From 607fcf76fa6f1a1a715fd0bc5191dcaa45128a93 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Tue, 4 Aug 2026 17:09:40 +0530 Subject: [PATCH 01/61] fix: 2288 correct captcha version, module names, P12 paths, and mock-rp OIDC config - Bump captcha chart to 0.1.1 to match the deployed version - Give each esignet instance a unique captcha module name (esignetgomosipid1/2, esignetgosunbird) - Fix MOSIP_P12_PATH filenames per instance (mosipid1.pfx, mosipid2.pfx, mock.pfx, sunbird.pfx) - Remove duplicate MOSIP_ESIGNET_CAPTCHA_MODULE_NAME entry from mosipid1 extraEnvVars - Add mock-relying-party-ui OIDC client config (CLIENT_ID, ACRS, DISPLAY, GRANT_TYPE, CLAIMS_LOCALES, SCOPE_USER_PROFILE, CLAIMS_USER_PROFILE, CLAIMS_REGISTRATION, FALLBACK_LANG, AUTHORIZE_ENDPOINT, CODE_CHALLENGE) across all instances in both esignet-standalone and esignet-standalone-2.0.0 profiles - Add mock-relying-party-service valuesFile (mock-replying-party.yaml) with PAR-related extraEnvVars, wired into all 4 mock-relying-party-service-go* apps https://github.com/mosip/esignet/issues/2288 Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 143 +++++++++++++----- .../dsf/esignet-standalone/esignet-dsf.yaml | 56 +++++++ .../dsf/esignet-standalone/external-dsf.yaml | 2 +- .../esignet-mosipid1-plugin-values-2-0-0.yaml | 6 +- .../esignet-mosipid2-plugin-values-2-0-0.yaml | 4 +- .../esignet-plugin-values-2-0-0.yaml | 4 +- .../esignet-sunbird-plugin-values-2-0-0.yaml | 4 +- .../mock-replying-party.yaml | 25 +++ 8 files changed, 198 insertions(+), 46 deletions(-) create mode 100644 Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 55e650580..9ce3a8826 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -103,7 +103,7 @@ apps: postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh" # --------------------------------------------------------------------------- - # eSignet v1.7.1 + # eSignet # --------------------------------------------------------------------------- esignet-go-mock: namespace: esignet-go-mock @@ -122,11 +122,11 @@ apps: extraEnvVarsCM[0]: "esignet-softhsm-go-share" #extraEnvVarsCM[1]: "kafka-config" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-go.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-go.${domain_name}" - domainConfig.MOSIP_API_HOST: "api.${domain_name}" - domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-go.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup-go.${domain_name}" + domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" @@ -155,11 +155,11 @@ apps: extraEnvVarsCM[0]: "esignet-softhsm-go-mosipid1-share" extraEnvVarsCM[1]: "esignet-global" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-go-mosipid1.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-go-mosipid1.${domain_name}" - domainConfig.MOSIP_API_HOST: "api.${domain_name}" - domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid1_domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-go-mosipid1.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup-go-mosipid1.${domain_name}" + domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid1_domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" @@ -196,11 +196,11 @@ apps: extraEnvVarsCM[0]: "esignet-softhsm-go-mosipid2-share" extraEnvVarsCM[1]: "esignet-global" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-go-mosipid2.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-go-mosipid2.${domain_name}" - domainConfig.MOSIP_API_HOST: "api.${domain_name}" - domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid2_domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-go-mosipid2.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup-go-mosipid2.${domain_name}" + domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid2_domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" @@ -237,11 +237,11 @@ apps: extraEnvVarsCM[0]: "esignet-softhsm-go-sunbird-share" #extraEnvVarsCM[1]: "kafka-config" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-go-sunbird.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-go-sunbird.${domain_name}" - domainConfig.MOSIP_API_HOST: "api.${domain_name}" - domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-go-sunbird.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup-go-sunbird.${domain_name}" + domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" @@ -256,12 +256,12 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh" # --------------------------------------------------------------------------- - # OIDC UI v1.7.1 + # OIDC UI # --------------------------------------------------------------------------- oidc-ui-go: namespace: esignet-go-mock enabled: true - version: 0.0.1-develop + version: 2.0.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" @@ -270,6 +270,7 @@ apps: oidc_ui.oidc_service_host: "esignet-go-mock.esignet-go-mock" oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-go-mock.esignet-go-mock/v1/esignet" oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-go-mock.esignet-go-mock" + timeout: 1200 priority: -13 hooks: @@ -278,7 +279,7 @@ apps: oidc-ui-go-mosipid1: namespace: esignet-go-mosipid1 enabled: true - version: 0.1.0-develop + version: 2.0.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" @@ -295,7 +296,7 @@ apps: oidc-ui-go-mosipid2: namespace: esignet-go-mosipid2 enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop + version: 2.0.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" @@ -312,7 +313,7 @@ apps: oidc-ui-go-sunbird: namespace: esignet-go-sunbird enabled: true - version: 0.0.1-develop + version: 2.0.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" @@ -380,11 +381,15 @@ apps: enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service + valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-replying-party.yaml" set: image.repository: "mosipqa/mock-relying-party-service" image.tag: "develop-go" - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-mock.esignet-go-mock/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go.${domain_name}/v1/esignet/oauth/v2/token" + mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-go.${domain_name}/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go.${domain_name}" + mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-go.${domain_name}/v1/esignet/oauth2/par" + mock_relying_party_service.REDIRECT_URI: "https://healthservices-go.${domain_name}/userprofile" + mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" timeout: 480 @@ -397,11 +402,15 @@ apps: enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service + valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-replying-party.yaml" set: image.repository: "mosipqa/mock-relying-party-service" image.tag: "develop-go" - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-mosipid1.esignet-go-mosipid1/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid1.${domain_name}/v1/esignet/oauth/v2/token" + mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-go-mosipid1.${domain_name}/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid1.${domain_name}" + mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-go-mosipid1.${domain_name}/v1/esignet/oauth2/par" + mock_relying_party_service.REDIRECT_URI: "https://healthservices-go-mosipid1.${domain_name}/userprofile" + mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go-mosipid1.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" timeout: 480 @@ -414,11 +423,15 @@ apps: enabled: ${MOSIPID2_ENABLED} version: 0.0.1-develop chart: mosip/mock-relying-party-service + valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-replying-party.yaml" set: image.repository: "mosipqa/mock-relying-party-service" - image.tag: "develop-go" - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-mosipid2.esignet-go-mosipid2/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid2.${domain_name}/v1/esignet/oauth/v2/token" + image.tag: "develop-go" + mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-go-mosipid2.${domain_name}/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid2.${domain_name}" + mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-go-mosipid2.${domain_name}/v1/esignet/oauth2/par" + mock_relying_party_service.REDIRECT_URI: "https://healthservices-go-mosipid2.${domain_name}/userprofile" + mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go-mosipid2.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" timeout: 480 @@ -431,11 +444,15 @@ apps: enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service + valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-replying-party.yaml" set: image.repository: "mosipqa/mock-relying-party-service" image.tag: "develop-go" - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-go-sunbird.esignet-go-sunbird/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-sunbird.${domain_name}/v1/esignet/oauth/v2/token" + mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-go-sunbird.${domain_name}/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-sunbird.${domain_name}" + mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-go-sunbird.${domain_name}/v1/esignet/oauth2/par" + mock_relying_party_service.REDIRECT_URI: "https://healthservices-go-sunbird.${domain_name}/userprofile" + mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go-sunbird.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" timeout: 480 @@ -458,6 +475,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices-go.${domain_name}" wait: true timeout: 480 @@ -480,6 +511,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go-mosipid1.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go-mosipid1.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go-mosipid1.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices-go-mosipid1.${domain_name}" wait: true timeout: 480 @@ -502,6 +547,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go-mosipid2.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go-mosipid2.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go-mosipid2.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices-go-mosipid2.${domain_name}" wait: true timeout: 480 @@ -524,6 +583,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go-sunbird.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go-sunbird.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go-sunbird.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices-go-sunbird.${domain_name}" wait: true timeout: 480 diff --git a/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml index bdeb831ef..5db2e94be 100644 --- a/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml @@ -443,6 +443,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices.${domain_name}" wait: true timeout: 480 @@ -463,6 +477,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid1.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid1.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid1.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices-mosipid1.${domain_name}" wait: true timeout: 480 @@ -483,6 +511,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid2.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid2.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid2.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices-mosipid2.${domain_name}" wait: true timeout: 480 @@ -503,6 +545,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices-sunbird.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-sunbird.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-sunbird.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices-sunbird.${domain_name}" wait: true timeout: 480 diff --git a/Helmsman/dsf/esignet-standalone/external-dsf.yaml b/Helmsman/dsf/esignet-standalone/external-dsf.yaml index c25538342..f44e721d9 100644 --- a/Helmsman/dsf/esignet-standalone/external-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/external-dsf.yaml @@ -512,7 +512,7 @@ apps: captcha: namespace: captcha enabled: true - version: 0.1.0-beta.1 + version: 0.1.1 chart: mosip/captcha set: metrics.serviceMonitor.enabled: "false" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml index efeb38505..697de99b0 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml @@ -9,8 +9,6 @@ extraEnvVars: configMapKeyRef: name: keycloak-host key: keycloak-external-url - - name: MOSIP_ESIGNET_CAPTCHA_MODULE_NAME - value: esignet - name: REDIS_HOST valueFrom: configMapKeyRef: @@ -64,7 +62,7 @@ extraEnvVars: - name: AUTHN_PROVIDER value: mosip - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/esignet.pfx + value: /home/mosip/keys/secret/mosipid1.pfx - name: MOSIP_P12_PASSWORD value: localtest - name: OIDC_UI_SCHEME @@ -85,7 +83,7 @@ extraEnvVars: value: decl-mosip-otp-flow-1 extraEnvVarsAdditional: - name: "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME" - value: "esignetmosipid1" + value: "esignetgomosipid1" - name: "MOSIP_ESIGNET_CAPTCHA_SITE-KEY" valueFrom: secretKeyRef: diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml index 6f4317522..96e42db3e 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml @@ -62,7 +62,7 @@ extraEnvVars: - name: AUTHN_PROVIDER value: mosip - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/esignet.pfx + value: /home/mosip/keys/secret/mosipid2.pfx - name: MOSIP_P12_PASSWORD value: localtest - name: OIDC_UI_SCHEME @@ -83,7 +83,7 @@ extraEnvVars: value: decl-mosip-otp-flow-1 extraEnvVarsAdditional: - name: "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME" - value: "esignetmosipid2" + value: "esignetgomosipid2" - name: "MOSIP_ESIGNET_CAPTCHA_SITE-KEY" valueFrom: secretKeyRef: diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml index 699de0f37..6f53b8731 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml @@ -22,7 +22,7 @@ extraEnvVars: name: esignet-captcha-go key: esignet-captcha-site-key - name: MOSIP_ESIGNET_CAPTCHA_MODULE_NAME - value: esignet + value: esignetgo - name: REDIS_HOST valueFrom: configMapKeyRef: @@ -76,7 +76,7 @@ extraEnvVars: - name: AUTHN_PROVIDER value: mosip - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/esignet.pfx + value: /home/mosip/keys/secret/mock.pfx - name: MOSIP_P12_PASSWORD value: localtest - name: OIDC_UI_SCHEME diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml index d579720f6..54f52350c 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml @@ -10,7 +10,7 @@ extraEnvVars: name: keycloak-host key: keycloak-external-url - name: MOSIP_ESIGNET_CAPTCHA_MODULE_NAME - value: esignet + value: esignetgosunbird - name: REDIS_HOST valueFrom: configMapKeyRef: @@ -64,7 +64,7 @@ extraEnvVars: - name: AUTHN_PROVIDER value: mosip - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/esignet.pfx + value: /home/mosip/keys/secret/sunbird.pfx - name: MOSIP_P12_PASSWORD value: localtest - name: OIDC_UI_SCHEME diff --git a/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml b/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml new file mode 100644 index 000000000..152594a8b --- /dev/null +++ b/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml @@ -0,0 +1,25 @@ +extraEnvVars: + - name: CLIENT_ID + value: I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM + - name: ACRS + value: >- + mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet%20mosip:idp:acr:password%20mosip:idp:acr:knowledge + - name: DISPLAY + value: page + - name: GRANT_TYPE + value: authorization_code + - name: CLAIMS_LOCALES + value: en + - name: SCOPE_USER_PROFILE + value: openid profile + - name: CLAIMS_USER_PROFILE + value: >- + {"userinfo":{"given_name":{"essential":true},"phone_number":{"essential":true},"email":{"essential":true},"picture":{"essential":false},"gender":{"essential":false},"birthdate":{"essential":false},"address":{"essential":false}},"id_token":{}} +mock_relying_party_service: + host: '' + mountDir: "" # path inside docker + healthCheckUrl: + mock_relying_party_serviceMountDIr: /home/mosip/oidc/ + puburl: + privurl: + USERINFO_RESPONSE_TYPE: jwt From 411fb31d4081fbd089dc883d6714488998216742 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Tue, 4 Aug 2026 17:36:54 +0530 Subject: [PATCH 02/61] docs: document esignet-standalone-2.0.0 differences in deployment guide Add inline notes throughout ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md covering the esignet-standalone-2.0.0 (Go) profile alongside the existing esignet-standalone (v1.7.1) instructions: - -go namespace/hostname equivalents in the instances table - shared mosipid1/mosipid2 domain variables and captcha/signup secrets (no separate _GO secrets) across both profiles - profile dropdown values per workflow step, noting Step 1 (external services) always uses esignet-standalone regardless of which esignet profile is deployed - verification commands and expected URLs side by side for both profiles - MOSIP ID onboarding note on allowed-domain-uris when both profiles point at the same remote MOSIP environment Signed-off-by: bhumi46 --- docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md | 100 +++++++++++++++++--- 1 file changed, 87 insertions(+), 13 deletions(-) diff --git a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md index ee2e06e61..4340b2245 100644 --- a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md +++ b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md @@ -52,6 +52,9 @@ This deployment can run up to **4 separate eSignet instances** on the same clust | **eSignet MOSIP-ID2** | `esignet-mosipid2` | A second real MOSIP identity system at `MOSIPID2_DOMAIN_NAME` | No | | **eSignet Sunbird** | `esignet-sunbird` | A Sunbird RC credential registry | Yes | +> **Deploying `esignet-standalone-2.0.0` instead?** Same 4 instances, `-go`-suffixed namespaces: +> `esignet-go-mock`, `esignet-go-mosipid1`, `esignet-go-mosipid2`, `esignet-go-sunbird`. + ### When do you need mosipid1? Use `esignet-mosipid1` when you want eSignet to authenticate citizens against a **real MOSIP identity system**. You give it the domain of your MOSIP environment (e.g. `mosipenv.your-org.net`) via the `MOSIPID1_DOMAIN_NAME` variable, and the deployment automatically connects eSignet to that system's identity APIs, database, and Keycloak. @@ -74,6 +77,11 @@ If you only have one MOSIP system to connect to, leave mosipid2 disabled. You do > No DSF file edits needed — `enable_mosipid2` is a workflow input toggle that controls deployment at runtime. +> **`esignet-standalone-2.0.0` note:** `MOSIPID1_DOMAIN_NAME` and `MOSIPID2_DOMAIN_NAME` are the same variables +> used by both profiles — if you run `esignet-standalone` and `esignet-standalone-2.0.0` side by side, their +> mosipid1/mosipid2 instances point at the **same** remote MOSIP environment(s). There's no separate `_GO`-suffixed +> domain variable. + --- ## 1. Before You Start @@ -148,6 +156,12 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings | `ESIGNET_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for the main `esignet-mock` namespace | | `ESIGNET_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for the main `esignet-mock` namespace | +> **`esignet-standalone-2.0.0` note:** `helmsman_external.yml` has no `esignet-standalone-2.0.0` option in its +> `profile` dropdown — it only ever deploys as `esignet-standalone`. The 2.0.0 profile has no `external-dsf.yaml` +> of its own; it reuses this same shared captcha/Postgres/Keycloak/Redis/Kafka/MinIO deployment (see the callout +> at the top of this guide). Always run Step 1 with `profile: esignet-standalone`, even if you only plan to +> deploy `esignet-standalone-2.0.0` in Step 2. + **For `helmsman_esignet.yml`:** | Secret Name | What it is | @@ -167,6 +181,13 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings > ⚠️ `MOSIPID1_KEYCLOAK_ADMIN_PASSWORD` and `MOSIPID2_KEYCLOAK_ADMIN_PASSWORD` are the admin passwords of the **remote** MOSIP-ID1 and MOSIP-ID2 Keycloak instances (not the local one deployed by this stack). The preinstall hook calls those Keycloak REST APIs to fetch client secrets. A wrong domain or wrong password here will cause the preinstall to fail with a curl error. +> **`esignet-standalone-2.0.0` note:** All of the secrets above are **reused as-is** by `esignet-standalone-2.0.0` +> — there are no separate `_GO`-suffixed GitHub secrets. Internally, the 2.0.0 hooks create differently-named +> Kubernetes secrets (e.g. `esignet-captcha-go`, `esignet-captcha-go-mosipid1`) and patch differently-named env +> vars onto the shared `captcha` deployment (e.g. `MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO`) so both +> profiles can coexist on the same captcha pod — but the underlying reCAPTCHA key **values** you configure here +> are shared between `esignet-standalone` and `esignet-standalone-2.0.0`. + **For `helmsman_signup.yml` (set now even though signup is not yet active):** | Secret Name | What it is | @@ -174,6 +195,9 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings | `MOSIP_SIGNUP_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for the `signup` namespace | | `MOSIP_SIGNUP_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for the `signup` namespace | +> **`esignet-standalone-2.0.0` note:** Same secrets reused here too — signup for the 2.0.0 profile deploys into +> the `signup-go` namespace (vs `signup` for `esignet-standalone`) but shares these same GitHub secret values. + --- ### C. Environment Variables @@ -206,12 +230,16 @@ Step 0 → Provision Infrastructure (terraform plan / apply) ├── 0b base-infra ~10 min ← once per AWS account; skip if already done ├── 0c observ-infra ~15 min ← optional monitoring cluster └── 0d infra ~20 min profile: esignet-standalone ← the main cluster -Step 1 → Deploy External Services (helmsman_external.yml) ~20 min -Step 2 → Deploy eSignet (helmsman_esignet.yml) ~25 min +Step 1 → Deploy External Services (helmsman_external.yml) ~20 min profile: esignet-standalone (always) +Step 2 → Deploy eSignet (helmsman_esignet.yml) ~25 min profile: esignet-standalone or esignet-standalone-2.0.0 Step 3 → Deploy Signup (helmsman_signup.yml) ⚠️ IN PROGRESS — not ready yet -Step 4 → Deploy Testrigs (optional) (helmsman_testrigs.yml) ~10 min +Step 4 → Deploy Testrigs (optional) (helmsman_testrigs.yml) ~10 min profile: esignet-standalone or esignet-standalone-2.0.0 ``` +> Steps 2–4 accept either profile in their `profile` dropdown — pick `esignet-standalone-2.0.0` to deploy the +> Go-based instances instead of (or alongside) the v1.7.1 ones. Step 1 has no 2.0.0 option since both profiles +> share the same external infrastructure. + --- ### Step 0 — Provision Infrastructure (Terraform) @@ -349,7 +377,7 @@ All pods should show `Running` or `Completed`. | Field | Value to enter | |---|---| -| `profile` | `esignet-standalone` | +| `profile` | `esignet-standalone` **or** `esignet-standalone-2.0.0` — see note below | | `mode` | `apply` | | `skip_mosip_dsf_check` | **tick this** — standalone has no MOSIP deployment to wait for | | `delete_existing_jobs` | tick only if re-running after a failure; leave unticked on first deploy | @@ -362,16 +390,34 @@ All pods should show `Running` or `Completed`. > **Important:** Always tick `skip_mosip_dsf_check` for standalone eSignet — without it, the workflow waits for a `mosip-dsf=completed` namespace label that will never appear (there is no full MOSIP deployment in this mode), and the workflow will fail. +> **`esignet-standalone-2.0.0` note:** Selecting `esignet-standalone-2.0.0` runs `Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml` +> instead — it deploys the same 4 instances (main/mock, mosipid1, mosipid2, sunbird) plus their OIDC UIs and mock +> relying party service, but into `-go`-suffixed namespaces (`esignet-go-mock`, `esignet-go-mosipid1`, +> `esignet-go-mosipid2`, `esignet-go-sunbird`) with `-go`-suffixed hostnames (e.g. `esignet-go.sandbox.xyz.net`). +> All other fields (`domain_name`, `mosipid1_domain_name`, `enable_mosipid2`, etc.) work the same way as for +> `esignet-standalone`. You can run both profiles side by side in the same cluster — Step 1 only needs to be run +> once, with `profile: esignet-standalone`. + 4. Click the green **`Run workflow`** button ![Deploy eSignet - Helmsman](_images/esignet.png) **How to know it succeeded:** + +For `esignet-standalone`: ```bash kubectl get pods -n esignet-mock && kubectl get pods -n esignet-mosipid1 && kubectl get pods -n esignet-sunbird # If enable_mosipid2 was set to true: kubectl get pods -n esignet-mosipid2 ``` + +For `esignet-standalone-2.0.0`: +```bash +kubectl get pods -n esignet-go-mock && kubectl get pods -n esignet-go-mosipid1 && kubectl get pods -n esignet-go-sunbird +# If enable_mosipid2 was set to true: +kubectl get pods -n esignet-go-mosipid2 +``` + All pods should show `Running`. --- @@ -385,6 +431,10 @@ All pods should show `Running`. > **What you need to do right now:** Nothing — skip this step for now. However, make sure the signup secrets (`MOSIP_SIGNUP_CAPTCHA_SITE_KEY` and `MOSIP_SIGNUP_CAPTCHA_SECRET_KEY`) are already added to the GitHub Environment (see Section 2) so you are ready when signup is enabled. > > This section will be updated with full instructions once signup deployment is ready. +> +> **`esignet-standalone-2.0.0` note:** `helmsman_signup.yml` already lists `esignet-standalone-2.0.0` in its +> `profile` dropdown (deploys into the `signup-go` namespace instead of `signup`), but it's equally not-yet-ready +> for either profile. --- @@ -402,7 +452,7 @@ All pods should show `Running`. | Field | Value to enter | |---|---| -| `profile` | `esignet-standalone` | +| `profile` | `esignet-standalone` **or** `esignet-standalone-2.0.0` — matches whichever profile you deployed in Step 2 | | `mode` | `apply` | | `domain_name` | your base domain — e.g. `sandbox.xyz.net` | | `mosipid1_domain_name` | MOSIP-ID1 base domain *(if MOSIP-ID1 was deployed in Step 2)* | @@ -417,11 +467,23 @@ All pods should show `Running`. ![Deploy Test Rigs - Helmsman](_images/helmsman-testrigs.png) **How to know it succeeded:** The workflow log should show all Helmsman releases applied without errors. Verify that test cronjobs were created: + +For `esignet-standalone`: ```bash kubectl get cronjobs -n esignet-mock kubectl get cronjobs -n esignet-mosipid1 kubectl get cronjobs -n esignet-mosipid2 kubectl get cronjobs -n esignet-sunbird +kubectl get cronjobs -n signup +``` + +For `esignet-standalone-2.0.0`: +```bash +kubectl get cronjobs -n esignet-go-mock +kubectl get cronjobs -n esignet-go-mosipid1 +kubectl get cronjobs -n esignet-go-mosipid2 +kubectl get cronjobs -n esignet-go-sunbird +kubectl get cronjobs -n signup-go ``` --- @@ -458,16 +520,19 @@ helm list -n keycloak kubectl get pods --all-namespaces | grep -v Running | grep -v Completed | grep -v Terminating ``` +> **Deployed `esignet-standalone-2.0.0`?** Swap in the `-go` namespaces: `esignet-go-mock`, `esignet-go-mosipid1`, +> `esignet-go-mosipid2`, `esignet-go-sunbird`. `keycloak` is shared, so `helm list -n keycloak` is unchanged. + **Expected URLs after deployment** (replace `sandbox.xyz.net` with your domain): -| Service | URL | -|---|---| -| eSignet OIDC UI | `https://esignet.sandbox.xyz.net` | -| Mock Relying Party UI | `https://healthservices.sandbox.xyz.net` | -| Keycloak | `https://iam.sandbox.xyz.net` | -| MOSIP-ID1 eSignet | `https://esignet-mosipid1.sandbox.xyz.net` | -| MOSIP-ID2 eSignet | `https://esignet-mosipid2.sandbox.xyz.net` | -| Sunbird eSignet | `https://esignet-sunbird.sandbox.xyz.net` | +| Service | esignet-standalone URL | esignet-standalone-2.0.0 URL | +|---|---|---| +| eSignet OIDC UI | `https://esignet.sandbox.xyz.net` | `https://esignet-go.sandbox.xyz.net` | +| Mock Relying Party UI | `https://healthservices.sandbox.xyz.net` | `https://healthservices-go.sandbox.xyz.net` | +| Keycloak | `https://iam.sandbox.xyz.net` | *(shared — same URL)* | +| MOSIP-ID1 eSignet | `https://esignet-mosipid1.sandbox.xyz.net` | `https://esignet-go-mosipid1.sandbox.xyz.net` | +| MOSIP-ID2 eSignet | `https://esignet-mosipid2.sandbox.xyz.net` | `https://esignet-go-mosipid2.sandbox.xyz.net` | +| Sunbird eSignet | `https://esignet-sunbird.sandbox.xyz.net` | `https://esignet-go-sunbird.sandbox.xyz.net` | --- @@ -510,6 +575,15 @@ mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet. Replace `` with your eSignet standalone base domain (e.g. `sandbox.xyz.net`). +> **`esignet-standalone-2.0.0` note:** Since `MOSIPID1_DOMAIN_NAME`/`MOSIPID2_DOMAIN_NAME` are shared between both +> profiles (see [Section 0](#0-understanding-the-esignet-instances)), if you're running `esignet-mosipid1` (v1.7.1) +> and `esignet-go-mosipid1` (2.0.0) against the **same** remote MOSIP-ID1 environment, add **both** hostnames to +> `mosip.ida.allowed.domain.uris`: +> ```properties +> mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1.,https://esignet-go-mosipid1. +> ``` +> Otherwise, only add the hostname for whichever profile(s) you actually deployed. + Reference commit: [mosip/mosip-config@27276cb](https://github.com/mosip/mosip-config/commit/27276cbb7fa01015492855baa3e00fe0a4db421c) After committing these changes, restart the `id-authentication` pods on the MOSIP platform so the config server picks up the new values: From 27269edae60d7f1efb69b78998a433c98eef5b23 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:10:52 +0530 Subject: [PATCH 03/61] Delete terraform/implementations/aws/infra/esgotest-CONTROL-PLANE-NODE-1.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- .../infra/esgotest-CONTROL-PLANE-NODE-1.yaml | 19 ------------------- 1 file changed, 19 deletions(-) delete mode 100644 terraform/implementations/aws/infra/esgotest-CONTROL-PLANE-NODE-1.yaml diff --git a/terraform/implementations/aws/infra/esgotest-CONTROL-PLANE-NODE-1.yaml b/terraform/implementations/aws/infra/esgotest-CONTROL-PLANE-NODE-1.yaml deleted file mode 100644 index 9681f1e26..000000000 --- a/terraform/implementations/aws/infra/esgotest-CONTROL-PLANE-NODE-1.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v1 -clusters: -- cluster: - certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TnpnME9ERXpPVEE1TUI0WERUSTJNRGN5TXpFek16Z3lPVm9YRFRNMk1EY3lNREV6TXpneQpPVm93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRjNE5EZ3hNemt3T1RCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJGdnlSZkVZdHFhTFJRb3BRYzJON1pHWS90ZzZNYllQTlZ6WlhZTUEKS1lKckZWdkFoQmtZbDZmaEVuZkk5QUVlSUVPL2theEIwZHhNYjBtNWoxNi9mUStqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUVF2aE5tckdkdkJId2NKdWU4CjVWYjZsYWRBQ3pBS0JnZ3Foa2pPUFFRREFnTkhBREJFQWlBZGF2V3hTL284ajNra1ZuenY4aStTR2lrU1JWRU4KY2tWTU1pUVV3VU83emdJZ0c3V3ZXUVc2WHhnR0FsbWlzelg4aXZWd0Frbkg5OXpoSTNTb2RoQllxZXM9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - server: https://172.31.66.49:6443 - name: esgotest -contexts: -- context: - cluster: esgotest - user: esgotest - name: esgotest -current-context: esgotest -kind: Config -preferences: {} -users: -- name: esgotest - user: - client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrakNDQVRpZ0F3SUJBZ0lJTTdwamJrRG1zQlF3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVGM0TkRneE16a3dPVEFlRncweU5qQTNNak14TXpNNE1qbGFGdzB5TnpBMwpNak14TXpNNE1qbGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUmpJTTYvVGd4RG5BUXkKRGxYR2NwWE9nK0twQU9jSTNnYlJQbE9zSEpBMDlIdHJydnpETmsyUXVuT0FEa2lHS1d2L0NHLzlUb0Y3SEl5ZQpNc1VPN0pSQW8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVTeDVJNnVIU2pXcU5aVVJBdVoyQ0tKaHlCNUV3Q2dZSUtvWkl6ajBFQXdJRFNBQXcKUlFJaEFQRnp2UE9rb0ZDKzNVYjBPM0dkUDRScVdsc2RYODlYSGlJcUk1aFdyNFd4QWlCY3ZLZkNMbzVVdms5OQphR1RnUWtQMzk1US9wbmFGcFNqQjVORFMxeVJmeFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZURDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE56ZzBPREV6T1RBNU1CNFhEVEkyTURjeU16RXpNemd5T1ZvWERUTTJNRGN5TURFek16Z3kKT1Zvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UYzRORGd4TXprd09UQlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCR2lUSGE5c3NTMXNzTDZwM2dpY0tEYnI4akhnTjBWakw3RWJ1dXdPCnFVN3JUaHovN0UrSHpiMitaUGxGSlVuczAxbnB4czhCcHBmNkVNZHpNV1N2My9LalFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlJMSGtqcTRkS05hbzFsUkVDNQpuWUlvbUhJSGtUQUtCZ2dxaGtqT1BRUURBZ05IQURCRUFpQXpPdUtCdWpJYjJZMlg1a29NNUVlamVHbXlmTlBZCndvckZNY3FkTFEwWlBBSWdkZVZ4ZjhkdGFZblQzZmZsNzM3T0hDamVlamVvR0RYRFdJRjRKL1dLaU5zPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUlDSHFlQ3NYekhFbjJoOUlSUk04OVdZc3QwMFFpL3J1VUxZa3BRTDI0R1JvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFWXlET3YwNE1RNXdFTWc1VnhuS1Z6b1BpcVFEbkNONEcwVDVUckJ5UU5QUjdhNjc4d3paTgprTHB6Z0E1SWhpbHIvd2h2L1U2QmV4eU1uakxGRHV5VVFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= From b90214854ea5e8bfd34223426c53faf550cc18eb Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:10:59 +0530 Subject: [PATCH 04/61] Delete terraform/implementations/aws/infra/esgotest.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- terraform/implementations/aws/infra/esgotest.yaml | 1 - 1 file changed, 1 deletion(-) delete mode 120000 terraform/implementations/aws/infra/esgotest.yaml diff --git a/terraform/implementations/aws/infra/esgotest.yaml b/terraform/implementations/aws/infra/esgotest.yaml deleted file mode 120000 index 06f0a3f0c..000000000 --- a/terraform/implementations/aws/infra/esgotest.yaml +++ /dev/null @@ -1 +0,0 @@ -esgotest-CONTROL-PLANE-NODE-1.yaml \ No newline at end of file From 065ba34d5dd1dd442aedd16b2f80cbe421acdb13 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:11:29 +0530 Subject: [PATCH 05/61] Delete terraform/implementations/aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- .../aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml | 19 ------------------- 1 file changed, 19 deletions(-) delete mode 100644 terraform/implementations/aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml diff --git a/terraform/implementations/aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml b/terraform/implementations/aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml deleted file mode 100644 index 720fc904a..000000000 --- a/terraform/implementations/aws/infra/esqa-CONTROL-PLANE-NODE-1.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v1 -clusters: -- cluster: - certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlakNDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TnpnMU1EUTNOREF6TUI0WERUSTJNRGN5TmpBMk16QXdNMW9YRFRNMk1EY3lNekEyTXpBdwpNMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRjNE5UQTBOelF3TXpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJCa2t5RGpiUnlzZkxOZHlKSTUvTndEMUJqcDdyZUZZQ3RiRjlzQ0gKNHJob1VhQ2NWbXlEaldQOFM4SmhBcVN0T1VUMXdQTU80Ny9qVjJuV08yUERlNWFqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUVZUYlRFc3pDNSs2L2ZPV1o0CnVpMHJqS3BoUmpBS0JnZ3Foa2pPUFFRREFnTkpBREJHQWlFQWp1dndybjBGQlRIMWtueUFlWnM1eVFlbUF0U2UKMVhWWERacUxlT1ZiazZNQ0lRRGZHTHgwYk1DZ3RwRnE0a01JYU5DU05lY0VaU01PbTI1L1doN2ZyUzkva2c9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - server: https://172.31.64.165:6443 - name: esqa -contexts: -- context: - cluster: esqa - user: esqa - name: esqa -current-context: esqa -kind: Config -preferences: {} -users: -- name: esqa - user: - client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrekNDQVRpZ0F3SUJBZ0lJUXBQYXZONnJ2Rmd3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVGM0TlRBME56UXdNekFlRncweU5qQTNNall3TmpNd01ETmFGdzB5TnpBMwpNall3TmpNd01ETmFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBVDQzenJpZUFJL2k2V3oKcVJBVGtON2dtTWZTLy9IZE5SM21HQnljSFJIQWROSVI4anNRQ0NWak12Um9ickN4T1RsbHpsbWFiV0JvaEhHRgpla2ExSFNpbm8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVESzM2R0pMYVo1WnFzeURRUDkyb0JGK29YUjB3Q2dZSUtvWkl6ajBFQXdJRFNRQXcKUmdJaEFLbjBtaXFvMFhvNzk4bDVSc09OUzV5WFBKK0NEYmUyZFFMWUlhVlRISGYwQWlFQThBQXk4bitHdCt0dApRVlhHeDNnVWdTaVFhLzVHN0tSZ3J5d1RHbFFnQW5vPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZVRDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE56ZzFNRFEzTkRBek1CNFhEVEkyTURjeU5qQTJNekF3TTFvWERUTTJNRGN5TXpBMk16QXcKTTFvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UYzROVEEwTnpRd016QlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCRHE1VTJBVjYrNHdOc3pzUk1DQ05sdWF2NmFiNlcyaWU0RTIrNWh6CkNSc1NWTTliOEVmNzd6VEMvU0RvOXFwQ3VwVGVOU1VUMU1UdlVycVdwbHZWMEIralFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlFNcmZvWWt0cG5sbXF6SU5BLwozYWdFWDZoZEhUQUtCZ2dxaGtqT1BRUURBZ05JQURCRkFpQllZeHllWVViM3UzSWJQa0cwQVpGdVQzbEFZakh3CjdXZFdNcFVUL0hWb1dRSWhBSlVxZnk0d0lVaWNYQ2RoMTNRd21rV2YwaExFc1R5VnZoN2ozak43VXpHegotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU1tWGlhRW9Sdm1ZUWIwbCtTTHFZMGpGN204eGJBWmV1MEpYOEk0L1NCaW1vQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK044NjRuZ0NQNHVsczZrUUU1RGU0SmpIMHYveDNUVWQ1aGdjbkIwUndIVFNFZkk3RUFnbApZekwwYUc2d3NUazVaYzVabW0xZ2FJUnhoWHBHdFIwb3B3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= From 515e4c679f8a4ae730724b6f2db0c93bff5c266d Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:11:38 +0530 Subject: [PATCH 06/61] Delete terraform/implementations/aws/infra/esqa.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- terraform/implementations/aws/infra/esqa.yaml | 1 - 1 file changed, 1 deletion(-) delete mode 120000 terraform/implementations/aws/infra/esqa.yaml diff --git a/terraform/implementations/aws/infra/esqa.yaml b/terraform/implementations/aws/infra/esqa.yaml deleted file mode 120000 index 1ea779d1d..000000000 --- a/terraform/implementations/aws/infra/esqa.yaml +++ /dev/null @@ -1 +0,0 @@ -esqa-CONTROL-PLANE-NODE-1.yaml \ No newline at end of file From e7fb9fbb73d1a971b1d1a26b3bf2c9c9d30f85a0 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:11:55 +0530 Subject: [PATCH 07/61] Delete terraform/implementations/aws/infra/rancher-override.tfvars Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- terraform/implementations/aws/infra/rancher-override.tfvars | 2 -- 1 file changed, 2 deletions(-) delete mode 100644 terraform/implementations/aws/infra/rancher-override.tfvars diff --git a/terraform/implementations/aws/infra/rancher-override.tfvars b/terraform/implementations/aws/infra/rancher-override.tfvars deleted file mode 100644 index da1b2e2eb..000000000 --- a/terraform/implementations/aws/infra/rancher-override.tfvars +++ /dev/null @@ -1,2 +0,0 @@ -enable_rancher_import = true -rancher_import_url = "\"kubectl apply -f https://rancher.mosip.net/v3/import/f25prw8zrsc959n2bk25mn79twtwmpq6hpxphf9xt97dhbm797r99n_c-stb2m.yaml\"" From 5c220d08beca6c4b0cd83081b7f3d4a862a80a80 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:12:05 +0530 Subject: [PATCH 08/61] Delete terraform/implementations/aws/infra/tf-plan.gpg Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- terraform/implementations/aws/infra/tf-plan.gpg | Bin 61233 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 terraform/implementations/aws/infra/tf-plan.gpg diff --git a/terraform/implementations/aws/infra/tf-plan.gpg b/terraform/implementations/aws/infra/tf-plan.gpg deleted file mode 100644 index 8eb2d1bda9db8ff8dbf17cf7b47be7e317ff6e13..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 61233 zcmV(hK={9m4Fm}T3Y5mE(Xi02U;ono008eC0gg2ms-J216BdF*7{6)2Ymf_>9!T7G z!1*E3uj+?%>*3#{mZ7eAy|#$EG;_$=@42-)lEqDwu7zquQFQ>DV&_bo>(-7(Zl!LQ zc}}IO2w+j9f)D@SBnKa=$OxPlHrd+u*K;e)%xPsen$r=*HUsq5D9)c+<;bk{VMhZV z9}kPw9&P)^plvae72W>k5;HN@9-DlG&Pt;~=Y>Pg2L8R-PrWZQYJ{g7sL!4`q}Yab zJ4gDgCLCt8b4V3A1Lf4N2r(r}sm!d#7ejjuu{`3FSDbUz zfHkQQCs~b!OoMU%0;fAM8W`_tK-_(lX)Kku-|*NBoccv*73%9J&OVF9$maKeiS8L< zpd!)ccpmRCR^lv}i2*wVG38S%C_iek&3BkapjR!FPj7pKvG%UVsjPnZDzp-Nalx7% zZL*K?pB$jkEz|Vr%Of%atj%y$(q;R6d8@LIm_?b=*CB!`tPY1k<;lhB5=Wqs*vm@G z$tKoN2*MFVOKZoB7^;@Z1GpgJNd;7ny}yMqHa%}XUxt1P9gA5M1pR!xTe>RH(k(@# z!5$Tq@|-7hS3PIPbtH$f8Ild7-vluMUuh=;2v5&A3&x1oU6xSYff8STVM}7amEUuv zY9gUyOEvl9sqpLTKfjT>*bGy>e^?8h)^Tvu*6T zH89wC1Vy0ApRfTnow42}x-@OewoH~vg?rrVXdTo>?w6S8?bLzg8~>DIy6X^O$e2N5 zazm;8RLCD6Bek z8*�B;TEGL>mL`v+~9mWyGgR4sdoTqkJJNy0XF~8@O4GVF&cOMcxa2%ZDI%I~O4_ z?-T760k^SHLq)FbuZIcVHrBhHksh43sJ639N7Jz%gh^dh<5@k@-S2vbI>y+>|9)iv z8AmuEhI>Ge#~WdE_$mK=UH@>MEz2><%cJ@v{(6y8(>gx0%~>D-jz8vvo8Y-=kkGVj zM!!64DhMaNx8M;rtyWtA1lh$VQ$5iTM`6^4D)v41+DM-;AAX@FW6^r0-lg7*;GQz zZk}>{(v9bqMk-X(ko<&Yv}%UPn3b$aduJZmGCxAyx0CADm6(PCI>RVqu-Ba7@z5#U zWIQ+prbs?4plsLl9C`I9H^w90$XN6v`xwpD~83Fx7WwH?oSuK5?uD(1&IDSb~tQ&gWrAkntpLCAS9-p1y zpsoL`zV?{ZCZ35CJTWFNwQS*e!RE%@%Tx=4GEaum8fiFr$9Z0sx)cZ)tn2<&`#4A! zc*+qlqX5YDbDn`Ek>Qj#WfrKlKr&9q-6PJbF(c!4P}V;`90~DIlGoZT9lMjfTY7{Wq&&p|<&Az{xk;dDyV*`U14Dz~qB}wL+8Q(yb zXOksum#*J`^s8fH?(P%<L-&oNl%g}aR>O@>W~L?V)xPMLBUIt$8Qr8aXI zj0sV49cr`3R*X+Tw3yEYGAGKf?CJwpfy|NEKJu0ES?ciMCWm}k*$$`NaI0&U)4`J+ zWyGnDs1#o)Z_Nr%(IeoWB|^}5KxaAVeapfIbuB}~2K;ptx1sRa&BX zIHdV54-TNzzUgYI9JvgxQQeK(p{VfhrF7F_SLCPyNKnvt;~=A6QI!$c2TntKs2sA% z>t-ioh(RJb?xw%_^RWU=<#Cp`o?{dqc=pw22|RCb02Gff%@M1ShImQEI!f5jrkvm*=%UtDi4)~6peIZV<9aUPY+E3BLP z1yjsWQLG;)|J3eMd~$x_%u!6d@2T%s!C5Rrr?%_F=tN=LJSwbA@*oR=HjBoo!76?$ zGz0ZzIK1$pZ9qJ+n?L;QqT~d#%g#3Yxe6bUc@(bhKP!WodlKiL#qn&gh~YnE^=8{0 z|79*W&vVtHbx&({8|>yF!vb|7b`UP<-?6@ZUAx+DsEn?w%eRZmV)J~+*tXN_g4jYi z;6h{xys%>iTecW8uU^bW^rcW&8q;sUkC(d&X_Bhju>Hqvig4>hidD&B>W?@xcQj{d*-o)75S2d9iWS;YC_H# zVNGee^H7-n+!(y)ACN(~vDBP~HI9K7#e%81`NP-&q~bGYw8Isgpj;Qc=}s_XxEA^2+|e^ba$A z7Dzl3#CqhD>Nw`{*a`+3M`I?=hZsD}JZ3#a;b^8PK@t{q?!B%smN>Q1xkkZ2M7^=s zqj0!bnf|KyQ-IV*c}2#JWac`|qu$t!_+r)8O&u6|07%K>7m=s2CDr8}o@&E0Kq9dp zlgZgbs?!8?3ZnIMbEWAi}INDJUWk(lQ{B%maU1_dviwcr*3D1vXH5Jy-dspvUoP^d<=8c@R2d%aEue zOpMdF8Z2FCT-W8lsZ4*b{^3dJ7e}5JA|_2dD$@eQRrv!aSok;85Im1YTLkL4O%p%ZV@P#*M5!CY;mH zK>(Uj)9rLN%*YHr{HhyW*CefcQuf$WuMbfqE_PvDdcS?memVF4tLx=B{vXys0{Ul( zX&8pWzs_{3<156*o@R(0|8OwdBKs!;HKfM~j0fSvwq*290G)QPFO6n0+DOyY&168w zkLdbegZAK-vS~R4?%PMtolXq9T01hUXc7Ps4PY*z3PlwU2{%DE;`pJmf&*aK2$(eu zRwm#ph$_LOo!VV(80KGRGU+yZNfwIbGUSoR>cc#;{6j%dOVvY(}w2mpZL)+an(Mh#LKh=z;XuSds=v4It-I3*U5-Iut<|EYOhp;vl_R>=48RE0Z-u+&d_-31yzj760v)Z@dg476RY@x zs$4l6uLSGRFSFZIM4+37+hBZZ0k)?aF9%UU#tJb=yDC3-skR+t}%E*BPI zLGDq~o1xa90Bw^{rn{@a^mxm@RLFtgaoZd3M2H(DX3Eq@f;x19WW4~3EKNQ z)X{^WE-tC{uSv^gr|(Ra(H%W`hS929i7q94vybD!^Rk!f=%$+ki|TG`;4Bc=dr z0wZpwy$wJkQwc3$3Xmx?G@AG3xFVq4Jdh}!iT8qj3X+(-m{oiswr>p^D9KU_=WfO2 z6RXLycx6t+a{UrGw66M#Xer!0Y%`C|K6Ur)^VorW@G<8~_vP~TB!bAlbM3O5ytoe( z-CrniW0v~g-=ucDCsbm7%4o|PRw*Bx4z)zJ5BU)@Z13)Jy?$E^eWL1=gJtNVZ-JF8 z$)psxzQ^a$JUH8H6)rMqZfxy{2hsv>#fX*QXJ3uNmcdqZZiF4%SNggr+v?jwM;QI3 z+1b@y&4%Fxz_p4Y*L%uW43Gl=#jc*4n>bdKD6AvPYCXo|N)G)_b}uABo?08$S`DSE z*PhY`1Wf83FQ1SevSh`g>BcGp^F!s%dy7^aYE3405v9azQYvJULKnaJF(-Gm8Fy}w zV}*Wt1;GxF(5h3eS-?hgDwF<`#X%?%wAxq4-r+#OkJWxl6Z3!)IC*UN{GM!s&7ero5$|LEnO9~JcE#rYVRV8UaV;7gemcdgyLGjI zwOF&p;qz!DDjXZe6%p2UZgun|UL5Rfdl7b;z97ok;nrFAv)d;NZ{9mrsMO-XD7wF} z`7mGt`>ctUuE;*&dWQLN!a-MI%Q4YeSIQZtOh1 z)Jf}-(okNxi1U_xAw$*v(2>j_RRWj_YI-y6d_bgh#9EJM zjg8KgWW{Q8ix;L;8wxUNIzhKEVU=c1zk&hmZ{qhTJpiOuh-*D&+d+OBaSgt}I;#kY zB;2ct1cpg8Wq^McQ@A1zj+ULp)KlyFIK09rZ0_9>G&6_rFJ2N+5XjbsCZH z>ZEY}#$y*FbXIe3CiO{}>js2C{h&JSmRVZ8j1Dn(j_OJ6e!oQ7O>_0KcO9S?*>@Ne zTkEagls@NMIxYC&6D!t7mPl%Xss7+~YfTYWOhc_{;g8W{((Q`gyL?s+@S80bx4z(+H!NG76 zxz#3^mo$%hQLFqQ*|S84vX-&vk!5_q3V)L~-7y1jW{?)Kra2 zl~(c_iNy==sY$<|I2K8_N09){C&In(1`n>dd7N#U5COt$NE)A3#H$pI>qgTt;Ngua z_9_WI+Mlf2tQ5R11D0B4@~t`C^N}CZPP|#eg@zz0b#D08rg;MKie^gj{{p-ydZ;)- zQOY>9Ief()sIwa zbP(Snzx}KXoy1p6cW?`3p^MCEjpS7GrGx=LtqoW>wtEz6Vr`q{u`vNcL+wS=CbUV5 z++1FWEMcc&5F6i-@l~0UAsLuUqt1h;Vo@*vcIjG@{dIB;nRuAkuuAK~CNBV(8R=|9 z;&{S4DU%J6M{%`Dpa^3|@4D=r467*IeGiv_V7YlsuKiR@prOGrJ}**=bwv;)0Vlv~ zHsC!#y&w&Gwu@#Sbyxs5u{VoT!};Ki8bzLSnChKo{S_R;bklJlR}{^}7Po`h1`g{0 zgprX05Mbv@vBRHv-Y|l>LnDd+0RupA3*71l7q<_8q}RYFM<{_J3l<-XGDFyG(?({b zt zex@Pj%7livq5NL*bXEWgaF`Om`*i z-S(eYL7yznAkSyJD5+?ALfNGUWAul!z1>}@tM7j$E9_MhU8HoJA?Cqr?F*XSrfzRS zQ4Z0c^xORz@?RkF3tM1vml+9|EB=tC{I_o5w)j9dD8OjUF^-t9&TrGTyPisViH8)b z9U?!-9L_F2V2n3kH{~7O00C2D%gpp?_F8wAq#rWiYnKUf12-tvq9QIqd?`UOJg#c;YS7ZVzY=5*2GVF#5MYQ2=3_M4&?}g<-B?0*@Kmsn?{ox~Me=7Dk)zE? zuXE;|-A56;IeZ6O)QoW*3(afGBZhghYdlxk1@)r{E)D~kcFj>lAi>RM>&RuLYRiK@ z5r{XZW&D5=t1SbTLvM+JAg>N$09R(V6AeG}O;hb8@h#XJYyF3A2L7)e(*G`W(zB9u zec`mYdJELoK_~pqKi_t?>;_5p)ffke(Mi~|Z%csAk?T7ckw=q}^$Z>ipr_L!qoXAP z2W1X;E5jn{*4ZN%2N44+-*)FkHf=F7(sp%BK%tcLBSIOhv9|r0! z?yY}dpNvP_G$qQdRKftSuEyS1;fEU?COgEDX6N-8YL8$o<$m|-)N`o;-y+n-qGS;% zJSBA;cO$F{dNb0`Db&u|@PvI2@@~|>lPV5>5fh|vD$PDe=85d51peAj`d{{A9^m!r zbNqV<9X&hPeA{xp`cu&aPZuFDMxg(JLy!A7AdQ8zp*n;2Bl-Gp!{Zb_owAV^bG78?xZne6cry_JGlT1ZcwzjKNB=62)C%L^XxLiPI@H(O^(X~3da2!u9`?qY{q$Qq0iCM6myy{#3ucNX$M}#$apK;J$ z5%3vveRkCRP_e`5sce9_gq|!+=X5nW<=-r8pLheK!g_A80w1CbnIHP^W=09XWNDWb zWAb>BG}NI@?ahBFS#!3ye_zv&KSGx{bb-KR2A07aS{6(psySK?n8(VFN?chhsg_Ul zG_><8A#d7?lYDhz?r*lDtfhoY(KBMB6j{!o-D(!H3dr0OuIl^_7SY(~WbfKMU_WZHjgP`1W=9haBwQ zkBOw>v}L>I|mejgh&WNC1$VO3(Dd}B41Gf+*NVRkCntkLpgeA|_h2pQu0 zyrt%?_P39^O9*nU9kx=yeL(n`cKT!oOOV^Pyf=Y?cbF?Ch{>Qrev?Yep&&vOdw8vj zyK1Npz#(evqKQ2r`U1f=glfJ%+eHLb^CU(qOfREnwr?Abgst0jT#d``K9aNF2VZW?I?zY%m|i zhL|=9DLAKS5M}XuV7o6%iyYB`RW7_Hu7=8Vyu}0Dz$1uS75J+zKbGl**Kol>E#HuC zef3Qp7q_c@GkhYUx&F~KsP#-Qx3sMwUJo<}t+VuLH8OfjfL!!Mvm9r4jR2qCQOdgw z9W2gI^GS;fRg#YHx@>R8cXnm1EJAPb8;o?RwcAR9+)8?`_lt9ALmV}?G(05IBpdg$ zU~FXmtFu6uIj6sZ=A(OD^_RH;NxS~F=eo_L;{tUxg7r*y%1=@- zl}oQlZei5g2NNHcoH|zHmk%-pt~x{dbOGC{Z?+}0pb?giq2GK}6ZA-(9k*)Tc|@e%@5u8{lO zJ=Oz~9O!wQQ%%n7N`W=nk^8A0zkx!#;U1rj`Nc>{xlnzhg&LX?af)i_0pY%Kc@ai< zx}kq}G3rEbe86vqmt#FS8#u(kp>$B+48~?}Z^PXq+<3sy?A{BU8H+27*0dw`mrKw# z51ACpIC3)M&WWL*l1ggC-Hf2Zd64L-J!uzLx$^ssWh?>JH_k$QYg8~BsEROiK1Ql4 zVKBN+jS5|cRQvDV0B56{hHTI)7xp*Mn+B4Jh;YE0uFwWfs4J@6*bhvwh9uw&d|VOV z;jb-zz#t2ZVH)kH)Huq1u@h_{2)Sl%QQQaL;vGwjE$}w1xaS+|;>TUv42YB!((wJp zq3mQ`W}6KBSS|~a_d7ceK$}=jfAs`huthYgu_ZEek1?$woa;hF_K^wVRW7oAzYR}- z3ZEcVh*m}qpX||^>(cE8?dqBN~{*zc7AS?0D$u*CM0|Dg( z$!%f^-I}84XCh_Qbr>2Y3(@hCdR2&66|)bn+dL8HfyP)mz8mdz?#*Lv%*PUHeBJ9= zgIi7)vU~p1q`>OtiO;%xr_00u+Islxs z37;^N!tq9o)JOO178)=RPFZTZ`U4K!VBh7WiR3NL#5Pwh#HGh1bXt>=GS3y@QV4?p z*kk7R5H7OTWx<<1wEA`;-ZCMf#8Di^Js$Du?yK>-aBlA`82L6ML!2GDXVO%U)jc9| z&0ca%7n1K6+%wY}_spn-%S2f>(ra~fB9t>z3>)j5A6KjV?5-qbUA6LoSYSn^^@eIgS{%bI9~NfVY;zVpXR0 zu9ZScp6$;EYo;rL0V|KXTuF*?z<&PkUhp)}DIe6sR+Wl9vQAlndp)dEQYZI*e~r+& zvo~opNZ=1vUU8<*Q5&N#j1mhwlsGY`U@|?4$BJW`e*yVbBSk6ZlfHQyTXpgT1mq%9 z_Z6o!D&jXQAs1_lY@8@nNV%dpi>Y~K>`41x@z7VjQeG5MDMQpO8|dpt#;^`XQRAySlv$2)A$f=Fi-1b;n6aTMK$UHVZ|#s zTH7xH*%NvD%^_l^eds68mnJon>G%ISaTQ%taC;3C3mRVVx8<7yQVAJPqev5^99_r zS?evk?1p%7n(jM=d+=&L_;PXQIWh~x9yxjeM2)Qd?tCV5qKUj0xU%v!Nd~!a%cZ}$HjXOIZPf^99^)~$`NH!#+;Wx*zoA}T zXqK&a{kdM;Co3J(Y~d#NR|$H7?Wt=H7%OOyA?y?ko-ziC>}cFSci|Ak!)3L#q@nDj z`;Z4cb494DtOTKAzHZ?EaPp|V<(h1>jHkf+AE?$>bEwaT>}#*xo6{9q0zjDQ;1~ku zsny`LMfiGlE!y8_V-gI$ixA2??>|ho*9Mw2x|3Gjs(6h0)*%HRw2~B7N99`$uqs+HoMkf)HTuh{|GOb-s7!tsyhz$G zOJNS$m*?e#Q$|rgw2Qh{F{IR*3B3jDBZWLLFvTWF5QcP6N9Nf~_QkfRRcqkhO)x1k zZSpf-j1F3+v*Eb~kK_HKvNlDzTae#$lRRnC(yd^BQ6XNJB`c*RlKc7bm0^v{Zr5+NFz^GN1D)aQXDw1k{U6`xMY z`o$bQ#d@>AfQtEJ#;QDh(1&bMf&%0;aV|Wwkl%EjA zQHa^|ughnUtWIirB;VDzuN*9wMyaS)(7CLGx`+jf2h?#wvc}=+*O1o7nh0SrwcgRRN63dF5U@OzHh-hJB`~QVm956E+ z+m7Dlw=Nt}FPB(I%nG^~Z2Cv6V|z^D>|*ab_E0^KS9BPzrGLycJkb6)C7I&mcQgYO zLk`E%gG=Y0%pa(8dBnHA#6Q=~b(=m|^N;o%r79%kXC>xx*rs+3-oNe6V(6|ePDvkR zn5v>{+qDxq+eO5k*ISFGp4y3L6P}36gAafWS4WSU2L`FEs_G5+C#g=I{u~KljP+GJ zH1>cjJbMe2-v*KN2bOOPdm6N^q;%ULlm`D7Bn#dVMZ(W&F;Oi)vTY3n)re3p8N0^$ z#y@X#2m=}Hz6+|vZdYKM@I=VJ9Ydka?^HM0H=>ncW!xX6z>H1fE_B{`F`OU)yLn|N z&p0A_LdnikD&3(ER#LR%X#tj2TL-;g$Q8`re7dG zt(1_EzhczyMd7Csr`=nnw9UN}1G#1Esn#Au#sA?NI~Twa%o`Ob>`ADqi=eUf-$}rl6(@J@*51)ChJwb z2OV0+t5eV6Ob}IUz8q$Mjst;M+K%<|?tyJGf)4k8TJ&I)YKLh>R`G0bpVS`Vs}@XB zTb$|M-f21Tnn79OZ=Oh`sc11}>a4mX;XzQx7!kig)*tOOJE0q#;qD7A-gW~X6<^V~ z^*(tOkkUKiYNt@l9EwlIX1_f8&+6;Wa>~$a=0+M3qE47tZ^OcdlL>N=gakw62rtdZ zdX?;tYMH+@5NEnAh_Gd(L-KH(f(I^o>VX{^hAwPzZ(j%(vef;1miq}Vx64<)%PBx7 zh=@Wy9v6^%DXG;}|6{&$l?T#7*k!+nel|UqmGzu`f!gO=G3Z6d%tN4Mu0dV(s_fV< zbA#)@-y+A#*6mAqOWcH#rQsZ+*FaIcU$#`ot^5 zQM|%ivTQ2TZ<$c0{3k$U;Db{6o8&^(1L(jJAjertX~d|Th7F)1)i{!IEBk`yGDw(o zP6095TczY>>{b!E>bI`fk8u#nXOT(MlFxrwuk*rA& z%QXtOjR&Ywpo1<_w-PV+QFmtUdL0Vf%8Z`D%MPNg>xC`*&y$EUb&NZ?R(n4H7U(DZ-F^QitA=#l-iqu)4E(u|8(b zC_{yXuQ!5zevbowCdA85enuvNl2Re0rY5K{%-wiDbxMxKfA)FS{P>W(%P>NQa~dw1x4$n^G8d^GwPj zV^#zG+GZ5*T{zK1Zf>PY6Y`|}YbYL7t4Hkyonw_#4 z-+Og_xj7IUv|(&IhG%6VrZ-(D{J|5fyRBUc!UlT`=y<|wdJ~e;UCMVJlFpQX)&|GH zfbTT#MRSAk|LMdZu08s+1kg>M@_yU?6qoviaG{~}+B8WN#Q7 z#4{GOG@It|G4-htqcV+7laDy~Sm)xqQP0B-nKmzX{7ugr(bs=oBEqAYVz5=ga-t=4ptzuOtU?9E z-Wmp(L z2NLFjQ^HLKV-{lK6cbH1k+r^b9tACF_9Y+;;ehx~REPndb+wr7Ty;amXy(V^QqLF~ z*e-7Gx*K&OPTju)ln=dOp=Sr(w>litl)S$j9cKWU!VoXpeG_n3&*0HL2mkk7zbD;z1CK#09%Np6O{b%Ysw2vJOGreYg>&sraZ+Qm;;q zjB-w!0UnV#9WsDK)B3up6>O=_La$ozc+?{tUN@MCY@Vry02v7w}I-kuJ z);O|4_|zUYp6eC!AW;Fr{y(bYnu4A92~g74r5kqm*!Cq1pM`qqq>_Br2McSYEtX#+oIIS%&!_~sx;w?&X2Dzk|M;7G&BqJR~dYuQq} zr}9he5B?;u4jC_8c^j$ufUPT0Yv1N#=d%8AlohHKc{qMyu)>~vGQw{cry;Vq`UnP0 zA#~vu{yxePzzV)aiJ}s2CE)a*dm2xcN$q05aw{@t;zpHTj0$7K74G1djJZ1TStYdR ze z+$Pmmh<9WSd43R7%aI$`Ev2Exv0IKR9eOz;s-oo=)jh&%j#$!_;ZB!pH6n=558`Fj zWA^F9KT`<7M>PSoNmi~_jl6xnaq#*ktS*0us~6=>l>qibgjdtQ_rQo0O)M+l9{8iO z>e~nTcG>vOzjEIC8hi#0H$4f zSO0JwLa@n2`j(py*p4P{w8Vkt8+lAgDLPL7W)>oH8~Vvnxk z4_j6RiRTp#Ok6x-)NGQ^tVcUCx`%ZiocXGoPK-Nk)t+KXIuNd~9h1(VUD|ezDaQuA zi6$oHtS^{sI(e(Ulc4z^ctEr?P)B)QTf{DR>JehojLRW`kw&{~s6)n>E$&c4$Ah6x z1MgBL@?AT8h0x74zRUMFuXKnKnzxvp^k=%Y`BqID?uY``J|s|_P4E0!IO7R9bd4={ z`PaWHGIP_4jnekA!9(8Sp$calD;j8Y>`nxHJ zm<8qkmxfJSpAuvc8Biu*2oM0?uMLwU?Z?Q3Nb9qN563B_Ku?6)c~~O-hyCc41E3cW2luV26SMm0-2@mIV zO7jc_8Z1P#*8CKNYh$Rv7JRbtBE6gI zNy)Pj{PL>UH)gg$GRS<|sGb}lh7IeE0Qs+UDnV3uKmM>qtOF*Iu12aD_`!8~>F99` z+N}*cxJr*#@jubB%v;^(g81)%5?MVagR|+iS~rzzB)hB;9q-2mo9gJWSHZxlyyc4&~@yGxKvqWIUrdip-b%vboA`&FRx ze&R6R5KceXffyg{Qpzzv329T>dIP(WbZsbrZ=-a7Owy%=vPHZ)OxK1ZdyD649AS9L z4QnxoOI{qp5+7B_b~GmQFY;M&D`GT$1L3UXUU~AV0I4MbiK@+Z*)ZpHk-)4R;6GF7 z3qVOTTN%8hkq3mM3s?Z)>jHXa#68>}sL>9do{$`bJ=ldnyquVK;^Ov9bijl3;Uy7G-P?Ainvs_+JF*YlP#fLQ{a0qK8@2h z#@|YvsiP7{SqG7uo%v!g7zO(_XVC7^v+9n=aJ?Nws=}#i?YC1u5N)vF>VkFkp|%-( zLc-)7K~&E7)M-ZL?l6XvI^$(1o=HH5Xlk7Tc*UKAc?pfSa$GSmU+vJ0+%MH@vP$4-Xw6#@#& z0F4$Di5L&53!B1Mp2sMSKl{dsD-IJIcv*2g1@x@wfsB=97r(=xSG8?TYBAXrOOZEc zb^)H~A_7u0eY>OO;){Y#Z7xWthLpHyQ!-?JppQC_d)11{XQ?lH!S?1dhszO)oCu#X zZ_}W%AH4*o?F`x+QPT}8KYrB#TN|ckh(igvM=F?l!1h*1j@Max3y`ip z$O7XN6tKG~1NrsXh$|>b8{nFn{p2wlr8Zx4XvTc?+g@ZFmHtzh6ei9E)-r3dhtrhF zcP5u>kU2U{g08~{Ojl*y#i`GnE1VADXCSPm-3&Zi;OL~vd>VSu9(EX9@XaV>_P_4f z&S+1pI@^cG_m)&vm#HyOd@&6_zAn_WM+gB;D;_@jtN5?E;4fxJ$-T53qfYqQVpIPG zF8k>ME0Qnw6$(?lzT%UmI;-j|S+W(&p4d5agHUR&=oRU>U+U51HY^DYQZLI|pIU+( zc4NrS%e-U^sHdZ7?k61VIqb#Y;y>BOgwxfDA-Gyn>`CiAT|AzQnvNky;w@9ok7H>D z6fSz_ToxiF;$@V~ChinCpRS#t)ndQ<{Hol5fNGS_#yEL+5G699sX|fsVLAUMW(7)W zM$`Tyr;~VhQpU}n8o%dq714TkXw-YRQE)il!gba!%uZOtjixxVZ?5DxiMQEk2YX^K z@xK{&0%J2W3+E2YXD`v6GWML- z-N?NA`cxV>n=iNka~GbD#%IF(5``Uc{=(R~jm?oS;`!VIo*QbTGe9c*^$adtn!B(U zV=%X(fYy;7BubMEG3xg=uc(PNN(^*qohaCsRY%xuJ#T>@lly`Gu zSxbT=g%RO0pjXh%6x$gJQ)i+7yn+sJS5e(|Rc+IK77eUT+Pt5OKWg+yl!R8wcaJW~ zJ@3H3f*_gAc|is4+LeD-`}4HByD{0(f8(smLE}Fje}R4}V10pW=X3@YvnBal9g+VA z!c$#?QD&7jl*qUu@)7ta~rn<|_b-$)R%Q^03YeM&nb4D|x+IP#_iSgJ;>&i_&@ zAM8Z?of^9D2#|Wj;HJ&&SjzMjBdwG^95R>;zJ|h9R~XgJL}%e_=q^Z`|96JKVd z%T0fsJdFl0L88O0wr(BNHe{gnZx9m>!H}fT3ll9kFg-Ba)=kkL;fafz%I7^SbiSJb z<}x9WtFKYAZ_1Cvtej02E_&lZ9Q2rJfDoh12zY9)1WbFlVF)wQ4nx(P##7+ub1y;3 z%E}WmaGV2DiKJ0GB=Y}%lur-Z0B|=26|wl?(vK=a$L_A71W!mLjY@9g?*G|{;wp_% z_^*ObX!$6H$_QLy!19OrW8tDRicn*u3==V-QDdU4H0tm_1?dnVRU{y&D!%cmM?xn< znEV4OJ_SwRr|HlpFyXt@Af+NszrD2?Y0dB=mu1co@&XP+(}P+(4hXNEHrB+->%iad zp2qwV$*y5XYbGvrXg2U1lT_@H5MsOgy<^&}pZger+!U}zyZ}4=b{b$9BO`oKcFTabm`Tu^Cb2J zu7gGo@K_Sx0?q&l6XS^IO%280rq6%t9UK;q+52c{Jt8ib z%JRyO#K zd_1&9GrEg7#JEU`a3UMN*t7NMfUszXXV*R%NIpI z!a=xo|K zE%0@6flFnV#P(W1dC^o-xEsCif;U$-@)>O!3aT_P6$tZpo;l#5nTf*1kaYwX&cx(?;Z6ct+!Wl(D~}xb zmg#qie0d~{^pxx|DX4#D0$77_vIPR%uyA@w7g&Qay8+*sQ+tCTIWx&3Uc;RE-iklJ z5ER5J8o`A0VlJ@v624M_WUjwMpB9CZLTQP`O9LtpuqjJe^>&|=KpE;PW&4Eh+J&v_ zC34JYxxdrOoeg@fCDkO=0>t6HyPBcN;s>;f*~omtep!^t*Y+U!)!mOf zC15|LiajJ)X$Cj_QvVx&6%ENaj6bPrp0U?4HME)|!nQs@$UqTZ4|Kny+(;1seHdRlh8W(zWojYXtty5m)WD=YP=p!#Z1#7>4 zX}l>3R{>7jG$MVP4_q_J;aU%#E}<05p$aL&7rVyzz_#(^);-2HZ!$r!b-W2FGV+qCcX0Flcixc8 z$c+1=3rEXDJb+WHJg5dvWCBsK15r{pfq&@tA^b7SwESg6K>d}>-0qv7E>iKPsRg{F zD(Zt2(x9@VcyWH4wT0_9&CL%IMzrP=L&TL;<*x+osu%o?#hy$tO1PHT>ImS9p<1U2 zPQ<{62uH>*pyOAL*jTA()pM3l9y078NyWKfY+9t_#`YE{^)bbM&kmYdp~fh?^=<~a zLxx`~?6!@iHxU3=+X9{Ovb;zwX_cce zy-%;YB^$RKt{FBp^+)0p0&EJ!A((Cw^dyU69)EAY<1pbU;O20APc*UBp4OH)<^!~s zlsAd=7SEi&oJly(Db}AEwotK|UFTG#58;zsf(I)G4@=Rlx)Ro(*>y_1K+~a}O{>Dw zDL;V>yJ)R?B_5w;+|fSQ9da#q>vS`Y_X;%LzrGxhBB($rFmAYFKIUoJKKf84R1zS6 zI)F`c$VXtW91HxqJDwQAz*#J@{mWZWSo-%nP>=lD9M^SO%M+Y+a2vM-kSJyDB?t2h z<0UBPkEqplSSIG0?;`g2_ILneh?Inij_1l+?t3F{;lyB4ceakT`VFbtmaDYmS^{>< zE9aW$u~P9ekL^4^Jve;*ir`jW_Gg!VQtH80X|m>+ zIlr}vB0i_VhTtY@H7GKT7$Y@tl{=J1k#4bzPg-cl^b@!E0V7E9es6v>eZFxnVWTKp z=Q-&o)A#RXHna`0sy?yDItuds9)?BTB5>q+ z$=$k#*STly3CjrNVi2SPWiZ-%hZEDYjclpI@$)C-d2 zka^?M*9_kpf#S84D9Yn&4Y10RJ@6xg?~iIjjTfL$R9D42ASwByL~BBqHK-&%=ky7< z`WeV{RPSU9pp{5boddy0Q+Agj;x|0G84IZVDf1yN8MKz?p0kV<Nbvm-$Z*hwe-+va6Pe|}yP3WYnsZ|WW)sCjA@ zz$qVIZpWw^WpP-4plPr#$i3xO(IK&J{GKZ9x`&C&f?S}yAc%Q4NO;ImB6;gaeg|kl z3|LN@47mz5wu)K}V>`ve#<=pFT73>ZHxSW}Pc1xbqI=2FKWJ2cF0Tl2Nfs6#>fR#) z*IvWDR}Z&9tE4-%^wJB8z0|Df?LvrM<7gEXXY7NtrDw=xX;xWejQ#rpO&Gvyr?;e^ z=njvXpl4l%)1_;hY|4C{4avV4I&KQWQK41|p(D=@p z>Z0v8^$b@fg9F#~7DMjm1>IH&tu;rF8pEN=nqNLLkzjD4-n-^2WZrL(W%;A3pWD79 z2i`;Cac+AoHbgLjLpU!(7nf@39KP%zk>FQWS9u&B3KRzXw;D&~d5v~2IIt~>`+VG& z7fTFqnc}V5Hg~nQCfEaK^HZGT7OsSoi3zr6g0YCL*cQq(-qB(i zOk`fD251dUfdFH(iY`1L@Xw=)Ek*Vlc##@Q#!$+?>#o+DC>B3bMrqDyI+bha zkPsfbUJW3of~9F9dHrxH^p%S9g$%eYXsC`-*2)jMR^_&Bg`zi`NTUmVMh%Zoxwk5m z(r)w24NAP#LlIPvK@ifJNQ6AOvl`l^A~=oO4#y`d{SRgmBuJchVc<@4o8!kfwUlYB z%b65S3_CoyEBM9n*VuneXRui3hhG(hz|TUil?c4m!^iS- zBZv8SZGa8N>ZNHE+*G^ZU()mY&Z*kR>}b|`;etOSC-SJF?so^(cP>!Z=(l=Yb-}#C z7-OmqGG_J5_Zu5)p*r+Xr6cM3`pvkh&qDmLOXP+>taY_w0$WV(gxgp{Jw#w?(+Mq- zPdUBWp|QNnX#wl1je%n8SF9mDdUUpitI>tvz0VA-4r}msq!=7wC$ptOJx4%h&Z+uH ztTfdpGuBMUwD))V?CeA>0$43tTOZBQroj~D4%o_m<3j{p9N!j}h}&x{d+@zusOjjx z=McU$ApYoRSd||yjr0(2(JWW#8c<}EX-w2@_O=Gf(K^>ct5xzaUVoee5eXV8oK$$q z!W3H|FXe7((iZ6Yp5F4u1fM1Cz?1;oaLv0VvTfZ!2m-!COFKb)U=3pTAxrbYUhQgz z7nBA!>df2Q;;!T*nCqS2Qc&DQ)7}W%B9=#xZ@JydTI$uC55GG$hdi{nj}7adZR+{C zdWE7ou30egu<)aw278L3S{>lGclrt#Q4aRXndZhhqU}M^0odiW8|z>~%T^Oin_gb` zFwRTMBC|uK8|7%d%SD14s!sJJBN0a(vPHZ+l z&A^>4WQCZ!efdEk$7{7WZK$1TVzC2PMwt1$Y#@ zjMl9D%sb>z(ZJnj-5d-!Zzc56_&QLK-R=JOGbJE-Sb zckh}ytPnni>hv_a?m=W#INPYJn;y_dBa=o#XPKP~(NBE<|2sSKcCz)-=WSOlSb;?VI)579kh zGlrfvd_&occTcKv6HpvB?>3dL6N7-@jw9kfHpD-yT~cSo>D(DVM`=AFr}LfmT%>=A z`<4(DuQGMmMC_uHy3*+rVc{C5C867709$(pD`z@NXtu04^Loj&y5zw?4+SS~=84{9 zm){?irvKioyf7GO_A6xSJ-pu;(-Sn2bKGYT?{hz^!E^V;yme+>1a)*nm8Gjj;UYKc zip$=_d_i4L+^wEbc;;X>>}*o1ab3(eB15P9;wl{fdqjZu(yAYcsr~`Tt-ezfeEw*s zA>p*86;fC#pL+D8fK%VgK!`;O#G~{ay9Nweuce@-^G^?28atB#9Y~lFv|@$OGhHqG z%}Qek`sMzi)IGbU*PG{aT4T(7+=V2R5DPrMnOP&z61`X+-Uw<~jv@#;D`*SW4ZULy zVx*??2qK-;upT8yVk4Y8)WRL?7z9)zV3i#Tc}(8#Ck8}_8cJ-pW*kjy5XvCz#})+; z)y9I)utA>W-f8w@C4#rNQqB%@IB8oBj$YZXi>o28kQ!xYREuEDV8b1v!dh(Izew?} z@*&6n!Onxue~*H*P=%6l*=DW93qlX(XQs|mD5qHevBEPs6CCJj2(jp{8n>|Z^9jFx z6c9q+3e5$xJmFz}Wkx8yqLS2*47LD$93Pg)w~*#c_jd#-PH!osy<8KPfS(VM?#DbbxX7g>IBRmy zXHf*!`(ObU5q`}G4Gce%loF8!kL`em2>$aa`WFwc7?14vwv6^EV$0BWr`Q$E38j^f zbda>d+nK+FgzOd){&}RL-mFKVnxQr za(<5)llqg~)_N^`klTSTj>7p$eNnerXIk6s=QF3%Lf%{f@gzj^gIiMQ-V_V7bgoN+ zhK31Ja6N_t(+>%QL-enJr)L>1FfjuB7B`%f8&LL zmp^xpA6tL~mJ?VWyQXQP?@h}})B2vq@_GOu7L^+~NV;zqPbMyd>g-DfrCtGmJ%=w6 zs{bSsOp_vX+FOXa#g>hq1@#^<=eyD_+~AA(r!dEcZv}Y60x_Fgm1aQTi6X}RY+-F8 zdjo~^8_75vC@lOp{`?a~=D`y)oV{xqb6|heH!T(9)~H8uC}s-3t;L;(&rRDX`k3&YYS4{%46?5#Lx52rqTix+YQu~5rlgf!O`oeD20y18iRWu z3?A$a)RrmPQHSYPL0UxNBc{2}mR0@djekmo85Wqt77@hP&N+GFmZ+xG&L)P2f^Jl@ z)~G;eZuXl(Vm);x70)PsF{n$qsCzr%GgjNC({%6aW9r_Vj*%PbEwt@L6`>-!j3pHd zXm?dBGq(CKMKJV*(MQSE-%?XItj;rp{xiDW1~iKEjaYx%XJJ#~+R9rNBU{kRYZtW5 zeXhRcxhlNa5krFHv&tywWDV@Qx;tH4P-z&meUESMUF=c;Cz4=3NTkfXs6YGm(j)mv zW*C^QC--gxyAA{rX$g5bcQwG155OCXCbqzhD}8>iBLHpf@da0z`utIQ2x|+8!@tV9 zH={pbXb}4X1c?frG?3Z=8~xuM-`pX`$v8NCaNw#r;xB}rQzW&8#&(T~Bd)}aJ@x3` zxby-E(elUL1~C5DC>#a0L1r)?5IG3LTe=GhV@II`pAOIhC)+qWA}7G|>{@CV^a(IP zhl;ycmwT?Mz@GxltAf#3|@xNRUpaY5J zLLK{I^KM2;(R8$nglNyhTQZ}Eff@yQ##*8p4*7{`0QE$D=*+oYLe?A7S7?A4m2Kcn zw$K^LV+=n5Un`8T=L{{@Une)TN zcLWQvVgJrj-?!~>m9lnj>Sg@fLQ&12#MF3UCYfq>HUpPwm`y9i`xgqppjbz#(3Vi%!3hpIAl_X$6i3#o5`KxbC;;eJls zZWwy=-)NsX0|o|RZ?-MTDv$cYXENHpE!deB|91zCPiDOA=Kx3Ik_SH(P3Jdma~mOj@1U;byah2VQEamsjr@*snAh1xmiY|%a)_tX7>($WV?PF~ zg(FXEp1%&mj`-NP;Gt3e_#PQB{9a|;e#fRHT!PtE0rP|Wq>x77MYip|K}DrxwJAV! zgOr9Ujj}KiXKSV(%>VVoT_GdYZ|NPZ1t|@S!QuDFY?RE=2@Tpn97)1OST|Y92`Bxa z=P?&iN09EDGM=lS!+1@T79x!Q52c@nl<<>73_J(rN(@+&D7((^D-)c!U20KcF)Oh1by5nlOu^8HOWGuJw z!Rv;fy~_CFO4AN}^ zhSDL|{OMfwJf4|iLG0`%Y5R2WxoIOUR9s5Cj73CvVSOBZ64o3UalNCc1Sr|SRJ)BObj-GIp)D8F8i#%`IY zdLMe@Q(Rzv8+(8#8$6`YiDjs5Yrm|aOK{0(^AqW<^!V~3Pvm3-Z0(SRD=YS9y?g-F z&626>j>6zgc$EnMtaXD1jxq2Ws0*9OSa;+Dicm%~1yd*OZ&%Z2t*n9xqRXLGS!go6 zr}eE!?I1@ef9)ig5f)(L1y5p@+DIf=e&79D28(Z&9$;*B#mRrR_Uw?K@#gv^$jxqI zgrpktJ#`VQg6loNi#u>)k;W-s8D$M`O*E9f$Xev!tWi1&+oI68sU^i&^<-nDq(7SI znh!~jQk9_bgH&-#la(!nPnHmc``jk8J1zPL-Zr+~SNC^iJ5^d+Zo*k^?AL*&Vmgsf zJu5S6J8~ce=7Zl@m__5qU2433$dK&GrdwaK>p4~RVpf5&zcqr9&zekR6gq9z!gp@u zhl>O+#f-{(g>`x}N?DZf*QrXk00dKt`#vi7bR{q;z<2``BKB%cWN0njB}sDUsW*QA z^B(`?vPnuYt+t#DhTa=h}IO(MwT}>)(g8as-!On>I_j1gRKUl*y_?{*ea3 zB{OAAORE5mbSnLVL{KEydXEh!)KA(`{3o&(O5#Y!{(6T^2se)0su~uq#OZM;s$T`M(7Q`4Vai;(TA+f6NRZ z0wz6{2&*Q$I_s|#_QA2#3S2xf%%1s@F4ZfEnXI-1l{S*9*hTwL95$2v2fP+@Mzs_? z^xr(1YsKzvd{E|FAlH;g1FEmLEoDY)ko!jYHEdYHz%lecFS3gg-!2V9f#DyfvW7s> zq6};10gzdYvJ`D0jmO}L$P0@58rcna!_ThKIcpsC@a>SKGp4^Y4FuI^Q|BA8=&g_$ z)@abvficiPp0Zujf4|G8my`V+kq#n@^l8Vhvt6Q$n$N2g3nkd07r;d6 z$o2=#oyVw9TU>vsj)zQ^p@aXRK=ZJD7(>wI00^E7^9cDV!VE5o={kFNpXD&b2hs>t zbp6yvaB4>`o}J&oy+|P9D_{JfGI@V8x_k%6CHgu|KR0WNIUF!^i_|ajwzIdAGY$=c zJqeg_ALi?9WAsSo*ePa=<%1uWFz4#fDjW1S`Wae!9t^rl(XJ)k@Beml6GtoDAZ@e! zrz$CKN)+~Rpu5Xw-kq-cJ25G980RzA+CLhN>S`HJMlIRwOpo5?aKhA zL&hS@w*g7C(cRPav7k6sdx52NS0o5Pzx1pos~kK7(*_yu5;5m_W@j(m1z`Q_GIeyw zqA_P&Jth|`@O)2=hH|%zHO-p!^13!PH#_1ia#?kQ-mWZ3iMawY;5+;%iakDe;<~b_ z#2M(3wt|wd%hxcg@CRHd(@8f+yMNPdQ@L>7d*X`P>hk6rocZtH`I_LpF(Kj~dZK@i zWaCn$CLQU(+X!>*&G!VVa+F2NZobi-fDz5%zI^6& zZ10|6nWmIQgBj3~s z1eW4Pa9v3IEL>=20oHR67H}L?BIRv3Ks905gM7n$w0C^Qw6ZcF9Lb;H!g{Dj^~^$b z(|9py&OqQ1kmLBwh#`643f&$UR+!qa%a20yHhG_pQh#q2%QZ*^h=4*TZLE*6wsVu~ z1+(YE2K<)L2+U>^W&kv|3=pRhT1=Ls%I135@qQvdJm1Y?7&m0GO}mY_ELlH~4%gOA zlq5kdCuOIpk=dkWA$)Tt@K_!eSDkE1fFgq>+iYS~-{?U!fpTakzs?Xc5G`63_it%q zLLFM4$?3HA4(N|9hDKIS!Hyendqyc5#*t0)Y?DmirT#&N^G~3SzdkFaDJ0VQ;X}O? zL0F#!r4v<@I37=P#t$5msMI@n;$@T}$KlW3;}i$simQ*O!?iSCUGi9Cwh>uzTvojYe>aO?GOk%fjDThCzEQye_rV#YxPr0Po1gfIeJ;TVNJ zIE-7Nd3@Q`3as)h z4Lo2O&7`7&DgyVWA1y(#`+|mc_%qMTcWp5Eo4D08Fk28$XvZ5i6T3S*pQ z(X#@Qpbeg5ZG$51ekplMIn_J!n1$HoyCnq%u~ur8KdI~=Jk;wpPQU-$pFw8qI}^JAA&_Fbpw9$ zQ)EZ4z}(ovn5rjc^c~sj&k}<1#>G;1QdXfu*jG8&2MQG<>ePnMzy(8Ph#qY4=H?ro z6pK3>83V@yr3X$N2Ys4$30$`5PXr~hXw{Hrs%(eefcm>1QtnswrKe`9%V$n%t&}TGf2X?OzG_ zZfL-BP6GGK^hhrhB7k-KE@Y*(0uDX~1then&MyENk<2mc$iOYneu!es(zDnzGD&+) zU5}3tp;SKzkV7&6X{Hg0Q>Gj`!^@{);Im}O%8dZ^9@ViWP~fsRpalcuaHad|#sq3K z5H?Bb!tIA^FTGLZgzpD1VG|6Mxq|}5$c9OglA>59)LMe+4-?8hzf8Am9DU-IL{yYY zSU_7z!%z<7DLGIS{-x6&_83@ONXzA?F5;2+(80}h=Qlg(T9DZVH(CM39sAxtZH$N*4TJtP&2pew4xk z$seL$DpA(*0qjI*iLWbQ*lVsi-SE4%$E!x<@yeRG@w>5MWL;N;<`c>7y% zV`p+q9-~i+hWRY}{wbh^aiim6y>XbXO(1qtRxm6R#_bw11MzDF6)%0PKNRVI_0-tT z1%Ug{0av7zO-==|4WK5E74UL(12{)7U)JR_`0_NPfgpwn!uLEvKbSYaZ*OrEl(nJgSWSVffcA4Jia)x zxywrplgr*pfZ(#q^-l(foX;B(3-1IVcF_apCqYiHCL`5nu?fV<3TTSbM zZ35K>p6>v@8QV>bCHx0h*MIf|aUB^u#M={ob$5WEcJ``O4dXfiVV^1-P*$(bbV297E-*{L zMws@=Pt4bY1or25R--37>S+aHCJEiB9LI}?^>>2*d!`&zw=*Dm07g6BK#YoK{=uVY zbUOy4z@s*(0j3iy0y3@8qC+o15CwW(q+s<>2m+{@s=XHh~QM> z`)Sk9i}=%Ariy1gw>ej@Jm7l0ZxKSq=;Ntl%;?(OhT-XEnm0y!X}~mN`nsCVh)Ur? zd5T(?aXzvaG_-#{i-0@d3=^_zQxTbK|9Ly<>-wRo9%dA`!?->m0Cj0dJfP@tHgas# zcZrqGFO|HCzON7cJZ_%e9VWdrpC4xw@6bwjR(3U(zKjOLR&Gx2&@M)cY$>(YR|u+2W%4gM3C9FM83&Tt0SK$M97g?eV+}FZ72Gqv*qeQ;=+Z;PQEPY z{1F^+0flKG`Yh4L^`j5#ACu6wy+V{_hB-gUy1J>Rn&JEjhwU1r3Y`K zQ0dnVx^>RShxM|>6~u;BlRtGw;}_u5?EyH>;5g$}x27j{k@d>G>mhAKoQ(yWu8!&uX$Bp(n(Y6kgMnsnP*r=3*t#V#dzDh`31$U>-MOnKkEZrl4z*VXaCfcHFE zoT%rKn~7Q`%sul9dDzxZ@uj=a|6g7mw`YdTOhcqz=UoMqfBj~Z9&M2r%Od|{Ht1+H zL8l83IiQ_7_BfyJ=09!zV`g7SP*SI4gj_L>it~cM_(r@B|nEw zG9#$6?wzV&EzLF~W(?sjON|;vYW+( z6?dt8IPY=O3I22t)52A(z&pJ^z<Bi1%K2qD-Vohv7~o_ zVEg)Bv);B85s9D}4;5hY|8v}rvxcD21s@`6;TBe%3xg52uI5nK%Z&tI2`iMRc;w`i zdWLX@mN)Sm7%4-kP@%Q=0NnAxonG-xl35V`5!rdy&aU!Vc>{!^#L9b)G^K~dbwttQ zd!7w(c`rR#?u1t?4kW$j;Z z=(d&P=ftZxikH!D@4S+nlXgF2HK0wYN0;qF5 z8Q++rv8Y~Mw6pb4e`XE8thyOp>ow_WwCt*YH#Q|n=EHZAa7U_ur3XmnExz&0J1?WcYp7W{KQh0Gawj15DRX?bCWrN?+@1Pti-7UcjvQIYZ5Uz;YJ^Gx3>N(m=_8B)f z7ds@ZD$=>ohhTPD4n^ePg3k4vfnA9_A_rqn@Y8MPQ~SD7D0~_4wA3Mhqy$(=?`Jx( z8?u@WI{@UZzcCWP4L6mYu*mae6WXTod07%3le2- zYFrk_U^PPlN^W7folAKeX2B0g*pQ2EXW>&U)lF_-1XqgykW~)DdbXZ)ud!dOv@&bt ztO3?gK=XeJ(|O^XX58jV3jd|OVhfMvl*=KlOAqxb>aHspUqa&n!Wlrr$iRfaU;z`G6^CWXiN-G;$XXlxS_LEzC=?3X`+Rjo__tWpr zO7e<300olrOB6gMrYjgL;_@9*Q*wBg+;x?fPA~zB_#Y6z(2kYvwEpTX*XQJO46q&> z%8<4+mh4O!_@`s}Vc*CS8{xNe!|LozVJ*GtXXee*Qzkc;#o}Ri-pC@pJ!6l8x9I>t zZEVqenKCh|>-+(S0&#)|b7pp+fXOd<6NXuzEv%ieN<>-?HkFoKSBx}B>A9yPFo)c? zXh$5L)|ln4tHyd!P6;J74(75m>0a@Tq*TAn`ht>g@<^EwfRn$ceuvZG4Yk%_iCghj zk6WnCVn6e~&K|rGE+m7NzxQ{+fddF56p0)kSGf?02(}lAL01HO;uWIRFX__@Ww1F> zW}*aUTx&Z7-;%dUSNi+M{CSax+~6grIl3u8g91IQ zXwM=H#U#)RO8a_FxC|4tP*MX=%yoKv3@WQjkhM~a2SRh$kcKVlb(Y&Jzcd&_GOGH? z=fNZuZS2+^J@T0hAvz!naC$GH;n%QkY^-BWu9Egjf>d<-1ar^C{Ao(v;uU%lI39Lf zVvI@znAN7X_ih6$I>vBhr;6f@EIvs36O$ahTP5U*~S6p(juuAXWz zwHln6BrYVaIHxYAmU|3JP(%m1p0u+=N7#A1X74x=zZbZ!)#X|0A+olnLJtY4uulMH zx4Sc^6O&>ec-jacsT9jL=O>hD$b(Oci_cmNy+d^#+U%3E8!GH!0vGrBHLVyRJb_AA z0GFNWROZTRYlRM)R*vgd_PtWQr<)CQJJTLovif%r05aZ@ z6l;`fl$G2NVqU}74!|oT97ZCdJ88k)hl^nPB?!YE7>>p*bPdOJB~>U_TzJLL4KLS-m+nsRXC%o54G($z%0T9*Is36V3HZ5OvgvIp@$ zm<2dKc3uV9Q(L^_#Wq6!qqqqi@ z>HGINr&^Wm7lL#h}oK$GFjf+m_v0?`jB{- zgT@4v)McK9CLuJ@rKP~AHKJz(!pV|yb9y%_e2hj}reh_aXgiQtSnIzhX#1+H)3 zfQ|Fub;tZEF3P`#@B%7!