================= -# Prepares the esignet-mosipid2 namespace for the esignet-mosipid2-apitestrig release. -# keycloak-host and keycloak-client-secrets are already present in esignet-mosipid2 -# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql -# needs to be copied; stale testrig CMs are deleted so the chart recreates them. -# ============================================================================= -set -euo pipefail - -NS=esignet-go-mosipid2 -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" - -echo "================================================" -echo "eSignet 1.7.1 - eSignet-MOSIPID2 API Testrig Pre-install" -echo "================================================" - -echo "Deleting stale testrig configmaps in $NS" -kubectl -n "$NS" delete --ignore-not-found=true configmap s3 -kubectl -n "$NS" delete --ignore-not-found=true configmap db -kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig - -echo "Copying postgres-postgresql secret to $NS" -$COPY_UTIL secret postgres-postgresql postgres "$NS" - -echo "eSignet-MOSIPID2 API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh index de0fb532e..b44bfdeae 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh @@ -1,19 +1,22 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet API Testrig Pre-install Setup +# eSignet Standalone 2.0.0 - eSignet API Testrig Pre-install Setup # ============================================================================= # Prepares the esignet-mock namespace for the esignet-apitestrig release. # keycloak-host and keycloak-client-secrets are already present in esignet-mock ns -# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql -# needs to be copied; stale testrig CMs are deleted so the chart recreates them. +# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, +# and the s3-esignet-apitestrig / apitestrig-esignet-apitestrig secrets referenced +# by extraEnvVarsSecret are created here (chart doesn't create them itself); stale +# testrig CMs are deleted so the chart recreates them. # ============================================================================= set -euo pipefail -NS=esignet-go-mock +NS=esignet-mock COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" +MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" echo "================================================" -echo "eSignet 1.7.1 - eSignet API Testrig Pre-install" +echo "eSignet Standalone 2.0.0 - eSignet API Testrig Pre-install" echo "================================================" echo "Deleting stale testrig configmaps in $NS" @@ -21,6 +24,15 @@ kubectl -n "$NS" delete --ignore-not-found=true configmap s3 kubectl -n "$NS" delete --ignore-not-found=true configmap db kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig +echo "Creating s3-esignet-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic s3-esignet-apitestrig \ + --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Creating apitestrig-esignet-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic apitestrig-esignet-apitestrig \ + --dry-run=client -o yaml | kubectl apply -f - + echo "Copying postgres-postgresql secret to $NS" $COPY_UTIL secret postgres-postgresql postgres "$NS" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh index 1a58942ea..ca432b01c 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh @@ -1,19 +1,22 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet-Sunbird API Testrig Pre-install Setup +# eSignet Standalone 2.0.0 - eSignet-Sunbird API Testrig Pre-install Setup # ============================================================================= # Prepares the esignet-sunbird namespace for the esignet-sunbird-apitestrig release. # keycloak-host and keycloak-client-secrets are already present in esignet-sunbird -# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql -# needs to be copied; stale testrig CMs are deleted so the chart recreates them. +# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, +# and the s3-esignet-sunbird-apitestrig / apitestrig-esignet-sunbird-apitestrig +# secrets referenced by extraEnvVarsSecret are created here (chart doesn't create +# them itself); stale testrig CMs are deleted so the chart recreates them. # ============================================================================= set -euo pipefail -NS=esignet-go-sunbird +NS=esignet-sunbird COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" +MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" echo "================================================" -echo "eSignet 1.7.1 - eSignet-Sunbird API Testrig Pre-install" +echo "eSignet Standalone 2.0.0 - eSignet-Sunbird API Testrig Pre-install" echo "================================================" echo "Deleting stale testrig configmaps in $NS" @@ -21,6 +24,15 @@ kubectl -n "$NS" delete --ignore-not-found=true configmap s3 kubectl -n "$NS" delete --ignore-not-found=true configmap db kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig +echo "Creating s3-esignet-sunbird-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic s3-esignet-sunbird-apitestrig \ + --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Creating apitestrig-esignet-sunbird-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic apitestrig-esignet-sunbird-apitestrig \ + --dry-run=client -o yaml | kubectl apply -f - + echo "Copying postgres-postgresql secret to $NS" $COPY_UTIL secret postgres-postgresql postgres "$NS" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-signup-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-signup-setup.sh index f66a44b22..d03208a1e 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-signup-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-signup-setup.sh @@ -9,7 +9,7 @@ # ============================================================================= set -euo pipefail -NS=signup-go +NS=signup COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh index 938217c8c..a6e42e923 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh @@ -7,13 +7,13 @@ # with the secret key environment variable. # # Environment Variables: -# CAPTCHA_SITE_KEY - reCAPTCHA site key (REQUIRED) -# CAPTCHA_SECRET_KEY - reCAPTCHA secret key (REQUIRED) -# ESIGNET_NS - eSignet namespace (default: esignet) +# ESIGNET_CAPTCHA_SITE_KEY - reCAPTCHA site key (REQUIRED) +# ESIGNET_CAPTCHA_SECRET_KEY - reCAPTCHA secret key (REQUIRED) +# ESIGNET_NS - eSignet namespace (default: esignet-mock) # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" CAPTCHA_NS="captcha" CAPTCHA_SITE_KEY="${ESIGNET_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_CAPTCHA_SITE_KEY environment variable must be set}" CAPTCHA_SECRET_KEY="${ESIGNET_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_CAPTCHA_SECRET_KEY environment variable must be set}" @@ -24,22 +24,36 @@ echo "eSignet 1.7.1 - Captcha Post-install" echo "================================================" # --- Step 1: Create captcha secrets for eSignet --- -echo "Creating esignet-captcha-go secret in $ESIGNET_NS namespace" -kubectl -n "$ESIGNET_NS" create secret generic esignet-captcha-go \ +echo "Creating esignet-captcha secret in $ESIGNET_NS namespace" +kubectl -n "$ESIGNET_NS" create secret generic esignet-captcha \ --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ --dry-run=client -o yaml | kubectl apply -f - # --- Step 2: Copy captcha secret to captcha namespace --- -echo "Copying esignet-captcha-go secret to $CAPTCHA_NS namespace" -$COPY_UTIL secret esignet-captcha-go "$ESIGNET_NS" "$CAPTCHA_NS" +echo "Copying esignet-captcha secret to $CAPTCHA_NS namespace" +$COPY_UTIL secret esignet-captcha "$ESIGNET_NS" "$CAPTCHA_NS" # --- Step 3: Patch captcha deployment with secret env var --- echo "Patching captcha deployment with secret key environment variable" -ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO')].name}" 2>/dev/null || echo "") + +# Remove the old pre-rename env var name if still present, so it doesn't linger +# pointing at a secret that no longer exists (esignet-captcha-go was renamed to +# esignet-captcha). +OLD_ENV_INDEX=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ + -o jsonpath="{range .spec.template.spec.containers[0].env[*]}{.name}{'\n'}{end}" 2>/dev/null \ + | grep -n -x "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO" | cut -d: -f1 || echo "") +if [[ -n "$OLD_ENV_INDEX" ]]; then + OLD_ENV_ARRAY_INDEX=$((OLD_ENV_INDEX - 1)) + echo "Removing stale MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO env var (index $OLD_ENV_ARRAY_INDEX)" + kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ + -p="[{\"op\": \"remove\", \"path\": \"/spec/template/spec/containers/0/env/$OLD_ENV_ARRAY_INDEX\"}]" +fi + +ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET')].name}" 2>/dev/null || echo "") if [[ -z "$ENV_VAR_EXISTS" ]]; then - echo "Adding MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO env var..." + echo "Adding MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET env var..." ENV_ARRAY_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ -o jsonpath="{.spec.template.spec.containers[0].env}" 2>/dev/null || echo "") if [[ -z "$ENV_ARRAY_EXISTS" ]]; then @@ -48,9 +62,9 @@ if [[ -z "$ENV_VAR_EXISTS" ]]; then -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env", "value": []}]' fi kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-go", "key": "esignet-captcha-secret-key"}}}}]' + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha", "key": "esignet-captcha-secret-key"}}}}]' else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO env var already exists." + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET env var already exists." fi echo "Captcha post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh deleted file mode 100755 index 165989433..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh +++ /dev/null @@ -1,39 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - Config-Server eSignet Post-install -# ============================================================================= -# Copies esignet-config-server-share CM from esignet-mock ns to mosipid1/mosipid2/sunbird, -# then patches active_profile_env and spring_config_label_env per namespace -# so each instance points to the correct config server profile and Git label. -# -# Environment variables (set in GitHub Actions workflow): -# ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL - Git label for esignet-mosipid1 (default: develop) -# ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL - Git label for esignet-mosipid2 (default: develop) -# ============================================================================= -set -euo pipefail - -SOURCE_NS="esignet-go-mock" -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -CM_NAME="esignet-config-server-go-share" - -MOSIPID1_SPRING_LABEL="${ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL:-develop}" -MOSIPID2_SPRING_LABEL="${ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL:-develop}" - -echo "================================================" -echo "eSignet 1.7.1 - Config-Server eSignet Post-install" -echo "================================================" - -for TARGET_NS in esignet-go-mosipid1 esignet-go-mosipid2 esignet-go-sunbird; do - echo "Copying $CM_NAME from $SOURCE_NS to $TARGET_NS" - $COPY_UTIL configmap "$CM_NAME" "$SOURCE_NS" "$TARGET_NS" -done - -echo "Patching $CM_NAME in esignet-go-mosipid1 (active_profile_env=mosipid1, spring_config_label_env=$MOSIPID1_SPRING_LABEL)" -kubectl -n esignet-go-mosipid1 patch configmap "$CM_NAME" --type merge \ - -p "{\"data\":{\"active_profile_env\":\"mosipid1\",\"spring_config_label_env\":\"$MOSIPID1_SPRING_LABEL\"}}" - -echo "Patching $CM_NAME in esignet-go-mosipid2 (active_profile_env=mosipid2, spring_config_label_env=$MOSIPID2_SPRING_LABEL)" -kubectl -n esignet-go-mosipid2 patch configmap "$CM_NAME" --type merge \ - -p "{\"data\":{\"active_profile_env\":\"mosipid2\",\"spring_config_label_env\":\"$MOSIPID2_SPRING_LABEL\"}}" - -echo "Config-server share configmap propagation and patching completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh deleted file mode 100755 index b2e028f2c..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh +++ /dev/null @@ -1,78 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - Config-Server eSignet Pre-install -# ============================================================================= -# Based on: esignet/deploy/config-server/install.sh -# -# Prepares esignet namespace for config-server deployment: -# 1. Ensures namespace exists with Istio injection enabled -# 2. Copies db-common-secrets from postgres ns -# 3. Creates esignet-global ConfigMap from workflow env vars -# (domain_name set by helmsman_esignet.yml; available as shell env var -# in all hooks run within the same workflow step) -# 4. Pre-creates empty esignet-misp-onboarder-key secret as placeholder -# (MISP onboarder at priority -6 writes the real key; config-server is -# restarted by esignet-misp-onboarder-postinstall.sh afterwards) -# -# NOTE: esignet-softhsm secret is NOT copied here — the softhsm helm chart -# installs directly into the esignet namespace, so no cross-namespace copy needed. -# -# NOTE: keycloak resources (keycloak-host, keycloak-env-vars, keycloak, -# keycloak-client-secrets) are NOT copied here. They are populated in all -# esignet namespaces by esignet-postinstall-keycloak-init.sh which runs as -# part of external-dsf (esignet-keycloak-init at priority -11 in keycloak ns). -# By the time esignet-dsf runs, these resources are already present. -# -# Environment Variables: -# ESIGNET_NS - eSignet namespace (default: esignet) -# domain_name - base domain (set by workflow, e.g. sandbox.example.net) -# ============================================================================= -set -euo pipefail - -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" -POSTGRES_NS="postgres" -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" - -echo "================================================" -echo "eSignet 1.7.1 - Config-Server eSignet Pre-install" -echo "================================================" - -# --- Step 1: Ensure namespace with Istio --- -kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - -kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite - -# --- Step 2: Copy db-common-secrets --- -# NOTE: esignet-softhsm secret is NOT copied here — the softhsm helm chart -# creates it directly in the esignet namespace as a helm-managed resource. -echo "Copying db-common-secrets from $POSTGRES_NS" -$COPY_UTIL secret db-common-secrets "$POSTGRES_NS" "$ESIGNET_NS" - -# --- Step 3: Create esignet-global from workflow env vars --- -# domain_name is exported by the helmsman_esignet.yml workflow step -echo "Creating esignet-global configmap (domain_name=${domain_name:-UNSET})" -kubectl -n "$ESIGNET_NS" create configmap esignet-global \ - --from-literal=installation-domain="${domain_name}" \ - --from-literal=mosip-api-host="api.${domain_name}" \ - --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet-go.${domain_name}" \ - --from-literal=mosip-iam-external-host="iam.${domain_name}" \ - --from-literal=mosip-kafka-host="kafka.${domain_name}" \ - --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup-go.${domain_name}" \ - --from-literal=mosip-smtp-host="smtp.${domain_name}" \ - --from-literal=mosip-version="develop" \ - --dry-run=client -o yaml | kubectl apply -f - -echo "esignet-global created/updated." - -# --- Step 4: Pre-create empty MISP key secret as placeholder --- -# Allows config-server pod to start. Real value written by MISP onboarder (-6). -# esignet-misp-onboarder-postinstall.sh restarts config-server after writing. -if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then - kubectl -n "$ESIGNET_NS" create secret generic esignet-misp-onboarder-key \ - --from-literal=mosip-esignet-misp-key="" - echo "esignet-misp-onboarder-key placeholder created." -else - echo "esignet-misp-onboarder-key already exists, skipping placeholder." -fi - -echo "Config-server eSignet pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-db-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-db-postinstall.sh deleted file mode 100755 index 27b7e4a3d..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-db-postinstall.sh +++ /dev/null @@ -1,23 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - Database Init Post-install (postgres-init-esignet-mock) -# ============================================================================= -# postgres-init-esignet-mock runs in the postgres namespace and creates -# db-common-secrets there. This hook copies it to all esignet-mock namespaces -# so each eSignet instance can use it for DB connections. -# ============================================================================= -set -euo pipefail - -POSTGRES_NS="postgres" -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" - -echo "================================================" -echo "eSignet 1.7.1 - Database Init Post-install" -echo "================================================" - -for NS in esignet-go-mock esignet-go-mosipid1 esignet-go-mosipid2 esignet-go-sunbird; do - echo "Copying db-common-secrets from $POSTGRES_NS to $NS" - $COPY_UTIL secret db-common-secrets "$POSTGRES_NS" "$NS" -done - -echo "Database init post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-init-db.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-init-db.sh deleted file mode 100755 index c597726bc..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-init-db.sh +++ /dev/null @@ -1,24 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - Database Init Pre-install (postgres-init-esignet-mock) -# ============================================================================= -# Based on: deploy/postgres/postgres-init.sh -# postgres-init-esignet-mock runs in the postgres namespace so it can access -# postgres-postgresql secret natively. This hook pre-creates all esignet-mock -# namespaces so the postInstall hook can copy db-common-secrets into each. -# Namespaces are created here at priority -16 because the namespace-specific -# preinstall hooks (esignet-mosipid1/mosipid2/sunbird) only run at priority -14. -# ============================================================================= -set -euo pipefail - -echo "================================================" -echo "eSignet 1.7.1 - Database Init Pre-install" -echo "================================================" - -for NS in esignet-go-mock esignet-go-mosipid1 esignet-go-mosipid2 esignet-go-sunbird; do - kubectl create namespace "$NS" --dry-run=client -o yaml | kubectl apply -f - - kubectl label namespace "$NS" istio-injection=enabled --overwrite - echo "Namespace $NS ready." -done - -echo "Database init pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh index bfeb5c619..c6b88a7b2 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh @@ -8,42 +8,40 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" echo "================================================" echo "eSignet 1.7.1 - MISP Onboarder Post-install" echo "================================================" JOB_STATUS=$(kubectl -n "$ESIGNET_NS" get jobs \ - -l app.kubernetes.io/instance=esignet-misp-onboarder-go \ + -l app.kubernetes.io/instance=esignet-misp-onboarder \ -o jsonpath='{.items[0].status.succeeded}' 2>/dev/null || echo "") -if [ "$JOB_STATUS" = "1" ]; then - echo "eSignet MISP partner onboarding completed successfully." -else - echo "WARNING: onboarding job may not have completed. Check logs:" - kubectl -n "$ESIGNET_NS" logs -l app.kubernetes.io/instance=esignet-misp-onboarder-go --tail=30 2>/dev/null || true -fi - -# Re-enable Istio sidecar injection now that the Job has completed +# Always restore namespace injection before returning from this hook. kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite echo "Istio injection re-enabled on namespace $ESIGNET_NS." +if ! [[ "$JOB_STATUS" =~ ^[1-9][0-9]*$ ]]; then + echo "WARNING: onboarding job may not have completed. Check logs:" + kubectl -n "$ESIGNET_NS" logs -l app.kubernetes.io/instance=esignet-misp-onboarder --tail=30 2>/dev/null || true + exit 1 +fi +echo "eSignet MISP partner onboarding completed successfully." + # Restart config-server first so it reloads the MISP key from the secret, # then restart esignet so it fetches the updated config from config-server. -if kubectl -n "$ESIGNET_NS" get deployment esignet-config-server-go &>/dev/null; then - kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-config-server-go - kubectl -n "$ESIGNET_NS" rollout status deployment esignet-config-server-go --timeout=300s || \ - echo "WARNING: esignet-config-server-go rollout did not complete within timeout." >&2 - echo "esignet-config-server-go restarted." +if kubectl -n "$ESIGNET_NS" get deployment esignet-config-server &>/dev/null; then + kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-config-server + kubectl -n "$ESIGNET_NS" rollout status deployment esignet-config-server --timeout=300s + echo "esignet-config-server restarted." else - echo "esignet-config-server-go deployment not found — skipping restart." + echo "esignet-config-server deployment not found — skipping restart." fi -if kubectl -n "$ESIGNET_NS" get deployment esignet-go-mock &>/dev/null; then - kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-go-mock - kubectl -n "$ESIGNET_NS" rollout status deployment esignet-go-mock --timeout=300s || \ - echo "WARNING: esignet rollout did not complete within timeout." >&2 +if kubectl -n "$ESIGNET_NS" get deployment esignet-mock &>/dev/null; then + kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-mock + kubectl -n "$ESIGNET_NS" rollout status deployment esignet-mock --timeout=300s echo "esignet deployment restarted." else echo "esignet deployment not found — skipping restart." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh index 72baca851..a4feb8aa1 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh @@ -12,7 +12,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" KEYCLOAK_NS="keycloak" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" @@ -26,6 +26,14 @@ kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply kubectl label namespace "$ESIGNET_NS" istio-injection=disabled --overwrite echo "Istio injection disabled on namespace $ESIGNET_NS." +restore_istio_injection_on_failure() { + local status=$? + if [ "$status" -ne 0 ]; then + kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite || true + fi +} +trap restore_istio_injection_on_failure EXIT + # Delete stale MISP onboarder artifacts from any previous run kubectl -n "$ESIGNET_NS" delete configmap esignet-onboarder-config --ignore-not-found=true kubectl -n "$ESIGNET_NS" delete secret esignet-onboarder-secrets --ignore-not-found=true diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh index 18f4d4708..43204af80 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh @@ -7,21 +7,21 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" echo "================================================" echo "eSignet 1.7.1 - Mock RP Onboarder Post-install" echo "================================================" JOB_STATUS=$(kubectl -n "$ESIGNET_NS" get jobs \ - -l app.kubernetes.io/instance=esignet-mock-rp-onboarder-go \ + -l app.kubernetes.io/instance=esignet-mock-rp-onboarder \ -o jsonpath='{.items[0].status.succeeded}' 2>/dev/null || echo "") if [ "$JOB_STATUS" = "1" ]; then echo "Mock RP OIDC partner onboarding completed successfully." else echo "WARNING: onboarding job may not have completed. Check logs:" - kubectl -n "$ESIGNET_NS" logs -l app.kubernetes.io/instance=esignet-mock-rp-onboarder-go --tail=30 2>/dev/null || true + kubectl -n "$ESIGNET_NS" logs -l app.kubernetes.io/instance=esignet-mock-rp-onboarder --tail=30 2>/dev/null || true fi # Re-enable Istio sidecar injection now that the Job has completed @@ -29,13 +29,13 @@ kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite echo "Istio injection re-enabled on namespace $ESIGNET_NS." # Restart mock-relying-party-service so it picks up the newly onboarded OIDC client -if kubectl -n "$ESIGNET_NS" get deployment mock-relying-party-service-go &>/dev/null; then - kubectl -n "$ESIGNET_NS" rollout restart deployment mock-relying-party-service-go - kubectl -n "$ESIGNET_NS" rollout status deployment mock-relying-party-service-go --timeout=300s || \ - echo "WARNING: mock-relying-party-service-go rollout did not complete within timeout." >&2 - echo "mock-relying-party-service-go restarted." +if kubectl -n "$ESIGNET_NS" get deployment mock-relying-party-service &>/dev/null; then + kubectl -n "$ESIGNET_NS" rollout restart deployment mock-relying-party-service + kubectl -n "$ESIGNET_NS" rollout status deployment mock-relying-party-service --timeout=300s || \ + echo "WARNING: mock-relying-party-service rollout did not complete within timeout." >&2 + echo "mock-relying-party-service restarted." else - echo "mock-relying-party-service-go deployment not found — skipping restart." + echo "mock-relying-party-service deployment not found — skipping restart." fi echo "Mock RP onboarder post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh index 14d494299..3cf764670 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh @@ -7,7 +7,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" KEYCLOAK_NS="keycloak" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh similarity index 53% rename from Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh rename to Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh index e0d5ccbc1..df3e0c89d 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh @@ -1,41 +1,41 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet MOSIPID1 Service Pre-install +# eSignet 1.7.1 - eSignet MOSIPID Service Pre-install # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid1, runs base esignet preinstall (copies -# postgres + redis config/secrets), then creates esignet-captcha-go-mosipid1 secret -# in the captcha namespace from workflow env vars, copies it to esignet-mosipid1, -# and patches the captcha deployment with the MOSIPID1 secret key. +# Wrapper: sets ESIGNET_NS=esignet-mosipid, runs base esignet preinstall (copies +# postgres + redis config/secrets), then creates esignet-captcha-mosipid secret +# in the captcha namespace from workflow env vars, copies it to esignet-mosipid, +# and patches the captcha deployment with the MOSIPID secret key. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-go-mosipid1" +export ESIGNET_NS="esignet-mosipid" CAPTCHA_NS="captcha" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY must be set}" -CAPTCHA_SECRET_KEY="${ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY must be set}" -MOSIPID1_POSTGRES_PASS="${MOSIPID1_POSTGRES_PASSWORD:?ERROR: MOSIPID1_POSTGRES_PASSWORD must be set}" -MOSIPID1_KC_ADMIN_PASS="${MOSIPID1_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID1_KEYCLOAK_ADMIN_PASSWORD must be set}" +CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID_CAPTCHA_SITE_KEY must be set}" +CAPTCHA_SECRET_KEY="${ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY must be set}" +MOSIPID_POSTGRES_PASS="${MOSIPID_POSTGRES_PASSWORD:?ERROR: MOSIPID_POSTGRES_PASSWORD must be set}" +MOSIPID_KC_ADMIN_PASS="${MOSIPID_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID_KEYCLOAK_ADMIN_PASSWORD must be set}" "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh" -# Create MOSIPID1-specific esignet-global — same domain_name, but esignet/signup hosts differ +# Create MOSIPID-specific esignet-global — same domain_name, but esignet/signup hosts differ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ --from-literal=installation-domain="${domain_name}" \ --from-literal=mosip-api-host="api.${domain_name}" \ --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet-go-mosipid1.${domain_name}" \ + --from-literal=mosip-esignet-host="esignet-mosipid.${domain_name}" \ --from-literal=mosip-iam-external-host="iam.${domain_name}" \ --from-literal=mosip-kafka-host="kafka.${domain_name}" \ --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup-go-mosipid1.${domain_name}" \ + --from-literal=mosip-signup-host="signup-mosipid.${domain_name}" \ --from-literal=mosip-smtp-host="smtp.${domain_name}" \ --from-literal=mosip-version="develop" \ --dry-run=client -o yaml | kubectl apply -f - -# Override postgres-config with MOSIPID1-specific DB values (2.0.0: isolated database) +# Override postgres-config with MOSIPID-specific DB values (2.0.0: isolated database) kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_go_mosipid1","database-username":"esignetuser_go_mosipid1"}}' + -p '{"data":{"database-name":"mosip_esignet_go_mosipid","database-username":"esignetuser_go_mosipid"}}' # Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then @@ -44,50 +44,65 @@ if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" fi -echo "Creating esignet-captcha-go-mosipid1 secret in $CAPTCHA_NS namespace" -kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-go-mosipid1 \ +echo "Creating esignet-captcha-mosipid secret in $CAPTCHA_NS namespace" +kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-mosipid \ --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ --dry-run=client -o yaml | kubectl apply -f - -echo "Copying esignet-captcha-go-mosipid1 secret from $CAPTCHA_NS to $ESIGNET_NS" -$COPY_UTIL secret esignet-captcha-go-mosipid1 "$CAPTCHA_NS" "$ESIGNET_NS" +echo "Copying esignet-captcha-mosipid secret from $CAPTCHA_NS to $ESIGNET_NS" +$COPY_UTIL secret esignet-captcha-mosipid "$CAPTCHA_NS" "$ESIGNET_NS" + +echo "Patching captcha deployment with ESIGNETMOSIPID secret key" + +# Remove stale pre-rename/pre-consolidation env var names if still present, so they +# don't linger pointing at secrets that no longer exist. +for OLD_NAME in MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID1 MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID2; do + OLD_ENV_INDEX=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ + -o jsonpath="{range .spec.template.spec.containers[0].env[*]}{.name}{'\n'}{end}" 2>/dev/null \ + | grep -n -x "$OLD_NAME" | cut -d: -f1 || echo "") + if [[ -n "$OLD_ENV_INDEX" ]]; then + OLD_ENV_ARRAY_INDEX=$((OLD_ENV_INDEX - 1)) + echo "Removing stale $OLD_NAME env var (index $OLD_ENV_ARRAY_INDEX)" + kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ + -p="[{\"op\": \"remove\", \"path\": \"/spec/template/spec/containers/0/env/$OLD_ENV_ARRAY_INDEX\"}]" + fi +done -echo "Patching captcha deployment with ESIGNETMOSIPID1 secret key" ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ - -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID1')].name}" 2>/dev/null || echo "") + -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID')].name}" 2>/dev/null || echo "") if [[ -z "$ENV_VAR_EXISTS" ]]; then kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID1", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-go-mosipid1", "key": "esignet-captcha-secret-key"}}}}]' + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-mosipid", "key": "esignet-captcha-secret-key"}}}}]' else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID1 already exists." + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID already exists." fi -# --- postgres-postgresql-mosipid1 secret (MOSIPID1 remote postgres password) --- -echo "Creating postgres-postgresql-mosipid1 secret in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create secret generic postgres-postgresql-mosipid1 \ - --from-literal=postgres-password="${MOSIPID1_POSTGRES_PASS}" \ +# --- postgres-postgresql-mosipid secret (MOSIPID remote postgres password) --- +echo "Creating postgres-postgresql-mosipid secret in $ESIGNET_NS" +kubectl -n "$ESIGNET_NS" create secret generic postgres-postgresql-mosipid \ + --from-literal=postgres-password="${MOSIPID_POSTGRES_PASS}" \ --dry-run=client -o yaml | kubectl apply -f - -# --- keycloak-host-mosipid1 CM (external URL points to MOSIPID1 Keycloak) --- -echo "Creating keycloak-host-mosipid1 configmap in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create configmap keycloak-host-mosipid1 \ - --from-literal=keycloak-external-host="iam.${mosipid1_domain_name}" \ - --from-literal=keycloak-external-url="https://iam.${mosipid1_domain_name}" \ +# --- keycloak-host-mosipid CM (external URL points to MOSIPID Keycloak) --- +echo "Creating keycloak-host-mosipid configmap in $ESIGNET_NS" +kubectl -n "$ESIGNET_NS" create configmap keycloak-host-mosipid \ + --from-literal=keycloak-external-host="iam.${mosipid_domain_name}" \ + --from-literal=keycloak-external-url="https://iam.${mosipid_domain_name}" \ --from-literal=keycloak-internal-host="keycloak.keycloak" \ --from-literal=keycloak-internal-service-url="http://keycloak.keycloak/auth/" \ --from-literal=keycloak-internal-url="http://keycloak.keycloak" \ --dry-run=client -o yaml | kubectl apply -f - -# --- keycloak-client-secrets-mosipid1: fetch all confidential clients from MOSIPID1 Keycloak --- -KC_HOST="iam.${mosipid1_domain_name}" +# --- keycloak-client-secrets-mosipid: fetch all confidential clients from MOSIPID Keycloak --- +KC_HOST="iam.${mosipid_domain_name}" REALM="mosip" echo "Fetching admin token from $KC_HOST" TOKEN_RESPONSE=$(curl -sf -X POST \ "https://${KC_HOST}/auth/realms/master/protocol/openid-connect/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ - -d "grant_type=password&client_id=admin-cli&username=admin&password=${MOSIPID1_KC_ADMIN_PASS}") + -d "grant_type=password&client_id=admin-cli&username=admin&password=${MOSIPID_KC_ADMIN_PASS}") ADMIN_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.access_token') if [[ -z "$ADMIN_TOKEN" || "$ADMIN_TOKEN" == "null" ]]; then echo "❌ Failed to get admin token from $KC_HOST" >&2; exit 1 @@ -116,12 +131,12 @@ while IFS= read -r client_json; do done < <(echo "$CLIENTS" | jq -c '.[]') if [[ ${#SECRET_ARGS[@]} -eq 0 ]]; then - echo "❌ No client secrets fetched from MOSIPID1 Keycloak" >&2; exit 1 + echo "❌ No client secrets fetched from MOSIPID Keycloak" >&2; exit 1 fi -echo "Creating keycloak-client-secrets-mosipid1 in $ESIGNET_NS (${#SECRET_ARGS[@]} clients)" -kubectl -n "$ESIGNET_NS" create secret generic keycloak-client-secrets-mosipid1 \ +echo "Creating keycloak-client-secrets-mosipid in $ESIGNET_NS (${#SECRET_ARGS[@]} clients)" +kubectl -n "$ESIGNET_NS" create secret generic keycloak-client-secrets-mosipid \ "${SECRET_ARGS[@]}" \ --dry-run=client -o yaml | kubectl apply -f - -echo "✓ keycloak-client-secrets-mosipid1 created" +echo "✓ keycloak-client-secrets-mosipid created" -echo "eSignet MOSIPID1 pre-install completed." +echo "eSignet MOSIPID pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh deleted file mode 100755 index e9346235e..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh +++ /dev/null @@ -1,127 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - eSignet MOSIPID2 Service Pre-install -# ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid2, runs base esignet preinstall (copies -# postgres + redis config/secrets), then creates esignet-captcha-go-mosipid2 secret -# in the captcha namespace from workflow env vars, copies it to esignet-mosipid2, -# and patches the captcha deployment with the MOSIPID2 secret key. -# ============================================================================= -set -euo pipefail - -export ESIGNET_NS="esignet-go-mosipid2" -CAPTCHA_NS="captcha" -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY must be set}" -CAPTCHA_SECRET_KEY="${ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY must be set}" -MOSIPID2_POSTGRES_PASS="${MOSIPID2_POSTGRES_PASSWORD:?ERROR: MOSIPID2_POSTGRES_PASSWORD must be set}" -MOSIPID2_KC_ADMIN_PASS="${MOSIPID2_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID2_KEYCLOAK_ADMIN_PASSWORD must be set}" - -"$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh" - -# Create MOSIPID2-specific esignet-global — same domain_name, but esignet/signup hosts differ -kubectl -n "$ESIGNET_NS" create configmap esignet-global \ - --from-literal=installation-domain="${domain_name}" \ - --from-literal=mosip-api-host="api.${domain_name}" \ - --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet-go-mosipid2.${domain_name}" \ - --from-literal=mosip-iam-external-host="iam.${domain_name}" \ - --from-literal=mosip-kafka-host="kafka.${domain_name}" \ - --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup-go-mosipid2.${domain_name}" \ - --from-literal=mosip-smtp-host="smtp.${domain_name}" \ - --from-literal=mosip-version="develop" \ - --dry-run=client -o yaml | kubectl apply -f - - -# Override postgres-config with MOSIPID2-specific DB values (2.0.0: isolated database) -kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_go_mosipid2","database-username":"esignetuser_go_mosipid2"}}' - -# Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. -if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then - kubectl -n "$ESIGNET_NS" create secret generic esignet-misp-onboarder-key \ - --from-literal=mosip-esignet-misp-key="" - echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" -fi - -echo "Creating esignet-captcha-go-mosipid2 secret in $CAPTCHA_NS namespace" -kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-go-mosipid2 \ - --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ - --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ - --dry-run=client -o yaml | kubectl apply -f - - -echo "Copying esignet-captcha-go-mosipid2 secret from $CAPTCHA_NS to $ESIGNET_NS" -$COPY_UTIL secret esignet-captcha-go-mosipid2 "$CAPTCHA_NS" "$ESIGNET_NS" - -echo "Patching captcha deployment with ESIGNETMOSIPID2 secret key" -ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ - -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID2')].name}" 2>/dev/null || echo "") -if [[ -z "$ENV_VAR_EXISTS" ]]; then - kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID2", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-go-mosipid2", "key": "esignet-captcha-secret-key"}}}}]' -else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID2 already exists." -fi - -# --- postgres-postgresql-mosipid2 secret (MOSIPID2 remote postgres password) --- -echo "Creating postgres-postgresql-mosipid2 secret in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create secret generic postgres-postgresql-mosipid2 \ - --from-literal=postgres-password="${MOSIPID2_POSTGRES_PASS}" \ - --dry-run=client -o yaml | kubectl apply -f - - -# --- keycloak-host-mosipid2 CM (external URL points to MOSIPID2 Keycloak) --- -echo "Creating keycloak-host-mosipid2 configmap in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create configmap keycloak-host-mosipid2 \ - --from-literal=keycloak-external-host="iam.${mosipid2_domain_name}" \ - --from-literal=keycloak-external-url="https://iam.${mosipid2_domain_name}" \ - --from-literal=keycloak-internal-host="keycloak.keycloak" \ - --from-literal=keycloak-internal-service-url="http://keycloak.keycloak/auth/" \ - --from-literal=keycloak-internal-url="http://keycloak.keycloak" \ - --dry-run=client -o yaml | kubectl apply -f - - -# --- keycloak-client-secrets-mosipid2: fetch all confidential clients from MOSIPID2 Keycloak --- -KC_HOST="iam.${mosipid2_domain_name}" -REALM="mosip" - -echo "Fetching admin token from $KC_HOST" -TOKEN_RESPONSE=$(curl -sf -X POST \ - "https://${KC_HOST}/auth/realms/master/protocol/openid-connect/token" \ - -H "Content-Type: application/x-www-form-urlencoded" \ - -d "grant_type=password&client_id=admin-cli&username=admin&password=${MOSIPID2_KC_ADMIN_PASS}") -ADMIN_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.access_token') -if [[ -z "$ADMIN_TOKEN" || "$ADMIN_TOKEN" == "null" ]]; then - echo "❌ Failed to get admin token from $KC_HOST" >&2; exit 1 -fi -echo "✓ Admin token obtained" - -echo "Fetching all clients from realm $REALM on $KC_HOST" -CLIENTS=$(curl -sf \ - "https://${KC_HOST}/auth/admin/realms/${REALM}/clients?max=500" \ - -H "Authorization: Bearer $ADMIN_TOKEN") - -SECRET_ARGS=() -while IFS= read -r client_json; do - client_id=$(echo "$client_json" | jq -r '.clientId') - uuid=$(echo "$client_json" | jq -r '.id') - auth_type=$(echo "$client_json" | jq -r '.clientAuthenticatorType') - is_public=$(echo "$client_json" | jq -r '.publicClient') - [[ "$auth_type" != "client-secret" || "$is_public" == "true" ]] && continue - secret_val=$(curl -sf \ - "https://${KC_HOST}/auth/admin/realms/${REALM}/clients/${uuid}/client-secret" \ - -H "Authorization: Bearer $ADMIN_TOKEN" | jq -r '.value // empty') - [[ -z "$secret_val" || "$secret_val" == "null" ]] && continue - key=$(echo "$client_id" | tr '-' '_')_secret - SECRET_ARGS+=("--from-literal=${key}=${secret_val}") - echo " ✓ $client_id" -done < <(echo "$CLIENTS" | jq -c '.[]') - -if [[ ${#SECRET_ARGS[@]} -eq 0 ]]; then - echo "❌ No client secrets fetched from MOSIPID2 Keycloak" >&2; exit 1 -fi -echo "Creating keycloak-client-secrets-mosipid2 in $ESIGNET_NS (${#SECRET_ARGS[@]} clients)" -kubectl -n "$ESIGNET_NS" create secret generic keycloak-client-secrets-mosipid2 \ - "${SECRET_ARGS[@]}" \ - --dry-run=client -o yaml | kubectl apply -f - -echo "✓ keycloak-client-secrets-mosipid2 created" - -echo "eSignet MOSIPID2 pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-postinstall-keycloak-init.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-postinstall-keycloak-init.sh index e79d80caf..8be5e8239 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-postinstall-keycloak-init.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-postinstall-keycloak-init.sh @@ -1,5 +1,5 @@ #!/bin/bash -# Post-install hook for esignet-keycloak-init (eSignet 1.7.1 standalone) +# Post-install hook for esignet-keycloak-init (eSignet 2.0.0 (Go) standalone) # The chart runs in keycloak ns and creates keycloak-host CM and # keycloak-client-secrets secret there. This hook fans those resources out to # all esignet-mock namespaces so every esignet-mock instance can reference them without @@ -10,13 +10,13 @@ KEYCLOAK_NS="keycloak" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" # All esignet-mock namespaces that need keycloak resources -ESIGNET_NAMESPACES=(esignet-go-mock esignet-go-mosipid1 esignet-go-mosipid2 esignet-go-sunbird) +ESIGNET_NAMESPACES=(esignet-mock esignet-mosipid esignet-sunbird) echo "================================================" -echo "eSignet 1.7.1 - Keycloak Init Post-install" +echo "eSignet 2.0.0 (Go) - Keycloak Init Post-install" echo "================================================" -echo "Sharing keycloak resources from $KEYCLOAK_NS to all esignet-go-mock namespaces" +echo "Sharing keycloak resources from $KEYCLOAK_NS to all esignet-mock namespaces" for NS_TARGET in "${ESIGNET_NAMESPACES[@]}"; do if ! kubectl get namespace "$NS_TARGET" &>/dev/null; then echo "Namespace $NS_TARGET does not exist, skipping" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh index eec0071d5..90505c084 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh @@ -14,7 +14,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" POSTGRES_NS="postgres" REDIS_NS="redis" KEYCLOAK_NS="keycloak" @@ -65,8 +65,8 @@ $COPY_UTIL secret db-common-secrets "$POSTGRES_NS" "$ESIGNET_NS" # external-dsf.yaml esignet-keycloak-init release), but that hook's namespace loop only # covers the original esignet-standalone namespaces. Copy them directly here so the # 2.0.0 namespace is self-sufficient without touching the shared hook. This runs for -# every instance that delegates to this script (esignet-go-mock plus the -# mosipid1/mosipid2/sunbird wrappers), matching the original profile's fan-out to all +# every instance that delegates to this script (esignet-mock plus the +# mosipid/sunbird wrappers), matching the original profile's fan-out to all # four namespaces. echo "Copying keycloak-host configmap from $KEYCLOAK_NS" $COPY_UTIL configmap keycloak-host "$KEYCLOAK_NS" "$ESIGNET_NS" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh index 20c40638d..f2b29752c 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh @@ -3,13 +3,13 @@ # eSignet 1.7.1 - eSignet Sunbird Service Pre-install # ============================================================================= # Wrapper: sets ESIGNET_NS=esignet-sunbird, runs base esignet preinstall (copies -# postgres + redis config/secrets), then creates esignet-captcha-go-sunbird secret +# postgres + redis config/secrets), then creates esignet-captcha-sunbird secret # in the captcha namespace from workflow env vars, copies it to esignet-sunbird, # and patches the captcha deployment with the Sunbird secret key. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-go-sunbird" +export ESIGNET_NS="esignet-sunbird" CAPTCHA_NS="captcha" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" CAPTCHA_SITE_KEY="${ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY must be set}" @@ -22,16 +22,16 @@ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ --from-literal=installation-domain="${domain_name}" \ --from-literal=mosip-api-host="api.${domain_name}" \ --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet-go-sunbird.${domain_name}" \ + --from-literal=mosip-esignet-host="esignet-sunbird.${domain_name}" \ --from-literal=mosip-iam-external-host="iam.${domain_name}" \ --from-literal=mosip-kafka-host="kafka.${domain_name}" \ --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup-go-sunbird.${domain_name}" \ + --from-literal=mosip-signup-host="signup-sunbird.${domain_name}" \ --from-literal=mosip-smtp-host="smtp.${domain_name}" \ --from-literal=mosip-version="develop" \ --dry-run=client -o yaml | kubectl apply -f - -# Override postgres-config with Sunbird-specific DB values +# Override postgres-config with Sunbird-specific DB values (2.0.0: isolated database) kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ -p '{"data":{"database-name":"mosip_esignet_go_sunbird","database-username":"esignetuser_go_sunbird"}}' @@ -42,23 +42,36 @@ if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" fi -echo "Creating esignet-captcha-go-sunbird secret in $CAPTCHA_NS namespace" -kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-go-sunbird \ +echo "Creating esignet-captcha-sunbird secret in $CAPTCHA_NS namespace" +kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-sunbird \ --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ --dry-run=client -o yaml | kubectl apply -f - -echo "Copying esignet-captcha-go-sunbird secret from $CAPTCHA_NS to $ESIGNET_NS" -$COPY_UTIL secret esignet-captcha-go-sunbird "$CAPTCHA_NS" "$ESIGNET_NS" +echo "Copying esignet-captcha-sunbird secret from $CAPTCHA_NS to $ESIGNET_NS" +$COPY_UTIL secret esignet-captcha-sunbird "$CAPTCHA_NS" "$ESIGNET_NS" echo "Patching captcha deployment with ESIGNETSUNBIRD secret key" +# Remove the old pre-rename env var name if still present, so it doesn't linger +# pointing at a secret that no longer exists (esignet-captcha-go-sunbird was renamed +# to esignet-captcha-sunbird). +OLD_ENV_INDEX=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ + -o jsonpath="{range .spec.template.spec.containers[0].env[*]}{.name}{'\n'}{end}" 2>/dev/null \ + | grep -n -x "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOSUNBIRD" | cut -d: -f1 || echo "") +if [[ -n "$OLD_ENV_INDEX" ]]; then + OLD_ENV_ARRAY_INDEX=$((OLD_ENV_INDEX - 1)) + echo "Removing stale MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOSUNBIRD env var (index $OLD_ENV_ARRAY_INDEX)" + kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ + -p="[{\"op\": \"remove\", \"path\": \"/spec/template/spec/containers/0/env/$OLD_ENV_ARRAY_INDEX\"}]" +fi + ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ - -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOSUNBIRD')].name}" 2>/dev/null || echo "") + -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETSUNBIRD')].name}" 2>/dev/null || echo "") if [[ -z "$ENV_VAR_EXISTS" ]]; then kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOSUNBIRD", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-go-sunbird", "key": "esignet-captcha-secret-key"}}}}]' + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETSUNBIRD", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-sunbird", "key": "esignet-captcha-secret-key"}}}}]' else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOSUNBIRD already exists." + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETSUNBIRD already exists." fi echo "eSignet Sunbird pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/kafka-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/kafka-postinstall.sh index 14e0b8eb9..ea238f1b5 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/kafka-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/kafka-postinstall.sh @@ -11,7 +11,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" KAFKA_URL="${KAFKA_URL:-kafka-0.kafka-headless.kafka.svc.cluster.local:9092,kafka-1.kafka-headless.kafka.svc.cluster.local:9092,kafka-2.kafka-headless.kafka.svc.cluster.local:9092}" echo "================================================" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh index 5651ce2b5..9d1ae319a 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh @@ -15,11 +15,20 @@ # ============================================================================= set -euo pipefail -KERNEL_NS="kernel-go" +KERNEL_NS="kernel" API_HOST="${MOSIP_API_HOST:-}" API_INTERNAL_HOST="${MOSIP_API_INTERNAL_HOST:-}" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" +if [ -z "$API_HOST" ]; then + echo "ERROR: MOSIP_API_HOST must be set" >&2 + exit 1 +fi +if [ -z "$API_INTERNAL_HOST" ]; then + echo "ERROR: MOSIP_API_INTERNAL_HOST must be set" >&2 + exit 1 +fi + echo "================================================" echo "eSignet 1.7.1 - Kernel Pre-install" echo "================================================" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/keycloak-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/keycloak-postinstall.sh index 6e4fbedf1..9192e2bdc 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/keycloak-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/keycloak-postinstall.sh @@ -13,7 +13,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" KEYCLOAK_NS="keycloak" CHART_VERSION="${KEYCLOAK_INIT_VERSION:-12.0.2}" INSTALLATION_DOMAIN="${INSTALLATION_DOMAIN:-sandbox.xyz.net}" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh index 9d22608cd..be79632da 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh @@ -1,22 +1,22 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Identity System DB Init Pre-install +# eSignet Standalone 2.0.0 - Mock Identity System DB Init Pre-install # ============================================================================= # Based on: esignet-mock-services/deploy/postgres/init_db.sh # Ensures postgres-postgresql secret is present in the esignet namespace # before postgres-init-mock-identity helm chart runs DB initialization. # # Environment Variables: -# ESIGNET_NS - eSignet namespace (default: esignet) +# ESIGNET_NS - eSignet namespace (default: esignet-mock) # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" POSTGRES_NS="postgres" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" -echo "eSignet 1.7.1 - Mock Identity DB Init Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Identity