>8>5QJwQIYs2Uj`)r6O|lwo~e8ybI8UW4c>sO$Go;D5&l zsVmf1Yw$nAn@(G4258I)VI(mdmoHb?;S0^0rUMM1>eWIKSj4yV0Z{k!ZVn-bD%kml z-)|s7f<|3z!t-=dl3)DmF94B$G}S`w6S-R~VBq2}fnt3^Uvm(ZU?o;@wmnoy1MZ%O zk!{@^fys~=m4gqBcT2|z+Qyrp0Sttp9}fh$ZP z8(I~ZRUo3VujRE)o;Kz+Ks`m^VoL;p`~~v?@U%ENvH4SKZ%#`afr!5EF{5tQjj5IE z1W&aR%vA1UtR z?jrnH!~a@I>M@Iv4A{vsxjcj&)In6vUi-i=?tLfcU4J#*qBc3ZWdACTAu5@#-?OBxJllJ zbcwR09nCqsi8%GIs6jaNWjga(WeM`9eOEQKB zdI%d17K65@ERca9o#shX(1r5-J*Z11oIbC;RQ2o=0LsB2{z<#<_)v!zbrJ~${3T2k{kA0*fg=5g|L_V_m|o-N#-tf2YK?qU7Qfv#e)_DSktGBWojC zlR1Q>!KF^W*)b>K-$U0-oN(Lgcqmi{vMe=RJdePyTWo|J?V4OB?(hg;F$))xx^~jw zah0u8CJ!is|-0nr9#8 zirZ+OwkPRh{*1ffs(DM+ zzZ-Ov)s@Qa)8<9Isifbh0!v=ltKp^voCgkyT+=kqcTB9SHn@bL-R(-OBZAueozaPp z4FHTf5G0rAH6w3Ib`|_ekOzvvr6v(&J5{yIO1)J8psKE+p0LYk)Be!OAhvha3<6$i z?z~1O)u=k2X+alEfkiQ(rF)z&(j^Pt9p74~K_y=ivh8S{BGS(|mqz z=l@Foon>fy5`JFAME=y!qJNtNi=_)I;+J$?{egrJiib^!@*D}2R z&&{PPeObrY@guaQYsu)NsrTUrQ->}`9>=6a*2J{x6`fA03HbfbEuqf+D{n0W+7?8q z<-cW~v5qm=^n&oBfVzjN<~Vi!!xK|>_AYAi;XBY!e{|JS`jd7Wbf?g?J{jnVtXLv{ zS1c%-ZCB2T1o+J@)U9uEsAkVOYRk#4Uc?yu8rtE8yYvOlG>|+iTj?OL_;>lINALfU zb|m{d7_URb16|LQz!ULsN>(Gm#eJRP7mx$Ewk$2=LtBt%t0Bak1i^{w+(3n z*st;vDz*sl%lD<>Bp>$Z?vC*7=M45-PxQlSR zUFu8I23E8CGWAEZl~YWz`Y&ALGrVh)d{%~L0| z5ieLV&gsE)6YjijxL_GsW;sB6{Sc#jfH`jo%xIO=vnW4JYE?f!g?;?#A&?a8=y?8c z`{MUQwt$AqmeKnNx!8Y8glZAxdHuHb@saEhI`Ly$*vtrNh&-Fgv99%p!lrm6Us?fx za=|2b2X}KZz1A^Q0fLERCs2{1@z9Ml{09<_EEXO)b*QHeapAd@1qyHqOwiVyYPU># z!g%cYJ!#3=R@iZWA9=w%Y}8WlvFL;qMisdD3o+gokI_cPf)H$x{{wH!fCRoqp_rk_ zI%ckMic8LOu*Oa1$cNMFrKY;~_%X~-P(zPP26n|!g4U3T)@KH~hSuiNnO8NI|J%`!<+Ni7)X_k(28{*4?{`FGkKD;2II zK7Kg+kv&`-&=sK#rg%+~6OM#z1@1z%EzJ?jWGJt{Ta50^EClH}HAv1ZXkK{L%qkf} z6*s2W)Zf`Lz4Wp>eqy&&5O zP74fXPj?_U_EnR4Hg{5cvj0%k*Vaas|8Nn?G^SnBj?&~kkyu0?o4izv4IcXSJl~6A zh8X&A+dS?TRDp`6!3k*AvB(tH%8EDGCh8DByRLOTINEcP?5AM^XRJ%*2!ANL@%b** z6buiIm?T%y9*>r;BjkCUBK#aa38bu!KLR}RB&ASdr#^u|rf;tQteQD-(O|5f?0VoB zBCs$p7p;64R@+$)3F3J&K*@)7v6_lElM$WsGVFqt3pSMtYVX>fy{-A44MjMZ9zicp zjD(aW_eBl)=iVIAmCDV_BQ@dTva3Q^!>bxxvAkC)XnZ7B^`TPNm#V zV-rLUSbPu9k93XUEv4VHJF&2k`&nFyk8V><3>&Okk<$ezJ=@mRy;wFFZPQhR1FajT zw9}sxViE8Xek7~DKm11P@-kznn#GmxXWxfK-?&Yufz(cMcu4ICB(27Xnl1&3L#;E;fp44+@ctc5eUi!470==Yrou(9^~AV1ohziX>45G*}a_ zJ}i`>Yr$|If$xV*nzheY#;q_ophB_O#s*;mZvW5KVjgT*_OdbhWqLCGy@KYE4(nn1 zFQNrL(Ft{a?kR)98@+>+>HL<<<8w3XB@C!6Rep&pjyf~ZUjxxKPF&l!`)G#+RqQs~ zM8j_y-S`-hj|M-t6g0y}hV|;?`ZbOy!PPS5r7R~=vjLjl=^Jq=_u9)44YOzU1S!k5 z?{2oNEQ6qesg_ncm&`e*&BsTIh_Bojjd1hDd3m=v8Qp3`LjOH{aEotrI)V2>NsUlC z9)0@JENCi66f`TUgktk!A35?J+SHzSciy43Zal#q;FFmZW&++P$-xFPbCd$x=QcF~ zs(1vSk+WdfL^l@G_z*?G!SK15nu%@1S?!3|P3MOap`ij=!b%5PypA2B7I&bJT*-mQ z-?_h>uekIBE8tX!uuwp}e}e$s$v##R{9QYNfo{k?Yi+!JHGegQVzgRW?w9ij<{KP9Q+AA1e=&`C^2)K z$0{I2jN8t9ymIe0Ikh~^B!O`ckr{};I2iV0WvxRk+S{g9Ga9_}UBUTlJzD7|K_;${ zwXR2U8^uzhs^T^8T)o2B8Z2ZiGRcdWk-59eYz6sby0!!exe>cwd}>|oGYh8gWLhd( zL3Mkr_l|j!`vMMPsU)ZD62%Pc%yT6ph?7EADG2huugvvnOEM1B%Y+4E8&02ORu#dp zU^qH=(Qz#=Q6AaTb`&lihyt>457*Zc6gULfZ3aQQnrJS|Mu%qbvJ^a4?P$_*+m1RA zN8-x^x7$dLCNKrbR5aYtuxaMcf{5iulric2l!s83WP%h&z7n^Q!A^@Om=?Pe?SVY} z!urL9*@dw3YfW1m)j%(>)7QpnprZ5)%X}aqv`g;{-zViFLt9qO@rThAJiz_Ao(#O| zqRAsHbU{!c^~*&#!`Uq{(BKi`Ap$_OzVjWagf;je(*$UQWF=K@O}L2%TC$k*iu8|5 z7jP4QV1fK{G7IAqSE-IWwxC+d(R>@B(ByD+TP4xY>I{O=`NW$vY(vv1fmW8vrS~jm15VtQsx7U?|NI ztpB=9bN-B@LwRymS9EuK@{qYegcrC(?}PNioDMzJ^~|!;e`ot;cmOs>07h zps{Q}dRpKjV>09{mZu2kn!mzuK_dw4qb(kvAX{$krPd+{h?G@snyZmfc|g|MwWr7>Eolr_0T z)836Z-=Hc)n`|QbYQ&|Z_XMU=;pm!LD`)^7b*sinLr>mGU#i)cBo2)o&&@*p`|RL8 z;zYIXj;(2Y^L6h%LY#JE1!{sU zDmir3_dN2xp2e-yF^UN;<7X>Pvcf)iqx9zE24Me{^;t6%s*xb_*&IC_qWV!lt!h2q zgAV{6a$olONmZL}H?#okJ1?u}BzR?)&-LP6!@#R?co0u&y0)`@^J(qsHBvI_u#7WI z*Tjgjv+Yvq*z_Sky*liz|K;>JPKIrlkJ{ZGt}c2q1AmS|ijx16y#yOP+?im$nHrK?4s*ATSJi?8%FEZ&Q5tVCsCGDf4}_F zpm}h}mM_9P5|$*rtd3*D%ia63q1pBnk>ou;G`?}faaZG|GErjG%lo*@d0`MJ8#T48 zK93FTLsc+(ZShsn*>h0|=iHZ-9PulC=vFxQ(P9|&yQd(@otgTeo~DkqDLXmT`1UVi zfDuyM*H7mr9VZO)PDZ7yae4P(9};LPF2okweg+O@h*agq+37w%MZ?^54Mhf=)R2mLL zI%D#2%lqj~?F>=C2LEx#id=0XuPqh|VmfN%Hwts5>o-<&>o+>oC0nh;XE-j;gzWHJ z6;}bRJsVcu7gx9Ev*GUvH7?>x_kxw~V!WsN;cmwuJ<1`%q}ti&a9ks(?*isM=jN-H z4Sf=Z+W2QC=BbK7i@?i)K~j1RyOB_}PGQwwxDz37YenE+0XgoUjyP#DfEgNDxtMzP zyp_ks47M#|>giPCL_TK= zi6G2%5SAr@fBd5BIk};kH)iN|a@uFh8Z(`LlbMo7MSqzqwKIWy<&cwF4GIvS zd?5XgxCNx5)X?=SU;$$rc%tNd1%XEU&Yw-KFe`R7 zxxVBb^g1@1#Dq%Rd>zVx4Byjo>olG(D|iVv@A zG-Ofx9;FQIXs*!ZzW*qd#I)N-#Oii&rZZHX0J^ItZMD=eB>gl=DDj)4dEsI+HX^e? znhw8lE>i~EF$m0ec>}MY_^(FtY!+pjS<#dZ|NdUlVlAlwRqfb-kMN;BVTx57B|-SI z`Qk;I_K%hLlFXLETtNU@`AxE6e}YqnAeogaDS@bl7+Q#05DY$Z?q|K)jD7C-JYwdf zUzblaUogwTN6w>glCh4ZWD@02SD7j5jMr&fsum{r1O>6i(u(6I^5Q~e!7>9H|NJ;3 z^g7(Ym2j7bXTaSQQ!D>-gSB2)?+U}_(@JU8$}qDk#l>zPahPt$Y~?aQ?r<(hRQI=W4Lntm@1r!D9loV8YQEmUy@luHcj1z(`SE9eXP7gwqa=eP6i5NJ-p-@IM8j9$&{ zO?P9bMVmJoIU;n~f%Nj?8~_wD`cKnV1Q6V4bVvlBZ63kp@Fu?k-ez)LJ7gj&9#EMQ zXrHR>+D8F8-^$_3>+sOw=5cZ<52D_kB}Dea0UBh;9%o{`Avx^+{VPs z)d88oW6=8HsStysx}uy1qr_m)JIf5v!-!-(!jcWPtr16n)Q+9QU7b9TFB1$O*E`|? z%^gbqXxwyO7hB5rlS~chSeCkW+LZSq+W%%RSz_n0!K0ceLcvVXUCxBY9r7b1s6R7N zEw>9H=|_l|GWZh~5Zas#;mx8rEj|Uk8-wwAjg_7<-g$j~$lV~A^~%$9cv)l4XklOs zROkRKAtpOY^5;ce@6G-{SBvP(RA;2CCfMri2c{Ok%Dy_)4vyyjTR_l_ct0-zaKJ{? z8VEcnUMJjQN(bm$g&&OC`=5AQU9V_H93hjkClC;WRhit^l~=CTn$=|jVr>PCf;X@s zY75jD^eR|VXTPZ2!#5d<@02%$5YJnfc#=Ua8s8>KngO$LH{wb~)GkZ}0$&EfVb7vzG%KM2td zC84yOhA=udT^*~y9)Xt*ZIr|)^pnjhKH8w#;h;OS&|8AQQ|IdF+8 zKM&O|R%{YoBlhLaQ8UgJZ?fL*O|uiXxdDc|)%EI-5Eyf%Up+DBx`sRdEQRE3{kJjM zootic<7bz^2D1=+Clif1&Ju5CaNRNM-zVp7I@F4;qFX zne`_b7#fSI<9vey+M7DUxlF5n_O8S{%6k%po{tQe8v+fY$>(8uJsA~Gz7AX(=~$8H z(N+dM$D*Xs8WOwCA+LB(Ty`!=&{=0QfeX)`r99LsvIB^{?TeoQ+2Vc82+457+|_ax zRoTTPBV)V@PKQIZ)!D`bJj6P4f*u>(Drt2g=hxL zzmWRo_z1C7HzX5wSvZM9)6+T$FP%E5!x&6XlIqURQH40y@84<|s}dILnO64B;{*?k z)lph{S2X_f^SfKzciH`-E5m1&K$y?>TnbJf=yFbp&#|q3p5kU*bO8N3YEMWUc_6*+ zB$&vgdP0FD;;Fl{49(Jup}A~is{AZZ)Rs|Y0Y;BN)75!8>Xd%j7z5dVuO+gzje@p99td2 zMU&>H;M+<>!SGmaJtE$fG(q9b!(hAm2eGU27`!ke#w|nrE!h4hjD4G@RKnv8bILiC zKd)R)vZHsD9pK`D%KBoW`soY{4deA`>Vf9@4c{}1X_3CIr`U|ZY3MoR=9^S1AdIMG zqRHUk(%|3qLeX*+4}Ij8HY(6k4$rP)Wr&y1g6W15%crfroxx9|Vt#{r=4dFn=P_>& z*nqpYf2fC!Zm<*eEG0+zMe4bYZ6*KNIYCE;N6?<-6R2rLrc++CCKmy~*J z$bC_2fQ^6u2m?haLb)O0L7^k`PAea30~F_})^j&*++S}LJB;W#mzEnz62~I-7aFUi{6Cg*n9}C<$qG^ZbRwAX(?d`5sVOSVTLCPd(^C zN>$nsFM)<-0V&7Z)H-_2sjR$3xPY*z&Vt72Oq}M4kKDDN9EMP~;W+&28(SLxH+QwC zifl~mvr%TU+kWF9_kNAEs`ti5R5}I~9J#!pZ7cNa(-IfZ^uQOmYZnsZZ@o;CI_7Xc$!YFX`viCeTD6TfOfWWoA}2r_Ka{eIZ?5+D6(bWYzK zDMZ!M5*ibVDwP2lwm)$NKUZdr1kghhaGsG=_0obM5}7@>?MEWCzNxoNQ*))lvJU ze-f&ixD!ng5ze~Re^hy0dk3r;h`s~NF8<+|Emg4TXzU41#Y}_ID_j z0o!~w(GQ42FB1L77JK5fXl;S15BfOn>#@}=2cgO8I&IVSY9jJ4h=hp~ z<;gG|%W$mFc^6WGfUD&#D%&pJ=l|3h^$7;}Lz@O+L>xQwA=H84K~eZG#?;O#t}iXoPDV%r~~ ze$KnRGtA|QW)dm)a%1}womizj?-4O?v;3b?H5)NWh#^wv;Cu0A?FVZ9i*Q6u3({?T zPfSU$0zey(@wLT}SL;zr0KLhLKEf~hbQ!^u+*-g4-Llk3Lia7JL(N)H*v96Kwt9?! zO;3qgB3vKlXBq7$lK@Hg)cC?U-m;~6H7vAK$b4q3(@cpHm6(hj+!~QQwnf{)$=old zw#{Knxn2@B3o655dW_Fsl<*+Gn*S>Sjeyorep;Usigh_H%S51B-zz~hv{@tZ4H0C= z#(G%va%Tga(8vzJoCV*RM?LTdt#TLLc$UV zLWa#maP#sz`-f1t`17TIEa5R5(*X~qQp)D}oz|j0S7)F_w>0w)i|B3X3!~Ykn?i6{ zZLnr&J)@Y=%+Q3z*r*wclP8P3@=wQ7UrK*!XyIbrHB`uQ=>6~_9pWr$@mN@dnK=5P zOxsx?7ZN}fM36LAJ%Fgj?)4~O;CkikDC{#=Jk{zH%gNu(BNJGvn|L0%jfw{$x?_g5 zhcszn@CQE?x5H)>>vaic&ioKD*fd}!5)KK{?B7K;umFDc#nSEhNk4qL5)ahmuYWQAg=5f5w!`h(Fv zW>M>uvwLmJqm0U86QVUSQW=De?;>zh)9$U)j_$y_23v`%%a*CkP+?B;ttP1gIy*znOAe?a=14Hn_r$$^RWw` z3lrrNvkkC&y<1}Qb=Cm}c63>QJ8J;hLg2GNYe9DIom1qp#M6xSa_x`u;bzh4-Z?%1*x+I$O$^mUgW>*|C#`}8Va1BR^I#RKUV32DTYk%mjD z?@{KQ`H&W6h5Pqqd4#LkbEVYf?A^dk&SmCsQ<4HWWRh))8~;V_}3Cb z22lE7W_&!IH^+ygCVr}&o&aKFu62&)oNwbH!YasGWY;=xh5nV|>EJb7_i0%-q(d5& zsRs!)$!3AFg4m~ZP!~d)NQ6Y{E2{x17}j5mjYV55g5f zYnwdH;4sBgL&A_&+6@dZr5*|F5)-~BQ(CbXerXOn@!WSXV0{yoXYS}y>DrvAxKzl{ zX%b}!+=rphC$FK&$He@Uz3!l2ryGd7X224DiO`U6`69dI$t}&p{!rg!EGuv%=hp9n zFKPqVVuaza`IQA!5yPb-O%a!==}j*6+ZNL4WA9?zx#(D@_W2Q*R*>-Tp1A))i!&{l z?IUMz@m|~oJwatGFF8j$T#lh;e8rm&D!&<6YH5kO!`rtx7V$71+~GVOJdSSYO!dy8 zSGIte7?gh3EK1c6*q0*`s2K}L(Nes_8ZUwyZN24+Zt+xRdyJJFzDk7 zyytVzo`rx5aNcjS&|-mQ=AiBLm=H0QINOe6f#@y=Q{M$Zb^*&~9^kSf^cmL_QHomc zJ7H!8YKfp}!`nQ8*Zj1HTq}$Es=~In@1CH_V>WRfK^wSjYgtr)z895kkm+F>X`^uc z;_h{dq*!hi1$b`g>BA*hEnC`Ch_R53x>?KrM@SMiZeZR9`(@*QsuUCPI=hnJR9Ru1 zsLyMhfa7!Wfr_3*qgf7PKTFj(3TvcQU{v(4pQdGePLaZ|P#1ueX+^E0mvw6_r`*2y z+hkMTpO%reqlo8rEtoumMYyR`x95TseYL1m_pdJH)i3UHdCnLv=BqGuYU2*#`|3Ub zazNuE^2weLCSs>*DfBnrk9*=0x$xr@GWX=*rK9%YZ~ONp!5szeJD|}tPBl-aX`ToW z?bmF-r#Wv4nB3g}I=5rxa{m&;6<#jfWjr3aY1nYEEf~DLrxq-9h@;-pVe-!qzz6q$ z`e}{UV3WZKxpNldjTAbQRl-k5b!2jb?%;Zd;tJ454``8NIa>0FS*Ch zt>19egXDAQxhVxvwUKPejsfC|ZkK)E{8|<~0`q{vFR~|r4g>w7s1xHxJ9%l3v+2E~ z`~>nKQp7ADQq@tIDm8+0moRs;29;6`^+tLuyg4)4QQ!WTg{qR5(U-fD{_I?hQ?y9D zFl;_o)o-6Gp1aA;!*(yXHqs?gsCw_f3c+brqLdT>M!t#6@Ef|ZkCVSb`DZEAc1uu% zVW0tJqG4A3ai7?GfyfllR}>Y&l*`7B``0lBCfo-_mp4mUaTp<~^Me|I z%4x=^HLvIUq@m&wkv0?klb|&sJ#+lgeDUQ{IS60cV%DRav>b>Jd^!GO**(lcq(kbx zfJXHCrFb5SOS@@x>Qta2mZI#e#tT0LeeGXkGPc{n%MNy#5C))L0YnSYTM);HAn4QF zXqO^eYYVng*K)31X9K?5w-Z)1KphA4+qNi#FgHlMW`%rUda&D{vDL(floDt%IbkBI z*z}I89fDtfZLejvpEak}3o>n+3v~{z_fu9$axjFLj>Cvvc$aX;trqGUKDA9w$Z2zY z^;lm~u%9WpSgc;LFz~e2>(m3@)A$63Envs=kE8DNWV~Ey=tu?qZ=`+b-BAuY+s z>_enhEw;|qFdv-Au@AN!B zE5`LoO!JeG$`gl>M=GhQPE9rsNk;7m3*Ofd_+qht5nmPiiuE-@)h5d!tkGI!I=m7he?OJg)?I^ zDhz_JU2wpV_}AXC>^5k*V}A^q96nbu3y1RAM(JWB`~(*N;5c934*sf0dwL&6N4jGG6W%_eDz+sqPbGbdl`RQ3MOnRSfP)x zrMUKevW#33XW%vCr1&q8dfO0R8JcQI`08Q35*lC?&*5yAg!M3_j!PibRF3yZgGEt;KSdN~G*r{5|6YAlsW(5+XVjHmYF?UKCpBnyrh_V$DxbKx?Kb zvB3hs7KCxY=xASf%bu2P=yNYh&>*MFjOx8So=aNt&rUH<^cV$p*HW;C+t)7(osVaTE=3yOp z9iPe8a0VOl-#`55xMY(CL5MSld#?nQ=*{rf>yCE~&424jGfGt%H#ARg{k$9o_XkrI zGVl+wDz@Cw%|Q%RY0ero@H-BffTLCOP2Rj6Xzr7ztrs$QzIIqsn8cQPV%>UD_zE_u zIAwLh(J%hB$y9~0DJ9&{Ap!g#i6T~AXtW$G3rgh1g3ZnH9cbP9H=C!E7a zQz{wT7{43hT`B8SD09GHbg5=6P=eQr!{3xOi%XqICTsOFh2Y=yXRi%h3IDD`++qRL zptzG^>#qx1z*55apW0!2WOvJvHTYWjF{y<(Hr>DUw+x8b15f3+W+Aec$*OwoaRSXn zSDxWjFzccm8`+H~Y0h{jC}e+TRF4v0y(j)K!x0WQg(FwH;0A;$eRVT(#Pob*=)nW2 zWIdPMLMvaao$#l*i~6Fo-UkTcvA20O*g(G+8A}p(hrMJX=+9bB$|2L=#3IHsvnCQU z;m3XFkRLRDhw?^LoLAuZt%bZtcR zN}au?3N3hc+<&{vJ5|xRGHEb$VWzH($8-qkEVkqM*-@qWRF;-W;1wm+9K&0^wsMsR zj3!I6FG#~bPP$+dU@ zJ1Qll_T?*l*oF`B!?gznHYBN07FV)fYwqN$->(2KL2uYmOA37g-uuU5HJa_~=2_G} zSDs1C5KtY0d{Z)sRvo|fu^;a!T*Y8FL}fC&=!?Ff>T$hEjfc8C&0S=9w|^o|&;`UE zj0;B}YcOdo)5Gfta)iTB{!LK z?ao^+0pma*1Hojb6h@&;hnT;Ei6(WA(w>?RrUy}IDF*%-uk-&ZCm24ru-h;7JO+Y%ssiD2PtsmpbeKeg3>u#t8-guUq|95LQiJd9-Ne?W)I` z(SmF*F7+X;PyB%?+-tl!#l$jfQGG}*FfJpI$RCl@6CN$<^ykHDEYq;t)RjuIg*K5gPuON2bGJT^7LH1B)V?0WqGRp2`yY3=v^@oKPj}^zD49Jg^=4~8y9xsg zz}(;bxyAT_o`wXip8%;2*LIMdjtq`KtNtrZBJGu2B@}XRQy4pd!l7RvN@5O z-;S#-7$)IrCGZVDnO2wuE{LR7Acu+XGR_XM!#4dkjc0iKA3D0yRS;nAUcy3dkua+6 zU*lR8xI*B*JCu8g!-$Q6mA}p7?BNqq4wF3m8iZffS|ECHXteDRQ_)F;D2?2phOS2 z!N&#ttm&o|7y+Lw08& zI%67U>xKK?9&Bk}n8b(a7}K6BU`ZA&)}gS87b7p8W&%DF4S_mRsSYltS|)sOzWzA` zV!$m66O-8PHrky#IAEydLeltxZ?~*!h!*7r(akx8gcH>iiwxdw$soJL&pvUs=BkuY zqH|ql3`i`NY*?u082zX;BLswnl<0_JRRzTY=&0iMOjw~@osQ7Z$XX*F!NN6V`aiTE|{2H=5 zU(b6;4&umb6z}0_0k!H4TxxhazpoIk1p-s2J8~sLmD(mIjNRREpQKG zdL8+h9)4(t_zU58qufI^YZ6AxoyB%ahqTRF5yaz;?jK><@rL2~rC3^LXo>ImEJ^Va zH2VDxQig7Ubn*bFPf}^CVstWSVkExcqH}2-bm;ub31CvAXzlGBe1 zYn&8>+7fZv*Sn_6TM{q8xtF zE7Itj>1MlfO*9FZ6nj@?1Sbl+ZynYK9xY6pLqR~1GPChY>*QW+xuQhMI~)>2{)%Q( znEo!ccnVVllIU}Go*pOt-?wxI=gm*u%tk>1_r$Xl&`3&EoKXBzc_#R^ZG7a>-5P_? zGuz3T2QK?8x+{lo|FxBVkr;w*D9#JnG&?rX9?$YWIc0a&Fh#g5M(%RKhOj>X5~=lg zUcds0_m3>Lp$tDR(sGQ%r*W#*hMNw+J}G=k{{mXx$#S2$oWqEEUoXG%8T9fzSqWYv zHxYudBf6vH^UVQTP3PV=@MFI}%+u=T8Hr3Hc1l0>hn2Yb41WIKbdF0gSSk0-{qQa{njQSZLg$E5bj4jQ(;5xHcnl|>QDHNK%av;UMGWg>yZ=CQEdIKPi%0a zUqP7*J*yN9%TO?@pP;gyg9*bX;u;A4>D2`u{Ubamh*b;ESX@Rc_2VkyRe%57uP%FA zmSm-r-Rfx5yS)q(U?D^?wcTfk)WeAG6r%487OF(i^=0_c%qKS{90&sg?9XxA{QQRM zSEL%s@(EbqSDyDFJD0?0ld&kmvCMBk*XEFNBi7Z_KPS5Fpp$vBAIt>nMPKEjt*QUJIhhVy7 z_1cYIp2RC3YMgur79cr&Kr)xGLVDm7|+ z41>Z{w$TmNn|mHy$DKFW>G4X6JRG#Gn;h4ztBKlUi%0%fX`r^xbo6)zaOk%GJG*p( zcS+`-`&XVFPhGjR`m8%z9OdbYdsk008; z1|z314;$5q8D)8_GaK@6q0(+ABm@P>L%c9c`!F39r_F(Ll9@+|TKuKHk&4eBHe$x0 zCc;ev-D;ZXlLG&Y+>eB_1k?Qv#cF8bhO7j9_ZDYw$u;z2@r6)Zu3ZgQu~OsR?E2~yJ~c- zyzuTMrSeN>YXgNsM~Jr2eB!VLNZ7(@Tn^4dJrCs(&!8iIf+RhJ`&7y8mlrmAT0r98 z>pUj!-{-=X@gJVRp1GH064JF-6{uHfVQZ29W$ig=FmfHZ@HLlyY$=qPwt_HfdVQhM zz8O*Id)ThIv{NBz^PAK+y_Lc$)JL<6oRJGdV>vPdRex%6rc@wi?w(#+D?JV&g7nRr zej(ha_qwv5|I0Pxi#NpHismFDR-j?L^8DpJY4AT}jgov>p{aYQe#zN!E%FAe@vA!y zK=`|q%OV3DEZZ!?aNZfOBAnD#V}WLRyur85BG$tM6E%KojHuK^yz~8uGci|GV7|a| zJdQ&nnGxFQf%W-i&P}|vakI<~{`0y1eVBKwbYN?0(F7j|Y#=lB&j;AUvS1w|qq&WS zEq|&_Y~yV5q+<#S_=8?@w`&!e4G6aPQ>rxmD)<301NZFM!aHxXWLFvI4fapRf6b&+ z`W&LtP)!^VjMr}gEAM^Z7RK1^3B=VE z91zxc&%1MdTczVk&qgQ%RSzr4Sx^vxr*}F^vvG&fMkPtt7*vfGeZi3U8AeQl+slL9 zDA`?e{11vdn_Q2>*}<)?;Zt4E4k#=$8qx{jJNAJS6ZnsSeXtxwZod_DLq}yyy^vpy_wl}(xHy{$yz)7%!| zL`4pOU>-gF&`;Zu z0Ual^9O6fV5WNILVnQ&b5Hp*v$9*{tkrrNnAVLkd&%D6RGv5Ah9fYs|}ZlrCXy zQyIGyFq_ye?f6Nzk2=2Z+35t@4nHO?k%s`FslJmE!!wg@4Juv42aUb1Ja9oeTs?H! zrHyTOCggU%*>Ib6Py@O2z#rpkj>+wHK!1%u#w&C%KON=+>F9c5lv`GLO5;%OA+BS$ z2p1)MZcbK>ofu?a?98cySHFp)z}Ez{%O@BfoyBpcl`Ux4@)9ugedRXPnL?1a9nv7~ zjz21CIv+HEnEE&+;V9CUh@-h!LxNTTyP_F_Wt@a&14<`v7kcV6EFY5}IH-G1-Up)i zngg}CdUm+byD}iiUh_ODC0j=D<=C}g$Jr4LX{MD%L-h$ekO5SlaJ^#r9w_%A?cPWw5GHW-*WoGY3bjbN=*3k*a`Ynwu zMAm>0_hOG^a`#a6f+RmynH9=Rqtm=IF`wA0U|Q0+a`^1HkIPQR@6)>t*3rM^bWVp) zSc*+JX&T5m+(Ka6VQr}9Vc>NKH%J3CulYaDksA%1TddFN;o@bbMp0*%r93|d#r4s~ zl{0LBqv`Vt?B*UDI+aZeN=o>zn!Yd{UzS6^a_OblKOOofY=14(4VQR&eWRf?&YpMV z1_5ut1HkYG>?wGlV}h$vhT0?Vq6Unk-W_RY5=M`#Ylms0dWR$ICC(qJ@!eFj+8+Ts z#j^%k@cgtk{1f(kC^YfIu-l>N$NdMzjz%L$yv$* zx)F%>{J^$k<^jnc29T3rnc1{VN}LKmwIii1$g5JEB&c>%VwCv(tf=K<&^Pd@U?Gbi z=(wr9C76o)(9ifr%GG64Eyp7r`qP$XgFY;Vq^c!&5?V;VNlGnr(^pSckrP<;I!2CFZHrvQ%pONzbUc z>?if6`{EY1e0(CQZKVhn-s3$Zk+IF8PYxn#CO!lk<0Vgu>tMY`?zXzjkNSqqVALq2 z<|#RliFcH*`Kz_08_}!f-7Rkk@iDt@$xw6i4#l0=P)feYACQ0>XF}0r3P?6Jx4#mIGijsuTiq#s z>|N{en5)44Zb;d2hLAy*%%!6r<)pY@u-WW3sO*E!OcCBWYI5ik1_kSp)S7X`Rx0tt zP`EKv_2k{1P&p}L1Wj=evmh>8Vy$sAgqwpYxPH1Zx4z&8sN5i^;WN?K{*W~ZH(@o< z7PXwAW)_ZU^8KY3C0Q{4gU-S)l?Fo4KJHw=>gY>QX8(K?6gaAk9(Z%^4 z+r>^ez8x#iV47Y!^dNuP1 zP@(ovVKm19*?z_qL$NPpv;cZV!U&=Cpl$SAOYa`Nj}X-!+8o~n?8FW`B8T)A`%GsI zI=35XXqTWX3o_Ib5H;9i65mbVgtGTVyCrO!O#W?*XX-?%sPL7dCM|J;BMrGU@GI~D zbT<#af>OAId%!{6Q@>s7VpB!&$B~TTi<+F%6s3S=r!rrYG8tHcp$(Eo=)f|BXN+D7D(xk$ffdfQhY~&t2E0zL z8l?lv&BeCnQ2FV~Y_jU*UvZh1Eo?GDux{LlVtpItzaY>GcSS!9yRrEflT1E_+F!>% z)Xu1-H6S_`w2ro)HyTaxdW?ph>r6bY3%5)is(?PXCGgvv08>L=_tzn^ohy{k<}kib z5lYZq5lh0hx2mS>XZi)E=fxA)gz$E){Plg!(Xy*76nIJ+;!$$ij=RkYt-d7CxPM@! z#0K6Ok7M#%*~MV)T=wDqXYzqrZ4Mf!zj2U_pks`TAB6}2MHI+TGA-jBR+KcKGx`La z;I7Iv>WC3E#ug!7F3dnb6rDk>D#AjhVM+7H!J-2NRwQiWejs-B^-H5fowX>F3TKm{ zdyV{AuzVO(-_6;QZ9LPTYqwKjPXr;#W8`qY?eIsJ16GgOUP+FKtqEUFC7Ho#+H@rNsA{S zYlWuJzYxQJE#(KDBVIA{6DO?UurH)8E%QL^{pRW-rHbXr2y-2O78HmB@+7Fk~92m z(aA*uZ;O8=h7>VDJK=`?ZIh|CO8oiafYmcE4Q4b zduhW|SLbtf30|m(r>sA!dngsyI4##g-XGmC+`s&{j&{B!2J8QzX{L{R{8bi57unNv zQa+IBtpLrV#FaqseCX(-_mE0PyTs>Z8R5e?chr}Lk}!u*=kNtYaE)6%vili#tFJ&G z=AEeE&12otdX=Hj&yeE8qVMDpfEJ=<t$LgX> z3(x+n6~>?$d*z2Dv04(Y7}g0YGyaJJ>S697=JUQKljH|?8J^|!2Z%k&J1N++85pCi z?IeoaTPpY|`#Enc)7*yK9eC~}_+y=B%e3rdKnPOpj*pIi4F=84?!&PL#04At;$ZV1 zfrHi)&K!UChi-l);qHCC%6!&Ycc&7|x&scRFQcRCj@n#!?@w-%xkjK(x@uFUwNM^3 z8C%qPWo2<}*RdBpqCZA`4<1aO8E(aIPxqvh$6WEl2Po^&u)FL?g-t?5I`R13>(S?03Xn)|Ll}LvUlp=3lmfA86HHXPGP=}8YoTc3 z%L#qL;G9^w*_M5YwdBX(F1<`>6$nyV@x_P;CN6}P9b$O_I~?{8v-g}v5=QfW=xj!! zQ_C4av$)9Sx?`^uxh`;FnwA!NX;F=3S=iN-xgmRz6cED!@@~s`u7VQO5zzlb1rgRY zbAr9yD1B-P>|kt297dB@kFyYOI_`k{P_Cn&e6KQKX9umuudDT{ z$;=kc#)+)Ss&<4zPFdLC6(z|JeS!Mp1_vm}_O<@o;OJc|TKcr0Ix8B>N2hK@OsggV zf^3W^7;k_C%z%tlkN^iVVD}7#6M$=41WAx25TbMPg#a|pU}K%IQlML;wGggH^2r(ZkD|+WViV~dd<1| zX14avnsBGSR+HtLk;*pHz( zP~3+|mA4vRx_iPH^*Ey1--$0=PX(mzvnGN>xvMsGd$_n9AhnPev)h43VsuN)s#{Cv zP>ykw+em29r=$Mpx}b?`CZ%=mc8RQZ_z;=D2^~bNI4@%SzaVCe8jZ7XGY%ews+@CJ zRZ{7`%Qp1+Z4yG%xcMhjdZrCA!^J^?4p+5jiR19^4baE52AU$yXL5%|3a1@O?j}xl zq)M0nQA^uR-^jW+fh7DeK^vR?T!}dGjCGef3Fo^ z<+s*9IaLSOitnt%Nvt-Mwy@vq@yu(u%rR}h$h}zrSZSFec^Bo1@Ev5C!Ry>+xMgSK!KX-Jq{?bLJh?CblBjMXdVTT3OD}`@E znNvizt{=0;9bQTkRrZQNf?_O|iP-;5p1iF2hQHj;>1VXJmj&nQzQm)ngc7GH8Vc19 zH1L!{>Xew(NIgt7^u=)!h+VH z?R%jVkKd8_A_|@suzW4LnQ?tj-=sT0CTl-t&4Vj4JKQ)g#J zRpUdbNkx)|PL^(j1L)sVw;N-I+y+%|zT!N#6yaruWlGRSN?}O*Eu5WpXj?6zIC4{8 z`@DLog9g#NlTfIKAm+AC{GI&_80uX_i*e*^(wLbK1}U|qL34u|fL&{eE{HZgTUko5 zMkvUnz;t9^9wxsr^ZmOvJ95DbFgl;Kl32H{~HvSn0Uun_wi0P>fb29l+j%$o z%aV6HFC*YteMOICgv$J7wqx6Vl7Rn*hnIY!#Q(xJo;>%-om0$G`kfOpg;P)9z1c%7 zAS<$_SlPOcbZu|Sij-n-%)p2}Ms#6?s>DNI`tGs|%sy3X(!EXVQQ0*%29`+s!|8Z7Z3!U`uoEWA@;Y9*LEcC>!<9SHsDB9R!r8srk2r zrtQdF;At#!&`-NyhuC)R3}AOC!C-5KC7Y?zX$p_F>8%2_*qsxyu5w6t<)T22-KD0HDw~&2__BIU-e`^Djv<3FjagTeqk+Ks2Ku1N8 z1^qz-nqav0ZMo2GRC{Ap(esd&-VhdPbchOn&Go$| z=g=d9fQVl!;wNG2gkO=**Ft@d{eMm2-N5XtjU35P8dX@!cch7tzhS3`l<~}T%*PN81!K}iPaxmagtWY<)oJasYYhU1F@91toJqx)1gdgNvX;#RVMKeb zE)Qmibr;*w?pav|cgg}7Y(lKMB5&;aYNFM`dX{s)2^Mop~U4S^Ts+ zxxtq)Ieoq9BAh_sk98=azH;)D;*S`B9$)44$1LCBw$S_gGnB`Yx5mu zisUkb*_}8xhy@~ zXO$fk&~@2KTOs8I<(Ln@Zr9W!Q%kZhPC<&ww1q>H^w@8-74Z#cg}L(2bHLe>Q2PA2 z8?M)dU}Ot_eZUc|1BQom;E6jo5oiG!S3T|q!Edz_-RhwZp8wqdO80UVlf?#vKx#Qc zYmVk!?%+4CICZ`IYbBHV!kwIia9mZ;qG=^t>eE5up83mcqMrtAa%VanApRY_wqURe zYrd4WHz|1bA00!oPH_pk2J74=t_+K3=zRaBm)G zfLf^vSkuwV@JZ*sFHIE?f@bf>8fnuZ zl*rIq+^Gg9-)~_g``A^2hVKV9xpOGUmPxxiV^g1zJ{r$`5f*-4 zh*jFm9|>ri1Ke<5d3ka2$$tl^Q(TTH^@>B2Xt(vFj`N=@XLbT!Plw>5{sCpyD0%BP zI=+J6X1(BP`Q`4ZnJ8hO-$G6SVUu^pKkE#w!1z(J5m7ZH&D6rgA`Wb0Z~}VLjIFY} zw}cuz$bYfmfyK&iD5bI!7JwOkRU>cTf5&OH#pIiY7AWquAB320xGrXbBO>IalFRts ze4qsR>gJXPH{Qt5=o!6whm_W8Oo5s>n(mp=?1f)o@+EZG5m-HuY$^O+K$rIC+rfr; zKXWT6(QS?cM*pJ*j;oN?i1KLY?o)KUEH{9=YBThKKjw%ztkvhY@iWF(N{$(V^3G`d zARyj@F$Md}iid{ob2jQsZ?@yN8T2SBM;A3v6;;DFPJ8Q9y9T^NBUb{}njq7e3Y8wA z1J15+ik($-xSwrT5e#)dyg#AXA1u~8)-*k!!GCd00ssI@A3Q{UXvK6utE!75;L6wq zbeqTCtvj#_?JnX{F}}Fqv@SOiRn;Qko1OJA?Gj-3iz?shTo=t9Kp>zh z`iJ=DR)mwT0w1Q!)bvfkUe%gnZA{Fsi?~*xcbe&@seK8U-<%wh@B(&Py4Bf6U9tc# z%cCjN)`t=Tq&*AytN#}H_2|vCW;u$r#dxj#YEB8^#D?d!#Pg#;XoN+wnOkEis}r;9 zJ${lfb|wksO3}(S3I`O@P_H9zxYYm5EP;gT{`(POUUO6?9e z$?*uv6?N_YKb7m|Q0=^k$aGM8~EMbEki`M=a@IMNLJR;IBmW8 zViSNTBUs}IOhAnm8m>t5$eqA!}|yw^U^!QOVPiZOqkC24#R zQ6%Wh0ui2+m`k|{$Uj2&Hn+k&l>8vwkJ&ig=I%HYQJnENeTq1TC%&fDd$Apug06fR z|KfT>8-S|u-~v^A%3i-_C^8K0PS6*Xdvn?>a-JwF@s@$`*Ux;@6$gu}^%;7X(Uk9N zV8Wlal+$7gczCA756R%E7qwlj*d0*l zZ@QE<_1Ni?RGI1cc2oxB=VU~9f8RMbOm*@cgfm7W-8E&hLh2Z&+4XdNUBP9TZ(i8? zU4m;)i%(}G_p@i5*^cJyQF;3(XAOTmT66faeDG}9&3YHCWj!Wm{LP-I-$j!?pJ^4n zP>ho!y&m3wh1xT_GfL_#Iq8CCdARTVh<1JJC9-CNP;_FF*X2)BJT$=4-YlVUmSZxZ zVCl@Y8le^s_3=E(xUJMuU%awD07CUa$xlhuEt~z^!uBus>E{wkGBaSBP}ZrWPD8M} z*BPRMg$#s0jp?nRZUqPHXXe<|MO)9?!RuwLo8{4uOI&ag%V}^qYjK>rf6wL4??*&v z_49wPloga{ENF|k#+=*MQ&^1nlmN$Nel}dGb#u!vDmt{u#qPyK^gN7qp-_F!XOvXo;Q3Z#Iwh`^#jwIxG|I6p&x6yLX|+NJ!SIr=-mx+)7ge?{!K!4!z(yn zJMn4^i}#}Z;Z0lAQ%8yQv7;Ob_~kQ0YUKVcD~p1xk7B-GU%MNZ7uv&aH*g>M|67}Q z6SUeWHZP)$UK$A2fcq|xA*HG91R{*E zm3BeerImrF8BZIf`4@Q)|9~`pG1sJj$AK;Kmy0T~q?0l0ABIu)j`PVguOK3AfFW=p zhZouY>Cj9BGu3U-F0W0OB$LIYHr1^*ob+ekk24l~)_b(lrdb=h_iW0?CmJ^Ss14Lo zB}0g7SUo5dc9d|`nic`ysH5}K9&|)0cG`Bt794Q0GKWX@a4Wwq$ZDFuK#3J58#htC#Q`+n6A zGBK|OD|)1aJCVa7YNKkm%NfGc+U6ZX1m!NsuDtHXkyL0!&cAeF2!#^GkbESRdULCM zr;A{e6N~n+; z?#)6Kk)qfqx*wJL6mP*>azqNy}S%=Z0l{=q89 z$qn?7A}zMAlzag?meH zka4eH4k|UlN+&+;qEJ+Ebj(qe@fC9<)n4)36B}%f@76YM#!|BZ0BSAOu^r)lQQhegHC|dL-LkOY#DAm-8#LR!-KQA3F?mVS z`JrsE-PT;UEcIQ%`~6ZTe?lz*j*@dKhygOwGqP*ys|Z9eMt1D+Ur$STzE_HW#bAuB zAae>1>Ji1G6zI`Sl(V}7!2CpL24H4->dr)sK?^bB?O=M(-uzO>I_V1yD7s1}QL1FY zEnXI)E>SK^^#ZfoG4r32rFoNN!S95f;)7CahH|7P=jyxbFRBgTbr_Dxre`9K$-ydc z#7#Sg5srRrN$9E9pByikmF#YPSlaIi3oRR0EgL$X5(O)bG;7j+DCyz0G2zTdKR>!AM1BoF_+qT26Wks;0TJ%fwE%vOB3*<#JVush;L z^mH-H*N<-Fov4q^0lc$liz3E$%gI86&p9Zml`vFXZ#pYr}aJCc}sguG90Z1aJHYG*y~Cm^fQh{X|F%vXH9h@&yez7ifO&iOJ)|D{#i`9FG*B*z}_bJ^p-##VlxP+Kxw+ zIr@7+3ZZol70>HLJ9x=7uU9xinXBv|oX-r*raLOD8Y_k=^_LrK5JAr0uuMKUZtPsH zv)Hrpi9f@=$hy;91Wx3ak6Zdl@cBzYeNedC-w{t1EL4)9LL}66cs^*?61pZoP2cnZ z^uP=wO1=?y6L{@X<9#&I>t@)t24h zjY@P1&jYlnXp^;T$aailY)cs5kHJ@ZF&e+&xkL2|{O!)pw_v5qzUz1PSXO4!<0SNh z|8$ z+>JHyw-2v86`+;P!7u#J$m;C0W-*06c5L)beZ`VsRfs>>2j$8!+|Dt_QWn9L_0^9b z;-s1u^nf38=)Ptc$aN1>c?qjxF*Kc-gOIi@-gLjq$G$U9iW(E*8%r6d=iJ2XWS>b$ zVD%Hdo1YHh&W?~XZeh4C@T&M}Ic@9!*c}|sl;~D&qDU^&a)`tcJkl`XvTNKr%(<7H zWM*a{`nXk6z0v2+(_5NFX-vya*V!1T|6CBIF(#OvCxg}0mPj!4!v>4|@khYaaMcMY zm7VzsxfZ3N|MJ4p#)oq&Iscr%PRrUQc1@qM=(aNAI z4N@tYksNcpggM>liL0A}{L*n#lnXtPWx$JPFapJ=o`OSho*A*kk!XM@u;4v*Kpuey z;V+p)O_JJOxTrG4m3fDk_c{`7oUiVu)knxZPc|)zOYT!(Pr86pnHAtRYN~%0<<7#1 zH#GHH! zA9qYw4OW%-s9a-);9*m6p`deKMMgt%D?;%6-}p_?gu#g%gfvJl|FrTl~7*{~_p0U<;z=vQOZ7aK*CAR$KPn zoImRj$0!5eYJRm)gJJ)@+YH~{9u4q}g5Rw;vf4o^iRN_TB!!-nMfQaMIt%2FAYhsP z`~)4%$muD`B42C~Jl4RUs-{*xEaf-jX08PHY|}GP5)*f8xb3XSHIlqD{UyZ4aK$Xt zEtBymtFmQOEXuq<2T5OL?Cnd^E1RgelrTzrbL5Okyx&=MKPvynag-1?Zj8$|rnF66 z53u?t4B_34x*8vEACId*1JR@{{vn!Y2LqEI;4d_t%P zlyk^dPSHrrOp3w2F>dy(AAVewFZS8Wnma9zaZ!mUX#DdK~L8BlXs8-8Df!NCo zHzO)ca?mRWTG1NJ{=L&)`GlZu7fdBlN&Qwu51-d88NnHC^C1n;UwZ)ep zY3ZuYbs|n1F2l16O)*?2{At=LJ7CEnL!k|WW_kF5Eom&q*%|wU1!b7(OO}~jLqVD) z{2@8Xm?6T7MtEK<>sgy~+Alxk%5txxJ#Y$}HFDXwTjK^9RpJo=_qxMzynu5YB1bN?u^DaS=euRciL2jwY0Ux@!eSm`V;{Mux1O1w`f0}r~^OrWeSK3%n$PLCr(-byD}(UM6-?C(#dmR@W=c&>?p%>BbyyqGs2 zt{pV@KUmRQL0nh$9LP`sq4Ade^*(<Ql#b)w zXYOQv>Ux80=37aW!`wdjVAkOX+=6|N4|_;HaB+!ho<7BEo3|=$3;4QaOObV!D{1q0 zszR)M(WgMSnDDs4i&TZ>5eR!$g?lFi-G)e7M8!ZC2tn`!X31stQR1ogNABHP9XxLn z-F$PR9y>KkGQm@f8YarXvGyzI_gL*ntI8!0jPa{s{B;zCfjsD+X^!RPz|p@hp+ue_ zx-*rO*$1$0Ze2ERkeXZ$ap}ZavD;L{V1YWcXDH3+x zpY)h(eU+@xf|Ov?V_Lwu&l3ho2b-9ZTa@kJGVQU(e627t=K!fCpPk1jvpEhb_H4Z2 zj49?usvCV&nvQo6XA3=VE|y7@*M4O_xNuhko9%@fQ{1;KJJ;o@(jsrBO4m6?OOU_c z`6gQX9QkRRe6FGZKcyL-<~rcg(E2HBf}&F9bkGo%3N{V7;4vi1f2~QUu$YdV?OLk= zutfbbA)#?EC%Y6oKFam;>b74Hm@IcoABRaoorTTZ)6QN+QQ9*o&fO#v zcaY>h@N(Vx7Np0i1&{)jMB-2PY|)J)y3JB@7u(ifRAb0;br92#Vc)D}IE4S|sk2&5 zj~3frDrwlmG4yB+cXgX`3DIaRUSeW;j2a2tgNXzil z=(%o2OWCqV9?^-2bDwTKCD)Lx=2ZLVE7M!r(=2qr8q7bEMMIIdD6LmJIf`542zZMH1 zQ-P*$nCXPS%t>-#1nw)QS6eJxP=vP<>oDiqedU4+=%h}6wyO$~W$OpuB z#>d&d(^5iQXWu4XoCgo=!r*+nGn^_j51-6#(0G~R{g4CJxKj;+b%yKAi;wAZi7u05LEx>n*_@#;iO`$6 zmLCswVe`bte~>XKu;wEyF4LdJfS9?(^&cg!33v16Mm&e=;GSs{{odPHm3nx4v-~CJ z!#=$WLQZY#)Q7!)j3O461bF)mP}fUiFxpUt!PTj2+!?#djc<`oQqm=7uyrYeIM?S4 zMqqMGxO~aK@Q#6toOU*uSNqlFQGC=0s7b2hB7Xqp9=eZ-4FXj*Q>#mzq|_)Vl_EC& zeC~76Kb=V)H!U`KX%I>b1aPl?7E#O56=W^n(Hk}vblO`3g~;)_aWAGGnDyu0#+t7$ zzOVO080#~_$4uqOyrwBj=I_TLk781QI~yvsRE06h^R$3T=_ABnpKx3`#9*y(wn!`< z^%Km=f3sNH{i%#Xq)pd6txatFerpMdBZ33j#YmT5o`ghu`5hgKDYAanCMw%AaQ7&s z@!X3E{IGV!oUm|ik4R#((QC`1Ns?BE_16An32Ime=4l@c8k}dBw$~v_eqKsu_$z01 z00cKxLcBR>LmW3Y{>T`~q-aXnw5bVU!ESMT)iVu~aF5|FDw!^9C%Y4Vm9OqxFh$nl zJ!IC$bWCRbKm1Rqwq&xz1VHvO#XE8%UpYJ2pE@81Ai=a@ACL@%cQfH#*(Q5nQL07Q zTHznhFU>|YAj?DZI0bS-B^KICn)Do*6r1!pd|O4k3_ze~sBQaEv3xi+DH03L`{DgH z^6Ca?J(y_zyuv@^nPjZpB=9MA&U%=?p!kbpr2|{j;F@Y&)K05zWkQfewu<&D;UcDw zQ+0<2maqe|JldK8o#tm=71*nh3sy z%VphJMjwK_;lGO}-}^V{m8#ynFp=nU@KIY<&3YMbvRUs5;;HkkolQO}i8Uy8z-~1w zK{Z)|Z-;EF1vM2V1FJX`f32?|WturT+isOm2pFY4j5~JCj|3I3l!8GtiTve@Tg6xN zSS@XuqZFYQej`T!45hl=-4l%`5?AI}a9!NSsMdpN%nsSa=sg_*3X~YPIOr&ZUdrR< zG@YQc5T!Z4aE056^!9U?rZqL>zjAer>|j8Ehk~Nwox-AaXb6o?>3mfCZk#IE;6!j` zWror#m9|2VV*sjO>wl{r&U#l-Q+?rDLjXK3vo?Ag2l3}JxU2}%iyjztSb6pHxO#Ga z2%GR1vBALo><(15MBo071lYhST6gQO1j!WidG=(=Ud?H-`oIUn=_H=+u-;+wmS_x2 zK>kD-Gh9-XLW3TNR-<~51fao{xP;^w{&)dgRJ3{gEUh(g`}2OS>N?x5q5HdZf^Rz% zA{4J6Qz~inTD3lsk$;Q(KA+(nDR0!Df5Ig4g%kH7{!sA1`h2-4AKm@LAP|-MV=G0& zh^2uz`e1lHqK~7}E%~P@r`=FcE zpN@#pT#MvVm5M%eC(ab4x3oLJI{k37fOKvZ_}@e*Ir2%FMJE%hCeGj}kiaTHiVjr0 zR-zNOocB;Z2;STY@+7gqk@+~IwYsWx`)(ju~Kf!y) zzHmdXK3%!KX#%a`SrY80X~?1c|E{ZKZW1neGV~s^d9S3`t*bUZws%TJ-2a-o{`xq=o=>MDbXog#Zilu|wMmgM>1xmX#uHO?uh9 z+Zte_gJ;5VLh;+=GJ3qAGu7kW-ejM!eMKYvukrMMY*btJL~P84BWlpS!d{?{wUTgl_1C~ zaiMy72v9I5z);oGH*c!lYPGh1%`GFwn%1mF<&)%vM5`dowgLOarZs!0TVua;RnUC*A zup`S87OoyWqfjK_DTnUJHMC!}1s@rX9o#&JShz=Q=CUU;T!Z?z=@N5wc9;&h9ha8g z$ORB|;Sw~R@fqa8Tgq> zt!v+c7u*j}##)-k@!{PI);85dciL~Wy4|E~cu(vN4;sAOg(#BNjfCuB~Ja(fz}C^?q{`>w3QcbxEa8DrM* Cn(^KM From 28a3c551501d4166834a4f729f42b85fddb90425 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:12:19 +0530 Subject: [PATCH 09/61] Delete terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- ...-standalone-es-go-test-terraform.tfstate.gpg | Bin 17601 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate.gpg deleted file mode 100644 index 5be6c905cd3caea7afcfaa80b5de5066c03137ba..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 17601 zcmV(pK=8ke4Fm}T3Y1G_N-;fkga6X%0nODQk!AOX#HMrk>CMvWnM4s4WQpnll!MER z#(ia5s$8#+=w@}A?Iq5$dTuxBW)Osw0$$YmH7s9}W(xSCbAX;?0JdF`$42C%#Rqqz z&p91B#YMCqRvZjc3}PA7jxUgQJ-=RK1*pap73c@+1RTrjKp=gt*#gAzH6zBT{fB^r z5PxF--&(EbO?*wVzRYNKgM^8ZDAeV=N-aG5R}Rp`Z&7g<9*->N20kyrOH&IAr&rOPM5-XSo}I3yiI6srNiOE zw+9U?^ouR&CXT3$nKmiFEXD)QF$8#I(ULqg={cd4{F^rT$C`zuYmCa-hGbbmwPfn( z6uN7q3tj)Yq|OCeLk2TPWWyuC1&=GfHjbx zpM}}m7T`Crd5HqM+~S9t{YZoF^EoWAZ31iTV;6N~4U?rlB1=DH>+DmHHclgnGgt%k zElqtD$Y5ek*DVHAduoRSC^eT1DHsuvi56JacJ}#~GWM8j$%{Qn_jQDD*g;!)_GB?z zFuq8WB_|cT$`fch3t50?7WvM4eXsPTgs*m!<_^#~Iqfn%)?@`C@Y-~~iO(jfdks-$J&|X7S1^+@A1rQZg*yyF-r8GF z7QpFJDMP-ZF={=KH8MV!L{cv{)psM^Hp^I?gR`^XS9_J%w_EE$d=qsBQGzN$4lhZ> zPO`ccNpQ=7DC`>eKiNi!cUWk&RsFUHN4m$CHIDO!6I8CNUbUPHgqUmT=C$#6=IqtQ zkjLCW%-*HYB~7a<@DCOxeOzfBK1uJX2iw~cFM|cQYiMuL>nw1{ZT(D~p~~Mh&mP{{ zTmS6ZB!u+R;R@c<)xjt`brEdLLQHrIZ+@GaldIo$B^D8Y zO9CSxa>@AUZl)Q1Fgl~EbtWoaUXDM63j3@`e-J0h?{p{pLI!&ljMgGPrxpt?E=7Yj zjK`Cg7xj2NGAeS$$No?v8&bUWD1$Xk!^;qtb;3mccrEX>Va&Iy7Y*So4Uf~ z_*0!|U$Q;M>KYLtNo>&D>fgb9*4_K5{FWpT%L znHUM2DJMqss!0Jg1zT4pUBCVc?NJkbf8IpGeZ(|JiB+o<6cU)>`WrYCQy?8QH=1Bl zBTR&~qYh)u=DZ&WgpJ)#R4>Tn`qaU;|CV{&*OX@=HsSJ#XEAromEsFJ=dS8Ust1SH zG*hS725DvyvZXBfLA<0iZ-pxSH}dHWh3~AJM~Byeh01PdBT*wj9c)IfoeU+sl#t96 z0r$dRw?kk~EvCw$!OG_NrikvcN^WBLQYrt`|9w>lOghp*oEmiL>Deu`!0Ooy%`yQ* zF*m05Q4y~sFNzb%1zqfEwiMcv7|p$)BXekjTc#tgPw&<}^(=a;7W$HA&$!Us66F!) zaE#ZIP?K4oPb|%d^ZOUQ>LUCs#G2wKtph;RK=k!%)UL(spYP9g#i?XUh?)6vnAO`m zfc(q==&0OyP@XFW^(NtY+J2G%V19aag`S zC#MU_`Gp|sC>yd?;|Xc_5Ma%ta&h!ur9Hz?Oe8+dAcC+0Y&R2!N<-4yTF+SyQ?(!hDn=Vib0xW!1N$%{ z7x$6ZqMD6jN1R$3_SPXJ_7sc(iXKLn01?jpX|sy}(LvC6GJCefG@1awP`>()5a&-k zyPx_!efcVT4}6S3Fg%ySxT~}+SsA+(5x)qr{!i1)GKu^-d{Q4t4mY4>GC5v%7jaev zBY{ONO6=;N+4C=Q%nGCF##V)TSYi8g7U zdApk|`dyhYOcM!7HUNMt=GK1{-3s=N+}PF<5a>;)|9#rUTbCP0m$?h1%5HM+=>AP|6G3%t3sO z%7VUAV?`}G>XXa83Y%sCKY{Z&s>|ht!bVCPo6Iy}c@XTvIgE3*S|AWrKI{~?rP|9) zw{tZ*&l;OZEsV_zGyu#>aR#Dr@0Vr5E~*6;4N}nHxNfF&7_8IN_u5XFswOBYi>^ca zHTz3)V_|N5fG2V8oj-+w*E zK{>P?&3%+dH16XaEVBN0a@M05|6Hi_<~4|ZsxEQZUj{UKGdi=uBUh&g(d#3mV5!9a zWdR>>6Qf?W{TyB3L&9C0z!gG)iW(tAT}ZUydMVy`Ix&6}wWxkqS18~usZ=5)CTq3` z5lxB+^3BQ-8pBzbei1biBNDlG;#qY{J@RlUEfcL#V|EycR5YH@%x?W+ zBKYH3PFlww_=1Cubskf?WH6v$WkysdlM)Xo(j#6Mg{M`uf`b(yzqYX~0l2L09EtSt zX`=hV3wAd6KySk+gyMvsDxYDlT~&vPsR0s9qNYpqhx!~4_&1ZfUx4Ul4`U93F=#z+ z?IFL->)T#~!!aTHQ*5{~U7ce-_qZHwcR7BFEpK9EjRJJ}Ja?}4!uNt+_?yY+j&$=c1G)xqoSLIq5J8b* z5l^MqQr1b#Ye^qMZ8Qy4#_Suu{=%oZItX~S-NWp+|A6X&un-bZc3|~a z9Ab`B46u*+>~U+$7QaXO{2{6;F96#DKHG;(&w7#_P4gTJWDQH5#Y?zv(Wg4qT(2Tz z(oxZ~8^oGR5&$0ha?Xu-4P$)@;k_VqY0GOKDLYe}TEmXYo#{TMSGU1>B|};tx`Yv0 zmY{z(<)uo=dXw?t{T%IKgGzd7l+~P=M*N_&grl+OaNlu&T>K3NC-{|^bhIn%B6@E3 zZq2#X$jQ8JD;+XdHzozD7*@6|(h?$2k4D#|6V{IV@CX}G-W zan~X>1Lup1lF&WY9X4;^P&&hV^tQu&ld0t%vWyxppXxhm~`PUJSTp z;iKPs<#nl?WJSj6E0@{mnWF7khB*9ZQisMT#CanxIWDx!20Abv?yD7uz_G5<@`QQv z`MGid$nt5cC}{d-D=M;g;H}Ly#xu8B@|&v#oQnCWsfje5^6;V9U>?>P&H#+1ldkQN=)%_3HJrKPc7l=8s+PP3n4u5@j-ZienyU2N(^3 z)|ITkqj8yn2RVU(Ru^fFLu$oIpbbIog0X(UNOq%tXpnQA3XzF}EdPJ7;i1eKX`{Qi zUB-e(|9y|v(B~v`DgLbrHF^*Voc>-+g4`6;t7w5hV77i8A8{Q(0Cs=f26mZf@mEJ! zB?2ehWBlSgB_sgpCU#{+eYApdI)oVs8fYdD)*3C%&w~!aNRh0yz zJamtTkpP{VmS1;!qfYghXQ4orfqO?|n1@)TV!JyUp4__w)C+roUmJxnskOmQFoTag zh3|9b(e8cz+|ZX3d#}AX!&b4*8i9%{sYNQGKg0)c z<|&~5n)d@2nYwr}ZOe_NAJzzYIZ^~qzXcW^-}tJJ`no^vRgEodHB>4vK+QWoRcAn3 z{X<}=D%H7I7$$x)fs})^BZ~EC@0^Gpg}%Fs8yWGC~ z?R0f0cd-ZszhGnS5m)RpMMKEQTQR4|m*mbFAN;Hp(&FB_G2K`(9G~t5^SRv?0(AFT z|6fq`a^M+~rZ4SO!NXU{c=#Adp@1i2(?pPj-Kznb8rnkq^nI8EgMl{}8VW~iTkL{{ zZ5byBFsB4Ld*7#%-A5Osc=&g%$QYG_cX2VDqJCx8v*duU#A=QV@oQAg=K0U7S)bQ= z4WYz~JbYcWmLfHs22R;e#27@>w7%^^*)L;ZsBO1cc|_C-7~Go1TY$N^us8zg%uobdK#udmoxv3PWZotCu3QUlz}_hKi1 zqG2E#4(Y*~_V~I!=*Gh-^TF72`<+f`j}tk=MhQt5r}cswKQQwoe- zAd#{T0edcdU({jSYm+(;_nsfC09+1Hs&^)>BUQIq`&b{tc`?edc8^>bPN0t?n4&*YiNVFD!i zhYb9(Y@yurfv#Qdqxf(zWxqzByZ}9Rm&}6Vc{vz)!3CK- z+-M#En+ie0(aPn`7zWA}WGL;^#(Q|mkw=ICE_#kVJ7GVJ!5<06>ZyEIVJVIN+o`<1 z>66L4F9Hyitj?{?lNbiN!5hQIk8Q@PKp{hRNlxAt(tm^^!U#`ZVP+oSqfI^2ElikXxT_OaLe<)#ShKwWLX>@oOEz1gk&Gb8=A z3tyO7=4-Mr%CjHlZic}+bN?^~A0{a%{Y;`t@Cm|sBLL@iH_E<0#DSi`_B^P>>FExK zymN{4-7!!x7GVfUxB8LD;I#d}s6>|MQpi&Fqo#;y*iS6+SZ&F*i%qZoB!i$po760{>8H5>&cGAX4Ax-%Nq~%Q7 zRp^uz#L;>DAkz(8*bDF2M6=U6BDbZ&JemBm2z5}d#Mz7jn@7b#Q`sr; z-m$f`1Ok3q-u@YztU3RXbG7B$3KGMRUrE9Tj#xIWHNE3c3IQugaX$gu>g3Cd_vm5{ z5_-hhcq)$|!-UvH=im8SC=BJt-G@HCdCq~MNIVC|E6|dSn<}F)Cxw(e?!5wOCtqH( z0o6}dGp{m_#xqzTfb6d4FSz5LiD-&WiA#eTa3K}td%ZjCyOQOUtz!MNkmMaqSW@4G zevusDP9S52j-O>2)Y_EWM8S)p@NNvVf19tvj2(FnOlzucY)&YwUMyr7S*HcrvMiOAsR=0a>xOy*)!d?t@*bDi1 zLn~>_Vfsvxz9}Q_tyC($&r#|als|>xf0(!)Pt_%3l+ zL{Ny9W1t57E2FDFq8Hlmnbuo|*^UPzQVOBr58;1k-oqW2!t4E<`vl6<9L&?EA5@Aa zQS2z%t$YdRL~A|Ic!$Iy?}^1$`-f5^_~cI!`|YK`ZDW?hh)^oF!|<#-*65Q z!g!!fK-I(L$-gLQj|hkR^t+>Z{n%5kQ6e2`xA`Sn$1@>!9Ku}0ih1;E>eyeZ2KkR- zBIkYaTnOOlBdTQllm2^)3}`(CdX86ok?RtVfj2~CWB}~_;bv~G$bxuIO4jwLj?};O zX^avz{h;XDz75hgfr#CTN&gp!W1O-HKJfo}T~1{DRZE%%tsWcv>wPBtJ#V(jCcoP} zt^#3Y#{21(xQ}p$T%`K~i-1E;kI)C8B$vh6iRwIDEzQ8O+>mhGyvmcM7KIIq&eLTn zEu2vBhUntEVL+&}Q~ZOjy6^xoKF$~UXlZ%Bhp<|vQ>d}!h;xM6CzY%w?e?f^Lf=Q3 zJ;1z^yIn{XJ>fPlYZj(c@TVF2VShE_FIiq>i(mwt_M!(HsI83r8UYN2aquBl2B(5x z;`bD^o-6fRFHiXJrol9Ke}+#oopseHkkr;y%U{=%j>Ay99S1T9Iiq|ZqXE11{Gr|0 zQ0+-w^{4Pc!u(WuFSg*5H!ggKtj>|k(2&{+GlWbT`7wmK~psN>?~we8>pL*&tz-fVIX#L>vmg!YSXP-o4^ zGR7)EdNjCbyGC{d`@Os(K$H<_fPo;8MBVUPNw@c(jkbWCc^XH&vy=Ai28%_T!f8CYnnbq>5xczcA|e9`2jtMYkX7=r@z zE|=_^JC(Ta>Wd32Fl2_OgJ@%}y*4ESaPgCakyGF2NmL|O*PP(@Sa`_soN-;w#A}4h z6j%#45?5C%fyL!evc$pygPBJ%TF8W|(UtX-wPZC77cF^vKhy0JV)(Id%LynX4hk+4 z?-fwpZ^g%*<;aifHIYJ-NyvG~MY(YGLBcrH-jGu=N)pmtZs;2;h!FX-B>}y|JL2&$ zj~l0Pj2q}cJ=O}*?I#1WU)*Z?er7a52eg(%;|!23#xf5!qT-)m%;e!+!C2a4CzTf` z9e9HWbD&7uhv)Tng@YY94lB@8OXovt*KhcpM$-1m)%`9oh_MK?Je3JTSWH!mPMx|_ zy;(g1p;*3L5$54tkdzi(aM4ep)_@?B$ZUNML&>YJ#J(0!q|;gKQz)_Wpp7(Mg{KWQ zpOmK$X%~0C1J-mQSMSo@2C(dUI;h)cm_k7_5>)1@BIf4yi1@XaXCxlQN0J#xN~c?X zM2%=*uWh=!Fwj^3Di7NmVS$L~aH`{sFTODEVpdZ49NksEd#JRZ*{h!$nspFag+Ja2 z!8La7e5}ih#tfaE{TuzXd({{o%pb0A$0fPQUm^ij(@Vo<=PPi{$zF34{?wIbmAKf& z4qDz+I=dO3^Qd?FCb5L7A@OE{X{`8IIkV!6DK?|^e?nRF={+n=&AVc<%Qy#=1+IwW z*kfyoo^_d_dJim7RkxwrG`kbeF)>e?TEqr6=+36o% zKJ0Smpa%#N!1AT&d*06f0r-~5Wn1g`5dxzei7l5>lz`QUr?=w$cjTYn_LRoh;b5_C z9Jd1awoxmgM$-+JHHAE@Sr0f+_kN3N2?pYg-M#Ep?*xwx1xX*80Xn>Y6OJ43ov^j2 zGaGpcbtyVJFxh#Uq+$FwF&BYxc$j=jJD0=^1d>$$S_R}1B_zDZx>teBVRY0_sd zo2`uPlWUI~-*%+M`&qtlMm9Jd^J-J4BWn_8`*KY6mgQtf(l@2{3*z*lC@3jY;5j4> zp(_`Bo>rO6FI0QQ>{lb%5GKEQm3&BkkTWpe9_w{KGuvv315o*mOta>6ne6EN-i2`BsLbXIM3>{%i5y)rKRx<46QzH1 zT8H}?o*S9&Kq85o6}{Mdr6ViG+oF7Y252MKp~jk^T2ht))Qq6wY@2miZf=V0+hPw$ z#6u4K91d(!s*5BIQ#a=R8*CxQ)Vb}M`h9Zdl4!2-U0K6YqMnDMCV6OjWcb-S5{i{G zm3dCZ^UfpS16^V~utOuCQf7?INn()oxQY#0Sy2?h_lgM+yftb&GA*8?b2e}`Cw}8U zhg(!v2IUsRvffOE7bq9)gjw=FWj9CYK%CCnFAr0S?>BM`@F~! z1Cm#BK*sJ*)Pw&Dkao$xbQ9Xe*CTYH(r->4lB3PE(`<7{abFuJt^ZVu{sNiYu*oPB z`zWy^$9;l77-DU~z{OA|kEe=jXViWRV_N1&?akpCOG`X4uzepH4ylXN<>6s6&QGy; zr#4c0wv#=ob~#C-n7Y~4(>!h)U#_e$zeE}=x5W9W!A~x$1SWU#>KpLf%e=!g6KS)u z?G07xUentM3()tn%#p1OfBKO_3*DicW2wso=Vpb0N6J;0?v9-&yQFd=AgQFbfgDUB zgo2wnczpIQy#{qYQXWkKuLO%~adzyz<`~qvuXf*?#U!8Cd*PK`I}3$XVH|qa8^WACw!;;b-hAQO-^#I zQCLg_q;KD2x;qF-t+dbt9&F)7@^|B0?Sd2(E~o>`L{TlIF`5$t!NXOx?>bQ}GDCG&B`itTqB&x%+}x=;XCiRX&p~Y+7~%|j&An|if{oUasv5IA)`+z( z{}MTJ7=O<|{d++94M}Mv6plR(L})vv43G12L*lWpxO%MNezZY06AB$n<{bR}a$pMV z+PNrBmbp^Vd?N#raRcnl8q|(KDEY_>DJt2b2u$hzUaRq%LT-~`#mtZ_WP~$d%?bk& zg;N?zx{NBj<0(AD^ag+CRkOyiuVyT$rjJ0!#izDpc}EYU+3RfXG5qe!KgXEm4u5+A zd9)V8$9K&3e#RnVnqPE6h0HVJ(+~4h$dqdg?B=>@wa~j1RW~%@Ecuy79^O% zyydksOEBFJR%@zpJL)_@B(xZ1)$OF&D|!g4n?^g00-ftzJ!-K*1RhRa9ExkS zB6t&|6U|<~9nptO;fkHd8kp;j_`Ql8=+D3bao-*oI&?7?8DOPH+f!515%a;%l?GLC z?xam;nLqLM?nlrtrl2-xsDxMz$oUDNrTZc^vsh8)ERIDSaF7$9JC&EEe^QzTL*U90 ze!u?pT)T@vRAR7Y1$JC)c$bvp(`|F6sV+|dur(8_nAS;fhXNk^lVjNzZHt{@RrwtL zvqxjT$?LJ#R+xUGlL69HD7*>&(4EFYev?hYVFXxja#5LCPa+NeT@D>cAc8-WVNKA1 zf_uJEr?fdTZa@Zjs-GaYwRbP8d)mowaK%~BroUZ%C%2rxgd@%Zzi%d1YD{> zxARp8Q0hXI()~K9;p|tec@9Y;9O}pRd-9XAxAv_Xm+pst1&pBt=(a)P+u_5c6U+v< zkF&}Bg~Q(A1V}H`i4+I!bDWajN((WOOyq+v?&g;7@v834mR*23>M_#erf^?YfiXjI zZp-x1IBMI`8Ht}hWfgBFI7biMJ?FM_{`8X-wzdpsQyc#oZ0oAnkOM{|L5$Tu`FV+N z>002+{vaqzESmS0sgzVLevOD2uGLs$^c;N`!;=_fq7JU>=X=FElZa}yaeHbQ;nSuC z(6fqW*jyh!)nF~Mg(!9u;jkldSKsDdsnwOz#nvL@1iKfiLdF40v5wEC)+o8|w3WGz zhW|IJM*Pp7Xv6jCiPp}GNwG6}bwj@Ot)Y#9CS&c=Z#TS7+{B|GdGkN9K*eDY=p}R~)Jd9c5>Iy!6p{o+4Ce6RA{7 zS_EyTjnNq?HJxXafS0d!EedmuA{Ww4v!9(PYj0CeM=}4K_mC^YeS7sKK%Bo2%|T$? zi&8(NS+nw!b+!_o3Y)Rn>Jb>>CW?>#OBAzJ;^<`b|B3?FFHnanch@TC?xVk4czntT z&PibR?Bc3fJg!G+uQ}`Qdl1!Ir;j-hFUR3xThe6QVYTZVsLDBHZn`pOUpT^p!F~-Q z&j8Nr{7kh7_qO34BOKE8Es%@7J@k=7p?_(BK%8okNmPe6=ArcB2aIn-lam$oDNBI^ zrwO5ybrfe4Xq%#Ae-q_QrZ&_R*_{I1v35gOWSXd*Fdgs!DkgOW-P|gWrzXEtxl?ql zxJsV^f|U04n++JC?!5n7nE8ddZ(b3dRBs-#k%g*i;N?*d+^0zQe5#FGG|J~bVIw_B zvdzy2>Bt=d!~QwPLJ&~7kqPObp4%$$DBMtaP)zgd$-YXlH6GPqOro6lEfJe-pG1XexQql+fy>MoXRF*ow1*V%-5qwOdtf|4mU#=vbihTAG`~^1OnApogHW$2UJg zt#i0)Tr6oYr1~G31jd>R>JA@?0hf)7(POx9UZL9H(PZHgC%b_a!$=B1^tB5*Al?T} z|7=mI)!2F(=->+EaA_dF0V)A(mDPI3L|e0Ph0K#T`n)0qxwTxmN*cCI)5J!(+_BqS zNO%;mn9{8oA~6wXk9*F4S#_9xC*X1uh*{MhhVcP|vCU_%p=6Dm3K?#i#{`}5Zd-c4xg>_bH)G!i6{@Uy|$O5@ayZ;?)Xp2P^Pn0uR~ccg(#>ycM7QUm)PDQvMQ+q zzt}_GTup9$^O{zopSy_Jaal zoJPhq0mdpjiD))iTRKR+G|So@qScF`?HDkRo6C+*<1P?ExQ4BQCidY~hS`nt3`YfK*0_1@}YIGY| zn`2#!s{p_Gui5-U*|b0tm8smpxC^b%hl0`BkjWF+(mg}nz?@>Djx;~%XWxNBLGlgKX;A{;>M?6@+vt#1dGlYXNz3}F(}ET7V-`Vg zP}R;)#Al~y#{Q{XU=(*i-tomRu|n-cJBU8?uyQEEz1VtbI8g0Ubayi=H`%)*{E7kY zCBAu_*~e~e5jWuNp?^6 z<9x7p*Ai3290B7&09V%}7(Jn)iD(50OUjIf;kJLr#%y_iHdHj&(_kBBDzNK#CafajtzdS z-H;1x=GX-wqLW#(w$sCiVBx5Yr`THhmz%io^&e;tErHEas0o^S^F})S3nBJv2iQKi zi|8bLon3+5l{kYRP=*<_ zBcOwvnlV9+dj|{!o-wQOU0N3J8F4~XX)4I1zpD z3qxPph^9&?YxsXheAfvq{gIG0*`jv>6Lv90TJkdXN9h5e)pe+JbZ#j+QBsqjX97%* z5lBjWRA{Q3iXb=~siJB@D9(f+d@umzt=z7{;k#s+xU9`C3>8V^g3`6)#{2k~D#rkY zJ*U;QmuxuBj;6SVpBh7gW!2|D*1?jz`+GvZA0!SrU`|GNz73sM6)F<2`%+0bR9&gY z0(SE#m&6d4O`g_qd|cwCj?zh-$iZZjt>T1Jf$FPM2bT zu_O_D(5E-B8eeDr+J}eE%5iwjLDq$|EJfHaB+EHJ`0;NCQPvRTR!Z7@`a)l84Gy?~ z=QD`(^0?R2()$E`E!qGczoR+(5a*LC?AHn1fKZh{L&0VH=6-v-KgufZ0qqaF?;g-s zm*YT47IKem9KwF zXhVoOTFY%)*bVHX16ql;g=c4C{hd9bk?00mx6H^!4NQKqfHtScsQ6~$!{n&3Q-Z^H zcplNT&jgcii0M*Wi^`_2_`q+QBYy+ha!WswG6q5dY^$zJ$MFEr_cDngYE%dZUEVv> zMzo$|$x6-bKN+52DNC<2&IwU*MVWsSrLgTRd1kdZfF0OTtykjo<8u2hwI@~m`LJ|K zf25bu7U5@H7nZ23TV>h-lF9uf6#I{yD@RY9O7Y6c?(tY25In3>om8!0H^k}~36@+@D9{N26T(K_a zY=rF@L_I8*pxPS3d$bY2Wo!dH4R^*Ge}`0lr|~LfeVG z+~P5qZF_FO{Dk7uA(`p~*YowqQZ1E-sRtGT3+^US&rY5Cw(X?!Wo--fPtD@^h{Qqz z3^zw}#RwsqIa9e;hoLa@L+m%&Ml6+@v2et~OVU`tPl^~J%gg6mhDnCw_4z7{Q@lC9 zTU4R2P6ojQlWX9I1HO%d;+B!=@pratYB3N~b z%ou_80z~>7uD%{D2t||FRfLCS{gZwArIi>_DaVX;clS0K)+1ol`RD+RSg0(B4F4Ev4)Qdm{? zqNoA2h6ZKTl!$=|Appb_xRVndTGjhD&9%wu2~3)qe%RS$NfucRA2Kb!wb5%Q%$Fn7 z5%~AMr4fY6bk$AeD_-VoZM-r>m5o$W0THq(J_TD{e)WM@G`2!P=9I798VK3A%}sV4 zT%0(tjKkx!Nw6{gi-oEEPqS#@~sVrABRKG5H6o_W)3(*lA_ap>U;psR^PrX{%Ds{@2AoaM+rDT%YO z-RdCxK6OOTB4yYxNGU$x3ummEsN$mJ9Q=Ty>g57yOCY;=? zFuDrRVTL(`ZJ=L?UR9!zo=g>q5lkhS)D0Elr*qP?wiM1PE|%sD_U7wYSFW7cZ>vmV zem|pqU*vH09W^uuPRMFd@f^W4jbG;;^NbvA3UzgD4r&&5zVVrgKIwY$gU<97@9!WV zQhe2YGepU476eV%^3WQ8s`XHqp`$=-G`~pe)c3{WFQ=wctKZDTW-C?1 z$p^B`%gGWhMAc#=W{0^9aP8ok2#@8ISXxjLAN^`rdYZ-9hJ%tNNUX+_um|(+l`q2g z{t0h`rDND)t0H4_7~0x6e7e=3K+YG-*9_EYTe}?ixsf4<`6S0%&O;nz!uIW!i}ILS2b?=* z4=W!NR5r}i*1GG-K8cPmD)bsQo}N+`H8U|X=K=#V$aUlJrRBBt8G|!=l0|KKXAmLm z`sv|Aoiv36;&+d44~Ku}EQW|M16KGCi>IEecHsOt$L=FUOG@*zEE~IXU6QOUqGEe?sJB_MzLG-&9Y zF9iZx@MKUC@B{VzGbS!wB9G;!_`r23>vFh@M);p@3ekN=pMv2hF%FvvrNuyNEP!2Te{c zL(aAr40czp#RA84tkDH3mZnz1T;x3_?fqcZct^(O%fIzLvOp0Vw7M_-TCXY|>`*!# z_g|!uHkpeGQZN0vU=AJDvY3*2T5ixF2SSK;-SD<#)d`AQV& z0;H} LoVHpZ=W_sbB_C1GlME5&HI1J%l;zwermqwl0Bxo_Khl}p+blBwn_GWBGZ zYC1UWs`=wiVL!;Tr`k>};c3RezP)C8jgfJ@-iecG0|=0+8J9`Q5T`v0hDs$1CtJcm zw%D>Ae8y-AS0X8yyYBf^MiMqs_h@4Jnx+olF)iNhnUV}VM&pe8mJ4X(+xdnsv0Gdd z1(Hl(VW|<1JV6h~53kB+ccS4sYC?Ixe7 z3BIM2i$RW9aL>kWHI+GH#V>VNLu7YCtcl~KvJ%ob3l(Yzuh3?wcCDeo6{fZA4w4Q^ zXAH5Qkd`%CfBDHzdk_M7_K;WpyI3|fhlDt4yfNd8kwnFQK;B2*Y}(5hY~R-y*<4QX z7$PMT;(!EY5tsRy=hu5tY>coEYDP?bk&4ksimWx2~}oe zF{E8{avC+p?I;{)$)#>+csN1~DI&H_6p7u)pt6O_?PHh89QU5P?Sxw8BClgyi{lSB z;M>{Io?T&wTI1}KcbQ0a6{T$>4}qB&|0EIzLC=hoTFU{_hDP8nERi|z_R;R?At&h- zT`)7mXOgSt}g*`)1h2j&B!Tj>SS2Pf|7$Uo_YaZ*AG1)ud8 z)@6DbFuW2@)(&(jrQ<|#9-bgjesJ<7^Km*BOGWa4&wQqStB$U{Kh>7w2ArYPGOmz( ziwkO)K-c*ir&&o=U{Fc%?5@V22wDKcsG>-{5uH5M3(L5u;9Q(t>{c+XHtFRmSbMAk zw?*5WnCD{t003`eTw0ulkoQPHu~!ivZjF`JOcoq!k6vjHoB=USDjs}aobV7ft^o_1ZH=($dreI z+SF!!OiH`;uS?X?pinDCBanEM7ZgNyS`l%z1mYtNyGUA48-1_ZADcjepn6*Um5U=_XQ^L=)SxPBgcX3 z|Fw#vXwC9uN)mL0Cnuf<$pA}P-P80DT1vwfwfFa(iQZ=os{bwK@~Xoux>1>2!;zC2 z<~ zZhM-cJM*FD_m|p5JhqZ(?>hwMBt}N$n$}+=w;w{MuqAaVOEvO)YnVQ0GaE$8B8P@s7(t5AoLQ z_$>KO+{pD^My-*|^cT9u>j68o-w zG{y3s0$dZH{)=(zNoz=-w_*LcwhQvnHhP234TW3faSqX7pT-jp3T~KKW;=>2Arka% zrQqnoE;~}*^_;S?cZ#4*IBo}jdrM1ubtYIy`S+DvuLc4)&3VQw*j@75IBo|N>SP;G zvF9dn$G3zY!kf}%`;(^3mTyrPNuj{kf6i9^4^ixr(;}}k0hwqPe}1`Q8%-mC-~j`YE`W8HO* zKDt?x-C%GhK>lU#UQ^+Sk|Sg1CSaZV^arRzUCrsjP1E z-m>R?_8S{S!+aVmL(MG77a!bN31$&tbnF6wds0kPS?SLVc0F@BF8eDXVMLarFUA+* zi(~5E1tb?uGld;b$b>PdRXuViVcHqcuEn^1kDlG5B-6U#cFzrP^b|#RPBYPWfpiQ) zw)DWcB+s{q;WL{Q&@u|M^qq5dQ)Dv(g6tklR@KrC`!h)C0RUMARTm4Kj?BwoD8Xb* zDJO{!3Fy~&I*Dqz5#TZst-Y_yRFh`P|L8|8Gz;U%`cwz+GoXAvb+o3l$Syk=`@$#@ zR`NN*QLzCa0vyfP?K*luM30w6;;_WW-otFv(5Ur7m6V(WOv{$?jbHbDW-;}FTwzI4mgk)o(Dd95IL zeu&PgA3U>{By&qCG0H!6=@F?O_722Vf`gm$p3tg1JTUh7mS@!#04qO=`Y6W%ka~2S zr#PH>ht`BRrdg7FN%I{>TnO_RJa?UuYM184SRlA1@TkZxW9{jas`_UuRx=|EyU9CBR zbeOhf1|VdTG^tCFOf~WL1>FB( zh?zi){jf2LXR?J(L(Em0v~nl}mW`#AB;Iv0zZ`EvZt-U34j9f^Gj!rWGV`9+{v(@$ zRX@s`GF`hFKLB(IEdQA7&?W(`uD)w)=Q<&S zJms&)$do6{9qfa^#Z9aHpa(B5k)=#^ty|tTEsR!O88dywEwB?ZXd*Xh2pAliieoIY zGY3-QtoFWbPkOaI za&-Cy?1=l{e&?a#ybv(D+SF+3gF!L(q4~a#ma$OP7OH{*lZ`)1#a%7tJCs`DSHmt~MKXHJacR(qY zuxN2iImuU4F8241d=^U`YiHaLF$0feVNf!Kr{4C;e}@j7!$?io4nYtJLsNKM{7LEm z6-jzp7iuRmP0e}tY$|KHLaeD=LuJiu`YOi0U@aPtp!G{@bHaL$o~#(SU8M zIa%W$eY`6qewA`WG=%mEL0;E7``w5(#ddsuIQ2k71=VpCX!Dq94^>VW;z9-bf!wkD zEa7X&60I9eoc}wJ594i%*jE=Gi`R!REKu=HLIR5n%(UgXc>Q&}S!bMuZq43LZy5Ei zsMVxNW%;?Pj({qks%83V+=xWVflTgSlQVnz|2PF26}bp)4L~$KNQPv{Xvm^V*T&`d zBehin&=YBoPwxqG=Cg#=mI2;k$f`$K5vo|$Nb+qn4b(XL-{3tfd^#!<*k3(#DhQd- z3mcnsv*&ho$ftd8&#N9Xz~KUPrXFy2<1b;bKZ3#LZ=Om=wYFfND(5IkGC{L9)EQ;OG%YpP(iSR z15{~W-YL1A!|5CjM#eVSRJuE*RDRu>K}zuH zMB{>q%|zpo&o&T+S>|Yd9r@w|woxgV;R9(J*!cHpcXc>Sg^Z&XPt3?06ioai!KuZ` zZ9GL-2h4PGt!35AM9$5>YosSO7`aY0?*N!R>v2j>`wG^(L} zH1(|Ys&O}u58P?dhcO;8bhQkn&o5})^V5QZho?qf;{D_&qQwPVtxfS##uqeS(-Phfrke%0N!TgY@`-X@d2 zk4~U`Q*CQZB)6_TD8B5Up$l`%TbM};_TH{rYlVASV2Y9AvPTX54MwD#=cM)tN5`5S zmcf7fczSydI~=C63n+BY|AE1ObF+6~vZpbLV8b&`{imjX96dL^i{ML)`Px3IDO*dLvH(>Z1D` z)6*J|aJ&Ng{`35?ds6E3gnyMCFNzZ%P}BEdCL}2u4q*aTQIfR9@un1Z?ib0L_KLFc oUFSd2BL=wZTQS@Zi8LJrJVvNeM`a(3L|jF0THz)~toWjSD#9F2yZ`_I From 823c58235ff2d86760e6a68355466684b365600c Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:14:08 +0530 Subject: [PATCH 10/61] Updated aws.tfvars Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- .../aws/infra/profiles/esignet-standalone/aws.tfvars | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars index f38f04b72..85198c9a4 100644 --- a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars +++ b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars @@ -7,16 +7,16 @@ # ============================================================ # Environment name (infra component) -cluster_name = "esqa" +cluster_name = "" # eSignet's domain (ex: esignet.xyz.net) -cluster_env_domain = "esqa.mosip.net" +cluster_env_domain = "" # Email-ID will be used by certbot to notify SSL certificate expiry via email -mosip_email_id = "thisisbn46@gmail.com" +mosip_email_id = "6@gmail.com" # SSH login key name for AWS node instances (ex: my-ssh-key) -ssh_key_name = "mosip-aws" +ssh_key_name = "" # The AWS region for resource creation aws_provider_region = "ap-south-1" @@ -74,7 +74,7 @@ WIREGUARD_CIDR = "172.0.0.0/8" # Use your actual WireGuard VPN CIDR # Rancher Import Configuration enable_rancher_import = true -rancher_import_url = "\"kubectl apply -f https://rancher.mosip.net/v3/import/rmqc6znrt9q9wd8j7zdtkslk4fcrxlxh72wpk9jl5z2vpgkkm7tlkj_c-m-rrm8fbn6.yaml\"" +rancher_import_url = "\"\"" # DNS Records to map — only eSignet-relevant subdomains # Includes hosts for both the esignet-standalone profile and the isolated @@ -94,7 +94,7 @@ postgresql_port = "5433" # MOSIP Infrastructure Repository Configuration mosip_infra_repo_url = "https://github.com/mosip/infra.git" -mosip_infra_branch = "es-go-test" +mosip_infra_branch = "develop" # VPC Configuration - Existing VPC to use (discovered by Name tag) vpc_name = "default" From 3557ac5a8ed6d28394d03373a4c7b842ee980f6d Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:16:16 +0530 Subject: [PATCH 11/61] Delete terraform/modules/aws/rke2-cluster/ansible/inventory.yml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- .../aws/rke2-cluster/ansible/inventory.yml | 46 ------------------- 1 file changed, 46 deletions(-) delete mode 100755 terraform/modules/aws/rke2-cluster/ansible/inventory.yml diff --git a/terraform/modules/aws/rke2-cluster/ansible/inventory.yml b/terraform/modules/aws/rke2-cluster/ansible/inventory.yml deleted file mode 100755 index a1bbce466..000000000 --- a/terraform/modules/aws/rke2-cluster/ansible/inventory.yml +++ /dev/null @@ -1,46 +0,0 @@ ---- -all: - vars: - cluster_name: "esqa" - cluster_env_domain: "mosip.local" - k8s_infra_repo_url: "https://github.com/mosip/k8s-infra.git" - k8s_infra_branch: "release-1.2.1.x" - install_rke2_version: "v1.28.9+rke2r1" - enable_rancher_import: true - rancher_import_url: "kubectl apply -f https://rancher.mosip.net/v3/import/rmqc6znrt9q9wd8j7zdtkslk4fcrxlxh72wpk9jl5z2vpgkkm7tlkj_c-m-rrm8fbn6.yaml" - ansible_user: ubuntu - ansible_ssh_private_key_file: ./ssh_key - ansible_ssh_common_args: '-o StrictHostKeyChecking=no' - - children: - control_plane: - hosts: - esqa-CONTROL-PLANE-NODE-1: - ansible_host: 172.31.64.165 - node_role: control_plane - is_primary: true - node_index: 0 - - etcd: - hosts: - esqa-ETCD-NODE-1: - ansible_host: 172.31.73.182 - node_role: etcd - - workers: - hosts: - esqa-WORKER-NODE-1: - ansible_host: 172.31.75.46 - node_role: worker - esqa-WORKER-NODE-2: - ansible_host: 172.31.72.215 - node_role: worker - esqa-WORKER-NODE-3: - ansible_host: 172.31.77.135 - node_role: worker - - rke2_cluster: - children: - control_plane: - etcd: - workers: From 5513ffda0a8b05b4d69749c20330d866b5179e2f Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:16:24 +0530 Subject: [PATCH 12/61] Delete terraform/modules/aws/rke2-cluster/ansible/esqa-CONTROL-PLANE-NODE-1.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- .../ansible/esqa-CONTROL-PLANE-NODE-1.yaml | 19 ------------------- 1 file changed, 19 deletions(-) delete mode 100644 terraform/modules/aws/rke2-cluster/ansible/esqa-CONTROL-PLANE-NODE-1.yaml diff --git a/terraform/modules/aws/rke2-cluster/ansible/esqa-CONTROL-PLANE-NODE-1.yaml b/terraform/modules/aws/rke2-cluster/ansible/esqa-CONTROL-PLANE-NODE-1.yaml deleted file mode 100644 index 720fc904a..000000000 --- a/terraform/modules/aws/rke2-cluster/ansible/esqa-CONTROL-PLANE-NODE-1.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v1 -clusters: -- cluster: - certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlakNDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TnpnMU1EUTNOREF6TUI0WERUSTJNRGN5TmpBMk16QXdNMW9YRFRNMk1EY3lNekEyTXpBdwpNMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRjNE5UQTBOelF3TXpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJCa2t5RGpiUnlzZkxOZHlKSTUvTndEMUJqcDdyZUZZQ3RiRjlzQ0gKNHJob1VhQ2NWbXlEaldQOFM4SmhBcVN0T1VUMXdQTU80Ny9qVjJuV08yUERlNWFqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUVZUYlRFc3pDNSs2L2ZPV1o0CnVpMHJqS3BoUmpBS0JnZ3Foa2pPUFFRREFnTkpBREJHQWlFQWp1dndybjBGQlRIMWtueUFlWnM1eVFlbUF0U2UKMVhWWERacUxlT1ZiazZNQ0lRRGZHTHgwYk1DZ3RwRnE0a01JYU5DU05lY0VaU01PbTI1L1doN2ZyUzkva2c9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - server: https://172.31.64.165:6443 - name: esqa -contexts: -- context: - cluster: esqa - user: esqa - name: esqa -current-context: esqa -kind: Config -preferences: {} -users: -- name: esqa - user: - client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrekNDQVRpZ0F3SUJBZ0lJUXBQYXZONnJ2Rmd3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVGM0TlRBME56UXdNekFlRncweU5qQTNNall3TmpNd01ETmFGdzB5TnpBMwpNall3TmpNd01ETmFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBVDQzenJpZUFJL2k2V3oKcVJBVGtON2dtTWZTLy9IZE5SM21HQnljSFJIQWROSVI4anNRQ0NWak12Um9ickN4T1RsbHpsbWFiV0JvaEhHRgpla2ExSFNpbm8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVESzM2R0pMYVo1WnFzeURRUDkyb0JGK29YUjB3Q2dZSUtvWkl6ajBFQXdJRFNRQXcKUmdJaEFLbjBtaXFvMFhvNzk4bDVSc09OUzV5WFBKK0NEYmUyZFFMWUlhVlRISGYwQWlFQThBQXk4bitHdCt0dApRVlhHeDNnVWdTaVFhLzVHN0tSZ3J5d1RHbFFnQW5vPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZVRDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE56ZzFNRFEzTkRBek1CNFhEVEkyTURjeU5qQTJNekF3TTFvWERUTTJNRGN5TXpBMk16QXcKTTFvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UYzROVEEwTnpRd016QlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCRHE1VTJBVjYrNHdOc3pzUk1DQ05sdWF2NmFiNlcyaWU0RTIrNWh6CkNSc1NWTTliOEVmNzd6VEMvU0RvOXFwQ3VwVGVOU1VUMU1UdlVycVdwbHZWMEIralFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlFNcmZvWWt0cG5sbXF6SU5BLwozYWdFWDZoZEhUQUtCZ2dxaGtqT1BRUURBZ05JQURCRkFpQllZeHllWVViM3UzSWJQa0cwQVpGdVQzbEFZakh3CjdXZFdNcFVUL0hWb1dRSWhBSlVxZnk0d0lVaWNYQ2RoMTNRd21rV2YwaExFc1R5VnZoN2ozak43VXpHegotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU1tWGlhRW9Sdm1ZUWIwbCtTTHFZMGpGN204eGJBWmV1MEpYOEk0L1NCaW1vQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK044NjRuZ0NQNHVsczZrUUU1RGU0SmpIMHYveDNUVWQ1aGdjbkIwUndIVFNFZkk3RUFnbApZekwwYUc2d3NUazVaYzVabW0xZ2FJUnhoWHBHdFIwb3B3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= From f787bfb2ef53c430346ad554af744947ecde3fa5 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:16:35 +0530 Subject: [PATCH 13/61] Delete terraform/modules/aws/rke2-cluster/ansible/esgotest-CONTROL-PLANE-NODE-1.yaml Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- .../esgotest-CONTROL-PLANE-NODE-1.yaml | 19 ------------------- 1 file changed, 19 deletions(-) delete mode 100644 terraform/modules/aws/rke2-cluster/ansible/esgotest-CONTROL-PLANE-NODE-1.yaml diff --git a/terraform/modules/aws/rke2-cluster/ansible/esgotest-CONTROL-PLANE-NODE-1.yaml b/terraform/modules/aws/rke2-cluster/ansible/esgotest-CONTROL-PLANE-NODE-1.yaml deleted file mode 100644 index 9681f1e26..000000000 --- a/terraform/modules/aws/rke2-cluster/ansible/esgotest-CONTROL-PLANE-NODE-1.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v1 -clusters: -- cluster: - certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TnpnME9ERXpPVEE1TUI0WERUSTJNRGN5TXpFek16Z3lPVm9YRFRNMk1EY3lNREV6TXpneQpPVm93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRjNE5EZ3hNemt3T1RCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJGdnlSZkVZdHFhTFJRb3BRYzJON1pHWS90ZzZNYllQTlZ6WlhZTUEKS1lKckZWdkFoQmtZbDZmaEVuZkk5QUVlSUVPL2theEIwZHhNYjBtNWoxNi9mUStqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUVF2aE5tckdkdkJId2NKdWU4CjVWYjZsYWRBQ3pBS0JnZ3Foa2pPUFFRREFnTkhBREJFQWlBZGF2V3hTL284ajNra1ZuenY4aStTR2lrU1JWRU4KY2tWTU1pUVV3VU83emdJZ0c3V3ZXUVc2WHhnR0FsbWlzelg4aXZWd0Frbkg5OXpoSTNTb2RoQllxZXM9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - server: https://172.31.66.49:6443 - name: esgotest -contexts: -- context: - cluster: esgotest - user: esgotest - name: esgotest -current-context: esgotest -kind: Config -preferences: {} -users: -- name: esgotest - user: - client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrakNDQVRpZ0F3SUJBZ0lJTTdwamJrRG1zQlF3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVGM0TkRneE16a3dPVEFlRncweU5qQTNNak14TXpNNE1qbGFGdzB5TnpBMwpNak14TXpNNE1qbGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUmpJTTYvVGd4RG5BUXkKRGxYR2NwWE9nK0twQU9jSTNnYlJQbE9zSEpBMDlIdHJydnpETmsyUXVuT0FEa2lHS1d2L0NHLzlUb0Y3SEl5ZQpNc1VPN0pSQW8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVTeDVJNnVIU2pXcU5aVVJBdVoyQ0tKaHlCNUV3Q2dZSUtvWkl6ajBFQXdJRFNBQXcKUlFJaEFQRnp2UE9rb0ZDKzNVYjBPM0dkUDRScVdsc2RYODlYSGlJcUk1aFdyNFd4QWlCY3ZLZkNMbzVVdms5OQphR1RnUWtQMzk1US9wbmFGcFNqQjVORFMxeVJmeFE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZURDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE56ZzBPREV6T1RBNU1CNFhEVEkyTURjeU16RXpNemd5T1ZvWERUTTJNRGN5TURFek16Z3kKT1Zvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UYzRORGd4TXprd09UQlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCR2lUSGE5c3NTMXNzTDZwM2dpY0tEYnI4akhnTjBWakw3RWJ1dXdPCnFVN3JUaHovN0UrSHpiMitaUGxGSlVuczAxbnB4czhCcHBmNkVNZHpNV1N2My9LalFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlJMSGtqcTRkS05hbzFsUkVDNQpuWUlvbUhJSGtUQUtCZ2dxaGtqT1BRUURBZ05IQURCRUFpQXpPdUtCdWpJYjJZMlg1a29NNUVlamVHbXlmTlBZCndvckZNY3FkTFEwWlBBSWdkZVZ4ZjhkdGFZblQzZmZsNzM3T0hDamVlamVvR0RYRFdJRjRKL1dLaU5zPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUlDSHFlQ3NYekhFbjJoOUlSUk04OVdZc3QwMFFpL3J1VUxZa3BRTDI0R1JvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFWXlET3YwNE1RNXdFTWc1VnhuS1Z6b1BpcVFEbkNONEcwVDVUckJ5UU5QUjdhNjc4d3paTgprTHB6Z0E1SWhpbHIvd2h2L1U2QmV4eU1uakxGRHV5VVFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= From 6a6bafecc7b21e38303cf79df887fcd8fd05ee88 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:17:54 +0530 Subject: [PATCH 14/61] Delete terraform/implementations/aws/infra/backend.tf Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- terraform/implementations/aws/infra/backend.tf | 5 ----- 1 file changed, 5 deletions(-) delete mode 100644 terraform/implementations/aws/infra/backend.tf diff --git a/terraform/implementations/aws/infra/backend.tf b/terraform/implementations/aws/infra/backend.tf deleted file mode 100644 index ff4cc9846..000000000 --- a/terraform/implementations/aws/infra/backend.tf +++ /dev/null @@ -1,5 +0,0 @@ -terraform { - backend "local" { - path = "profiles/esignet-standalone/aws-infra-esignet-standalone-es-go-test-terraform.tfstate" - } -} From 48da6cb30980b1fd854e9be4562582858681f712 Mon Sep 17 00:00:00 2001 From: bhumi46 <111699703+bhumi46@users.noreply.github.com> Date: Wed, 5 Aug 2026 10:20:44 +0530 Subject: [PATCH 15/61] Update aws.tfvars Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com> --- .../infra/profiles/esignet-standalone/aws.tfvars | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars index 85198c9a4..a7cfa4290 100644 --- a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars +++ b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars @@ -10,19 +10,19 @@ cluster_name = "" # eSignet's domain (ex: esignet.xyz.net) -cluster_env_domain = "" +cluster_env_domain = "" # Email-ID will be used by certbot to notify SSL certificate expiry via email -mosip_email_id = "6@gmail.com" +mosip_email_id = " 0 to From 924e37f17110f0ac1b843e16769019ca10b2db50 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 6 Aug 2026 17:25:17 +0530 Subject: [PATCH 16/61] fix: replace hardcoded P12 password and crypto encryption key with secretKeyRef MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CodeRabbit flagged MOSIP_P12_PASSWORD and CRYPTO_ENCRYPTION_KEY as hardcoded credentials (CWE-798), duplicated identically across all 4 esignet-standalone-2.0.0 plugin-values files. Replace with valueFrom.secretKeyRef pointing at a new shared esignet-go-crypto secret. - esignet-preinstall.sh (shared by all 4 esignet-go-* instances) now mints esignet-go-crypto in the captcha namespace from two new required GH Actions secrets (ESIGNET_P12_PASSWORD, ESIGNET_CRYPTO_ENCRYPTION_KEY) and copies it into each instance's namespace, following the same pattern already used for captcha secrets - helmsman_esignet.yml: wire the two new secrets through env passthrough, masking, and validation (required only when profile == esignet-standalone-2.0.0) - Deployment guide updated with the two new secrets Existing values are preserved (not rotated) to avoid breaking anything tied to the current P12 keystore files — the secret material now lives only in GitHub Environment secrets, never committed to the repo. Signed-off-by: bhumi46 --- .github/workflows/helmsman_esignet.yml | 22 +++++++++++++++++++ .../esignet-preinstall.sh | 14 ++++++++++++ .../esignet-mosipid1-plugin-values-2-0-0.yaml | 10 +++++++-- .../esignet-mosipid2-plugin-values-2-0-0.yaml | 10 +++++++-- .../esignet-plugin-values-2-0-0.yaml | 10 +++++++-- .../esignet-sunbird-plugin-values-2-0-0.yaml | 10 +++++++-- docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md | 2 ++ 7 files changed, 70 insertions(+), 8 deletions(-) diff --git a/.github/workflows/helmsman_esignet.yml b/.github/workflows/helmsman_esignet.yml index 170fb368f..a7eb3a817 100644 --- a/.github/workflows/helmsman_esignet.yml +++ b/.github/workflows/helmsman_esignet.yml @@ -143,6 +143,10 @@ jobs: MOSIPID2_POSTGRES_PASSWORD: ${{ secrets.MOSIPID2_POSTGRES_PASSWORD }} ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY }} ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY }} + # eSignet-Go (esignet-standalone-2.0.0 profile only) P12 keystore password + + # crypto encryption key — shared across all 4 esignet-go-* instances + ESIGNET_P12_PASSWORD: ${{ secrets.ESIGNET_P12_PASSWORD }} + ESIGNET_CRYPTO_ENCRYPTION_KEY: ${{ secrets.ESIGNET_CRYPTO_ENCRYPTION_KEY }} # Spring config label per namespace — controls which Git branch/tag the config-server uses # Set as Environment Variables in Repository → Settings → Environments → → Variables # If unset, hooks default to 'develop' @@ -209,6 +213,8 @@ jobs: echo "::add-mask::${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY }}" + echo "::add-mask::${{ secrets.ESIGNET_P12_PASSWORD }}" + echo "::add-mask::${{ secrets.ESIGNET_CRYPTO_ENCRYPTION_KEY }}" - name: Setup kubectl and kubeconfig env: @@ -418,6 +424,19 @@ jobs: else echo "ℹ mosipid2 disabled — skipping mosipid2 secret validation" fi + + if [ "$PROFILE" == "esignet-standalone-2.0.0" ]; then + echo "--- Validating esignet-standalone-2.0.0 P12/crypto secrets ---" + for var in ESIGNET_P12_PASSWORD ESIGNET_CRYPTO_ENCRYPTION_KEY; do + val="${!var:-}" + if [ -z "$val" ]; then + echo "❌ $var secret is not configured (required for esignet-standalone-2.0.0)" + MISSING_SECRETS=1 + else + echo "✅ $var is configured" + fi + done + fi fi if [ "$MISSING_SECRETS" -eq 1 ]; then @@ -440,6 +459,9 @@ jobs: echo " - ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY / ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY" echo " - MOSIPID2_POSTGRES_PASSWORD / MOSIPID2_KEYCLOAK_ADMIN_PASSWORD" fi + if [ "$PROFILE" == "esignet-standalone-2.0.0" ]; then + echo " - ESIGNET_P12_PASSWORD / ESIGNET_CRYPTO_ENCRYPTION_KEY" + fi fi exit 1 fi diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh index eec0071d5..3885cc0c0 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh @@ -80,4 +80,18 @@ $COPY_UTIL secret keycloak "$KEYCLOAK_NS" "$ESIGNET_NS" echo "Copying keycloak-client-secrets secret from $KEYCLOAK_NS" $COPY_UTIL secret keycloak-client-secrets "$KEYCLOAK_NS" "$ESIGNET_NS" +# --- Step 5: Shared eSignet P12 password + crypto encryption key --- +ESIGNET_P12_PASSWORD_VAL="${ESIGNET_P12_PASSWORD:?ERROR: ESIGNET_P12_PASSWORD must be set}" +ESIGNET_CRYPTO_KEY_VAL="${ESIGNET_CRYPTO_ENCRYPTION_KEY:?ERROR: ESIGNET_CRYPTO_ENCRYPTION_KEY must be set}" +CRYPTO_HUB_NS="captcha" + +echo "Creating esignet-go-crypto secret in $CRYPTO_HUB_NS namespace" +kubectl -n "$CRYPTO_HUB_NS" create secret generic esignet-go-crypto \ + --from-literal=p12-password="$ESIGNET_P12_PASSWORD_VAL" \ + --from-literal=crypto-encryption-key="$ESIGNET_CRYPTO_KEY_VAL" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Copying esignet-go-crypto secret from $CRYPTO_HUB_NS to $ESIGNET_NS" +$COPY_UTIL secret esignet-go-crypto "$CRYPTO_HUB_NS" "$ESIGNET_NS" + echo "eSignet pre-install completed." diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml index 697de99b0..e89a64b79 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml @@ -64,11 +64,17 @@ extraEnvVars: - name: MOSIP_P12_PATH value: /home/mosip/keys/secret/mosipid1.pfx - name: MOSIP_P12_PASSWORD - value: localtest + valueFrom: + secretKeyRef: + name: esignet-go-crypto + key: p12-password - name: OIDC_UI_SCHEME value: https - name: CRYPTO_ENCRYPTION_KEY - value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e + valueFrom: + secretKeyRef: + name: esignet-go-crypto + key: crypto-encryption-key - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml index 96e42db3e..f915ee073 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml @@ -64,11 +64,17 @@ extraEnvVars: - name: MOSIP_P12_PATH value: /home/mosip/keys/secret/mosipid2.pfx - name: MOSIP_P12_PASSWORD - value: localtest + valueFrom: + secretKeyRef: + name: esignet-go-crypto + key: p12-password - name: OIDC_UI_SCHEME value: https - name: CRYPTO_ENCRYPTION_KEY - value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e + valueFrom: + secretKeyRef: + name: esignet-go-crypto + key: crypto-encryption-key - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml index 6f53b8731..bb20b7512 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml @@ -78,11 +78,17 @@ extraEnvVars: - name: MOSIP_P12_PATH value: /home/mosip/keys/secret/mock.pfx - name: MOSIP_P12_PASSWORD - value: localtest + valueFrom: + secretKeyRef: + name: esignet-go-crypto + key: p12-password - name: OIDC_UI_SCHEME value: https - name: CRYPTO_ENCRYPTION_KEY - value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e + valueFrom: + secretKeyRef: + name: esignet-go-crypto + key: crypto-encryption-key - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml index 54f52350c..1b30dd47a 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml @@ -66,11 +66,17 @@ extraEnvVars: - name: MOSIP_P12_PATH value: /home/mosip/keys/secret/sunbird.pfx - name: MOSIP_P12_PASSWORD - value: localtest + valueFrom: + secretKeyRef: + name: esignet-go-crypto + key: p12-password - name: OIDC_UI_SCHEME value: https - name: CRYPTO_ENCRYPTION_KEY - value: 0579f866ac7c9273580d0ff163fa01a7b2401a7ff3ddc3e3b14ae3136fa6025e + valueFrom: + secretKeyRef: + name: esignet-go-crypto + key: crypto-encryption-key - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH diff --git a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md index 4340b2245..1c554a9f1 100644 --- a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md +++ b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md @@ -174,6 +174,8 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings | `ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-mosipid2` namespace *(only needed if mosipid2 is enabled)* | | `ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for `esignet-sunbird` namespace | | `ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-sunbird` namespace | +| `ESIGNET_P12_PASSWORD` | P12 keystore password, shared across all 4 `esignet-go-*` instances *(only needed for `esignet-standalone-2.0.0`)* | +| `ESIGNET_CRYPTO_ENCRYPTION_KEY` | Crypto encryption key, shared across all 4 `esignet-go-*` instances *(only needed for `esignet-standalone-2.0.0`)* | | `MOSIPID1_POSTGRES_PASSWORD` | Postgres superuser password for the MOSIP-ID1 remote MOSIP environment | | `MOSIPID2_POSTGRES_PASSWORD` | Postgres superuser password for the MOSIP-ID2 remote MOSIP environment *(only needed if mosipid2 is enabled)* | | `MOSIPID1_KEYCLOAK_ADMIN_PASSWORD` | Keycloak admin password for the MOSIP-ID1 remote MOSIP environment | From f160f6566f296819724168e9929059bb3af87010 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Fri, 7 Aug 2026 12:34:03 +0530 Subject: [PATCH 17/61] fix: switch esignet-go-* keymanager config to match upstream PKCS11 integration, PKCS12 for mosipid1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follows mosip/esignet#2331 (Keymanager integration changes), which removed MOSIP_P12_PASSWORD/CRYPTO_ENCRYPTION_KEY from the chart entirely in favor of KEYMANAGER_* config: - mock/mosipid2/sunbird: KEYMANAGER_KEYSTORE_TYPE PKCS11, using each instance's existing esignet-softhsm-go-* secret for KEYMANAGER_PKCS11_PIN; module path corrected to the real /usr/lib/softhsm/libsofthsm2.so from the now-merged upstream chart (was a placeholder) - mosipid1: KEYMANAGER_KEYSTORE_TYPE PKCS12 instead, using the extraVolumes/extraVolumeMounts capability added in mosip/esignet#2333. esignet-mosipid1-preinstall.sh now generates a throwaway self-signed PKCS12 keystore (create-if-missing, so it stays stable across redeploys) in secret esignet-keystore-go-mosipid1, bulk-imported via extraEnvVarsSecret for KEYMANAGER_PKCS12_PASSWORD and mounted at /home/mosip/keys/secret for KEYMANAGER_PKCS12_FILE_PATH - Removed the now-unused ESIGNET_P12_PASSWORD/ESIGNET_CRYPTO_ENCRYPTION_KEY GitHub secrets wiring from helmsman_esignet.yml and the deployment guide — no GH secrets needed for either keystore approach anymore https://github.com/mosip/esignet/issues/2333 Signed-off-by: bhumi46 --- .github/workflows/helmsman_esignet.yml | 22 ---------------- .../esignet-mosipid1-preinstall.sh | 23 +++++++++++++++++ .../esignet-preinstall.sh | 14 ----------- .../esignet-mosipid1-plugin-values-2-0-0.yaml | 25 +++++++++++-------- .../esignet-mosipid2-plugin-values-2-0-0.yaml | 23 +++++++++-------- .../esignet-plugin-values-2-0-0.yaml | 23 +++++++++-------- .../esignet-sunbird-plugin-values-2-0-0.yaml | 23 +++++++++-------- docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md | 2 -- 8 files changed, 76 insertions(+), 79 deletions(-) diff --git a/.github/workflows/helmsman_esignet.yml b/.github/workflows/helmsman_esignet.yml index a7eb3a817..170fb368f 100644 --- a/.github/workflows/helmsman_esignet.yml +++ b/.github/workflows/helmsman_esignet.yml @@ -143,10 +143,6 @@ jobs: MOSIPID2_POSTGRES_PASSWORD: ${{ secrets.MOSIPID2_POSTGRES_PASSWORD }} ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY }} ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY }} - # eSignet-Go (esignet-standalone-2.0.0 profile only) P12 keystore password + - # crypto encryption key — shared across all 4 esignet-go-* instances - ESIGNET_P12_PASSWORD: ${{ secrets.ESIGNET_P12_PASSWORD }} - ESIGNET_CRYPTO_ENCRYPTION_KEY: ${{ secrets.ESIGNET_CRYPTO_ENCRYPTION_KEY }} # Spring config label per namespace — controls which Git branch/tag the config-server uses # Set as Environment Variables in Repository → Settings → Environments → → Variables # If unset, hooks default to 'develop' @@ -213,8 +209,6 @@ jobs: echo "::add-mask::${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY }}" - echo "::add-mask::${{ secrets.ESIGNET_P12_PASSWORD }}" - echo "::add-mask::${{ secrets.ESIGNET_CRYPTO_ENCRYPTION_KEY }}" - name: Setup kubectl and kubeconfig env: @@ -424,19 +418,6 @@ jobs: else echo "ℹ mosipid2 disabled — skipping mosipid2 secret validation" fi - - if [ "$PROFILE" == "esignet-standalone-2.0.0" ]; then - echo "--- Validating esignet-standalone-2.0.0 P12/crypto secrets ---" - for var in ESIGNET_P12_PASSWORD ESIGNET_CRYPTO_ENCRYPTION_KEY; do - val="${!var:-}" - if [ -z "$val" ]; then - echo "❌ $var secret is not configured (required for esignet-standalone-2.0.0)" - MISSING_SECRETS=1 - else - echo "✅ $var is configured" - fi - done - fi fi if [ "$MISSING_SECRETS" -eq 1 ]; then @@ -459,9 +440,6 @@ jobs: echo " - ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY / ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY" echo " - MOSIPID2_POSTGRES_PASSWORD / MOSIPID2_KEYCLOAK_ADMIN_PASSWORD" fi - if [ "$PROFILE" == "esignet-standalone-2.0.0" ]; then - echo " - ESIGNET_P12_PASSWORD / ESIGNET_CRYPTO_ENCRYPTION_KEY" - fi fi exit 1 fi diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh index e0d5ccbc1..ce97e8240 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh @@ -44,6 +44,29 @@ if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" fi +# Create esignet-keystore-go-mosipid1 (PKCS12 keystore for KEYMANAGER_KEYSTORE_TYPE: PKCS12) — +# a throwaway self-signed cert generated once and reused across redeploys. Never regenerate an +# existing keystore: KEYMANAGER_PKCS12_PASSWORD/mosipid1.pfx must stay stable, or anything +# encrypted with the old keystore becomes unreadable. +if ! kubectl -n "$ESIGNET_NS" get secret esignet-keystore-go-mosipid1 &>/dev/null; then + echo "Generating dummy PKCS12 keystore for mosipid1" + DUMMY_P12_PASSWORD="$(openssl rand -hex 16)" + TMP_KEY="$(mktemp)" + TMP_CERT="$(mktemp)" + TMP_P12="$(mktemp)" + openssl req -x509 -newkey rsa:2048 -keyout "$TMP_KEY" -out "$TMP_CERT" \ + -days 3650 -nodes -subj "/CN=esignet-go-mosipid1-dummy" 2>/dev/null + openssl pkcs12 -export -out "$TMP_P12" -inkey "$TMP_KEY" -in "$TMP_CERT" \ + -passout "pass:${DUMMY_P12_PASSWORD}" + kubectl -n "$ESIGNET_NS" create secret generic esignet-keystore-go-mosipid1 \ + --from-literal=KEYMANAGER_PKCS12_PASSWORD="$DUMMY_P12_PASSWORD" \ + --from-file=mosipid1.pfx="$TMP_P12" + rm -f "$TMP_KEY" "$TMP_CERT" "$TMP_P12" + echo "esignet-keystore-go-mosipid1 secret created in $ESIGNET_NS" +else + echo "esignet-keystore-go-mosipid1 already exists — reusing existing keystore" +fi + echo "Creating esignet-captcha-go-mosipid1 secret in $CAPTCHA_NS namespace" kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-go-mosipid1 \ --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh index 3885cc0c0..eec0071d5 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh @@ -80,18 +80,4 @@ $COPY_UTIL secret keycloak "$KEYCLOAK_NS" "$ESIGNET_NS" echo "Copying keycloak-client-secrets secret from $KEYCLOAK_NS" $COPY_UTIL secret keycloak-client-secrets "$KEYCLOAK_NS" "$ESIGNET_NS" -# --- Step 5: Shared eSignet P12 password + crypto encryption key --- -ESIGNET_P12_PASSWORD_VAL="${ESIGNET_P12_PASSWORD:?ERROR: ESIGNET_P12_PASSWORD must be set}" -ESIGNET_CRYPTO_KEY_VAL="${ESIGNET_CRYPTO_ENCRYPTION_KEY:?ERROR: ESIGNET_CRYPTO_ENCRYPTION_KEY must be set}" -CRYPTO_HUB_NS="captcha" - -echo "Creating esignet-go-crypto secret in $CRYPTO_HUB_NS namespace" -kubectl -n "$CRYPTO_HUB_NS" create secret generic esignet-go-crypto \ - --from-literal=p12-password="$ESIGNET_P12_PASSWORD_VAL" \ - --from-literal=crypto-encryption-key="$ESIGNET_CRYPTO_KEY_VAL" \ - --dry-run=client -o yaml | kubectl apply -f - - -echo "Copying esignet-go-crypto secret from $CRYPTO_HUB_NS to $ESIGNET_NS" -$COPY_UTIL secret esignet-go-crypto "$CRYPTO_HUB_NS" "$ESIGNET_NS" - echo "eSignet pre-install completed." diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml index e89a64b79..409283736 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml @@ -61,20 +61,14 @@ extraEnvVars: key: mosip_ida_client_secret - name: AUTHN_PROVIDER value: mosip - - name: MOSIP_P12_PATH + - name: KEYMANAGER_DB_SCHEMA + value: esignet + - name: KEYMANAGER_KEYSTORE_TYPE + value: PKCS12 + - name: KEYMANAGER_PKCS12_FILE_PATH value: /home/mosip/keys/secret/mosipid1.pfx - - name: MOSIP_P12_PASSWORD - valueFrom: - secretKeyRef: - name: esignet-go-crypto - key: p12-password - name: OIDC_UI_SCHEME value: https - - name: CRYPTO_ENCRYPTION_KEY - valueFrom: - secretKeyRef: - name: esignet-go-crypto - key: crypto-encryption-key - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH @@ -87,6 +81,15 @@ extraEnvVars: value: decl-layout-1 - name: DEFAULT_AUTH_FLOW_ID value: decl-mosip-otp-flow-1 +extraEnvVarsSecret: + - esignet-keystore-go-mosipid1 +extraVolumes: + - name: esignet-keystore-go-mosipid1 + secret: + secretName: esignet-keystore-go-mosipid1 +extraVolumeMounts: + - name: esignet-keystore-go-mosipid1 + mountPath: /home/mosip/keys/secret extraEnvVarsAdditional: - name: "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME" value: "esignetgomosipid1" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml index f915ee073..7c4890e12 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml @@ -61,20 +61,23 @@ extraEnvVars: key: mosip_ida_client_secret - name: AUTHN_PROVIDER value: mosip - - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/mosipid2.pfx - - name: MOSIP_P12_PASSWORD + - name: KEYMANAGER_DB_SCHEMA + value: esignet + - name: KEYMANAGER_KEYSTORE_TYPE + value: PKCS11 + - name: KEYMANAGER_PKCS11_MODULE_PATH + value: /usr/lib/softhsm/libsofthsm2.so + - name: KEYMANAGER_PKCS11_TOKEN_LABEL + value: esignet + - name: KEYMANAGER_PKCS11_SLOT_ID + value: "0" + - name: KEYMANAGER_PKCS11_PIN valueFrom: secretKeyRef: - name: esignet-go-crypto - key: p12-password + name: esignet-softhsm-go-mosipid2 + key: security-pin - name: OIDC_UI_SCHEME value: https - - name: CRYPTO_ENCRYPTION_KEY - valueFrom: - secretKeyRef: - name: esignet-go-crypto - key: crypto-encryption-key - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml index bb20b7512..83c8dbd6c 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml @@ -75,20 +75,23 @@ extraEnvVars: key: mosip_ida_client_secret - name: AUTHN_PROVIDER value: mosip - - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/mock.pfx - - name: MOSIP_P12_PASSWORD + - name: KEYMANAGER_DB_SCHEMA + value: esignet + - name: KEYMANAGER_KEYSTORE_TYPE + value: PKCS11 + - name: KEYMANAGER_PKCS11_MODULE_PATH + value: /usr/lib/softhsm/libsofthsm2.so + - name: KEYMANAGER_PKCS11_TOKEN_LABEL + value: esignet + - name: KEYMANAGER_PKCS11_SLOT_ID + value: "0" + - name: KEYMANAGER_PKCS11_PIN valueFrom: secretKeyRef: - name: esignet-go-crypto - key: p12-password + name: esignet-softhsm-go + key: security-pin - name: OIDC_UI_SCHEME value: https - - name: CRYPTO_ENCRYPTION_KEY - valueFrom: - secretKeyRef: - name: esignet-go-crypto - key: crypto-encryption-key - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml index 1b30dd47a..80ec0bb63 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml @@ -63,20 +63,23 @@ extraEnvVars: key: mosip_ida_client_secret - name: AUTHN_PROVIDER value: mosip - - name: MOSIP_P12_PATH - value: /home/mosip/keys/secret/sunbird.pfx - - name: MOSIP_P12_PASSWORD + - name: KEYMANAGER_DB_SCHEMA + value: esignet + - name: KEYMANAGER_KEYSTORE_TYPE + value: PKCS11 + - name: KEYMANAGER_PKCS11_MODULE_PATH + value: /usr/lib/softhsm/libsofthsm2.so + - name: KEYMANAGER_PKCS11_TOKEN_LABEL + value: esignet + - name: KEYMANAGER_PKCS11_SLOT_ID + value: "0" + - name: KEYMANAGER_PKCS11_PIN valueFrom: secretKeyRef: - name: esignet-go-crypto - key: p12-password + name: esignet-softhsm-go-sunbird + key: security-pin - name: OIDC_UI_SCHEME value: https - - name: CRYPTO_ENCRYPTION_KEY - valueFrom: - secretKeyRef: - name: esignet-go-crypto - key: crypto-encryption-key - name: OIDC_UI_PORT value: '443' - name: OIDC_UI_LOGIN_PATH diff --git a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md index 1c554a9f1..4340b2245 100644 --- a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md +++ b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md @@ -174,8 +174,6 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings | `ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-mosipid2` namespace *(only needed if mosipid2 is enabled)* | | `ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for `esignet-sunbird` namespace | | `ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-sunbird` namespace | -| `ESIGNET_P12_PASSWORD` | P12 keystore password, shared across all 4 `esignet-go-*` instances *(only needed for `esignet-standalone-2.0.0`)* | -| `ESIGNET_CRYPTO_ENCRYPTION_KEY` | Crypto encryption key, shared across all 4 `esignet-go-*` instances *(only needed for `esignet-standalone-2.0.0`)* | | `MOSIPID1_POSTGRES_PASSWORD` | Postgres superuser password for the MOSIP-ID1 remote MOSIP environment | | `MOSIPID2_POSTGRES_PASSWORD` | Postgres superuser password for the MOSIP-ID2 remote MOSIP environment *(only needed if mosipid2 is enabled)* | | `MOSIPID1_KEYCLOAK_ADMIN_PASSWORD` | Keycloak admin password for the MOSIP-ID1 remote MOSIP environment | From 226de62cd5fadde359c8b609597ee0ac246be825 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Fri, 7 Aug 2026 13:22:55 +0530 Subject: [PATCH 18/61] fix: use fixed localtest password for mosipid1 dummy PKCS12 keystore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Use a fixed known value instead of a randomly generated one — this password only protects a throwaway self-signed dummy keystore generated by this hook, not real production key material, so a shared known value is acceptable here. https://github.com/mosip/esignet/issues/2333 Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh index ce97e8240..cd5501eaf 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh @@ -50,7 +50,7 @@ fi # encrypted with the old keystore becomes unreadable. if ! kubectl -n "$ESIGNET_NS" get secret esignet-keystore-go-mosipid1 &>/dev/null; then echo "Generating dummy PKCS12 keystore for mosipid1" - DUMMY_P12_PASSWORD="$(openssl rand -hex 16)" + DUMMY_P12_PASSWORD="localtest" TMP_KEY="$(mktemp)" TMP_CERT="$(mktemp)" TMP_P12="$(mktemp)" From 63cf707c2f86bcc2cbbeab01f4bf55894c2df66c Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Fri, 7 Aug 2026 17:10:37 +0530 Subject: [PATCH 19/61] fix: resolve CodeRabbit review findings on esignet-standalone-2.0.0 Correctness/security fixes: - helmsman_esignet.yml: use env.PROFILE (not the empty push-event input) in the MOSIP DSF check condition - helmsman_esignet.yml, helmsman_testrigs.yml: enforce mosipid1_domain_name/ mosipid2_domain_name as required instead of silently accepting empty values - helmsman_testrigs.yml: bind workflow inputs to env: and reference them as shell variables instead of interpolating ${{ }} directly into the script body (GitHub Actions script injection hardening) - esignet-misp-onboarder-postinstall.sh: always restore Istio injection before returning, exit nonzero on job failure instead of continuing to restart dependent workloads, stop masking rollout-status failures - esignet-misp-onboarder-preinstall.sh: add an EXIT trap to restore Istio injection if the hook fails partway, so a failed preinstall doesn't leave the namespace permanently without sidecar injection - kernel-preinstall.sh: validate MOSIP_API_HOST/MOSIP_API_INTERNAL_HOST before creating the domain-config configmap instead of silently defaulting to empty - softhsm-esignet-postinstall.sh: fix the copied configmap name (esignet-softhsm-share -> esignet-softhsm-go-share, matching what the mosip/softhsm chart actually creates) and stop suppressing copy failures - signup-service-preinstall.sh: restart the captcha deployment when the signup-go secret is updated on an existing deployment, not just on first creation, so key/secret rotations actually take effect - trigger-test-jobs-esignet.sh: distinguish genuine NotFound from other kubectl failures (RBAC, credentials, API errors) in the CronJob existence check, CronJob list, and Job status polling; separate local declarations from command-substitution assignments so exit codes are captured correctly; propagate signup/signup-go job failures into OVERALL_SUCCESS instead of discarding them - 4x apitestrig-esignet-*-setup.sh: create the s3-esignet-*-apitestrig and apitestrig-esignet-*-apitestrig secrets referenced by extraEnvVarsSecret, which nothing was creating before - esignet-mosipid1/2-plugin-values-2-0-0.yaml: LOGGING_LEVEL DEBUG -> INFO Documentation/consistency fixes: - Replace stale "eSignet 1.7.1" banners/headers with "eSignet Standalone 2.0.0" across hook scripts, and correct documented env var defaults to match code - esignet-dsf.yaml, testrigs-dsf.yaml: correct stale v1.7.1 references in comments and a commented-out postInstall path - captcha-postinstall.sh: fix header docs to match the actual env var names and default namespace - aws.tfvars: close an unclosed placeholder - Remove stray trailing blank lines / extra blank lines in two values files - ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md: fix markdownlint MD028/MD029/MD031 violations, correct the Steps 2/4 profile-acceptance note, remove unconditional signup CronJob verification commands (Step 3 isn't ready for either profile), and extend the MOSIP-ID2 allowed-domain-uris example to cover shared MOSIP-ID2 environments Signed-off-by: bhumi46 --- .github/workflows/helmsman_esignet.yml | 11 ++- .github/workflows/helmsman_testrigs.yml | 23 +++++- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 8 +- .../testrigs-dsf.yaml | 14 ++-- .../apitestrig-esignet-mosipid1-setup.sh | 22 ++++-- .../apitestrig-esignet-mosipid2-setup.sh | 22 ++++-- .../apitestrig-esignet-setup.sh | 22 ++++-- .../apitestrig-esignet-sunbird-setup.sh | 22 ++++-- .../captcha-postinstall.sh | 6 +- .../esignet-misp-onboarder-postinstall.sh | 20 +++-- .../esignet-misp-onboarder-preinstall.sh | 8 ++ .../kernel-preinstall.sh | 9 +++ .../mock-identity-init-db.sh | 6 +- .../mock-identity-system-preinstall.sh | 8 +- ...lying-party-service-mosipid1-preinstall.sh | 2 +- ...lying-party-service-mosipid2-preinstall.sh | 2 +- .../mock-relying-party-service-preinstall.sh | 4 +- ...elying-party-service-sunbird-preinstall.sh | 2 +- ...ck-relying-party-ui-mosipid1-preinstall.sh | 4 +- ...ck-relying-party-ui-mosipid2-preinstall.sh | 4 +- .../mock-relying-party-ui-preinstall.sh | 4 +- ...ock-relying-party-ui-sunbird-preinstall.sh | 4 +- .../notifier-postinstall.sh | 4 +- .../oidc-ui-mosipid1-preinstall.sh | 2 +- .../signup-service-preinstall.sh | 4 +- .../softhsm-esignet-postinstall.sh | 10 +-- .../trigger-test-jobs-esignet.sh | 76 +++++++++++++++---- .../uitestrig-signup-setup.sh | 6 +- .../esignet-mosipid1-plugin-values-2-0-0.yaml | 2 +- .../esignet-mosipid2-plugin-values-2-0-0.yaml | 3 +- .../esignet-plugin-values-2-0-0.yaml | 1 - docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md | 35 +++++---- .../profiles/esignet-standalone/aws.tfvars | 2 +- 33 files changed, 257 insertions(+), 115 deletions(-) diff --git a/.github/workflows/helmsman_esignet.yml b/.github/workflows/helmsman_esignet.yml index 170fb368f..d09e8d959 100644 --- a/.github/workflows/helmsman_esignet.yml +++ b/.github/workflows/helmsman_esignet.yml @@ -94,6 +94,15 @@ jobs: if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then MOSIPID1_DOMAIN="${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }}" MOSIPID2_DOMAIN="${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }}" + if [ -z "$MOSIPID1_DOMAIN" ]; then + echo "❌ mosipid1_domain_name is required for standalone profiles" + exit 1 + fi + if [ "${{ github.event.inputs.enable_mosipid2 }}" = "true" ] && + [ -z "$MOSIPID2_DOMAIN" ]; then + echo "❌ mosipid2_domain_name is required when enable_mosipid2 is true" + exit 1 + fi echo "✓ mosipid1_domain_name = $MOSIPID1_DOMAIN (esignet standalone)" echo "✓ mosipid2_domain_name = $MOSIPID2_DOMAIN (esignet standalone)" MOSIPID1_SPRING_LABEL="${{ vars.ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL }}" @@ -326,7 +335,7 @@ jobs: kubectl cluster-info - name: Check if mosip-dsf label is completed - if: ${{ github.event.inputs.skip_mosip_dsf_check != 'true' && vars.ESIGNET_STANDALONE_MODE != 'true' && !startsWith(github.event.inputs.profile, 'esignet-standalone') }} + if: ${{ github.event.inputs.skip_mosip_dsf_check != 'true' && vars.ESIGNET_STANDALONE_MODE != 'true' && !startsWith(env.PROFILE, 'esignet-standalone') }} run: | STATUS=$(kubectl get namespace default -o jsonpath='{.metadata.labels.mosip-dsf}' 2>/dev/null || echo "") if [[ "$STATUS" != "completed" ]]; then diff --git a/.github/workflows/helmsman_testrigs.yml b/.github/workflows/helmsman_testrigs.yml index 8a2c5395b..1b19de8ff 100644 --- a/.github/workflows/helmsman_testrigs.yml +++ b/.github/workflows/helmsman_testrigs.yml @@ -73,6 +73,12 @@ jobs: name: ${{ github.ref_name }} steps: - name: Validate required variables + env: + IN_MOSIPID1_DOMAIN: ${{ github.event.inputs.mosipid1_domain_name }} + IN_MOSIPID2_DOMAIN: ${{ github.event.inputs.mosipid2_domain_name }} + VAR_MOSIPID1_DOMAIN: ${{ vars.MOSIPID1_DOMAIN_NAME }} + VAR_MOSIPID2_DOMAIN: ${{ vars.MOSIPID2_DOMAIN_NAME }} + IN_ENABLE_MOSIPID2: ${{ github.event.inputs.enable_mosipid2 }} run: | errors=() PROFILE="${{ github.event.inputs.profile }}" @@ -100,13 +106,22 @@ jobs: # mosipid1_domain_name and mosipid2_domain_name are esignet standalone only. # Push events always target the esignet profile (path filter); dispatch uses explicit profile input. if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then - MOSIPID1_DOMAIN="${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }}" - MOSIPID2_DOMAIN="${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }}" + MOSIPID1_DOMAIN="${IN_MOSIPID1_DOMAIN:-$VAR_MOSIPID1_DOMAIN}" + MOSIPID2_DOMAIN="${IN_MOSIPID2_DOMAIN:-$VAR_MOSIPID2_DOMAIN}" + if [ -z "$MOSIPID1_DOMAIN" ]; then + echo "❌ mosipid1_domain_name is required for standalone profiles" + exit 1 + fi + if [ "$IN_ENABLE_MOSIPID2" = "true" ] && + [ -z "$MOSIPID2_DOMAIN" ]; then + echo "❌ mosipid2_domain_name is required when enable_mosipid2 is true" + exit 1 + fi echo "✓ mosipid1_domain_name = $MOSIPID1_DOMAIN (esignet standalone)" echo "✓ mosipid2_domain_name = $MOSIPID2_DOMAIN (esignet standalone)" else - MOSIPID1_PROVIDED="${{ github.event.inputs.mosipid1_domain_name }}" - MOSIPID2_PROVIDED="${{ github.event.inputs.mosipid2_domain_name }}" + MOSIPID1_PROVIDED="$IN_MOSIPID1_DOMAIN" + MOSIPID2_PROVIDED="$IN_MOSIPID2_DOMAIN" if [ -n "$MOSIPID1_PROVIDED" ] || [ -n "$MOSIPID2_PROVIDED" ]; then echo "⚠ mosipid1_domain_name / mosipid2_domain_name are only used for esignet standalone profile — ignoring for profile=$PROFILE" fi diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 9ce3a8826..0deca2876 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -1,19 +1,19 @@ # ============================================================================= # eSignet Profile - eSignet Services DSF (Desired State File) # ============================================================================= -# This DSF deploys eSignet v1.7.1 services for the standalone eSignet profile. +# This DSF deploys eSignet 2.0.0 (Go) services for the standalone eSignet profile. # # Components (in priority order): # 1. Keycloak Init (eSignet-specific clients and roles) -# 2. eSignet service v1.7.1 -# 3. OIDC UI v1.7.1 +# 2. eSignet service 2.0.0-develop (Go) +# 3. OIDC UI 2.0.0-develop (Go) # 4. Mock Identity System (optional, disabled by default) # 5. Mock Relying Party Service (optional) # 6. Mock Relying Party UI (optional) # 7. Partner Onboarder (eSignet + Resident OIDC) # 8. Demo OIDC Partner Onboarder # -# Based on eSignet v1.7.1 deploy scripts: +# Based on eSignet 2.0.0 deploy scripts: # - install-esignet.sh # - initialise-prereq.sh (keycloak-init) # ============================================================================= diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml index f243acad9..b48741524 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml @@ -8,12 +8,12 @@ helmRepos: mosip: https://mosip.github.io/mosip-helm # Apitestrigs deploy into service namespaces (no dedicated testrig namespaces): -# esignet-apitestrig → esignet ns -# esignet-mosipid1-apitestrig → esignet-mosipid1 ns -# esignet-mosipid2-apitestrig → esignet-mosipid2 ns -# esignet-sunbird-apitestrig → esignet-sunbird ns -# esignet-signup-apitestrig → signup ns (disabled — enable if signup deployed) -# signup-uitestrig → signup-uitestrig (disabled — enable if signup deployed) +# esignet-apitestrig-go → esignet-go-mock ns +# esignet-go-mosipid1-apitestrig → esignet-go-mosipid1 ns +# esignet-go-mosipid2-apitestrig → esignet-go-mosipid2 ns +# esignet-go-sunbird-apitestrig → esignet-go-sunbird ns +# esignet-signup-apitestrig-go → signup-go ns (disabled — enable if signup deployed) +# signup-uitestrig-go → signup-uitestrig-go (disabled — enable if signup deployed) namespaces: esignet-go-mosipid1: protected: false @@ -212,7 +212,7 @@ apps: priority: -2 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh" - # postInstall: "$WORKDIR/hooks/esignet-standalone/trigger-test-jobs-esignet.sh" + # postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh" # --------------------------------------------------------------------------- # Signup API Test Rig — disabled by default diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh index adbdcadfb..14b70b216 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh @@ -1,19 +1,22 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet-MOSIPID1 API Testrig Pre-install Setup +# eSignet Standalone 2.0.0 - eSignet-MOSIPID1 API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-mosipid1 namespace for the esignet-mosipid1-apitestrig release. +# Prepares the esignet-mosipid1 namespace for the esignet-go-mosipid1-apitestrig release. # keycloak-host and keycloak-client-secrets are already present in esignet-mosipid1 -# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql -# needs to be copied; stale testrig CMs are deleted so the chart recreates them. +# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, +# and the s3-esignet-mosipid1-apitestrig / apitestrig-esignet-mosipid1-apitestrig +# secrets referenced by extraEnvVarsSecret are created here (chart doesn't create +# them itself); stale testrig CMs are deleted so the chart recreates them. # ============================================================================= set -euo pipefail NS=esignet-go-mosipid1 COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" +MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" echo "================================================" -echo "eSignet 1.7.1 - eSignet-MOSIPID1 API Testrig Pre-install" +echo "eSignet Standalone 2.0.0 - eSignet-MOSIPID1 API Testrig Pre-install" echo "================================================" echo "Deleting stale testrig configmaps in $NS" @@ -21,6 +24,15 @@ kubectl -n "$NS" delete --ignore-not-found=true configmap s3 kubectl -n "$NS" delete --ignore-not-found=true configmap db kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig +echo "Creating s3-esignet-mosipid1-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic s3-esignet-mosipid1-apitestrig \ + --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Creating apitestrig-esignet-mosipid1-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic apitestrig-esignet-mosipid1-apitestrig \ + --dry-run=client -o yaml | kubectl apply -f - + echo "Copying postgres-postgresql secret to $NS" $COPY_UTIL secret postgres-postgresql postgres "$NS" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh index bb5f2d9e2..072faec92 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh @@ -1,19 +1,22 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet-MOSIPID2 API Testrig Pre-install Setup +# eSignet Standalone 2.0.0 - eSignet-MOSIPID2 API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-mosipid2 namespace for the esignet-mosipid2-apitestrig release. +# Prepares the esignet-mosipid2 namespace for the esignet-go-mosipid2-apitestrig release. # keycloak-host and keycloak-client-secrets are already present in esignet-mosipid2 -# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql -# needs to be copied; stale testrig CMs are deleted so the chart recreates them. +# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, +# and the s3-esignet-mosipid2-apitestrig / apitestrig-esignet-mosipid2-apitestrig +# secrets referenced by extraEnvVarsSecret are created here (chart doesn't create +# them itself); stale testrig CMs are deleted so the chart recreates them. # ============================================================================= set -euo pipefail NS=esignet-go-mosipid2 COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" +MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" echo "================================================" -echo "eSignet 1.7.1 - eSignet-MOSIPID2 API Testrig Pre-install" +echo "eSignet Standalone 2.0.0 - eSignet-MOSIPID2 API Testrig Pre-install" echo "================================================" echo "Deleting stale testrig configmaps in $NS" @@ -21,6 +24,15 @@ kubectl -n "$NS" delete --ignore-not-found=true configmap s3 kubectl -n "$NS" delete --ignore-not-found=true configmap db kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig +echo "Creating s3-esignet-mosipid2-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic s3-esignet-mosipid2-apitestrig \ + --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Creating apitestrig-esignet-mosipid2-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic apitestrig-esignet-mosipid2-apitestrig \ + --dry-run=client -o yaml | kubectl apply -f - + echo "Copying postgres-postgresql secret to $NS" $COPY_UTIL secret postgres-postgresql postgres "$NS" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh index de0fb532e..ebd79e8e9 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh @@ -1,19 +1,22 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet API Testrig Pre-install Setup +# eSignet Standalone 2.0.0 - eSignet API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-mock namespace for the esignet-apitestrig release. +# Prepares the esignet-mock namespace for the esignet-apitestrig-go release. # keycloak-host and keycloak-client-secrets are already present in esignet-mock ns -# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql -# needs to be copied; stale testrig CMs are deleted so the chart recreates them. +# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, +# and the s3-esignet-apitestrig / apitestrig-esignet-apitestrig secrets referenced +# by extraEnvVarsSecret are created here (chart doesn't create them itself); stale +# testrig CMs are deleted so the chart recreates them. # ============================================================================= set -euo pipefail NS=esignet-go-mock COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" +MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" echo "================================================" -echo "eSignet 1.7.1 - eSignet API Testrig Pre-install" +echo "eSignet Standalone 2.0.0 - eSignet API Testrig Pre-install" echo "================================================" echo "Deleting stale testrig configmaps in $NS" @@ -21,6 +24,15 @@ kubectl -n "$NS" delete --ignore-not-found=true configmap s3 kubectl -n "$NS" delete --ignore-not-found=true configmap db kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig +echo "Creating s3-esignet-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic s3-esignet-apitestrig \ + --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Creating apitestrig-esignet-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic apitestrig-esignet-apitestrig \ + --dry-run=client -o yaml | kubectl apply -f - + echo "Copying postgres-postgresql secret to $NS" $COPY_UTIL secret postgres-postgresql postgres "$NS" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh index 1a58942ea..d7adbcca9 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh @@ -1,19 +1,22 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet-Sunbird API Testrig Pre-install Setup +# eSignet Standalone 2.0.0 - eSignet-Sunbird API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-sunbird namespace for the esignet-sunbird-apitestrig release. +# Prepares the esignet-sunbird namespace for the esignet-go-sunbird-apitestrig release. # keycloak-host and keycloak-client-secrets are already present in esignet-sunbird -# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql -# needs to be copied; stale testrig CMs are deleted so the chart recreates them. +# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, +# and the s3-esignet-sunbird-apitestrig / apitestrig-esignet-sunbird-apitestrig +# secrets referenced by extraEnvVarsSecret are created here (chart doesn't create +# them itself); stale testrig CMs are deleted so the chart recreates them. # ============================================================================= set -euo pipefail NS=esignet-go-sunbird COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" +MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" echo "================================================" -echo "eSignet 1.7.1 - eSignet-Sunbird API Testrig Pre-install" +echo "eSignet Standalone 2.0.0 - eSignet-Sunbird API Testrig Pre-install" echo "================================================" echo "Deleting stale testrig configmaps in $NS" @@ -21,6 +24,15 @@ kubectl -n "$NS" delete --ignore-not-found=true configmap s3 kubectl -n "$NS" delete --ignore-not-found=true configmap db kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig +echo "Creating s3-esignet-sunbird-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic s3-esignet-sunbird-apitestrig \ + --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Creating apitestrig-esignet-sunbird-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic apitestrig-esignet-sunbird-apitestrig \ + --dry-run=client -o yaml | kubectl apply -f - + echo "Copying postgres-postgresql secret to $NS" $COPY_UTIL secret postgres-postgresql postgres "$NS" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh index 938217c8c..60ef72d59 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh @@ -7,9 +7,9 @@ # with the secret key environment variable. # # Environment Variables: -# CAPTCHA_SITE_KEY - reCAPTCHA site key (REQUIRED) -# CAPTCHA_SECRET_KEY - reCAPTCHA secret key (REQUIRED) -# ESIGNET_NS - eSignet namespace (default: esignet) +# ESIGNET_CAPTCHA_SITE_KEY - reCAPTCHA site key (REQUIRED) +# ESIGNET_CAPTCHA_SECRET_KEY - reCAPTCHA secret key (REQUIRED) +# ESIGNET_NS - eSignet namespace (default: esignet-go-mock) # ============================================================================= set -euo pipefail diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh index bfeb5c619..f26e8ed56 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh @@ -18,23 +18,22 @@ JOB_STATUS=$(kubectl -n "$ESIGNET_NS" get jobs \ -l app.kubernetes.io/instance=esignet-misp-onboarder-go \ -o jsonpath='{.items[0].status.succeeded}' 2>/dev/null || echo "") -if [ "$JOB_STATUS" = "1" ]; then - echo "eSignet MISP partner onboarding completed successfully." -else +# Always restore namespace injection before returning from this hook. +kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite +echo "Istio injection re-enabled on namespace $ESIGNET_NS." + +if ! [[ "$JOB_STATUS" =~ ^[1-9][0-9]*$ ]]; then echo "WARNING: onboarding job may not have completed. Check logs:" kubectl -n "$ESIGNET_NS" logs -l app.kubernetes.io/instance=esignet-misp-onboarder-go --tail=30 2>/dev/null || true + exit 1 fi - -# Re-enable Istio sidecar injection now that the Job has completed -kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite -echo "Istio injection re-enabled on namespace $ESIGNET_NS." +echo "eSignet MISP partner onboarding completed successfully." # Restart config-server first so it reloads the MISP key from the secret, # then restart esignet so it fetches the updated config from config-server. if kubectl -n "$ESIGNET_NS" get deployment esignet-config-server-go &>/dev/null; then kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-config-server-go - kubectl -n "$ESIGNET_NS" rollout status deployment esignet-config-server-go --timeout=300s || \ - echo "WARNING: esignet-config-server-go rollout did not complete within timeout." >&2 + kubectl -n "$ESIGNET_NS" rollout status deployment esignet-config-server-go --timeout=300s echo "esignet-config-server-go restarted." else echo "esignet-config-server-go deployment not found — skipping restart." @@ -42,8 +41,7 @@ fi if kubectl -n "$ESIGNET_NS" get deployment esignet-go-mock &>/dev/null; then kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-go-mock - kubectl -n "$ESIGNET_NS" rollout status deployment esignet-go-mock --timeout=300s || \ - echo "WARNING: esignet rollout did not complete within timeout." >&2 + kubectl -n "$ESIGNET_NS" rollout status deployment esignet-go-mock --timeout=300s echo "esignet deployment restarted." else echo "esignet deployment not found — skipping restart." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh index 72baca851..e8dc9d7e8 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh @@ -26,6 +26,14 @@ kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply kubectl label namespace "$ESIGNET_NS" istio-injection=disabled --overwrite echo "Istio injection disabled on namespace $ESIGNET_NS." +restore_istio_injection_on_failure() { + local status=$? + if [ "$status" -ne 0 ]; then + kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite || true + fi +} +trap restore_istio_injection_on_failure EXIT + # Delete stale MISP onboarder artifacts from any previous run kubectl -n "$ESIGNET_NS" delete configmap esignet-onboarder-config --ignore-not-found=true kubectl -n "$ESIGNET_NS" delete secret esignet-onboarder-secrets --ignore-not-found=true diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh index 5651ce2b5..b4f4546ab 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh @@ -20,6 +20,15 @@ API_HOST="${MOSIP_API_HOST:-}" API_INTERNAL_HOST="${MOSIP_API_INTERNAL_HOST:-}" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" +if [ -z "$API_HOST" ]; then + echo "ERROR: MOSIP_API_HOST must be set" >&2 + exit 1 +fi +if [ -z "$API_INTERNAL_HOST" ]; then + echo "ERROR: MOSIP_API_INTERNAL_HOST must be set" >&2 + exit 1 +fi + echo "================================================" echo "eSignet 1.7.1 - Kernel Pre-install" echo "================================================" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh index 9d22608cd..8f006956d 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh @@ -1,13 +1,13 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Identity System DB Init Pre-install +# eSignet Standalone 2.0.0 - Mock Identity System DB Init Pre-install # ============================================================================= # Based on: esignet-mock-services/deploy/postgres/init_db.sh # Ensures postgres-postgresql secret is present in the esignet namespace # before postgres-init-mock-identity helm chart runs DB initialization. # # Environment Variables: -# ESIGNET_NS - eSignet namespace (default: esignet) +# ESIGNET_NS - eSignet namespace (default: esignet-go-mock) # ============================================================================= set -euo pipefail @@ -16,7 +16,7 @@ POSTGRES_NS="postgres" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" -echo "eSignet 1.7.1 - Mock Identity DB Init Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Identity DB Init Pre-install" echo "================================================" # --- Step 1: Ensure esignet namespace exists with istio --- diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh index da1b91802..4d51968bf 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Identity System Pre-install +# eSignet Standalone 2.0.0 - Mock Identity System Pre-install # ============================================================================= # Prepares esignet namespace for mock identity system deployment: # - Copies softhsm-mock-identity-system secret from softhsm ns @@ -8,8 +8,8 @@ # - Verifies softhsm-mock-identity-system-go-share ConfigMap is present # # Environment Variables: -# MOCKID_DB_NAME - Mock identity DB name (default: mosip_mockidentitysystem) -# MOCKID_DB_USER - Mock identity DB user (default: mockidentityuser) +# MOCKID_DB_NAME - Mock identity DB name (default: mosip_mockidentitysystem_go) +# MOCKID_DB_USER - Mock identity DB user (default: mockidentityuser_go) # MOCKID_DB_PORT - Postgres port (default: 5432) # ============================================================================= set -euo pipefail @@ -22,7 +22,7 @@ MOCKID_DB_PORT="${MOCKID_DB_PORT:-5432}" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" -echo "eSignet 1.7.1 - Mock Identity System Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Identity System Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh index 1847d2e5a..78db8d94c 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party Service MOSIPID1 Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party Service MOSIPID1 Pre-install # ============================================================================= # Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base mock-rp-service # preinstall (creates private key secrets in the target namespace). diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh index 069f92439..e6e8f3496 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party Service MOSIPID2 Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party Service MOSIPID2 Pre-install # ============================================================================= # Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base mock-rp-service # preinstall (creates private key secrets in the target namespace). diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh index 45b51adcd..f2736d682 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party Service Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party Service Pre-install # ============================================================================= # Creates K8s secrets for mock relying party private keys from GitHub Actions # environment secrets, then verifies the esignet service is running. @@ -25,7 +25,7 @@ cleanup_temp_files() { trap cleanup_temp_files EXIT INT TERM echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party Service Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Relying Party Service Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh index 7cb2fcbb6..74bc76ee2 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party Service Sunbird Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party Service Sunbird Pre-install # ============================================================================= # Wrapper: sets ESIGNET_NS=esignet-sunbird and delegates to base mock-rp-service # preinstall (creates private key secrets in the target namespace). diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh index dd6165071..eccf10272 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party UI MOSIPID1 Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID1 Pre-install # ============================================================================= # Ensures esignet-mosipid1 namespace exists and verifies mock-relying-party-service # is available in the esignet-mosipid1 namespace before UI deployment. @@ -10,7 +10,7 @@ set -euo pipefail ESIGNET_NS="esignet-go-mosipid1" echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID1 Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID1 Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh index 3734187c8..3c65bbbcc 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party UI MOSIPID2 Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID2 Pre-install # ============================================================================= # Ensures esignet-mosipid2 namespace exists and verifies mock-relying-party-service # is available in the esignet-mosipid2 namespace before UI deployment. @@ -10,7 +10,7 @@ set -euo pipefail ESIGNET_NS="esignet-go-mosipid2" echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID2 Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID2 Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh index 1340a045f..220b444ae 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh @@ -1,13 +1,13 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party UI Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party UI Pre-install # ============================================================================= # Prepares for mock relying party UI deployment. # ============================================================================= set -euo pipefail echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party UI Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Relying Party UI Pre-install" echo "================================================" # Ensure esignet namespace exists diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh index e1c066e06..9d37c849f 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party UI Sunbird Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party UI Sunbird Pre-install # ============================================================================= # Ensures esignet-sunbird namespace exists and verifies mock-relying-party-service # is available in the esignet-sunbird namespace before UI deployment. @@ -10,7 +10,7 @@ set -euo pipefail ESIGNET_NS="esignet-go-sunbird" echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party UI Sunbird Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Relying Party UI Sunbird Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh index 8277b1a8f..5bf32602a 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Notifier Post-install +# eSignet Standalone 2.0.0 - Notifier Post-install # ============================================================================= # Based on: esignet-signup/deploy/kernel/install.sh # Patches notifier deployment with SMS number length env vars after install. @@ -10,7 +10,7 @@ set -euo pipefail KERNEL_NS="kernel-go" echo "================================================" -echo "eSignet 1.7.1 - Notifier Post-install" +echo "eSignet Standalone 2.0.0 - Notifier Post-install" echo "================================================" # Source: deploy/kernel/install.sh - kubectl set env deployment/notifier diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh index fb19d5533..57aa055fa 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh @@ -1,6 +1,6 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - OIDC UI MOSIPID1 Pre-install +# eSignet Standalone 2.0.0 - OIDC UI MOSIPID1 Pre-install # ============================================================================= # Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base oidc-ui preinstall. # ============================================================================= diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh index 84be8071d..1b95fc1e7 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh @@ -64,7 +64,9 @@ if [[ -z "$ENV_VAR_EXISTS" ]]; then kubectl patch deployment -n captcha captcha --type='json' \ -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP_GO", "valueFrom": {"secretKeyRef": {"name": "signup-captcha-go", "key": "signup-captcha-secret-key"}}}}]' else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP_GO already exists." + echo "Restarting captcha to load the updated signup-go secret." + kubectl -n captcha rollout restart deployment/captcha + kubectl -n captcha rollout status deployment/captcha --timeout=480s fi # --- Step 5: Create signup-keystore secrets --- diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh index 2d02ce0cd..2818214bc 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh @@ -25,14 +25,12 @@ echo "Waiting for SoftHSM pod to be ready..." kubectl -n "$SOFTHSM_NS" wait --for=condition=ready pod -l app.kubernetes.io/instance=esignet-softhsm-go --timeout=480s || \ { echo "ERROR: SoftHSM pod not ready after timeout" >&2; exit 1; } -# --- Step 2: Copy esignet-softhsm-share configmap to esignet namespace --- -echo "Copying esignet-softhsm-share configmap to $ESIGNET_NS namespace" -$COPY_UTIL configmap esignet-softhsm-share "$SOFTHSM_NS" "$ESIGNET_NS" 2>/dev/null || \ - echo "WARNING: esignet-softhsm-share configmap not found in $SOFTHSM_NS" +# --- Step 2: Copy esignet-softhsm-go-share configmap to esignet namespace --- +echo "Copying esignet-softhsm-go-share configmap to $ESIGNET_NS namespace" +$COPY_UTIL configmap esignet-softhsm-go-share "$SOFTHSM_NS" "$ESIGNET_NS" # --- Step 3: Copy esignet-softhsm secret to esignet namespace --- echo "Copying esignet-softhsm-go secret to $ESIGNET_NS namespace" -$COPY_UTIL secret esignet-softhsm-go "$SOFTHSM_NS" "$ESIGNET_NS" 2>/dev/null || \ - echo "WARNING: esignet-softhsm-go secret not found in $SOFTHSM_NS" +$COPY_UTIL secret esignet-softhsm-go "$SOFTHSM_NS" "$ESIGNET_NS" echo "SoftHSM eSignet post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh b/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh index 58088c891..99884df6b 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh @@ -1,11 +1,11 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Trigger Testrig CronJobs +# eSignet Standalone 2.0.0 - Trigger Testrig CronJobs # ============================================================================= # Immediately triggers testrig CronJobs after deployment: -# apitestrig → esignet-mock ns (cronjob-apitestrig-esignet-mock) -# signup-apitestrig → signup ns (if deployed) -# signup-uitestrig → signup-uitestrig ns (if deployed) +# apitestrig → esignet-go-mock ns +# signup-apitestrig → signup-go ns (if deployed) +# signup-uitestrig → signup-uitestrig-go ns (if deployed) # ============================================================================= set -euo pipefail @@ -13,12 +13,35 @@ CONTINUE_ON_FAILURE="${CONTINUE_ON_FAILURE:-true}" JOB_TIMEOUT="${JOB_TIMEOUT:-5400}" OVERALL_SUCCESS=true +# Runs `kubectl "$@"`, printing stdout on success. +# Returns 0 on success, 2 for a genuine NotFound (caller should treat the +# resource as absent), or 1 with the error printed to stderr for any other +# kubectl failure (RBAC, credentials, API errors) so real problems aren't +# silently swallowed alongside the expected "doesn't exist" case. +kubectl_get() { + local output rc=0 + output=$(kubectl "$@" 2>&1) || rc=$? + if [[ $rc -eq 0 ]]; then + printf '%s' "$output" + return 0 + fi + if echo "$output" | grep -q '(NotFound)'; then + return 2 + fi + echo "✗ kubectl $* failed: $output" >&2 + return 1 +} + trigger_and_wait() { local ns=$1 cronjob=$2 - if ! kubectl get cronjob -n "$ns" "$cronjob" &>/dev/null; then + local rc=0 + kubectl_get get cronjob -n "$ns" "$cronjob" -o name >/dev/null || rc=$? + if [[ $rc -eq 2 ]]; then echo "⏭ CronJob $cronjob not found in $ns — skipping" return 0 + elif [[ $rc -ne 0 ]]; then + return 1 fi local job_name="${cronjob}-manual-$(date +%s)" @@ -27,10 +50,29 @@ trigger_and_wait() { local elapsed=0 while [[ $elapsed -lt $JOB_TIMEOUT ]]; do - local complete=$(kubectl get job -n "$ns" "$job_name" \ - -o jsonpath='{.status.conditions[?(@.type=="Complete")].status}' 2>/dev/null || echo "") - local failed=$(kubectl get job -n "$ns" "$job_name" \ - -o jsonpath='{.status.conditions[?(@.type=="Failed")].status}' 2>/dev/null || echo "") + local complete failed + rc=0 + complete=$(kubectl_get get job -n "$ns" "$job_name" \ + -o jsonpath='{.status.conditions[?(@.type=="Complete")].status}') || rc=$? + if [[ $rc -eq 2 ]]; then + echo " ⏳ $job_name not yet visible in $ns (${elapsed}s elapsed)..." + sleep 10 + elapsed=$((elapsed + 10)) + continue + elif [[ $rc -ne 0 ]]; then + return 1 + fi + rc=0 + failed=$(kubectl_get get job -n "$ns" "$job_name" \ + -o jsonpath='{.status.conditions[?(@.type=="Failed")].status}') || rc=$? + if [[ $rc -eq 2 ]]; then + echo " ⏳ $job_name not yet visible in $ns (${elapsed}s elapsed)..." + sleep 10 + elapsed=$((elapsed + 10)) + continue + elif [[ $rc -ne 0 ]]; then + return 1 + fi [[ "$complete" == "True" ]] && { echo "✓ $job_name completed successfully"; return 0; } [[ "$failed" == "True" ]] && { echo "✗ $job_name failed" >&2 @@ -48,8 +90,14 @@ trigger_and_wait() { trigger_all_in_ns() { local ns=$1 - local cronjobs - cronjobs=$(kubectl get cronjobs -n "$ns" -o jsonpath='{.items[*].metadata.name}' 2>/dev/null || echo "") + local cronjobs rc=0 + cronjobs=$(kubectl_get get cronjobs -n "$ns" -o jsonpath='{.items[*].metadata.name}') || rc=$? + if [[ $rc -eq 2 ]]; then + echo "⏭ No CronJobs found in $ns — skipping" + return 0 + elif [[ $rc -ne 0 ]]; then + return 1 + fi if [[ -z "$cronjobs" ]]; then echo "⏭ No CronJobs found in $ns — skipping" return 0 @@ -60,7 +108,7 @@ trigger_all_in_ns() { } echo "================================================" -echo "eSignet 1.7.1 - Trigger Testrig CronJobs" +echo "eSignet Standalone 2.0.0 - Trigger Testrig CronJobs" echo "================================================" echo "=== eSignet API Testrig (esignet-go-mock ns) ===" @@ -76,10 +124,10 @@ echo "=== eSignet-Sunbird API Testrig (esignet-go-sunbird ns) ===" trigger_all_in_ns esignet-go-sunbird || OVERALL_SUCCESS=false echo "=== Signup API Testrig (signup-go ns, if deployed) ===" -trigger_all_in_ns signup-go || true +trigger_all_in_ns signup-go || OVERALL_SUCCESS=false echo "=== Signup UI Testrig (signup-uitestrig-go ns, if deployed) ===" -trigger_all_in_ns signup-uitestrig-go || true +trigger_all_in_ns signup-uitestrig-go || OVERALL_SUCCESS=false echo "" echo "=== Testrig Execution Summary ===" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh index c4f7ccf45..102ff6a9c 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh @@ -1,8 +1,8 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Signup UI Testrig Pre-install Setup +# eSignet Standalone 2.0.0 - Signup UI Testrig Pre-install Setup # ============================================================================= -# Prepares the signup-uitestrig namespace. +# Prepares the signup-uitestrig-go namespace. # Copies keycloak resources from keycloak ns, MinIO s3 secret from minio ns, # and postgres-postgresql from postgres ns. # Stale uitestrig CMs are deleted so the chart recreates them from set: values. @@ -13,7 +13,7 @@ NS=signup-uitestrig-go COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" -echo "eSignet 1.7.1 - Signup UI Testrig Pre-install" +echo "eSignet Standalone 2.0.0 - Signup UI Testrig Pre-install" echo "================================================" echo "Ensuring $NS namespace exists with Istio injection disabled" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml index 409283736..7a48edd8f 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml @@ -135,7 +135,7 @@ extraEnvVarsAdditional: 'email', 'svg': 'email_icon', 'prefixes': '', 'postfix': '@email', 'maxLength': '', 'regex': '' {{ "}}" }} - name: LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT - value: DEBUG + value: INFO - name: MOSIP_ESIGNET_CAPTCHA_REQUIRED value: "false" - name: MOSIP_ESIGNET_CAPTCHA_URL diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml index 7c4890e12..9e5695a8e 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml @@ -135,7 +135,7 @@ extraEnvVarsAdditional: 'email', 'svg': 'email_icon', 'prefixes': '', 'postfix': '@email', 'maxLength': '', 'regex': '' {{ "}}" }} - name: LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT - value: DEBUG + value: INFO - name: MOSIP_ESIGNET_CAPTCHA_REQUIRED value: "" - name: MOSIP_ESIGNET_CAPTCHA_URL @@ -145,4 +145,3 @@ extraEnvVarsAdditional: secretKeyRef: name: esignet-misp-onboarder-key key: mosip-esignet-misp-key - diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml index 83c8dbd6c..b10407528 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml @@ -117,7 +117,6 @@ extraEnvVars: # prefix: /v1/esignet/ - # extraEnvVarsAdditional is a Helm list — this file REPLACES the base list on merge. # All required entries (captcha + plugin-specific) must be present together. diff --git a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md index 4340b2245..49bdb12ca 100644 --- a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md +++ b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md @@ -180,7 +180,7 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings | `MOSIPID2_KEYCLOAK_ADMIN_PASSWORD` | Keycloak admin password for the MOSIP-ID2 remote MOSIP environment *(only needed if mosipid2 is enabled)* | > ⚠️ `MOSIPID1_KEYCLOAK_ADMIN_PASSWORD` and `MOSIPID2_KEYCLOAK_ADMIN_PASSWORD` are the admin passwords of the **remote** MOSIP-ID1 and MOSIP-ID2 Keycloak instances (not the local one deployed by this stack). The preinstall hook calls those Keycloak REST APIs to fetch client secrets. A wrong domain or wrong password here will cause the preinstall to fail with a curl error. - +> > **`esignet-standalone-2.0.0` note:** All of the secrets above are **reused as-is** by `esignet-standalone-2.0.0` > — there are no separate `_GO`-suffixed GitHub secrets. Internally, the 2.0.0 hooks create differently-named > Kubernetes secrets (e.g. `esignet-captcha-go`, `esignet-captcha-go-mosipid1`) and patch differently-named env @@ -236,9 +236,10 @@ Step 3 → Deploy Signup (helmsman_signup.yml) ⚠️ IN PROGR Step 4 → Deploy Testrigs (optional) (helmsman_testrigs.yml) ~10 min profile: esignet-standalone or esignet-standalone-2.0.0 ``` -> Steps 2–4 accept either profile in their `profile` dropdown — pick `esignet-standalone-2.0.0` to deploy the -> Go-based instances instead of (or alongside) the v1.7.1 ones. Step 1 has no 2.0.0 option since both profiles -> share the same external infrastructure. +> Steps 2 and 4 accept either profile in their `profile` dropdown — pick `esignet-standalone-2.0.0` to deploy +> the Go-based instances instead of (or alongside) the v1.7.1 ones. Step 1 has no 2.0.0 option since both +> profiles share the same external infrastructure. Step 3's dropdown also lists `esignet-standalone-2.0.0`, +> but the step itself isn't usable yet for either profile — see the note below. --- @@ -356,9 +357,11 @@ Follow the full instructions in the root README: [Step 3ca: Observation Infrastr ![Deploy External Services - Helmsman](_images/helmsman-external-services.png) **How to know it succeeded:** Click into the running workflow. Wait for all jobs to show a green tick. Then run: + ```bash kubectl get pods -n postgres && kubectl get pods -n keycloak && kubectl get pods -n kafka ``` + All pods should show `Running` or `Completed`. --- @@ -390,6 +393,10 @@ All pods should show `Running` or `Completed`. > **Important:** Always tick `skip_mosip_dsf_check` for standalone eSignet — without it, the workflow waits for a `mosip-dsf=completed` namespace label that will never appear (there is no full MOSIP deployment in this mode), and the workflow will fail. +4. Click the green **`Run workflow`** button + +![Deploy eSignet - Helmsman](_images/esignet.png) + > **`esignet-standalone-2.0.0` note:** Selecting `esignet-standalone-2.0.0` runs `Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml` > instead — it deploys the same 4 instances (main/mock, mosipid1, mosipid2, sunbird) plus their OIDC UIs and mock > relying party service, but into `-go`-suffixed namespaces (`esignet-go-mock`, `esignet-go-mosipid1`, @@ -398,13 +405,10 @@ All pods should show `Running` or `Completed`. > `esignet-standalone`. You can run both profiles side by side in the same cluster — Step 1 only needs to be run > once, with `profile: esignet-standalone`. -4. Click the green **`Run workflow`** button - -![Deploy eSignet - Helmsman](_images/esignet.png) - **How to know it succeeded:** For `esignet-standalone`: + ```bash kubectl get pods -n esignet-mock && kubectl get pods -n esignet-mosipid1 && kubectl get pods -n esignet-sunbird # If enable_mosipid2 was set to true: @@ -412,6 +416,7 @@ kubectl get pods -n esignet-mosipid2 ``` For `esignet-standalone-2.0.0`: + ```bash kubectl get pods -n esignet-go-mock && kubectl get pods -n esignet-go-mosipid1 && kubectl get pods -n esignet-go-sunbird # If enable_mosipid2 was set to true: @@ -469,21 +474,21 @@ All pods should show `Running`. **How to know it succeeded:** The workflow log should show all Helmsman releases applied without errors. Verify that test cronjobs were created: For `esignet-standalone`: + ```bash kubectl get cronjobs -n esignet-mock kubectl get cronjobs -n esignet-mosipid1 kubectl get cronjobs -n esignet-mosipid2 kubectl get cronjobs -n esignet-sunbird -kubectl get cronjobs -n signup ``` For `esignet-standalone-2.0.0`: + ```bash kubectl get cronjobs -n esignet-go-mock kubectl get cronjobs -n esignet-go-mosipid1 kubectl get cronjobs -n esignet-go-mosipid2 kubectl get cronjobs -n esignet-go-sunbird -kubectl get cronjobs -n signup-go ``` --- @@ -564,11 +569,13 @@ Reference commit: [mosip/mosip-config@e8961a2](https://github.com/mosip/mosip-co The MOSIP Identity Authentication service restricts which domains can call its APIs. Edit `id-authentication-default.properties` in the MOSIP platform's `mosip-config` branch and add your eSignet standalone hostnames to `mosip.ida.allowed.domain.uris`: **For mosipid1 only:** + ```properties mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1. ``` **For both mosipid1 and mosipid2:** + ```properties mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1.,https://esignet-mosipid2. ``` @@ -577,11 +584,13 @@ Replace `` with your eSignet standalone base domain (e.g. `sandbox. > **`esignet-standalone-2.0.0` note:** Since `MOSIPID1_DOMAIN_NAME`/`MOSIPID2_DOMAIN_NAME` are shared between both > profiles (see [Section 0](#0-understanding-the-esignet-instances)), if you're running `esignet-mosipid1` (v1.7.1) -> and `esignet-go-mosipid1` (2.0.0) against the **same** remote MOSIP-ID1 environment, add **both** hostnames to -> `mosip.ida.allowed.domain.uris`: +> and `esignet-go-mosipid1` (2.0.0) against the **same** remote MOSIP-ID1 environment (and similarly for +> MOSIP-ID2), add **both** hostnames for each shared environment to `mosip.ida.allowed.domain.uris`: +> > ```properties -> mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1.,https://esignet-go-mosipid1. +> mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1.,https://esignet-go-mosipid1.,https://esignet-mosipid2.,https://esignet-go-mosipid2. > ``` +> > Otherwise, only add the hostname for whichever profile(s) you actually deployed. Reference commit: [mosip/mosip-config@27276cb](https://github.com/mosip/mosip-config/commit/27276cbb7fa01015492855baa3e00fe0a4db421c) diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars index a7cfa4290..98b68ff23 100644 --- a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars +++ b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars @@ -13,7 +13,7 @@ cluster_name = "" cluster_env_domain = "" # Email-ID will be used by certbot to notify SSL certificate expiry via email -mosip_email_id = " Date: Fri, 7 Aug 2026 17:50:36 +0530 Subject: [PATCH 20/61] fix: bind enable_mosipid2 to env in helmsman_esignet.yml, guard mosipid2 cronjob checks in docs - helmsman_esignet.yml: bind github.event.inputs.enable_mosipid2 to a step-level env var in the validate-inputs job's "Validate required variables" step instead of interpolating ${{ }} directly into the shell condition (same script-injection hardening pattern already applied to helmsman_testrigs.yml) - ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md: make the esignet-mosipid2 / esignet-go-mosipid2 CronJob verification commands conditional on enable_mosipid2, matching the pattern already used for the pods-check section earlier in the guide Signed-off-by: bhumi46 --- .github/workflows/helmsman_esignet.yml | 4 +++- docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md | 6 ++++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/helmsman_esignet.yml b/.github/workflows/helmsman_esignet.yml index d09e8d959..f2753edf1 100644 --- a/.github/workflows/helmsman_esignet.yml +++ b/.github/workflows/helmsman_esignet.yml @@ -71,6 +71,8 @@ jobs: name: ${{ github.ref_name }} steps: - name: Validate required variables + env: + IN_ENABLE_MOSIPID2: ${{ github.event.inputs.enable_mosipid2 }} run: | errors=() PROFILE="${{ github.event.inputs.profile }}" @@ -98,7 +100,7 @@ jobs: echo "❌ mosipid1_domain_name is required for standalone profiles" exit 1 fi - if [ "${{ github.event.inputs.enable_mosipid2 }}" = "true" ] && + if [ "$IN_ENABLE_MOSIPID2" = "true" ] && [ -z "$MOSIPID2_DOMAIN" ]; then echo "❌ mosipid2_domain_name is required when enable_mosipid2 is true" exit 1 diff --git a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md index 49bdb12ca..8d8e29d8d 100644 --- a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md +++ b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md @@ -478,8 +478,9 @@ For `esignet-standalone`: ```bash kubectl get cronjobs -n esignet-mock kubectl get cronjobs -n esignet-mosipid1 -kubectl get cronjobs -n esignet-mosipid2 kubectl get cronjobs -n esignet-sunbird +# If enable_mosipid2 was set to true: +kubectl get cronjobs -n esignet-mosipid2 ``` For `esignet-standalone-2.0.0`: @@ -487,8 +488,9 @@ For `esignet-standalone-2.0.0`: ```bash kubectl get cronjobs -n esignet-go-mock kubectl get cronjobs -n esignet-go-mosipid1 -kubectl get cronjobs -n esignet-go-mosipid2 kubectl get cronjobs -n esignet-go-sunbird +# If enable_mosipid2 was set to true: +kubectl get cronjobs -n esignet-go-mosipid2 ``` --- From 1f8713ac4793ac33e0254dda8c1269e17f0b1188 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Sat, 15 Aug 2026 14:30:47 +0530 Subject: [PATCH 21/61] fix: convert esignet-standalone-2.0.0 extraEnvVars/extraEnvVarsAdditional to maps Matches the chart-side list-to-map conversion (mosip/esignet#2380, mosip/esignet-mock-services#602): Helm deep-merges map keys across values layers but replaces lists wholesale. Converts all 6 profile override files (esignet base/sunbird/mosipid1/mosipid2 plugin values, mock-identity, mock-relying-party) from list to map format, preserving every entry including the Helmsman-escaped Handlebars template value in MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS (verified byte-identical via diff, and re-rendered against the real charts to confirm no index-keyed garbage and correct final output). Also updates a stale comment describing the old list-replace merge semantics. NOTE: requires the esignet/mock-identity-system/mock-relying-party chart PRs to be merged and republished before this is deployed - until then the charts still expect lists and this would break. Signed-off-by: bhumi46 --- .../esignet-mosipid1-plugin-values-2-0-0.yaml | 103 ++++++--------- .../esignet-mosipid2-plugin-values-2-0-0.yaml | 111 +++++++--------- .../esignet-plugin-values-2-0-0.yaml | 118 +++++++----------- .../esignet-sunbird-plugin-values-2-0-0.yaml | 83 +++++------- .../mock-identity-values-2-0-0.yaml | 24 ++-- .../mock-replying-party.yaml | 19 ++- 6 files changed, 176 insertions(+), 282 deletions(-) diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml index 7a48edd8f..af9553846 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml @@ -4,83 +4,72 @@ # Override full extraEnvVars to use namespace-specific softhsm secret name. extraEnvVars: - - name: KEYCLOAK_EXTERNAL_URL + KEYCLOAK_EXTERNAL_URL: valueFrom: configMapKeyRef: name: keycloak-host key: keycloak-external-url - - name: REDIS_HOST + REDIS_HOST: valueFrom: configMapKeyRef: name: redis-config key: redis-host - - name: REDIS_PORT + REDIS_PORT: valueFrom: configMapKeyRef: name: redis-config key: redis-port - - name: REDIS_PASSWORD + REDIS_PASSWORD: valueFrom: secretKeyRef: name: redis key: redis-password - - name: DATABASE_HOST + DATABASE_HOST: valueFrom: configMapKeyRef: name: postgres-config key: database-host - - name: DATABASE_PORT + DATABASE_PORT: valueFrom: configMapKeyRef: name: postgres-config key: database-port - - name: DATABASE_NAME + DATABASE_NAME: valueFrom: configMapKeyRef: name: postgres-config key: database-name - - name: DATABASE_USERNAME + DATABASE_USERNAME: valueFrom: configMapKeyRef: name: postgres-config key: database-username - - name: DB_DBUSER_PASSWORD + DB_DBUSER_PASSWORD: valueFrom: secretKeyRef: name: db-common-secrets key: db-dbuser-password - - name: SOFTHSM_ESIGNET_SECURITY_PIN + SOFTHSM_ESIGNET_SECURITY_PIN: valueFrom: secretKeyRef: name: esignet-softhsm-go-mosipid1 key: security-pin - - name: MOSIP_IDA_CLIENT_SECRET + MOSIP_IDA_CLIENT_SECRET: valueFrom: secretKeyRef: name: keycloak-client-secrets-mosipid1 key: mosip_ida_client_secret - - name: AUTHN_PROVIDER - value: mosip - - name: KEYMANAGER_DB_SCHEMA - value: esignet - - name: KEYMANAGER_KEYSTORE_TYPE - value: PKCS12 - - name: KEYMANAGER_PKCS12_FILE_PATH - value: /home/mosip/keys/secret/mosipid1.pfx - - name: OIDC_UI_SCHEME - value: https - - name: OIDC_UI_PORT - value: '443' - - name: OIDC_UI_LOGIN_PATH - value: /signin - - name: OIDC_UI_ERROR_PATH - value: /error - - name: DEFAULT_THEME_ID - value: decl-theme-1 - - name: DEFAULT_LAYOUT_ID - value: decl-layout-1 - - name: DEFAULT_AUTH_FLOW_ID - value: decl-mosip-otp-flow-1 + AUTHN_PROVIDER: mosip + KEYMANAGER_DB_SCHEMA: esignet + KEYMANAGER_KEYSTORE_TYPE: PKCS12 + KEYMANAGER_PKCS12_FILE_PATH: /home/mosip/keys/secret/mosipid1.pfx + OIDC_UI_SCHEME: https + OIDC_UI_PORT: '443' + OIDC_UI_LOGIN_PATH: /signin + OIDC_UI_ERROR_PATH: /error + DEFAULT_THEME_ID: decl-theme-1 + DEFAULT_LAYOUT_ID: decl-layout-1 + DEFAULT_AUTH_FLOW_ID: decl-mosip-otp-flow-1 extraEnvVarsSecret: - esignet-keystore-go-mosipid1 extraVolumes: @@ -91,9 +80,8 @@ extraVolumeMounts: - name: esignet-keystore-go-mosipid1 mountPath: /home/mosip/keys/secret extraEnvVarsAdditional: - - name: "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME" - value: "esignetgomosipid1" - - name: "MOSIP_ESIGNET_CAPTCHA_SITE-KEY" + "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME": "esignetgomosipid1" + "MOSIP_ESIGNET_CAPTCHA_SITE-KEY": valueFrom: secretKeyRef: name: esignet-captcha-go-mosipid1 @@ -103,27 +91,17 @@ extraEnvVarsAdditional: # Plugin 2: mosip-identity-plugin # Update URLs to match your MOSIP IDA deployment. # --------------------------------------------------------------------------- - - name: NAMESPACE - value: mosipid1 - - name: plugin_name_env - value: mosip-identity-plugin.jar - - name: SPRING_KAFKA_CONSUMER_GROUP_ID - value: esignet-consumer-esignet-mosipid1 - - name: MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE - value: esignet-mosipid1-signup-esqa020 - - name: MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS - value: email,phone - - name: MOSIP_ESIGNET_SEND_OTP_ATTEMPTS - value: '300' - - name: MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS - value: '300' - - name: MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS - value: '600' - - name: MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS - value: '600' - - name: MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX - value: '@phone' - - name: MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS + NAMESPACE: mosipid1 + plugin_name_env: mosip-identity-plugin.jar + SPRING_KAFKA_CONSUMER_GROUP_ID: esignet-consumer-esignet-mosipid1 + MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE: esignet-mosipid1-signup-esqa020 + MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS: email,phone + MOSIP_ESIGNET_SEND_OTP_ATTEMPTS: '300' + MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: '300' + MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS: '600' + MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS: '600' + MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX: '@phone' + MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS: value: >- {{ "{{" }} 'id': 'mobile', 'svg': 'mobile_icon', 'prefixes': {{ "{{" }}'label': 'IND', 'value': '+91', 'maxLength': '', 'regex': ''},{'label': @@ -134,13 +112,10 @@ extraEnvVarsAdditional: '', 'postfix': '', 'maxLength': '', 'regex': '' }, { 'id': 'email', 'svg': 'email_icon', 'prefixes': '', 'postfix': '@email', 'maxLength': '', 'regex': '' {{ "}}" }} - - name: LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT - value: INFO - - name: MOSIP_ESIGNET_CAPTCHA_REQUIRED - value: "false" - - name: MOSIP_ESIGNET_CAPTCHA_URL - value: http://captcha.captcha - - name: "MOSIP_ESIGNET_MISP_KEY" + LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT: INFO + MOSIP_ESIGNET_CAPTCHA_REQUIRED: "false" + MOSIP_ESIGNET_CAPTCHA_URL: http://captcha.captcha + "MOSIP_ESIGNET_MISP_KEY": valueFrom: secretKeyRef: name: esignet-misp-onboarder-key diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml index 9e5695a8e..ccb5f2dab 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml @@ -4,96 +4,82 @@ # Override full extraEnvVars to use namespace-specific softhsm secret name. extraEnvVars: - - name: KEYCLOAK_EXTERNAL_URL + KEYCLOAK_EXTERNAL_URL: valueFrom: configMapKeyRef: name: keycloak-host key: keycloak-external-url - - name: REDIS_HOST + REDIS_HOST: valueFrom: configMapKeyRef: name: redis-config key: redis-host - - name: REDIS_PORT + REDIS_PORT: valueFrom: configMapKeyRef: name: redis-config key: redis-port - - name: REDIS_PASSWORD + REDIS_PASSWORD: valueFrom: secretKeyRef: name: redis key: redis-password - - name: DATABASE_HOST + DATABASE_HOST: valueFrom: configMapKeyRef: name: postgres-config key: database-host - - name: DATABASE_PORT + DATABASE_PORT: valueFrom: configMapKeyRef: name: postgres-config key: database-port - - name: DATABASE_NAME + DATABASE_NAME: valueFrom: configMapKeyRef: name: postgres-config key: database-name - - name: DATABASE_USERNAME + DATABASE_USERNAME: valueFrom: configMapKeyRef: name: postgres-config key: database-username - - name: DB_DBUSER_PASSWORD + DB_DBUSER_PASSWORD: valueFrom: secretKeyRef: name: db-common-secrets key: db-dbuser-password - - name: SOFTHSM_ESIGNET_SECURITY_PIN + SOFTHSM_ESIGNET_SECURITY_PIN: valueFrom: secretKeyRef: name: esignet-softhsm-go-mosipid2 key: security-pin - - name: MOSIP_IDA_CLIENT_SECRET + MOSIP_IDA_CLIENT_SECRET: valueFrom: secretKeyRef: name: keycloak-client-secrets-mosipid2 key: mosip_ida_client_secret - - name: AUTHN_PROVIDER - value: mosip - - name: KEYMANAGER_DB_SCHEMA - value: esignet - - name: KEYMANAGER_KEYSTORE_TYPE - value: PKCS11 - - name: KEYMANAGER_PKCS11_MODULE_PATH - value: /usr/lib/softhsm/libsofthsm2.so - - name: KEYMANAGER_PKCS11_TOKEN_LABEL - value: esignet - - name: KEYMANAGER_PKCS11_SLOT_ID - value: "0" - - name: KEYMANAGER_PKCS11_PIN + AUTHN_PROVIDER: mosip + KEYMANAGER_DB_SCHEMA: esignet + KEYMANAGER_KEYSTORE_TYPE: PKCS11 + KEYMANAGER_PKCS11_MODULE_PATH: /usr/lib/softhsm/libsofthsm2.so + KEYMANAGER_PKCS11_TOKEN_LABEL: esignet + KEYMANAGER_PKCS11_SLOT_ID: "0" + KEYMANAGER_PKCS11_PIN: valueFrom: secretKeyRef: name: esignet-softhsm-go-mosipid2 key: security-pin - - name: OIDC_UI_SCHEME - value: https - - name: OIDC_UI_PORT - value: '443' - - name: OIDC_UI_LOGIN_PATH - value: /signin - - name: OIDC_UI_ERROR_PATH - value: /error - - name: DEFAULT_THEME_ID - value: decl-theme-1 - - name: DEFAULT_LAYOUT_ID - value: decl-layout-1 - - name: DEFAULT_AUTH_FLOW_ID - value: decl-mosip-otp-flow-1 + OIDC_UI_SCHEME: https + OIDC_UI_PORT: '443' + OIDC_UI_LOGIN_PATH: /signin + OIDC_UI_ERROR_PATH: /error + DEFAULT_THEME_ID: decl-theme-1 + DEFAULT_LAYOUT_ID: decl-layout-1 + DEFAULT_AUTH_FLOW_ID: decl-mosip-otp-flow-1 extraEnvVarsAdditional: - - name: "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME" - value: "esignetgomosipid2" - - name: "MOSIP_ESIGNET_CAPTCHA_SITE-KEY" + "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME": "esignetgomosipid2" + "MOSIP_ESIGNET_CAPTCHA_SITE-KEY": valueFrom: secretKeyRef: name: esignet-captcha-go-mosipid2 @@ -103,27 +89,17 @@ extraEnvVarsAdditional: # Plugin 2: mosip-identity-plugin # Update URLs to match your MOSIP IDA deployment. # --------------------------------------------------------------------------- - - name: NAMESPACE - value: mosipid2 - - name: plugin_name_env - value: mosip-identity-plugin.jar - - name: SPRING_KAFKA_CONSUMER_GROUP_ID - value: esignet-consumer-esignet-mosipid2 - - name: MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE - value: esignet-mosipid2-signup-esqa020 - - name: MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS - value: email,phone - - name: MOSIP_ESIGNET_SEND_OTP_ATTEMPTS - value: '300' - - name: MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS - value: '300' - - name: MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS - value: '600' - - name: MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS - value: '600' - - name: MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX - value: '@phone' - - name: MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS + NAMESPACE: mosipid2 + plugin_name_env: mosip-identity-plugin.jar + SPRING_KAFKA_CONSUMER_GROUP_ID: esignet-consumer-esignet-mosipid2 + MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE: esignet-mosipid2-signup-esqa020 + MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS: email,phone + MOSIP_ESIGNET_SEND_OTP_ATTEMPTS: '300' + MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: '300' + MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS: '600' + MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS: '600' + MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX: '@phone' + MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS: value: >- {{ "{{" }} 'id': 'mobile', 'svg': 'mobile_icon', 'prefixes': {{ "{{" }}'label': 'IND', 'value': '+91', 'maxLength': '', 'regex': ''},{'label': @@ -134,13 +110,10 @@ extraEnvVarsAdditional: '', 'postfix': '', 'maxLength': '', 'regex': '' }, { 'id': 'email', 'svg': 'email_icon', 'prefixes': '', 'postfix': '@email', 'maxLength': '', 'regex': '' {{ "}}" }} - - name: LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT - value: INFO - - name: MOSIP_ESIGNET_CAPTCHA_REQUIRED - value: "" - - name: MOSIP_ESIGNET_CAPTCHA_URL - value: http://captcha.captcha - - name: "MOSIP_ESIGNET_MISP_KEY" + LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT: INFO + MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" + MOSIP_ESIGNET_CAPTCHA_URL: http://captcha.captcha + "MOSIP_ESIGNET_MISP_KEY": valueFrom: secretKeyRef: name: esignet-misp-onboarder-key diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml index b10407528..44beb2993 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml @@ -11,99 +11,85 @@ extraEnvVars: - - name: KEYCLOAK_EXTERNAL_URL + KEYCLOAK_EXTERNAL_URL: valueFrom: configMapKeyRef: name: keycloak-host key: keycloak-external-url - - name: MOSIP_ESIGNET_CAPTCHA_SITE_KEY + MOSIP_ESIGNET_CAPTCHA_SITE_KEY: valueFrom: secretKeyRef: name: esignet-captcha-go key: esignet-captcha-site-key - - name: MOSIP_ESIGNET_CAPTCHA_MODULE_NAME - value: esignetgo - - name: REDIS_HOST + MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: esignetgo + REDIS_HOST: valueFrom: configMapKeyRef: name: redis-config key: redis-host - - name: REDIS_PORT + REDIS_PORT: valueFrom: configMapKeyRef: name: redis-config key: redis-port - - name: REDIS_PASSWORD + REDIS_PASSWORD: valueFrom: secretKeyRef: name: redis key: redis-password - - name: DATABASE_HOST + DATABASE_HOST: valueFrom: configMapKeyRef: name: postgres-config key: database-host - - name: DATABASE_PORT + DATABASE_PORT: valueFrom: configMapKeyRef: name: postgres-config key: database-port - - name: DATABASE_NAME + DATABASE_NAME: valueFrom: configMapKeyRef: name: postgres-config key: database-name - - name: DATABASE_USERNAME + DATABASE_USERNAME: valueFrom: configMapKeyRef: name: postgres-config key: database-username - - name: DB_DBUSER_PASSWORD + DB_DBUSER_PASSWORD: valueFrom: secretKeyRef: name: db-common-secrets key: db-dbuser-password - - name: SOFTHSM_ESIGNET_SECURITY_PIN + SOFTHSM_ESIGNET_SECURITY_PIN: valueFrom: secretKeyRef: name: esignet-softhsm-go key: security-pin - - name: MOSIP_IDA_CLIENT_SECRET + MOSIP_IDA_CLIENT_SECRET: valueFrom: secretKeyRef: name: keycloak-client-secrets key: mosip_ida_client_secret - - name: AUTHN_PROVIDER - value: mosip - - name: KEYMANAGER_DB_SCHEMA - value: esignet - - name: KEYMANAGER_KEYSTORE_TYPE - value: PKCS11 - - name: KEYMANAGER_PKCS11_MODULE_PATH - value: /usr/lib/softhsm/libsofthsm2.so - - name: KEYMANAGER_PKCS11_TOKEN_LABEL - value: esignet - - name: KEYMANAGER_PKCS11_SLOT_ID - value: "0" - - name: KEYMANAGER_PKCS11_PIN + AUTHN_PROVIDER: mosip + KEYMANAGER_DB_SCHEMA: esignet + KEYMANAGER_KEYSTORE_TYPE: PKCS11 + KEYMANAGER_PKCS11_MODULE_PATH: /usr/lib/softhsm/libsofthsm2.so + KEYMANAGER_PKCS11_TOKEN_LABEL: esignet + KEYMANAGER_PKCS11_SLOT_ID: "0" + KEYMANAGER_PKCS11_PIN: valueFrom: secretKeyRef: name: esignet-softhsm-go key: security-pin - - name: OIDC_UI_SCHEME - value: https - - name: OIDC_UI_PORT - value: '443' - - name: OIDC_UI_LOGIN_PATH - value: /signin - - name: OIDC_UI_ERROR_PATH - value: /error - - name: DEFAULT_THEME_ID - value: decl-theme-1 - - name: DEFAULT_LAYOUT_ID - value: decl-layout-1 - - name: DEFAULT_AUTH_FLOW_ID - value: decl-mosip-otp-flow-1 + OIDC_UI_SCHEME: https + OIDC_UI_PORT: '443' + OIDC_UI_LOGIN_PATH: /signin + OIDC_UI_ERROR_PATH: /error + DEFAULT_THEME_ID: decl-theme-1 + DEFAULT_LAYOUT_ID: decl-layout-1 + DEFAULT_AUTH_FLOW_ID: decl-mosip-otp-flow-1 # extraEnvVarsCM: # - esignet-softhsm-share @@ -117,18 +103,17 @@ extraEnvVars: # prefix: /v1/esignet/ -# extraEnvVarsAdditional is a Helm list — this file REPLACES the base list on merge. -# All required entries (captcha + plugin-specific) must be present together. +# extraEnvVarsAdditional is a map — entries here deep-merge with the chart's own +# defaults key-by-key, so only the entries that differ need to be listed here. extraEnvVarsAdditional: # Captcha site key — from esignet-captcha secret (deployed by external-dsf) - - name: "MOSIP_ESIGNET_CAPTCHA_SITE_KEY" + "MOSIP_ESIGNET_CAPTCHA_SITE_KEY": valueFrom: secretKeyRef: name: esignet-captcha-go key: esignet-captcha-site-key - - name: "MOSIP_ESIGNET_CAPTCHA_REQUIRED" - value: "" + "MOSIP_ESIGNET_CAPTCHA_REQUIRED": "" # --------------------------------------------------------------------------- # Plugin 2: mosip-identity-plugin @@ -136,25 +121,16 @@ extraEnvVarsAdditional: # Update URLs to match your MOSIP IDA deployment if the defaults don't apply. # --------------------------------------------------------------------------- # - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL" - # value: "http://mosip-file-server.mosip-file-server/mosip-certs/ida-partner.cer" - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_KYC-AUTH-URL" - # value: "http://ida-auth.ida/idauthentication/v1/kyc-auth/delegated/${mosip.esignet.authenticator.ida.misp-license-key}/" - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_KYC-EXCHANGE-URL" - # value: "http://ida-auth.ida/idauthentication/v1/kyc-exchange/delegated/${mosip.esignet.authenticator.ida.misp-license-key}/" - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_SEND-OTP-URL" - # value: "http://ida-otp.ida/idauthentication/v1/otp/${mosip.esignet.authenticator.ida.misp-license-key}/" - # - name: "MOSIP_ESIGNET_BINDER_IDA_KEY-BINDING-URL" - # value: "http://ida-auth.ida/idauthentication/v1/identity-key-binding/delegated/${mosip.esignet.authenticator.ida.misp-license-key}/" - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_GET-CERTIFICATES-URL" - # value: "http://ida-internal.ida/idauthentication/v1/internal/getAllCertificates" - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH-TOKEN-URL" - # value: "http://authmanager.kernel/v1/authmanager/authenticate/clientidsecretkey" - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT-MANAGER-URL" - # value: "http://auditmanager.kernel/v1/auditmanager/audits" - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP-CHANNELS" - # value: "email,phone" - # - name: "MOSIP_ESIGNET_MISP_KEY" + # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL": "http://mosip-file-server.mosip-file-server/mosip-certs/ida-partner.cer" + # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_KYC-AUTH-URL": "http://ida-auth.ida/idauthentication/v1/kyc-auth/delegated/${mosip.esignet.authenticator.ida.misp-license-key}/" + # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_KYC-EXCHANGE-URL": "http://ida-auth.ida/idauthentication/v1/kyc-exchange/delegated/${mosip.esignet.authenticator.ida.misp-license-key}/" + # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_SEND-OTP-URL": "http://ida-otp.ida/idauthentication/v1/otp/${mosip.esignet.authenticator.ida.misp-license-key}/" + # "MOSIP_ESIGNET_BINDER_IDA_KEY-BINDING-URL": "http://ida-auth.ida/idauthentication/v1/identity-key-binding/delegated/${mosip.esignet.authenticator.ida.misp-license-key}/" + # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_GET-CERTIFICATES-URL": "http://ida-internal.ida/idauthentication/v1/internal/getAllCertificates" + # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH-TOKEN-URL": "http://authmanager.kernel/v1/authmanager/authenticate/clientidsecretkey" + # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT-MANAGER-URL": "http://auditmanager.kernel/v1/auditmanager/audits" + # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP-CHANNELS": "email,phone" + # "MOSIP_ESIGNET_MISP_KEY": # valueFrom: # secretKeyRef: # name: esignet-misp-onboarder-key @@ -166,11 +142,7 @@ extraEnvVarsAdditional: # Set MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL to your Sunbird registry host. # --------------------------------------------------------------------------- # - # - name: "MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL" - # value: "https://your-sunbird-registry-host" - # - name: "MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL" - # value: "https://your-sunbird-registry-host/api/v1/Insurance/search" - # - name: "MOSIP_ESIGNET_INTEGRATION_AUDIT_PLUGIN" - # value: "LoggerAuditService" - # - name: "MOSIP_ESIGNET_INTEGRATION_KEY_BINDER" - # value: "NoOpKeyBinder" + # "MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL": "https://your-sunbird-registry-host" + # "MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL": "https://your-sunbird-registry-host/api/v1/Insurance/search" + # "MOSIP_ESIGNET_INTEGRATION_AUDIT_PLUGIN": "LoggerAuditService" + # "MOSIP_ESIGNET_INTEGRATION_KEY_BINDER": "NoOpKeyBinder" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml index 80ec0bb63..3b13c1508 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml @@ -4,113 +4,94 @@ # Override full extraEnvVars to use namespace-specific softhsm secret name. extraEnvVars: - - name: KEYCLOAK_EXTERNAL_URL + KEYCLOAK_EXTERNAL_URL: valueFrom: configMapKeyRef: name: keycloak-host key: keycloak-external-url - - name: MOSIP_ESIGNET_CAPTCHA_MODULE_NAME - value: esignetgosunbird - - name: REDIS_HOST + MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: esignetgosunbird + REDIS_HOST: valueFrom: configMapKeyRef: name: redis-config key: redis-host - - name: REDIS_PORT + REDIS_PORT: valueFrom: configMapKeyRef: name: redis-config key: redis-port - - name: REDIS_PASSWORD + REDIS_PASSWORD: valueFrom: secretKeyRef: name: redis key: redis-password - - name: DATABASE_HOST + DATABASE_HOST: valueFrom: configMapKeyRef: name: postgres-config key: database-host - - name: DATABASE_PORT + DATABASE_PORT: valueFrom: configMapKeyRef: name: postgres-config key: database-port - - name: DATABASE_NAME + DATABASE_NAME: valueFrom: configMapKeyRef: name: postgres-config key: database-name - - name: DATABASE_USERNAME + DATABASE_USERNAME: valueFrom: configMapKeyRef: name: postgres-config key: database-username - - name: DB_DBUSER_PASSWORD + DB_DBUSER_PASSWORD: valueFrom: secretKeyRef: name: db-common-secrets key: db-dbuser-password - - name: SOFTHSM_ESIGNET_SECURITY_PIN + SOFTHSM_ESIGNET_SECURITY_PIN: valueFrom: secretKeyRef: name: esignet-softhsm-go-sunbird key: security-pin - - name: MOSIP_IDA_CLIENT_SECRET + MOSIP_IDA_CLIENT_SECRET: valueFrom: secretKeyRef: name: keycloak-client-secrets key: mosip_ida_client_secret - - name: AUTHN_PROVIDER - value: mosip - - name: KEYMANAGER_DB_SCHEMA - value: esignet - - name: KEYMANAGER_KEYSTORE_TYPE - value: PKCS11 - - name: KEYMANAGER_PKCS11_MODULE_PATH - value: /usr/lib/softhsm/libsofthsm2.so - - name: KEYMANAGER_PKCS11_TOKEN_LABEL - value: esignet - - name: KEYMANAGER_PKCS11_SLOT_ID - value: "0" - - name: KEYMANAGER_PKCS11_PIN + AUTHN_PROVIDER: mosip + KEYMANAGER_DB_SCHEMA: esignet + KEYMANAGER_KEYSTORE_TYPE: PKCS11 + KEYMANAGER_PKCS11_MODULE_PATH: /usr/lib/softhsm/libsofthsm2.so + KEYMANAGER_PKCS11_TOKEN_LABEL: esignet + KEYMANAGER_PKCS11_SLOT_ID: "0" + KEYMANAGER_PKCS11_PIN: valueFrom: secretKeyRef: name: esignet-softhsm-go-sunbird key: security-pin - - name: OIDC_UI_SCHEME - value: https - - name: OIDC_UI_PORT - value: '443' - - name: OIDC_UI_LOGIN_PATH - value: /signin - - name: OIDC_UI_ERROR_PATH - value: /error - - name: DEFAULT_THEME_ID - value: decl-theme-1 - - name: DEFAULT_LAYOUT_ID - value: decl-layout-1 - - name: DEFAULT_AUTH_FLOW_ID - value: decl-mosip-otp-flow-1 + OIDC_UI_SCHEME: https + OIDC_UI_PORT: '443' + OIDC_UI_LOGIN_PATH: /signin + OIDC_UI_ERROR_PATH: /error + DEFAULT_THEME_ID: decl-theme-1 + DEFAULT_LAYOUT_ID: decl-layout-1 + DEFAULT_AUTH_FLOW_ID: decl-mosip-otp-flow-1 extraEnvVarsAdditional: - - name: "MOSIP_ESIGNET_CAPTCHA_SITE_KEY" + "MOSIP_ESIGNET_CAPTCHA_SITE_KEY": valueFrom: secretKeyRef: name: esignet-captcha-go-sunbird key: esignet-captcha-site-key - - name: "MOSIP_ESIGNET_CAPTCHA_REQUIRED" - value: "" + "MOSIP_ESIGNET_CAPTCHA_REQUIRED": "" # --------------------------------------------------------------------------- # Plugin 3: sunbird-rc-plugin # Update URLs to match your Sunbird RC registry deployment. # --------------------------------------------------------------------------- - - name: "MOSIP_ESIGNET_INTEGRATION_AUDIT_PLUGIN" - value: "LoggerAuditService" - - name: "MOSIP_ESIGNET_INTEGRATION_KEY_BINDER" - value: "NoOpKeyBinder" - - name: MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS - value: '300' - - name: MOSIP_ESIGNET_AUTHENTICATOR_DEFAULT_AUTH_FACTOR_KBI_INDIVIDUAL_ID_FIELD - value: "policyNumber" + "MOSIP_ESIGNET_INTEGRATION_AUDIT_PLUGIN": "LoggerAuditService" + "MOSIP_ESIGNET_INTEGRATION_KEY_BINDER": "NoOpKeyBinder" + MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: '300' + MOSIP_ESIGNET_AUTHENTICATOR_DEFAULT_AUTH_FACTOR_KBI_INDIVIDUAL_ID_FIELD: "policyNumber" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml index 1cbf9dc1e..daeb84499 100755 --- a/Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml @@ -1,49 +1,47 @@ extraEnvVars: - - name: DATABASE_HOST + DATABASE_HOST: valueFrom: configMapKeyRef: name: mockid-postgres-config key: database-host - - name: DATABASE_PORT + DATABASE_PORT: valueFrom: configMapKeyRef: name: mockid-postgres-config key: database-port - - name: DATABASE_NAME + DATABASE_NAME: valueFrom: configMapKeyRef: name: mockid-postgres-config key: database-name - - name: DATABASE_USERNAME + DATABASE_USERNAME: valueFrom: configMapKeyRef: name: mockid-postgres-config key: database-username - - name: DB_DBUSER_PASSWORD + DB_DBUSER_PASSWORD: valueFrom: secretKeyRef: name: db-common-secrets key: db-dbuser-password - - name: SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN + SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN: valueFrom: secretKeyRef: name: softhsm-mock-identity-system-go key: security-pin - - name: hsm_local_dir_name - value: hsm-client - - name: MOSIP_ESIGNET_MOCK_SUPPORTED_FIELDS - value: individualId,password - - name: REDIS_HOST + hsm_local_dir_name: hsm-client + MOSIP_ESIGNET_MOCK_SUPPORTED_FIELDS: individualId,password + REDIS_HOST: valueFrom: configMapKeyRef: name: redis-config key: redis-host - - name: REDIS_PORT + REDIS_PORT: valueFrom: configMapKeyRef: name: redis-config key: redis-port - - name: REDIS_PASSWORD + REDIS_PASSWORD: valueFrom: secretKeyRef: name: redis diff --git a/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml b/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml index 152594a8b..24abf63e6 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml @@ -1,18 +1,13 @@ extraEnvVars: - - name: CLIENT_ID - value: I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM - - name: ACRS + CLIENT_ID: I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM + ACRS: value: >- mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet%20mosip:idp:acr:password%20mosip:idp:acr:knowledge - - name: DISPLAY - value: page - - name: GRANT_TYPE - value: authorization_code - - name: CLAIMS_LOCALES - value: en - - name: SCOPE_USER_PROFILE - value: openid profile - - name: CLAIMS_USER_PROFILE + DISPLAY: page + GRANT_TYPE: authorization_code + CLAIMS_LOCALES: en + SCOPE_USER_PROFILE: openid profile + CLAIMS_USER_PROFILE: value: >- {"userinfo":{"given_name":{"essential":true},"phone_number":{"essential":true},"email":{"essential":true},"picture":{"essential":false},"gender":{"essential":false},"birthdate":{"essential":false},"address":{"essential":false}},"id_token":{}} mock_relying_party_service: From cbb680bdc205b41eb2e66445ed12b049df82a346 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 11:53:19 +0530 Subject: [PATCH 22/61] fix: inline esignet-standalone-2.0.0 valuesFile content into DSF set: entries Now that extraEnvVars/extraEnvVarsAdditional are maps (commit 1f8713ac), every key can be expressed as an individual dot-path set: entry directly in esignet-dsf.yaml, matching the convention already used for domainConfig.KEY/extraEnvVarsCM[n] in this same file. Removes the valuesFile: reference and deletes the source file for each of the 6 converted apps (esignet base/sunbird/mosipid1/mosipid2, mock-identity, mock-relying-party x4) once nothing references it. Verified: full-manifest helm template diff (not just env:) for every app, comparing the original valuesFile + baseline set: render against the new set:-only render - byte-identical in every case. Checked for key overlap against existing domainConfig.*/set: entries first (none found) so nothing is duplicated. Two values (MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS, CLAIMS_USER_PROFILE) are JSON-like blobs full of commas and braces, which --set's mini-language treats specially. Escaped with \, \{ \} per Helm's strvals rules, wrapped in YAML single-quoted strings in the DSF (double-quoted YAML does NOT accept these as valid escapes - caught and fixed one instance of this during implementation). Verified end-to-end three ways: Helm's strvals parser directly, YAML round-trip via an independent parser, and Helmsman's own real binary (-dry-run -debug against a local, unreachable fake kubeconfig, network-free) - its internal "values to override from env" dump shows both escaped values recovered exactly as intended before being handed to Helm. Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 292 +++++++++++++++++- .../esignet-mosipid1-plugin-values-2-0-0.yaml | 122 -------- .../esignet-mosipid2-plugin-values-2-0-0.yaml | 120 ------- .../esignet-plugin-values-2-0-0.yaml | 148 --------- .../esignet-sunbird-plugin-values-2-0-0.yaml | 97 ------ .../mock-identity-values-2-0-0.yaml | 48 --- .../mock-replying-party.yaml | 20 -- 7 files changed, 280 insertions(+), 567 deletions(-) delete mode 100644 Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml delete mode 100644 Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml delete mode 100644 Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml delete mode 100644 Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml delete mode 100755 Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml delete mode 100644 Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 0deca2876..17818f7a1 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -110,7 +110,6 @@ apps: enabled: true version: 2.0.0-develop chart: mosip/esignet - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml" set: image.repository: "mosipqa/esignet" image.tag: "develop-go" @@ -132,6 +131,49 @@ apps: domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" domainConfig.OIDC_UI_HOSTNAME: "esignet-go.${domain_name}" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha-go" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetgo" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.key: "redis-port" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.name: "redis" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.key: "redis-password" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.key: "database-host" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.key: "database-port" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.key: "database-name" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" + extraEnvVars.AUTHN_PROVIDER: "mosip" + extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" + extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" + extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/lib/softhsm/libsofthsm2.so" + extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "esignet" + extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.OIDC_UI_SCHEME: "https" + extraEnvVars.OIDC_UI_PORT: "443" + extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" + extraEnvVars.OIDC_UI_ERROR_PATH: "/error" + extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" + extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" + extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha-go" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" timeout: 600 priority: -14 hooks: @@ -143,7 +185,6 @@ apps: enabled: true version: 2.0.0-develop chart: mosip/esignet - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml" set: image.repository: "mosipqa/esignet" image.tag: "develop-go" @@ -173,7 +214,64 @@ apps: domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid1_domain_name}" domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-go-mosipid1.${domain_name}" domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-go-mosipid1.${domain_name}" - domainConfig.OIDC_UI_HOSTNAME: "esignet-go-mosipid1.${domain_name}" + domainConfig.OIDC_UI_HOSTNAME: "esignet-go-mosipid1.${domain_name}" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.key: "redis-port" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.name: "redis" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.key: "redis-password" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.key: "database-host" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.key: "database-port" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.key: "database-name" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go-mosipid1" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets-mosipid1" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" + extraEnvVars.AUTHN_PROVIDER: "mosip" + extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" + extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS12" + extraEnvVars.KEYMANAGER_PKCS12_FILE_PATH: "/home/mosip/keys/secret/mosipid1.pfx" + extraEnvVars.OIDC_UI_SCHEME: "https" + extraEnvVars.OIDC_UI_PORT: "443" + extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" + extraEnvVars.OIDC_UI_ERROR_PATH: "/error" + extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" + extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" + extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" + extraEnvVarsSecret[0]: "esignet-keystore-go-mosipid1" + extraVolumes[0].name: "esignet-keystore-go-mosipid1" + extraVolumes[0].secret.secretName: "esignet-keystore-go-mosipid1" + extraVolumeMounts[0].name: "esignet-keystore-go-mosipid1" + extraVolumeMounts[0].mountPath: "/home/mosip/keys/secret" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetgomosipid1" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.name: "esignet-captcha-go-mosipid1" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" + extraEnvVarsAdditional.NAMESPACE: "mosipid1" + extraEnvVarsAdditional.plugin_name_env: "mosip-identity-plugin.jar" + extraEnvVarsAdditional.SPRING_KAFKA_CONSUMER_GROUP_ID: "esignet-consumer-esignet-mosipid1" + extraEnvVarsAdditional.MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE: "esignet-mosipid1-signup-esqa020" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS: 'email\,phone' + extraEnvVarsAdditional.MOSIP_ESIGNET_SEND_OTP_ATTEMPTS: "300" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: "300" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS: "600" + extraEnvVarsAdditional.MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS: "600" + extraEnvVarsAdditional.MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX: "@phone" + extraEnvVarsAdditional.MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS.value: '\{\{ "\{\{" \}\} ''id'': ''mobile''\, ''svg'': ''mobile_icon''\, ''prefixes'': \{\{ "\{\{" \}\}''label'': ''IND''\, ''value'': ''+91''\, ''maxLength'': ''''\, ''regex'': ''''\}\,\{''label'': ''KHM''\, ''value'': ''+855''\, ''regex'': ''''\{\{ "\}\}" \}\}\, ''postfix'': ''@phone''\, ''maxLength'': ''''\, ''regex'': '''' \}\, \{ ''id'': ''nrc''\, ''svg'': ''nrc_id_icon''\, ''prefixes'': ''''\, ''postfix'': ''@nrc''\, ''maxLength'': ''''\, ''regex'': '''' \}\, \{ ''id'': ''vid''\, ''svg'': ''vid_icon''\, ''prefixes'': ''''\, ''postfix'': ''''\, ''maxLength'': ''''\, ''regex'': '''' \}\, \{ ''id'': ''email''\, ''svg'': ''email_icon''\, ''prefixes'': ''''\, ''postfix'': ''@email''\, ''maxLength'': ''''\, ''regex'': '''' \{\{ "\}\}" \}\}' + extraEnvVarsAdditional.LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT: "INFO" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "false" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_URL: "http://captcha.captcha" + extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY.valueFrom.secretKeyRef.name: "esignet-misp-onboarder-key" + extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY.valueFrom.secretKeyRef.key: "mosip-esignet-misp-key" timeout: 600 priority: -14 hooks: @@ -184,7 +282,6 @@ apps: enabled: ${MOSIPID2_ENABLED} version: 2.0.0-develop chart: mosip/esignet - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml" set: image.repository: "mosipqa/esignet" image.tag: "develop-go" @@ -214,7 +311,63 @@ apps: domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid2_domain_name}" domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-go-mosipid2.${domain_name}" domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-go-mosipid2.${domain_name}" - domainConfig.OIDC_UI_HOSTNAME: "esignet-go-mosipid2.${domain_name}" + domainConfig.OIDC_UI_HOSTNAME: "esignet-go-mosipid2.${domain_name}" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.key: "redis-port" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.name: "redis" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.key: "redis-password" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.key: "database-host" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.key: "database-port" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.key: "database-name" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go-mosipid2" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets-mosipid2" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" + extraEnvVars.AUTHN_PROVIDER: "mosip" + extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" + extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" + extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/lib/softhsm/libsofthsm2.so" + extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "esignet" + extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go-mosipid2" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.OIDC_UI_SCHEME: "https" + extraEnvVars.OIDC_UI_PORT: "443" + extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" + extraEnvVars.OIDC_UI_ERROR_PATH: "/error" + extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" + extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" + extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetgomosipid2" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.name: "esignet-captcha-go-mosipid2" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" + extraEnvVarsAdditional.NAMESPACE: "mosipid2" + extraEnvVarsAdditional.plugin_name_env: "mosip-identity-plugin.jar" + extraEnvVarsAdditional.SPRING_KAFKA_CONSUMER_GROUP_ID: "esignet-consumer-esignet-mosipid2" + extraEnvVarsAdditional.MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE: "esignet-mosipid2-signup-esqa020" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS: 'email\,phone' + extraEnvVarsAdditional.MOSIP_ESIGNET_SEND_OTP_ATTEMPTS: "300" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: "300" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS: "600" + extraEnvVarsAdditional.MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS: "600" + extraEnvVarsAdditional.MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX: "@phone" + extraEnvVarsAdditional.MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS.value: '\{\{ "\{\{" \}\} ''id'': ''mobile''\, ''svg'': ''mobile_icon''\, ''prefixes'': \{\{ "\{\{" \}\}''label'': ''IND''\, ''value'': ''+91''\, ''maxLength'': ''''\, ''regex'': ''''\}\,\{''label'': ''KHM''\, ''value'': ''+855''\, ''regex'': ''''\{\{ "\}\}" \}\}\, ''postfix'': ''@phone''\, ''maxLength'': ''''\, ''regex'': '''' \}\, \{ ''id'': ''nrc''\, ''svg'': ''nrc_id_icon''\, ''prefixes'': ''''\, ''postfix'': ''@nrc''\, ''maxLength'': ''''\, ''regex'': '''' \}\, \{ ''id'': ''vid''\, ''svg'': ''vid_icon''\, ''prefixes'': ''''\, ''postfix'': ''''\, ''maxLength'': ''''\, ''regex'': '''' \}\, \{ ''id'': ''email''\, ''svg'': ''email_icon''\, ''prefixes'': ''''\, ''postfix'': ''@email''\, ''maxLength'': ''''\, ''regex'': '''' \{\{ "\}\}" \}\}' + extraEnvVarsAdditional.LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT: "INFO" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_URL: "http://captcha.captcha" + extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY.valueFrom.secretKeyRef.name: "esignet-misp-onboarder-key" + extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY.valueFrom.secretKeyRef.key: "mosip-esignet-misp-key" timeout: 600 priority: -14 hooks: @@ -225,7 +378,6 @@ apps: enabled: true version: 2.0.0-develop chart: mosip/esignet - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml" set: image.repository: "mosipqa/esignet" image.tag: "develop-go" @@ -249,7 +401,52 @@ apps: domainConfig.MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid1_domain_name}" domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL: "https://registry.${mosipid1_domain_name}/api/v1/Insurance/search" domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid1_domain_name}/api/v1/Insurance/" - domainConfig.OIDC_UI_HOSTNAME: "esignet-go-sunbird.${domain_name}" + domainConfig.OIDC_UI_HOSTNAME: "esignet-go-sunbird.${domain_name}" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetgosunbird" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.key: "redis-port" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.name: "redis" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.key: "redis-password" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.key: "database-host" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.key: "database-port" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.key: "database-name" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go-sunbird" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" + extraEnvVars.AUTHN_PROVIDER: "mosip" + extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" + extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" + extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/lib/softhsm/libsofthsm2.so" + extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "esignet" + extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go-sunbird" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.OIDC_UI_SCHEME: "https" + extraEnvVars.OIDC_UI_PORT: "443" + extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" + extraEnvVars.OIDC_UI_ERROR_PATH: "/error" + extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" + extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" + extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha-go-sunbird" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" + extraEnvVarsAdditional.MOSIP_ESIGNET_INTEGRATION_AUDIT_PLUGIN: "LoggerAuditService" + extraEnvVarsAdditional.MOSIP_ESIGNET_INTEGRATION_KEY_BINDER: "NoOpKeyBinder" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: "300" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATOR_DEFAULT_AUTH_FACTOR_KBI_INDIVIDUAL_ID_FIELD: "policyNumber" timeout: 600 priority: -14 hooks: @@ -351,7 +548,6 @@ apps: enabled: true version: 0.0.1-develop chart: mosip/mock-identity-system - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml" set: image.repository: "mosipqa/mock-identity-system" image.tag: "develop" @@ -368,6 +564,26 @@ apps: domainConfig.installation-domain: "${domain_name}" domainConfig.MOSIP_MOCK_IDA_IDENTITY_SCHEMA_URL: "https://raw.githubusercontent.com/prathmeshj12/addidentityschema_testing/refs/heads/main/email-signup-schema-testing.json" domainConfig.MOSIP_MOCK_UI_SPEC_SCHEMA_URL: "https://raw.githubusercontent.com/prathmeshj12/addidentityschema_testing/refs/heads/main/ui_spec_reset_password_phone.json" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.name: "mockid-postgres-config" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.key: "database-host" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.name: "mockid-postgres-config" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.key: "database-port" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.name: "mockid-postgres-config" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.key: "database-name" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.name: "mockid-postgres-config" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" + extraEnvVars.SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN.valueFrom.secretKeyRef.name: "softhsm-mock-identity-system-go" + extraEnvVars.SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.hsm_local_dir_name: "hsm-client" + extraEnvVars.MOSIP_ESIGNET_MOCK_SUPPORTED_FIELDS: 'individualId\,password' + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.key: "redis-port" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.name: "redis" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.key: "redis-password" timeout: 480 priority: -11 hooks: @@ -381,7 +597,6 @@ apps: enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-replying-party.yaml" set: image.repository: "mosipqa/mock-relying-party-service" image.tag: "develop-go" @@ -392,6 +607,20 @@ apps: mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + extraEnvVars.CLIENT_ID: "I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM" + extraEnvVars.ACRS.value: "mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet%20mosip:idp:acr:password%20mosip:idp:acr:knowledge" + extraEnvVars.DISPLAY: "page" + extraEnvVars.GRANT_TYPE: "authorization_code" + extraEnvVars.CLAIMS_LOCALES: "en" + extraEnvVars.SCOPE_USER_PROFILE: "openid profile" + extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\}\,"phone_number":\{"essential":true\}\,"email":\{"essential":true\}\,"picture":\{"essential":false\}\,"gender":\{"essential":false\}\,"birthdate":\{"essential":false\}\,"address":\{"essential":false\}\}\,"id_token":\{\}\}' + mock_relying_party_service.host: "" + mock_relying_party_service.mountDir: "" + mock_relying_party_service.healthCheckUrl: null + mock_relying_party_service.mock_relying_party_serviceMountDIr: "/home/mosip/oidc/" + mock_relying_party_service.puburl: null + mock_relying_party_service.privurl: null + mock_relying_party_service.USERINFO_RESPONSE_TYPE: "jwt" timeout: 480 priority: -10 hooks: @@ -402,7 +631,6 @@ apps: enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-replying-party.yaml" set: image.repository: "mosipqa/mock-relying-party-service" image.tag: "develop-go" @@ -413,6 +641,20 @@ apps: mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go-mosipid1.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + extraEnvVars.CLIENT_ID: "I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM" + extraEnvVars.ACRS.value: "mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet%20mosip:idp:acr:password%20mosip:idp:acr:knowledge" + extraEnvVars.DISPLAY: "page" + extraEnvVars.GRANT_TYPE: "authorization_code" + extraEnvVars.CLAIMS_LOCALES: "en" + extraEnvVars.SCOPE_USER_PROFILE: "openid profile" + extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\}\,"phone_number":\{"essential":true\}\,"email":\{"essential":true\}\,"picture":\{"essential":false\}\,"gender":\{"essential":false\}\,"birthdate":\{"essential":false\}\,"address":\{"essential":false\}\}\,"id_token":\{\}\}' + mock_relying_party_service.host: "" + mock_relying_party_service.mountDir: "" + mock_relying_party_service.healthCheckUrl: null + mock_relying_party_service.mock_relying_party_serviceMountDIr: "/home/mosip/oidc/" + mock_relying_party_service.puburl: null + mock_relying_party_service.privurl: null + mock_relying_party_service.USERINFO_RESPONSE_TYPE: "jwt" timeout: 480 priority: -10 hooks: @@ -423,7 +665,6 @@ apps: enabled: ${MOSIPID2_ENABLED} version: 0.0.1-develop chart: mosip/mock-relying-party-service - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-replying-party.yaml" set: image.repository: "mosipqa/mock-relying-party-service" image.tag: "develop-go" @@ -434,6 +675,20 @@ apps: mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go-mosipid2.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + extraEnvVars.CLIENT_ID: "I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM" + extraEnvVars.ACRS.value: "mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet%20mosip:idp:acr:password%20mosip:idp:acr:knowledge" + extraEnvVars.DISPLAY: "page" + extraEnvVars.GRANT_TYPE: "authorization_code" + extraEnvVars.CLAIMS_LOCALES: "en" + extraEnvVars.SCOPE_USER_PROFILE: "openid profile" + extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\}\,"phone_number":\{"essential":true\}\,"email":\{"essential":true\}\,"picture":\{"essential":false\}\,"gender":\{"essential":false\}\,"birthdate":\{"essential":false\}\,"address":\{"essential":false\}\}\,"id_token":\{\}\}' + mock_relying_party_service.host: "" + mock_relying_party_service.mountDir: "" + mock_relying_party_service.healthCheckUrl: null + mock_relying_party_service.mock_relying_party_serviceMountDIr: "/home/mosip/oidc/" + mock_relying_party_service.puburl: null + mock_relying_party_service.privurl: null + mock_relying_party_service.USERINFO_RESPONSE_TYPE: "jwt" timeout: 480 priority: -10 hooks: @@ -444,7 +699,6 @@ apps: enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/mock-replying-party.yaml" set: image.repository: "mosipqa/mock-relying-party-service" image.tag: "develop-go" @@ -455,6 +709,20 @@ apps: mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go-sunbird.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + extraEnvVars.CLIENT_ID: "I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM" + extraEnvVars.ACRS.value: "mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet%20mosip:idp:acr:password%20mosip:idp:acr:knowledge" + extraEnvVars.DISPLAY: "page" + extraEnvVars.GRANT_TYPE: "authorization_code" + extraEnvVars.CLAIMS_LOCALES: "en" + extraEnvVars.SCOPE_USER_PROFILE: "openid profile" + extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\}\,"phone_number":\{"essential":true\}\,"email":\{"essential":true\}\,"picture":\{"essential":false\}\,"gender":\{"essential":false\}\,"birthdate":\{"essential":false\}\,"address":\{"essential":false\}\}\,"id_token":\{\}\}' + mock_relying_party_service.host: "" + mock_relying_party_service.mountDir: "" + mock_relying_party_service.healthCheckUrl: null + mock_relying_party_service.mock_relying_party_serviceMountDIr: "/home/mosip/oidc/" + mock_relying_party_service.puburl: null + mock_relying_party_service.privurl: null + mock_relying_party_service.USERINFO_RESPONSE_TYPE: "jwt" timeout: 480 priority: -10 hooks: diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml deleted file mode 100644 index af9553846..000000000 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid1-plugin-values-2-0-0.yaml +++ /dev/null @@ -1,122 +0,0 @@ -# eSignet MOSIPID1 — plugin 2 (mosip-identity-plugin) runtime configuration. -# pluginNameEnv=mosip-identity-plugin.jar set in DSF set: block. -# Update IDA service URLs below to match your MOSIP IDA deployment. - -# Override full extraEnvVars to use namespace-specific softhsm secret name. -extraEnvVars: - KEYCLOAK_EXTERNAL_URL: - valueFrom: - configMapKeyRef: - name: keycloak-host - key: keycloak-external-url - REDIS_HOST: - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-host - REDIS_PORT: - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-port - REDIS_PASSWORD: - valueFrom: - secretKeyRef: - name: redis - key: redis-password - DATABASE_HOST: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-host - DATABASE_PORT: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-port - DATABASE_NAME: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-name - DATABASE_USERNAME: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-username - DB_DBUSER_PASSWORD: - valueFrom: - secretKeyRef: - name: db-common-secrets - key: db-dbuser-password - SOFTHSM_ESIGNET_SECURITY_PIN: - valueFrom: - secretKeyRef: - name: esignet-softhsm-go-mosipid1 - key: security-pin - MOSIP_IDA_CLIENT_SECRET: - valueFrom: - secretKeyRef: - name: keycloak-client-secrets-mosipid1 - key: mosip_ida_client_secret - AUTHN_PROVIDER: mosip - KEYMANAGER_DB_SCHEMA: esignet - KEYMANAGER_KEYSTORE_TYPE: PKCS12 - KEYMANAGER_PKCS12_FILE_PATH: /home/mosip/keys/secret/mosipid1.pfx - OIDC_UI_SCHEME: https - OIDC_UI_PORT: '443' - OIDC_UI_LOGIN_PATH: /signin - OIDC_UI_ERROR_PATH: /error - DEFAULT_THEME_ID: decl-theme-1 - DEFAULT_LAYOUT_ID: decl-layout-1 - DEFAULT_AUTH_FLOW_ID: decl-mosip-otp-flow-1 -extraEnvVarsSecret: - - esignet-keystore-go-mosipid1 -extraVolumes: - - name: esignet-keystore-go-mosipid1 - secret: - secretName: esignet-keystore-go-mosipid1 -extraVolumeMounts: - - name: esignet-keystore-go-mosipid1 - mountPath: /home/mosip/keys/secret -extraEnvVarsAdditional: - "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME": "esignetgomosipid1" - "MOSIP_ESIGNET_CAPTCHA_SITE-KEY": - valueFrom: - secretKeyRef: - name: esignet-captcha-go-mosipid1 - key: esignet-captcha-site-key - - # --------------------------------------------------------------------------- - # Plugin 2: mosip-identity-plugin - # Update URLs to match your MOSIP IDA deployment. - # --------------------------------------------------------------------------- - NAMESPACE: mosipid1 - plugin_name_env: mosip-identity-plugin.jar - SPRING_KAFKA_CONSUMER_GROUP_ID: esignet-consumer-esignet-mosipid1 - MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE: esignet-mosipid1-signup-esqa020 - MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS: email,phone - MOSIP_ESIGNET_SEND_OTP_ATTEMPTS: '300' - MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: '300' - MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS: '600' - MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS: '600' - MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX: '@phone' - MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS: - value: >- - {{ "{{" }} 'id': 'mobile', 'svg': 'mobile_icon', 'prefixes': {{ "{{" }}'label': - 'IND', 'value': '+91', 'maxLength': '', 'regex': ''},{'label': - 'KHM', 'value': '+855', 'regex': ''{{ "}}" }}, 'postfix': '@phone', - 'maxLength': '', 'regex': '' }, { 'id': 'nrc', 'svg': - 'nrc_id_icon', 'prefixes': '', 'postfix': '@nrc', 'maxLength': - '', 'regex': '' }, { 'id': 'vid', 'svg': 'vid_icon', 'prefixes': - '', 'postfix': '', 'maxLength': '', 'regex': '' }, { 'id': - 'email', 'svg': 'email_icon', 'prefixes': '', 'postfix': - '@email', 'maxLength': '', 'regex': '' {{ "}}" }} - LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT: INFO - MOSIP_ESIGNET_CAPTCHA_REQUIRED: "false" - MOSIP_ESIGNET_CAPTCHA_URL: http://captcha.captcha - "MOSIP_ESIGNET_MISP_KEY": - valueFrom: - secretKeyRef: - name: esignet-misp-onboarder-key - key: mosip-esignet-misp-key diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml deleted file mode 100644 index ccb5f2dab..000000000 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-mosipid2-plugin-values-2-0-0.yaml +++ /dev/null @@ -1,120 +0,0 @@ -# eSignet MOSIPID2 — plugin 2 (mosip-identity-plugin) runtime configuration. -# pluginNameEnv=mosip-identity-plugin.jar set in DSF set: block. -# Update IDA service URLs below to match your MOSIP IDA deployment. - -# Override full extraEnvVars to use namespace-specific softhsm secret name. -extraEnvVars: - KEYCLOAK_EXTERNAL_URL: - valueFrom: - configMapKeyRef: - name: keycloak-host - key: keycloak-external-url - REDIS_HOST: - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-host - REDIS_PORT: - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-port - REDIS_PASSWORD: - valueFrom: - secretKeyRef: - name: redis - key: redis-password - DATABASE_HOST: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-host - DATABASE_PORT: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-port - DATABASE_NAME: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-name - DATABASE_USERNAME: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-username - DB_DBUSER_PASSWORD: - valueFrom: - secretKeyRef: - name: db-common-secrets - key: db-dbuser-password - SOFTHSM_ESIGNET_SECURITY_PIN: - valueFrom: - secretKeyRef: - name: esignet-softhsm-go-mosipid2 - key: security-pin - MOSIP_IDA_CLIENT_SECRET: - valueFrom: - secretKeyRef: - name: keycloak-client-secrets-mosipid2 - key: mosip_ida_client_secret - AUTHN_PROVIDER: mosip - KEYMANAGER_DB_SCHEMA: esignet - KEYMANAGER_KEYSTORE_TYPE: PKCS11 - KEYMANAGER_PKCS11_MODULE_PATH: /usr/lib/softhsm/libsofthsm2.so - KEYMANAGER_PKCS11_TOKEN_LABEL: esignet - KEYMANAGER_PKCS11_SLOT_ID: "0" - KEYMANAGER_PKCS11_PIN: - valueFrom: - secretKeyRef: - name: esignet-softhsm-go-mosipid2 - key: security-pin - OIDC_UI_SCHEME: https - OIDC_UI_PORT: '443' - OIDC_UI_LOGIN_PATH: /signin - OIDC_UI_ERROR_PATH: /error - DEFAULT_THEME_ID: decl-theme-1 - DEFAULT_LAYOUT_ID: decl-layout-1 - DEFAULT_AUTH_FLOW_ID: decl-mosip-otp-flow-1 -extraEnvVarsAdditional: - "MOSIP_ESIGNET_CAPTCHA_MODULE_NAME": "esignetgomosipid2" - "MOSIP_ESIGNET_CAPTCHA_SITE-KEY": - valueFrom: - secretKeyRef: - name: esignet-captcha-go-mosipid2 - key: esignet-captcha-site-key - - # --------------------------------------------------------------------------- - # Plugin 2: mosip-identity-plugin - # Update URLs to match your MOSIP IDA deployment. - # --------------------------------------------------------------------------- - NAMESPACE: mosipid2 - plugin_name_env: mosip-identity-plugin.jar - SPRING_KAFKA_CONSUMER_GROUP_ID: esignet-consumer-esignet-mosipid2 - MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE: esignet-mosipid2-signup-esqa020 - MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS: email,phone - MOSIP_ESIGNET_SEND_OTP_ATTEMPTS: '300' - MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: '300' - MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS: '600' - MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS: '600' - MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX: '@phone' - MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS: - value: >- - {{ "{{" }} 'id': 'mobile', 'svg': 'mobile_icon', 'prefixes': {{ "{{" }}'label': - 'IND', 'value': '+91', 'maxLength': '', 'regex': ''},{'label': - 'KHM', 'value': '+855', 'regex': ''{{ "}}" }}, 'postfix': '@phone', - 'maxLength': '', 'regex': '' }, { 'id': 'nrc', 'svg': - 'nrc_id_icon', 'prefixes': '', 'postfix': '@nrc', 'maxLength': - '', 'regex': '' }, { 'id': 'vid', 'svg': 'vid_icon', 'prefixes': - '', 'postfix': '', 'maxLength': '', 'regex': '' }, { 'id': - 'email', 'svg': 'email_icon', 'prefixes': '', 'postfix': - '@email', 'maxLength': '', 'regex': '' {{ "}}" }} - LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT: INFO - MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" - MOSIP_ESIGNET_CAPTCHA_URL: http://captcha.captcha - "MOSIP_ESIGNET_MISP_KEY": - valueFrom: - secretKeyRef: - name: esignet-misp-onboarder-key - key: mosip-esignet-misp-key diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml deleted file mode 100644 index 44beb2993..000000000 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-plugin-values-2-0-0.yaml +++ /dev/null @@ -1,148 +0,0 @@ -# eSignet standalone — plugin and captcha runtime configuration. -# -# Plugin selection: -# Plugin 1 (mock): pluginNameEnv=esignet-mock-plugin.jar → no changes needed here -# Plugin 2 (mosip-identity): pluginNameEnv=mosip-identity-plugin.jar → uncomment IDA section below -# Plugin 3 (sunbird-rc): pluginNameEnv=sunbird-rc-plugin.jar → uncomment Sunbird section below -# Plugin 4 (custom): pluginNameEnv= pluginUrlEnv= → no changes needed here -# - -## Uncomment required parms added with single '#' when needed. - - -extraEnvVars: - KEYCLOAK_EXTERNAL_URL: - valueFrom: - configMapKeyRef: - name: keycloak-host - key: keycloak-external-url - MOSIP_ESIGNET_CAPTCHA_SITE_KEY: - valueFrom: - secretKeyRef: - name: esignet-captcha-go - key: esignet-captcha-site-key - MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: esignetgo - REDIS_HOST: - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-host - REDIS_PORT: - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-port - REDIS_PASSWORD: - valueFrom: - secretKeyRef: - name: redis - key: redis-password - DATABASE_HOST: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-host - DATABASE_PORT: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-port - DATABASE_NAME: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-name - DATABASE_USERNAME: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-username - DB_DBUSER_PASSWORD: - valueFrom: - secretKeyRef: - name: db-common-secrets - key: db-dbuser-password - SOFTHSM_ESIGNET_SECURITY_PIN: - valueFrom: - secretKeyRef: - name: esignet-softhsm-go - key: security-pin - MOSIP_IDA_CLIENT_SECRET: - valueFrom: - secretKeyRef: - name: keycloak-client-secrets - key: mosip_ida_client_secret - AUTHN_PROVIDER: mosip - KEYMANAGER_DB_SCHEMA: esignet - KEYMANAGER_KEYSTORE_TYPE: PKCS11 - KEYMANAGER_PKCS11_MODULE_PATH: /usr/lib/softhsm/libsofthsm2.so - KEYMANAGER_PKCS11_TOKEN_LABEL: esignet - KEYMANAGER_PKCS11_SLOT_ID: "0" - KEYMANAGER_PKCS11_PIN: - valueFrom: - secretKeyRef: - name: esignet-softhsm-go - key: security-pin - OIDC_UI_SCHEME: https - OIDC_UI_PORT: '443' - OIDC_UI_LOGIN_PATH: /signin - OIDC_UI_ERROR_PATH: /error - DEFAULT_THEME_ID: decl-theme-1 - DEFAULT_LAYOUT_ID: decl-layout-1 - DEFAULT_AUTH_FLOW_ID: decl-mosip-otp-flow-1 -# extraEnvVarsCM: -# - esignet-softhsm-share - -#extraEnvVarsSecret: [] - -#istio: -# enabled: true -# gateways: -# - istio-system/public -# - istio-system/internal -# prefix: /v1/esignet/ - - -# extraEnvVarsAdditional is a map — entries here deep-merge with the chart's own -# defaults key-by-key, so only the entries that differ need to be listed here. - -extraEnvVarsAdditional: - # Captcha site key — from esignet-captcha secret (deployed by external-dsf) - "MOSIP_ESIGNET_CAPTCHA_SITE_KEY": - valueFrom: - secretKeyRef: - name: esignet-captcha-go - key: esignet-captcha-site-key - "MOSIP_ESIGNET_CAPTCHA_REQUIRED": "" - - # --------------------------------------------------------------------------- - # Plugin 2: mosip-identity-plugin - # Uncomment all entries below when pluginNameEnv=mosip-identity-plugin.jar. - # Update URLs to match your MOSIP IDA deployment if the defaults don't apply. - # --------------------------------------------------------------------------- - # - # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL": "http://mosip-file-server.mosip-file-server/mosip-certs/ida-partner.cer" - # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_KYC-AUTH-URL": "http://ida-auth.ida/idauthentication/v1/kyc-auth/delegated/${mosip.esignet.authenticator.ida.misp-license-key}/" - # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_KYC-EXCHANGE-URL": "http://ida-auth.ida/idauthentication/v1/kyc-exchange/delegated/${mosip.esignet.authenticator.ida.misp-license-key}/" - # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_SEND-OTP-URL": "http://ida-otp.ida/idauthentication/v1/otp/${mosip.esignet.authenticator.ida.misp-license-key}/" - # "MOSIP_ESIGNET_BINDER_IDA_KEY-BINDING-URL": "http://ida-auth.ida/idauthentication/v1/identity-key-binding/delegated/${mosip.esignet.authenticator.ida.misp-license-key}/" - # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_GET-CERTIFICATES-URL": "http://ida-internal.ida/idauthentication/v1/internal/getAllCertificates" - # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH-TOKEN-URL": "http://authmanager.kernel/v1/authmanager/authenticate/clientidsecretkey" - # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT-MANAGER-URL": "http://auditmanager.kernel/v1/auditmanager/audits" - # "MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP-CHANNELS": "email,phone" - # "MOSIP_ESIGNET_MISP_KEY": - # valueFrom: - # secretKeyRef: - # name: esignet-misp-onboarder-key - # key: mosip-esignet-misp-key - - # --------------------------------------------------------------------------- - # Plugin 3: sunbird-rc-plugin - # Uncomment all entries below when pluginNameEnv=sunbird-rc-plugin.jar. - # Set MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL to your Sunbird registry host. - # --------------------------------------------------------------------------- - # - # "MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL": "https://your-sunbird-registry-host" - # "MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL": "https://your-sunbird-registry-host/api/v1/Insurance/search" - # "MOSIP_ESIGNET_INTEGRATION_AUDIT_PLUGIN": "LoggerAuditService" - # "MOSIP_ESIGNET_INTEGRATION_KEY_BINDER": "NoOpKeyBinder" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml deleted file mode 100644 index 3b13c1508..000000000 --- a/Helmsman/utils/esignet-standalone-2.0.0/esignet-sunbird-plugin-values-2-0-0.yaml +++ /dev/null @@ -1,97 +0,0 @@ -# eSignet Sunbird — plugin 3 (sunbird-rc-plugin) runtime configuration. -# pluginNameEnv=sunbird-rc-plugin.jar set in DSF set: block. -# Update MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL to your Sunbird registry host. - -# Override full extraEnvVars to use namespace-specific softhsm secret name. -extraEnvVars: - KEYCLOAK_EXTERNAL_URL: - valueFrom: - configMapKeyRef: - name: keycloak-host - key: keycloak-external-url - MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: esignetgosunbird - REDIS_HOST: - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-host - REDIS_PORT: - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-port - REDIS_PASSWORD: - valueFrom: - secretKeyRef: - name: redis - key: redis-password - DATABASE_HOST: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-host - DATABASE_PORT: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-port - DATABASE_NAME: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-name - DATABASE_USERNAME: - valueFrom: - configMapKeyRef: - name: postgres-config - key: database-username - DB_DBUSER_PASSWORD: - valueFrom: - secretKeyRef: - name: db-common-secrets - key: db-dbuser-password - SOFTHSM_ESIGNET_SECURITY_PIN: - valueFrom: - secretKeyRef: - name: esignet-softhsm-go-sunbird - key: security-pin - MOSIP_IDA_CLIENT_SECRET: - valueFrom: - secretKeyRef: - name: keycloak-client-secrets - key: mosip_ida_client_secret - AUTHN_PROVIDER: mosip - KEYMANAGER_DB_SCHEMA: esignet - KEYMANAGER_KEYSTORE_TYPE: PKCS11 - KEYMANAGER_PKCS11_MODULE_PATH: /usr/lib/softhsm/libsofthsm2.so - KEYMANAGER_PKCS11_TOKEN_LABEL: esignet - KEYMANAGER_PKCS11_SLOT_ID: "0" - KEYMANAGER_PKCS11_PIN: - valueFrom: - secretKeyRef: - name: esignet-softhsm-go-sunbird - key: security-pin - OIDC_UI_SCHEME: https - OIDC_UI_PORT: '443' - OIDC_UI_LOGIN_PATH: /signin - OIDC_UI_ERROR_PATH: /error - DEFAULT_THEME_ID: decl-theme-1 - DEFAULT_LAYOUT_ID: decl-layout-1 - DEFAULT_AUTH_FLOW_ID: decl-mosip-otp-flow-1 - -extraEnvVarsAdditional: - "MOSIP_ESIGNET_CAPTCHA_SITE_KEY": - valueFrom: - secretKeyRef: - name: esignet-captcha-go-sunbird - key: esignet-captcha-site-key - "MOSIP_ESIGNET_CAPTCHA_REQUIRED": "" - - # --------------------------------------------------------------------------- - # Plugin 3: sunbird-rc-plugin - # Update URLs to match your Sunbird RC registry deployment. - # --------------------------------------------------------------------------- - "MOSIP_ESIGNET_INTEGRATION_AUDIT_PLUGIN": "LoggerAuditService" - "MOSIP_ESIGNET_INTEGRATION_KEY_BINDER": "NoOpKeyBinder" - MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: '300' - MOSIP_ESIGNET_AUTHENTICATOR_DEFAULT_AUTH_FACTOR_KBI_INDIVIDUAL_ID_FIELD: "policyNumber" diff --git a/Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml deleted file mode 100755 index daeb84499..000000000 --- a/Helmsman/utils/esignet-standalone-2.0.0/mock-identity-values-2-0-0.yaml +++ /dev/null @@ -1,48 +0,0 @@ -extraEnvVars: - DATABASE_HOST: - valueFrom: - configMapKeyRef: - name: mockid-postgres-config - key: database-host - DATABASE_PORT: - valueFrom: - configMapKeyRef: - name: mockid-postgres-config - key: database-port - DATABASE_NAME: - valueFrom: - configMapKeyRef: - name: mockid-postgres-config - key: database-name - DATABASE_USERNAME: - valueFrom: - configMapKeyRef: - name: mockid-postgres-config - key: database-username - DB_DBUSER_PASSWORD: - valueFrom: - secretKeyRef: - name: db-common-secrets - key: db-dbuser-password - SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN: - valueFrom: - secretKeyRef: - name: softhsm-mock-identity-system-go - key: security-pin - hsm_local_dir_name: hsm-client - MOSIP_ESIGNET_MOCK_SUPPORTED_FIELDS: individualId,password - REDIS_HOST: - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-host - REDIS_PORT: - valueFrom: - configMapKeyRef: - name: redis-config - key: redis-port - REDIS_PASSWORD: - valueFrom: - secretKeyRef: - name: redis - key: redis-password diff --git a/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml b/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml deleted file mode 100644 index 24abf63e6..000000000 --- a/Helmsman/utils/esignet-standalone-2.0.0/mock-replying-party.yaml +++ /dev/null @@ -1,20 +0,0 @@ -extraEnvVars: - CLIENT_ID: I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM - ACRS: - value: >- - mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet%20mosip:idp:acr:password%20mosip:idp:acr:knowledge - DISPLAY: page - GRANT_TYPE: authorization_code - CLAIMS_LOCALES: en - SCOPE_USER_PROFILE: openid profile - CLAIMS_USER_PROFILE: - value: >- - {"userinfo":{"given_name":{"essential":true},"phone_number":{"essential":true},"email":{"essential":true},"picture":{"essential":false},"gender":{"essential":false},"birthdate":{"essential":false},"address":{"essential":false}},"id_token":{}} -mock_relying_party_service: - host: '' - mountDir: "" # path inside docker - healthCheckUrl: - mock_relying_party_serviceMountDIr: /home/mosip/oidc/ - puburl: - privurl: - USERINFO_RESPONSE_TYPE: jwt From 38f920a9c34cc1b8a4fa2fedd2181c2806ec455d Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 12:20:44 +0530 Subject: [PATCH 23/61] fix: remove extraVolumes/extraVolumeMounts from esignet-go-mosipid1 The extraVolumes/extraVolumeMounts chart feature these referenced was deleted from the esignet chart. Drop the corresponding set: entries. extraEnvVarsSecret[0] stays - it's the chart's pre-existing envFrom secretRef mechanism, unrelated to the removed volume-mount feature, even though it happened to reference the same secret name. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 17818f7a1..6e542d435 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -249,10 +249,6 @@ apps: extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" extraEnvVarsSecret[0]: "esignet-keystore-go-mosipid1" - extraVolumes[0].name: "esignet-keystore-go-mosipid1" - extraVolumes[0].secret.secretName: "esignet-keystore-go-mosipid1" - extraVolumeMounts[0].name: "esignet-keystore-go-mosipid1" - extraVolumeMounts[0].mountPath: "/home/mosip/keys/secret" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetgomosipid1" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.name: "esignet-captcha-go-mosipid1" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" From bc97de4d59f897b964d0a8e2bc7f0ab69ec523ed Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 12:25:58 +0530 Subject: [PATCH 24/61] fix: remove unused extraEnvVarsSecret from esignet-go-mosipid1 esignet-keystore-go-mosipid1 secret is not being used. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 6e542d435..49007afba 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -248,7 +248,6 @@ apps: extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" - extraEnvVarsSecret[0]: "esignet-keystore-go-mosipid1" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetgomosipid1" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.name: "esignet-captcha-go-mosipid1" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" From f3aba85934ab78b52d8736c123455bf6cc1df12c Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 15:22:58 +0530 Subject: [PATCH 25/61] Drop -go suffix and consolidate mosipid1/mosipid2 in esignet-standalone-2.0.0 DSF The Go rewrite profile used a -go suffix on release/namespace/hostnames solely to avoid colliding with the parallel v1.7.1 (non-Go) profile. That profile is retired, so the suffix is no longer needed. Also consolidates the separate mosipid1 (PKCS12) and mosipid2 (PKCS11) instances into a single mosipid instance, keeping mosipid2's PKCS11 config as canonical. Co-Authored-By: Claude Sonnet 5 Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 548 ++++++------------ .../esignet-standalone-2.0.0/signup-dsf.yaml | 50 +- .../testrigs-dsf.yaml | 119 ++-- .../config-server-esignet-values-2-0-0.yaml | 6 +- ...ml => softhsm-esignet-mosipid-values.yaml} | 2 +- .../softhsm-esignet-mosipid2-values.yaml | 28 - 6 files changed, 226 insertions(+), 527 deletions(-) rename Helmsman/utils/{softhsm-esignet-mosipid1-values.yaml => softhsm-esignet-mosipid-values.yaml} (90%) delete mode 100644 Helmsman/utils/softhsm-esignet-mosipid2-values.yaml diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 49007afba..c11e97a7e 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -28,15 +28,13 @@ helmRepos: mosip: https://mosip.github.io/mosip-helm namespaces: - esignet-go-mock: + esignet-mock: protected: false - softhsm-go: + softhsm: protected: false - esignet-go-mosipid1: + esignet-mosipid: protected: false - esignet-go-mosipid2: - protected: false - esignet-go-sunbird: + esignet-sunbird: protected: false apps: @@ -45,8 +43,8 @@ apps: # --------------------------------------------------------------------------- # Deployed here (not in external-dsf) so esignet-softhsm-share configmap is # available in esignet namespace before eSignet service starts. - esignet-softhsm-go: - namespace: esignet-go-mock + esignet-softhsm: + namespace: esignet-mock enabled: true version: 12.0.1 chart: mosip/softhsm @@ -56,30 +54,19 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh" - esignet-softhsm-go-mosipid1: - namespace: esignet-go-mosipid1 + esignet-softhsm-mosipid: + namespace: esignet-mosipid enabled: true version: 12.0.1 chart: mosip/softhsm - valuesFile: "$WORKDIR/utils/softhsm-esignet-mosipid1-values.yaml" - timeout: 480 - priority: -16 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid1-setup.sh" - - esignet-softhsm-go-mosipid2: - namespace: esignet-go-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 12.0.1 - chart: mosip/softhsm - valuesFile: "$WORKDIR/utils/softhsm-esignet-mosipid2-values.yaml" + valuesFile: "$WORKDIR/utils/softhsm-esignet-mosipid-values.yaml" timeout: 480 priority: -16 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid2-setup.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid-setup.sh" - esignet-softhsm-go-sunbird: - namespace: esignet-go-sunbird + esignet-softhsm-sunbird: + namespace: esignet-sunbird enabled: true version: 12.0.1 chart: mosip/softhsm @@ -89,8 +76,8 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh" - esignet-config-server-go: - namespace: esignet-go-mock + esignet-config-server: + namespace: esignet-mock enabled: false version: 12.0.1 chart: mosip/config-server @@ -105,8 +92,8 @@ apps: # --------------------------------------------------------------------------- # eSignet # --------------------------------------------------------------------------- - esignet-go-mock: - namespace: esignet-go-mock + esignet-mock: + namespace: esignet-mock enabled: true version: 2.0.0-develop chart: mosip/esignet @@ -118,11 +105,11 @@ apps: activeProfileEnv: "" pluginNameEnv: "esignet-mock-plugin.jar" pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-go-share" + extraEnvVarsCM[0]: "esignet-softhsm-share" #extraEnvVarsCM[1]: "kafka-config" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-go.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "https://signup-go.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup.${domain_name}" domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" @@ -130,12 +117,12 @@ apps: domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" - domainConfig.OIDC_UI_HOSTNAME: "esignet-go.${domain_name}" + domainConfig.OIDC_UI_HOSTNAME: "esignet.${domain_name}" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" - extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha-go" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha" extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" - extraEnvVars.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetgo" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignet" extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" @@ -152,7 +139,7 @@ apps: extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" - extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm" extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" @@ -162,7 +149,7 @@ apps: extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/lib/softhsm/libsofthsm2.so" extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "esignet" extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" - extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" @@ -171,7 +158,7 @@ apps: extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha-go" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" timeout: 600 @@ -180,8 +167,8 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh" postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh" - esignet-go-mosipid1: - namespace: esignet-go-mosipid1 + esignet-mosipid: + namespace: esignet-mosipid enabled: true version: 2.0.0-develop chart: mosip/esignet @@ -193,28 +180,28 @@ apps: activeProfileEnv: "" pluginNameEnv: "mosip-identity-plugin.jar" pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-go-mosipid1-share" + extraEnvVarsCM[0]: "esignet-softhsm-mosipid-share" extraEnvVarsCM[1]: "esignet-global" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-go-mosipid1.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "https://signup-go-mosipid1.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-mosipid.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup-mosipid.${domain_name}" domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid1_domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid_domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" - domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid1_domain_name}" - domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid1_domain_name}" - domainConfig.IDA_INTERNAL_URL: "https://api-internal.${mosipid1_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL: "https://api-internal.${mosipid1_domain_name}/mosip-certs/ida-partner.cer" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid1_domain_name}/v1/authmanager/authenticate/clientidsecretkey" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid1_domain_name}/v1/auditmanager/audits" - domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid1_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-go-mosipid1.${domain_name}" - domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-go-mosipid1.${domain_name}" - domainConfig.OIDC_UI_HOSTNAME: "esignet-go-mosipid1.${domain_name}" + domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid_domain_name}" + domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid_domain_name}" + domainConfig.IDA_INTERNAL_URL: "https://api-internal.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL: "https://api-internal.${mosipid_domain_name}/mosip-certs/ida-partner.cer" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid_domain_name}/v1/authmanager/authenticate/clientidsecretkey" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid_domain_name}/v1/auditmanager/audits" + domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-mosipid.${domain_name}" + domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-mosipid.${domain_name}" + domainConfig.OIDC_UI_HOSTNAME: "esignet-mosipid.${domain_name}" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" @@ -233,101 +220,9 @@ apps: extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" - extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go-mosipid1" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" - extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets-mosipid1" - extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" - extraEnvVars.AUTHN_PROVIDER: "mosip" - extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" - extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS12" - extraEnvVars.KEYMANAGER_PKCS12_FILE_PATH: "/home/mosip/keys/secret/mosipid1.pfx" - extraEnvVars.OIDC_UI_SCHEME: "https" - extraEnvVars.OIDC_UI_PORT: "443" - extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" - extraEnvVars.OIDC_UI_ERROR_PATH: "/error" - extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" - extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" - extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetgomosipid1" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.name: "esignet-captcha-go-mosipid1" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" - extraEnvVarsAdditional.NAMESPACE: "mosipid1" - extraEnvVarsAdditional.plugin_name_env: "mosip-identity-plugin.jar" - extraEnvVarsAdditional.SPRING_KAFKA_CONSUMER_GROUP_ID: "esignet-consumer-esignet-mosipid1" - extraEnvVarsAdditional.MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE: "esignet-mosipid1-signup-esqa020" - extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS: 'email\,phone' - extraEnvVarsAdditional.MOSIP_ESIGNET_SEND_OTP_ATTEMPTS: "300" - extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: "300" - extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS: "600" - extraEnvVarsAdditional.MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS: "600" - extraEnvVarsAdditional.MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX: "@phone" - extraEnvVarsAdditional.MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS.value: '\{\{ "\{\{" \}\} ''id'': ''mobile''\, ''svg'': ''mobile_icon''\, ''prefixes'': \{\{ "\{\{" \}\}''label'': ''IND''\, ''value'': ''+91''\, ''maxLength'': ''''\, ''regex'': ''''\}\,\{''label'': ''KHM''\, ''value'': ''+855''\, ''regex'': ''''\{\{ "\}\}" \}\}\, ''postfix'': ''@phone''\, ''maxLength'': ''''\, ''regex'': '''' \}\, \{ ''id'': ''nrc''\, ''svg'': ''nrc_id_icon''\, ''prefixes'': ''''\, ''postfix'': ''@nrc''\, ''maxLength'': ''''\, ''regex'': '''' \}\, \{ ''id'': ''vid''\, ''svg'': ''vid_icon''\, ''prefixes'': ''''\, ''postfix'': ''''\, ''maxLength'': ''''\, ''regex'': '''' \}\, \{ ''id'': ''email''\, ''svg'': ''email_icon''\, ''prefixes'': ''''\, ''postfix'': ''@email''\, ''maxLength'': ''''\, ''regex'': '''' \{\{ "\}\}" \}\}' - extraEnvVarsAdditional.LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT: "INFO" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "false" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_URL: "http://captcha.captcha" - extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY.valueFrom.secretKeyRef.name: "esignet-misp-onboarder-key" - extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY.valueFrom.secretKeyRef.key: "mosip-esignet-misp-key" - timeout: 600 - priority: -14 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh" - - esignet-go-mosipid2: - namespace: esignet-go-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 2.0.0-develop - chart: mosip/esignet - set: - image.repository: "mosipqa/esignet" - image.tag: "develop-go" - enable_insecure: "false" - springConfigNameEnv: "" - activeProfileEnv: "" - pluginNameEnv: "mosip-identity-plugin.jar" - pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-go-mosipid2-share" - extraEnvVarsCM[1]: "esignet-global" - metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-go-mosipid2.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "https://signup-go-mosipid2.${domain_name}" - domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" - domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid2_domain_name}" - domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" - domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" - domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" - domainConfig.installation-domain: "${domain_name}" - domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid2_domain_name}" - domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid2_domain_name}" - domainConfig.IDA_INTERNAL_URL: "https://api-internal.${mosipid2_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL: "https://api-internal.${mosipid2_domain_name}/mosip-certs/ida-partner.cer" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid2_domain_name}/v1/authmanager/authenticate/clientidsecretkey" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid2_domain_name}/v1/auditmanager/audits" - domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid2_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-go-mosipid2.${domain_name}" - domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-go-mosipid2.${domain_name}" - domainConfig.OIDC_UI_HOSTNAME: "esignet-go-mosipid2.${domain_name}" - extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" - extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" - extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" - extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" - extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" - extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.key: "redis-port" - extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.name: "redis" - extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.key: "redis-password" - extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.name: "postgres-config" - extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.key: "database-host" - extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.name: "postgres-config" - extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.key: "database-port" - extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.name: "postgres-config" - extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.key: "database-name" - extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.name: "postgres-config" - extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" - extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" - extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" - extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go-mosipid2" - extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" - extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets-mosipid2" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets-mosipid" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" extraEnvVars.AUTHN_PROVIDER: "mosip" extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" @@ -335,7 +230,7 @@ apps: extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/lib/softhsm/libsofthsm2.so" extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "esignet" extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" - extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go-mosipid2" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" @@ -344,13 +239,13 @@ apps: extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetgomosipid2" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.name: "esignet-captcha-go-mosipid2" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetmosipid" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.name: "esignet-captcha-mosipid" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" - extraEnvVarsAdditional.NAMESPACE: "mosipid2" + extraEnvVarsAdditional.NAMESPACE: "mosipid" extraEnvVarsAdditional.plugin_name_env: "mosip-identity-plugin.jar" - extraEnvVarsAdditional.SPRING_KAFKA_CONSUMER_GROUP_ID: "esignet-consumer-esignet-mosipid2" - extraEnvVarsAdditional.MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE: "esignet-mosipid2-signup-esqa020" + extraEnvVarsAdditional.SPRING_KAFKA_CONSUMER_GROUP_ID: "esignet-consumer-esignet-mosipid" + extraEnvVarsAdditional.MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE: "esignet-mosipid-signup-esqa020" extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS: 'email\,phone' extraEnvVarsAdditional.MOSIP_ESIGNET_SEND_OTP_ATTEMPTS: "300" extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: "300" @@ -366,10 +261,10 @@ apps: timeout: 600 priority: -14 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh" - esignet-go-sunbird: - namespace: esignet-go-sunbird + esignet-sunbird: + namespace: esignet-sunbird enabled: true version: 2.0.0-develop chart: mosip/esignet @@ -381,11 +276,11 @@ apps: activeProfileEnv: "" pluginNameEnv: "sunbird-rc-plugin.jar" pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-go-sunbird-share" + extraEnvVarsCM[0]: "esignet-softhsm-sunbird-share" #extraEnvVarsCM[1]: "kafka-config" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-go-sunbird.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "https://signup-go-sunbird.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-sunbird.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup-sunbird.${domain_name}" domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" @@ -393,13 +288,13 @@ apps: domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" - domainConfig.MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid1_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL: "https://registry.${mosipid1_domain_name}/api/v1/Insurance/search" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid1_domain_name}/api/v1/Insurance/" - domainConfig.OIDC_UI_HOSTNAME: "esignet-go-sunbird.${domain_name}" + domainConfig.MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL: "https://registry.${mosipid_domain_name}/api/v1/Insurance/search" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid_domain_name}/api/v1/Insurance/" + domainConfig.OIDC_UI_HOSTNAME: "esignet-sunbird.${domain_name}" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" - extraEnvVars.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetgosunbird" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetsunbird" extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" @@ -416,7 +311,7 @@ apps: extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" - extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go-sunbird" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" @@ -426,7 +321,7 @@ apps: extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/lib/softhsm/libsofthsm2.so" extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "esignet" extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" - extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-go-sunbird" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" @@ -435,7 +330,7 @@ apps: extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha-go-sunbird" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha-sunbird" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" extraEnvVarsAdditional.MOSIP_ESIGNET_INTEGRATION_AUDIT_PLUGIN: "LoggerAuditService" @@ -450,70 +345,53 @@ apps: # --------------------------------------------------------------------------- # OIDC UI # --------------------------------------------------------------------------- - oidc-ui-go: - namespace: esignet-go-mock + oidc-ui: + namespace: esignet-mock enabled: true version: 2.0.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" image.tag: "develop-go" - istio.hosts[0]: "esignet-go.${domain_name}" - oidc_ui.oidc_service_host: "esignet-go-mock.esignet-go-mock" - oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-go-mock.esignet-go-mock/v1/esignet" - oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-go-mock.esignet-go-mock" + istio.hosts[0]: "esignet.${domain_name}" + oidc_ui.oidc_service_host: "esignet-mock.esignet-mock" + oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mock.esignet-mock/v1/esignet" + oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mock.esignet-mock" timeout: 1200 priority: -13 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh" - oidc-ui-go-mosipid1: - namespace: esignet-go-mosipid1 + oidc-ui-mosipid: + namespace: esignet-mosipid enabled: true version: 2.0.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" image.tag: "develop-go" - istio.hosts[0]: "esignet-go-mosipid1.${domain_name}" - oidc_ui.oidc_service_host: "esignet-go-mosipid1.esignet-go-mosipid1" - oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-go-mosipid1.esignet-go-mosipid1/v1/esignet" - oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-go-mosipid1.esignet-go-mosipid1" - timeout: 1200 - priority: -13 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh" - - oidc-ui-go-mosipid2: - namespace: esignet-go-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 2.0.0-develop - chart: mosip/oidc-ui - set: - image.repository: "mosipqa/oidc-ui" - image.tag: "develop-go" - istio.hosts[0]: "esignet-go-mosipid2.${domain_name}" - oidc_ui.oidc_service_host: "esignet-go-mosipid2.esignet-go-mosipid2" - oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-go-mosipid2.esignet-go-mosipid2/v1/esignet" - oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-go-mosipid2.esignet-go-mosipid2" + istio.hosts[0]: "esignet-mosipid.${domain_name}" + oidc_ui.oidc_service_host: "esignet-mosipid.esignet-mosipid" + oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mosipid.esignet-mosipid/v1/esignet" + oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mosipid.esignet-mosipid" timeout: 1200 priority: -13 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid-preinstall.sh" - oidc-ui-go-sunbird: - namespace: esignet-go-sunbird + oidc-ui-sunbird: + namespace: esignet-sunbird enabled: true version: 2.0.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" image.tag: "develop-go" - istio.hosts[0]: "esignet-go-sunbird.${domain_name}" - oidc_ui.oidc_service_host: "esignet-go-sunbird.esignet-go-sunbird" - oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-go-sunbird.esignet-go-sunbird/v1/esignet" - oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-go-sunbird.esignet-go-sunbird" + istio.hosts[0]: "esignet-sunbird.${domain_name}" + oidc_ui.oidc_service_host: "esignet-sunbird.esignet-sunbird" + oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-sunbird.esignet-sunbird/v1/esignet" + oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-sunbird.esignet-sunbird" timeout: 1200 priority: -13 hooks: @@ -523,8 +401,8 @@ apps: # Mock Identity System (Optional) # --------------------------------------------------------------------------- # Enable for testing with mock identity data. - softhsm-mock-identity-system-go: - namespace: softhsm-go + softhsm-mock-identity-system: + namespace: softhsm enabled: true version: 12.0.1 chart: mosip/softhsm @@ -538,8 +416,8 @@ apps: preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh" postUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh" - mock-identity-system-go: - namespace: esignet-go-mock + mock-identity-system: + namespace: esignet-mock enabled: true version: 0.0.1-develop chart: mosip/mock-identity-system @@ -547,9 +425,9 @@ apps: image.repository: "mosipqa/mock-identity-system" image.tag: "develop" enable_insecure: "false" - extraEnvVarsCM[0]: "softhsm-mock-identity-system-go-share" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-go.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-go.${domain_name}" + extraEnvVarsCM[0]: "softhsm-mock-identity-system-share" + domainConfig.MOSIP_ESIGNET_HOST: "esignet.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "signup.${domain_name}" domainConfig.MOSIP_API_HOST: "api.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" @@ -569,7 +447,7 @@ apps: extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" - extraEnvVars.SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN.valueFrom.secretKeyRef.name: "softhsm-mock-identity-system-go" + extraEnvVars.SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN.valueFrom.secretKeyRef.name: "softhsm-mock-identity-system" extraEnvVars.SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.hsm_local_dir_name: "hsm-client" extraEnvVars.MOSIP_ESIGNET_MOCK_SUPPORTED_FIELDS: 'individualId\,password' @@ -587,19 +465,19 @@ apps: # --------------------------------------------------------------------------- # Mock Relying Party (Optional) # --------------------------------------------------------------------------- - mock-relying-party-service-go: - namespace: esignet-go-mock + mock-relying-party-service: + namespace: esignet-mock enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service set: image.repository: "mosipqa/mock-relying-party-service" image.tag: "develop-go" - mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-go.${domain_name}/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go.${domain_name}" - mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-go.${domain_name}/v1/esignet/oauth2/par" - mock_relying_party_service.REDIRECT_URI: "https://healthservices-go.${domain_name}/userprofile" - mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go.${domain_name}" + mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet.${domain_name}/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet.${domain_name}" + mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet.${domain_name}/v1/esignet/oauth2/par" + mock_relying_party_service.REDIRECT_URI: "https://healthservices.${domain_name}/userprofile" + mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" extraEnvVars.CLIENT_ID: "I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM" @@ -621,53 +499,19 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh" - mock-relying-party-service-go-mosipid1: - namespace: esignet-go-mosipid1 + mock-relying-party-service-mosipid: + namespace: esignet-mosipid enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service - set: - image.repository: "mosipqa/mock-relying-party-service" - image.tag: "develop-go" - mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-go-mosipid1.${domain_name}/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid1.${domain_name}" - mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-go-mosipid1.${domain_name}/v1/esignet/oauth2/par" - mock_relying_party_service.REDIRECT_URI: "https://healthservices-go-mosipid1.${domain_name}/userprofile" - mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go-mosipid1.${domain_name}" - enable_insecure: "false" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" - extraEnvVars.CLIENT_ID: "I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM" - extraEnvVars.ACRS.value: "mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet%20mosip:idp:acr:password%20mosip:idp:acr:knowledge" - extraEnvVars.DISPLAY: "page" - extraEnvVars.GRANT_TYPE: "authorization_code" - extraEnvVars.CLAIMS_LOCALES: "en" - extraEnvVars.SCOPE_USER_PROFILE: "openid profile" - extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\}\,"phone_number":\{"essential":true\}\,"email":\{"essential":true\}\,"picture":\{"essential":false\}\,"gender":\{"essential":false\}\,"birthdate":\{"essential":false\}\,"address":\{"essential":false\}\}\,"id_token":\{\}\}' - mock_relying_party_service.host: "" - mock_relying_party_service.mountDir: "" - mock_relying_party_service.healthCheckUrl: null - mock_relying_party_service.mock_relying_party_serviceMountDIr: "/home/mosip/oidc/" - mock_relying_party_service.puburl: null - mock_relying_party_service.privurl: null - mock_relying_party_service.USERINFO_RESPONSE_TYPE: "jwt" - timeout: 480 - priority: -10 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh" - - mock-relying-party-service-go-mosipid2: - namespace: esignet-go-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/mock-relying-party-service set: image.repository: "mosipqa/mock-relying-party-service" image.tag: "develop-go" - mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-go-mosipid2.${domain_name}/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-mosipid2.${domain_name}" - mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-go-mosipid2.${domain_name}/v1/esignet/oauth2/par" - mock_relying_party_service.REDIRECT_URI: "https://healthservices-go-mosipid2.${domain_name}/userprofile" - mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go-mosipid2.${domain_name}" + mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-mosipid.${domain_name}/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-mosipid.${domain_name}" + mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-mosipid.${domain_name}/v1/esignet/oauth2/par" + mock_relying_party_service.REDIRECT_URI: "https://healthservices-mosipid.${domain_name}/userprofile" + mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-mosipid.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" extraEnvVars.CLIENT_ID: "I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM" @@ -687,21 +531,21 @@ apps: timeout: 480 priority: -10 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid-preinstall.sh" - mock-relying-party-service-go-sunbird: - namespace: esignet-go-sunbird + mock-relying-party-service-sunbird: + namespace: esignet-sunbird enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service set: image.repository: "mosipqa/mock-relying-party-service" image.tag: "develop-go" - mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-go-sunbird.${domain_name}/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-go-sunbird.${domain_name}" - mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-go-sunbird.${domain_name}/v1/esignet/oauth2/par" - mock_relying_party_service.REDIRECT_URI: "https://healthservices-go-sunbird.${domain_name}/userprofile" - mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-go-sunbird.${domain_name}" + mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-sunbird.${domain_name}/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-sunbird.${domain_name}" + mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-sunbird.${domain_name}/v1/esignet/oauth2/par" + mock_relying_party_service.REDIRECT_URI: "https://healthservices-sunbird.${domain_name}/userprofile" + mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-sunbird.${domain_name}" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" extraEnvVars.CLIENT_ID: "I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM" @@ -723,21 +567,21 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh" - mock-relying-party-ui-go: - namespace: esignet-go-mock + mock-relying-party-ui: + namespace: esignet-mock enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-ui set: image.repository: "mosipqa/mock-relying-party-ui" image.tag: "develop-go" - mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-go.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-go.esignet-go-mock" - mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-go.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-go.${domain_name}/mock-relying-party-service" - mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go.${domain_name}/userprofile" - mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go.${domain_name}/registration" - mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service.esignet-mock" + mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices.${domain_name}/mock-relying-party-service" + mock_relying_party_ui.REDIRECT_URI: "https://healthservices.${domain_name}/userprofile" + mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices.${domain_name}/registration" + mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet.${domain_name}/plugins/sign-in-button-plugin.js" mock_relying_party_ui.mock_relying_party_ui_port: '5000' mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet @@ -752,28 +596,28 @@ apps: mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge - istio.hosts[0]: "healthservices-go.${domain_name}" + istio.hosts[0]: "healthservices.${domain_name}" wait: true timeout: 480 priority: -9 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh" - mock-relying-party-ui-go-mosipid1: - namespace: esignet-go-mosipid1 + mock-relying-party-ui-mosipid: + namespace: esignet-mosipid enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-ui set: image.repository: "mosipqa/mock-relying-party-ui" image.tag: "develop-go" - mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-go-mosipid1.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-go-mosipid1.esignet-go-mosipid1" - mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-go-mosipid1.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-go-mosipid1.${domain_name}/mock-relying-party-service" - mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go-mosipid1.${domain_name}/userprofile" - mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go-mosipid1.${domain_name}/registration" - mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go-mosipid1.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-mosipid.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-mosipid.esignet-mosipid" + mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-mosipid.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-mosipid.${domain_name}/mock-relying-party-service" + mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid.${domain_name}/userprofile" + mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid.${domain_name}/registration" + mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid.${domain_name}/plugins/sign-in-button-plugin.js" mock_relying_party_ui.mock_relying_party_ui_port: '5000' mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet @@ -788,64 +632,28 @@ apps: mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge - istio.hosts[0]: "healthservices-go-mosipid1.${domain_name}" + istio.hosts[0]: "healthservices-mosipid.${domain_name}" wait: true timeout: 480 priority: -9 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid-preinstall.sh" - mock-relying-party-ui-go-mosipid2: - namespace: esignet-go-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/mock-relying-party-ui - set: - image.repository: "mosipqa/mock-relying-party-ui" - image.tag: "develop-go" - mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-go-mosipid2.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-go-mosipid2.esignet-go-mosipid2" - mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-go-mosipid2.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-go-mosipid2.${domain_name}/mock-relying-party-service" - mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go-mosipid2.${domain_name}/userprofile" - mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go-mosipid2.${domain_name}/registration" - mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go-mosipid2.${domain_name}/plugins/sign-in-button-plugin.js" - mock_relying_party_ui.mock_relying_party_ui_port: '5000' - mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ - mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet - mock_relying_party_ui.DISPLAY: page - mock_relying_party_ui.PROMPT: consent - mock_relying_party_ui.GRANT_TYPE: authorization_code - mock_relying_party_ui.CLAIMS_LOCALES: en - mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile - mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' - mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' - mock_relying_party_ui.DEFAULT_LANG: en - mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' - mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize - mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge - istio.hosts[0]: "healthservices-go-mosipid2.${domain_name}" - wait: true - timeout: 480 - priority: -9 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh" - - mock-relying-party-ui-go-sunbird: - namespace: esignet-go-sunbird + mock-relying-party-ui-sunbird: + namespace: esignet-sunbird enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-ui set: image.repository: "mosipqa/mock-relying-party-ui" image.tag: "develop-go" - mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-go-sunbird.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-go-sunbird.esignet-go-sunbird" - mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-go-sunbird.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-go-sunbird.${domain_name}/mock-relying-party-service" - mock_relying_party_ui.REDIRECT_URI: "https://healthservices-go-sunbird.${domain_name}/userprofile" - mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-go-sunbird.${domain_name}/registration" - mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-go-sunbird.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-sunbird.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-sunbird.esignet-sunbird" + mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-sunbird.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-sunbird.${domain_name}/mock-relying-party-service" + mock_relying_party_ui.REDIRECT_URI: "https://healthservices-sunbird.${domain_name}/userprofile" + mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-sunbird.${domain_name}/registration" + mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-sunbird.${domain_name}/plugins/sign-in-button-plugin.js" mock_relying_party_ui.mock_relying_party_ui_port: '5000' mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet @@ -860,74 +668,42 @@ apps: mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge - istio.hosts[0]: "healthservices-go-sunbird.${domain_name}" + istio.hosts[0]: "healthservices-sunbird.${domain_name}" wait: true timeout: 480 priority: -9 hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh" - pms-partner-go-mosipid1: - namespace: esignet-go-mosipid1 - enabled: false - version: 12.2.3 - chart: mosip/pms-partner - set: - # image.repository: "mosipid/partner-management-service" - # image.tag: "1.2.2.3" - istio.gateways[0]: "pms-partner-mosipid1-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-go-mosipid1.${domain_name}" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-go-share" - priority: -9 - timeout: 1200 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/pms-partner-mosipid1-preinstall.sh" - - pms-policy-go-mosipid1: - namespace: esignet-go-mosipid1 - enabled: false - version: 12.2.3 - chart: mosip/pms-policy - set: - # image.repository: "mosipid/policy-management-service" - # image.tag: "1.2.2.2" - istio.gateways[0]: "pms-partner-mosipid1-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-go-mosipid1.${domain_name}" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-go-share" - priority: -9 - timeout: 1200 - - pms-partner-go-mosipid2: - namespace: esignet-go-mosipid2 + pms-partner-mosipid: + namespace: esignet-mosipid enabled: false version: 12.2.3 chart: mosip/pms-partner set: # image.repository: "mosipid/partner-management-service" # image.tag: "1.2.2.3" - istio.gateways[0]: "pms-partner-mosipid2-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-go-mosipid2.${domain_name}" + istio.gateways[0]: "pms-partner-mosipid-gateway" + istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid.${domain_name}" extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-go-share" + extraEnvVarsCM[1]: "esignet-config-server-share" priority: -9 timeout: 1200 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/pms-partner-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/pms-partner-mosipid-preinstall.sh" - pms-policy-go-mosipid2: - namespace: esignet-go-mosipid2 + pms-policy-mosipid: + namespace: esignet-mosipid enabled: false version: 12.2.3 chart: mosip/pms-policy set: # image.repository: "mosipid/policy-management-service" # image.tag: "1.2.2.2" - istio.gateways[0]: "pms-partner-mosipid2-gateway" + istio.gateways[0]: "pms-partner-mosipid-gateway" extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-go-share" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-go-mosipid2.${domain_name}" + extraEnvVarsCM[1]: "esignet-config-server-share" + istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid.${domain_name}" priority: -9 timeout: 1200 @@ -942,8 +718,8 @@ apps: # Onboards the eSignet MISP client — only needed with mosip-identity-plugin (plugin 2). # Runs FIRST so the MISP license key is written before mock-rp-onboarder starts. # After completion, restarts the esignet deployment to pick up the new MISP license key. - esignet-misp-onboarder-go: - namespace: esignet-go-mock + esignet-misp-onboarder: + namespace: esignet-mock enabled: false version: 0.0.1-develop chart: mosip/partner-onboarder @@ -955,7 +731,7 @@ apps: onboarding.configmaps.s3.s3-region: "" onboarding.configmaps.s3.s3-bucket-name: "onboarder" onboarding.secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" - onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-go-mock" + onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-mock" onboarding.variables.push_reports_to_s3: "true" onboarding.variables.mosipid: "false" extraEnvVarsCM[0]: "keycloak-env-vars" @@ -964,7 +740,7 @@ apps: extraEnvVarsSecret[1]: "keycloak-client-secrets" domainConfig.mosip-api-internal-host: "api-internal.${domain_name}" domainConfig.mosip-api-host: "api.${domain_name}" - domainConfig.mosip-esignet-host: "esignet-go.${domain_name}" + domainConfig.mosip-esignet-host: "esignet.${domain_name}" domainConfig.mosip-esignet-insurance-host: "esignet-insurance.${domain_name}" domainConfig.mosip-resident-host: "resident.${domain_name}" domainConfig.installation-domain: "${domain_name}" @@ -981,8 +757,8 @@ apps: # Mock RP OIDC Partner Onboarder # Onboards the mock relying party as an OIDC client. # Enable for plugin 1 (mock) or plugin 3 (sunbird-rc). Set mosipid: "true" for mosip-identity-plugin. - esignet-mock-rp-onboarder-go: - namespace: esignet-go-mock + esignet-mock-rp-onboarder: + namespace: esignet-mock enabled: true version: 0.0.1-develop chart: mosip/partner-onboarder @@ -996,14 +772,14 @@ apps: onboarding.configmaps.s3.s3-region: "" onboarding.secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" onboarding.configmaps.s3.s3-bucket-name: "onboarder" - onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-go-mock" + onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-mock" onboarding.variables.mosipid: "false" onboarding.variables.push_reports_to_s3: "true" extraEnvVarsCM[0]: "keycloak-env-vars" extraEnvVarsCM[1]: "keycloak-host" domainConfig.mosip-api-internal-host: "api-internal.${domain_name}" domainConfig.mosip-api-host: "api.${domain_name}" - domainConfig.mosip-esignet-host: "esignet-go.${domain_name}" + domainConfig.mosip-esignet-host: "esignet.${domain_name}" domainConfig.mosip-esignet-insurance-host: "esignet-insurance.${domain_name}" domainConfig.mosip-resident-host: "resident.${domain_name}" domainConfig.installation-domain: "${domain_name}" diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml index 1139c2973..dc2f0a5e4 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml @@ -35,11 +35,11 @@ helmRepos: mosip: https://mosip.github.io/mosip-helm namespaces: - signup-go: + signup: protected: false - kernel-go: + kernel: protected: false - mock-smtp-go: + mock-smtp: protected: false apps: @@ -48,8 +48,8 @@ apps: # --------------------------------------------------------------------------- # Creates mosip-signup-client with required roles in Keycloak. # Propagates mosip_signup_client_secret between keycloak and signup namespaces. - signup-keycloak-init-go: - namespace: signup-go + signup-keycloak-init: + namespace: signup enabled: false version: 12.0.2 chart: mosip/keycloak-init @@ -73,8 +73,8 @@ apps: # Required for audit logging (auditmanager), OTP generation (otpmanager), # auth token validation (authmanager), and email/SMS dispatch (notifier). # kernel-preinstall.sh creates kernel namespace and domain-config configmap. - authmanager-go: - namespace: kernel-go + authmanager: + namespace: kernel enabled: false version: 12.0.1 chart: mosip/authmanager @@ -87,8 +87,8 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" - auditmanager-go: - namespace: kernel-go + auditmanager: + namespace: kernel enabled: false version: 12.0.1 chart: mosip/auditmanager @@ -101,8 +101,8 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" - otpmanager-go: - namespace: kernel-go + otpmanager: + namespace: kernel enabled: false version: 12.0.1 chart: mosip/otpmanager @@ -113,8 +113,8 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" - notifier-go: - namespace: kernel-go + notifier: + namespace: kernel enabled: false version: 12.0.1 chart: mosip/notifier @@ -128,8 +128,8 @@ apps: # --------------------------------------------------------------------------- # Mock SMTP (Optional — dev/test email and SMS) # --------------------------------------------------------------------------- - mock-smtp-go: - namespace: mock-smtp-go + mock-smtp: + namespace: mock-smtp enabled: false version: 1.0.0 chart: mosip/mock-smtp @@ -145,8 +145,8 @@ apps: # signup-service-preinstall.sh copies redis secrets, creates keycloak-host # configmap, signup-captcha and signup-keystore secrets, and msg-gateway # configmap/secret pointing to mock-smtp. - signup-go: - namespace: signup-go + signup: + namespace: signup enabled: false version: 1.2.2 chart: mosip/signup @@ -155,8 +155,8 @@ apps: image.tag: "1.2.2" enable_insecure: "false" plugin_name_env: "esignet-mock-plugin.jar" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-go.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-go.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "esignet.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "signup.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" wait: true timeout: 600 @@ -168,18 +168,18 @@ apps: # --------------------------------------------------------------------------- # Signup UI # --------------------------------------------------------------------------- - signup-ui-go: - namespace: signup-go + signup-ui: + namespace: signup enabled: false version: 1.2.2 chart: mosip/signup-ui set: image.repository: "mosipid/signup-ui" image.tag: "1.2.2" - istio.hosts[0]: "signup-go.${domain_name}" - signup_ui.signup_service_host: "signup-go.signup-go" - signup_ui.configmaps.signup-ui.REACT_APP_API_BASE_URL: "http://signup-go.signup-go/v1/signup" - signup_ui.configmaps.signup-ui.REACT_APP_SBI_DOMAIN_URI: "http://signup-go.signup-go" + istio.hosts[0]: "signup.${domain_name}" + signup_ui.signup_service_host: "signup.signup" + signup_ui.configmaps.signup-ui.REACT_APP_API_BASE_URL: "http://signup.signup/v1/signup" + signup_ui.configmaps.signup-ui.REACT_APP_SBI_DOMAIN_URI: "http://signup.signup" wait: true timeout: 600 priority: -3 diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml index b48741524..94ca20929 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml @@ -8,32 +8,29 @@ helmRepos: mosip: https://mosip.github.io/mosip-helm # Apitestrigs deploy into service namespaces (no dedicated testrig namespaces): -# esignet-apitestrig-go → esignet-go-mock ns -# esignet-go-mosipid1-apitestrig → esignet-go-mosipid1 ns -# esignet-go-mosipid2-apitestrig → esignet-go-mosipid2 ns -# esignet-go-sunbird-apitestrig → esignet-go-sunbird ns -# esignet-signup-apitestrig-go → signup-go ns (disabled — enable if signup deployed) -# signup-uitestrig-go → signup-uitestrig-go (disabled — enable if signup deployed) +# esignet-apitestrig → esignet-mock ns +# esignet-mosipid-apitestrig → esignet-mosipid ns +# esignet-sunbird-apitestrig → esignet-sunbird ns +# esignet-signup-apitestrig → signup ns (disabled — enable if signup deployed) +# signup-uitestrig → signup-uitestrig (disabled — enable if signup deployed) namespaces: - esignet-go-mosipid1: + esignet-mock: protected: false - esignet-go-mock: + esignet-mosipid: protected: false - esignet-go-mosipid2: + esignet-sunbird: protected: false - esignet-go-sunbird: + signup: protected: false - signup-go: - protected: false - signup-uitestrig-go: + signup-uitestrig: protected: false apps: # --------------------------------------------------------------------------- # eSignet API Testrig — main esignet namespace # --------------------------------------------------------------------------- - esignet-apitestrig-go: - namespace: esignet-go-mock + esignet-apitestrig: + namespace: esignet-mock enabled: true version: 0.0.1-develop chart: mosip/apitestrig @@ -61,12 +58,12 @@ apps: apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-go-mock" + apitestrig.configmaps.apitestrig.NS: "esignet-mock" apitestrig.configmaps.apitestrig.servicesNotDeployed: '' apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-go.${domain_name}" + apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet.${domain_name}" apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" @@ -75,10 +72,10 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh" # --------------------------------------------------------------------------- - # eSignet API Testrig — esignet-mosipid1 namespace (mosip-identity-plugin) + # eSignet API Testrig — esignet-mosipid namespace (mosip-identity-plugin) # --------------------------------------------------------------------------- - esignet-go-mosipid1-apitestrig: - namespace: esignet-go-mosipid1 + esignet-mosipid-apitestrig: + namespace: esignet-mosipid enabled: true version: 0.0.1-develop chart: mosip/apitestrig @@ -89,61 +86,15 @@ apps: extraEnvVarsCM[2]: "keycloak-host" extraEnvVarsCM[3]: "db" extraEnvVarsCM[4]: "apitestrig" - extraEnvVarsSecret[0]: "apitestrig-esignet-mosipid1-apitestrig" - extraEnvVarsSecret[1]: "s3-esignet-mosipid1-apitestrig" - extraEnvVarsSecret[2]: "keycloak-client-secrets" - extraEnvVarsSecret[3]: "postgres-postgresql" - crontime: "0 2 * * *" - apitestrig.configmaps.s3.s3-host: 'http://minio.minio:9000' - apitestrig.configmaps.s3.s3-user-key: 'admin' - apitestrig.configmaps.s3.s3-region: '' - apitestrig.configmaps.db.db-server: "api-internal.${mosipid1_domain_name}" - apitestrig.configmaps.db.db-su-user: "postgres" - apitestrig.configmaps.db.db-port: "${esignet_db_port}" - apitestrig.configmaps.apitestrig.ENV_USER: "api-internal.${env_name}" - apitestrig.configmaps.apitestrig.ENV_ENDPOINT: "https://api-internal.${domain_name}" - apitestrig.configmaps.apitestrig.ENV_TESTLEVEL: "smokeAndRegression" - apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" - apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" - apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-go-mosipid1" - apitestrig.configmaps.apitestrig.servicesNotDeployed: 'sunbirdrc' - apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" - apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" - apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-go-mosipid1.${domain_name}" - apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid1_domain_name};idrepository=api-internal.${mosipid1_domain_name};authmanager=api-internal.${mosipid1_domain_name};resident=api-internal.${mosipid1_domain_name};partnermanager=pms-go-mosipid1.${mosipid1_domain_name};idauthentication=api-internal.${mosipid1_domain_name};masterdata=api-internal.${mosipid1_domain_name};idgenerator=api-internal.${mosipid1_domain_name};policymanager=pms-go-mosipid1.${mosipid1_domain_name};preregistration=api-internal.${mosipid1_domain_name};keymanager=api-internal.${mosipid1_domain_name};" - secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" - apitestrig.variables.push_reports_to_s3: "yes" - priority: -4 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh" - - # --------------------------------------------------------------------------- - # eSignet API Testrig — esignet-mosipid2 namespace (mosip-identity-plugin) - # --------------------------------------------------------------------------- - esignet-go-mosipid2-apitestrig: - namespace: esignet-go-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/apitestrig - valuesFile: "$WORKDIR/utils/esignet-apitestrig-values.yaml" - set: - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "s3" - extraEnvVarsCM[2]: "keycloak-host" - extraEnvVarsCM[3]: "db" - extraEnvVarsCM[4]: "apitestrig" - extraEnvVarsSecret[0]: "apitestrig-esignet-mosipid2-apitestrig" - extraEnvVarsSecret[1]: "s3-esignet-mosipid2-apitestrig" + extraEnvVarsSecret[0]: "apitestrig-esignet-mosipid-apitestrig" + extraEnvVarsSecret[1]: "s3-esignet-mosipid-apitestrig" extraEnvVarsSecret[2]: "keycloak-client-secrets" extraEnvVarsSecret[3]: "postgres-postgresql" crontime: "0 2 * * *" apitestrig.configmaps.s3.s3-host: 'http://minio.minio:9000' apitestrig.configmaps.s3.s3-user-key: 'admin' apitestrig.configmaps.s3.s3-region: '' - apitestrig.configmaps.db.db-server: "api-internal.${mosipid2_domain_name}" + apitestrig.configmaps.db.db-server: "api-internal.${mosipid_domain_name}" apitestrig.configmaps.db.db-su-user: "postgres" apitestrig.configmaps.db.db-port: "${esignet_db_port}" apitestrig.configmaps.apitestrig.ENV_USER: "api-internal.${env_name}" @@ -152,26 +103,26 @@ apps: apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-go-mosipid2" + apitestrig.configmaps.apitestrig.NS: "esignet-mosipid" apitestrig.configmaps.apitestrig.servicesNotDeployed: 'sunbirdrc' apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-go-mosipid2.${domain_name}" + apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-mosipid.${domain_name}" apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid2_domain_name};idrepository=api-internal.${mosipid2_domain_name};authmanager=api-internal.${mosipid2_domain_name};resident=api-internal.${mosipid2_domain_name};partnermanager=pms-go-mosipid2.${mosipid2_domain_name};idauthentication=api-internal.${mosipid2_domain_name};masterdata=api-internal.${mosipid2_domain_name};idgenerator=api-internal.${mosipid2_domain_name};policymanager=pms-go-mosipid2.${mosipid2_domain_name};preregistration=api-internal.${mosipid2_domain_name};keymanager=api-internal.${mosipid2_domain_name};" + apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid_domain_name};idrepository=api-internal.${mosipid_domain_name};authmanager=api-internal.${mosipid_domain_name};resident=api-internal.${mosipid_domain_name};partnermanager=pms-mosipid.${mosipid_domain_name};idauthentication=api-internal.${mosipid_domain_name};masterdata=api-internal.${mosipid_domain_name};idgenerator=api-internal.${mosipid_domain_name};policymanager=pms-mosipid.${mosipid_domain_name};preregistration=api-internal.${mosipid_domain_name};keymanager=api-internal.${mosipid_domain_name};" secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" priority: -3 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid-setup.sh" # --------------------------------------------------------------------------- # eSignet API Testrig — esignet-sunbird namespace (sunbird-rc-plugin) # postInstall triggers all four testrig namespaces after last one deploys. # --------------------------------------------------------------------------- - esignet-go-sunbird-apitestrig: - namespace: esignet-go-sunbird + esignet-sunbird-apitestrig: + namespace: esignet-sunbird enabled: true version: 0.0.1-develop chart: mosip/apitestrig @@ -199,14 +150,14 @@ apps: apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-go-sunbird" + apitestrig.configmaps.apitestrig.NS: "esignet-sunbird" apitestrig.configmaps.apitestrig.servicesNotDeployed: '' apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-go-sunbird.${domain_name}" + apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-sunbird.${domain_name}" apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.sunBirdBaseURL: "https://registry.${mosipid1_domain_name}" + apitestrig.configmaps.apitestrig.sunBirdBaseURL: "https://registry.${mosipid_domain_name}" secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" priority: -2 @@ -218,8 +169,8 @@ apps: # Signup API Test Rig — disabled by default # Enable only if signup stack (signup-dsf) is deployed. # --------------------------------------------------------------------------- - esignet-signup-apitestrig-go: - namespace: signup-go + esignet-signup-apitestrig: + namespace: signup enabled: false version: 0.0.1-develop chart: mosip/apitestrig @@ -238,7 +189,7 @@ apps: apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "signup-go" + apitestrig.configmaps.apitestrig.NS: "signup" apitestrig.configmaps.apitestrig.servicesNotDeployed: '' secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" @@ -250,8 +201,8 @@ apps: # Signup UI Test Rig — disabled by default # Enable only if signup stack (signup-dsf) is deployed. # --------------------------------------------------------------------------- - signup-uitestrig-go: - namespace: signup-uitestrig-go + signup-uitestrig: + namespace: signup-uitestrig enabled: false version: 0.0.1-develop chart: mosip/uitestrig @@ -269,7 +220,7 @@ apps: uitestrig.configmaps.uitestrig.reportExpirationInDays: "3" uitestrig.configmaps.uitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" uitestrig.configmaps.uitestrig.eSignetDeployed: "yes" - uitestrig.configmaps.uitestrig.NS: "signup-uitestrig-go" + uitestrig.configmaps.uitestrig.NS: "signup-uitestrig" uitestrig.variables.push_reports_to_s3: "yes" priority: -1 hooks: diff --git a/Helmsman/utils/esignet-standalone-2.0.0/config-server-esignet-values-2-0-0.yaml b/Helmsman/utils/esignet-standalone-2.0.0/config-server-esignet-values-2-0-0.yaml index 45598cc92..7ad1685a5 100644 --- a/Helmsman/utils/esignet-standalone-2.0.0/config-server-esignet-values-2-0-0.yaml +++ b/Helmsman/utils/esignet-standalone-2.0.0/config-server-esignet-values-2-0-0.yaml @@ -96,21 +96,21 @@ envVariables: - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_SOFTHSM_ESIGNET_SECURITY_PIN valueFrom: secretKeyRef: - name: esignet-softhsm-go + name: esignet-softhsm key: security-pin enabled: true - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_ESIGNET_CAPTCHA_SECRET_KEY valueFrom: secretKeyRef: - name: esignet-captcha-go + name: esignet-captcha key: esignet-captcha-secret-key enabled: true - name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_ESIGNET_CAPTCHA_SITE_KEY valueFrom: secretKeyRef: - name: esignet-captcha-go + name: esignet-captcha key: esignet-captcha-site-key enabled: true diff --git a/Helmsman/utils/softhsm-esignet-mosipid1-values.yaml b/Helmsman/utils/softhsm-esignet-mosipid-values.yaml similarity index 90% rename from Helmsman/utils/softhsm-esignet-mosipid1-values.yaml rename to Helmsman/utils/softhsm-esignet-mosipid-values.yaml index 526bf77c7..0354bf98d 100644 --- a/Helmsman/utils/softhsm-esignet-mosipid1-values.yaml +++ b/Helmsman/utils/softhsm-esignet-mosipid-values.yaml @@ -1,4 +1,4 @@ -# SoftHSM values for esignet-mosipid1 namespace +# SoftHSM values for esignet-mosipid namespace # Identical to softhsm-esignet-values.yaml — separate file so each namespace # gets an independent SoftHSM PVC and pin secret. diff --git a/Helmsman/utils/softhsm-esignet-mosipid2-values.yaml b/Helmsman/utils/softhsm-esignet-mosipid2-values.yaml deleted file mode 100644 index 7df046d37..000000000 --- a/Helmsman/utils/softhsm-esignet-mosipid2-values.yaml +++ /dev/null @@ -1,28 +0,0 @@ -# SoftHSM values for esignet-mosipid2 namespace -# Identical to softhsm-esignet-values.yaml — separate file so each namespace -# gets an independent SoftHSM PVC and pin secret. - -replicaCount: 1 - -image: - repository: mosipid/softhsm - tag: v2 - pullPolicy: Always - -persistence: - enabled: true - size: 1Gi - storageClass: "" - -resources: - requests: - cpu: 100m - memory: 128Mi - limits: - cpu: 500m - memory: 512Mi - -securityContext: - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 From 21e4675a1dadc2150d840c4215ef3e79bb4a8972 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 15:23:09 +0530 Subject: [PATCH 26/61] Drop -go suffix and consolidate mosipid1/mosipid2 in esignet-standalone-2.0.0 hooks Updates namespace/secret/configmap names and kubectl patches in all hook scripts to match the DSF rename, removes the 7 mosipid1-only scripts (superseded by the consolidated mosipid instance), and deletes 2 dead scripts that duplicated the shared external-dsf.yaml's own hooks and were never referenced by any DSF file. Also adds explicit cleanup of stale pre-rename captcha env var names on the shared captcha Deployment (captcha-postinstall.sh, esignet-mosipid-preinstall.sh, esignet-sunbird-preinstall.sh), so renaming the underlying secrets doesn't leave orphaned env vars pointing at secrets that no longer exist. Co-Authored-By: Claude Sonnet 5 Signed-off-by: bhumi46 --- ...sh => apitestrig-esignet-mosipid-setup.sh} | 22 +-- .../apitestrig-esignet-mosipid2-setup.sh | 39 ----- .../apitestrig-esignet-setup.sh | 4 +- .../apitestrig-esignet-sunbird-setup.sh | 4 +- .../apitestrig-signup-setup.sh | 2 +- .../captcha-postinstall.sh | 34 ++-- .../config-server-esignet-postinstall.sh | 28 ++-- .../config-server-esignet-setup.sh | 6 +- .../esignet-db-postinstall.sh | 23 --- .../esignet-init-db.sh | 24 --- .../esignet-misp-onboarder-postinstall.sh | 22 +-- .../esignet-misp-onboarder-preinstall.sh | 2 +- .../esignet-mock-rp-onboarder-postinstall.sh | 18 +-- .../esignet-mock-rp-onboarder-preinstall.sh | 2 +- ...stall.sh => esignet-mosipid-preinstall.sh} | 95 ++++++----- .../esignet-mosipid1-preinstall.sh | 150 ------------------ .../esignet-postinstall-keycloak-init.sh | 8 +- .../esignet-preinstall.sh | 8 +- .../esignet-sunbird-preinstall.sh | 37 +++-- .../kafka-postinstall.sh | 2 +- .../kernel-preinstall.sh | 2 +- .../keycloak-postinstall.sh | 2 +- .../mock-identity-init-db.sh | 4 +- .../mock-identity-system-preinstall.sh | 24 +-- ...lying-party-service-mosipid-preinstall.sh} | 6 +- ...lying-party-service-mosipid2-preinstall.sh | 10 -- .../mock-relying-party-service-preinstall.sh | 2 +- ...elying-party-service-sunbird-preinstall.sh | 2 +- ...ck-relying-party-ui-mosipid-preinstall.sh} | 14 +- ...ck-relying-party-ui-mosipid2-preinstall.sh | 24 --- .../mock-relying-party-ui-preinstall.sh | 4 +- ...ock-relying-party-ui-sunbird-preinstall.sh | 4 +- .../notifier-postinstall.sh | 6 +- ...stall.sh => oidc-ui-mosipid-preinstall.sh} | 6 +- .../oidc-ui-mosipid1-preinstall.sh | 9 -- .../oidc-ui-preinstall.sh | 2 +- .../oidc-ui-sunbird-preinstall.sh | 2 +- ...l.sh => pms-partner-mosipid-preinstall.sh} | 20 +-- .../pms-partner-mosipid1-preinstall.sh | 45 ------ .../postgres-preinstall.sh | 2 +- .../esignet-standalone-2.0.0/redis-setup.sh | 2 +- .../signup-init-db.sh | 2 +- .../signup-keycloak-init-postinstall.sh | 2 +- .../signup-keycloak-init-preinstall.sh | 2 +- .../signup-service-preinstall.sh | 26 +-- ...up.sh => softhsm-esignet-mosipid-setup.sh} | 6 +- .../softhsm-esignet-mosipid2-setup.sh | 9 -- .../softhsm-esignet-postinstall.sh | 16 +- .../softhsm-esignet-setup.sh | 2 +- .../softhsm-esignet-sunbird-setup.sh | 2 +- ...ofthsm-mock-identity-system-postinstall.sh | 12 +- ...softhsm-mock-identity-system-preinstall.sh | 4 +- .../trigger-test-jobs-esignet.sh | 29 ++-- .../uitestrig-signup-setup.sh | 4 +- 54 files changed, 269 insertions(+), 569 deletions(-) rename Helmsman/hooks/esignet-standalone-2.0.0/{apitestrig-esignet-mosipid1-setup.sh => apitestrig-esignet-mosipid-setup.sh} (68%) delete mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh delete mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/esignet-db-postinstall.sh delete mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/esignet-init-db.sh rename Helmsman/hooks/esignet-standalone-2.0.0/{esignet-mosipid2-preinstall.sh => esignet-mosipid-preinstall.sh} (53%) delete mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh rename Helmsman/hooks/esignet-standalone-2.0.0/{mock-relying-party-service-mosipid1-preinstall.sh => mock-relying-party-service-mosipid-preinstall.sh} (68%) delete mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh rename Helmsman/hooks/esignet-standalone-2.0.0/{mock-relying-party-ui-mosipid1-preinstall.sh => mock-relying-party-ui-mosipid-preinstall.sh} (57%) delete mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh rename Helmsman/hooks/esignet-standalone-2.0.0/{oidc-ui-mosipid2-preinstall.sh => oidc-ui-mosipid-preinstall.sh} (66%) delete mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh rename Helmsman/hooks/esignet-standalone-2.0.0/{pms-partner-mosipid2-preinstall.sh => pms-partner-mosipid-preinstall.sh} (61%) delete mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid1-preinstall.sh rename Helmsman/hooks/esignet-standalone-2.0.0/{softhsm-esignet-mosipid1-setup.sh => softhsm-esignet-mosipid-setup.sh} (65%) delete mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid2-setup.sh diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid-setup.sh similarity index 68% rename from Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh rename to Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid-setup.sh index 14b70b216..085a41dfb 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid-setup.sh @@ -1,22 +1,22 @@ #!/bin/bash # ============================================================================= -# eSignet Standalone 2.0.0 - eSignet-MOSIPID1 API Testrig Pre-install Setup +# eSignet Standalone 2.0.0 - eSignet-MOSIPID API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-mosipid1 namespace for the esignet-go-mosipid1-apitestrig release. -# keycloak-host and keycloak-client-secrets are already present in esignet-mosipid1 +# Prepares the esignet-mosipid namespace for the esignet-mosipid-apitestrig release. +# keycloak-host and keycloak-client-secrets are already present in esignet-mosipid # (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, -# and the s3-esignet-mosipid1-apitestrig / apitestrig-esignet-mosipid1-apitestrig +# and the s3-esignet-mosipid-apitestrig / apitestrig-esignet-mosipid-apitestrig # secrets referenced by extraEnvVarsSecret are created here (chart doesn't create # them itself); stale testrig CMs are deleted so the chart recreates them. # ============================================================================= set -euo pipefail -NS=esignet-go-mosipid1 +NS=esignet-mosipid COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" echo "================================================" -echo "eSignet Standalone 2.0.0 - eSignet-MOSIPID1 API Testrig Pre-install" +echo "eSignet Standalone 2.0.0 - eSignet-MOSIPID API Testrig Pre-install" echo "================================================" echo "Deleting stale testrig configmaps in $NS" @@ -24,16 +24,16 @@ kubectl -n "$NS" delete --ignore-not-found=true configmap s3 kubectl -n "$NS" delete --ignore-not-found=true configmap db kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig -echo "Creating s3-esignet-mosipid1-apitestrig secret in $NS" -kubectl -n "$NS" create secret generic s3-esignet-mosipid1-apitestrig \ +echo "Creating s3-esignet-mosipid-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic s3-esignet-mosipid-apitestrig \ --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \ --dry-run=client -o yaml | kubectl apply -f - -echo "Creating apitestrig-esignet-mosipid1-apitestrig secret in $NS" -kubectl -n "$NS" create secret generic apitestrig-esignet-mosipid1-apitestrig \ +echo "Creating apitestrig-esignet-mosipid-apitestrig secret in $NS" +kubectl -n "$NS" create secret generic apitestrig-esignet-mosipid-apitestrig \ --dry-run=client -o yaml | kubectl apply -f - echo "Copying postgres-postgresql secret to $NS" $COPY_UTIL secret postgres-postgresql postgres "$NS" -echo "eSignet-MOSIPID1 API Testrig pre-install setup completed." +echo "eSignet-MOSIPID API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh deleted file mode 100755 index 072faec92..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh +++ /dev/null @@ -1,39 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet Standalone 2.0.0 - eSignet-MOSIPID2 API Testrig Pre-install Setup -# ============================================================================= -# Prepares the esignet-mosipid2 namespace for the esignet-go-mosipid2-apitestrig release. -# keycloak-host and keycloak-client-secrets are already present in esignet-mosipid2 -# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, -# and the s3-esignet-mosipid2-apitestrig / apitestrig-esignet-mosipid2-apitestrig -# secrets referenced by extraEnvVarsSecret are created here (chart doesn't create -# them itself); stale testrig CMs are deleted so the chart recreates them. -# ============================================================================= -set -euo pipefail - -NS=esignet-go-mosipid2 -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" - -echo "================================================" -echo "eSignet Standalone 2.0.0 - eSignet-MOSIPID2 API Testrig Pre-install" -echo "================================================" - -echo "Deleting stale testrig configmaps in $NS" -kubectl -n "$NS" delete --ignore-not-found=true configmap s3 -kubectl -n "$NS" delete --ignore-not-found=true configmap db -kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig - -echo "Creating s3-esignet-mosipid2-apitestrig secret in $NS" -kubectl -n "$NS" create secret generic s3-esignet-mosipid2-apitestrig \ - --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \ - --dry-run=client -o yaml | kubectl apply -f - - -echo "Creating apitestrig-esignet-mosipid2-apitestrig secret in $NS" -kubectl -n "$NS" create secret generic apitestrig-esignet-mosipid2-apitestrig \ - --dry-run=client -o yaml | kubectl apply -f - - -echo "Copying postgres-postgresql secret to $NS" -$COPY_UTIL secret postgres-postgresql postgres "$NS" - -echo "eSignet-MOSIPID2 API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh index ebd79e8e9..b44bfdeae 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh @@ -2,7 +2,7 @@ # ============================================================================= # eSignet Standalone 2.0.0 - eSignet API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-mock namespace for the esignet-apitestrig-go release. +# Prepares the esignet-mock namespace for the esignet-apitestrig release. # keycloak-host and keycloak-client-secrets are already present in esignet-mock ns # (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, # and the s3-esignet-apitestrig / apitestrig-esignet-apitestrig secrets referenced @@ -11,7 +11,7 @@ # ============================================================================= set -euo pipefail -NS=esignet-go-mock +NS=esignet-mock COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh index d7adbcca9..ca432b01c 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh @@ -2,7 +2,7 @@ # ============================================================================= # eSignet Standalone 2.0.0 - eSignet-Sunbird API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-sunbird namespace for the esignet-go-sunbird-apitestrig release. +# Prepares the esignet-sunbird namespace for the esignet-sunbird-apitestrig release. # keycloak-host and keycloak-client-secrets are already present in esignet-sunbird # (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied, # and the s3-esignet-sunbird-apitestrig / apitestrig-esignet-sunbird-apitestrig @@ -11,7 +11,7 @@ # ============================================================================= set -euo pipefail -NS=esignet-go-sunbird +NS=esignet-sunbird COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-signup-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-signup-setup.sh index f66a44b22..d03208a1e 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-signup-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-signup-setup.sh @@ -9,7 +9,7 @@ # ============================================================================= set -euo pipefail -NS=signup-go +NS=signup COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh index 60ef72d59..a6e42e923 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh @@ -9,11 +9,11 @@ # Environment Variables: # ESIGNET_CAPTCHA_SITE_KEY - reCAPTCHA site key (REQUIRED) # ESIGNET_CAPTCHA_SECRET_KEY - reCAPTCHA secret key (REQUIRED) -# ESIGNET_NS - eSignet namespace (default: esignet-go-mock) +# ESIGNET_NS - eSignet namespace (default: esignet-mock) # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" CAPTCHA_NS="captcha" CAPTCHA_SITE_KEY="${ESIGNET_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_CAPTCHA_SITE_KEY environment variable must be set}" CAPTCHA_SECRET_KEY="${ESIGNET_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_CAPTCHA_SECRET_KEY environment variable must be set}" @@ -24,22 +24,36 @@ echo "eSignet 1.7.1 - Captcha Post-install" echo "================================================" # --- Step 1: Create captcha secrets for eSignet --- -echo "Creating esignet-captcha-go secret in $ESIGNET_NS namespace" -kubectl -n "$ESIGNET_NS" create secret generic esignet-captcha-go \ +echo "Creating esignet-captcha secret in $ESIGNET_NS namespace" +kubectl -n "$ESIGNET_NS" create secret generic esignet-captcha \ --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ --dry-run=client -o yaml | kubectl apply -f - # --- Step 2: Copy captcha secret to captcha namespace --- -echo "Copying esignet-captcha-go secret to $CAPTCHA_NS namespace" -$COPY_UTIL secret esignet-captcha-go "$ESIGNET_NS" "$CAPTCHA_NS" +echo "Copying esignet-captcha secret to $CAPTCHA_NS namespace" +$COPY_UTIL secret esignet-captcha "$ESIGNET_NS" "$CAPTCHA_NS" # --- Step 3: Patch captcha deployment with secret env var --- echo "Patching captcha deployment with secret key environment variable" -ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO')].name}" 2>/dev/null || echo "") + +# Remove the old pre-rename env var name if still present, so it doesn't linger +# pointing at a secret that no longer exists (esignet-captcha-go was renamed to +# esignet-captcha). +OLD_ENV_INDEX=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ + -o jsonpath="{range .spec.template.spec.containers[0].env[*]}{.name}{'\n'}{end}" 2>/dev/null \ + | grep -n -x "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO" | cut -d: -f1 || echo "") +if [[ -n "$OLD_ENV_INDEX" ]]; then + OLD_ENV_ARRAY_INDEX=$((OLD_ENV_INDEX - 1)) + echo "Removing stale MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO env var (index $OLD_ENV_ARRAY_INDEX)" + kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ + -p="[{\"op\": \"remove\", \"path\": \"/spec/template/spec/containers/0/env/$OLD_ENV_ARRAY_INDEX\"}]" +fi + +ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET')].name}" 2>/dev/null || echo "") if [[ -z "$ENV_VAR_EXISTS" ]]; then - echo "Adding MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO env var..." + echo "Adding MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET env var..." ENV_ARRAY_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ -o jsonpath="{.spec.template.spec.containers[0].env}" 2>/dev/null || echo "") if [[ -z "$ENV_ARRAY_EXISTS" ]]; then @@ -48,9 +62,9 @@ if [[ -z "$ENV_VAR_EXISTS" ]]; then -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env", "value": []}]' fi kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-go", "key": "esignet-captcha-secret-key"}}}}]' + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha", "key": "esignet-captcha-secret-key"}}}}]' else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO env var already exists." + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET env var already exists." fi echo "Captcha post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh index 165989433..23d740745 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh @@ -1,39 +1,33 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Config-Server eSignet Post-install +# eSignet 2.0.0 (Go) - Config-Server eSignet Post-install # ============================================================================= -# Copies esignet-config-server-share CM from esignet-mock ns to mosipid1/mosipid2/sunbird, +# Copies esignet-config-server-share CM from esignet-mock ns to mosipid/sunbird, # then patches active_profile_env and spring_config_label_env per namespace # so each instance points to the correct config server profile and Git label. # # Environment variables (set in GitHub Actions workflow): -# ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL - Git label for esignet-mosipid1 (default: develop) -# ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL - Git label for esignet-mosipid2 (default: develop) +# ESIGNET_MOSIPID_SPRING_CONFIG_LABEL - Git label for esignet-mosipid (default: develop) # ============================================================================= set -euo pipefail -SOURCE_NS="esignet-go-mock" +SOURCE_NS="esignet-mock" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -CM_NAME="esignet-config-server-go-share" +CM_NAME="esignet-config-server-share" -MOSIPID1_SPRING_LABEL="${ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL:-develop}" -MOSIPID2_SPRING_LABEL="${ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL:-develop}" +MOSIPID_SPRING_LABEL="${ESIGNET_MOSIPID_SPRING_CONFIG_LABEL:-develop}" echo "================================================" -echo "eSignet 1.7.1 - Config-Server eSignet Post-install" +echo "eSignet 2.0.0 (Go) - Config-Server eSignet Post-install" echo "================================================" -for TARGET_NS in esignet-go-mosipid1 esignet-go-mosipid2 esignet-go-sunbird; do +for TARGET_NS in esignet-mosipid esignet-sunbird; do echo "Copying $CM_NAME from $SOURCE_NS to $TARGET_NS" $COPY_UTIL configmap "$CM_NAME" "$SOURCE_NS" "$TARGET_NS" done -echo "Patching $CM_NAME in esignet-go-mosipid1 (active_profile_env=mosipid1, spring_config_label_env=$MOSIPID1_SPRING_LABEL)" -kubectl -n esignet-go-mosipid1 patch configmap "$CM_NAME" --type merge \ - -p "{\"data\":{\"active_profile_env\":\"mosipid1\",\"spring_config_label_env\":\"$MOSIPID1_SPRING_LABEL\"}}" - -echo "Patching $CM_NAME in esignet-go-mosipid2 (active_profile_env=mosipid2, spring_config_label_env=$MOSIPID2_SPRING_LABEL)" -kubectl -n esignet-go-mosipid2 patch configmap "$CM_NAME" --type merge \ - -p "{\"data\":{\"active_profile_env\":\"mosipid2\",\"spring_config_label_env\":\"$MOSIPID2_SPRING_LABEL\"}}" +echo "Patching $CM_NAME in esignet-mosipid (active_profile_env=mosipid, spring_config_label_env=$MOSIPID_SPRING_LABEL)" +kubectl -n esignet-mosipid patch configmap "$CM_NAME" --type merge \ + -p "{\"data\":{\"active_profile_env\":\"mosipid\",\"spring_config_label_env\":\"$MOSIPID_SPRING_LABEL\"}}" echo "Config-server share configmap propagation and patching completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh index b2e028f2c..ee1798d92 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh @@ -29,7 +29,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" POSTGRES_NS="postgres" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" @@ -54,11 +54,11 @@ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ --from-literal=installation-domain="${domain_name}" \ --from-literal=mosip-api-host="api.${domain_name}" \ --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet-go.${domain_name}" \ + --from-literal=mosip-esignet-host="esignet.${domain_name}" \ --from-literal=mosip-iam-external-host="iam.${domain_name}" \ --from-literal=mosip-kafka-host="kafka.${domain_name}" \ --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup-go.${domain_name}" \ + --from-literal=mosip-signup-host="signup.${domain_name}" \ --from-literal=mosip-smtp-host="smtp.${domain_name}" \ --from-literal=mosip-version="develop" \ --dry-run=client -o yaml | kubectl apply -f - diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-db-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-db-postinstall.sh deleted file mode 100755 index 27b7e4a3d..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-db-postinstall.sh +++ /dev/null @@ -1,23 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - Database Init Post-install (postgres-init-esignet-mock) -# ============================================================================= -# postgres-init-esignet-mock runs in the postgres namespace and creates -# db-common-secrets there. This hook copies it to all esignet-mock namespaces -# so each eSignet instance can use it for DB connections. -# ============================================================================= -set -euo pipefail - -POSTGRES_NS="postgres" -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" - -echo "================================================" -echo "eSignet 1.7.1 - Database Init Post-install" -echo "================================================" - -for NS in esignet-go-mock esignet-go-mosipid1 esignet-go-mosipid2 esignet-go-sunbird; do - echo "Copying db-common-secrets from $POSTGRES_NS to $NS" - $COPY_UTIL secret db-common-secrets "$POSTGRES_NS" "$NS" -done - -echo "Database init post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-init-db.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-init-db.sh deleted file mode 100755 index c597726bc..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-init-db.sh +++ /dev/null @@ -1,24 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - Database Init Pre-install (postgres-init-esignet-mock) -# ============================================================================= -# Based on: deploy/postgres/postgres-init.sh -# postgres-init-esignet-mock runs in the postgres namespace so it can access -# postgres-postgresql secret natively. This hook pre-creates all esignet-mock -# namespaces so the postInstall hook can copy db-common-secrets into each. -# Namespaces are created here at priority -16 because the namespace-specific -# preinstall hooks (esignet-mosipid1/mosipid2/sunbird) only run at priority -14. -# ============================================================================= -set -euo pipefail - -echo "================================================" -echo "eSignet 1.7.1 - Database Init Pre-install" -echo "================================================" - -for NS in esignet-go-mock esignet-go-mosipid1 esignet-go-mosipid2 esignet-go-sunbird; do - kubectl create namespace "$NS" --dry-run=client -o yaml | kubectl apply -f - - kubectl label namespace "$NS" istio-injection=enabled --overwrite - echo "Namespace $NS ready." -done - -echo "Database init pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh index f26e8ed56..c6b88a7b2 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh @@ -8,14 +8,14 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" echo "================================================" echo "eSignet 1.7.1 - MISP Onboarder Post-install" echo "================================================" JOB_STATUS=$(kubectl -n "$ESIGNET_NS" get jobs \ - -l app.kubernetes.io/instance=esignet-misp-onboarder-go \ + -l app.kubernetes.io/instance=esignet-misp-onboarder \ -o jsonpath='{.items[0].status.succeeded}' 2>/dev/null || echo "") # Always restore namespace injection before returning from this hook. @@ -24,24 +24,24 @@ echo "Istio injection re-enabled on namespace $ESIGNET_NS." if ! [[ "$JOB_STATUS" =~ ^[1-9][0-9]*$ ]]; then echo "WARNING: onboarding job may not have completed. Check logs:" - kubectl -n "$ESIGNET_NS" logs -l app.kubernetes.io/instance=esignet-misp-onboarder-go --tail=30 2>/dev/null || true + kubectl -n "$ESIGNET_NS" logs -l app.kubernetes.io/instance=esignet-misp-onboarder --tail=30 2>/dev/null || true exit 1 fi echo "eSignet MISP partner onboarding completed successfully." # Restart config-server first so it reloads the MISP key from the secret, # then restart esignet so it fetches the updated config from config-server. -if kubectl -n "$ESIGNET_NS" get deployment esignet-config-server-go &>/dev/null; then - kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-config-server-go - kubectl -n "$ESIGNET_NS" rollout status deployment esignet-config-server-go --timeout=300s - echo "esignet-config-server-go restarted." +if kubectl -n "$ESIGNET_NS" get deployment esignet-config-server &>/dev/null; then + kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-config-server + kubectl -n "$ESIGNET_NS" rollout status deployment esignet-config-server --timeout=300s + echo "esignet-config-server restarted." else - echo "esignet-config-server-go deployment not found — skipping restart." + echo "esignet-config-server deployment not found — skipping restart." fi -if kubectl -n "$ESIGNET_NS" get deployment esignet-go-mock &>/dev/null; then - kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-go-mock - kubectl -n "$ESIGNET_NS" rollout status deployment esignet-go-mock --timeout=300s +if kubectl -n "$ESIGNET_NS" get deployment esignet-mock &>/dev/null; then + kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-mock + kubectl -n "$ESIGNET_NS" rollout status deployment esignet-mock --timeout=300s echo "esignet deployment restarted." else echo "esignet deployment not found — skipping restart." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh index e8dc9d7e8..a4feb8aa1 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh @@ -12,7 +12,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" KEYCLOAK_NS="keycloak" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh index 18f4d4708..43204af80 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh @@ -7,21 +7,21 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" echo "================================================" echo "eSignet 1.7.1 - Mock RP Onboarder Post-install" echo "================================================" JOB_STATUS=$(kubectl -n "$ESIGNET_NS" get jobs \ - -l app.kubernetes.io/instance=esignet-mock-rp-onboarder-go \ + -l app.kubernetes.io/instance=esignet-mock-rp-onboarder \ -o jsonpath='{.items[0].status.succeeded}' 2>/dev/null || echo "") if [ "$JOB_STATUS" = "1" ]; then echo "Mock RP OIDC partner onboarding completed successfully." else echo "WARNING: onboarding job may not have completed. Check logs:" - kubectl -n "$ESIGNET_NS" logs -l app.kubernetes.io/instance=esignet-mock-rp-onboarder-go --tail=30 2>/dev/null || true + kubectl -n "$ESIGNET_NS" logs -l app.kubernetes.io/instance=esignet-mock-rp-onboarder --tail=30 2>/dev/null || true fi # Re-enable Istio sidecar injection now that the Job has completed @@ -29,13 +29,13 @@ kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite echo "Istio injection re-enabled on namespace $ESIGNET_NS." # Restart mock-relying-party-service so it picks up the newly onboarded OIDC client -if kubectl -n "$ESIGNET_NS" get deployment mock-relying-party-service-go &>/dev/null; then - kubectl -n "$ESIGNET_NS" rollout restart deployment mock-relying-party-service-go - kubectl -n "$ESIGNET_NS" rollout status deployment mock-relying-party-service-go --timeout=300s || \ - echo "WARNING: mock-relying-party-service-go rollout did not complete within timeout." >&2 - echo "mock-relying-party-service-go restarted." +if kubectl -n "$ESIGNET_NS" get deployment mock-relying-party-service &>/dev/null; then + kubectl -n "$ESIGNET_NS" rollout restart deployment mock-relying-party-service + kubectl -n "$ESIGNET_NS" rollout status deployment mock-relying-party-service --timeout=300s || \ + echo "WARNING: mock-relying-party-service rollout did not complete within timeout." >&2 + echo "mock-relying-party-service restarted." else - echo "mock-relying-party-service-go deployment not found — skipping restart." + echo "mock-relying-party-service deployment not found — skipping restart." fi echo "Mock RP onboarder post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh index 14d494299..3cf764670 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh @@ -7,7 +7,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" KEYCLOAK_NS="keycloak" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh similarity index 53% rename from Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh rename to Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh index e9346235e..92b506c9e 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid2-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh @@ -1,41 +1,41 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet MOSIPID2 Service Pre-install +# eSignet 1.7.1 - eSignet MOSIPID Service Pre-install # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid2, runs base esignet preinstall (copies -# postgres + redis config/secrets), then creates esignet-captcha-go-mosipid2 secret -# in the captcha namespace from workflow env vars, copies it to esignet-mosipid2, -# and patches the captcha deployment with the MOSIPID2 secret key. +# Wrapper: sets ESIGNET_NS=esignet-mosipid, runs base esignet preinstall (copies +# postgres + redis config/secrets), then creates esignet-captcha-mosipid secret +# in the captcha namespace from workflow env vars, copies it to esignet-mosipid, +# and patches the captcha deployment with the MOSIPID secret key. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-go-mosipid2" +export ESIGNET_NS="esignet-mosipid" CAPTCHA_NS="captcha" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY must be set}" -CAPTCHA_SECRET_KEY="${ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY must be set}" -MOSIPID2_POSTGRES_PASS="${MOSIPID2_POSTGRES_PASSWORD:?ERROR: MOSIPID2_POSTGRES_PASSWORD must be set}" -MOSIPID2_KC_ADMIN_PASS="${MOSIPID2_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID2_KEYCLOAK_ADMIN_PASSWORD must be set}" +CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID_CAPTCHA_SITE_KEY must be set}" +CAPTCHA_SECRET_KEY="${ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY must be set}" +MOSIPID_POSTGRES_PASS="${MOSIPID_POSTGRES_PASSWORD:?ERROR: MOSIPID_POSTGRES_PASSWORD must be set}" +MOSIPID_KC_ADMIN_PASS="${MOSIPID_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID_KEYCLOAK_ADMIN_PASSWORD must be set}" "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh" -# Create MOSIPID2-specific esignet-global — same domain_name, but esignet/signup hosts differ +# Create MOSIPID-specific esignet-global — same domain_name, but esignet/signup hosts differ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ --from-literal=installation-domain="${domain_name}" \ --from-literal=mosip-api-host="api.${domain_name}" \ --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet-go-mosipid2.${domain_name}" \ + --from-literal=mosip-esignet-host="esignet-mosipid.${domain_name}" \ --from-literal=mosip-iam-external-host="iam.${domain_name}" \ --from-literal=mosip-kafka-host="kafka.${domain_name}" \ --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup-go-mosipid2.${domain_name}" \ + --from-literal=mosip-signup-host="signup-mosipid.${domain_name}" \ --from-literal=mosip-smtp-host="smtp.${domain_name}" \ --from-literal=mosip-version="develop" \ --dry-run=client -o yaml | kubectl apply -f - -# Override postgres-config with MOSIPID2-specific DB values (2.0.0: isolated database) +# Override postgres-config with MOSIPID-specific DB values (2.0.0: isolated database) kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_go_mosipid2","database-username":"esignetuser_go_mosipid2"}}' + -p '{"data":{"database-name":"mosip_esignet_mosipid","database-username":"esignetuser_mosipid"}}' # Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then @@ -44,50 +44,65 @@ if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" fi -echo "Creating esignet-captcha-go-mosipid2 secret in $CAPTCHA_NS namespace" -kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-go-mosipid2 \ +echo "Creating esignet-captcha-mosipid secret in $CAPTCHA_NS namespace" +kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-mosipid \ --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ --dry-run=client -o yaml | kubectl apply -f - -echo "Copying esignet-captcha-go-mosipid2 secret from $CAPTCHA_NS to $ESIGNET_NS" -$COPY_UTIL secret esignet-captcha-go-mosipid2 "$CAPTCHA_NS" "$ESIGNET_NS" +echo "Copying esignet-captcha-mosipid secret from $CAPTCHA_NS to $ESIGNET_NS" +$COPY_UTIL secret esignet-captcha-mosipid "$CAPTCHA_NS" "$ESIGNET_NS" + +echo "Patching captcha deployment with ESIGNETMOSIPID secret key" + +# Remove stale pre-rename/pre-consolidation env var names if still present, so they +# don't linger pointing at secrets that no longer exist. +for OLD_NAME in MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID1 MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID2; do + OLD_ENV_INDEX=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ + -o jsonpath="{range .spec.template.spec.containers[0].env[*]}{.name}{'\n'}{end}" 2>/dev/null \ + | grep -n -x "$OLD_NAME" | cut -d: -f1 || echo "") + if [[ -n "$OLD_ENV_INDEX" ]]; then + OLD_ENV_ARRAY_INDEX=$((OLD_ENV_INDEX - 1)) + echo "Removing stale $OLD_NAME env var (index $OLD_ENV_ARRAY_INDEX)" + kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ + -p="[{\"op\": \"remove\", \"path\": \"/spec/template/spec/containers/0/env/$OLD_ENV_ARRAY_INDEX\"}]" + fi +done -echo "Patching captcha deployment with ESIGNETMOSIPID2 secret key" ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ - -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID2')].name}" 2>/dev/null || echo "") + -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID')].name}" 2>/dev/null || echo "") if [[ -z "$ENV_VAR_EXISTS" ]]; then kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID2", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-go-mosipid2", "key": "esignet-captcha-secret-key"}}}}]' + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-mosipid", "key": "esignet-captcha-secret-key"}}}}]' else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID2 already exists." + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID already exists." fi -# --- postgres-postgresql-mosipid2 secret (MOSIPID2 remote postgres password) --- -echo "Creating postgres-postgresql-mosipid2 secret in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create secret generic postgres-postgresql-mosipid2 \ - --from-literal=postgres-password="${MOSIPID2_POSTGRES_PASS}" \ +# --- postgres-postgresql-mosipid secret (MOSIPID remote postgres password) --- +echo "Creating postgres-postgresql-mosipid secret in $ESIGNET_NS" +kubectl -n "$ESIGNET_NS" create secret generic postgres-postgresql-mosipid \ + --from-literal=postgres-password="${MOSIPID_POSTGRES_PASS}" \ --dry-run=client -o yaml | kubectl apply -f - -# --- keycloak-host-mosipid2 CM (external URL points to MOSIPID2 Keycloak) --- -echo "Creating keycloak-host-mosipid2 configmap in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create configmap keycloak-host-mosipid2 \ - --from-literal=keycloak-external-host="iam.${mosipid2_domain_name}" \ - --from-literal=keycloak-external-url="https://iam.${mosipid2_domain_name}" \ +# --- keycloak-host-mosipid CM (external URL points to MOSIPID Keycloak) --- +echo "Creating keycloak-host-mosipid configmap in $ESIGNET_NS" +kubectl -n "$ESIGNET_NS" create configmap keycloak-host-mosipid \ + --from-literal=keycloak-external-host="iam.${mosipid_domain_name}" \ + --from-literal=keycloak-external-url="https://iam.${mosipid_domain_name}" \ --from-literal=keycloak-internal-host="keycloak.keycloak" \ --from-literal=keycloak-internal-service-url="http://keycloak.keycloak/auth/" \ --from-literal=keycloak-internal-url="http://keycloak.keycloak" \ --dry-run=client -o yaml | kubectl apply -f - -# --- keycloak-client-secrets-mosipid2: fetch all confidential clients from MOSIPID2 Keycloak --- -KC_HOST="iam.${mosipid2_domain_name}" +# --- keycloak-client-secrets-mosipid: fetch all confidential clients from MOSIPID Keycloak --- +KC_HOST="iam.${mosipid_domain_name}" REALM="mosip" echo "Fetching admin token from $KC_HOST" TOKEN_RESPONSE=$(curl -sf -X POST \ "https://${KC_HOST}/auth/realms/master/protocol/openid-connect/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ - -d "grant_type=password&client_id=admin-cli&username=admin&password=${MOSIPID2_KC_ADMIN_PASS}") + -d "grant_type=password&client_id=admin-cli&username=admin&password=${MOSIPID_KC_ADMIN_PASS}") ADMIN_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.access_token') if [[ -z "$ADMIN_TOKEN" || "$ADMIN_TOKEN" == "null" ]]; then echo "❌ Failed to get admin token from $KC_HOST" >&2; exit 1 @@ -116,12 +131,12 @@ while IFS= read -r client_json; do done < <(echo "$CLIENTS" | jq -c '.[]') if [[ ${#SECRET_ARGS[@]} -eq 0 ]]; then - echo "❌ No client secrets fetched from MOSIPID2 Keycloak" >&2; exit 1 + echo "❌ No client secrets fetched from MOSIPID Keycloak" >&2; exit 1 fi -echo "Creating keycloak-client-secrets-mosipid2 in $ESIGNET_NS (${#SECRET_ARGS[@]} clients)" -kubectl -n "$ESIGNET_NS" create secret generic keycloak-client-secrets-mosipid2 \ +echo "Creating keycloak-client-secrets-mosipid in $ESIGNET_NS (${#SECRET_ARGS[@]} clients)" +kubectl -n "$ESIGNET_NS" create secret generic keycloak-client-secrets-mosipid \ "${SECRET_ARGS[@]}" \ --dry-run=client -o yaml | kubectl apply -f - -echo "✓ keycloak-client-secrets-mosipid2 created" +echo "✓ keycloak-client-secrets-mosipid created" -echo "eSignet MOSIPID2 pre-install completed." +echo "eSignet MOSIPID pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh deleted file mode 100755 index cd5501eaf..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid1-preinstall.sh +++ /dev/null @@ -1,150 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - eSignet MOSIPID1 Service Pre-install -# ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid1, runs base esignet preinstall (copies -# postgres + redis config/secrets), then creates esignet-captcha-go-mosipid1 secret -# in the captcha namespace from workflow env vars, copies it to esignet-mosipid1, -# and patches the captcha deployment with the MOSIPID1 secret key. -# ============================================================================= -set -euo pipefail - -export ESIGNET_NS="esignet-go-mosipid1" -CAPTCHA_NS="captcha" -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY must be set}" -CAPTCHA_SECRET_KEY="${ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY must be set}" -MOSIPID1_POSTGRES_PASS="${MOSIPID1_POSTGRES_PASSWORD:?ERROR: MOSIPID1_POSTGRES_PASSWORD must be set}" -MOSIPID1_KC_ADMIN_PASS="${MOSIPID1_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID1_KEYCLOAK_ADMIN_PASSWORD must be set}" - -"$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh" - -# Create MOSIPID1-specific esignet-global — same domain_name, but esignet/signup hosts differ -kubectl -n "$ESIGNET_NS" create configmap esignet-global \ - --from-literal=installation-domain="${domain_name}" \ - --from-literal=mosip-api-host="api.${domain_name}" \ - --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet-go-mosipid1.${domain_name}" \ - --from-literal=mosip-iam-external-host="iam.${domain_name}" \ - --from-literal=mosip-kafka-host="kafka.${domain_name}" \ - --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup-go-mosipid1.${domain_name}" \ - --from-literal=mosip-smtp-host="smtp.${domain_name}" \ - --from-literal=mosip-version="develop" \ - --dry-run=client -o yaml | kubectl apply -f - - -# Override postgres-config with MOSIPID1-specific DB values (2.0.0: isolated database) -kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_go_mosipid1","database-username":"esignetuser_go_mosipid1"}}' - -# Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. -if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then - kubectl -n "$ESIGNET_NS" create secret generic esignet-misp-onboarder-key \ - --from-literal=mosip-esignet-misp-key="" - echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" -fi - -# Create esignet-keystore-go-mosipid1 (PKCS12 keystore for KEYMANAGER_KEYSTORE_TYPE: PKCS12) — -# a throwaway self-signed cert generated once and reused across redeploys. Never regenerate an -# existing keystore: KEYMANAGER_PKCS12_PASSWORD/mosipid1.pfx must stay stable, or anything -# encrypted with the old keystore becomes unreadable. -if ! kubectl -n "$ESIGNET_NS" get secret esignet-keystore-go-mosipid1 &>/dev/null; then - echo "Generating dummy PKCS12 keystore for mosipid1" - DUMMY_P12_PASSWORD="localtest" - TMP_KEY="$(mktemp)" - TMP_CERT="$(mktemp)" - TMP_P12="$(mktemp)" - openssl req -x509 -newkey rsa:2048 -keyout "$TMP_KEY" -out "$TMP_CERT" \ - -days 3650 -nodes -subj "/CN=esignet-go-mosipid1-dummy" 2>/dev/null - openssl pkcs12 -export -out "$TMP_P12" -inkey "$TMP_KEY" -in "$TMP_CERT" \ - -passout "pass:${DUMMY_P12_PASSWORD}" - kubectl -n "$ESIGNET_NS" create secret generic esignet-keystore-go-mosipid1 \ - --from-literal=KEYMANAGER_PKCS12_PASSWORD="$DUMMY_P12_PASSWORD" \ - --from-file=mosipid1.pfx="$TMP_P12" - rm -f "$TMP_KEY" "$TMP_CERT" "$TMP_P12" - echo "esignet-keystore-go-mosipid1 secret created in $ESIGNET_NS" -else - echo "esignet-keystore-go-mosipid1 already exists — reusing existing keystore" -fi - -echo "Creating esignet-captcha-go-mosipid1 secret in $CAPTCHA_NS namespace" -kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-go-mosipid1 \ - --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ - --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ - --dry-run=client -o yaml | kubectl apply -f - - -echo "Copying esignet-captcha-go-mosipid1 secret from $CAPTCHA_NS to $ESIGNET_NS" -$COPY_UTIL secret esignet-captcha-go-mosipid1 "$CAPTCHA_NS" "$ESIGNET_NS" - -echo "Patching captcha deployment with ESIGNETMOSIPID1 secret key" -ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ - -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID1')].name}" 2>/dev/null || echo "") -if [[ -z "$ENV_VAR_EXISTS" ]]; then - kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID1", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-go-mosipid1", "key": "esignet-captcha-secret-key"}}}}]' -else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID1 already exists." -fi - -# --- postgres-postgresql-mosipid1 secret (MOSIPID1 remote postgres password) --- -echo "Creating postgres-postgresql-mosipid1 secret in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create secret generic postgres-postgresql-mosipid1 \ - --from-literal=postgres-password="${MOSIPID1_POSTGRES_PASS}" \ - --dry-run=client -o yaml | kubectl apply -f - - -# --- keycloak-host-mosipid1 CM (external URL points to MOSIPID1 Keycloak) --- -echo "Creating keycloak-host-mosipid1 configmap in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create configmap keycloak-host-mosipid1 \ - --from-literal=keycloak-external-host="iam.${mosipid1_domain_name}" \ - --from-literal=keycloak-external-url="https://iam.${mosipid1_domain_name}" \ - --from-literal=keycloak-internal-host="keycloak.keycloak" \ - --from-literal=keycloak-internal-service-url="http://keycloak.keycloak/auth/" \ - --from-literal=keycloak-internal-url="http://keycloak.keycloak" \ - --dry-run=client -o yaml | kubectl apply -f - - -# --- keycloak-client-secrets-mosipid1: fetch all confidential clients from MOSIPID1 Keycloak --- -KC_HOST="iam.${mosipid1_domain_name}" -REALM="mosip" - -echo "Fetching admin token from $KC_HOST" -TOKEN_RESPONSE=$(curl -sf -X POST \ - "https://${KC_HOST}/auth/realms/master/protocol/openid-connect/token" \ - -H "Content-Type: application/x-www-form-urlencoded" \ - -d "grant_type=password&client_id=admin-cli&username=admin&password=${MOSIPID1_KC_ADMIN_PASS}") -ADMIN_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.access_token') -if [[ -z "$ADMIN_TOKEN" || "$ADMIN_TOKEN" == "null" ]]; then - echo "❌ Failed to get admin token from $KC_HOST" >&2; exit 1 -fi -echo "✓ Admin token obtained" - -echo "Fetching all clients from realm $REALM on $KC_HOST" -CLIENTS=$(curl -sf \ - "https://${KC_HOST}/auth/admin/realms/${REALM}/clients?max=500" \ - -H "Authorization: Bearer $ADMIN_TOKEN") - -SECRET_ARGS=() -while IFS= read -r client_json; do - client_id=$(echo "$client_json" | jq -r '.clientId') - uuid=$(echo "$client_json" | jq -r '.id') - auth_type=$(echo "$client_json" | jq -r '.clientAuthenticatorType') - is_public=$(echo "$client_json" | jq -r '.publicClient') - [[ "$auth_type" != "client-secret" || "$is_public" == "true" ]] && continue - secret_val=$(curl -sf \ - "https://${KC_HOST}/auth/admin/realms/${REALM}/clients/${uuid}/client-secret" \ - -H "Authorization: Bearer $ADMIN_TOKEN" | jq -r '.value // empty') - [[ -z "$secret_val" || "$secret_val" == "null" ]] && continue - key=$(echo "$client_id" | tr '-' '_')_secret - SECRET_ARGS+=("--from-literal=${key}=${secret_val}") - echo " ✓ $client_id" -done < <(echo "$CLIENTS" | jq -c '.[]') - -if [[ ${#SECRET_ARGS[@]} -eq 0 ]]; then - echo "❌ No client secrets fetched from MOSIPID1 Keycloak" >&2; exit 1 -fi -echo "Creating keycloak-client-secrets-mosipid1 in $ESIGNET_NS (${#SECRET_ARGS[@]} clients)" -kubectl -n "$ESIGNET_NS" create secret generic keycloak-client-secrets-mosipid1 \ - "${SECRET_ARGS[@]}" \ - --dry-run=client -o yaml | kubectl apply -f - -echo "✓ keycloak-client-secrets-mosipid1 created" - -echo "eSignet MOSIPID1 pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-postinstall-keycloak-init.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-postinstall-keycloak-init.sh index e79d80caf..8be5e8239 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-postinstall-keycloak-init.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-postinstall-keycloak-init.sh @@ -1,5 +1,5 @@ #!/bin/bash -# Post-install hook for esignet-keycloak-init (eSignet 1.7.1 standalone) +# Post-install hook for esignet-keycloak-init (eSignet 2.0.0 (Go) standalone) # The chart runs in keycloak ns and creates keycloak-host CM and # keycloak-client-secrets secret there. This hook fans those resources out to # all esignet-mock namespaces so every esignet-mock instance can reference them without @@ -10,13 +10,13 @@ KEYCLOAK_NS="keycloak" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" # All esignet-mock namespaces that need keycloak resources -ESIGNET_NAMESPACES=(esignet-go-mock esignet-go-mosipid1 esignet-go-mosipid2 esignet-go-sunbird) +ESIGNET_NAMESPACES=(esignet-mock esignet-mosipid esignet-sunbird) echo "================================================" -echo "eSignet 1.7.1 - Keycloak Init Post-install" +echo "eSignet 2.0.0 (Go) - Keycloak Init Post-install" echo "================================================" -echo "Sharing keycloak resources from $KEYCLOAK_NS to all esignet-go-mock namespaces" +echo "Sharing keycloak resources from $KEYCLOAK_NS to all esignet-mock namespaces" for NS_TARGET in "${ESIGNET_NAMESPACES[@]}"; do if ! kubectl get namespace "$NS_TARGET" &>/dev/null; then echo "Namespace $NS_TARGET does not exist, skipping" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh index eec0071d5..72f6052ba 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh @@ -14,7 +14,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" POSTGRES_NS="postgres" REDIS_NS="redis" KEYCLOAK_NS="keycloak" @@ -41,7 +41,7 @@ $COPY_UTIL configmap postgres-config "$POSTGRES_NS" "$ESIGNET_NS" # Override postgres-config with 2.0.0-specific DB values (isolated database) kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_go","database-username":"esignetuser_go"}}' + -p '{"data":{"database-name":"mosip_esignet","database-username":"esignetuser"}}' echo "Copying redis-config configmap from $REDIS_NS" $COPY_UTIL configmap redis-config "$REDIS_NS" "$ESIGNET_NS" @@ -65,8 +65,8 @@ $COPY_UTIL secret db-common-secrets "$POSTGRES_NS" "$ESIGNET_NS" # external-dsf.yaml esignet-keycloak-init release), but that hook's namespace loop only # covers the original esignet-standalone namespaces. Copy them directly here so the # 2.0.0 namespace is self-sufficient without touching the shared hook. This runs for -# every instance that delegates to this script (esignet-go-mock plus the -# mosipid1/mosipid2/sunbird wrappers), matching the original profile's fan-out to all +# every instance that delegates to this script (esignet-mock plus the +# mosipid/sunbird wrappers), matching the original profile's fan-out to all # four namespaces. echo "Copying keycloak-host configmap from $KEYCLOAK_NS" $COPY_UTIL configmap keycloak-host "$KEYCLOAK_NS" "$ESIGNET_NS" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh index 20c40638d..a25dd63d6 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh @@ -3,13 +3,13 @@ # eSignet 1.7.1 - eSignet Sunbird Service Pre-install # ============================================================================= # Wrapper: sets ESIGNET_NS=esignet-sunbird, runs base esignet preinstall (copies -# postgres + redis config/secrets), then creates esignet-captcha-go-sunbird secret +# postgres + redis config/secrets), then creates esignet-captcha-sunbird secret # in the captcha namespace from workflow env vars, copies it to esignet-sunbird, # and patches the captcha deployment with the Sunbird secret key. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-go-sunbird" +export ESIGNET_NS="esignet-sunbird" CAPTCHA_NS="captcha" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" CAPTCHA_SITE_KEY="${ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY must be set}" @@ -22,18 +22,18 @@ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ --from-literal=installation-domain="${domain_name}" \ --from-literal=mosip-api-host="api.${domain_name}" \ --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet-go-sunbird.${domain_name}" \ + --from-literal=mosip-esignet-host="esignet-sunbird.${domain_name}" \ --from-literal=mosip-iam-external-host="iam.${domain_name}" \ --from-literal=mosip-kafka-host="kafka.${domain_name}" \ --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup-go-sunbird.${domain_name}" \ + --from-literal=mosip-signup-host="signup-sunbird.${domain_name}" \ --from-literal=mosip-smtp-host="smtp.${domain_name}" \ --from-literal=mosip-version="develop" \ --dry-run=client -o yaml | kubectl apply -f - # Override postgres-config with Sunbird-specific DB values kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_go_sunbird","database-username":"esignetuser_go_sunbird"}}' + -p '{"data":{"database-name":"mosip_esignet_sunbird","database-username":"esignetuser_sunbird"}}' # Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then @@ -42,23 +42,36 @@ if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" fi -echo "Creating esignet-captcha-go-sunbird secret in $CAPTCHA_NS namespace" -kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-go-sunbird \ +echo "Creating esignet-captcha-sunbird secret in $CAPTCHA_NS namespace" +kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-sunbird \ --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ --dry-run=client -o yaml | kubectl apply -f - -echo "Copying esignet-captcha-go-sunbird secret from $CAPTCHA_NS to $ESIGNET_NS" -$COPY_UTIL secret esignet-captcha-go-sunbird "$CAPTCHA_NS" "$ESIGNET_NS" +echo "Copying esignet-captcha-sunbird secret from $CAPTCHA_NS to $ESIGNET_NS" +$COPY_UTIL secret esignet-captcha-sunbird "$CAPTCHA_NS" "$ESIGNET_NS" echo "Patching captcha deployment with ESIGNETSUNBIRD secret key" +# Remove the old pre-rename env var name if still present, so it doesn't linger +# pointing at a secret that no longer exists (esignet-captcha-go-sunbird was renamed +# to esignet-captcha-sunbird). +OLD_ENV_INDEX=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ + -o jsonpath="{range .spec.template.spec.containers[0].env[*]}{.name}{'\n'}{end}" 2>/dev/null \ + | grep -n -x "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOSUNBIRD" | cut -d: -f1 || echo "") +if [[ -n "$OLD_ENV_INDEX" ]]; then + OLD_ENV_ARRAY_INDEX=$((OLD_ENV_INDEX - 1)) + echo "Removing stale MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOSUNBIRD env var (index $OLD_ENV_ARRAY_INDEX)" + kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ + -p="[{\"op\": \"remove\", \"path\": \"/spec/template/spec/containers/0/env/$OLD_ENV_ARRAY_INDEX\"}]" +fi + ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ - -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOSUNBIRD')].name}" 2>/dev/null || echo "") + -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETSUNBIRD')].name}" 2>/dev/null || echo "") if [[ -z "$ENV_VAR_EXISTS" ]]; then kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOSUNBIRD", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-go-sunbird", "key": "esignet-captcha-secret-key"}}}}]' + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETSUNBIRD", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-sunbird", "key": "esignet-captcha-secret-key"}}}}]' else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOSUNBIRD already exists." + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETSUNBIRD already exists." fi echo "eSignet Sunbird pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/kafka-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/kafka-postinstall.sh index 14e0b8eb9..ea238f1b5 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/kafka-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/kafka-postinstall.sh @@ -11,7 +11,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" KAFKA_URL="${KAFKA_URL:-kafka-0.kafka-headless.kafka.svc.cluster.local:9092,kafka-1.kafka-headless.kafka.svc.cluster.local:9092,kafka-2.kafka-headless.kafka.svc.cluster.local:9092}" echo "================================================" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh index b4f4546ab..9d1ae319a 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh @@ -15,7 +15,7 @@ # ============================================================================= set -euo pipefail -KERNEL_NS="kernel-go" +KERNEL_NS="kernel" API_HOST="${MOSIP_API_HOST:-}" API_INTERNAL_HOST="${MOSIP_API_INTERNAL_HOST:-}" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/keycloak-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/keycloak-postinstall.sh index 6e4fbedf1..9192e2bdc 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/keycloak-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/keycloak-postinstall.sh @@ -13,7 +13,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" KEYCLOAK_NS="keycloak" CHART_VERSION="${KEYCLOAK_INIT_VERSION:-12.0.2}" INSTALLATION_DOMAIN="${INSTALLATION_DOMAIN:-sandbox.xyz.net}" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh index 8f006956d..be79632da 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh @@ -7,11 +7,11 @@ # before postgres-init-mock-identity helm chart runs DB initialization. # # Environment Variables: -# ESIGNET_NS - eSignet namespace (default: esignet-go-mock) +# ESIGNET_NS - eSignet namespace (default: esignet-mock) # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" POSTGRES_NS="postgres" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh index 4d51968bf..9455bbdec 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh @@ -5,19 +5,19 @@ # Prepares esignet namespace for mock identity system deployment: # - Copies softhsm-mock-identity-system secret from softhsm ns # - Creates mockid-postgres-config with mock identity DB values -# - Verifies softhsm-mock-identity-system-go-share ConfigMap is present +# - Verifies softhsm-mock-identity-system-share ConfigMap is present # # Environment Variables: -# MOCKID_DB_NAME - Mock identity DB name (default: mosip_mockidentitysystem_go) -# MOCKID_DB_USER - Mock identity DB user (default: mockidentityuser_go) +# MOCKID_DB_NAME - Mock identity DB name (default: mosip_mockidentitysystem) +# MOCKID_DB_USER - Mock identity DB user (default: mockidentityuser) # MOCKID_DB_PORT - Postgres port (default: 5432) # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" -SOFTHSM_NS="softhsm-go" -MOCKID_DB_NAME="${MOCKID_DB_NAME:-mosip_mockidentitysystem_go}" -MOCKID_DB_USER="${MOCKID_DB_USER:-mockidentityuser_go}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" +SOFTHSM_NS="softhsm" +MOCKID_DB_NAME="${MOCKID_DB_NAME:-mosip_mockidentitysystem}" +MOCKID_DB_USER="${MOCKID_DB_USER:-mockidentityuser}" MOCKID_DB_PORT="${MOCKID_DB_PORT:-5432}" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" @@ -29,8 +29,8 @@ kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply # Copy softhsm-mock-identity-system secret to esignet ns # The chart references it directly via secretKeyRef — pod and secret must be in same namespace -$COPY_UTIL secret softhsm-mock-identity-system-go "$SOFTHSM_NS" "$ESIGNET_NS" -echo "softhsm-mock-identity-system-go secret copied to $ESIGNET_NS." +$COPY_UTIL secret softhsm-mock-identity-system "$SOFTHSM_NS" "$ESIGNET_NS" +echo "softhsm-mock-identity-system secret copied to $ESIGNET_NS." # Read internal host from postgres-config (already present from esignet-preinstall.sh) DB_HOST=$(kubectl -n "$ESIGNET_NS" get configmap postgres-config \ @@ -50,11 +50,11 @@ kubectl -n "$ESIGNET_NS" create configmap mockid-postgres-config \ echo "mockid-postgres-config created/updated in $ESIGNET_NS (host=$DB_HOST db=$MOCKID_DB_NAME user=$MOCKID_DB_USER)." # Verify SoftHSM mock identity configmap exists in esignet namespace -if kubectl -n "$ESIGNET_NS" get configmap softhsm-mock-identity-system-go-share &>/dev/null; then +if kubectl -n "$ESIGNET_NS" get configmap softhsm-mock-identity-system-share &>/dev/null; then echo "SoftHSM mock identity system configmap found." else - echo "ERROR: softhsm-mock-identity-system-go-share configmap not found in $ESIGNET_NS namespace." - echo "Deploy softhsm-mock-identity-system-go before running mock identity system install." + echo "ERROR: softhsm-mock-identity-system-share configmap not found in $ESIGNET_NS namespace." + echo "Deploy softhsm-mock-identity-system before running mock identity system install." exit 1 fi diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid-preinstall.sh similarity index 68% rename from Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh rename to Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid-preinstall.sh index 78db8d94c..f86affce4 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid-preinstall.sh @@ -1,10 +1,10 @@ #!/bin/bash # ============================================================================= -# eSignet Standalone 2.0.0 - Mock Relying Party Service MOSIPID1 Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party Service MOSIPID Pre-install # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base mock-rp-service +# Wrapper: sets ESIGNET_NS=esignet-mosipid and delegates to base mock-rp-service # preinstall (creates private key secrets in the target namespace). # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-go-mosipid1" +export ESIGNET_NS="esignet-mosipid" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh deleted file mode 100755 index e6e8f3496..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid2-preinstall.sh +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet Standalone 2.0.0 - Mock Relying Party Service MOSIPID2 Pre-install -# ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base mock-rp-service -# preinstall (creates private key secrets in the target namespace). -# ============================================================================= -set -euo pipefail -export ESIGNET_NS="esignet-go-mosipid2" -exec "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh index f2736d682..aa3a24fb6 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh @@ -11,7 +11,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" CLIENT_KEY_TMPFILE="" JWE_KEY_TMPFILE="" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh index 74bc76ee2..077947de5 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh @@ -6,5 +6,5 @@ # preinstall (creates private key secrets in the target namespace). # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-go-sunbird" +export ESIGNET_NS="esignet-sunbird" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid-preinstall.sh similarity index 57% rename from Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh rename to Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid-preinstall.sh index eccf10272..7e960eba9 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid-preinstall.sh @@ -1,24 +1,24 @@ #!/bin/bash # ============================================================================= -# eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID1 Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID Pre-install # ============================================================================= -# Ensures esignet-mosipid1 namespace exists and verifies mock-relying-party-service -# is available in the esignet-mosipid1 namespace before UI deployment. +# Ensures esignet-mosipid namespace exists and verifies mock-relying-party-service +# is available in the esignet-mosipid namespace before UI deployment. # ============================================================================= set -euo pipefail -ESIGNET_NS="esignet-go-mosipid1" +ESIGNET_NS="esignet-mosipid" echo "================================================" -echo "eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID1 Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - -if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service-go &>/dev/null; then +if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service &>/dev/null; then echo "Mock relying party service found in $ESIGNET_NS." else echo "WARNING: Mock relying party service not found in $ESIGNET_NS. UI depends on the service being deployed." fi -echo "Mock relying party UI MOSIPID1 pre-install completed." +echo "Mock relying party UI MOSIPID pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh deleted file mode 100755 index 3c65bbbcc..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid2-preinstall.sh +++ /dev/null @@ -1,24 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID2 Pre-install -# ============================================================================= -# Ensures esignet-mosipid2 namespace exists and verifies mock-relying-party-service -# is available in the esignet-mosipid2 namespace before UI deployment. -# ============================================================================= -set -euo pipefail - -ESIGNET_NS="esignet-go-mosipid2" - -echo "================================================" -echo "eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID2 Pre-install" -echo "================================================" - -kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - - -if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service-go &>/dev/null; then - echo "Mock relying party service found in $ESIGNET_NS." -else - echo "WARNING: Mock relying party service not found in $ESIGNET_NS. UI depends on the service being deployed." -fi - -echo "Mock relying party UI MOSIPID2 pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh index 220b444ae..aeb2c84a9 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh @@ -11,10 +11,10 @@ echo "eSignet Standalone 2.0.0 - Mock Relying Party UI Pre-install" echo "================================================" # Ensure esignet namespace exists -kubectl create namespace esignet-go-mock --dry-run=client -o yaml | kubectl apply -f - +kubectl create namespace esignet-mock --dry-run=client -o yaml | kubectl apply -f - # Verify mock relying party service is available -if kubectl -n esignet-go-mock get svc mock-relying-party-service-go &>/dev/null; then +if kubectl -n esignet-mock get svc mock-relying-party-service &>/dev/null; then echo "Mock relying party service found." else echo "WARNING: Mock relying party service not found. UI depends on the service being deployed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh index 9d37c849f..d98a62acc 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh @@ -7,7 +7,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="esignet-go-sunbird" +ESIGNET_NS="esignet-sunbird" echo "================================================" echo "eSignet Standalone 2.0.0 - Mock Relying Party UI Sunbird Pre-install" @@ -15,7 +15,7 @@ echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - -if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service-go &>/dev/null; then +if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service &>/dev/null; then echo "Mock relying party service found in $ESIGNET_NS." else echo "WARNING: Mock relying party service not found in $ESIGNET_NS. UI depends on the service being deployed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh index 5bf32602a..a42a62267 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh @@ -7,15 +7,15 @@ # ============================================================================= set -euo pipefail -KERNEL_NS="kernel-go" +KERNEL_NS="kernel" echo "================================================" echo "eSignet Standalone 2.0.0 - Notifier Post-install" echo "================================================" # Source: deploy/kernel/install.sh - kubectl set env deployment/notifier -echo "Setting SMS number length env vars on notifier-go deployment" -kubectl -n "$KERNEL_NS" set env deployment/notifier-go \ +echo "Setting SMS number length env vars on notifier deployment" +kubectl -n "$KERNEL_NS" set env deployment/notifier \ MOSIP_KERNEL_SMS_NUMBER_MIN_LENGTH=7 \ MOSIP_KERNEL_SMS_NUMBER_MAX_LENGTH=10 diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid-preinstall.sh similarity index 66% rename from Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid2-preinstall.sh rename to Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid-preinstall.sh index 9ccb94471..fca557915 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid2-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid-preinstall.sh @@ -1,9 +1,9 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - OIDC UI MOSIPID2 Pre-install +# eSignet 1.7.1 - OIDC UI MOSIPID Pre-install # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base oidc-ui preinstall. +# Wrapper: sets ESIGNET_NS=esignet-mosipid and delegates to base oidc-ui preinstall. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-go-mosipid2" +export ESIGNET_NS="esignet-mosipid" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh deleted file mode 100755 index 57aa055fa..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid1-preinstall.sh +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet Standalone 2.0.0 - OIDC UI MOSIPID1 Pre-install -# ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base oidc-ui preinstall. -# ============================================================================= -set -euo pipefail -export ESIGNET_NS="esignet-go-mosipid1" -exec "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh index 3edf203d4..d25717fb5 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh @@ -11,7 +11,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" echo "================================================" echo "eSignet 1.7.1 - OIDC UI Pre-install" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-sunbird-preinstall.sh index 9ab201731..b7e0826cf 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-sunbird-preinstall.sh @@ -5,5 +5,5 @@ # Wrapper: sets ESIGNET_NS=esignet-sunbird and delegates to base oidc-ui preinstall. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-go-sunbird" +export ESIGNET_NS="esignet-sunbird" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid-preinstall.sh similarity index 61% rename from Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid2-preinstall.sh rename to Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid-preinstall.sh index 6ac2fe3fc..ecea9f0b0 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid2-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid-preinstall.sh @@ -1,45 +1,45 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - PMS Partner MOSIPID2 Pre-install +# eSignet 1.7.1 - PMS Partner MOSIPID Pre-install # ============================================================================= -# Creates the Istio Gateway for pms-partner in esignet-mosipid2 namespace. +# Creates the Istio Gateway for pms-partner in esignet-mosipid namespace. # ============================================================================= set -euo pipefail -ESIGNET_NS="esignet-go-mosipid2" +ESIGNET_NS="esignet-mosipid" echo "================================================" -echo "eSignet 1.7.1 - PMS Partner MOSIPID2 Pre-install" +echo "eSignet 1.7.1 - PMS Partner MOSIPID Pre-install" echo "================================================" kubectl apply -f - </dev/null || echo "") + -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP')].name}" 2>/dev/null || echo "") if [[ -z "$ENV_VAR_EXISTS" ]]; then kubectl patch deployment -n captcha captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP_GO", "valueFrom": {"secretKeyRef": {"name": "signup-captcha-go", "key": "signup-captcha-secret-key"}}}}]' + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP", "valueFrom": {"secretKeyRef": {"name": "signup-captcha", "key": "signup-captcha-secret-key"}}}}]' else - echo "Restarting captcha to load the updated signup-go secret." + echo "Restarting captcha to load the updated signup secret." kubectl -n captcha rollout restart deployment/captcha kubectl -n captcha rollout status deployment/captcha --timeout=480s fi @@ -81,8 +81,8 @@ kubectl -n "$SIGNUP_NS" create secret generic signup-keystore \ # --- Step 6: Create msg-gateway configmap and secret (pointing to mock-smtp) --- echo "Creating msg-gateway configmap and secret in $SIGNUP_NS" kubectl -n "$SIGNUP_NS" create configmap msg-gateway \ - --from-literal=smtp-host="mock-smtp-go.mock-smtp-go" \ - --from-literal=sms-host="mock-smtp-go.mock-smtp-go" \ + --from-literal=smtp-host="mock-smtp.mock-smtp" \ + --from-literal=sms-host="mock-smtp.mock-smtp" \ --from-literal=smtp-port="8025" \ --from-literal=sms-port="8080" \ --from-literal=smtp-username="" \ diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid1-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid-setup.sh similarity index 65% rename from Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid1-setup.sh rename to Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid-setup.sh index c9d0ccc04..120c2b1e0 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid1-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid-setup.sh @@ -1,9 +1,9 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - SoftHSM eSignet MOSIPID1 Pre-install Setup +# eSignet 1.7.1 - SoftHSM eSignet MOSIPID Pre-install Setup # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base softhsm setup. +# Wrapper: sets ESIGNET_NS=esignet-mosipid and delegates to base softhsm setup. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-go-mosipid1" +export ESIGNET_NS="esignet-mosipid" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid2-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid2-setup.sh deleted file mode 100755 index 9d16c2ec8..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid2-setup.sh +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - SoftHSM eSignet MOSIPID2 Pre-install Setup -# ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base softhsm setup. -# ============================================================================= -set -euo pipefail -export ESIGNET_NS="esignet-go-mosipid2" -exec "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh index 2818214bc..4b990127c 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh @@ -12,8 +12,8 @@ # ============================================================================= set -euo pipefail -SOFTHSM_NS="${SOFTHSM_NS:-softhsm-go}" -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +SOFTHSM_NS="${SOFTHSM_NS:-softhsm}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" @@ -22,15 +22,15 @@ echo "================================================" # --- Step 1: Wait for SoftHSM pod to be ready --- echo "Waiting for SoftHSM pod to be ready..." -kubectl -n "$SOFTHSM_NS" wait --for=condition=ready pod -l app.kubernetes.io/instance=esignet-softhsm-go --timeout=480s || \ +kubectl -n "$SOFTHSM_NS" wait --for=condition=ready pod -l app.kubernetes.io/instance=esignet-softhsm --timeout=480s || \ { echo "ERROR: SoftHSM pod not ready after timeout" >&2; exit 1; } -# --- Step 2: Copy esignet-softhsm-go-share configmap to esignet namespace --- -echo "Copying esignet-softhsm-go-share configmap to $ESIGNET_NS namespace" -$COPY_UTIL configmap esignet-softhsm-go-share "$SOFTHSM_NS" "$ESIGNET_NS" +# --- Step 2: Copy esignet-softhsm-share configmap to esignet namespace --- +echo "Copying esignet-softhsm-share configmap to $ESIGNET_NS namespace" +$COPY_UTIL configmap esignet-softhsm-share "$SOFTHSM_NS" "$ESIGNET_NS" # --- Step 3: Copy esignet-softhsm secret to esignet namespace --- -echo "Copying esignet-softhsm-go secret to $ESIGNET_NS namespace" -$COPY_UTIL secret esignet-softhsm-go "$SOFTHSM_NS" "$ESIGNET_NS" +echo "Copying esignet-softhsm secret to $ESIGNET_NS namespace" +$COPY_UTIL secret esignet-softhsm "$SOFTHSM_NS" "$ESIGNET_NS" echo "SoftHSM eSignet post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh index 84f6961e0..54fa57156 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh @@ -11,7 +11,7 @@ # ============================================================================= set -euo pipefail -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" echo "================================================" echo "eSignet 1.7.1 - SoftHSM eSignet Pre-install" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh index 1e9584f8a..5007357b3 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh @@ -5,5 +5,5 @@ # Wrapper: sets ESIGNET_NS=esignet-sunbird and delegates to base softhsm setup. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-go-sunbird" +export ESIGNET_NS="esignet-sunbird" exec "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh index f8a711787..5349e447c 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh @@ -2,14 +2,14 @@ # ============================================================================= # eSignet 1.7.1 - SoftHSM Mock Identity System Post-install # ============================================================================= -# Copies chart-generated softhsm-mock-identity-system-go-share configmap +# Copies chart-generated softhsm-mock-identity-system-share configmap # (PKCS11 slot/token config) from softhsm namespace to esignet-mock namespace. # The security PIN is handled separately via secret copy in preinstall. # ============================================================================= set -euo pipefail -SOFTHSM_NS="${SOFTHSM_NS:-softhsm-go}" -ESIGNET_NS="${ESIGNET_NS:-esignet-go-mock}" +SOFTHSM_NS="${SOFTHSM_NS:-softhsm}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" @@ -17,11 +17,11 @@ echo "eSignet 1.7.1 - SoftHSM Mock Identity System Post-install" echo "================================================" # Wait for SoftHSM mock identity pod to be ready -kubectl -n "$SOFTHSM_NS" wait --for=condition=ready pod -l app.kubernetes.io/instance=softhsm-mock-identity-system-go --timeout=480s || \ +kubectl -n "$SOFTHSM_NS" wait --for=condition=ready pod -l app.kubernetes.io/instance=softhsm-mock-identity-system --timeout=480s || \ { echo "ERROR: SoftHSM mock identity system pod not ready after timeout" >&2; exit 1; } # Copy chart-generated PKCS11 configmap to esignet-mock namespace -echo "Copying softhsm-mock-identity-system-go-share configmap to $ESIGNET_NS" -$COPY_UTIL configmap softhsm-mock-identity-system-go-share "$SOFTHSM_NS" "$ESIGNET_NS" +echo "Copying softhsm-mock-identity-system-share configmap to $ESIGNET_NS" +$COPY_UTIL configmap softhsm-mock-identity-system-share "$SOFTHSM_NS" "$ESIGNET_NS" echo "SoftHSM mock identity system post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh index d27bd7d54..99a1ea0dc 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh @@ -11,7 +11,7 @@ echo "eSignet 1.7.1 - SoftHSM Mock Identity System Pre-install" echo "================================================" # Ensure softhsm namespace exists -kubectl create namespace softhsm-go --dry-run=client -o yaml | kubectl apply -f - -kubectl label namespace softhsm-go istio-injection=enabled --overwrite +kubectl create namespace softhsm --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace softhsm istio-injection=enabled --overwrite echo "SoftHSM mock identity system pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh b/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh index 99884df6b..1b31cbfee 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh @@ -3,9 +3,9 @@ # eSignet Standalone 2.0.0 - Trigger Testrig CronJobs # ============================================================================= # Immediately triggers testrig CronJobs after deployment: -# apitestrig → esignet-go-mock ns -# signup-apitestrig → signup-go ns (if deployed) -# signup-uitestrig → signup-uitestrig-go ns (if deployed) +# apitestrig → esignet-mock ns +# signup-apitestrig → signup ns (if deployed) +# signup-uitestrig → signup-uitestrig ns (if deployed) # ============================================================================= set -euo pipefail @@ -111,23 +111,20 @@ echo "================================================" echo "eSignet Standalone 2.0.0 - Trigger Testrig CronJobs" echo "================================================" -echo "=== eSignet API Testrig (esignet-go-mock ns) ===" -trigger_all_in_ns esignet-go-mock || OVERALL_SUCCESS=false +echo "=== eSignet API Testrig (esignet-mock ns) ===" +trigger_all_in_ns esignet-mock || OVERALL_SUCCESS=false -echo "=== eSignet-MOSIPID1 API Testrig (esignet-go-mosipid1 ns) ===" -trigger_all_in_ns esignet-go-mosipid1 || OVERALL_SUCCESS=false +echo "=== eSignet-MOSIPID API Testrig (esignet-mosipid ns) ===" +trigger_all_in_ns esignet-mosipid || OVERALL_SUCCESS=false -echo "=== eSignet-MOSIPID2 API Testrig (esignet-go-mosipid2 ns) ===" -trigger_all_in_ns esignet-go-mosipid2 || OVERALL_SUCCESS=false +echo "=== eSignet-Sunbird API Testrig (esignet-sunbird ns) ===" +trigger_all_in_ns esignet-sunbird || OVERALL_SUCCESS=false -echo "=== eSignet-Sunbird API Testrig (esignet-go-sunbird ns) ===" -trigger_all_in_ns esignet-go-sunbird || OVERALL_SUCCESS=false +echo "=== Signup API Testrig (signup ns, if deployed) ===" +trigger_all_in_ns signup || OVERALL_SUCCESS=false -echo "=== Signup API Testrig (signup-go ns, if deployed) ===" -trigger_all_in_ns signup-go || OVERALL_SUCCESS=false - -echo "=== Signup UI Testrig (signup-uitestrig-go ns, if deployed) ===" -trigger_all_in_ns signup-uitestrig-go || OVERALL_SUCCESS=false +echo "=== Signup UI Testrig (signup-uitestrig ns, if deployed) ===" +trigger_all_in_ns signup-uitestrig || OVERALL_SUCCESS=false echo "" echo "=== Testrig Execution Summary ===" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh index 102ff6a9c..8564065a5 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh @@ -2,14 +2,14 @@ # ============================================================================= # eSignet Standalone 2.0.0 - Signup UI Testrig Pre-install Setup # ============================================================================= -# Prepares the signup-uitestrig-go namespace. +# Prepares the signup-uitestrig namespace. # Copies keycloak resources from keycloak ns, MinIO s3 secret from minio ns, # and postgres-postgresql from postgres ns. # Stale uitestrig CMs are deleted so the chart recreates them from set: values. # ============================================================================= set -euo pipefail -NS=signup-uitestrig-go +NS=signup-uitestrig COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" From d140705ea3e5897927cfc0bf574a66df79495539 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 15:23:22 +0530 Subject: [PATCH 27/61] Update esignet-standalone-2.0.0 database entries in shared external-dsf.yaml Consolidates mosip_esignet_go_mosipid1/mosipid2 into a single mosip_esignet_go_mosipid entry, matching the DSF's mosipid consolidation. Also fixes a naming collision the plain "-go" removal would have caused: this file packs both the v1.7.1 and Go profiles' database definitions into the same flat set: maps (postgres-init-esignet, postgres-init-signup), distinguished only by the _go suffix. Dropping _go from mosip_esignet_go/_sunbird, mosip_mockidentitysystem_go, mosip_audit_go, mosip_kernel_go, and mosip_otp_go would produce duplicate keys colliding with the still-present (retired) v1.7.1 entries. Instead these 6 entries are disabled and the Go profile's hooks now point at the same physical databases the v1.7.1 profile already defines, avoiding both the collision and redundant isolated databases. Co-Authored-By: Claude Sonnet 5 Signed-off-by: bhumi46 --- .../dsf/esignet-standalone/external-dsf.yaml | 65 +++++++++---------- 1 file changed, 31 insertions(+), 34 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone/external-dsf.yaml b/Helmsman/dsf/esignet-standalone/external-dsf.yaml index f44e721d9..a956215a7 100644 --- a/Helmsman/dsf/esignet-standalone/external-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/external-dsf.yaml @@ -184,9 +184,15 @@ apps: databases.mosip_mockidentitysystem.su.secret.name: "postgres-postgresql" databases.mosip_mockidentitysystem.su.secret.key: "postgres-password" # --------------------------------------------------------------------------- - # esignet-standalone-2.0.0 profile — isolated databases (own data, shared postgres) + # esignet-standalone-2.0.0 profile databases # --------------------------------------------------------------------------- - databases.mosip_esignet_go.enabled: "true" + # mosip_esignet_go / mosip_esignet_go_sunbird / mosip_mockidentitysystem_go + # are disabled — the Go profile shares the same physical databases as the + # (retired) v1.7.1 profile above (mosip_esignet / mosip_esignet_sunbird / + # mosip_mockidentitysystem) instead of maintaining isolated duplicates. Kept + # with the _go suffix (rather than deleted) so the key stays distinct from + # the v1.7.1 entries above in this flat set: map. + databases.mosip_esignet_go.enabled: "false" databases.mosip_esignet_go.scriptsDir: "mosip_esignet" databases.mosip_esignet_go.dbName: "mosip_esignet_go" databases.mosip_esignet_go.dbUser: "esignetuser_go" @@ -199,33 +205,20 @@ apps: databases.mosip_esignet_go.su.user: "postgres" databases.mosip_esignet_go.su.secret.name: "postgres-postgresql" databases.mosip_esignet_go.su.secret.key: "postgres-password" - databases.mosip_esignet_go_mosipid1.enabled: "true" - databases.mosip_esignet_go_mosipid1.scriptsDir: "mosip_esignet" - databases.mosip_esignet_go_mosipid1.dbName: "mosip_esignet_go_mosipid1" - databases.mosip_esignet_go_mosipid1.dbUser: "esignetuser_go_mosipid1" - databases.mosip_esignet_go_mosipid1.branch: "develop" - databases.mosip_esignet_go_mosipid1.host: "postgres.${domain_name}" - databases.mosip_esignet_go_mosipid1.port: ${esignet_db_port} - databases.mosip_esignet_go_mosipid1.dml: 1 - databases.mosip_esignet_go_mosipid1.repoUrl: "https://github.com/mosip/esignet.git" - databases.mosip_esignet_go_mosipid1.defaultDb: "postgres" - databases.mosip_esignet_go_mosipid1.su.user: "postgres" - databases.mosip_esignet_go_mosipid1.su.secret.name: "postgres-postgresql" - databases.mosip_esignet_go_mosipid1.su.secret.key: "postgres-password" - databases.mosip_esignet_go_mosipid2.enabled: "true" - databases.mosip_esignet_go_mosipid2.scriptsDir: "mosip_esignet" - databases.mosip_esignet_go_mosipid2.dbName: "mosip_esignet_go_mosipid2" - databases.mosip_esignet_go_mosipid2.dbUser: "esignetuser_go_mosipid2" - databases.mosip_esignet_go_mosipid2.branch: "develop" - databases.mosip_esignet_go_mosipid2.host: "postgres.${domain_name}" - databases.mosip_esignet_go_mosipid2.port: ${esignet_db_port} - databases.mosip_esignet_go_mosipid2.dml: 1 - databases.mosip_esignet_go_mosipid2.repoUrl: "https://github.com/mosip/esignet.git" - databases.mosip_esignet_go_mosipid2.defaultDb: "postgres" - databases.mosip_esignet_go_mosipid2.su.user: "postgres" - databases.mosip_esignet_go_mosipid2.su.secret.name: "postgres-postgresql" - databases.mosip_esignet_go_mosipid2.su.secret.key: "postgres-password" - databases.mosip_esignet_go_sunbird.enabled: "true" + databases.mosip_esignet_go_mosipid.enabled: "true" + databases.mosip_esignet_go_mosipid.scriptsDir: "mosip_esignet" + databases.mosip_esignet_go_mosipid.dbName: "mosip_esignet_go_mosipid" + databases.mosip_esignet_go_mosipid.dbUser: "esignetuser_go_mosipid" + databases.mosip_esignet_go_mosipid.branch: "develop" + databases.mosip_esignet_go_mosipid.host: "postgres.${domain_name}" + databases.mosip_esignet_go_mosipid.port: ${esignet_db_port} + databases.mosip_esignet_go_mosipid.dml: 1 + databases.mosip_esignet_go_mosipid.repoUrl: "https://github.com/mosip/esignet.git" + databases.mosip_esignet_go_mosipid.defaultDb: "postgres" + databases.mosip_esignet_go_mosipid.su.user: "postgres" + databases.mosip_esignet_go_mosipid.su.secret.name: "postgres-postgresql" + databases.mosip_esignet_go_mosipid.su.secret.key: "postgres-password" + databases.mosip_esignet_go_sunbird.enabled: "false" databases.mosip_esignet_go_sunbird.scriptsDir: "mosip_esignet" databases.mosip_esignet_go_sunbird.dbName: "mosip_esignet_go_sunbird" databases.mosip_esignet_go_sunbird.dbUser: "esignetuser_go_sunbird" @@ -238,7 +231,7 @@ apps: databases.mosip_esignet_go_sunbird.su.user: "postgres" databases.mosip_esignet_go_sunbird.su.secret.name: "postgres-postgresql" databases.mosip_esignet_go_sunbird.su.secret.key: "postgres-password" - databases.mosip_mockidentitysystem_go.enabled: "true" + databases.mosip_mockidentitysystem_go.enabled: "false" databases.mosip_mockidentitysystem_go.scriptsDir: "mosip_mockidentitysystem" databases.mosip_mockidentitysystem_go.dbName: "mosip_mockidentitysystem_go" databases.mosip_mockidentitysystem_go.dbUser: "mockidentityuser_go" @@ -308,21 +301,25 @@ apps: databases.mosip_otp.port: ${esignet_db_port} databases.mosip_otp.dml: 0 # --------------------------------------------------------------------------- - # esignet-standalone-2.0.0 profile — isolated signup/kernel databases + # esignet-standalone-2.0.0 profile — signup/kernel databases # --------------------------------------------------------------------------- - databases.mosip_audit_go.enabled: "true" + # Disabled — the Go profile shares the same physical mosip_audit/mosip_kernel/ + # mosip_otp databases as above instead of maintaining isolated duplicates. Kept + # with the _go suffix (rather than deleted) so the key stays distinct from the + # entries above in this flat set: map. + databases.mosip_audit_go.enabled: "false" databases.mosip_audit_go.branch: "v1.2.0.1" databases.mosip_audit_go.repoUrl: "https://github.com/mosip/audit-manager.git" databases.mosip_audit_go.host: "postgres.${domain_name}" databases.mosip_audit_go.port: ${esignet_db_port} databases.mosip_audit_go.dml: 0 - databases.mosip_kernel_go.enabled: "true" + databases.mosip_kernel_go.enabled: "false" databases.mosip_kernel_go.branch: "v1.2.0.1" databases.mosip_kernel_go.repoUrl: "https://github.com/mosip/commons.git" databases.mosip_kernel_go.host: "postgres.${domain_name}" databases.mosip_kernel_go.port: ${esignet_db_port} databases.mosip_kernel_go.dml: 0 - databases.mosip_otp_go.enabled: "true" + databases.mosip_otp_go.enabled: "false" databases.mosip_otp_go.branch: "v1.2.0.1" databases.mosip_otp_go.repoUrl: "https://github.com/mosip/otp-manager.git" databases.mosip_otp_go.host: "postgres.${domain_name}" From fd5fd1b268280bc0d44100e13c09ed9ff785ee29 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 15:23:34 +0530 Subject: [PATCH 28/61] Add mosipid_domain_name and Go-profile secrets to eSignet/testrig workflows The esignet-standalone-2.0.0 DSFs now use a single \${mosipid_domain_name} variable instead of mosipid1/mosipid2. The v1.7.1 esignet-standalone profile still runs two separate mosipid1/mosipid2 instances, so its existing inputs, secrets, and MOSIPID2_ENABLED toggle are left as-is; mosipid_domain_name and the new ESIGNET_MOSIPID_CAPTCHA_*, MOSIPID_POSTGRES_PASSWORD, MOSIPID_KEYCLOAK_ADMIN_PASSWORD, and ESIGNET_MOSIPID_SPRING_CONFIG_LABEL secrets/vars are added alongside them, with validation now branching by exact profile name. Also updates the SOFTHSM_PAIRS release/namespace list for esignet-standalone-2.0.0 to match the renamed releases. Note: the new MOSIPID_* secrets/vars need to be configured in the GitHub environment before a real esignet-standalone-2.0.0 deployment run. Co-Authored-By: Claude Sonnet 5 Signed-off-by: bhumi46 --- .github/workflows/helmsman_esignet.yml | 81 +++++++++++++++++++++---- .github/workflows/helmsman_testrigs.yml | 33 ++++++++-- 2 files changed, 96 insertions(+), 18 deletions(-) diff --git a/.github/workflows/helmsman_esignet.yml b/.github/workflows/helmsman_esignet.yml index f2753edf1..77f56a242 100644 --- a/.github/workflows/helmsman_esignet.yml +++ b/.github/workflows/helmsman_esignet.yml @@ -52,6 +52,10 @@ on: description: "MOSIP-ID2 domain name for this environment (e.g. qabase.xyz.net)" required: false type: string + mosipid_domain_name: + description: "MOSIP-ID domain name for esignet-standalone-2.0.0 (Go) profile only (e.g. qabase.xyz.net)" + required: false + type: string env_name: description: "Environment name (e.g. sandbox, dev, staging)" required: false @@ -91,13 +95,16 @@ jobs: echo "✓ domain_name = $DOMAIN" echo "✓ env_name = $ENV" echo "✓ esignet_db_port = $ESIGNET_DB_PORT" - # mosipid1_domain_name and mosipid2_domain_name are esignet standalone only. + # mosipid1/mosipid2_domain_name are esignet-standalone (v1.7.1) only — that + # profile still runs two separate mosipid1/mosipid2 instances. + # mosipid_domain_name is esignet-standalone-2.0.0 (Go) only — that profile + # consolidates mosipid1+mosipid2 into a single mosipid instance. # Push events always target esignet (path filter); dispatch uses explicit profile input. - if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then + if [ -z "$PROFILE" ] || [ "$PROFILE" = "esignet-standalone" ]; then MOSIPID1_DOMAIN="${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }}" MOSIPID2_DOMAIN="${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }}" if [ -z "$MOSIPID1_DOMAIN" ]; then - echo "❌ mosipid1_domain_name is required for standalone profiles" + echo "❌ mosipid1_domain_name is required for esignet-standalone" exit 1 fi if [ "$IN_ENABLE_MOSIPID2" = "true" ] && @@ -111,11 +118,23 @@ jobs: MOSIPID2_SPRING_LABEL="${{ vars.ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL }}" echo "✓ mosipid1_spring_config_label = ${MOSIPID1_SPRING_LABEL:-develop} (esignet standalone, default: develop)" echo "✓ mosipid2_spring_config_label = ${MOSIPID2_SPRING_LABEL:-develop} (esignet standalone, default: develop)" - else + fi + if [ -z "$PROFILE" ] || [ "$PROFILE" = "esignet-standalone-2.0.0" ]; then + MOSIPID_DOMAIN="${{ github.event.inputs.mosipid_domain_name || vars.MOSIPID_DOMAIN_NAME }}" + if [ -z "$MOSIPID_DOMAIN" ]; then + echo "❌ mosipid_domain_name is required for esignet-standalone-2.0.0" + exit 1 + fi + echo "✓ mosipid_domain_name = $MOSIPID_DOMAIN (esignet standalone 2.0.0 / Go)" + MOSIPID_SPRING_LABEL="${{ vars.ESIGNET_MOSIPID_SPRING_CONFIG_LABEL }}" + echo "✓ mosipid_spring_config_label = ${MOSIPID_SPRING_LABEL:-develop} (esignet standalone 2.0.0, default: develop)" + fi + if [ -n "$PROFILE" ] && [ "$PROFILE" != "esignet-standalone" ] && [ "$PROFILE" != "esignet-standalone-2.0.0" ]; then MOSIPID1_PROVIDED="${{ github.event.inputs.mosipid1_domain_name }}" MOSIPID2_PROVIDED="${{ github.event.inputs.mosipid2_domain_name }}" - if [ -n "$MOSIPID1_PROVIDED" ] || [ -n "$MOSIPID2_PROVIDED" ]; then - echo "⚠ mosipid1_domain_name / mosipid2_domain_name are only used for esignet standalone profile — ignoring for profile=$PROFILE" + MOSIPID_PROVIDED="${{ github.event.inputs.mosipid_domain_name }}" + if [ -n "$MOSIPID1_PROVIDED" ] || [ -n "$MOSIPID2_PROVIDED" ] || [ -n "$MOSIPID_PROVIDED" ]; then + echo "⚠ mosipid1_domain_name / mosipid2_domain_name / mosipid_domain_name are only used for esignet standalone profiles — ignoring for profile=$PROFILE" fi fi @@ -132,6 +151,7 @@ jobs: esignet_db_port: ${{ github.event.inputs.esignet_db_port || vars.ESIGNET_DB_PORT }} mosipid1_domain_name: ${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }} mosipid2_domain_name: ${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }} + mosipid_domain_name: ${{ github.event.inputs.mosipid_domain_name || vars.MOSIPID_DOMAIN_NAME }} env_name: ${{ github.event.inputs.env_name || vars.ENV_NAME }} MOSIPID2_ENABLED: ${{ github.event.inputs.enable_mosipid2 == 'true' && 'true' || 'false' }} # All secrets below are ENVIRONMENT secrets (not repository secrets) @@ -147,11 +167,17 @@ jobs: ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY }} ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY }} ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY }} - # MOSIPID1 / MOSIPID2 remote Keycloak admin + Postgres passwords + # mosipid captcha secret — required for esignet-standalone-2.0.0 (Go) profile only + ESIGNET_MOSIPID_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_MOSIPID_CAPTCHA_SITE_KEY }} + ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY }} + # MOSIPID1 / MOSIPID2 remote Keycloak admin + Postgres passwords (esignet-standalone) MOSIPID1_KEYCLOAK_ADMIN_PASSWORD: ${{ secrets.MOSIPID1_KEYCLOAK_ADMIN_PASSWORD }} MOSIPID2_KEYCLOAK_ADMIN_PASSWORD: ${{ secrets.MOSIPID2_KEYCLOAK_ADMIN_PASSWORD }} MOSIPID1_POSTGRES_PASSWORD: ${{ secrets.MOSIPID1_POSTGRES_PASSWORD }} MOSIPID2_POSTGRES_PASSWORD: ${{ secrets.MOSIPID2_POSTGRES_PASSWORD }} + # MOSIPID remote Keycloak admin + Postgres password (esignet-standalone-2.0.0 / Go) + MOSIPID_KEYCLOAK_ADMIN_PASSWORD: ${{ secrets.MOSIPID_KEYCLOAK_ADMIN_PASSWORD }} + MOSIPID_POSTGRES_PASSWORD: ${{ secrets.MOSIPID_POSTGRES_PASSWORD }} ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY }} ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY }} # Spring config label per namespace — controls which Git branch/tag the config-server uses @@ -159,6 +185,7 @@ jobs: # If unset, hooks default to 'develop' ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL: ${{ vars.ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL }} ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL: ${{ vars.ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL }} + ESIGNET_MOSIPID_SPRING_CONFIG_LABEL: ${{ vars.ESIGNET_MOSIPID_SPRING_CONFIG_LABEL }} # Cluster access secrets KUBECONFIG_SECRET: ${{ secrets.KUBECONFIG }} CLUSTER_WIREGUARD_WG0: ${{ secrets.CLUSTER_WIREGUARD_WG0 }} @@ -203,6 +230,7 @@ jobs: save_var "ESIGNET_DB_PORT" "${{ github.event.inputs.esignet_db_port }}" save_var "MOSIPID1_DOMAIN_NAME" "${{ github.event.inputs.mosipid1_domain_name }}" save_var "MOSIPID2_DOMAIN_NAME" "${{ github.event.inputs.mosipid2_domain_name }}" + save_var "MOSIPID_DOMAIN_NAME" "${{ github.event.inputs.mosipid_domain_name }}" save_var "ENV_NAME" "${{ github.event.inputs.env_name }}" - name: Mask sensitive data @@ -218,6 +246,8 @@ jobs: echo "::add-mask::${{ secrets.ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY }}" + echo "::add-mask::${{ secrets.ESIGNET_MOSIPID_CAPTCHA_SITE_KEY }}" + echo "::add-mask::${{ secrets.ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY }}" @@ -391,8 +421,8 @@ jobs: echo "✅ ESIGNET_CAPTCHA_SECRET_KEY is configured" fi - # Per-namespace captcha secrets — only required for esignet standalone profile - if [[ "$PROFILE" == esignet-standalone* ]]; then + # Per-namespace captcha secrets — only required for esignet standalone profiles + if [ "$PROFILE" = "esignet-standalone" ]; then echo "--- Validating esignet standalone mosipid1 captcha secrets ---" for var in ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY \ ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY; do @@ -429,6 +459,28 @@ jobs: else echo "ℹ mosipid2 disabled — skipping mosipid2 secret validation" fi + elif [ "$PROFILE" = "esignet-standalone-2.0.0" ]; then + echo "--- Validating esignet standalone 2.0.0 (Go) mosipid captcha secrets ---" + for var in ESIGNET_MOSIPID_CAPTCHA_SITE_KEY ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY \ + ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY; do + val="${!var:-}" + if [ -z "$val" ]; then + echo "❌ $var secret is not configured (required for esignet standalone 2.0.0)" + MISSING_SECRETS=1 + else + echo "✅ $var is configured" + fi + done + echo "--- Validating esignet standalone 2.0.0 (Go) mosipid postgres + keycloak secrets ---" + for var in MOSIPID_POSTGRES_PASSWORD MOSIPID_KEYCLOAK_ADMIN_PASSWORD; do + val="${!var:-}" + if [ -z "$val" ]; then + echo "❌ $var secret is not configured (required for esignet standalone 2.0.0)" + MISSING_SECRETS=1 + else + echo "✅ $var is configured" + fi + done fi if [ "$MISSING_SECRETS" -eq 1 ]; then @@ -443,7 +495,7 @@ jobs: echo " - MOCK_RELYING_PARTY_JWE_PRIVATE_KEY (base64 encoded PEM)" echo " - ESIGNET_CAPTCHA_SITE_KEY (reCAPTCHA site key - plain text)" echo " - ESIGNET_CAPTCHA_SECRET_KEY (reCAPTCHA secret key - plain text)" - if [[ "$PROFILE" == esignet-standalone* ]]; then + if [ "$PROFILE" = "esignet-standalone" ]; then echo " - ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY / ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY" echo " - ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY / ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY" echo " - MOSIPID1_POSTGRES_PASSWORD / MOSIPID1_KEYCLOAK_ADMIN_PASSWORD" @@ -451,6 +503,10 @@ jobs: echo " - ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY / ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY" echo " - MOSIPID2_POSTGRES_PASSWORD / MOSIPID2_KEYCLOAK_ADMIN_PASSWORD" fi + elif [ "$PROFILE" = "esignet-standalone-2.0.0" ]; then + echo " - ESIGNET_MOSIPID_CAPTCHA_SITE_KEY / ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY" + echo " - ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY / ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY" + echo " - MOSIPID_POSTGRES_PASSWORD / MOSIPID_KEYCLOAK_ADMIN_PASSWORD" fi exit 1 fi @@ -554,6 +610,7 @@ jobs: echo "domain_name = $domain_name" echo "mosipid1_domain_name = $mosipid1_domain_name" echo "mosipid2_domain_name = $mosipid2_domain_name" + echo "mosipid_domain_name = $mosipid_domain_name" echo "env_name = $env_name" - name: Initiate helmsman to apply the DSF configurations @@ -597,7 +654,7 @@ jobs: SOFTHSM_PAIRS=("esignet-softhsm:esignet-mock" "esignet-softhsm-mosipid1:esignet-mosipid1" "esignet-softhsm-mosipid2:esignet-mosipid2" "esignet-softhsm-sunbird:esignet-sunbird") ;; esignet-standalone-2.0.0) - SOFTHSM_PAIRS=("esignet-softhsm-go:esignet-go-mock" "esignet-softhsm-go-mosipid1:esignet-go-mosipid1" "esignet-softhsm-go-mosipid2:esignet-go-mosipid2" "esignet-softhsm-go-sunbird:esignet-go-sunbird") + SOFTHSM_PAIRS=("esignet-softhsm:esignet-mock" "esignet-softhsm-mosipid:esignet-mosipid" "esignet-softhsm-sunbird:esignet-sunbird") ;; *) SOFTHSM_PAIRS=() @@ -643,7 +700,7 @@ jobs: echo "Commit: ${{ github.sha }}" echo "" echo "Namespaces created/updated:" - kubectl get ns esignet-mock esignet-mosipid1 esignet-mosipid2 esignet-sunbird softhsm keycloak redis postgres 2>/dev/null || echo "Some namespaces may not exist yet" + kubectl get ns esignet-mock esignet-mosipid1 esignet-mosipid2 esignet-mosipid esignet-sunbird softhsm keycloak redis postgres 2>/dev/null || echo "Some namespaces may not exist yet" echo "" echo "eSignet pods status:" kubectl get pods -n esignet-mock 2>/dev/null || echo "esignet-mock namespace not ready" diff --git a/.github/workflows/helmsman_testrigs.yml b/.github/workflows/helmsman_testrigs.yml index 1b19de8ff..93e5f52d1 100644 --- a/.github/workflows/helmsman_testrigs.yml +++ b/.github/workflows/helmsman_testrigs.yml @@ -38,6 +38,10 @@ on: description: "MOSIP-ID2 domain name (e.g. mosipenv2.xyz.net) — required only when enable_mosipid2 is set" required: false type: string + mosipid_domain_name: + description: "MOSIP-ID domain name for esignet-standalone-2.0.0 (Go) profile only (e.g. mosipenv.xyz.net)" + required: false + type: string db_port: description: "PostgreSQL port for MOSIP platform external postgres (e.g. 5433)" required: true @@ -79,6 +83,8 @@ jobs: VAR_MOSIPID1_DOMAIN: ${{ vars.MOSIPID1_DOMAIN_NAME }} VAR_MOSIPID2_DOMAIN: ${{ vars.MOSIPID2_DOMAIN_NAME }} IN_ENABLE_MOSIPID2: ${{ github.event.inputs.enable_mosipid2 }} + IN_MOSIPID_DOMAIN: ${{ github.event.inputs.mosipid_domain_name }} + VAR_MOSIPID_DOMAIN: ${{ vars.MOSIPID_DOMAIN_NAME }} run: | errors=() PROFILE="${{ github.event.inputs.profile }}" @@ -103,13 +109,16 @@ jobs: echo "✓ slack_channel_name = $SLACK_CH" echo "✓ db_port = $DB_PORT" echo "✓ esignet_db_port = $ESIGNET_DB_PORT" - # mosipid1_domain_name and mosipid2_domain_name are esignet standalone only. + # mosipid1/mosipid2_domain_name are esignet-standalone (v1.7.1) only — that + # profile still runs two separate mosipid1/mosipid2 instances. + # mosipid_domain_name is esignet-standalone-2.0.0 (Go) only — that profile + # consolidates mosipid1+mosipid2 into a single mosipid instance. # Push events always target the esignet profile (path filter); dispatch uses explicit profile input. - if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then + if [ -z "$PROFILE" ] || [ "$PROFILE" = "esignet-standalone" ]; then MOSIPID1_DOMAIN="${IN_MOSIPID1_DOMAIN:-$VAR_MOSIPID1_DOMAIN}" MOSIPID2_DOMAIN="${IN_MOSIPID2_DOMAIN:-$VAR_MOSIPID2_DOMAIN}" if [ -z "$MOSIPID1_DOMAIN" ]; then - echo "❌ mosipid1_domain_name is required for standalone profiles" + echo "❌ mosipid1_domain_name is required for esignet-standalone" exit 1 fi if [ "$IN_ENABLE_MOSIPID2" = "true" ] && @@ -119,11 +128,21 @@ jobs: fi echo "✓ mosipid1_domain_name = $MOSIPID1_DOMAIN (esignet standalone)" echo "✓ mosipid2_domain_name = $MOSIPID2_DOMAIN (esignet standalone)" - else + fi + if [ -z "$PROFILE" ] || [ "$PROFILE" = "esignet-standalone-2.0.0" ]; then + MOSIPID_DOMAIN="${IN_MOSIPID_DOMAIN:-$VAR_MOSIPID_DOMAIN}" + if [ -z "$MOSIPID_DOMAIN" ]; then + echo "❌ mosipid_domain_name is required for esignet-standalone-2.0.0" + exit 1 + fi + echo "✓ mosipid_domain_name = $MOSIPID_DOMAIN (esignet standalone 2.0.0 / Go)" + fi + if [ -n "$PROFILE" ] && [ "$PROFILE" != "esignet-standalone" ] && [ "$PROFILE" != "esignet-standalone-2.0.0" ]; then MOSIPID1_PROVIDED="$IN_MOSIPID1_DOMAIN" MOSIPID2_PROVIDED="$IN_MOSIPID2_DOMAIN" - if [ -n "$MOSIPID1_PROVIDED" ] || [ -n "$MOSIPID2_PROVIDED" ]; then - echo "⚠ mosipid1_domain_name / mosipid2_domain_name are only used for esignet standalone profile — ignoring for profile=$PROFILE" + MOSIPID_PROVIDED="$IN_MOSIPID_DOMAIN" + if [ -n "$MOSIPID1_PROVIDED" ] || [ -n "$MOSIPID2_PROVIDED" ] || [ -n "$MOSIPID_PROVIDED" ]; then + echo "⚠ mosipid1_domain_name / mosipid2_domain_name / mosipid_domain_name are only used for esignet standalone profiles — ignoring for profile=$PROFILE" fi fi @@ -139,6 +158,7 @@ jobs: domain_name: ${{ github.event.inputs.domain_name || vars.DOMAIN_NAME }} mosipid1_domain_name: ${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }} mosipid2_domain_name: ${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }} + mosipid_domain_name: ${{ github.event.inputs.mosipid_domain_name || vars.MOSIPID_DOMAIN_NAME }} MOSIPID2_ENABLED: ${{ github.event.inputs.enable_mosipid2 == 'true' && 'true' || 'false' }} db_port: ${{ github.event.inputs.db_port || vars.DB_PORT }} esignet_db_port: ${{ github.event.inputs.esignet_db_port || vars.ESIGNET_DB_PORT }} @@ -184,6 +204,7 @@ jobs: save_var "DOMAIN_NAME" "${{ github.event.inputs.domain_name }}" save_var "MOSIPID1_DOMAIN_NAME" "${{ github.event.inputs.mosipid1_domain_name }}" save_var "MOSIPID2_DOMAIN_NAME" "${{ github.event.inputs.mosipid2_domain_name }}" + save_var "MOSIPID_DOMAIN_NAME" "${{ github.event.inputs.mosipid_domain_name }}" save_var "DB_PORT" "${{ github.event.inputs.db_port }}" save_var "ESIGNET_DB_PORT" "${{ github.event.inputs.esignet_db_port }}" save_var "ENV_NAME" "${{ github.event.inputs.env_name }}" From 252e0429b7debe67a81bb2997dd8ec9ea49b5760 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 17:13:47 +0530 Subject: [PATCH 29/61] Consolidate mosipid1/mosipid2 into a single mosipid instance for esignet-standalone Applies the same consolidation already done for the Go profile to the v1.7.1 esignet-standalone profile: mosipid1 was always-enabled with a more complete config (captcha explicitly configured) while mosipid2 was optional and off by default, so mosipid1's config becomes canonical. Deletes mosipid2's app blocks, hook scripts, and plugin-values file, and renames mosipid1's to the consolidated mosipid name throughout the DSF, testrigs DSF, and hooks. Also fixes softhsm-esignet-mosipid1/2-values.yaml references that were left dangling by the earlier Go-profile task: those files were shared with the Go profile and got renamed/deleted there without accounting for this profile's own use of them, silently breaking this profile's softhsm-mosipid app. Both profiles now correctly share the single softhsm-esignet-mosipid-values.yaml file. Co-Authored-By: Claude Sonnet 5 Signed-off-by: bhumi46 --- .../dsf/esignet-standalone/esignet-dsf.yaml | 276 ++++-------------- .../dsf/esignet-standalone/testrigs-dsf.yaml | 79 +---- ...sh => apitestrig-esignet-mosipid-setup.sh} | 12 +- .../apitestrig-esignet-mosipid2-setup.sh | 27 -- .../config-server-esignet-postinstall.sh | 20 +- .../esignet-db-postinstall.sh | 2 +- .../esignet-standalone/esignet-init-db.sh | 4 +- ...stall.sh => esignet-mosipid-preinstall.sh} | 96 +++--- .../esignet-mosipid2-preinstall.sh | 127 -------- .../esignet-postinstall-keycloak-init.sh | 2 +- ...lying-party-service-mosipid-preinstall.sh} | 6 +- ...lying-party-service-mosipid2-preinstall.sh | 10 - ...ck-relying-party-ui-mosipid-preinstall.sh} | 12 +- ...ck-relying-party-ui-mosipid2-preinstall.sh | 24 -- ...stall.sh => oidc-ui-mosipid-preinstall.sh} | 6 +- .../oidc-ui-mosipid2-preinstall.sh | 9 - ...l.sh => pms-partner-mosipid-preinstall.sh} | 20 +- .../pms-partner-mosipid2-preinstall.sh | 45 --- ...up.sh => softhsm-esignet-mosipid-setup.sh} | 6 +- .../softhsm-esignet-mosipid2-setup.sh | 9 - .../trigger-test-jobs-esignet.sh | 7 +- ...aml => esignet-mosipid-plugin-values.yaml} | 16 +- .../utils/esignet-mosipid2-plugin-values.yaml | 118 -------- 23 files changed, 178 insertions(+), 755 deletions(-) rename Helmsman/hooks/esignet-standalone/{apitestrig-esignet-mosipid1-setup.sh => apitestrig-esignet-mosipid-setup.sh} (75%) delete mode 100755 Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid2-setup.sh rename Helmsman/hooks/esignet-standalone/{esignet-mosipid1-preinstall.sh => esignet-mosipid-preinstall.sh} (53%) delete mode 100755 Helmsman/hooks/esignet-standalone/esignet-mosipid2-preinstall.sh rename Helmsman/hooks/esignet-standalone/{mock-relying-party-service-mosipid1-preinstall.sh => mock-relying-party-service-mosipid-preinstall.sh} (69%) delete mode 100755 Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid2-preinstall.sh rename Helmsman/hooks/esignet-standalone/{mock-relying-party-ui-mosipid1-preinstall.sh => mock-relying-party-ui-mosipid-preinstall.sh} (66%) delete mode 100755 Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid2-preinstall.sh rename Helmsman/hooks/esignet-standalone/{oidc-ui-mosipid1-preinstall.sh => oidc-ui-mosipid-preinstall.sh} (66%) delete mode 100755 Helmsman/hooks/esignet-standalone/oidc-ui-mosipid2-preinstall.sh rename Helmsman/hooks/esignet-standalone/{pms-partner-mosipid1-preinstall.sh => pms-partner-mosipid-preinstall.sh} (62%) delete mode 100755 Helmsman/hooks/esignet-standalone/pms-partner-mosipid2-preinstall.sh rename Helmsman/hooks/esignet-standalone/{softhsm-esignet-mosipid1-setup.sh => softhsm-esignet-mosipid-setup.sh} (65%) delete mode 100755 Helmsman/hooks/esignet-standalone/softhsm-esignet-mosipid2-setup.sh rename Helmsman/utils/{esignet-mosipid1-plugin-values.yaml => esignet-mosipid-plugin-values.yaml} (91%) delete mode 100644 Helmsman/utils/esignet-mosipid2-plugin-values.yaml diff --git a/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml index 5db2e94be..56d5a8fd4 100644 --- a/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml @@ -32,9 +32,7 @@ namespaces: protected: false softhsm: protected: false - esignet-mosipid1: - protected: false - esignet-mosipid2: + esignet-mosipid: protected: false esignet-sunbird: protected: false @@ -56,27 +54,16 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/softhsm-esignet-setup.sh" - esignet-softhsm-mosipid1: - namespace: esignet-mosipid1 + esignet-softhsm-mosipid: + namespace: esignet-mosipid enabled: true version: 12.0.1 chart: mosip/softhsm - valuesFile: "$WORKDIR/utils/softhsm-esignet-mosipid1-values.yaml" - timeout: 480 - priority: -16 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/softhsm-esignet-mosipid1-setup.sh" - - esignet-softhsm-mosipid2: - namespace: esignet-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 12.0.1 - chart: mosip/softhsm - valuesFile: "$WORKDIR/utils/softhsm-esignet-mosipid2-values.yaml" + valuesFile: "$WORKDIR/utils/softhsm-esignet-mosipid-values.yaml" timeout: 480 priority: -16 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/softhsm-esignet-mosipid2-setup.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/softhsm-esignet-mosipid-setup.sh" esignet-softhsm-sunbird: namespace: esignet-sunbird @@ -136,12 +123,12 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/esignet-preinstall.sh" - esignet-mosipid1: - namespace: esignet-mosipid1 + esignet-mosipid: + namespace: esignet-mosipid enabled: true version: 0.1.0-develop chart: mosip/esignet - valuesFile: "$WORKDIR/utils/esignet-mosipid1-plugin-values.yaml" + valuesFile: "$WORKDIR/utils/esignet-mosipid-plugin-values.yaml" set: image.repository: "mosipqa/esignet-with-plugins" image.tag: "develop" @@ -150,71 +137,31 @@ apps: activeProfileEnv: "" pluginNameEnv: "mosip-identity-plugin.jar" pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-mosipid1-share" + extraEnvVarsCM[0]: "esignet-softhsm-mosipid-share" extraEnvVarsCM[1]: "esignet-global" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-mosipid1.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-mosipid1.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "esignet-mosipid.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "signup-mosipid.${domain_name}" domainConfig.MOSIP_API_HOST: "api.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid1_domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid_domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" - domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid1_domain_name}" - domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid1_domain_name}" - domainConfig.IDA_INTERNAL_URL: "https://api-internal.${mosipid1_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL: "https://api-internal.${mosipid1_domain_name}/mosip-certs/ida-partner.cer" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid1_domain_name}/v1/authmanager/authenticate/clientidsecretkey" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid1_domain_name}/v1/auditmanager/audits" - domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid1_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-mosipid1.${domain_name}" - domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-mosipid1.${domain_name}" + domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid_domain_name}" + domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid_domain_name}" + domainConfig.IDA_INTERNAL_URL: "https://api-internal.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL: "https://api-internal.${mosipid_domain_name}/mosip-certs/ida-partner.cer" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid_domain_name}/v1/authmanager/authenticate/clientidsecretkey" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid_domain_name}/v1/auditmanager/audits" + domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-mosipid.