DB Init Pre-install" echo "================================================" # --- Step 1: Ensure esignet namespace exists with istio --- diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh index da1b91802..9455bbdec 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh @@ -1,11 +1,11 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Identity System Pre-install +# eSignet Standalone 2.0.0 - Mock Identity System Pre-install # ============================================================================= # Prepares esignet namespace for mock identity system deployment: # - Copies softhsm-mock-identity-system secret from softhsm ns # - Creates mockid-postgres-config with mock identity DB values -# - Verifies softhsm-mock-identity-system-go-share ConfigMap is present +# - Verifies softhsm-mock-identity-system-share ConfigMap is present # # Environment Variables: # MOCKID_DB_NAME - Mock identity DB name (default: mosip_mockidentitysystem) @@ -14,23 +14,23 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" -SOFTHSM_NS="softhsm-go" -MOCKID_DB_NAME="${MOCKID_DB_NAME:-mosip_mockidentitysystem_go}" -MOCKID_DB_USER="${MOCKID_DB_USER:-mockidentityuser_go}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" +SOFTHSM_NS="softhsm" +MOCKID_DB_NAME="${MOCKID_DB_NAME:-mosip_mockidentitysystem}" +MOCKID_DB_USER="${MOCKID_DB_USER:-mockidentityuser}" MOCKID_DB_PORT="${MOCKID_DB_PORT:-5432}" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" -echo "eSignet 1.7.1 - Mock Identity System Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Identity System Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - # Copy softhsm-mock-identity-system secret to esignet ns # The chart references it directly via secretKeyRef — pod and secret must be in same namespace -$COPY_UTIL secret softhsm-mock-identity-system-go "$SOFTHSM_NS" "$ESIGNET_NS" -echo "softhsm-mock-identity-system-go secret copied to $ESIGNET_NS." +$COPY_UTIL secret softhsm-mock-identity-system "$SOFTHSM_NS" "$ESIGNET_NS" +echo "softhsm-mock-identity-system secret copied to $ESIGNET_NS." # Read internal host from postgres-config (already present from esignet-preinstall.sh) DB_HOST=$(kubectl -n "$ESIGNET_NS" get configmap postgres-config \ @@ -50,11 +50,11 @@ kubectl -n "$ESIGNET_NS" create configmap mockid-postgres-config \ echo "mockid-postgres-config created/updated in $ESIGNET_NS (host=$DB_HOST db=$MOCKID_DB_NAME user=$MOCKID_DB_USER)." # Verify SoftHSM mock identity configmap exists in esignet namespace -if kubectl -n "$ESIGNET_NS" get configmap softhsm-mock-identity-system-go-share &>/dev/null; then +if kubectl -n "$ESIGNET_NS" get configmap softhsm-mock-identity-system-share &>/dev/null; then echo "SoftHSM mock identity system configmap found." else - echo "ERROR: softhsm-mock-identity-system-go-share configmap not found in $ESIGNET_NS namespace." - echo "Deploy softhsm-mock-identity-system-go before running mock identity system install." + echo "ERROR: softhsm-mock-identity-system-share configmap not found in $ESIGNET_NS namespace." + echo "Deploy softhsm-mock-identity-system before running mock identity system install." exit 1 fi diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid-preinstall.sh similarity index 68% rename from Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh rename to Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid-preinstall.sh index 1847d2e5a..f86affce4 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid-preinstall.sh @@ -1,10 +1,10 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party Service MOSIPID1 Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party Service MOSIPID Pre-install # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base mock-rp-service +# Wrapper: sets ESIGNET_NS=esignet-mosipid and delegates to base mock-rp-service # preinstall (creates private key secrets in the target namespace). # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-go-mosipid1" +export ESIGNET_NS="esignet-mosipid" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh deleted file mode 100755 index 069f92439..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - Mock Relying Party Service MOSIPID2 Pre-install -# ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base mock-rp-service -# preinstall (creates private key secrets in the target namespace). -# ============================================================================= -set -euo pipefail -export ESIGNET_NS="esignet-go-mosipid2" -exec "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh index 45b51adcd..aa3a24fb6 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party Service Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party Service Pre-install # ============================================================================= # Creates K8s secrets for mock relying party private keys from GitHub Actions # environment secrets, then verifies the esignet service is running. @@ -11,7 +11,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" CLIENT_KEY_TMPFILE="" JWE_KEY_TMPFILE="" @@ -25,7 +25,7 @@ cleanup_temp_files() { trap cleanup_temp_files EXIT INT TERM echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party Service Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Relying Party Service Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh index 7cb2fcbb6..077947de5 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh @@ -1,10 +1,10 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party Service Sunbird Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party Service Sunbird Pre-install # ============================================================================= # Wrapper: sets ESIGNET_NS=esignet-sunbird and delegates to base mock-rp-service # preinstall (creates private key secrets in the target namespace). # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-go-sunbird" +export ESIGNET_NS="esignet-sunbird" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid-preinstall.sh similarity index 65% rename from Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid2-preinstall.sh rename to Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid-preinstall.sh index ec8551819..7e960eba9 100755 --- a/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid2-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid-preinstall.sh @@ -1,16 +1,16 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party UI MOSIPID2 Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID Pre-install # ============================================================================= -# Ensures esignet-mosipid2 namespace exists and verifies mock-relying-party-service -# is available in the esignet-mosipid2 namespace before UI deployment. +# Ensures esignet-mosipid namespace exists and verifies mock-relying-party-service +# is available in the esignet-mosipid namespace before UI deployment. # ============================================================================= set -euo pipefail -ESIGNET_NS="esignet-mosipid2" +ESIGNET_NS="esignet-mosipid" echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID2 Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - @@ -21,4 +21,4 @@ else echo "WARNING: Mock relying party service not found in $ESIGNET_NS. UI depends on the service being deployed." fi -echo "Mock relying party UI MOSIPID2 pre-install completed." +echo "Mock relying party UI MOSIPID pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh deleted file mode 100755 index dd6165071..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh +++ /dev/null @@ -1,24 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - Mock Relying Party UI MOSIPID1 Pre-install -# ============================================================================= -# Ensures esignet-mosipid1 namespace exists and verifies mock-relying-party-service -# is available in the esignet-mosipid1 namespace before UI deployment. -# ============================================================================= -set -euo pipefail - -ESIGNET_NS="esignet-go-mosipid1" - -echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID1 Pre-install" -echo "================================================" - -kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - - -if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service-go &>/dev/null; then - echo "Mock relying party service found in $ESIGNET_NS." -else - echo "WARNING: Mock relying party service not found in $ESIGNET_NS. UI depends on the service being deployed." -fi - -echo "Mock relying party UI MOSIPID1 pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh deleted file mode 100755 index 3734187c8..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh +++ /dev/null @@ -1,24 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - Mock Relying Party UI MOSIPID2 Pre-install -# ============================================================================= -# Ensures esignet-mosipid2 namespace exists and verifies mock-relying-party-service -# is available in the esignet-mosipid2 namespace before UI deployment. -# ============================================================================= -set -euo pipefail - -ESIGNET_NS="esignet-go-mosipid2" - -echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID2 Pre-install" -echo "================================================" - -kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - - -if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service-go &>/dev/null; then - echo "Mock relying party service found in $ESIGNET_NS." -else - echo "WARNING: Mock relying party service not found in $ESIGNET_NS. UI depends on the service being deployed." -fi - -echo "Mock relying party UI MOSIPID2 pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh index 1340a045f..aeb2c84a9 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh @@ -1,20 +1,20 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party UI Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party UI Pre-install # ============================================================================= # Prepares for mock relying party UI deployment. # ============================================================================= set -euo pipefail echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party UI Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Relying Party UI Pre-install" echo "================================================" # Ensure esignet namespace exists -kubectl create namespace esignet-go-mock --dry-run=client -o yaml | kubectl apply -f - +kubectl create namespace esignet-mock --dry-run=client -o yaml | kubectl apply -f - # Verify mock relying party service is available -if kubectl -n esignet-go-mock get svc mock-relying-party-service-go &>/dev/null; then +if kubectl -n esignet-mock get svc mock-relying-party-service &>/dev/null; then echo "Mock relying party service found." else echo "WARNING: Mock relying party service not found. UI depends on the service being deployed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh index e1c066e06..d98a62acc 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh @@ -1,21 +1,21 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party UI Sunbird Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party UI Sunbird Pre-install # ============================================================================= # Ensures esignet-sunbird namespace exists and verifies mock-relying-party-service # is available in the esignet-sunbird namespace before UI deployment. # ============================================================================= set -euo pipefail -ESIGNET_NS="esignet-go-sunbird" +ESIGNET_NS="esignet-sunbird" echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party UI Sunbird Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Relying Party UI Sunbird Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - -if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service-go &>/dev/null; then +if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service &>/dev/null; then echo "Mock relying party service found in $ESIGNET_NS." else echo "WARNING: Mock relying party service not found in $ESIGNET_NS. UI depends on the service being deployed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh index 8277b1a8f..a42a62267 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh @@ -1,21 +1,21 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Notifier Post-install +# eSignet Standalone 2.0.0 - Notifier Post-install # ============================================================================= # Based on: esignet-signup/deploy/kernel/install.sh # Patches notifier deployment with SMS number length env vars after install. # ============================================================================= set -euo pipefail -KERNEL_NS="kernel-go" +KERNEL_NS="kernel" echo "================================================" -echo "eSignet 1.7.1 - Notifier Post-install" +echo "eSignet Standalone 2.0.0 - Notifier Post-install" echo "================================================" # Source: deploy/kernel/install.sh - kubectl set env deployment/notifier -echo "Setting SMS number length env vars on notifier-go deployment" -kubectl -n "$KERNEL_NS" set env deployment/notifier-go \ +echo "Setting SMS number length env vars on notifier deployment" +kubectl -n "$KERNEL_NS" set env deployment/notifier \ MOSIP_KERNEL_SMS_NUMBER_MIN_LENGTH=7 \ MOSIP_KERNEL_SMS_NUMBER_MAX_LENGTH=10 diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid-preinstall.sh similarity index 66% rename from Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh rename to Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid-preinstall.sh index fb19d5533..fca557915 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid-preinstall.sh @@ -1,9 +1,9 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - OIDC UI MOSIPID1 Pre-install +# eSignet 1.7.1 - OIDC UI MOSIPID Pre-install # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base oidc-ui preinstall. +# Wrapper: sets ESIGNET_NS=esignet-mosipid and delegates to base oidc-ui preinstall. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-go-mosipid1" +export ESIGNET_NS="esignet-mosipid" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid2-preinstall.sh deleted file mode 100755 index 9ccb94471..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid2-preinstall.sh +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - OIDC UI MOSIPID2 Pre-install -# ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base oidc-ui preinstall. -# ============================================================================= -set -euo pipefail -export ESIGNET_NS="esignet-go-mosipid2" -exec "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh index 3edf203d4..d25717fb5 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh @@ -11,7 +11,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" echo "================================================" echo "eSignet 1.7.1 - OIDC UI Pre-install" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-sunbird-preinstall.sh index 9ab201731..b7e0826cf 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-sunbird-preinstall.sh @@ -5,5 +5,5 @@ # Wrapper: sets ESIGNET_NS=esignet-sunbird and delegates to base oidc-ui preinstall. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-go-sunbird" +export ESIGNET_NS="esignet-sunbird" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid1-preinstall.sh deleted file mode 100755 index 0a94341e4..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid1-preinstall.sh +++ /dev/null @@ -1,45 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - PMS Partner MOSIPID1 Pre-install -# ============================================================================= -# Creates the Istio Gateway for pms-partner in esignet-mosipid1 namespace. -# ============================================================================= -set -euo pipefail - -ESIGNET_NS="esignet-go-mosipid1" - -echo "================================================" -echo "eSignet 1.7.1 - PMS Partner MOSIPID1 Pre-install" -echo "================================================" - -kubectl apply -f - </dev/null || echo "") + -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP')].name}" 2>/dev/null || echo "") if [[ -z "$ENV_VAR_EXISTS" ]]; then kubectl patch deployment -n captcha captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP_GO", "valueFrom": {"secretKeyRef": {"name": "signup-captcha-go", "key": "signup-captcha-secret-key"}}}}]' + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP", "valueFrom": {"secretKeyRef": {"name": "signup-captcha", "key": "signup-captcha-secret-key"}}}}]' else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP_GO already exists." + echo "Restarting captcha to load the updated signup secret." + kubectl -n captcha rollout restart deployment/captcha + kubectl -n captcha rollout status deployment/captcha --timeout=480s fi # --- Step 5: Create signup-keystore secrets --- @@ -79,8 +81,8 @@ kubectl -n "$SIGNUP_NS" create secret generic signup-keystore \ # --- Step 6: Create msg-gateway configmap and secret (pointing to mock-smtp) --- echo "Creating msg-gateway configmap and secret in $SIGNUP_NS" kubectl -n "$SIGNUP_NS" create configmap msg-gateway \ - --from-literal=smtp-host="mock-smtp-go.mock-smtp-go" \ - --from-literal=sms-host="mock-smtp-go.mock-smtp-go" \ + --from-literal=smtp-host="mock-smtp.mock-smtp" \ + --from-literal=sms-host="mock-smtp.mock-smtp" \ --from-literal=smtp-port="8025" \ --from-literal=sms-port="8080" \ --from-literal=smtp-username="" \ diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid1-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid-setup.sh similarity index 65% rename from Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid1-setup.sh rename to Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid-setup.sh index c9d0ccc04..120c2b1e0 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid1-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid-setup.sh @@ -1,9 +1,9 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - SoftHSM eSignet MOSIPID1 Pre-install Setup +# eSignet 1.7.1 - SoftHSM eSignet MOSIPID Pre-install Setup # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base softhsm setup. +# Wrapper: sets ESIGNET_NS=esignet-mosipid and delegates to base softhsm setup. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-go-mosipid1" +export ESIGNET_NS="esignet-mosipid" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid2-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid2-setup.sh deleted file mode 100755 index 9d16c2ec8..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid2-setup.sh +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - SoftHSM eSignet MOSIPID2 Pre-install Setup -# ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base softhsm setup. -# ============================================================================= -set -euo pipefail -export ESIGNET_NS="esignet-go-mosipid2" -exec "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh index 2d02ce0cd..4b990127c 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh @@ -12,8 +12,8 @@ # ============================================================================= set -euo pipefail -SOFTHSM_NS="${SOFTHSM_NS:-softhsm-go}" -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +SOFTHSM_NS="${SOFTHSM_NS:-softhsm}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" @@ -22,17 +22,15 @@ echo "================================================" # --- Step 1: Wait for SoftHSM pod to be ready --- echo "Waiting for SoftHSM pod to be ready..." -kubectl -n "$SOFTHSM_NS" wait --for=condition=ready pod -l app.kubernetes.io/instance=esignet-softhsm-go --timeout=480s || \ +kubectl -n "$SOFTHSM_NS" wait --for=condition=ready pod -l app.kubernetes.io/instance=esignet-softhsm --timeout=480s || \ { echo "ERROR: SoftHSM pod not ready after timeout" >&2; exit 1; } # --- Step 2: Copy esignet-softhsm-share configmap to esignet namespace --- echo "Copying esignet-softhsm-share configmap to $ESIGNET_NS namespace" -$COPY_UTIL configmap esignet-softhsm-share "$SOFTHSM_NS" "$ESIGNET_NS" 2>/dev/null || \ - echo "WARNING: esignet-softhsm-share configmap not found in $SOFTHSM_NS" +$COPY_UTIL configmap esignet-softhsm-share "$SOFTHSM_NS" "$ESIGNET_NS" # --- Step 3: Copy esignet-softhsm secret to esignet namespace --- -echo "Copying esignet-softhsm-go secret to $ESIGNET_NS namespace" -$COPY_UTIL secret esignet-softhsm-go "$SOFTHSM_NS" "$ESIGNET_NS" 2>/dev/null || \ - echo "WARNING: esignet-softhsm-go secret not found in $SOFTHSM_NS" +echo "Copying esignet-softhsm secret to $ESIGNET_NS namespace" +$COPY_UTIL secret esignet-softhsm "$SOFTHSM_NS" "$ESIGNET_NS" echo "SoftHSM eSignet post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh index 84f6961e0..54fa57156 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh @@ -11,7 +11,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" echo "================================================" echo "eSignet 1.7.1 - SoftHSM eSignet Pre-install" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh index 1e9584f8a..5007357b3 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh @@ -5,5 +5,5 @@ # Wrapper: sets ESIGNET_NS=esignet-sunbird and delegates to base softhsm setup. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-go-sunbird" +export ESIGNET_NS="esignet-sunbird" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh index f8a711787..5349e447c 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh @@ -2,14 +2,14 @@ # ============================================================================= # eSignet 1.7.1 - SoftHSM Mock Identity System Post-install # ============================================================================= -# Copies chart-generated softhsm-mock-identity-system-go-share configmap +# Copies chart-generated softhsm-mock-identity-system-share configmap # (PKCS11 slot/token config) from softhsm namespace to esignet-mock namespace. # The security PIN is handled separately via secret copy in preinstall. # ============================================================================= set -euo pipefail -SOFTHSM_NS="${SOFTHSM_NS:-softhsm-go}" -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +SOFTHSM_NS="${SOFTHSM_NS:-softhsm}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" @@ -17,11 +17,11 @@ echo "eSignet 1.7.1 - SoftHSM Mock Identity System Post-install" echo "================================================" # Wait for SoftHSM mock identity pod to be ready -kubectl -n "$SOFTHSM_NS" wait --for=condition=ready pod -l app.kubernetes.io/instance=softhsm-mock-identity-system-go --timeout=480s || \ +kubectl -n "$SOFTHSM_NS" wait --for=condition=ready pod -l app.kubernetes.io/instance=softhsm-mock-identity-system --timeout=480s || \ { echo "ERROR: SoftHSM mock identity system pod not ready after timeout" >&2; exit 1; } # Copy chart-generated PKCS11 configmap to esignet-mock namespace -echo "Copying softhsm-mock-identity-system-go-share configmap to $ESIGNET_NS" -$COPY_UTIL configmap softhsm-mock-identity-system-go-share "$SOFTHSM_NS" "$ESIGNET_NS" +echo "Copying softhsm-mock-identity-system-share configmap to $ESIGNET_NS" +$COPY_UTIL configmap softhsm-mock-identity-system-share "$SOFTHSM_NS" "$ESIGNET_NS" echo "SoftHSM mock identity system post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh index d27bd7d54..99a1ea0dc 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh @@ -11,7 +11,7 @@ echo "eSignet 1.7.1 - SoftHSM Mock Identity System Pre-install" echo "================================================" # Ensure softhsm namespace exists -kubectl create namespace softhsm-go --dry-run=client -o yaml | kubectl apply -f - -kubectl label namespace softhsm-go istio-injection=enabled --overwrite +kubectl create namespace softhsm --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace softhsm istio-injection=enabled --overwrite echo "SoftHSM mock identity system pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh b/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh index 58088c891..1b31cbfee 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh @@ -1,9 +1,9 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Trigger Testrig CronJobs +# eSignet Standalone 2.0.0 - Trigger Testrig CronJobs # ============================================================================= # Immediately triggers testrig CronJobs after deployment: -# apitestrig → esignet-mock ns (cronjob-apitestrig-esignet-mock) +# apitestrig → esignet-mock ns # signup-apitestrig → signup ns (if deployed) # signup-uitestrig → signup-uitestrig ns (if deployed) # ============================================================================= @@ -13,12 +13,35 @@ CONTINUE_ON_FAILURE="${CONTINUE_ON_FAILURE:-true}" JOB_TIMEOUT="${JOB_TIMEOUT:-5400}" OVERALL_SUCCESS=true +# Runs `kubectl "$@"`, printing stdout on success. +# Returns 0 on success, 2 for a genuine NotFound (caller should treat the +# resource as absent), or 1 with the error printed to stderr for any other +# kubectl failure (RBAC, credentials, API errors) so real problems aren't +# silently swallowed alongside the expected "doesn't exist" case. +kubectl_get() { + local output rc=0 + output=$(kubectl "$@" 2>&1) || rc=$? + if [[ $rc -eq 0 ]]; then + printf '%s' "$output" + return 0 + fi + if echo "$output" | grep -q '(NotFound)'; then + return 2 + fi + echo "✗ kubectl $* failed: $output" >&2 + return 1 +} + trigger_and_wait() { local ns=$1 cronjob=$2 - if ! kubectl get cronjob -n "$ns" "$cronjob" &>/dev/null; then + local rc=0 + kubectl_get get cronjob -n "$ns" "$cronjob" -o name >/dev/null || rc=$? + if [[ $rc -eq 2 ]]; then echo "⏭ CronJob $cronjob not found in $ns — skipping" return 0 + elif [[ $rc -ne 0 ]]; then + return 1 fi local job_name="${cronjob}-manual-$(date +%s)" @@ -27,10 +50,29 @@ trigger_and_wait() { local elapsed=0 while [[ $elapsed -lt $JOB_TIMEOUT ]]; do - local complete=$(kubectl get job -n "$ns" "$job_name" \ - -o jsonpath='{.status.conditions[?(@.type=="Complete")].status}' 2>/dev/null || echo "") - local failed=$(kubectl get job -n "$ns" "$job_name" \ - -o jsonpath='{.status.conditions[?(@.type=="Failed")].status}' 2>/dev/null || echo "") + local complete failed + rc=0 + complete=$(kubectl_get get job -n "$ns" "$job_name" \ + -o jsonpath='{.status.conditions[?(@.type=="Complete")].status}') || rc=$? + if [[ $rc -eq 2 ]]; then + echo " ⏳ $job_name not yet visible in $ns (${elapsed}s elapsed)..." + sleep 10 + elapsed=$((elapsed + 10)) + continue + elif [[ $rc -ne 0 ]]; then + return 1 + fi + rc=0 + failed=$(kubectl_get get job -n "$ns" "$job_name" \ + -o jsonpath='{.status.conditions[?(@.type=="Failed")].status}') || rc=$? + if [[ $rc -eq 2 ]]; then + echo " ⏳ $job_name not yet visible in $ns (${elapsed}s elapsed)..." + sleep 10 + elapsed=$((elapsed + 10)) + continue + elif [[ $rc -ne 0 ]]; then + return 1 + fi [[ "$complete" == "True" ]] && { echo "✓ $job_name completed successfully"; return 0; } [[ "$failed" == "True" ]] && { echo "✗ $job_name failed" >&2 @@ -48,8 +90,14 @@ trigger_and_wait() { trigger_all_in_ns() { local ns=$1 - local cronjobs - cronjobs=$(kubectl get cronjobs -n "$ns" -o jsonpath='{.items[*].metadata.name}' 2>/dev/null || echo "") + local cronjobs rc=0 + cronjobs=$(kubectl_get get cronjobs -n "$ns" -o jsonpath='{.items[*].metadata.name}') || rc=$? + if [[ $rc -eq 2 ]]; then + echo "⏭ No CronJobs found in $ns — skipping" + return 0 + elif [[ $rc -ne 0 ]]; then + return 1 + fi if [[ -z "$cronjobs" ]]; then echo "⏭ No CronJobs found in $ns — skipping" return 0 @@ -60,26 +108,23 @@ trigger_all_in_ns() { } echo "================================================" -echo "eSignet 1.7.1 - Trigger Testrig CronJobs" +echo "eSignet Standalone 2.0.0 - Trigger Testrig CronJobs" echo "================================================" -echo "=== eSignet API Testrig (esignet-go-mock ns) ===" -trigger_all_in_ns esignet-go-mock || OVERALL_SUCCESS=false - -echo "=== eSignet-MOSIPID1 API Testrig (esignet-go-mosipid1 ns) ===" -trigger_all_in_ns esignet-go-mosipid1 || OVERALL_SUCCESS=false +echo "=== eSignet API Testrig (esignet-mock ns) ===" +trigger_all_in_ns esignet-mock || OVERALL_SUCCESS=false -echo "=== eSignet-MOSIPID2 API Testrig (esignet-go-mosipid2 ns) ===" -trigger_all_in_ns esignet-go-mosipid2 || OVERALL_SUCCESS=false +echo "=== eSignet-MOSIPID API Testrig (esignet-mosipid ns) ===" +trigger_all_in_ns esignet-mosipid || OVERALL_SUCCESS=false -echo "=== eSignet-Sunbird API Testrig (esignet-go-sunbird ns) ===" -trigger_all_in_ns esignet-go-sunbird || OVERALL_SUCCESS=false +echo "=== eSignet-Sunbird API Testrig (esignet-sunbird ns) ===" +trigger_all_in_ns esignet-sunbird || OVERALL_SUCCESS=false -echo "=== Signup API Testrig (signup-go ns, if deployed) ===" -trigger_all_in_ns signup-go || true +echo "=== Signup API Testrig (signup ns, if deployed) ===" +trigger_all_in_ns signup || OVERALL_SUCCESS=false -echo "=== Signup UI Testrig (signup-uitestrig-go ns, if deployed) ===" -trigger_all_in_ns signup-uitestrig-go || true +echo "=== Signup UI Testrig (signup-uitestrig ns, if deployed) ===" +trigger_all_in_ns signup-uitestrig || OVERALL_SUCCESS=false echo "" echo "=== Testrig Execution Summary ===" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh index c4f7ccf45..8564065a5 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Signup UI Testrig Pre-install Setup +# eSignet Standalone 2.0.0 - Signup UI Testrig Pre-install Setup # ============================================================================= # Prepares the signup-uitestrig namespace. # Copies keycloak resources from keycloak ns, MinIO s3 secret from minio ns, @@ -9,11 +9,11 @@ # ============================================================================= set -euo pipefail -NS=signup-uitestrig-go +NS=signup-uitestrig COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" -echo "eSignet 1.7.1 - Signup UI Testrig Pre-install" +echo "eSignet Standalone 2.0.0 - Signup UI Testrig Pre-install" echo "================================================" echo "Ensuring $NS namespace exists with Istio injection disabled" diff --git a/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid1-setup.sh b/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid-setup.sh similarity index 75% rename from Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid1-setup.sh rename to Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid-setup.sh index 89ef80915..a1047daa2 100755 --- a/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid1-setup.sh +++ b/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid-setup.sh @@ -1,19 +1,19 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet-MOSIPID1 API Testrig Pre-install Setup +# eSignet 1.7.1 - eSignet-MOSIPID API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-mosipid1 namespace for the esignet-mosipid1-apitestrig release. -# keycloak-host and keycloak-client-secrets are already present in esignet-mosipid1 +# Prepares the esignet-mosipid namespace for the esignet-mosipid-apitestrig release. +# keycloak-host and keycloak-client-secrets are already present in esignet-mosipid # (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql # needs to be copied; stale testrig CMs are deleted so the chart recreates them. # ============================================================================= set -euo pipefail -NS=esignet-mosipid1 +NS=esignet-mosipid COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" -echo "eSignet 1.7.1 - eSignet-MOSIPID1 API Testrig Pre-install" +echo "eSignet 1.7.1 - eSignet-MOSIPID API Testrig Pre-install" echo "================================================" echo "Deleting stale testrig configmaps in $NS" @@ -24,4 +24,4 @@ kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig echo "Copying postgres-postgresql secret to $NS" $COPY_UTIL secret postgres-postgresql postgres "$NS" -echo "eSignet-MOSIPID1 API Testrig pre-install setup completed." +echo "eSignet-MOSIPID API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid2-setup.sh b/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid2-setup.sh deleted file mode 100755 index 9f5f75258..000000000 --- a/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid2-setup.sh +++ /dev/null @@ -1,27 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - eSignet-MOSIPID2 API Testrig Pre-install Setup -# ============================================================================= -# Prepares the esignet-mosipid2 namespace for the esignet-mosipid2-apitestrig release. -# keycloak-host and keycloak-client-secrets are already present in esignet-mosipid2 -# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql -# needs to be copied; stale testrig CMs are deleted so the chart recreates them. -# ============================================================================= -set -euo pipefail - -NS=esignet-mosipid2 -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" - -echo "================================================" -echo "eSignet 1.7.1 - eSignet-MOSIPID2 API Testrig Pre-install" -echo "================================================" - -echo "Deleting stale testrig configmaps in $NS" -kubectl -n "$NS" delete --ignore-not-found=true configmap s3 -kubectl -n "$NS" delete --ignore-not-found=true configmap db -kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig - -echo "Copying postgres-postgresql secret to $NS" -$COPY_UTIL secret postgres-postgresql postgres "$NS" - -echo "eSignet-MOSIPID2 API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone/config-server-esignet-postinstall.sh b/Helmsman/hooks/esignet-standalone/config-server-esignet-postinstall.sh deleted file mode 100755 index 1c799425e..000000000 --- a/Helmsman/hooks/esignet-standalone/config-server-esignet-postinstall.sh +++ /dev/null @@ -1,39 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - Config-Server eSignet Post-install -# ============================================================================= -# Copies esignet-config-server-share CM from esignet-mock ns to mosipid1/mosipid2/sunbird, -# then patches active_profile_env and spring_config_label_env per namespace -# so each instance points to the correct config server profile and Git label. -# -# Environment variables (set in GitHub Actions workflow): -# ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL - Git label for esignet-mosipid1 (default: develop) -# ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL - Git label for esignet-mosipid2 (default: develop) -# ============================================================================= -set -euo pipefail - -SOURCE_NS="esignet-mock" -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -CM_NAME="esignet-config-server-share" - -MOSIPID1_SPRING_LABEL="${ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL:-develop}" -MOSIPID2_SPRING_LABEL="${ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL:-develop}" - -echo "================================================" -echo "eSignet 1.7.1 - Config-Server eSignet Post-install" -echo "================================================" - -for TARGET_NS in esignet-mosipid1 esignet-mosipid2 esignet-sunbird; do - echo "Copying $CM_NAME from $SOURCE_NS to $TARGET_NS" - $COPY_UTIL configmap "$CM_NAME" "$SOURCE_NS" "$TARGET_NS" -done - -echo "Patching $CM_NAME in esignet-mosipid1 (active_profile_env=mosipid1, spring_config_label_env=$MOSIPID1_SPRING_LABEL)" -kubectl -n esignet-mosipid1 patch configmap "$CM_NAME" --type merge \ - -p "{\"data\":{\"active_profile_env\":\"mosipid1\",\"spring_config_label_env\":\"$MOSIPID1_SPRING_LABEL\"}}" - -echo "Patching $CM_NAME in esignet-mosipid2 (active_profile_env=mosipid2, spring_config_label_env=$MOSIPID2_SPRING_LABEL)" -kubectl -n esignet-mosipid2 patch configmap "$CM_NAME" --type merge \ - -p "{\"data\":{\"active_profile_env\":\"mosipid2\",\"spring_config_label_env\":\"$MOSIPID2_SPRING_LABEL\"}}" - -echo "Config-server share configmap propagation and patching completed." diff --git a/Helmsman/hooks/esignet-standalone/config-server-esignet-setup.sh b/Helmsman/hooks/esignet-standalone/config-server-esignet-setup.sh deleted file mode 100755 index ee1798d92..000000000 --- a/Helmsman/hooks/esignet-standalone/config-server-esignet-setup.sh +++ /dev/null @@ -1,78 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - Config-Server eSignet Pre-install -# ============================================================================= -# Based on: esignet/deploy/config-server/install.sh -# -# Prepares esignet namespace for config-server deployment: -# 1. Ensures namespace exists with Istio injection enabled -# 2. Copies db-common-secrets from postgres ns -# 3. Creates esignet-global ConfigMap from workflow env vars -# (domain_name set by helmsman_esignet.yml; available as shell env var -# in all hooks run within the same workflow step) -# 4. Pre-creates empty esignet-misp-onboarder-key secret as placeholder -# (MISP onboarder at priority -6 writes the real key; config-server is -# restarted by esignet-misp-onboarder-postinstall.sh afterwards) -# -# NOTE: esignet-softhsm secret is NOT copied here — the softhsm helm chart -# installs directly into the esignet namespace, so no cross-namespace copy needed. -# -# NOTE: keycloak resources (keycloak-host, keycloak-env-vars, keycloak, -# keycloak-client-secrets) are NOT copied here. They are populated in all -# esignet namespaces by esignet-postinstall-keycloak-init.sh which runs as -# part of external-dsf (esignet-keycloak-init at priority -11 in keycloak ns). -# By the time esignet-dsf runs, these resources are already present. -# -# Environment Variables: -# ESIGNET_NS - eSignet namespace (default: esignet) -# domain_name - base domain (set by workflow, e.g. sandbox.example.net) -# ============================================================================= -set -euo pipefail - -ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" -POSTGRES_NS="postgres" -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" - -echo "================================================" -echo "eSignet 1.7.1 - Config-Server eSignet Pre-install" -echo "================================================" - -# --- Step 1: Ensure namespace with Istio --- -kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - -kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite - -# --- Step 2: Copy db-common-secrets --- -# NOTE: esignet-softhsm secret is NOT copied here — the softhsm helm chart -# creates it directly in the esignet namespace as a helm-managed resource. -echo "Copying db-common-secrets from $POSTGRES_NS" -$COPY_UTIL secret db-common-secrets "$POSTGRES_NS" "$ESIGNET_NS" - -# --- Step 3: Create esignet-global from workflow env vars --- -# domain_name is exported by the helmsman_esignet.yml workflow step -echo "Creating esignet-global configmap (domain_name=${domain_name:-UNSET})" -kubectl -n "$ESIGNET_NS" create configmap esignet-global \ - --from-literal=installation-domain="${domain_name}" \ - --from-literal=mosip-api-host="api.${domain_name}" \ - --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet.${domain_name}" \ - --from-literal=mosip-iam-external-host="iam.${domain_name}" \ - --from-literal=mosip-kafka-host="kafka.${domain_name}" \ - --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup.${domain_name}" \ - --from-literal=mosip-smtp-host="smtp.${domain_name}" \ - --from-literal=mosip-version="develop" \ - --dry-run=client -o yaml | kubectl apply -f - -echo "esignet-global created/updated." - -# --- Step 4: Pre-create empty MISP key secret as placeholder --- -# Allows config-server pod to start. Real value written by MISP onboarder (-6). -# esignet-misp-onboarder-postinstall.sh restarts config-server after writing. -if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then - kubectl -n "$ESIGNET_NS" create secret generic esignet-misp-onboarder-key \ - --from-literal=mosip-esignet-misp-key="" - echo "esignet-misp-onboarder-key placeholder created." -else - echo "esignet-misp-onboarder-key already exists, skipping placeholder." -fi - -echo "Config-server eSignet pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone/esignet-db-postinstall.sh b/Helmsman/hooks/esignet-standalone/esignet-db-postinstall.sh index cf716aa72..a671a62c8 100755 --- a/Helmsman/hooks/esignet-standalone/esignet-db-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone/esignet-db-postinstall.sh @@ -15,7 +15,7 @@ echo "================================================" echo "eSignet 1.7.1 - Database Init Post-install" echo "================================================" -for NS in esignet-mock esignet-mosipid1 esignet-mosipid2 esignet-sunbird; do +for NS in esignet-mock esignet-mosipid esignet-sunbird; do echo "Copying db-common-secrets from $POSTGRES_NS to $NS" $COPY_UTIL secret db-common-secrets "$POSTGRES_NS" "$NS" done diff --git a/Helmsman/hooks/esignet-standalone/esignet-init-db.sh b/Helmsman/hooks/esignet-standalone/esignet-init-db.sh index d382f7848..9c15c6fb5 100755 --- a/Helmsman/hooks/esignet-standalone/esignet-init-db.sh +++ b/Helmsman/hooks/esignet-standalone/esignet-init-db.sh @@ -7,7 +7,7 @@ # postgres-postgresql secret natively. This hook pre-creates all esignet-mock # namespaces so the postInstall hook can copy db-common-secrets into each. # Namespaces are created here at priority -16 because the namespace-specific -# preinstall hooks (esignet-mosipid1/mosipid2/sunbird) only run at priority -14. +# preinstall hooks (esignet-mosipid/sunbird) only run at priority -14. # ============================================================================= set -euo pipefail @@ -15,7 +15,7 @@ echo "================================================" echo "eSignet 1.7.1 - Database Init Pre-install" echo "================================================" -for NS in esignet-mock esignet-mosipid1 esignet-mosipid2 esignet-sunbird; do +for NS in esignet-mock esignet-mosipid esignet-sunbird; do kubectl create namespace "$NS" --dry-run=client -o yaml | kubectl apply -f - kubectl label namespace "$NS" istio-injection=enabled --overwrite echo "Namespace $NS ready." diff --git a/Helmsman/hooks/esignet-standalone/esignet-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone/esignet-mosipid-preinstall.sh similarity index 53% rename from Helmsman/hooks/esignet-standalone/esignet-mosipid1-preinstall.sh rename to Helmsman/hooks/esignet-standalone/esignet-mosipid-preinstall.sh index e768ad1d8..ef54cc13a 100755 --- a/Helmsman/hooks/esignet-standalone/esignet-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone/esignet-mosipid-preinstall.sh @@ -1,41 +1,41 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet MOSIPID1 Service Pre-install +# eSignet 1.7.1 - eSignet MOSIPID Service Pre-install # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid1, runs base esignet preinstall (copies -# postgres + redis config/secrets), then creates esignet-captcha-mosipid1 secret -# in the captcha namespace from workflow env vars, copies it to esignet-mosipid1, -# and patches the captcha deployment with the MOSIPID1 secret key. +# Wrapper: sets ESIGNET_NS=esignet-mosipid, runs base esignet preinstall (copies +# postgres + redis config/secrets), then creates esignet-captcha-mosipid secret +# in the captcha namespace from workflow env vars, copies it to esignet-mosipid, +# and patches the captcha deployment with the MOSIPID secret key. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-mosipid1" +export ESIGNET_NS="esignet-mosipid" CAPTCHA_NS="captcha" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY must be set}" -CAPTCHA_SECRET_KEY="${ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY must be set}" -MOSIPID1_POSTGRES_PASS="${MOSIPID1_POSTGRES_PASSWORD:?ERROR: MOSIPID1_POSTGRES_PASSWORD must be set}" -MOSIPID1_KC_ADMIN_PASS="${MOSIPID1_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID1_KEYCLOAK_ADMIN_PASSWORD must be set}" +CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID_CAPTCHA_SITE_KEY must be set}" +CAPTCHA_SECRET_KEY="${ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY must be set}" +MOSIPID_POSTGRES_PASS="${MOSIPID_POSTGRES_PASSWORD:?ERROR: MOSIPID_POSTGRES_PASSWORD must be set}" +MOSIPID_KC_ADMIN_PASS="${MOSIPID_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID_KEYCLOAK_ADMIN_PASSWORD must be set}" "$WORKDIR/hooks/esignet-standalone/esignet-preinstall.sh" -# Create MOSIPID1-specific esignet-global — same domain_name, but esignet/signup hosts differ +# Create MOSIPID-specific esignet-global — same domain_name, but esignet/signup hosts differ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ --from-literal=installation-domain="${domain_name}" \ --from-literal=mosip-api-host="api.${domain_name}" \ --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet-mosipid1.${domain_name}" \ + --from-literal=mosip-esignet-host="esignet-mosipid.${domain_name}" \ --from-literal=mosip-iam-external-host="iam.${domain_name}" \ --from-literal=mosip-kafka-host="kafka.${domain_name}" \ --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup-mosipid1.${domain_name}" \ + --from-literal=mosip-signup-host="signup-mosipid.${domain_name}" \ --from-literal=mosip-smtp-host="smtp.${domain_name}" \ --from-literal=mosip-version="develop" \ --dry-run=client -o yaml | kubectl apply -f - -# Override postgres-config with MOSIPID1-specific DB values +# Override postgres-config with MOSIPID-specific DB values kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_mosipid1","database-username":"esignetuser_mosipid1"}}' + -p '{"data":{"database-name":"mosip_esignet_mosipid","database-username":"esignetuser_mosipid"}}' # Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then @@ -44,50 +44,66 @@ if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" fi -echo "Creating esignet-captcha-mosipid1 secret in $CAPTCHA_NS namespace" -kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-mosipid1 \ +echo "Creating esignet-captcha-mosipid secret in $CAPTCHA_NS namespace" +kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-mosipid \ --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ --dry-run=client -o yaml | kubectl apply -f - -echo "Copying esignet-captcha-mosipid1 secret from $CAPTCHA_NS to $ESIGNET_NS" -$COPY_UTIL secret esignet-captcha-mosipid1 "$CAPTCHA_NS" "$ESIGNET_NS" +echo "Copying esignet-captcha-mosipid secret from $CAPTCHA_NS to $ESIGNET_NS" +$COPY_UTIL secret esignet-captcha-mosipid "$CAPTCHA_NS" "$ESIGNET_NS" + +echo "Patching captcha deployment with ESIGNETMOSIPID secret key" + +# Remove stale pre-consolidation env var names if still present, so they don't +# linger pointing at secrets that no longer exist (esignet-mosipid1 was renamed +# to esignet-mosipid; esignet-mosipid2 was removed). +for OLD_NAME in MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID1 MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID2; do + OLD_ENV_INDEX=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ + -o jsonpath="{range .spec.template.spec.containers[0].env[*]}{.name}{'\n'}{end}" 2>/dev/null \ + | grep -n -x "$OLD_NAME" | cut -d: -f1 || echo "") + if [[ -n "$OLD_ENV_INDEX" ]]; then + OLD_ENV_ARRAY_INDEX=$((OLD_ENV_INDEX - 1)) + echo "Removing stale $OLD_NAME env var (index $OLD_ENV_ARRAY_INDEX)" + kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ + -p="[{\"op\": \"remove\", \"path\": \"/spec/template/spec/containers/0/env/$OLD_ENV_ARRAY_INDEX\"}]" + fi +done -echo "Patching captcha deployment with ESIGNETMOSIPID1 secret key" ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ - -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID1')].name}" 2>/dev/null || echo "") + -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID')].name}" 2>/dev/null || echo "") if [[ -z "$ENV_VAR_EXISTS" ]]; then kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID1", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-mosipid1", "key": "esignet-captcha-secret-key"}}}}]' + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-mosipid", "key": "esignet-captcha-secret-key"}}}}]' else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID1 already exists." + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID already exists." fi -# --- postgres-postgresql-mosipid1 secret (MOSIPID1 remote postgres password) --- -echo "Creating postgres-postgresql-mosipid1 secret in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create secret generic postgres-postgresql-mosipid1 \ - --from-literal=postgres-password="${MOSIPID1_POSTGRES_PASS}" \ +# --- postgres-postgresql-mosipid secret (MOSIPID remote postgres password) --- +echo "Creating postgres-postgresql-mosipid secret in $ESIGNET_NS" +kubectl -n "$ESIGNET_NS" create secret generic postgres-postgresql-mosipid \ + --from-literal=postgres-password="${MOSIPID_POSTGRES_PASS}" \ --dry-run=client -o yaml | kubectl apply -f - -# --- keycloak-host-mosipid1 CM (external URL points to MOSIPID1 Keycloak) --- -echo "Creating keycloak-host-mosipid1 configmap in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create configmap keycloak-host-mosipid1 \ - --from-literal=keycloak-external-host="iam.${mosipid1_domain_name}" \ - --from-literal=keycloak-external-url="https://iam.${mosipid1_domain_name}" \ +# --- keycloak-host-mosipid CM (external URL points to MOSIPID Keycloak) --- +echo "Creating keycloak-host-mosipid configmap in $ESIGNET_NS" +kubectl -n "$ESIGNET_NS" create configmap keycloak-host-mosipid \ + --from-literal=keycloak-external-host="iam.${mosipid_domain_name}" \ + --from-literal=keycloak-external-url="https://iam.${mosipid_domain_name}" \ --from-literal=keycloak-internal-host="keycloak.keycloak" \ --from-literal=keycloak-internal-service-url="http://keycloak.keycloak/auth/" \ --from-literal=keycloak-internal-url="http://keycloak.keycloak" \ --dry-run=client -o yaml | kubectl apply -f - -# --- keycloak-client-secrets-mosipid1: fetch all confidential clients from MOSIPID1 Keycloak --- -KC_HOST="iam.${mosipid1_domain_name}" +# --- keycloak-client-secrets-mosipid: fetch all confidential clients from MOSIPID Keycloak --- +KC_HOST="iam.${mosipid_domain_name}" REALM="mosip" echo "Fetching admin token from $KC_HOST" TOKEN_RESPONSE=$(curl -sf -X POST \ "https://${KC_HOST}/auth/realms/master/protocol/openid-connect/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ - -d "grant_type=password&client_id=admin-cli&username=admin&password=${MOSIPID1_KC_ADMIN_PASS}") + -d "grant_type=password&client_id=admin-cli&username=admin&password=${MOSIPID_KC_ADMIN_PASS}") ADMIN_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.access_token') if [[ -z "$ADMIN_TOKEN" || "$ADMIN_TOKEN" == "null" ]]; then echo "❌ Failed to get admin token from $KC_HOST" >&2; exit 1 @@ -116,12 +132,12 @@ while IFS= read -r client_json; do done < <(echo "$CLIENTS" | jq -c '.