${domain_name}" + domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-mosipid.${domain_name}" timeout: 600 priority: -14 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/esignet-mosipid1-preinstall.sh" - - esignet-mosipid2: - namespace: esignet-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/esignet - valuesFile: "$WORKDIR/utils/esignet-mosipid2-plugin-values.yaml" - set: - image.repository: "mosipqa/esignet-with-plugins" - image.tag: "develop" - enable_insecure: "false" - springConfigNameEnv: "" - activeProfileEnv: "" - pluginNameEnv: "mosip-identity-plugin.jar" - pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-mosipid2-share" - extraEnvVarsCM[1]: "esignet-global" - metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-mosipid2.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-mosipid2.${domain_name}" - domainConfig.MOSIP_API_HOST: "api.${domain_name}" - domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid2_domain_name}" - domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" - domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" - domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" - domainConfig.installation-domain: "${domain_name}" - domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid2_domain_name}" - domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid2_domain_name}" - domainConfig.IDA_INTERNAL_URL: "https://api-internal.${mosipid2_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL: "https://api-internal.${mosipid2_domain_name}/mosip-certs/ida-partner.cer" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid2_domain_name}/v1/authmanager/authenticate/clientidsecretkey" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid2_domain_name}/v1/auditmanager/audits" - domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid2_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-mosipid2.${domain_name}" - domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-mosipid2.${domain_name}" - timeout: 600 - priority: -14 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/esignet-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/esignet-mosipid-preinstall.sh" esignet-sunbird: namespace: esignet-sunbird @@ -242,9 +189,9 @@ apps: domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" - domainConfig.MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid1_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL: "https://registry.${mosipid1_domain_name}/api/v1/Insurance/search" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid1_domain_name}/api/v1/Insurance/" + domainConfig.MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL: "https://registry.${mosipid_domain_name}/api/v1/Insurance/search" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid_domain_name}/api/v1/Insurance/" timeout: 600 priority: -14 hooks: @@ -270,39 +217,22 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/oidc-ui-preinstall.sh" - oidc-ui-mosipid1: - namespace: esignet-mosipid1 + oidc-ui-mosipid: + namespace: esignet-mosipid enabled: true version: 0.1.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" image.tag: "develop" - istio.hosts[0]: "esignet-mosipid1.${domain_name}" - oidc_ui.oidc_service_host: "esignet-mosipid1.esignet-mosipid1" - oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mosipid1.esignet-mosipid1/v1/esignet" - oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mosipid1.esignet-mosipid1" + istio.hosts[0]: "esignet-mosipid.${domain_name}" + oidc_ui.oidc_service_host: "esignet-mosipid.esignet-mosipid" + oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mosipid.esignet-mosipid/v1/esignet" + oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mosipid.esignet-mosipid" timeout: 1200 priority: -13 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/oidc-ui-mosipid1-preinstall.sh" - - oidc-ui-mosipid2: - namespace: esignet-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/oidc-ui - set: - image.repository: "mosipqa/oidc-ui" - image.tag: "develop" - istio.hosts[0]: "esignet-mosipid2.${domain_name}" - oidc_ui.oidc_service_host: "esignet-mosipid2.esignet-mosipid2" - oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mosipid2.esignet-mosipid2/v1/esignet" - oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mosipid2.esignet-mosipid2" - timeout: 1200 - priority: -13 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/oidc-ui-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/oidc-ui-mosipid-preinstall.sh" oidc-ui-sunbird: namespace: esignet-sunbird @@ -385,35 +315,20 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-service-preinstall.sh" - mock-relying-party-service-mosipid1: - namespace: esignet-mosipid1 + mock-relying-party-service-mosipid: + namespace: esignet-mosipid enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service set: - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-mosipid1.esignet-mosipid1/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-mosipid1.${domain_name}/v1/esignet/oauth/v2/token" - enable_insecure: "false" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" - timeout: 480 - priority: -10 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-service-mosipid1-preinstall.sh" - - mock-relying-party-service-mosipid2: - namespace: esignet-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/mock-relying-party-service - set: - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-mosipid2.esignet-mosipid2/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-mosipid2.${domain_name}/v1/esignet/oauth/v2/token" + mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-mosipid.esignet-mosipid/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-mosipid.${domain_name}/v1/esignet/oauth/v2/token" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" timeout: 480 priority: -10 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-service-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-service-mosipid-preinstall.sh" mock-relying-party-service-sunbird: namespace: esignet-sunbird @@ -464,19 +379,19 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-ui-preinstall.sh" - mock-relying-party-ui-mosipid1: - namespace: esignet-mosipid1 + mock-relying-party-ui-mosipid: + namespace: esignet-mosipid enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-ui set: - mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-mosipid1.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-mosipid1.esignet-mosipid1" - mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-mosipid1.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-mosipid1.${domain_name}/mock-relying-party-service" - mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid1.${domain_name}/userprofile" - mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid1.${domain_name}/registration" - mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid1.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-mosipid.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-mosipid.esignet-mosipid" + mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-mosipid.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-mosipid.${domain_name}/mock-relying-party-service" + mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid.${domain_name}/userprofile" + mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid.${domain_name}/registration" + mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid.${domain_name}/plugins/sign-in-button-plugin.js" mock_relying_party_ui.mock_relying_party_ui_port: '5000' mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet @@ -491,46 +406,12 @@ apps: mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge - istio.hosts[0]: "healthservices-mosipid1.${domain_name}" + istio.hosts[0]: "healthservices-mosipid.${domain_name}" wait: true timeout: 480 priority: -9 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-ui-mosipid1-preinstall.sh" - - mock-relying-party-ui-mosipid2: - namespace: esignet-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/mock-relying-party-ui - set: - mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-mosipid2.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-mosipid2.esignet-mosipid2" - mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-mosipid2.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-mosipid2.${domain_name}/mock-relying-party-service" - mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid2.${domain_name}/userprofile" - mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid2.${domain_name}/registration" - mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid2.${domain_name}/plugins/sign-in-button-plugin.js" - mock_relying_party_ui.mock_relying_party_ui_port: '5000' - mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ - mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet - mock_relying_party_ui.DISPLAY: page - mock_relying_party_ui.PROMPT: consent - mock_relying_party_ui.GRANT_TYPE: authorization_code - mock_relying_party_ui.CLAIMS_LOCALES: en - mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile - mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' - mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' - mock_relying_party_ui.DEFAULT_LANG: en - mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' - mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize - mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge - istio.hosts[0]: "healthservices-mosipid2.${domain_name}" - wait: true - timeout: 480 - priority: -9 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-ui-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-ui-mosipid-preinstall.sh" mock-relying-party-ui-sunbird: namespace: esignet-sunbird @@ -566,81 +447,38 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-ui-sunbird-preinstall.sh" - pms-partner-mosipid1: - namespace: esignet-mosipid1 + pms-partner-mosipid: + namespace: esignet-mosipid enabled: false version: 12.2.3 chart: mosip/pms-partner set: # image.repository: "mosipid/partner-management-service" # image.tag: "1.2.2.3" - istio.gateways[0]: "pms-partner-mosipid1-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid1.${domain_name}" + istio.gateways[0]: "pms-partner-mosipid-gateway" + istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid.${domain_name}" extraEnvVarsCM[0]: "esignet-global" extraEnvVarsCM[1]: "esignet-config-server-share" priority: -9 timeout: 1200 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/pms-partner-mosipid1-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/pms-partner-mosipid-preinstall.sh" - pms-policy-mosipid1: - namespace: esignet-mosipid1 + pms-policy-mosipid: + namespace: esignet-mosipid enabled: false version: 12.2.3 chart: mosip/pms-policy set: # image.repository: "mosipid/policy-management-service" # image.tag: "1.2.2.2" - istio.gateways[0]: "pms-partner-mosipid1-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid1.${domain_name}" + istio.gateways[0]: "pms-partner-mosipid-gateway" + istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid.${domain_name}" extraEnvVarsCM[0]: "esignet-global" extraEnvVarsCM[1]: "esignet-config-server-share" priority: -9 timeout: 1200 - pms-partner-mosipid2: - namespace: esignet-mosipid2 - enabled: false - version: 12.2.3 - chart: mosip/pms-partner - set: - # image.repository: "mosipid/partner-management-service" - # image.tag: "1.2.2.3" - istio.gateways[0]: "pms-partner-mosipid2-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid2.${domain_name}" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-share" - priority: -9 - timeout: 1200 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/pms-partner-mosipid2-preinstall.sh" - - pms-policy-mosipid2: - namespace: esignet-mosipid2 - enabled: false - version: 12.2.3 - chart: mosip/pms-policy - set: - # image.repository: "mosipid/policy-management-service" - # image.tag: "1.2.2.2" - istio.gateways[0]: "pms-partner-mosipid2-gateway" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-share" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid2.${domain_name}" - priority: -9 - timeout: 1200 - - # --------------------------------------------------------------------------- - # Partner Onboarders - # --------------------------------------------------------------------------- - # Two onboarders for eSignet standalone — enable the one matching your plugin: - # esignet-mock-rp-onboarder: for mock plugin (plugin 1) and sunbird-rc (plugin 3) - # esignet-misp-onboarder: for mosip-identity-plugin (plugin 2) only - - # eSignet MISP Partner Onboarder - # Onboards the eSignet MISP client — only needed with mosip-identity-plugin (plugin 2). - # Runs FIRST so the MISP license key is written before mock-rp-onboarder starts. - # After completion, restarts the esignet deployment to pick up the new MISP license key. esignet-misp-onboarder: namespace: esignet-mock enabled: false diff --git a/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml b/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml index d07899ae8..2250af730 100644 --- a/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml @@ -9,18 +9,15 @@ helmRepos: # Apitestrigs deploy into service namespaces (no dedicated testrig namespaces): # esignet-apitestrig → esignet ns -# esignet-mosipid1-apitestrig → esignet-mosipid1 ns -# esignet-mosipid2-apitestrig → esignet-mosipid2 ns +# esignet-mosipid-apitestrig → esignet-mosipid ns # esignet-sunbird-apitestrig → esignet-sunbird ns # esignet-signup-apitestrig → signup ns (disabled — enable if signup deployed) # signup-uitestrig → signup-uitestrig (disabled — enable if signup deployed) namespaces: - esignet-mosipid1: + esignet-mosipid: protected: false esignet-mock: protected: false - esignet-mosipid2: - protected: false esignet-sunbird: protected: false signup: @@ -75,10 +72,10 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone/apitestrig-esignet-setup.sh" # --------------------------------------------------------------------------- - # eSignet API Testrig — esignet-mosipid1 namespace (mosip-identity-plugin) + # eSignet API Testrig — esignet-mosipid namespace (mosip-identity-plugin) # --------------------------------------------------------------------------- - esignet-mosipid1-apitestrig: - namespace: esignet-mosipid1 + esignet-mosipid-apitestrig: + namespace: esignet-mosipid enabled: true version: 0.0.1-develop chart: mosip/apitestrig @@ -89,15 +86,15 @@ apps: extraEnvVarsCM[2]: "keycloak-host" extraEnvVarsCM[3]: "db" extraEnvVarsCM[4]: "apitestrig" - extraEnvVarsSecret[0]: "apitestrig-esignet-mosipid1-apitestrig" - extraEnvVarsSecret[1]: "s3-esignet-mosipid1-apitestrig" + extraEnvVarsSecret[0]: "apitestrig-esignet-mosipid-apitestrig" + extraEnvVarsSecret[1]: "s3-esignet-mosipid-apitestrig" extraEnvVarsSecret[2]: "keycloak-client-secrets" extraEnvVarsSecret[3]: "postgres-postgresql" crontime: "0 2 * * *" apitestrig.configmaps.s3.s3-host: 'http://minio.minio:9000' apitestrig.configmaps.s3.s3-user-key: 'admin' apitestrig.configmaps.s3.s3-region: '' - apitestrig.configmaps.db.db-server: "api-internal.${mosipid1_domain_name}" + apitestrig.configmaps.db.db-server: "api-internal.${mosipid_domain_name}" apitestrig.configmaps.db.db-su-user: "postgres" apitestrig.configmaps.db.db-port: "${esignet_db_port}" apitestrig.configmaps.apitestrig.ENV_USER: "api-internal.${env_name}" @@ -106,70 +103,20 @@ apps: apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-mosipid1" + apitestrig.configmaps.apitestrig.NS: "esignet-mosipid" apitestrig.configmaps.apitestrig.servicesNotDeployed: 'sunbirdrc' apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-mosipid1.${domain_name}" + apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-mosipid.${domain_name}" apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid1_domain_name};idrepository=api-internal.${mosipid1_domain_name};authmanager=api-internal.${mosipid1_domain_name};resident=api-internal.${mosipid1_domain_name};partnermanager=pms-mosipid1.${mosipid1_domain_name};idauthentication=api-internal.${mosipid1_domain_name};masterdata=api-internal.${mosipid1_domain_name};idgenerator=api-internal.${mosipid1_domain_name};policymanager=pms-mosipid1.${mosipid1_domain_name};preregistration=api-internal.${mosipid1_domain_name};keymanager=api-internal.${mosipid1_domain_name};" + apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid_domain_name};idrepository=api-internal.${mosipid_domain_name};authmanager=api-internal.${mosipid_domain_name};resident=api-internal.${mosipid_domain_name};partnermanager=pms-mosipid.${mosipid_domain_name};idauthentication=api-internal.${mosipid_domain_name};masterdata=api-internal.${mosipid_domain_name};idgenerator=api-internal.${mosipid_domain_name};policymanager=pms-mosipid.${mosipid_domain_name};preregistration=api-internal.${mosipid_domain_name};keymanager=api-internal.${mosipid_domain_name};" secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" priority: -4 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/apitestrig-esignet-mosipid1-setup.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/apitestrig-esignet-mosipid-setup.sh" - # --------------------------------------------------------------------------- - # eSignet API Testrig — esignet-mosipid2 namespace (mosip-identity-plugin) - # --------------------------------------------------------------------------- - esignet-mosipid2-apitestrig: - namespace: esignet-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/apitestrig - valuesFile: "$WORKDIR/utils/esignet-apitestrig-values.yaml" - set: - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "s3" - extraEnvVarsCM[2]: "keycloak-host" - extraEnvVarsCM[3]: "db" - extraEnvVarsCM[4]: "apitestrig" - extraEnvVarsSecret[0]: "apitestrig-esignet-mosipid2-apitestrig" - extraEnvVarsSecret[1]: "s3-esignet-mosipid2-apitestrig" - extraEnvVarsSecret[2]: "keycloak-client-secrets" - extraEnvVarsSecret[3]: "postgres-postgresql" - crontime: "0 2 * * *" - apitestrig.configmaps.s3.s3-host: 'http://minio.minio:9000' - apitestrig.configmaps.s3.s3-user-key: 'admin' - apitestrig.configmaps.s3.s3-region: '' - apitestrig.configmaps.db.db-server: "api-internal.${mosipid2_domain_name}" - apitestrig.configmaps.db.db-su-user: "postgres" - apitestrig.configmaps.db.db-port: "${esignet_db_port}" - apitestrig.configmaps.apitestrig.ENV_USER: "api-internal.${env_name}" - apitestrig.configmaps.apitestrig.ENV_ENDPOINT: "https://api-internal.${domain_name}" - apitestrig.configmaps.apitestrig.ENV_TESTLEVEL: "smokeAndRegression" - apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" - apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" - apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-mosipid2" - apitestrig.configmaps.apitestrig.servicesNotDeployed: 'sunbirdrc' - apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" - apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" - apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-mosipid2.${domain_name}" - apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid2_domain_name};idrepository=api-internal.${mosipid2_domain_name};authmanager=api-internal.${mosipid2_domain_name};resident=api-internal.${mosipid2_domain_name};partnermanager=pms-mosipid2.${mosipid2_domain_name};idauthentication=api-internal.${mosipid2_domain_name};masterdata=api-internal.${mosipid2_domain_name};idgenerator=api-internal.${mosipid2_domain_name};policymanager=pms-mosipid2.${mosipid2_domain_name};preregistration=api-internal.${mosipid2_domain_name};keymanager=api-internal.${mosipid2_domain_name};" - secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" - apitestrig.variables.push_reports_to_s3: "yes" - priority: -3 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/apitestrig-esignet-mosipid2-setup.sh" - - # --------------------------------------------------------------------------- - # eSignet API Testrig — esignet-sunbird namespace (sunbird-rc-plugin) - # postInstall triggers all four testrig namespaces after last one deploys. - # --------------------------------------------------------------------------- esignet-sunbird-apitestrig: namespace: esignet-sunbird enabled: true @@ -206,7 +153,7 @@ apps: apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-sunbird.${domain_name}" apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.sunBirdBaseURL: "https://registry.${mosipid1_domain_name}" + apitestrig.configmaps.apitestrig.sunBirdBaseURL: "https://registry.${mosipid_domain_name}" secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" priority: -2 diff --git a/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid1-setup.sh b/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid-setup.sh similarity index 75% rename from Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid1-setup.sh rename to Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid-setup.sh index 89ef80915..a1047daa2 100755 --- a/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid1-setup.sh +++ b/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid-setup.sh @@ -1,19 +1,19 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet-MOSIPID1 API Testrig Pre-install Setup +# eSignet 1.7.1 - eSignet-MOSIPID API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-mosipid1 namespace for the esignet-mosipid1-apitestrig release. -# keycloak-host and keycloak-client-secrets are already present in esignet-mosipid1 +# Prepares the esignet-mosipid namespace for the esignet-mosipid-apitestrig release. +# keycloak-host and keycloak-client-secrets are already present in esignet-mosipid # (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql # needs to be copied; stale testrig CMs are deleted so the chart recreates them. # ============================================================================= set -euo pipefail -NS=esignet-mosipid1 +NS=esignet-mosipid COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" -echo "eSignet 1.7.1 - eSignet-MOSIPID1 API Testrig Pre-install" +echo "eSignet 1.7.1 - eSignet-MOSIPID API Testrig Pre-install" echo "================================================" echo "Deleting stale testrig configmaps in $NS" @@ -24,4 +24,4 @@ kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig echo "Copying postgres-postgresql secret to $NS" $COPY_UTIL secret postgres-postgresql postgres "$NS" -echo "eSignet-MOSIPID1 API Testrig pre-install setup completed." +echo "eSignet-MOSIPID API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid2-setup.sh b/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid2-setup.sh deleted file mode 100755 index 9f5f75258..000000000 --- a/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid2-setup.sh +++ /dev/null @@ -1,27 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - eSignet-MOSIPID2 API Testrig Pre-install Setup -# ============================================================================= -# Prepares the esignet-mosipid2 namespace for the esignet-mosipid2-apitestrig release. -# keycloak-host and keycloak-client-secrets are already present in esignet-mosipid2 -# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql -# needs to be copied; stale testrig CMs are deleted so the chart recreates them. -# ============================================================================= -set -euo pipefail - -NS=esignet-mosipid2 -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" - -echo "================================================" -echo "eSignet 1.7.1 - eSignet-MOSIPID2 API Testrig Pre-install" -echo "================================================" - -echo "Deleting stale testrig configmaps in $NS" -kubectl -n "$NS" delete --ignore-not-found=true configmap s3 -kubectl -n "$NS" delete --ignore-not-found=true configmap db -kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig - -echo "Copying postgres-postgresql secret to $NS" -$COPY_UTIL secret postgres-postgresql postgres "$NS" - -echo "eSignet-MOSIPID2 API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone/config-server-esignet-postinstall.sh b/Helmsman/hooks/esignet-standalone/config-server-esignet-postinstall.sh index 1c799425e..9309be2c1 100755 --- a/Helmsman/hooks/esignet-standalone/config-server-esignet-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone/config-server-esignet-postinstall.sh @@ -2,13 +2,12 @@ # ============================================================================= # eSignet 1.7.1 - Config-Server eSignet Post-install # ============================================================================= -# Copies esignet-config-server-share CM from esignet-mock ns to mosipid1/mosipid2/sunbird, +# Copies esignet-config-server-share CM from esignet-mock ns to mosipid/sunbird, # then patches active_profile_env and spring_config_label_env per namespace # so each instance points to the correct config server profile and Git label. # # Environment variables (set in GitHub Actions workflow): -# ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL - Git label for esignet-mosipid1 (default: develop) -# ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL - Git label for esignet-mosipid2 (default: develop) +# ESIGNET_MOSIPID_SPRING_CONFIG_LABEL - Git label for esignet-mosipid (default: develop) # ============================================================================= set -euo pipefail @@ -16,24 +15,19 @@ SOURCE_NS="esignet-mock" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" CM_NAME="esignet-config-server-share" -MOSIPID1_SPRING_LABEL="${ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL:-develop}" -MOSIPID2_SPRING_LABEL="${ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL:-develop}" +MOSIPID_SPRING_LABEL="${ESIGNET_MOSIPID_SPRING_CONFIG_LABEL:-develop}" echo "================================================" echo "eSignet 1.7.1 - Config-Server eSignet Post-install" echo "================================================" -for TARGET_NS in esignet-mosipid1 esignet-mosipid2 esignet-sunbird; do +for TARGET_NS in esignet-mosipid esignet-sunbird; do echo "Copying $CM_NAME from $SOURCE_NS to $TARGET_NS" $COPY_UTIL configmap "$CM_NAME" "$SOURCE_NS" "$TARGET_NS" done -echo "Patching $CM_NAME in esignet-mosipid1 (active_profile_env=mosipid1, spring_config_label_env=$MOSIPID1_SPRING_LABEL)" -kubectl -n esignet-mosipid1 patch configmap "$CM_NAME" --type merge \ - -p "{\"data\":{\"active_profile_env\":\"mosipid1\",\"spring_config_label_env\":\"$MOSIPID1_SPRING_LABEL\"}}" - -echo "Patching $CM_NAME in esignet-mosipid2 (active_profile_env=mosipid2, spring_config_label_env=$MOSIPID2_SPRING_LABEL)" -kubectl -n esignet-mosipid2 patch configmap "$CM_NAME" --type merge \ - -p "{\"data\":{\"active_profile_env\":\"mosipid2\",\"spring_config_label_env\":\"$MOSIPID2_SPRING_LABEL\"}}" +echo "Patching $CM_NAME in esignet-mosipid (active_profile_env=mosipid, spring_config_label_env=$MOSIPID_SPRING_LABEL)" +kubectl -n esignet-mosipid patch configmap "$CM_NAME" --type merge \ + -p "{\"data\":{\"active_profile_env\":\"mosipid\",\"spring_config_label_env\":\"$MOSIPID_SPRING_LABEL\"}}" echo "Config-server share configmap propagation and patching completed." diff --git a/Helmsman/hooks/esignet-standalone/esignet-db-postinstall.sh b/Helmsman/hooks/esignet-standalone/esignet-db-postinstall.sh index cf716aa72..a671a62c8 100755 --- a/Helmsman/hooks/esignet-standalone/esignet-db-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone/esignet-db-postinstall.sh @@ -15,7 +15,7 @@ echo "================================================" echo "eSignet 1.7.1 - Database Init Post-install" echo "================================================" -for NS in esignet-mock esignet-mosipid1 esignet-mosipid2 esignet-sunbird; do +for NS in esignet-mock esignet-mosipid esignet-sunbird; do echo "Copying db-common-secrets from $POSTGRES_NS to $NS" $COPY_UTIL secret db-common-secrets "$POSTGRES_NS" "$NS" done diff --git a/Helmsman/hooks/esignet-standalone/esignet-init-db.sh b/Helmsman/hooks/esignet-standalone/esignet-init-db.sh index d382f7848..9c15c6fb5 100755 --- a/Helmsman/hooks/esignet-standalone/esignet-init-db.sh +++ b/Helmsman/hooks/esignet-standalone/esignet-init-db.sh @@ -7,7 +7,7 @@ # postgres-postgresql secret natively. This hook pre-creates all esignet-mock # namespaces so the postInstall hook can copy db-common-secrets into each. # Namespaces are created here at priority -16 because the namespace-specific -# preinstall hooks (esignet-mosipid1/mosipid2/sunbird) only run at priority -14. +# preinstall hooks (esignet-mosipid/sunbird) only run at priority -14. # ============================================================================= set -euo pipefail @@ -15,7 +15,7 @@ echo "================================================" echo "eSignet 1.7.1 - Database Init Pre-install" echo "================================================" -for NS in esignet-mock esignet-mosipid1 esignet-mosipid2 esignet-sunbird; do +for NS in esignet-mock esignet-mosipid esignet-sunbird; do kubectl create namespace "$NS" --dry-run=client -o yaml | kubectl apply -f - kubectl label namespace "$NS" istio-injection=enabled --overwrite echo "Namespace $NS ready." diff --git a/Helmsman/hooks/esignet-standalone/esignet-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone/esignet-mosipid-preinstall.sh similarity index 53% rename from Helmsman/hooks/esignet-standalone/esignet-mosipid1-preinstall.sh rename to Helmsman/hooks/esignet-standalone/esignet-mosipid-preinstall.sh index e768ad1d8..ef54cc13a 100755 --- a/Helmsman/hooks/esignet-standalone/esignet-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone/esignet-mosipid-preinstall.sh @@ -1,41 +1,41 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet MOSIPID1 Service Pre-install +# eSignet 1.7.1 - eSignet MOSIPID Service Pre-install # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid1, runs base esignet preinstall (copies -# postgres + redis config/secrets), then creates esignet-captcha-mosipid1 secret -# in the captcha namespace from workflow env vars, copies it to esignet-mosipid1, -# and patches the captcha deployment with the MOSIPID1 secret key. +# Wrapper: sets ESIGNET_NS=esignet-mosipid, runs base esignet preinstall (copies +# postgres + redis config/secrets), then creates esignet-captcha-mosipid secret +# in the captcha namespace from workflow env vars, copies it to esignet-mosipid, +# and patches the captcha deployment with the MOSIPID secret key. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-mosipid1" +export ESIGNET_NS="esignet-mosipid" CAPTCHA_NS="captcha" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY must be set}" -CAPTCHA_SECRET_KEY="${ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY must be set}" -MOSIPID1_POSTGRES_PASS="${MOSIPID1_POSTGRES_PASSWORD:?ERROR: MOSIPID1_POSTGRES_PASSWORD must be set}" -MOSIPID1_KC_ADMIN_PASS="${MOSIPID1_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID1_KEYCLOAK_ADMIN_PASSWORD must be set}" +CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID_CAPTCHA_SITE_KEY must be set}" +CAPTCHA_SECRET_KEY="${ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY must be set}" +MOSIPID_POSTGRES_PASS="${MOSIPID_POSTGRES_PASSWORD:?ERROR: MOSIPID_POSTGRES_PASSWORD must be set}" +MOSIPID_KC_ADMIN_PASS="${MOSIPID_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID_KEYCLOAK_ADMIN_PASSWORD must be set}" "$WORKDIR/hooks/esignet-standalone/esignet-preinstall.sh" -# Create MOSIPID1-specific esignet-global — same domain_name, but esignet/signup hosts differ +# Create MOSIPID-specific esignet-global — same domain_name, but esignet/signup hosts differ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ --from-literal=installation-domain="${domain_name}" \ --from-literal=mosip-api-host="api.${domain_name}" \ --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet-mosipid1.${domain_name}" \ + --from-literal=mosip-esignet-host="esignet-mosipid.${domain_name}" \ --from-literal=mosip-iam-external-host="iam.${domain_name}" \ --from-literal=mosip-kafka-host="kafka.${domain_name}" \ --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup-mosipid1.${domain_name}" \ + --from-literal=mosip-signup-host="signup-mosipid.${domain_name}" \ --from-literal=mosip-smtp-host="smtp.${domain_name}" \ --from-literal=mosip-version="develop" \ --dry-run=client -o yaml | kubectl apply -f - -# Override postgres-config with MOSIPID1-specific DB values +# Override postgres-config with MOSIPID-specific DB values kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_mosipid1","database-username":"esignetuser_mosipid1"}}' + -p '{"data":{"database-name":"mosip_esignet_mosipid","database-username":"esignetuser_mosipid"}}' # Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then @@ -44,50 +44,66 @@ if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" fi -echo "Creating esignet-captcha-mosipid1 secret in $CAPTCHA_NS namespace" -kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-mosipid1 \ +echo "Creating esignet-captcha-mosipid secret in $CAPTCHA_NS namespace" +kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-mosipid \ --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ --dry-run=client -o yaml | kubectl apply -f - -echo "Copying esignet-captcha-mosipid1 secret from $CAPTCHA_NS to $ESIGNET_NS" -$COPY_UTIL secret esignet-captcha-mosipid1 "$CAPTCHA_NS" "$ESIGNET_NS" +echo "Copying esignet-captcha-mosipid secret from $CAPTCHA_NS to $ESIGNET_NS" +$COPY_UTIL secret esignet-captcha-mosipid "$CAPTCHA_NS" "$ESIGNET_NS" + +echo "Patching captcha deployment with ESIGNETMOSIPID secret key" + +# Remove stale pre-consolidation env var names if still present, so they don't +# linger pointing at secrets that no longer exist (esignet-mosipid1 was renamed +# to esignet-mosipid; esignet-mosipid2 was removed). +for OLD_NAME in MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID1 MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID2; do + OLD_ENV_INDEX=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ + -o jsonpath="{range .spec.template.spec.containers[0].env[*]}{.name}{'\n'}{end}" 2>/dev/null \ + | grep -n -x "$OLD_NAME" | cut -d: -f1 || echo "") + if [[ -n "$OLD_ENV_INDEX" ]]; then + OLD_ENV_ARRAY_INDEX=$((OLD_ENV_INDEX - 1)) + echo "Removing stale $OLD_NAME env var (index $OLD_ENV_ARRAY_INDEX)" + kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ + -p="[{\"op\": \"remove\", \"path\": \"/spec/template/spec/containers/0/env/$OLD_ENV_ARRAY_INDEX\"}]" + fi +done -echo "Patching captcha deployment with ESIGNETMOSIPID1 secret key" ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ - -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID1')].name}" 2>/dev/null || echo "") + -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID')].name}" 2>/dev/null || echo "") if [[ -z "$ENV_VAR_EXISTS" ]]; then kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID1", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-mosipid1", "key": "esignet-captcha-secret-key"}}}}]' + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-mosipid", "key": "esignet-captcha-secret-key"}}}}]' else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID1 already exists." + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID already exists." fi -# --- postgres-postgresql-mosipid1 secret (MOSIPID1 remote postgres password) --- -echo "Creating postgres-postgresql-mosipid1 secret in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create secret generic postgres-postgresql-mosipid1 \ - --from-literal=postgres-password="${MOSIPID1_POSTGRES_PASS}" \ +# --- postgres-postgresql-mosipid secret (MOSIPID remote postgres password) --- +echo "Creating postgres-postgresql-mosipid secret in $ESIGNET_NS" +kubectl -n "$ESIGNET_NS" create secret generic postgres-postgresql-mosipid \ + --from-literal=postgres-password="${MOSIPID_POSTGRES_PASS}" \ --dry-run=client -o yaml | kubectl apply -f - -# --- keycloak-host-mosipid1 CM (external URL points to MOSIPID1 Keycloak) --- -echo "Creating keycloak-host-mosipid1 configmap in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create configmap keycloak-host-mosipid1 \ - --from-literal=keycloak-external-host="iam.${mosipid1_domain_name}" \ - --from-literal=keycloak-external-url="https://iam.${mosipid1_domain_name}" \ +# --- keycloak-host-mosipid CM (external URL points to MOSIPID Keycloak) --- +echo "Creating keycloak-host-mosipid configmap in $ESIGNET_NS" +kubectl -n "$ESIGNET_NS" create configmap keycloak-host-mosipid \ + --from-literal=keycloak-external-host="iam.${mosipid_domain_name}" \ + --from-literal=keycloak-external-url="https://iam.${mosipid_domain_name}" \ --from-literal=keycloak-internal-host="keycloak.keycloak" \ --from-literal=keycloak-internal-service-url="http://keycloak.keycloak/auth/" \ --from-literal=keycloak-internal-url="http://keycloak.keycloak" \ --dry-run=client -o yaml | kubectl apply -f - -# --- keycloak-client-secrets-mosipid1: fetch all confidential clients from MOSIPID1 Keycloak --- -KC_HOST="iam.${mosipid1_domain_name}" +# --- keycloak-client-secrets-mosipid: fetch all confidential clients from MOSIPID Keycloak --- +KC_HOST="iam.${mosipid_domain_name}" REALM="mosip" echo "Fetching admin token from $KC_HOST" TOKEN_RESPONSE=$(curl -sf -X POST \ "https://${KC_HOST}/auth/realms/master/protocol/openid-connect/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ - -d "grant_type=password&client_id=admin-cli&username=admin&password=${MOSIPID1_KC_ADMIN_PASS}") + -d "grant_type=password&client_id=admin-cli&username=admin&password=${MOSIPID_KC_ADMIN_PASS}") ADMIN_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.access_token') if [[ -z "$ADMIN_TOKEN" || "$ADMIN_TOKEN" == "null" ]]; then echo "❌ Failed to get admin token from $KC_HOST" >&2; exit 1 @@ -116,12 +132,12 @@ while IFS= read -r client_json; do done < <(echo "$CLIENTS" | jq -c '.[]') if [[ ${#SECRET_ARGS[@]} -eq 0 ]]; then - echo "❌ No client secrets fetched from MOSIPID1 Keycloak" >&2; exit 1 + echo "❌ No client secrets fetched from MOSIPID Keycloak" >&2; exit 1 fi -echo "Creating keycloak-client-secrets-mosipid1 in $ESIGNET_NS (${#SECRET_ARGS[@]} clients)" -kubectl -n "$ESIGNET_NS" create secret generic keycloak-client-secrets-mosipid1 \ +echo "Creating keycloak-client-secrets-mosipid in $ESIGNET_NS (${#SECRET_ARGS[@]} clients)" +kubectl -n "$ESIGNET_NS" create secret generic keycloak-client-secrets-mosipid \ "${SECRET_ARGS[@]}" \ --dry-run=client -o yaml | kubectl apply -f - -echo "✓ keycloak-client-secrets-mosipid1 created" +echo "✓ keycloak-client-secrets-mosipid created" -echo "eSignet MOSIPID1 pre-install completed." +echo "eSignet MOSIPID pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone/esignet-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone/esignet-mosipid2-preinstall.sh deleted file mode 100755 index 4580db97e..000000000 --- a/Helmsman/hooks/esignet-standalone/esignet-mosipid2-preinstall.sh +++ /dev/null @@ -1,127 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - eSignet MOSIPID2 Service Pre-install -# ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid2, runs base esignet preinstall (copies -# postgres + redis config/secrets), then creates esignet-captcha-mosipid2 secret -# in the captcha namespace from workflow env vars, copies it to esignet-mosipid2, -# and patches the captcha deployment with the MOSIPID2 secret key. -# ============================================================================= -set -euo pipefail - -export ESIGNET_NS="esignet-mosipid2" -CAPTCHA_NS="captcha" -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY must be set}" -CAPTCHA_SECRET_KEY="${ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY must be set}" -MOSIPID2_POSTGRES_PASS="${MOSIPID2_POSTGRES_PASSWORD:?ERROR: MOSIPID2_POSTGRES_PASSWORD must be set}" -MOSIPID2_KC_ADMIN_PASS="${MOSIPID2_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID2_KEYCLOAK_ADMIN_PASSWORD must be set}" - -"$WORKDIR/hooks/esignet-standalone/esignet-preinstall.sh" - -# Create MOSIPID2-specific esignet-global — same domain_name, but esignet/signup hosts differ -kubectl -n "$ESIGNET_NS" create configmap esignet-global \ - --from-literal=installation-domain="${domain_name}" \ - --from-literal=mosip-api-host="api.${domain_name}" \ - --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet-mosipid2.${domain_name}" \ - --from-literal=mosip-iam-external-host="iam.${domain_name}" \ - --from-literal=mosip-kafka-host="kafka.${domain_name}" \ - --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup-mosipid2.${domain_name}" \ - --from-literal=mosip-smtp-host="smtp.${domain_name}" \ - --from-literal=mosip-version="develop" \ - --dry-run=client -o yaml | kubectl apply -f - - -# Override postgres-config with MOSIPID2-specific DB values -kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_mosipid2","database-username":"esignetuser_mosipid2"}}' - -# Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. -if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then - kubectl -n "$ESIGNET_NS" create secret generic esignet-misp-onboarder-key \ - --from-literal=mosip-esignet-misp-key="" - echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" -fi - -echo "Creating esignet-captcha-mosipid2 secret in $CAPTCHA_NS namespace" -kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-mosipid2 \ - --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ - --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ - --dry-run=client -o yaml | kubectl apply -f - - -echo "Copying esignet-captcha-mosipid2 secret from $CAPTCHA_NS to $ESIGNET_NS" -$COPY_UTIL secret esignet-captcha-mosipid2 "$CAPTCHA_NS" "$ESIGNET_NS" - -echo "Patching captcha deployment with ESIGNETMOSIPID2 secret key" -ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ - -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID2')].name}" 2>/dev/null || echo "") -if [[ -z "$ENV_VAR_EXISTS" ]]; then - kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID2", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-mosipid2", "key": "esignet-captcha-secret-key"}}}}]' -else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID2 already exists." -fi - -# --- postgres-postgresql-mosipid2 secret (MOSIPID2 remote postgres password) --- -echo "Creating postgres-postgresql-mosipid2 secret in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create secret generic postgres-postgresql-mosipid2 \ - --from-literal=postgres-password="${MOSIPID2_POSTGRES_PASS}" \ - --dry-run=client -o yaml | kubectl apply -f - - -# --- keycloak-host-mosipid2 CM (external URL points to MOSIPID2 Keycloak) --- -echo "Creating keycloak-host-mosipid2 configmap in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create configmap keycloak-host-mosipid2 \ - --from-literal=keycloak-external-host="iam.${mosipid2_domain_name}" \ - --from-literal=keycloak-external-url="https://iam.${mosipid2_domain_name}" \ - --from-literal=keycloak-internal-host="keycloak.keycloak" \ - --from-literal=keycloak-internal-service-url="http://keycloak.keycloak/auth/" \ - --from-literal=keycloak-internal-url="http://keycloak.keycloak" \ - --dry-run=client -o yaml | kubectl apply -f - - -# --- keycloak-client-secrets-mosipid2: fetch all confidential clients from MOSIPID2 Keycloak --- -KC_HOST="iam.${mosipid2_domain_name}" -REALM="mosip" - -echo "Fetching admin token from $KC_HOST" -TOKEN_RESPONSE=$(curl -sf -X POST \ - "https://${KC_HOST}/auth/realms/master/protocol/openid-connect/token" \ - -H "Content-Type: application/x-www-form-urlencoded" \ - -d "grant_type=password&client_id=admin-cli&username=admin&password=${MOSIPID2_KC_ADMIN_PASS}") -ADMIN_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.access_token') -if [[ -z "$ADMIN_TOKEN" || "$ADMIN_TOKEN" == "null" ]]; then - echo "❌ Failed to get admin token from $KC_HOST" >&2; exit 1 -fi -echo "✓ Admin token obtained" - -echo "Fetching all clients from realm $REALM on $KC_HOST" -CLIENTS=$(curl -sf \ - "https://${KC_HOST}/auth/admin/realms/${REALM}/clients?max=500" \ - -H "Authorization: Bearer $ADMIN_TOKEN") - -SECRET_ARGS=() -while IFS= read -r client_json; do - client_id=$(echo "$client_json" | jq -r '.clientId') - uuid=$(echo "$client_json" | jq -r '.id') - auth_type=$(echo "$client_json" | jq -r '.clientAuthenticatorType') - is_public=$(echo "$client_json" | jq -r '.publicClient') - [[ "$auth_type" != "client-secret" || "$is_public" == "true" ]] && continue - secret_val=$(curl -sf \ - "https://${KC_HOST}/auth/admin/realms/${REALM}/clients/${uuid}/client-secret" \ - -H "Authorization: Bearer $ADMIN_TOKEN" | jq -r '.value // empty') - [[ -z "$secret_val" || "$secret_val" == "null" ]] && continue - key=$(echo "$client_id" | tr '-' '_')_secret - SECRET_ARGS+=("--from-literal=${key}=${secret_val}") - echo " ✓ $client_id" -done < <(echo "$CLIENTS" | jq -c '.[]') - -if [[ ${#SECRET_ARGS[@]} -eq 0 ]]; then - echo "❌ No client secrets fetched from MOSIPID2 Keycloak" >&2; exit 1 -fi -echo "Creating keycloak-client-secrets-mosipid2 in $ESIGNET_NS (${#SECRET_ARGS[@]} clients)" -kubectl -n "$ESIGNET_NS" create secret generic keycloak-client-secrets-mosipid2 \ - "${SECRET_ARGS[@]}" \ - --dry-run=client -o yaml | kubectl apply -f - -echo "✓ keycloak-client-secrets-mosipid2 created" - -echo "eSignet MOSIPID2 pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone/esignet-postinstall-keycloak-init.sh b/Helmsman/hooks/esignet-standalone/esignet-postinstall-keycloak-init.sh index 811b19841..42357fd22 100755 --- a/Helmsman/hooks/esignet-standalone/esignet-postinstall-keycloak-init.sh +++ b/Helmsman/hooks/esignet-standalone/esignet-postinstall-keycloak-init.sh @@ -10,7 +10,7 @@ KEYCLOAK_NS="keycloak" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" # All esignet-mock namespaces that need keycloak resources -ESIGNET_NAMESPACES=(esignet-mock esignet-mosipid1 esignet-mosipid2 esignet-sunbird) +ESIGNET_NAMESPACES=(esignet-mock esignet-mosipid esignet-sunbird) echo "================================================" echo "eSignet 1.7.1 - Keycloak Init Post-install" diff --git a/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid-preinstall.sh similarity index 69% rename from Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid1-preinstall.sh rename to Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid-preinstall.sh index 001e00f21..86300fb61 100755 --- a/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid-preinstall.sh @@ -1,10 +1,10 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party Service MOSIPID1 Pre-install +# eSignet 1.7.1 - Mock Relying Party Service MOSIPID Pre-install # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base mock-rp-service +# Wrapper: sets ESIGNET_NS=esignet-mosipid and delegates to base mock-rp-service # preinstall (creates private key secrets in the target namespace). # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-mosipid1" +export ESIGNET_NS="esignet-mosipid" exec "$WORKDIR/hooks/esignet-standalone/mock-relying-party-service-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid2-preinstall.sh deleted file mode 100755 index b8cbdf9fa..000000000 --- a/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid2-preinstall.sh +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - Mock Relying Party Service MOSIPID2 Pre-install -# ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base mock-rp-service -# preinstall (creates private key secrets in the target namespace). -# ============================================================================= -set -euo pipefail -export ESIGNET_NS="esignet-mosipid2" -exec "$WORKDIR/hooks/esignet-standalone/mock-relying-party-service-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid-preinstall.sh similarity index 66% rename from Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid1-preinstall.sh rename to Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid-preinstall.sh index dd3affbea..c00337b89 100755 --- a/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid-preinstall.sh @@ -1,16 +1,16 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party UI MOSIPID1 Pre-install +# eSignet 1.7.1 - Mock Relying Party UI MOSIPID Pre-install # ============================================================================= -# Ensures esignet-mosipid1 namespace exists and verifies mock-relying-party-service -# is available in the esignet-mosipid1 namespace before UI deployment. +# Ensures esignet-mosipid namespace exists and verifies mock-relying-party-service +# is available in the esignet-mosipid namespace before UI deployment. # ============================================================================= set -euo pipefail -ESIGNET_NS="esignet-mosipid1" +ESIGNET_NS="esignet-mosipid" echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID1 Pre-install" +echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - @@ -21,4 +21,4 @@ else echo "WARNING: Mock relying party service not found in $ESIGNET_NS. UI depends on the service being deployed." fi -echo "Mock relying party UI MOSIPID1 pre-install completed." +echo "Mock relying party UI MOSIPID pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid2-preinstall.sh deleted file mode 100755 index ec8551819..000000000 --- a/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid2-preinstall.sh +++ /dev/null @@ -1,24 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - Mock Relying Party UI MOSIPID2 Pre-install -# ============================================================================= -# Ensures esignet-mosipid2 namespace exists and verifies mock-relying-party-service -# is available in the esignet-mosipid2 namespace before UI deployment. -# ============================================================================= -set -euo pipefail - -ESIGNET_NS="esignet-mosipid2" - -echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID2 Pre-install" -echo "================================================" - -kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - - -if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service &>/dev/null; then - echo "Mock relying party service found in $ESIGNET_NS." -else - echo "WARNING: Mock relying party service not found in $ESIGNET_NS. UI depends on the service being deployed." -fi - -echo "Mock relying party UI MOSIPID2 pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid-preinstall.sh similarity index 66% rename from Helmsman/hooks/esignet-standalone/oidc-ui-mosipid1-preinstall.sh rename to Helmsman/hooks/esignet-standalone/oidc-ui-mosipid-preinstall.sh index 6a93a51ed..f7e4aac72 100755 --- a/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid-preinstall.sh @@ -1,9 +1,9 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - OIDC UI MOSIPID1 Pre-install +# eSignet 1.7.1 - OIDC UI MOSIPID Pre-install # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base oidc-ui preinstall. +# Wrapper: sets ESIGNET_NS=esignet-mosipid and delegates to base oidc-ui preinstall. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-mosipid1" +export ESIGNET_NS="esignet-mosipid" exec "$WORKDIR/hooks/esignet-standalone/oidc-ui-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid2-preinstall.sh deleted file mode 100755 index 6afd2350d..000000000 --- a/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid2-preinstall.sh +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - OIDC UI MOSIPID2 Pre-install -# ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base oidc-ui preinstall. -# ============================================================================= -set -euo pipefail -export ESIGNET_NS="esignet-mosipid2" -exec "$WORKDIR/hooks/esignet-standalone/oidc-ui-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone/pms-partner-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone/pms-partner-mosipid-preinstall.sh similarity index 62% rename from Helmsman/hooks/esignet-standalone/pms-partner-mosipid1-preinstall.sh rename to Helmsman/hooks/esignet-standalone/pms-partner-mosipid-preinstall.sh index c5faefc5c..ecea9f0b0 100755 --- a/Helmsman/hooks/esignet-standalone/pms-partner-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone/pms-partner-mosipid-preinstall.sh @@ -1,45 +1,45 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - PMS Partner MOSIPID1 Pre-install +# eSignet 1.7.1 - PMS Partner MOSIPID Pre-install # ============================================================================= -# Creates the Istio Gateway for pms-partner in esignet-mosipid1 namespace. +# Creates the Istio Gateway for pms-partner in esignet-mosipid namespace. # ============================================================================= set -euo pipefail -ESIGNET_NS="esignet-mosipid1" +ESIGNET_NS="esignet-mosipid" echo "================================================" -echo "eSignet 1.7.1 - PMS Partner MOSIPID1 Pre-install" +echo "eSignet 1.7.1 - PMS Partner MOSIPID Pre-install" echo "================================================" kubectl apply -f - <- - {{ "{{" }} 'id': 'mobile', 'svg': 'mobile_icon', 'prefixes': {{ "{{" }}'label': - 'IND', 'value': '+91', 'maxLength': '', 'regex': ''},{'label': - 'KHM', 'value': '+855', 'regex': ''{{ "}}" }}, 'postfix': '@phone', - 'maxLength': '', 'regex': '' }, { 'id': 'nrc', 'svg': - 'nrc_id_icon', 'prefixes': '', 'postfix': '@nrc', 'maxLength': - '', 'regex': '' }, { 'id': 'vid', 'svg': 'vid_icon', 'prefixes': - '', 'postfix': '', 'maxLength': '', 'regex': '' }, { 'id': - 'email', 'svg': 'email_icon', 'prefixes': '', 'postfix': - '@email', 'maxLength': '', 'regex': '' {{ "}}" }} - - name: LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT - value: DEBUG - - name: MOSIP_ESIGNET_CAPTCHA_REQUIRED - value: "" - - name: MOSIP_ESIGNET_CAPTCHA_URL - value: http://captcha.captcha - - name: "MOSIP_ESIGNET_MISP_KEY" - valueFrom: - secretKeyRef: - name: esignet-misp-onboarder-key - key: mosip-esignet-misp-key - From 976c44bcbb3ad717c6eea39a4e0bdd6c15092ade Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 17:14:05 +0530 Subject: [PATCH 30/61] Consolidate v1.7.1 mosipid1/mosipid2 database entries in external-dsf.yaml Merges mosip_esignet_mosipid1/mosip_esignet_mosipid2 into a single mosip_esignet_mosipid entry (mosipid1's config, matching the consolidation already applied to the DSF and hooks), removing the now-redundant mosipid2 database provisioning entry. Co-Authored-By: Claude Sonnet 5 Signed-off-by: bhumi46 --- .../dsf/esignet-standalone/external-dsf.yaml | 54 +++++++------------ 1 file changed, 19 insertions(+), 35 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone/external-dsf.yaml b/Helmsman/dsf/esignet-standalone/external-dsf.yaml index a956215a7..646442d9a 100644 --- a/Helmsman/dsf/esignet-standalone/external-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/external-dsf.yaml @@ -114,43 +114,27 @@ apps: databases.mosip_esignet.su.user: "postgres" databases.mosip_esignet.su.secret.name: "postgres-postgresql" databases.mosip_esignet.su.secret.key: "postgres-password" - databases.mosip_esignet_mosipid1.repoUrl: "https://github.com/mosip/esignet.git" - databases.mosip_esignet_mosipid1.defaultDb: "postgres" - databases.mosip_esignet_mosipid1.su.user: "postgres" - databases.mosip_esignet_mosipid1.su.secret.name: "postgres-postgresql" - databases.mosip_esignet_mosipid1.su.secret.key: "postgres-password" + databases.mosip_esignet_mosipid.repoUrl: "https://github.com/mosip/esignet.git" + databases.mosip_esignet_mosipid.defaultDb: "postgres" + databases.mosip_esignet_mosipid.su.user: "postgres" + databases.mosip_esignet_mosipid.su.secret.name: "postgres-postgresql" + databases.mosip_esignet_mosipid.su.secret.key: "postgres-password" # --------------------------------------------------------------------------- - # esignet-mosipid1 namespace (plugin 2 - mosip-identity) + # esignet-mosipid namespace (plugin 2 - mosip-identity) # --------------------------------------------------------------------------- - databases.mosip_esignet_mosipid1.enabled: "true" - databases.mosip_esignet_mosipid1.scriptsDir: "mosip_esignet" - databases.mosip_esignet_mosipid1.dbName: "mosip_esignet_mosipid1" - databases.mosip_esignet_mosipid1.dbUser: "esignetuser_mosipid1" - databases.mosip_esignet_mosipid1.branch: "develop" - databases.mosip_esignet_mosipid1.host: "postgres.${domain_name}" - databases.mosip_esignet_mosipid1.port: ${esignet_db_port} - databases.mosip_esignet_mosipid1.dml: 1 - databases.mosip_esignet_mosipid1.repoUrl: "https://github.com/mosip/esignet.git" - databases.mosip_esignet_mosipid1.defaultDb: "postgres" - databases.mosip_esignet_mosipid1.su.user: "postgres" - databases.mosip_esignet_mosipid1.su.secret.name: "postgres-postgresql" - databases.mosip_esignet_mosipid1.su.secret.key: "postgres-password" - # --------------------------------------------------------------------------- - # esignet-mosipid2 namespace (plugin 2 - mosip-identity) - # --------------------------------------------------------------------------- - databases.mosip_esignet_mosipid2.enabled: "true" - databases.mosip_esignet_mosipid2.scriptsDir: "mosip_esignet" - databases.mosip_esignet_mosipid2.dbName: "mosip_esignet_mosipid2" - databases.mosip_esignet_mosipid2.dbUser: "esignetuser_mosipid2" - databases.mosip_esignet_mosipid2.branch: "develop" - databases.mosip_esignet_mosipid2.host: "postgres.${domain_name}" - databases.mosip_esignet_mosipid2.port: ${esignet_db_port} - databases.mosip_esignet_mosipid2.dml: 1 - databases.mosip_esignet_mosipid2.repoUrl: "https://github.com/mosip/esignet.git" - databases.mosip_esignet_mosipid2.defaultDb: "postgres" - databases.mosip_esignet_mosipid2.su.user: "postgres" - databases.mosip_esignet_mosipid2.su.secret.name: "postgres-postgresql" - databases.mosip_esignet_mosipid2.su.secret.key: "postgres-password" + databases.mosip_esignet_mosipid.enabled: "true" + databases.mosip_esignet_mosipid.scriptsDir: "mosip_esignet" + databases.mosip_esignet_mosipid.dbName: "mosip_esignet_mosipid" + databases.mosip_esignet_mosipid.dbUser: "esignetuser_mosipid" + databases.mosip_esignet_mosipid.branch: "develop" + databases.mosip_esignet_mosipid.host: "postgres.${domain_name}" + databases.mosip_esignet_mosipid.port: ${esignet_db_port} + databases.mosip_esignet_mosipid.dml: 1 + databases.mosip_esignet_mosipid.repoUrl: "https://github.com/mosip/esignet.git" + databases.mosip_esignet_mosipid.defaultDb: "postgres" + databases.mosip_esignet_mosipid.su.user: "postgres" + databases.mosip_esignet_mosipid.su.secret.name: "postgres-postgresql" + databases.mosip_esignet_mosipid.su.secret.key: "postgres-password" # --------------------------------------------------------------------------- # esignet-sunbird namespace (plugin 3 - sunbird-rc) # --------------------------------------------------------------------------- From 6d96e24b05379809789b1e78b41ebf16ccad5db5 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 17:14:22 +0530 Subject: [PATCH 31/61] Simplify eSignet/testrig workflows now that both profiles use one mosipid instance With v1.7.1 esignet-standalone also consolidated to a single mosipid instance, mosipid1_domain_name/mosipid2_domain_name/enable_mosipid2 and the MOSIPID1_*/MOSIPID2_* secrets and vars are no longer needed by either profile. Replaces them with the single mosipid_domain_name input and MOSIPID_* secrets/vars added for the Go profile, now shared by both esignet-standalone and esignet-standalone-2.0.0. Also collapses the per-profile SOFTHSM_PAIRS case statement to one shared list, since both profiles now use identical softhsm release/namespace names. Co-Authored-By: Claude Sonnet 5 Signed-off-by: bhumi46 --- .github/workflows/helmsman_esignet.yml | 157 +++--------------------- .github/workflows/helmsman_testrigs.yml | 61 ++------- 2 files changed, 29 insertions(+), 189 deletions(-) diff --git a/.github/workflows/helmsman_esignet.yml b/.github/workflows/helmsman_esignet.yml index 77f56a242..046af52db 100644 --- a/.github/workflows/helmsman_esignet.yml +++ b/.github/workflows/helmsman_esignet.yml @@ -39,21 +39,8 @@ on: description: "PostgreSQL port for eSignet databases (e.g. 5433 for MOSIP platform external postgres)" required: true type: string - mosipid1_domain_name: - description: "MOSIP-ID1 domain name for this environment (e.g. mosipenv1.xyz.net)" - required: false - type: string - enable_mosipid2: - description: "Enable MOSIP-ID2 eSignet instance (deploys softhsm, esignet, oidc-ui, mock-rp for mosipid2)" - required: false - default: false - type: boolean - mosipid2_domain_name: - description: "MOSIP-ID2 domain name for this environment (e.g. qabase.xyz.net)" - required: false - type: string mosipid_domain_name: - description: "MOSIP-ID domain name for esignet-standalone-2.0.0 (Go) profile only (e.g. qabase.xyz.net)" + description: "MOSIP-ID domain name for this environment (e.g. mosipenv.xyz.net) — required for esignet standalone profiles" required: false type: string env_name: @@ -75,8 +62,6 @@ jobs: name: ${{ github.ref_name }} steps: - name: Validate required variables - env: - IN_ENABLE_MOSIPID2: ${{ github.event.inputs.enable_mosipid2 }} run: | errors=() PROFILE="${{ github.event.inputs.profile }}" @@ -95,46 +80,22 @@ jobs: echo "✓