[]') if [[ ${#SECRET_ARGS[@]} -eq 0 ]]; then - echo "❌ No client secrets fetched from MOSIPID1 Keycloak" >&2; exit 1 + echo "❌ No client secrets fetched from MOSIPID Keycloak" >&2; exit 1 fi -echo "Creating keycloak-client-secrets-mosipid1 in $ESIGNET_NS (${#SECRET_ARGS[@]} clients)" -kubectl -n "$ESIGNET_NS" create secret generic keycloak-client-secrets-mosipid1 \ +echo "Creating keycloak-client-secrets-mosipid in $ESIGNET_NS (${#SECRET_ARGS[@]} clients)" +kubectl -n "$ESIGNET_NS" create secret generic keycloak-client-secrets-mosipid \ "${SECRET_ARGS[@]}" \ --dry-run=client -o yaml | kubectl apply -f - -echo "✓ keycloak-client-secrets-mosipid1 created" +echo "✓ keycloak-client-secrets-mosipid created" -echo "eSignet MOSIPID1 pre-install completed." +echo "eSignet MOSIPID pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone/esignet-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone/esignet-mosipid2-preinstall.sh deleted file mode 100755 index 4580db97e..000000000 --- a/Helmsman/hooks/esignet-standalone/esignet-mosipid2-preinstall.sh +++ /dev/null @@ -1,127 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - eSignet MOSIPID2 Service Pre-install -# ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid2, runs base esignet preinstall (copies -# postgres + redis config/secrets), then creates esignet-captcha-mosipid2 secret -# in the captcha namespace from workflow env vars, copies it to esignet-mosipid2, -# and patches the captcha deployment with the MOSIPID2 secret key. -# ============================================================================= -set -euo pipefail - -export ESIGNET_NS="esignet-mosipid2" -CAPTCHA_NS="captcha" -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY must be set}" -CAPTCHA_SECRET_KEY="${ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY must be set}" -MOSIPID2_POSTGRES_PASS="${MOSIPID2_POSTGRES_PASSWORD:?ERROR: MOSIPID2_POSTGRES_PASSWORD must be set}" -MOSIPID2_KC_ADMIN_PASS="${MOSIPID2_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID2_KEYCLOAK_ADMIN_PASSWORD must be set}" - -"$WORKDIR/hooks/esignet-standalone/esignet-preinstall.sh" - -# Create MOSIPID2-specific esignet-global — same domain_name, but esignet/signup hosts differ -kubectl -n "$ESIGNET_NS" create configmap esignet-global \ - --from-literal=installation-domain="${domain_name}" \ - --from-literal=mosip-api-host="api.${domain_name}" \ - --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet-mosipid2.${domain_name}" \ - --from-literal=mosip-iam-external-host="iam.${domain_name}" \ - --from-literal=mosip-kafka-host="kafka.${domain_name}" \ - --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup-mosipid2.${domain_name}" \ - --from-literal=mosip-smtp-host="smtp.${domain_name}" \ - --from-literal=mosip-version="develop" \ - --dry-run=client -o yaml | kubectl apply -f - - -# Override postgres-config with MOSIPID2-specific DB values -kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_mosipid2","database-username":"esignetuser_mosipid2"}}' - -# Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. -if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then - kubectl -n "$ESIGNET_NS" create secret generic esignet-misp-onboarder-key \ - --from-literal=mosip-esignet-misp-key="" - echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" -fi - -echo "Creating esignet-captcha-mosipid2 secret in $CAPTCHA_NS namespace" -kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-mosipid2 \ - --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ - --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ - --dry-run=client -o yaml | kubectl apply -f - - -echo "Copying esignet-captcha-mosipid2 secret from $CAPTCHA_NS to $ESIGNET_NS" -$COPY_UTIL secret esignet-captcha-mosipid2 "$CAPTCHA_NS" "$ESIGNET_NS" - -echo "Patching captcha deployment with ESIGNETMOSIPID2 secret key" -ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ - -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID2')].name}" 2>/dev/null || echo "") -if [[ -z "$ENV_VAR_EXISTS" ]]; then - kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID2", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-mosipid2", "key": "esignet-captcha-secret-key"}}}}]' -else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID2 already exists." -fi - -# --- postgres-postgresql-mosipid2 secret (MOSIPID2 remote postgres password) --- -echo "Creating postgres-postgresql-mosipid2 secret in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create secret generic postgres-postgresql-mosipid2 \ - --from-literal=postgres-password="${MOSIPID2_POSTGRES_PASS}" \ - --dry-run=client -o yaml | kubectl apply -f - - -# --- keycloak-host-mosipid2 CM (external URL points to MOSIPID2 Keycloak) --- -echo "Creating keycloak-host-mosipid2 configmap in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create configmap keycloak-host-mosipid2 \ - --from-literal=keycloak-external-host="iam.${mosipid2_domain_name}" \ - --from-literal=keycloak-external-url="https://iam.${mosipid2_domain_name}" \ - --from-literal=keycloak-internal-host="keycloak.keycloak" \ - --from-literal=keycloak-internal-service-url="http://keycloak.keycloak/auth/" \ - --from-literal=keycloak-internal-url="http://keycloak.keycloak" \ - --dry-run=client -o yaml | kubectl apply -f - - -# --- keycloak-client-secrets-mosipid2: fetch all confidential clients from MOSIPID2 Keycloak --- -KC_HOST="iam.${mosipid2_domain_name}" -REALM="mosip" - -echo "Fetching admin token from $KC_HOST" -TOKEN_RESPONSE=$(curl -sf -X POST \ - "https://${KC_HOST}/auth/realms/master/protocol/openid-connect/token" \ - -H "Content-Type: application/x-www-form-urlencoded" \ - -d "grant_type=password&client_id=admin-cli&username=admin&password=${MOSIPID2_KC_ADMIN_PASS}") -ADMIN_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.access_token') -if [[ -z "$ADMIN_TOKEN" || "$ADMIN_TOKEN" == "null" ]]; then - echo "❌ Failed to get admin token from $KC_HOST" >&2; exit 1 -fi -echo "✓ Admin token obtained" - -echo "Fetching all clients from realm $REALM on $KC_HOST" -CLIENTS=$(curl -sf \ - "https://${KC_HOST}/auth/admin/realms/${REALM}/clients?max=500" \ - -H "Authorization: Bearer $ADMIN_TOKEN") - -SECRET_ARGS=() -while IFS= read -r client_json; do - client_id=$(echo "$client_json" | jq -r '.clientId') - uuid=$(echo "$client_json" | jq -r '.id') - auth_type=$(echo "$client_json" | jq -r '.clientAuthenticatorType') - is_public=$(echo "$client_json" | jq -r '.publicClient') - [[ "$auth_type" != "client-secret" || "$is_public" == "true" ]] && continue - secret_val=$(curl -sf \ - "https://${KC_HOST}/auth/admin/realms/${REALM}/clients/${uuid}/client-secret" \ - -H "Authorization: Bearer $ADMIN_TOKEN" | jq -r '.value // empty') - [[ -z "$secret_val" || "$secret_val" == "null" ]] && continue - key=$(echo "$client_id" | tr '-' '_')_secret - SECRET_ARGS+=("--from-literal=${key}=${secret_val}") - echo " ✓ $client_id" -done < <(echo "$CLIENTS" | jq -c '.[]') - -if [[ ${#SECRET_ARGS[@]} -eq 0 ]]; then - echo "❌ No client secrets fetched from MOSIPID2 Keycloak" >&2; exit 1 -fi -echo "Creating keycloak-client-secrets-mosipid2 in $ESIGNET_NS (${#SECRET_ARGS[@]} clients)" -kubectl -n "$ESIGNET_NS" create secret generic keycloak-client-secrets-mosipid2 \ - "${SECRET_ARGS[@]}" \ - --dry-run=client -o yaml | kubectl apply -f - -echo "✓ keycloak-client-secrets-mosipid2 created" - -echo "eSignet MOSIPID2 pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone/esignet-postinstall-keycloak-init.sh b/Helmsman/hooks/esignet-standalone/esignet-postinstall-keycloak-init.sh index 811b19841..42357fd22 100755 --- a/Helmsman/hooks/esignet-standalone/esignet-postinstall-keycloak-init.sh +++ b/Helmsman/hooks/esignet-standalone/esignet-postinstall-keycloak-init.sh @@ -10,7 +10,7 @@ KEYCLOAK_NS="keycloak" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" # All esignet-mock namespaces that need keycloak resources -ESIGNET_NAMESPACES=(esignet-mock esignet-mosipid1 esignet-mosipid2 esignet-sunbird) +ESIGNET_NAMESPACES=(esignet-mock esignet-mosipid esignet-sunbird) echo "================================================" echo "eSignet 1.7.1 - Keycloak Init Post-install" diff --git a/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid-preinstall.sh similarity index 69% rename from Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid1-preinstall.sh rename to Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid-preinstall.sh index 001e00f21..86300fb61 100755 --- a/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid-preinstall.sh @@ -1,10 +1,10 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party Service MOSIPID1 Pre-install +# eSignet 1.7.1 - Mock Relying Party Service MOSIPID Pre-install # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base mock-rp-service +# Wrapper: sets ESIGNET_NS=esignet-mosipid and delegates to base mock-rp-service # preinstall (creates private key secrets in the target namespace). # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-mosipid1" +export ESIGNET_NS="esignet-mosipid" exec "$WORKDIR/hooks/esignet-standalone/mock-relying-party-service-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid2-preinstall.sh deleted file mode 100755 index b8cbdf9fa..000000000 --- a/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid2-preinstall.sh +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - Mock Relying Party Service MOSIPID2 Pre-install -# ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base mock-rp-service -# preinstall (creates private key secrets in the target namespace). -# ============================================================================= -set -euo pipefail -export ESIGNET_NS="esignet-mosipid2" -exec "$WORKDIR/hooks/esignet-standalone/mock-relying-party-service-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid-preinstall.sh similarity index 66% rename from Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid1-preinstall.sh rename to Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid-preinstall.sh index dd3affbea..c00337b89 100755 --- a/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid-preinstall.sh @@ -1,16 +1,16 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party UI MOSIPID1 Pre-install +# eSignet 1.7.1 - Mock Relying Party UI MOSIPID Pre-install # ============================================================================= -# Ensures esignet-mosipid1 namespace exists and verifies mock-relying-party-service -# is available in the esignet-mosipid1 namespace before UI deployment. +# Ensures esignet-mosipid namespace exists and verifies mock-relying-party-service +# is available in the esignet-mosipid namespace before UI deployment. # ============================================================================= set -euo pipefail -ESIGNET_NS="esignet-mosipid1" +ESIGNET_NS="esignet-mosipid" echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID1 Pre-install" +echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - @@ -21,4 +21,4 @@ else echo "WARNING: Mock relying party service not found in $ESIGNET_NS. UI depends on the service being deployed." fi -echo "Mock relying party UI MOSIPID1 pre-install completed." +echo "Mock relying party UI MOSIPID pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid-preinstall.sh similarity index 66% rename from Helmsman/hooks/esignet-standalone/oidc-ui-mosipid1-preinstall.sh rename to Helmsman/hooks/esignet-standalone/oidc-ui-mosipid-preinstall.sh index 6a93a51ed..f7e4aac72 100755 --- a/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid-preinstall.sh @@ -1,9 +1,9 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - OIDC UI MOSIPID1 Pre-install +# eSignet 1.7.1 - OIDC UI MOSIPID Pre-install # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base oidc-ui preinstall. +# Wrapper: sets ESIGNET_NS=esignet-mosipid and delegates to base oidc-ui preinstall. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-mosipid1" +export ESIGNET_NS="esignet-mosipid" exec "$WORKDIR/hooks/esignet-standalone/oidc-ui-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid2-preinstall.sh deleted file mode 100755 index 6afd2350d..000000000 --- a/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid2-preinstall.sh +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - OIDC UI MOSIPID2 Pre-install -# ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base oidc-ui preinstall. -# ============================================================================= -set -euo pipefail -export ESIGNET_NS="esignet-mosipid2" -exec "$WORKDIR/hooks/esignet-standalone/oidc-ui-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone/pms-partner-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone/pms-partner-mosipid1-preinstall.sh deleted file mode 100755 index c5faefc5c..000000000 --- a/Helmsman/hooks/esignet-standalone/pms-partner-mosipid1-preinstall.sh +++ /dev/null @@ -1,45 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - PMS Partner MOSIPID1 Pre-install -# ============================================================================= -# Creates the Istio Gateway for pms-partner in esignet-mosipid1 namespace. -# ============================================================================= -set -euo pipefail - -ESIGNET_NS="esignet-mosipid1" - -echo "================================================" -echo "eSignet 1.7.1 - PMS Partner MOSIPID1 Pre-install" -echo "================================================" - -kubectl apply -f - <- - {{ "{{" }} 'id': 'mobile', 'svg': 'mobile_icon', 'prefixes': {{ "{{" }}'label': - 'IND', 'value': '+91', 'maxLength': '', 'regex': ''},{'label': - 'KHM', 'value': '+855', 'regex': ''{{ "}}" }}, 'postfix': '@phone', - 'maxLength': '', 'regex': '' }, { 'id': 'nrc', 'svg': - 'nrc_id_icon', 'prefixes': '', 'postfix': '@nrc', 'maxLength': - '', 'regex': '' }, { 'id': 'vid', 'svg': 'vid_icon', 'prefixes': - '', 'postfix': '', 'maxLength': '', 'regex': '' }, { 'id': - 'email', 'svg': 'email_icon', 'prefixes': '', 'postfix': - '@email', 'maxLength': '', 'regex': '' {{ "}}" }} - - name: LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT - value: DEBUG - - name: MOSIP_ESIGNET_CAPTCHA_REQUIRED - value: "" - - name: MOSIP_ESIGNET_CAPTCHA_URL - value: http://captcha.captcha - - name: "MOSIP_ESIGNET_MISP_KEY" - valueFrom: - secretKeyRef: - name: esignet-misp-onboarder-key - key: mosip-esignet-misp-key - diff --git a/Helmsman/utils/esignet-standalone-2.0.0/config-server-esignet-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/config-server-esignet-values-2-0-0.yaml deleted file mode 100644 index 45598cc92..000000000 --- a/Helmsman/utils/esignet-standalone-2.0.0/config-server-esignet-values-2-0-0.yaml +++ /dev/null @@ -1,139 +0,0 @@ -# Config-server values for eSignet standalone profile. -# Based on: esignet/deploy/config-server/values.yaml -# -# Domain values (API_HOST, ESIGNET_HOST, etc.) are read from the -# esignet-global ConfigMap created by config-server-esignet-setup.sh -# from workflow env vars — no static domain values here. -# -# envVariables is a Helm list — this file is the single source of truth for -# all entries. Do NOT partially override via a second -f file; it replaces -# the whole list. - -gitRepo: - uri: https://github.com/mosip/mosip-config - version: esqa-2 - searchFolders: "" - private: false - username: "" - token: "" - -resources: - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - limits: - cpu: 400m - memory: 2000Mi - requests: - cpu: 200m - memory: 1500Mi - -envVariables: - - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_DB_DBUSER_PASSWORD - valueFrom: - secretKeyRef: - name: db-common-secrets - key: db-dbuser-password - enabled: true - - - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MOSIP_API_PUBLIC_HOST - valueFrom: - configMapKeyRef: - name: esignet-global - key: mosip-api-host - enabled: true - - - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MOSIP_API_INTERNAL_HOST - valueFrom: - configMapKeyRef: - name: esignet-global - key: mosip-api-internal-host - enabled: true - - - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_KEYCLOAK_INTERNAL_URL - valueFrom: - configMapKeyRef: - name: keycloak-host - key: keycloak-internal-url - enabled: true - - - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_KEYCLOAK_EXTERNAL_URL - valueFrom: - configMapKeyRef: - name: keycloak-host - key: keycloak-external-url - enabled: true - - - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MOSIP_ESIGNET_HOST - valueFrom: - configMapKeyRef: - name: esignet-global - key: mosip-esignet-host - enabled: true - - - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_KEYCLOAK_INTERNAL_HOST - valueFrom: - configMapKeyRef: - name: keycloak-host - key: keycloak-internal-host - enabled: true - - - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_KEYCLOAK_EXTERNAL_HOST - valueFrom: - configMapKeyRef: - name: keycloak-host - key: keycloak-external-host - enabled: true - - - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MPARTNER_DEFAULT_AUTH_SECRET - valueFrom: - secretKeyRef: - name: keycloak-client-secrets - key: mpartner_default_auth_secret - enabled: true - - - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_SOFTHSM_ESIGNET_SECURITY_PIN - valueFrom: - secretKeyRef: - name: esignet-softhsm-go - key: security-pin - enabled: true - - - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_ESIGNET_CAPTCHA_SECRET_KEY - valueFrom: - secretKeyRef: - name: esignet-captcha-go - key: esignet-captcha-secret-key - enabled: true - - - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_ESIGNET_CAPTCHA_SITE_KEY - valueFrom: - secretKeyRef: - name: esignet-captcha-go - key: esignet-captcha-site-key - enabled: true - - # Placeholder until MISP onboarder runs (priority -6). - # After onboarder writes the real key, config-server is restarted by - # esignet-misp-onboarder-postinstall.sh so the updated secret is loaded. - - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MOSIP_ESIGNET_MISP_KEY - valueFrom: - secretKeyRef: - name: esignet-misp-onboarder-key - key: mosip-esignet-misp-key - enabled: true - - - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MOSIP_PMS_CLIENT_SECRET - valueFrom: - secretKeyRef: - name: keycloak-client-secrets - key: mosip_pms_client_secret - enabled: true - - - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MOSIP_SIGNUP_HOST - valueFrom: - configMapKeyRef: - name: esignet-global - key: mosip-signup-host - enabled: true diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml deleted file mode 100644 index efeb38505..000000000 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml +++ /dev/null @@ -1,140 +0,0 @@ -# eSignet MOSIPID1 — plugin 2 (mosip-identity-plugin) runtime configuration. -# pluginNameEnv=mosip-identity-plugin.jar set in DSF set: block. -# Update IDA service URLs below to match your MOSIP IDA deployment. - -# Override full extraEnvVars to use namespace-specific softhsm secret name. -extraEnvVars: - - name: KEYCLOAK_EXTERNAL_URL - valueFrom: - configMapKeyRef: - name: keycloak-host - key: keycloak-external-url - - name: MOSIP_ESIGNET_CAPTCHA_MODULE_NAME - value: esignet - - name: REDIS_HOST - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-host - - name: REDIS_PORT - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-port - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: redis - key: redis-password - - name: DATABASE_HOST - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-host - - name: DATABASE_PORT - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-port - - name: DATABASE_NAME - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-name - - name: DATABASE_USERNAME - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-username - - name: DB_DBUSER_PASSWORD - valueFrom: - secretKeyRef: - name: db-common-secrets - key: db-dbuser-password - - name: SOFTHSM_ESIGNET_SECURITY_PIN - valueFrom: - secretKeyRef: - name: esignet-softhsm-go-mosipid1 - key: security-pin - - name: MOSIP_IDA_CLIENT_SECRET - valueFrom: - secretKeyRef: - name: keycloak-client-secrets-mosipid1 - key: mosip_ida_client_secret - - name: AUTHN_PROVIDER - value: mosip - - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/esignet.pfx - - name: MOSIP_P12_PASSWORD - value: localtest - - name: OIDC_UI_SCHEME - value: https - - name: CRYPTO_ENCRYPTION_KEY - value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e - - name: OIDC_UI_PORT - value: '443' - - name: OIDC_UI_LOGIN_PATH - value: /signin - - name: OIDC_UI_ERROR_PATH - value: /error - - name: DEFAULT_THEME_ID - value: decl-theme-1 - - name: DEFAULT_LAYOUT_ID - value: decl-layout-1 - - name: DEFAULT_AUTH_FLOW_ID - value: decl-mosip-otp-flow-1 -extraEnvVarsAdditional: - - name: "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME" - value: "esignetmosipid1" - - name: "MOSIP_ESIGNET_CAPTCHA_SITE-KEY" - valueFrom: - secretKeyRef: - name: esignet-captcha-go-mosipid1 - key: esignet-captcha-site-key - - # --------------------------------------------------------------------------- - # Plugin 2: mosip-identity-plugin - # Update URLs to match your MOSIP IDA deployment. - # --------------------------------------------------------------------------- - - name: NAMESPACE - value: mosipid1 - - name: plugin_name_env - value: mosip-identity-plugin.jar - - name: SPRING_KAFKA_CONSUMER_GROUP_ID - value: esignet-consumer-esignet-mosipid1 - - name: MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE - value: esignet-mosipid1-signup-esqa020 - - name: MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS - value: email,phone - - name: MOSIP_ESIGNET_SEND_OTP_ATTEMPTS - value: '300' - - name: MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS - value: '300' - - name: MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS - value: '600' - - name: MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS - value: '600' - - name: MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX - value: '@phone' - - name: MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS - value: >- - {{ "{{" }} 'id': 'mobile', 'svg': 'mobile_icon', 'prefixes': {{ "{{" }}'label': - 'IND', 'value': '+91', 'maxLength': '', 'regex': ''},{'label': - 'KHM', 'value': '+855', 'regex': ''{{ "}}" }}, 'postfix': '@phone', - 'maxLength': '', 'regex': '' }, { 'id': 'nrc', 'svg': - 'nrc_id_icon', 'prefixes': '', 'postfix': '@nrc', 'maxLength': - '', 'regex': '' }, { 'id': 'vid', 'svg': 'vid_icon', 'prefixes': - '', 'postfix': '', 'maxLength': '', 'regex': '' }, { 'id': - 'email', 'svg': 'email_icon', 'prefixes': '', 'postfix': - '@email', 'maxLength': '', 'regex': '' {{ "}}" }} - - name: LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT - value: DEBUG - - name: MOSIP_ESIGNET_CAPTCHA_REQUIRED - value: "false" - - name: MOSIP_ESIGNET_CAPTCHA_URL - value: http://captcha.captcha - - name: "MOSIP_ESIGNET_MISP_KEY" - valueFrom: - secretKeyRef: - name: esignet-misp-onboarder-key - key: mosip-esignet-misp-key diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml deleted file mode 100644 index 6f4317522..000000000 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml +++ /dev/null @@ -1,139 +0,0 @@ -# eSignet MOSIPID2 — plugin 2 (mosip-identity-plugin) runtime configuration. -# pluginNameEnv=mosip-identity-plugin.jar set in DSF set: block. -# Update IDA service URLs below to match your MOSIP IDA deployment. - -# Override full extraEnvVars to use namespace-specific softhsm secret name. -extraEnvVars: - - name: KEYCLOAK_EXTERNAL_URL - valueFrom: - configMapKeyRef: - name: keycloak-host - key: keycloak-external-url - - name: REDIS_HOST - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-host - - name: REDIS_PORT - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-port - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: redis - key: redis-password - - name: DATABASE_HOST - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-host - - name: DATABASE_PORT - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-port - - name: DATABASE_NAME - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-name - - name: DATABASE_USERNAME - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-username - - name: DB_DBUSER_PASSWORD - valueFrom: - secretKeyRef: - name: db-common-secrets - key: db-dbuser-password - - name: SOFTHSM_ESIGNET_SECURITY_PIN - valueFrom: - secretKeyRef: - name: esignet-softhsm-go-mosipid2 - key: security-pin - - name: MOSIP_IDA_CLIENT_SECRET - valueFrom: - secretKeyRef: - name: keycloak-client-secrets-mosipid2 - key: mosip_ida_client_secret - - name: AUTHN_PROVIDER - value: mosip - - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/esignet.pfx - - name: MOSIP_P12_PASSWORD - value: localtest - - name: OIDC_UI_SCHEME - value: https - - name: CRYPTO_ENCRYPTION_KEY - value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e - - name: OIDC_UI_PORT - value: '443' - - name: OIDC_UI_LOGIN_PATH - value: /signin - - name: OIDC_UI_ERROR_PATH - value: /error - - name: DEFAULT_THEME_ID - value: decl-theme-1 - - name: DEFAULT_LAYOUT_ID - value: decl-layout-1 - - name: DEFAULT_AUTH_FLOW_ID - value: decl-mosip-otp-flow-1 -extraEnvVarsAdditional: - - name: "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME" - value: "esignetmosipid2" - - name: "MOSIP_ESIGNET_CAPTCHA_SITE-KEY" - valueFrom: - secretKeyRef: - name: esignet-captcha-go-mosipid2 - key: esignet-captcha-site-key - - # --------------------------------------------------------------------------- - # Plugin 2: mosip-identity-plugin - # Update URLs to match your MOSIP IDA deployment. - # --------------------------------------------------------------------------- - - name: NAMESPACE - value: mosipid2 - - name: plugin_name_env - value: mosip-identity-plugin.jar - - name: SPRING_KAFKA_CONSUMER_GROUP_ID - value: esignet-consumer-esignet-mosipid2 - - name: MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE - value: esignet-mosipid2-signup-esqa020 - - name: MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS - value: email,phone - - name: MOSIP_ESIGNET_SEND_OTP_ATTEMPTS - value: '300' - - name: MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS - value: '300' - - name: MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS - value: '600' - - name: MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS - value: '600' - - name: MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX - value: '@phone' - - name: MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS - value: >- - {{ "{{" }} 'id': 'mobile', 'svg': 'mobile_icon', 'prefixes': {{ "{{" }}'label': - 'IND', 'value': '+91', 'maxLength': '', 'regex': ''},{'label': - 'KHM', 'value': '+855', 'regex': ''{{ "}}" }}, 'postfix': '@phone', - 'maxLength': '', 'regex': '' }, { 'id': 'nrc', 'svg': - 'nrc_id_icon', 'prefixes': '', 'postfix': '@nrc', 'maxLength': - '', 'regex': '' }, { 'id': 'vid', 'svg': 'vid_icon', 'prefixes': - '', 'postfix': '', 'maxLength': '', 'regex': '' }, { 'id': - 'email', 'svg': 'email_icon', 'prefixes': '', 'postfix': - '@email', 'maxLength': '', 'regex': '' {{ "}}" }} - - name: LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT - value: DEBUG - - name: MOSIP_ESIGNET_CAPTCHA_REQUIRED - value: "" - - name: MOSIP_ESIGNET_CAPTCHA_URL - value: http://captcha.captcha - - name: "MOSIP_ESIGNET_MISP_KEY" - valueFrom: - secretKeyRef: - name: esignet-misp-onboarder-key - key: mosip-esignet-misp-key - diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml deleted file mode 100644 index 699de0f37..000000000 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml +++ /dev/null @@ -1,168 +0,0 @@ -# eSignet standalone — plugin and captcha runtime configuration. -# -# Plugin selection: -# Plugin 1 (mock): pluginNameEnv=esignet-mock-plugin.jar → no changes needed here -# Plugin 2 (mosip-identity): pluginNameEnv=mosip-identity-plugin.jar → uncomment IDA section below -# Plugin 3 (sunbird-rc): pluginNameEnv=sunbird-rc-plugin.jar → uncomment Sunbird section below -# Plugin 4 (custom): pluginNameEnv= pluginUrlEnv= → no changes needed here -# - -## Uncomment required parms added with single '#' when needed. - - -extraEnvVars: - - name: KEYCLOAK_EXTERNAL_URL - valueFrom: - configMapKeyRef: - name: keycloak-host - key: keycloak-external-url - - name: MOSIP_ESIGNET_CAPTCHA_SITE_KEY - valueFrom: - secretKeyRef: - name: esignet-captcha-go - key: esignet-captcha-site-key - - name: MOSIP_ESIGNET_CAPTCHA_MODULE_NAME - value: esignet - - name: REDIS_HOST - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-host - - name: REDIS_PORT - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-port - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: redis - key: redis-password - - name: DATABASE_HOST - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-host - - name: DATABASE_PORT - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-port - - name: DATABASE_NAME - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-name - - name: DATABASE_USERNAME - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-username - - name: DB_DBUSER_PASSWORD - valueFrom: - secretKeyRef: - name: db-common-secrets - key: db-dbuser-password - - name: SOFTHSM_ESIGNET_SECURITY_PIN - valueFrom: - secretKeyRef: - name: esignet-softhsm-go - key: security-pin - - name: MOSIP_IDA_CLIENT_SECRET - valueFrom: - secretKeyRef: - name: keycloak-client-secrets - key: mosip_ida_client_secret - - name: AUTHN_PROVIDER - value: mosip - - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/esignet.pfx - - name: MOSIP_P12_PASSWORD - value: localtest - - name: OIDC_UI_SCHEME - value: https - - name: CRYPTO_ENCRYPTION_KEY - value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e - - name: OIDC_UI_PORT - value: '443' - - name: OIDC_UI_LOGIN_PATH - value: /signin - - name: OIDC_UI_ERROR_PATH - value: /error - - name: DEFAULT_THEME_ID - value: decl-theme-1 - - name: DEFAULT_LAYOUT_ID - value: decl-layout-1 - - name: DEFAULT_AUTH_FLOW_ID - value: decl-mosip-otp-flow-1 -# extraEnvVarsCM: -# - esignet-softhsm-share - -#extraEnvVarsSecret: [] - -#istio: -# enabled: true -# gateways: -# - istio-system/public -# - istio-system/internal -# prefix: /v1/esignet/ - - - -# extraEnvVarsAdditional is a Helm list — this file REPLACES the base list on merge. -# All required entries (captcha + plugin-specific) must be present together. - -extraEnvVarsAdditional: - # Captcha site key — from esignet-captcha secret (deployed by external-dsf) - - name: "MOSIP_ESIGNET_CAPTCHA_SITE_KEY" - valueFrom: - secretKeyRef: - name: esignet-captcha-go - key: esignet-captcha-site-key - - name: "MOSIP_ESIGNET_CAPTCHA_REQUIRED" - value: "" - - # --------------------------------------------------------------------------- - # Plugin 2: mosip-identity-plugin - # Uncomment all entries below when pluginNameEnv=mosip-identity-plugin.jar. - # Update URLs to match your MOSIP IDA deployment if the defaults don't apply. - # --------------------------------------------------------------------------- - # - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL" - # value: "http://mosip-file-server.mosip-file-server/mosip-certs/ida-partner.cer" - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_KYC-AUTH-URL" - # value: "http://ida-auth.ida/idauthentication/v1/kyc-auth/delegated/${mosip.esignet.authenticator.ida.misp-license-key}/" - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_KYC-EXCHANGE-URL" - # value: "http://ida-auth.ida/idauthentication/v1/kyc-exchange/delegated/${mosip.esignet.authenticator.ida.misp-license-key}/" - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_SEND-OTP-URL" - # value: "http://ida-otp.ida/idauthentication/v1/otp/${mosip.esignet.authenticator.ida.misp-license-key}/" - # - name: "MOSIP_ESIGNET_BINDER_IDA_KEY-BINDING-URL" - # value: "http://ida-auth.ida/idauthentication/v1/identity-key-binding/delegated/${mosip.esignet.authenticator.ida.misp-license-key}/" - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_GET-CERTIFICATES-URL" - # value: "http://ida-internal.ida/idauthentication/v1/internal/getAllCertificates" - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH-TOKEN-URL" - # value: "http://authmanager.kernel/v1/authmanager/authenticate/clientidsecretkey" - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT-MANAGER-URL" - # value: "http://auditmanager.kernel/v1/auditmanager/audits" - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP-CHANNELS" - # value: "email,phone" - # - name: "MOSIP_ESIGNET_MISP_KEY" - # valueFrom: - # secretKeyRef: - # name: esignet-misp-onboarder-key - # key: mosip-esignet-misp-key - - # --------------------------------------------------------------------------- - # Plugin 3: sunbird-rc-plugin - # Uncomment all entries below when pluginNameEnv=sunbird-rc-plugin.jar. - # Set MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL to your Sunbird registry host. - # --------------------------------------------------------------------------- - # - # - name: "MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL" - # value: "https://your-sunbird-registry-host" - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL" - # value: "https://your-sunbird-registry-host/api/v1/Insurance/search" - # - name: "MOSIP_ESIGNET_INTEGRATION_AUDIT_PLUGIN" - # value: "LoggerAuditService" - # - name: "MOSIP_ESIGNET_INTEGRATION_KEY_BINDER" - # value: "NoOpKeyBinder" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml deleted file mode 100644 index d579720f6..000000000 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml +++ /dev/null @@ -1,107 +0,0 @@ -# eSignet Sunbird — plugin 3 (sunbird-rc-plugin) runtime configuration. -# pluginNameEnv=sunbird-rc-plugin.jar set in DSF set: block. -# Update MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL to your Sunbird registry host. - -# Override full extraEnvVars to use namespace-specific softhsm secret name. -extraEnvVars: - - name: KEYCLOAK_EXTERNAL_URL - valueFrom: - configMapKeyRef: - name: keycloak-host - key: keycloak-external-url - - name: MOSIP_ESIGNET_CAPTCHA_MODULE_NAME - value: esignet - - name: REDIS_HOST - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-host - - name: REDIS_PORT - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-port - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: redis - key: redis-password - - name: DATABASE_HOST - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-host - - name: DATABASE_PORT - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-port - - name: DATABASE_NAME - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-name - - name: DATABASE_USERNAME - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-username - - name: DB_DBUSER_PASSWORD - valueFrom: - secretKeyRef: - name: db-common-secrets - key: db-dbuser-password - - name: SOFTHSM_ESIGNET_SECURITY_PIN - valueFrom: - secretKeyRef: - name: esignet-softhsm-go-sunbird - key: security-pin - - name: MOSIP_IDA_CLIENT_SECRET - valueFrom: - secretKeyRef: - name: keycloak-client-secrets - key: mosip_ida_client_secret - - name: AUTHN_PROVIDER - value: mosip - - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/esignet.pfx - - name: MOSIP_P12_PASSWORD - value: localtest - - name: OIDC_UI_SCHEME - value: https - - name: CRYPTO_ENCRYPTION_KEY - value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e - - name: OIDC_UI_PORT - value: '443' - - name: OIDC_UI_LOGIN_PATH - value: /signin - - name: OIDC_UI_ERROR_PATH - value: /error - - name: DEFAULT_THEME_ID - value: decl-theme-1 - - name: DEFAULT_LAYOUT_ID - value: decl-layout-1 - - name: DEFAULT_AUTH_FLOW_ID - value: decl-mosip-otp-flow-1 - -extraEnvVarsAdditional: - - name: "MOSIP_ESIGNET_CAPTCHA_SITE_KEY" - valueFrom: - secretKeyRef: - name: esignet-captcha-go-sunbird - key: esignet-captcha-site-key - - name: "MOSIP_ESIGNET_CAPTCHA_REQUIRED" - value: "" - - # --------------------------------------------------------------------------- - # Plugin 3: sunbird-rc-plugin - # Update URLs to match your Sunbird RC registry deployment. - # --------------------------------------------------------------------------- - - name: "MOSIP_ESIGNET_INTEGRATION_AUDIT_PLUGIN" - value: "LoggerAuditService" - - name: "MOSIP_ESIGNET_INTEGRATION_KEY_BINDER" - value: "NoOpKeyBinder" - - name: MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS - value: '300' - - name: MOSIP_ESIGNET_AUTHENTICATOR_DEFAULT_AUTH_FACTOR_KBI_INDIVIDUAL_ID_FIELD - value: "policyNumber" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml deleted file mode 100755 index 1cbf9dc1e..000000000 --- a/Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml +++ /dev/null @@ -1,50 +0,0 @@ -extraEnvVars: - - name: DATABASE_HOST - valueFrom: - configMapKeyRef: - name: mockid-postgres-config - key: database-host - - name: DATABASE_PORT - valueFrom: - configMapKeyRef: - name: mockid-postgres-config - key: database-port - - name: DATABASE_NAME - valueFrom: - configMapKeyRef: - name: mockid-postgres-config - key: database-name - - name: DATABASE_USERNAME - valueFrom: - configMapKeyRef: - name: mockid-postgres-config - key: database-username - - name: DB_DBUSER_PASSWORD - valueFrom: - secretKeyRef: - name: db-common-secrets - key: db-dbuser-password - - name: SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN - valueFrom: - secretKeyRef: - name: softhsm-mock-identity-system-go - key: security-pin - - name: hsm_local_dir_name - value: hsm-client - - name: MOSIP_ESIGNET_MOCK_SUPPORTED_FIELDS - value: individualId,password - - name: REDIS_HOST - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-host - - name: REDIS_PORT - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-port - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: redis - key: redis-password diff --git a/Helmsman/utils/softhsm-esignet-mosipid1-values.yaml b/Helmsman/utils/softhsm-esignet-mosipid-values.yaml similarity index 90% rename from Helmsman/utils/softhsm-esignet-mosipid1-values.yaml rename to Helmsman/utils/softhsm-esignet-mosipid-values.yaml index 526bf77c7..0354bf98d 100644 --- a/Helmsman/utils/softhsm-esignet-mosipid1-values.yaml +++ b/Helmsman/utils/softhsm-esignet-mosipid-values.yaml @@ -1,4 +1,4 @@ -# SoftHSM values for esignet-mosipid1 namespace +# SoftHSM values for esignet-mosipid namespace # Identical to softhsm-esignet-values.yaml — separate file so each namespace # gets an independent SoftHSM PVC and pin secret. diff --git a/Helmsman/utils/softhsm-esignet-mosipid2-values.yaml b/Helmsman/utils/softhsm-esignet-mosipid2-values.yaml deleted file mode 100644 index 7df046d37..000000000 --- a/Helmsman/utils/softhsm-esignet-mosipid2-values.yaml +++ /dev/null @@ -1,28 +0,0 @@ -# SoftHSM values for esignet-mosipid2 namespace -# Identical to softhsm-esignet-values.yaml — separate file so each namespace -# gets an independent SoftHSM PVC and pin secret. - -replicaCount: 1 - -image: - repository: mosipid/softhsm - tag: v2 - pullPolicy: Always - -persistence: - enabled: true - size: 1Gi - storageClass: "" - -resources: - requests: - cpu: 100m - memory: 128Mi - limits: - cpu: 500m - memory: 512Mi - -securityContext: - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 diff --git a/docs/DSF_CONFIGURATION_GUIDE.md b/docs/DSF_CONFIGURATION_GUIDE.md index 5fc532b58..daa5d8ecd 100644 --- a/docs/DSF_CONFIGURATION_GUIDE.md +++ b/docs/DSF_CONFIGURATION_GUIDE.md @@ -539,9 +539,8 @@ apps: #### 1. Test Endpoints -All API endpoints in `testrigs-dsf.yaml` use `${domain_name}` substitution — no manual edits needed. For the eSignet profile, `${mosipid1_domain_name}` and `${mosipid2_domain_name}` are also used for the MOSIP-ID1 and MOSIP-ID2 testrig database hosts. Set these as GitHub Environment Variables: -- `vars.MOSIPID1_DOMAIN_NAME` (e.g. `mosipid1.example.net`) -- `vars.MOSIPID2_DOMAIN_NAME` (e.g. `mosipid2.example.net`) +All API endpoints in `testrigs-dsf.yaml` use `${domain_name}` substitution — no manual edits needed. For the eSignet profile, `${mosipid_domain_name}` is also used for the MOSIP-ID testrig database host. Set this as a GitHub Environment Variable: +- `vars.MOSIPID_DOMAIN_NAME` (e.g. `mosipid.example.net`) #### 2. Test Data Configuration @@ -692,7 +691,7 @@ apps: - [ ] GitHub Environment Variables set for your branch (`vars.DOMAIN_NAME`, `vars.ENV_NAME`, `vars.CLUSTER_ID`, `vars.SLACK_CHANNEL_NAME`) - [ ] Port variables set: `vars.DB_PORT` (MOSIP platform profiles), `vars.ESIGNET_DB_PORT` (eSignet profile) -- [ ] For eSignet profile: `vars.MOSIPID1_DOMAIN_NAME` and `vars.MOSIPID2_DOMAIN_NAME` also set +- [ ] For eSignet profile: `vars.MOSIPID_DOMAIN_NAME` also set - [ ] No manual `` or domain placeholder edits needed in DSF files ### Before Deploying prereq-dsf.yaml @@ -719,7 +718,7 @@ apps: - [ ] All MOSIP/eSignet services running - [ ] Test data branch matches MOSIP version -- [ ] `vars.MOSIPID1_DOMAIN_NAME` and `vars.MOSIPID2_DOMAIN_NAME` set (esignet-standalone profile) +- [ ] `vars.MOSIPID_DOMAIN_NAME` set (esignet-standalone profile) --- @@ -795,8 +794,7 @@ apps: | Slack channel | `vars.SLACK_CHANNEL_NAME` | GitHub Environment Variables | Alerting in prereq-dsf | | MOSIP postgres port | `vars.DB_PORT` | GitHub Environment Variables | MOSIP platform external postgres (5433) | | eSignet postgres port | `vars.ESIGNET_DB_PORT` | GitHub Environment Variables | eSignet container postgres (5432) | -| MOSIP-ID1 domain | `vars.MOSIPID1_DOMAIN_NAME` | GitHub Environment Variables | esignet-standalone profile — MOSIP-ID1 testrig hosts | -| MOSIP-ID2 domain | `vars.MOSIPID2_DOMAIN_NAME` | GitHub Environment Variables | esignet-standalone profile — MOSIP-ID2 testrig hosts | +| MOSIP-ID domain | `vars.MOSIPID_DOMAIN_NAME` | GitHub Environment Variables | esignet-standalone profile — MOSIP-ID testrig hosts | **DSF file manual edits (one-time per environment):** diff --git a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md index ee2e06e61..70afb2730 100644 --- a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md +++ b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md @@ -4,20 +4,20 @@ This guide walks you through deploying eSignet standalone on your Kubernetes clu You do **not** need to run any commands on your local machine — everything runs in the cloud via GitHub workflows. **What gets deployed:** -- Up to 4 eSignet instances (esignet, esignet-mosipid1, esignet-mosipid2, esignet-sunbird) — **mosipid1 is enabled by default; mosipid2 is optional** -- OIDC UI for each enabled instance +- 3 eSignet instances (esignet, esignet-mosipid, esignet-sunbird) — all enabled by default +- OIDC UI for each instance - Mock Relying Party service and UI - Supporting infrastructure: Postgres, Redis, Kafka, Keycloak, SoftHSM, Captcha, MinIO **Estimated time:** ~90–120 minutes end to end (Terraform ~30 min, external services ~20 min, eSignet ~25 min). -> **A second, isolated profile — `esignet-standalone-2.0.0`** — is also available in the `profile` dropdown of -> `helmsman_esignet.yml`, `helmsman_testrigs.yml`, and `helmsman_signup.yml`. It deploys its own namespaces, Helm -> releases, hostnames (e.g. `esignet-go-mock`, `esignet-go-mosipid1`), and databases, so it can run side by side -> with `esignet-standalone` in the same cluster without colliding. It shares the same external infrastructure -> (Postgres server, Keycloak, Redis, Kafka, Minio, Captcha instances) and Terraform profile — deploy/manage those via `helmsman_external.yml` and -> Terraform using the `esignet-standalone` profile as usual; there is no separate `esignet-standalone-2.0.0` entry -> for either of those. +> **A second, isolated profile — `esignet-standalone-2.0.0`** (the Go rewrite of eSignet) — is also available in +> the `profile` dropdown of `helmsman_esignet.yml`, `helmsman_testrigs.yml`, and `helmsman_signup.yml`. It deploys +> its own Helm releases and databases under **the same namespaces and hostnames** as `esignet-standalone` — the +> two profiles are not meant to run side by side on the same cluster/domain, only one at a time. It shares the +> same external infrastructure (Postgres server, Keycloak, Redis, Kafka, Minio, Captcha instances) and Terraform +> profile — deploy/manage those via `helmsman_external.yml` and Terraform using the `esignet-standalone` profile +> as usual; there is no separate `esignet-standalone-2.0.0` entry for either of those. --- @@ -37,42 +37,28 @@ You do **not** need to run any commands on your local machine — everything run - [Step 4 — Deploy Testrigs (optional)](#step-4--deploy-testrigs-optional) 5. [Re-deploying or Re-running](#4-re-deploying-or-re-running) 6. [Verifying Deployment](#5-verifying-deployment) -7. [MOSIP ID Plugin Onboarding (mosipid1 / mosipid2)](#6-mosip-id-plugin-onboarding-mosipid1--mosipid2) +7. [MOSIP ID Plugin Onboarding (mosipid)](#6-mosip-id-plugin-onboarding-mosipid) --- ## 0. Understanding the eSignet Instances -This deployment can run up to **4 separate eSignet instances** on the same cluster, each isolated in its own Kubernetes namespace. Think of each instance as a completely independent eSignet service — it has its own database, its own Keycloak clients, its own domain name, and its own identity plugin. +This deployment runs **3 separate eSignet instances** on the same cluster, each isolated in its own Kubernetes namespace. Think of each instance as a completely independent eSignet service — it has its own database, its own Keycloak clients, its own domain name, and its own identity plugin. | Instance | Namespace | What it connects to | Enabled by default | |---|---|---|---| | **eSignet (main)** | `esignet-mock` | Mock identity — for demos and testing without a live MOSIP system | Yes | -| **eSignet MOSIP-ID1** | `esignet-mosipid1` | A real MOSIP identity system at `MOSIPID1_DOMAIN_NAME` | **Yes** | -| **eSignet MOSIP-ID2** | `esignet-mosipid2` | A second real MOSIP identity system at `MOSIPID2_DOMAIN_NAME` | No | +| **eSignet MOSIP-ID** | `esignet-mosipid` | A real MOSIP identity system at `MOSIPID_DOMAIN_NAME` | Yes | | **eSignet Sunbird** | `esignet-sunbird` | A Sunbird RC credential registry | Yes | -### When do you need mosipid1? +> **Deploying `esignet-standalone-2.0.0` instead?** Identical 3 instances, same namespaces and hostnames — the +> two profiles are interchangeable, not additive; deploy one or the other, not both, on a given cluster/domain. -Use `esignet-mosipid1` when you want eSignet to authenticate citizens against a **real MOSIP identity system**. You give it the domain of your MOSIP environment (e.g. `mosipenv.your-org.net`) via the `MOSIPID1_DOMAIN_NAME` variable, and the deployment automatically connects eSignet to that system's identity APIs, database, and Keycloak. +### When do you need mosipid? -**This is enabled by default** — if you have a MOSIP system to connect to, fill in the `MOSIPID1_DOMAIN_NAME` variable and the related secrets and it will be deployed as part of the normal workflow run. +Use `esignet-mosipid` when you want eSignet to authenticate citizens against a **real MOSIP identity system**. You give it the domain of your MOSIP environment (e.g. `mosipenv.your-org.net`) via the `MOSIPID_DOMAIN_NAME` variable, and the deployment automatically connects eSignet to that system's identity APIs, database, and Keycloak. -### When do you need mosipid2? - -`esignet-mosipid2` is **disabled by default**. Enable it only if you need to run **two eSignet instances that each connect to a different MOSIP environment** on the same cluster — for example, one pointing at a production MOSIP environment and another at a staging one. - -If you only have one MOSIP system to connect to, leave mosipid2 disabled. You do not need to configure any mosipid2 secrets or variables. - -**To enable mosipid2:** - -1. Add the `MOSIPID2_DOMAIN_NAME` environment variable in your GitHub Environment (Section 2B) -2. Add these secrets in your GitHub Environment (Section 2A): - - `ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY` and `ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY` - - `MOSIPID2_POSTGRES_PASSWORD` and `MOSIPID2_KEYCLOAK_ADMIN_PASSWORD` -3. When running the eSignet workflow (Step 2), toggle **`enable_mosipid2`** to `true` and fill in the `mosipid2_domain_name` field - -> No DSF file edits needed — `enable_mosipid2` is a workflow input toggle that controls deployment at runtime. +**This is enabled by default** — if you have a MOSIP system to connect to, fill in the `MOSIPID_DOMAIN_NAME` variable and the related secrets and it will be deployed as part of the normal workflow run. --- @@ -83,12 +69,11 @@ Complete this checklist before triggering any workflow: - [ ] Kubernetes cluster is up and running - [ ] `KUBECONFIG` file is available for your cluster - [ ] DNS records for all domain names are pointed to your cluster's load balancer -- [ ] Google reCAPTCHA v2 keys are generated — you need **at minimum 4 site/secret key pairs** (one per enabled instance): +- [ ] Google reCAPTCHA v2 keys are generated — you need **4 site/secret key pairs** (one per instance): - one for `esignet-mock` namespace - - one for `esignet-mosipid1` namespace + - one for `esignet-mosipid` namespace - one for `esignet-sunbird` namespace - one for `signup` namespace - - one for `esignet-mosipid2` namespace *(only if you are enabling mosipid2 — see [Section 0](#0-understanding-the-esignet-instances))* - See [reCAPTCHA Setup Guide](RECAPTCHA_SETUP_GUIDE.md) - [ ] Mock Relying Party PEM key pair is generated (client private key + JWE private key) - [ ] GitHub Environment named after your branch (e.g. `MOSIP-44613`) exists under: @@ -148,24 +133,31 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings | `ESIGNET_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for the main `esignet-mock` namespace | | `ESIGNET_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for the main `esignet-mock` namespace | +> **`esignet-standalone-2.0.0` note:** `helmsman_external.yml` has no `esignet-standalone-2.0.0` option in its +> `profile` dropdown — it only ever deploys as `esignet-standalone`. The 2.0.0 profile has no `external-dsf.yaml` +> of its own; it reuses this same shared captcha/Postgres/Keycloak/Redis/Kafka/MinIO deployment (see the callout +> at the top of this guide). Always run Step 1 with `profile: esignet-standalone`, even if you only plan to +> deploy `esignet-standalone-2.0.0` in Step 2. + **For `helmsman_esignet.yml`:** | Secret Name | What it is | |---|---| | `MOCK_RELYING_PARTY_CLIENT_PRIVATE_KEY` | Base64-encoded PEM — mock relying party client private key | | `MOCK_RELYING_PARTY_JWE_PRIVATE_KEY` | Base64-encoded PEM — JWE userinfo private key | -| `ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for `esignet-mosipid1` namespace | -| `ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-mosipid1` namespace | -| `ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for `esignet-mosipid2` namespace *(only needed if mosipid2 is enabled)* | -| `ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-mosipid2` namespace *(only needed if mosipid2 is enabled)* | +| `ESIGNET_MOSIPID_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for `esignet-mosipid` namespace | +| `ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-mosipid` namespace | | `ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for `esignet-sunbird` namespace | | `ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-sunbird` namespace | -| `MOSIPID1_POSTGRES_PASSWORD` | Postgres superuser password for the MOSIP-ID1 remote MOSIP environment | -| `MOSIPID2_POSTGRES_PASSWORD` | Postgres superuser password for the MOSIP-ID2 remote MOSIP environment *(only needed if mosipid2 is enabled)* | -| `MOSIPID1_KEYCLOAK_ADMIN_PASSWORD` | Keycloak admin password for the MOSIP-ID1 remote MOSIP environment | -| `MOSIPID2_KEYCLOAK_ADMIN_PASSWORD` | Keycloak admin password for the MOSIP-ID2 remote MOSIP environment *(only needed if mosipid2 is enabled)* | +| `MOSIPID_POSTGRES_PASSWORD` | Postgres superuser password for the remote MOSIP environment | +| `MOSIPID_KEYCLOAK_ADMIN_PASSWORD` | Keycloak admin password for the remote MOSIP environment | -> ⚠️ `MOSIPID1_KEYCLOAK_ADMIN_PASSWORD` and `MOSIPID2_KEYCLOAK_ADMIN_PASSWORD` are the admin passwords of the **remote** MOSIP-ID1 and MOSIP-ID2 Keycloak instances (not the local one deployed by this stack). The preinstall hook calls those Keycloak REST APIs to fetch client secrets. A wrong domain or wrong password here will cause the preinstall to fail with a curl error. +> ⚠️ `MOSIPID_KEYCLOAK_ADMIN_PASSWORD` is the admin password of the **remote** MOSIP-ID Keycloak instance (not the local one deployed by this stack). The preinstall hook calls that Keycloak's REST API to fetch client secrets. A wrong domain or wrong password here will cause the preinstall to fail with a curl error. +> +> **`esignet-standalone-2.0.0` note:** All of the secrets above are **reused as-is** by `esignet-standalone-2.0.0` +> — both profiles create identically-named Kubernetes secrets (e.g. `esignet-captcha`, `esignet-captcha-mosipid`) +> and patch the same env var names onto the shared `captcha` deployment +> (e.g. `MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET`), since only one profile is ever deployed at a time. **For `helmsman_signup.yml` (set now even though signup is not yet active):** @@ -174,6 +166,9 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings | `MOSIP_SIGNUP_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for the `signup` namespace | | `MOSIP_SIGNUP_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for the `signup` namespace | +> **`esignet-standalone-2.0.0` note:** Same secrets reused here too — signup for the 2.0.0 profile deploys into +> the same `signup` namespace as `esignet-standalone` and shares these same GitHub secret values. + --- ### C. Environment Variables @@ -189,10 +184,8 @@ Navigate to: `Repository → Settings → Environments → | `ENV_NAME` | `sandbox` | **Yes** | Short environment label shown on the landing page | | `CLUSTER_ID` | `c-xxxxx` | **Yes** | Rancher cluster ID used by monitoring setup — see [Finding your clusterid](../README.md#step-4a-configure-github-environment-variables) in the root README | | `SLACK_CHANNEL_NAME` | `#mosip-alerts` | **Yes** | Slack channel name for alert notifications | -| `MOSIPID1_DOMAIN_NAME` | `mosipid1.xyz.net` | Optional | Base domain of the MOSIP environment that `esignet-mosipid1` connects to (required if mosipid1 is enabled) | -| `MOSIPID2_DOMAIN_NAME` | `mosipid2.xyz.net` | Optional | Base domain of the second MOSIP environment — only set this if you have enabled mosipid2 (see [Section 0](#0-understanding-the-esignet-instances)) | -| `ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL` | `develop` | Optional | Git branch/tag for MOSIP-ID1 config-server (defaults to `develop`) | -| `ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL` | `develop` | Optional | Git branch/tag for MOSIP-ID2 config-server — only relevant if mosipid2 is enabled (defaults to `develop`) | +| `MOSIPID_DOMAIN_NAME` | `mosipid.xyz.net` | **Yes** | Base domain of the MOSIP environment that `esignet-mosipid` connects to | +| `ESIGNET_MOSIPID_SPRING_CONFIG_LABEL` | `develop` | Optional | Git branch/tag for MOSIP-ID config-server (defaults to `develop`) | | `ESIGNET_STANDALONE_MODE` | `true` | Optional | Set to `true` to skip the MOSIP DSF completion check | --- @@ -206,12 +199,17 @@ Step 0 → Provision Infrastructure (terraform plan / apply) ├── 0b base-infra ~10 min ← once per AWS account; skip if already done ├── 0c observ-infra ~15 min ← optional monitoring cluster └── 0d infra ~20 min profile: esignet-standalone ← the main cluster -Step 1 → Deploy External Services (helmsman_external.yml) ~20 min -Step 2 → Deploy eSignet (helmsman_esignet.yml) ~25 min +Step 1 → Deploy External Services (helmsman_external.yml) ~20 min profile: esignet-standalone (always) +Step 2 → Deploy eSignet (helmsman_esignet.yml) ~25 min profile: esignet-standalone or esignet-standalone-2.0.0 Step 3 → Deploy Signup (helmsman_signup.yml) ⚠️ IN PROGRESS — not ready yet -Step 4 → Deploy Testrigs (optional) (helmsman_testrigs.yml) ~10 min +Step 4 → Deploy Testrigs (optional) (helmsman_testrigs.yml) ~10 min profile: esignet-standalone or esignet-standalone-2.0.0 ``` +> Steps 2 and 4 accept either profile in their `profile` dropdown — pick `esignet-standalone-2.0.0` to deploy +> the Go-based instances instead of (or alongside) the v1.7.1 ones. Step 1 has no 2.0.0 option since both +> profiles share the same external infrastructure. Step 3's dropdown also lists `esignet-standalone-2.0.0`, +> but the step itself isn't usable yet for either profile — see the note below. + --- ### Step 0 — Provision Infrastructure (Terraform) @@ -328,16 +326,18 @@ Follow the full instructions in the root README: [Step 3ca: Observation Infrastr ![Deploy External Services - Helmsman](_images/helmsman-external-services.png) **How to know it succeeded:** Click into the running workflow. Wait for all jobs to show a green tick. Then run: + ```bash kubectl get pods -n postgres && kubectl get pods -n keycloak && kubectl get pods -n kafka ``` + All pods should show `Running` or `Completed`. --- ### Step 2 — Deploy eSignet -> **What this does:** Deploys the eSignet application itself — 4 separate instances (main, MOSIP-ID1, MOSIP-ID2, Sunbird), the OIDC login UI for each, and the Mock Relying Party service for testing. +> **What this does:** Deploys the eSignet application itself — 3 separate instances (main, MOSIP-ID, Sunbird), the OIDC login UI for each, and the Mock Relying Party service for testing. > Only run this after Step 1 is fully complete. **GitHub Actions workflow name:** `Deploy eSignet using Helmsman` @@ -349,15 +349,13 @@ All pods should show `Running` or `Completed`. | Field | Value to enter | |---|---| -| `profile` | `esignet-standalone` | +| `profile` | `esignet-standalone` **or** `esignet-standalone-2.0.0` — see note below | | `mode` | `apply` | | `skip_mosip_dsf_check` | **tick this** — standalone has no MOSIP deployment to wait for | | `delete_existing_jobs` | tick only if re-running after a failure; leave unticked on first deploy | | `domain_name` | your base domain — e.g. `sandbox.xyz.net` | | `esignet_db_port` | `5432` | -| `mosipid1_domain_name` | MOSIP-ID1 base domain — e.g. `mosipid1.xyz.net` *(leave blank if not using MOSIP-ID1)* | -| `enable_mosipid2` | toggle `true` to deploy the MOSIP-ID2 eSignet instance; leave `false` to skip it | -| `mosipid2_domain_name` | MOSIP-ID2 base domain — e.g. `mosipid2.xyz.net` *(only required if `enable_mosipid2` is true)* | +| `mosipid_domain_name` | MOSIP-ID base domain — e.g. `mosipid.xyz.net` | | `env_name` | your environment name — e.g. `sandbox` | > **Important:** Always tick `skip_mosip_dsf_check` for standalone eSignet — without it, the workflow waits for a `mosip-dsf=completed` namespace label that will never appear (there is no full MOSIP deployment in this mode), and the workflow will fail. @@ -366,12 +364,19 @@ All pods should show `Running` or `Completed`. ![Deploy eSignet - Helmsman](_images/esignet.png) +> **`esignet-standalone-2.0.0` note:** Selecting `esignet-standalone-2.0.0` runs `Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml` +> instead — it deploys the same 3 instances (main/mock, mosipid, sunbird) plus their OIDC UIs and mock relying +> party service, into the **same namespaces and hostnames** as `esignet-standalone`. All other fields +> (`domain_name`, `mosipid_domain_name`, etc.) work the same way as for `esignet-standalone`. Deploy one profile +> or the other on a given cluster/domain, not both — Step 1 only needs to be run once either way, with +> `profile: esignet-standalone`. + **How to know it succeeded:** + ```bash -kubectl get pods -n esignet-mock && kubectl get pods -n esignet-mosipid1 && kubectl get pods -n esignet-sunbird -# If enable_mosipid2 was set to true: -kubectl get pods -n esignet-mosipid2 +kubectl get pods -n esignet-mock && kubectl get pods -n esignet-mosipid && kubectl get pods -n esignet-sunbird ``` + All pods should show `Running`. --- @@ -385,6 +390,10 @@ All pods should show `Running`. > **What you need to do right now:** Nothing — skip this step for now. However, make sure the signup secrets (`MOSIP_SIGNUP_CAPTCHA_SITE_KEY` and `MOSIP_SIGNUP_CAPTCHA_SECRET_KEY`) are already added to the GitHub Environment (see Section 2) so you are ready when signup is enabled. > > This section will be updated with full instructions once signup deployment is ready. +> +> **`esignet-standalone-2.0.0` note:** `helmsman_signup.yml` already lists `esignet-standalone-2.0.0` in its +> `profile` dropdown (deploys into the same `signup` namespace as `esignet-standalone`), but it's equally +> not-yet-ready for either profile. --- @@ -402,11 +411,10 @@ All pods should show `Running`. | Field | Value to enter | |---|---| -| `profile` | `esignet-standalone` | +| `profile` | `esignet-standalone` **or** `esignet-standalone-2.0.0` — matches whichever profile you deployed in Step 2 | | `mode` | `apply` | | `domain_name` | your base domain — e.g. `sandbox.xyz.net` | -| `mosipid1_domain_name` | MOSIP-ID1 base domain *(if MOSIP-ID1 was deployed in Step 2)* | -| `mosipid2_domain_name` | MOSIP-ID2 base domain *(if `enable_mosipid2` was `true` in Step 2)* | +| `mosipid_domain_name` | MOSIP-ID base domain — same value used in Step 2 | | `db_port` *(MOSIP platform external postgres)* | leave blank — not used by the `esignet-standalone` profile | | `esignet_db_port` *(esignet container postgres)* | `5432` | | `env_name` | your environment name | @@ -417,10 +425,10 @@ All pods should show `Running`. ![Deploy Test Rigs - Helmsman](_images/helmsman-testrigs.png) **How to know it succeeded:** The workflow log should show all Helmsman releases applied without errors. Verify that test cronjobs were created: + ```bash kubectl get cronjobs -n esignet-mock -kubectl get cronjobs -n esignet-mosipid1 -kubectl get cronjobs -n esignet-mosipid2 +kubectl get cronjobs -n esignet-mosipid kubectl get cronjobs -n esignet-sunbird ``` @@ -443,8 +451,7 @@ Run these commands against your cluster to confirm everything is healthy: ```bash # Check all pods across eSignet namespaces kubectl get pods -n esignet-mock -kubectl get pods -n esignet-mosipid1 -kubectl get pods -n esignet-mosipid2 +kubectl get pods -n esignet-mosipid kubectl get pods -n esignet-sunbird # Check Istio virtual services (confirms domain routing) @@ -458,22 +465,24 @@ helm list -n keycloak kubectl get pods --all-namespaces | grep -v Running | grep -v Completed | grep -v Terminating ``` -**Expected URLs after deployment** (replace `sandbox.xyz.net` with your domain): +> **Deployed `esignet-standalone-2.0.0`?** Same namespaces and commands as above — the two profiles share +> identical naming, so there's nothing to swap. + +**Expected URLs after deployment** (replace `sandbox.xyz.net` with your domain; identical for both profiles): | Service | URL | |---|---| | eSignet OIDC UI | `https://esignet.sandbox.xyz.net` | | Mock Relying Party UI | `https://healthservices.sandbox.xyz.net` | | Keycloak | `https://iam.sandbox.xyz.net` | -| MOSIP-ID1 eSignet | `https://esignet-mosipid1.sandbox.xyz.net` | -| MOSIP-ID2 eSignet | `https://esignet-mosipid2.sandbox.xyz.net` | +| MOSIP-ID eSignet | `https://esignet-mosipid.sandbox.xyz.net` | | Sunbird eSignet | `https://esignet-sunbird.sandbox.xyz.net` | --- -## 6. MOSIP ID Plugin Onboarding (mosipid1 / mosipid2) +## 6. MOSIP ID Plugin Onboarding (mosipid) -> **This section applies only if you are deploying `esignet-mosipid1` or `esignet-mosipid2`** — instances that authenticate citizens against a real MOSIP platform. If you are using only the mock identity system (`esignet-mock`) or Sunbird, skip this section. +> **This section applies only if you are deploying `esignet-mosipid`** — the instance that authenticates citizens against a real MOSIP platform. If you are using only the mock identity system (`esignet-mock`) or Sunbird, skip this section. Onboarding eSignet to a MOSIP identity system involves two phases: **prerequisites** (config changes on the MOSIP platform side) and **manual onboarding** (Postman collection run against the deployed eSignet instance). @@ -481,7 +490,7 @@ Onboarding eSignet to a MOSIP identity system involves two phases: **prerequisit ### Prerequisites — Changes on the MOSIP platform's mosip-config branch -The following changes must be made on **each MOSIP platform's `mosip-config` repository branch** that the esignet-mosipid instance points to (the branch set via `ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL` / `ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL`). +The following changes must be made on the **MOSIP platform's `mosip-config` repository branch** that the esignet-mosipid instance points to (the branch set via `ESIGNET_MOSIPID_SPRING_CONFIG_LABEL`). #### 1. Add eSignet property files @@ -498,18 +507,17 @@ Reference commit: [mosip/mosip-config@e8961a2](https://github.com/mosip/mosip-co The MOSIP Identity Authentication service restricts which domains can call its APIs. Edit `id-authentication-default.properties` in the MOSIP platform's `mosip-config` branch and add your eSignet standalone hostnames to `mosip.ida.allowed.domain.uris`: -**For mosipid1 only:** ```properties -mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1. -``` - -**For both mosipid1 and mosipid2:** -```properties -mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1.,https://esignet-mosipid2. +mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid. ``` Replace `` with your eSignet standalone base domain (e.g. `sandbox.xyz.net`). +> **`esignet-standalone-2.0.0` note:** `MOSIPID_DOMAIN_NAME` is shared between both profiles (see +> [Section 0](#0-understanding-the-esignet-instances)), and both profiles use the identical +> `esignet-mosipid.` hostname — since only one profile is ever deployed at a time, no extra +> hostname needs to be added here regardless of which profile you're running. + Reference commit: [mosip/mosip-config@27276cb](https://github.com/mosip/mosip-config/commit/27276cbb7fa01015492855baa3e00fe0a4db421c) After committing these changes, restart the `id-authentication` pods on the MOSIP platform so the config server picks up the new values: @@ -526,4 +534,4 @@ Once the prerequisites above are complete, follow the manual onboarding steps us **[eSignet Postman Collection — MOSIP ID Plugin Onboarding](https://github.com/mosip/esignet/tree/master/postman-collection#esignet-collection)** -This collection covers partner onboarding, OIDC client registration, and end-to-end flow verification for the MOSIP ID plugin against your deployed `esignet-mosipid1` or `esignet-mosipid2` instance. +This collection covers partner onboarding, OIDC client registration, and end-to-end flow verification for the MOSIP ID plugin against your deployed `esignet-mosipid` instance. diff --git a/docs/HELMSMAN_DESTROY_GUIDE.md b/docs/HELMSMAN_DESTROY_GUIDE.md index 7360848d5..2cd0924cf 100644 --- a/docs/HELMSMAN_DESTROY_GUIDE.md +++ b/docs/HELMSMAN_DESTROY_GUIDE.md @@ -51,9 +51,9 @@ The destroy workflows follow a **reusable workflow pattern**: | Workflow | File | Purpose | Namespaces Affected | | ----------------------------------- | ------------------------------------------ | ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| **Destroy Testrigs** | `helmsman_testrigs_destroy.yml` | Removes test rig services | `apitestrig`, `dslrig`, `uitestrig` (MOSIP platform); `esignet`, `esignet-mosipid1`, `esignet-mosipid2`, `esignet-sunbird`, `signup` (esignet profile apitestrigs) | +| **Destroy Testrigs** | `helmsman_testrigs_destroy.yml` | Removes test rig services | `apitestrig`, `dslrig`, `uitestrig` (MOSIP platform); `esignet`, `esignet-mosipid`, `esignet-sunbird`, `signup` (esignet profile apitestrigs) | | **Destroy MOSIP Services** | `helmsman_mosip_destroy.yml` | Removes core MOSIP services | `admin`, `apitestrig`, `artifactory`, `config-server`, `dslrig`, `esignet`, `idrepo`, `kernel`, `masterdata`, `packet-manager`, `pmp`, `postgresdb`, `print`, `regproc`, `resident`, `uitestrig` | -| **Destroy eSignet Services** | (use `helmsman_esignet.yml` with `--destroy`) | Removes eSignet stack (esignet profile) | `esignet`, `esignet-mosipid1`, `esignet-mosipid2`, `esignet-sunbird`, `signup`, `kernel` | +| **Destroy eSignet Services** | (use `helmsman_esignet.yml` with `--destroy`) | Removes eSignet stack (esignet profile) | `esignet`, `esignet-mosipid`, `esignet-sunbird`, `signup`, `kernel` | | **Destroy External Services** | `helmsman_external_destroy_external.yml` | Removes external dependencies | `keycloak`, `kafka`, `minio`, `softhsm`, `clamav`, `activemq`, `captcha`, `redis`, `postgres`, `landing-page` | | **Destroy Prerequisites** | `helmsman_external_destroy_prereq.yml` | Removes monitoring and Istio | `cattle-logging-system`, `istio-system`, `monitoring` | diff --git a/docs/HELMSMAN_EXTERNAL_GUIDE.md b/docs/HELMSMAN_EXTERNAL_GUIDE.md index 0cd292106..5c90eef3b 100644 --- a/docs/HELMSMAN_EXTERNAL_GUIDE.md +++ b/docs/HELMSMAN_EXTERNAL_GUIDE.md @@ -23,7 +23,7 @@ Choose the profile that matches your deployment target: | Profile | Use when | |---------|----------| -| `esignet-standalone` | eSignet standalone — up to 4 parallel instances (esignet-mock, esignet-mosipid1, esignet-mosipid2, esignet-sunbird). mosipid2 is optional via `enable_mosipid2` toggle. No full MOSIP stack. | +| `esignet-standalone` | eSignet standalone — 3 parallel instances (esignet-mock, esignet-mosipid, esignet-sunbird). No full MOSIP stack. | | `mosip-platform-1.2.0.x` | Full MOSIP platform with Java 11 | | `mosip-platform-1.2.1.x` | Full MOSIP platform with Java 21 | diff --git a/docs/HELMSMAN_TESTRIGS_GUIDE.md b/docs/HELMSMAN_TESTRIGS_GUIDE.md index 1401d56ef..d171783ed 100644 --- a/docs/HELMSMAN_TESTRIGS_GUIDE.md +++ b/docs/HELMSMAN_TESTRIGS_GUIDE.md @@ -14,11 +14,11 @@ Deploy API, UI, and DSL test rigs after all services are running and partner onb | Profile | What deploys | Namespaces | |---------|-------------|------------| -| `esignet-standalone` | `esignet-apitestrig` into up to 4 namespaces; optional signup apitestrig + uitestrig | `esignet-mock`, `esignet-mosipid1`, `esignet-mosipid2` *(if enabled)*, `esignet-sunbird`, `signup` | +| `esignet-standalone` | `esignet-apitestrig` into 3 namespaces; optional signup apitestrig + uitestrig | `esignet-mock`, `esignet-mosipid`, `esignet-sunbird`, `signup` | | `mosip-platform-1.2.0.x` | API testrig, UI testrig, DSL testrig | MOSIP testrig namespaces | | `mosip-platform-1.2.1.x` | Same as above | MOSIP testrig namespaces | -> **eSignet standalone (`esignet-standalone` profile):** Requires `mosipid1_domain_name` for the MOSIP-ID1 apitestrig endpoint. `mosipid2_domain_name` is only required if mosipid2 was enabled during eSignet deployment (`enable_mosipid2: true`). +> **eSignet standalone (`esignet-standalone` profile):** Requires `mosipid_domain_name` for the MOSIP-ID apitestrig endpoint. --- @@ -74,10 +74,9 @@ No additional secrets required — MinIO root password is read automatically fro | Input | Description | Example | |-------|-------------|---------| -| `mosipid1_domain_name` | Domain for the MOSIP-ID1 eSignet instance | `mosipid1.mosip.net` | -| `mosipid2_domain_name` | Domain for the MOSIP-ID2 eSignet instance — only required if mosipid2 was enabled (`enable_mosipid2: true`) during eSignet deployment | `mosipid2.mosip.net` | +| `mosipid_domain_name` | Domain for the MOSIP-ID eSignet instance | `mosipid.mosip.net` | -> If not provided as inputs, values fall back to GitHub Environment Variables: `vars.MOSIPID1_DOMAIN_NAME` and `vars.MOSIPID2_DOMAIN_NAME`. +> If not provided as an input, the value falls back to the GitHub Environment Variable `vars.MOSIPID_DOMAIN_NAME`. --- @@ -92,16 +91,15 @@ No additional secrets required — MinIO root password is read automatically fro - **(4)** **Deployment profile to use** — pick the profile you want (e.g., `mosip-platform-1.2.0.x` or `esignet-standalone`). - **(5)** **Choose Helmsman mode: dry-run or apply** — always pick **`apply`**. - **(6)** **Domain name for this environment** — type the web domain this environment should use (e.g., `example.xyz.net`). -- **(7)** **MOSIP-ID1 domain name** *(eSignet profile only)* — type the base domain used by the MOSIP-ID1 eSignet instance (e.g., `mosipid1.xyz.net`). Leave blank for MOSIP platform profiles. -- **(8)** **QA base domain name** *(eSignet profile only)* — type the base domain used by the MOSIP-ID2 eSignet instance (e.g., `mosipid2.xyz.net`). Leave blank for MOSIP platform profiles. -- **(9)** **PostgreSQL port for MOSIP platform external postgres** — only fill this in if you picked a `mosip-platform-*` profile in step 4. Type `5433` (or whatever port your external PostgreSQL uses). -- **(10)** **PostgreSQL port for esignet standalone container postgres** — only fill this in if you picked the `esignet-standalone` profile in step 4. Type `5432`. -- **(11)** **Environment name** — a short nickname for this environment (e.g., `sandbox`, `dev`, `staging`). -- **(12)** **Slack channel name for alerting** (optional) — the Slack channel that should receive test result notifications (e.g., `#mosip-alerts`). Leave blank if you don't want Slack alerts. -- **(13)** **Slack webhook URL for alerting** (optional) — leave this blank; it's normally already saved as the `SLACK_WEBHOOK_URL` secret in your GitHub environment. -- **(14)** Click the green **Run workflow** button to start the deployment. +- **(7)** **MOSIP-ID domain name** *(eSignet profile only)* — type the base domain used by the MOSIP-ID eSignet instance (e.g., `mosipid.xyz.net`). Leave blank for MOSIP platform profiles. +- **(8)** **PostgreSQL port for MOSIP platform external postgres** — only fill this in if you picked a `mosip-platform-*` profile in step 4. Type `5433` (or whatever port your external PostgreSQL uses). +- **(9)** **PostgreSQL port for esignet standalone container postgres** — only fill this in if you picked the `esignet-standalone` profile in step 4. Type `5432`. +- **(10)** **Environment name** — a short nickname for this environment (e.g., `sandbox`, `dev`, `staging`). +- **(11)** **Slack channel name for alerting** (optional) — the Slack channel that should receive test result notifications (e.g., `#mosip-alerts`). Leave blank if you don't want Slack alerts. +- **(12)** **Slack webhook URL for alerting** (optional) — leave this blank; it's normally already saved as the `SLACK_WEBHOOK_URL` secret in your GitHub environment. +- **(13)** Click the green **Run workflow** button to start the deployment. -> **Note:** Steps 7–10 all appear in the form regardless of which profile you picked — fill in only the ones that match your profile (MOSIP-ID1/MOSIP-ID2 domains for `esignet-standalone`, PostgreSQL port for `mosip-platform-*`) and leave the rest blank. +> **Note:** Steps 7–9 all appear in the form regardless of which profile you picked — fill in only the ones that match your profile (MOSIP-ID domain for `esignet-standalone`, PostgreSQL port for `mosip-platform-*`) and leave the rest blank. > **Important:** Always pass `--keep-untracked-releases` — without it Helmsman will delete releases from previous DSFs (esignet, oidc-ui, etc.) that aren't listed in `testrigs-dsf.yaml`. The workflow handles this automatically. @@ -123,8 +121,7 @@ kubectl get cronjobs -n dslrig # For eSignet standalone kubectl get cronjobs -n esignet -kubectl get cronjobs -n esignet-mosipid1 -kubectl get cronjobs -n esignet-mosipid2 +kubectl get cronjobs -n esignet-mosipid kubectl get cronjobs -n esignet-sunbird ``` @@ -141,7 +138,7 @@ kubectl create job --from=cronjob/cronjob-dslorchestrator-full dslrig-manual-run **3. Trigger eSignet test jobs (eSignet standalone profile)** -The `trigger-test-jobs-esignet.sh` postInstall hook fires automatically after the last testrig deploys — it triggers all cronjobs across all 4 esignet namespaces sequentially and optionally signup/signup-uitestrig if deployed. +The `trigger-test-jobs-esignet.sh` postInstall hook fires automatically after the last testrig deploys — it triggers all cronjobs across all 3 esignet namespaces sequentially and optionally signup/signup-uitestrig if deployed. To trigger manually: @@ -163,8 +160,7 @@ kubectl get pods -n dslrig # Check testrig pods (eSignet standalone) kubectl get pods -n esignet # esignet-apitestrig cronjob -kubectl get pods -n esignet-mosipid1 -kubectl get pods -n esignet-mosipid2 +kubectl get pods -n esignet-mosipid kubectl get pods -n esignet-sunbird kubectl get pods -n signup # signup-apitestrig (if enabled) ``` diff --git a/docs/WORKFLOW_GUIDE.md b/docs/WORKFLOW_GUIDE.md index b86f68481..3a809b848 100644 --- a/docs/WORKFLOW_GUIDE.md +++ b/docs/WORKFLOW_GUIDE.md @@ -387,18 +387,16 @@ Mode: apply ✅ | **mode** | `apply` | MUST be apply! | | **domain_name** | `sandbox.example.net` | Or set `vars.DOMAIN_NAME` | | **esignet_db_port** | `5432` (esignet) / `5433` (MOSIP platform) | Or set `vars.ESIGNET_DB_PORT` | - | **mosipid1_domain_name** | `mosipid1.example.net` | esignet-standalone profile only — MOSIP-ID1 environment domain | - | **enable_mosipid2** | `false` (default) / `true` | Toggle to deploy MOSIP-ID2 instance; leave `false` to skip | - | **mosipid2_domain_name** | `mosipid2.example.net` | Required only if `enable_mosipid2` is `true` | + | **mosipid_domain_name** | `mosipid.example.net` | esignet-standalone profile only — MOSIP-ID environment domain | | **skip_mosip_dsf_check** | `true` for standalone, `false` when MOSIP is deployed | | | **delete_existing_jobs** | `true` when re-running after a failed attempt | Cleans up stale onboarder jobs | -3. **Monitor Progress** (25-35 minutes for esignet-standalone profile with up to 4 instances) +3. **Monitor Progress** (25-35 minutes for esignet-standalone profile with 3 instances) ``` - → SoftHSM (all 4 namespaces) + → SoftHSM (all 3 namespaces) → Config server - → eSignet core (all 4 namespaces in parallel) - → OIDC UI (all 4 namespaces) + → eSignet core (all 3 namespaces in parallel) + → OIDC UI (all 3 namespaces) → Mock identity system → Mock relying party ``` @@ -411,8 +409,7 @@ Mode: apply ✅ **Check Status:** ```bash kubectl get pods -n esignet -kubectl get pods -n esignet-mosipid1 # esignet profile only -kubectl get pods -n esignet-mosipid2 # esignet profile only +kubectl get pods -n esignet-mosipid # esignet profile only kubectl get pods -n esignet-sunbird # esignet profile only ``` @@ -445,14 +442,13 @@ kubectl get pods -n esignet-sunbird # esignet profile only | **profile** | Same as your deployment profile | | | **mode** | `apply` | | | **domain_name** | `sandbox.example.net` | Or `vars.DOMAIN_NAME` | - | **mosipid1_domain_name** | `mosipid1.example.net` | esignet-standalone profile only | - | **mosipid2_domain_name** | `mosipid2.example.net` | esignet-standalone only — required if mosipid2 was enabled | + | **mosipid_domain_name** | `mosipid.example.net` | esignet-standalone profile only | | **db_port** | `5433` | MOSIP platform only | | **esignet_db_port** | `5432` | eSignet profile | 4. **Monitor Progress** (10-20 minutes) ``` - → esignet-apitestrig (esignet profile: 4 instances across all namespaces) + → esignet-apitestrig (esignet profile: 3 instances across all namespaces) → signup-apitestrig (if signup was deployed) → API / DSL / UI test rigs (MOSIP platform profiles) ``` @@ -460,8 +456,7 @@ kubectl get pods -n esignet-sunbird # esignet profile only 5. **Verify CronJobs Created** ```bash kubectl get cronjobs -n esignet - kubectl get cronjobs -n esignet-mosipid1 # esignet profile - kubectl get cronjobs -n esignet-mosipid2 # esignet profile + kubectl get cronjobs -n esignet-mosipid # esignet profile kubectl get cronjobs -n esignet-sunbird # esignet profile ``` @@ -612,8 +607,7 @@ These inputs override the corresponding GitHub Environment Variables for a singl | `clusterid` | `vars.CLUSTER_ID` | Rancher cluster ID | | `db_port` | `vars.DB_PORT` | MOSIP platform postgres port | | `esignet_db_port` | `vars.ESIGNET_DB_PORT` | eSignet postgres port | -| `mosipid1_domain_name` | `vars.MOSIPID1_DOMAIN_NAME` | MOSIP-ID1 environment base domain (esignet profile) | -| `mosipid2_domain_name` | `vars.MOSIPID2_DOMAIN_NAME` | MOSIP-ID2 environment base domain (esignet profile) | +| `mosipid_domain_name` | `vars.MOSIPID_DOMAIN_NAME` | MOSIP-ID environment base domain (esignet profile) | --- @@ -772,10 +766,10 @@ DEPLOYMENT FLOW: └── PostgreSQL, Redis, Kafka, SoftHSM, Keycloak, Captcha, MinIO 4. Helmsman: eSignet [helmsman_esignet.yml, profile=esignet-standalone] - └── 3 instances always (esignet-mock / esignet-mosipid1 / esignet-sunbird) + esignet-mosipid2 if enable_mosipid2=true + └── 3 instances always (esignet-mock / esignet-mosipid / esignet-sunbird) 5. Helmsman: Test Rigs [helmsman_testrigs.yml, profile=esignet-standalone, manual] - └── API testrigs for all 4 esignet namespaces + └── API testrigs for all 3 esignet namespaces └── ✅ Deployment Complete! ``` diff --git a/docs/esignet_README.md b/docs/esignet_README.md index 73ad5b3ba..b38de8828 100644 --- a/docs/esignet_README.md +++ b/docs/esignet_README.md @@ -233,11 +233,9 @@ Custom Helm values are stored in: - **(7)** **Delete existing onboarder jobs before deploy** (checkbox) — only tick this when re-running after a failure. Leave unticked on a first-time deploy. - **(8)** **Domain name for this environment** — type the web domain this environment should use (e.g., `example.xyz.net`). - **(9)** **PostgreSQL port for esignet databases** — type `5432` for eSignet standalone, or `5433` if this is part of a MOSIP platform profile. -- **(10)** **MOSIP-ID1 domain name** *(eSignet standalone only)* — base domain for the MOSIP-ID1 eSignet instance (e.g., `mosipid1.xyz.net`). Leave blank if you're not deploying MOSIP-ID1. -- **(11)** **Enable MOSIP-ID2 eSignet instance** *(eSignet standalone only)* — toggle to `true` to deploy the MOSIP-ID2 instance (softhsm, esignet, oidc-ui, mock-rp). Leave `false` to skip it entirely. -- **(12)** **MOSIP-ID2 domain name** *(eSignet standalone only, required if enable_mosipid2 is true)* — base domain for the MOSIP-ID2 eSignet instance (e.g., `mosipid2.xyz.net`). -- **(13)** **Environment name** — a short nickname for this environment (e.g., `sandbox`, `dev`, `staging`). -- **(14)** Click the green **Run workflow** button to start the deployment. +- **(10)** **MOSIP-ID domain name** *(eSignet standalone only)* — base domain for the MOSIP-ID eSignet instance (e.g., `mosipid.xyz.net`). Leave blank if you're not deploying MOSIP-ID. +- **(11)** **Environment name** — a short nickname for this environment (e.g., `sandbox`, `dev`, `staging`). +- **(12)** Click the green **Run workflow** button to start the deployment. --- @@ -258,9 +256,7 @@ Custom Helm values are stored in: | `mode` | `dry-run` or `apply` | Yes | Always use `apply` — dry-run will fail | | `domain_name` | Your base domain | Yes | Or set `vars.DOMAIN_NAME` in GitHub Environment | | `esignet_db_port` | PostgreSQL port for esignet databases | Yes | `5433` for MOSIP platform external postgres, `5432` for eSignet standalone (or `vars.ESIGNET_DB_PORT`) | -| `mosipid1_domain_name` | Base domain for the MOSIP-ID1 eSignet instance | No | eSignet standalone only — leave blank otherwise (or `vars.MOSIPID1_DOMAIN_NAME`) | -| `enable_mosipid2` | Deploy MOSIP-ID2 eSignet instance | No | Toggle `true` to deploy softhsm, esignet, oidc-ui, mock-rp for mosipid2; default `false` | -| `mosipid2_domain_name` | Base domain for the MOSIP-ID2 eSignet instance | No | Required only if `enable_mosipid2` is `true` (or `vars.MOSIPID2_DOMAIN_NAME`) | +| `mosipid_domain_name` | Base domain for the MOSIP-ID eSignet instance | No | eSignet standalone only — leave blank otherwise (or `vars.MOSIPID_DOMAIN_NAME`) | | `env_name` | Environment name shown on the landing page | Yes | Or set `vars.ENV_NAME` in GitHub Environment | | `skip_mosip_dsf_check` | Skip MOSIP DSF completion check | No | Tick for eSignet standalone deploys; default `false` otherwise | | `delete_existing_jobs` | Delete stale onboarder jobs before deploy | No | Set `true` when re-running after a failure | diff --git a/terraform/implementations/aws/infra/backend.tf b/terraform/implementations/aws/infra/backend.tf deleted file mode 100644 index ff4cc9846..000000000 --- a/terraform/implementations/aws/infra/backend.tf +++ /dev/null @@ -1,5 +0,0 @@ -terraform { - backend "local" { - path = "profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate" - } -} diff --git a/terraform/implementations/aws/infra/esgotest-CONTROL-PLANE-NODE-1.yaml b/terraform/implementations/aws/infra/esgotest-CONTROL-PLANE-NODE-1.yaml deleted file mode 100644 index 9681f1e26..000000000 --- a/terraform/implementations/aws/infra/esgotest-CONTROL-PLANE-NODE-1.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v1 -clusters: -- cluster: - certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TnpnME9ERXpPVEE1TUI0WERUSTJNRGN5TXpFek16Z3lPVm9YRFRNMk1EY3lNREV6TXpneQpPVm93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRjNE5EZ3hNemt3T1RCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJGdnlSZkVZdHFhTFJRb3BRYzJON1pHWS90ZzZNYllQTlZ6WlhZTUEKS1lKckZWdkFoQmtZbDZmaEVuZkk5QUVlSUVPL2theEIwZHhNYjBtNWoxNi9mUStqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUVF2aE5tckdkdkJId2NKdWU4CjVWYjZsYWRBQ3pBS0JnZ3Foa2pPUFFRREFnTkhBREJFQWlBZGF2V3hTL284ajNra1ZuenY4aStTR2lrU1JWRU4KY2tWTU1pUVV3VU83emdJZ0c3V3ZXUVc2WHhnR0FsbWlzelg4aXZWd0Frbkg5OXpoSTNTb2RoQllxZXM9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - server: https://172.31.66.49:6443 - name: esgotest -contexts: -- context: - cluster: esgotest - user: esgotest - name: esgotest -current-context: esgotest -kind: Config -preferences: {} -users: -- name: esgotest - user: - client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrakNDQVRpZ0F3SUJBZ0lJTTdwamJrRG1zQlF3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVGM0TkRneE16a3dPVEFlRncweU5qQTNNak14TXpNNE1qbGFGdzB5TnpBMwpNak14TXpNNE1qbGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUmpJTTYvVGd4RG5BUXkKRGxYR2NwWE9nK0twQU9jSTNnYlJQbE9zSEpBMDlIdHJydnpETmsyUXVuT0FEa2lHS1d2L0NHLzlUb0Y3SEl5ZQpNc1VPN0pSQW8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVTeDVJNnVIU2pXcU5aVVJBdVoyQ0tKaHlCNUV3Q2dZSUtvWkl6ajBFQXdJRFNBQXcKUlFJaEFQRnp2UE9rb0ZDKzNVYjBPM0dkUDRScVdsc2RYODlYSGlJcUk1aFdyNFd4QWlCY3ZLZkNMbzVVdms5OQphR1RnUWtQMzk1US9wbmFGcFNqQjVORFMxeVJmeFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZURDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE56ZzBPREV6T1RBNU1CNFhEVEkyTURjeU16RXpNemd5T1ZvWERUTTJNRGN5TURFek16Z3kKT1Zvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UYzRORGd4TXprd09UQlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCR2lUSGE5c3NTMXNzTDZwM2dpY0tEYnI4akhnTjBWakw3RWJ1dXdPCnFVN3JUaHovN0UrSHpiMitaUGxGSlVuczAxbnB4czhCcHBmNkVNZHpNV1N2My9LalFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlJMSGtqcTRkS05hbzFsUkVDNQpuWUlvbUhJSGtUQUtCZ2dxaGtqT1BRUURBZ05IQURCRUFpQXpPdUtCdWpJYjJZMlg1a29NNUVlamVHbXlmTlBZCndvckZNY3FkTFEwWlBBSWdkZVZ4ZjhkdGFZblQzZmZsNzM3T0hDamVlamVvR0RYRFdJRjRKL1dLaU5zPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUlDSHFlQ3NYekhFbjJoOUlSUk04OVdZc3QwMFFpL3J1VUxZa3BRTDI0R1JvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFWXlET3YwNE1RNXdFTWc1VnhuS1Z6b1BpcVFEbkNONEcwVDVUckJ5UU5QUjdhNjc4d3paTgprTHB6Z0E1SWhpbHIvd2h2L1U2QmV4eU1uakxGRHV5VVFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= diff --git a/terraform/implementations/aws/infra/esgotest.yaml b/terraform/implementations/aws/infra/esgotest.yaml deleted file mode 120000 index 06f0a3f0c..000000000 --- a/terraform/implementations/aws/infra/esgotest.yaml +++ /dev/null @@ -1 +0,0 @@ -esgotest-CONTROL-PLANE-NODE-1.yaml \ No newline at end of file diff --git a/terraform/implementations/aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml b/terraform/implementations/aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml deleted file mode 100644 index 720fc904a..000000000 --- a/terraform/implementations/aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v1 -clusters: -- cluster: - certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlakNDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TnpnMU1EUTNOREF6TUI0WERUSTJNRGN5TmpBMk16QXdNMW9YRFRNMk1EY3lNekEyTXpBdwpNMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRjNE5UQTBOelF3TXpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJCa2t5RGpiUnlzZkxOZHlKSTUvTndEMUJqcDdyZUZZQ3RiRjlzQ0gKNHJob1VhQ2NWbXlEaldQOFM4SmhBcVN0T1VUMXdQTU80Ny9qVjJuV08yUERlNWFqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUVZUYlRFc3pDNSs2L2ZPV1o0CnVpMHJqS3BoUmpBS0JnZ3Foa2pPUFFRREFnTkpBREJHQWlFQWp1dndybjBGQlRIMWtueUFlWnM1eVFlbUF0U2UKMVhWWERacUxlT1ZiazZNQ0lRRGZHTHgwYk1DZ3RwRnE0a01JYU5DU05lY0VaU01PbTI1L1doN2ZyUzkva2c9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - server: https://172.31.64.165:6443 - name: esqa -contexts: -- context: - cluster: esqa - user: esqa - name: esqa -current-context: esqa -kind: Config -preferences: {} -users: -- name: esqa - user: - client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrekNDQVRpZ0F3SUJBZ0lJUXBQYXZONnJ2Rmd3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVGM0TlRBME56UXdNekFlRncweU5qQTNNall3TmpNd01ETmFGdzB5TnpBMwpNall3TmpNd01ETmFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBVDQzenJpZUFJL2k2V3oKcVJBVGtON2dtTWZTLy9IZE5SM21HQnljSFJIQWROSVI4anNRQ0NWak12Um9ickN4T1RsbHpsbWFiV0JvaEhHRgpla2ExSFNpbm8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVESzM2R0pMYVo1WnFzeURRUDkyb0JGK29YUjB3Q2dZSUtvWkl6ajBFQXdJRFNRQXcKUmdJaEFLbjBtaXFvMFhvNzk4bDVSc09OUzV5WFBKK0NEYmUyZFFMWUlhVlRISGYwQWlFQThBQXk4bitHdCt0dApRVlhHeDNnVWdTaVFhLzVHN0tSZ3J5d1RHbFFnQW5vPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZVRDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE56ZzFNRFEzTkRBek1CNFhEVEkyTURjeU5qQTJNekF3TTFvWERUTTJNRGN5TXpBMk16QXcKTTFvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UYzROVEEwTnpRd016QlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCRHE1VTJBVjYrNHdOc3pzUk1DQ05sdWF2NmFiNlcyaWU0RTIrNWh6CkNSc1NWTTliOEVmNzd6VEMvU0RvOXFwQ3VwVGVOU1VUMU1UdlVycVdwbHZWMEIralFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlFNcmZvWWt0cG5sbXF6SU5BLwozYWdFWDZoZEhUQUtCZ2dxaGtqT1BRUURBZ05JQURCRkFpQllZeHllWVViM3UzSWJQa0cwQVpGdVQzbEFZakh3CjdXZFdNcFVUL0hWb1dRSWhBSlVxZnk0d0lVaWNYQ2RoMTNRd21rV2YwaExFc1R5VnZoN2ozak43VXpHegotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU1tWGlhRW9Sdm1ZUWIwbCtTTHFZMGpGN204eGJBWmV1MEpYOEk0L1NCaW1vQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK044NjRuZ0NQNHVsczZrUUU1RGU0SmpIMHYveDNUVWQ1aGdjbkIwUndIVFNFZkk3RUFnbApZekwwYUc2d3NUazVaYzVabW0xZ2FJUnhoWHBHdFIwb3B3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= diff --git a/terraform/implementations/aws/infra/esqa.yaml b/terraform/implementations/aws/infra/esqa.yaml deleted file mode 120000 index 1ea779d1d..000000000 --- a/terraform/implementations/aws/infra/esqa.yaml +++ /dev/null @@ -1 +0,0 @@ -esqa-CONTROL-PLANE-NODE-1.yaml \ No newline at end of file diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg deleted file mode 100644 index 5be6c905c..000000000 Binary files a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg and /dev/null differ diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars index f38f04b72..644320705 100644 --- a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars +++ b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars @@ -7,22 +7,22 @@ # ============================================================ # Environment name (infra component) -cluster_name = "esqa" +cluster_name = "" # eSignet's domain (ex: esignet.xyz.net) -cluster_env_domain = "esqa.mosip.net" +cluster_env_domain = "" # Email-ID will be used by certbot to notify SSL certificate expiry via email -mosip_email_id = "thisisbn46@gmail.com" +mosip_email_id = "" # SSH login key name for AWS node instances (ex: my-ssh-key) -ssh_key_name = "mosip-aws" +ssh_key_name = "" # The AWS region for resource creation aws_provider_region = "ap-south-1" # Specific availability zones for VM deployment (optional) -specific_availability_zones = ["ap-south-1b"] +specific_availability_zones = [] # The instance type for Kubernetes nodes (control plane, worker, etcd) # Smaller instance type since eSignet standalone needs fewer resources @@ -32,7 +32,7 @@ k8s_instance_type = "t3a.2xlarge" nginx_instance_type = "t3a.2xlarge" # The Route 53 hosted zone ID -zone_id = "Z090954828SJIEL6P5406" +zone_id = "" ## UBUNTU 24.04 # The Amazon Machine Image ID for the instances @@ -63,7 +63,7 @@ k8s_control_plane_node_count = 1 k8s_etcd_node_count = 1 # Worker -k8s_worker_node_count = 3 +k8s_worker_node_count = 2 # RKE2 Version Configuration rke2_version = "v1.28.9+rke2r1" @@ -74,14 +74,15 @@ WIREGUARD_CIDR = "172.0.0.0/8" # Use your actual WireGuard VPN CIDR # Rancher Import Configuration enable_rancher_import = true -rancher_import_url = "\"kubectl apply -f https://rancher.mosip.net/v3/import/rmqc6znrt9q9wd8j7zdtkslk4fcrxlxh72wpk9jl5z2vpgkkm7tlkj_c-m-rrm8fbn6.yaml\"" +rancher_import_url = "\"\"" # DNS Records to map — only eSignet-relevant subdomains -# Includes hosts for both the esignet-standalone profile and the isolated -# esignet-standalone-2.0.0 profile (suffixed "-go"), since both are deployed -# side-by-side against this same cluster/domain. +# Shared by both the esignet-standalone profile and the esignet-standalone-2.0.0 +# profile — both use identical hostnames (no "-go" suffix, single consolidated +# mosipid instance instead of separate mosipid1/mosipid2), since only one of +# the two profiles is ever live on a given cluster/domain at a time. -subdomain_public = ["esignet", "healthservices", "signup", "esignet-sunbird", "healthservices-sunbird", "healthservices-mosipid1", "esignet-mosipid1", "pms-mosipid1", "signup-mosipid1", "healthservices-mosipid2", "esignet-mosipid2", "pms-mosipid2", "signup-mosipid2", "esignet-go", "healthservices-go", "signup-go", "esignet-go-sunbird", "healthservices-go-sunbird", "healthservices-go-mosipid1", "esignet-go-mosipid1", "pms-go-mosipid1", "signup-go-mosipid1", "healthservices-go-mosipid2", "esignet-go-mosipid2", "pms-go-mosipid2", "signup-go-mosipid2"] +subdomain_public = ["esignet", "healthservices", "signup", "esignet-sunbird", "healthservices-sunbird", "healthservices-mosipid", "esignet-mosipid", "pms-mosipid", "signup-mosipid"] subdomain_internal = ["iam", "activemq", "kafka", "kibana", "postgres", "smtp", "pmp", "minio"] # PostgreSQL Configuration @@ -94,10 +95,10 @@ postgresql_port = "5433" # MOSIP Infrastructure Repository Configuration mosip_infra_repo_url = "https://github.com/mosip/infra.git" -mosip_infra_branch = "es-go-test" +mosip_infra_branch = "develop" # VPC Configuration - Existing VPC to use (discovered by Name tag) -vpc_name = "default" +vpc_name = "" # ── ActiveMQ Configuration ───────────────────────────────────────────────────── # Set enable_activemq_setup = true AND nginx_node_ebs_volume_size_3 > 0 to diff --git a/terraform/implementations/aws/infra/rancher-override.tfvars b/terraform/implementations/aws/infra/rancher-override.tfvars deleted file mode 100644 index da1b2e2eb..000000000 --- a/terraform/implementations/aws/infra/rancher-override.tfvars +++ /dev/null @@ -1,2 +0,0 @@ -enable_rancher_import = true -rancher_import_url = "\"kubectl apply -f https://rancher.mosip.net/v3/import/f25prw8zrsc959n2bk25mn79twtwmpq6hpxphf9xt97dhbm797r99n_c-stb2m.yaml\"" diff --git a/terraform/implementations/aws/infra/tf-plan.gpg b/terraform/implementations/aws/infra/tf-plan.gpg deleted file mode 100644 index 8eb2d1bda..000000000 Binary files a/terraform/implementations/aws/infra/tf-plan.gpg and /dev/null differ diff --git a/terraform/modules/aws/rke2-cluster/ansible/esgotest-CONTROL-PLANE-NODE-1.yaml b/terraform/modules/aws/rke2-cluster/ansible/esgotest-CONTROL-PLANE-NODE-1.yaml deleted file mode 100644 index 9681f1e26..000000000 --- a/terraform/modules/aws/rke2-cluster/ansible/esgotest-CONTROL-PLANE-NODE-1.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v1 -clusters: -- cluster: - certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TnpnME9ERXpPVEE1TUI0WERUSTJNRGN5TXpFek16Z3lPVm9YRFRNMk1EY3lNREV6TXpneQpPVm93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRjNE5EZ3hNemt3T1RCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJGdnlSZkVZdHFhTFJRb3BRYzJON1pHWS90ZzZNYllQTlZ6WlhZTUEKS1lKckZWdkFoQmtZbDZmaEVuZkk5QUVlSUVPL2theEIwZHhNYjBtNWoxNi9mUStqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUVF2aE5tckdkdkJId2NKdWU4CjVWYjZsYWRBQ3pBS0JnZ3Foa2pPUFFRREFnTkhBREJFQWlBZGF2V3hTL284ajNra1ZuenY4aStTR2lrU1JWRU4KY2tWTU1pUVV3VU83emdJZ0c3V3ZXUVc2WHhnR0FsbWlzelg4aXZWd0Frbkg5OXpoSTNTb2RoQllxZXM9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - server: https://172.31.66.49:6443 - name: esgotest -contexts: -- context: - cluster: esgotest - user: esgotest - name: esgotest -current-context: esgotest -kind: Config -preferences: {} -users: -- name: esgotest - user: - client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrakNDQVRpZ0F3SUJBZ0lJTTdwamJrRG1zQlF3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVGM0TkRneE16a3dPVEFlRncweU5qQTNNak14TXpNNE1qbGFGdzB5TnpBMwpNak14TXpNNE1qbGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUmpJTTYvVGd4RG5BUXkKRGxYR2NwWE9nK0twQU9jSTNnYlJQbE9zSEpBMDlIdHJydnpETmsyUXVuT0FEa2lHS1d2L0NHLzlUb0Y3SEl5ZQpNc1VPN0pSQW8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVTeDVJNnVIU2pXcU5aVVJBdVoyQ0tKaHlCNUV3Q2dZSUtvWkl6ajBFQXdJRFNBQXcKUlFJaEFQRnp2UE9rb0ZDKzNVYjBPM0dkUDRScVdsc2RYODlYSGlJcUk1aFdyNFd4QWlCY3ZLZkNMbzVVdms5OQphR1RnUWtQMzk1US9wbmFGcFNqQjVORFMxeVJmeFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZURDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE56ZzBPREV6T1RBNU1CNFhEVEkyTURjeU16RXpNemd5T1ZvWERUTTJNRGN5TURFek16Z3kKT1Zvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UYzRORGd4TXprd09UQlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCR2lUSGE5c3NTMXNzTDZwM2dpY0tEYnI4akhnTjBWakw3RWJ1dXdPCnFVN3JUaHovN0UrSHpiMitaUGxGSlVuczAxbnB4czhCcHBmNkVNZHpNV1N2My9LalFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlJMSGtqcTRkS05hbzFsUkVDNQpuWUlvbUhJSGtUQUtCZ2dxaGtqT1BRUURBZ05IQURCRUFpQXpPdUtCdWpJYjJZMlg1a29NNUVlamVHbXlmTlBZCndvckZNY3FkTFEwWlBBSWdkZVZ4ZjhkdGFZblQzZmZsNzM3T0hDamVlamVvR0RYRFdJRjRKL1dLaU5zPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUlDSHFlQ3NYekhFbjJoOUlSUk04OVdZc3QwMFFpL3J1VUxZa3BRTDI0R1JvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFWXlET3YwNE1RNXdFTWc1VnhuS1Z6b1BpcVFEbkNONEcwVDVUckJ5UU5QUjdhNjc4d3paTgprTHB6Z0E1SWhpbHIvd2h2L1U2QmV4eU1uakxGRHV5VVFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= diff --git a/terraform/modules/aws/rke2-cluster/ansible/esqa-CONTROL-PLANE-NODE-1.yaml b/terraform/modules/aws/rke2-cluster/ansible/esqa-CONTROL-PLANE-NODE-1.yaml deleted file mode 100644 index 720fc904a..000000000 --- a/terraform/modules/aws/rke2-cluster/ansible/esqa-CONTROL-PLANE-NODE-1.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v1 -clusters: -- cluster: - certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlakNDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TnpnMU1EUTNOREF6TUI0WERUSTJNRGN5TmpBMk16QXdNMW9YRFRNMk1EY3lNekEyTXpBdwpNMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRjNE5UQTBOelF3TXpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJCa2t5RGpiUnlzZkxOZHlKSTUvTndEMUJqcDdyZUZZQ3RiRjlzQ0gKNHJob1VhQ2NWbXlEaldQOFM4SmhBcVN0T1VUMXdQTU80Ny9qVjJuV08yUERlNWFqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUVZUYlRFc3pDNSs2L2ZPV1o0CnVpMHJqS3BoUmpBS0JnZ3Foa2pPUFFRREFnTkpBREJHQWlFQWp1dndybjBGQlRIMWtueUFlWnM1eVFlbUF0U2UKMVhWWERacUxlT1ZiazZNQ0lRRGZHTHgwYk1DZ3RwRnE0a01JYU5DU05lY0VaU01PbTI1L1doN2ZyUzkva2c9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - server: https://172.31.64.165:6443 - name: esqa -contexts: -- context: - cluster: esqa - user: esqa - name: esqa -current-context: esqa -kind: Config -preferences: {} -users: -- name: esqa - user: - client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrekNDQVRpZ0F3SUJBZ0lJUXBQYXZONnJ2Rmd3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVGM0TlRBME56UXdNekFlRncweU5qQTNNall3TmpNd01ETmFGdzB5TnpBMwpNall3TmpNd01ETmFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBVDQzenJpZUFJL2k2V3oKcVJBVGtON2dtTWZTLy9IZE5SM21HQnljSFJIQWROSVI4anNRQ0NWak12Um9ickN4T1RsbHpsbWFiV0JvaEhHRgpla2ExSFNpbm8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVESzM2R0pMYVo1WnFzeURRUDkyb0JGK29YUjB3Q2dZSUtvWkl6ajBFQXdJRFNRQXcKUmdJaEFLbjBtaXFvMFhvNzk4bDVSc09OUzV5WFBKK0NEYmUyZFFMWUlhVlRISGYwQWlFQThBQXk4bitHdCt0dApRVlhHeDNnVWdTaVFhLzVHN0tSZ3J5d1RHbFFnQW5vPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZVRDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE56ZzFNRFEzTkRBek1CNFhEVEkyTURjeU5qQTJNekF3TTFvWERUTTJNRGN5TXpBMk16QXcKTTFvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UYzROVEEwTnpRd016QlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCRHE1VTJBVjYrNHdOc3pzUk1DQ05sdWF2NmFiNlcyaWU0RTIrNWh6CkNSc1NWTTliOEVmNzd6VEMvU0RvOXFwQ3VwVGVOU1VUMU1UdlVycVdwbHZWMEIralFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlFNcmZvWWt0cG5sbXF6SU5BLwozYWdFWDZoZEhUQUtCZ2dxaGtqT1BRUURBZ05JQURCRkFpQllZeHllWVViM3UzSWJQa0cwQVpGdVQzbEFZakh3CjdXZFdNcFVUL0hWb1dRSWhBSlVxZnk0d0lVaWNYQ2RoMTNRd21rV2YwaExFc1R5VnZoN2ozak43VXpHegotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU1tWGlhRW9Sdm1ZUWIwbCtTTHFZMGpGN204eGJBWmV1MEpYOEk0L1NCaW1vQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK044NjRuZ0NQNHVsczZrUUU1RGU0SmpIMHYveDNUVWQ1aGdjbkIwUndIVFNFZkk3RUFnbApZekwwYUc2d3NUazVaYzVabW0xZ2FJUnhoWHBHdFIwb3B3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= diff --git a/terraform/modules/aws/rke2-cluster/ansible/inventory.yml b/terraform/modules/aws/rke2-cluster/ansible/inventory.yml deleted file mode 100755 index a1bbce466..000000000 --- a/terraform/modules/aws/rke2-cluster/ansible/inventory.yml +++ /dev/null @@ -1,46 +0,0 @@ ---- -all: - vars: - cluster_name: "esqa" - cluster_env_domain: "mosip.local" - k8s_infra_repo_url: "https://github.com/mosip/k8s-infra.git" - k8s_infra_branch: "release-1.2.1.x" - install_rke2_version: "v1.28.9+rke2r1" - enable_rancher_import: true - rancher_import_url: "kubectl apply -f https://rancher.mosip.net/v3/import/rmqc6znrt9q9wd8j7zdtkslk4fcrxlxh72wpk9jl5z2vpgkkm7tlkj_c-m-rrm8fbn6.yaml" - ansible_user: ubuntu - ansible_ssh_private_key_file: ./ssh_key - ansible_ssh_common_args: '-o StrictHostKeyChecking=no' - - children: - control_plane: - hosts: - esqa-CONTROL-PLANE-NODE-1: - ansible_host: 172.31.64.165 - node_role: control_plane - is_primary: true - node_index: 0 - - etcd: - hosts: - esqa-ETCD-NODE-1: - ansible_host: 172.31.73.182 - node_role: etcd - - workers: - hosts: - esqa-WORKER-NODE-1: - ansible_host: 172.31.75.46 - node_role: worker - esqa-WORKER-NODE-2: - ansible_host: 172.31.72.215 - node_role: worker - esqa-WORKER-NODE-3: - ansible_host: 172.31.77.135 - node_role: worker - - rke2_cluster: - children: - control_plane: - etcd: - workers: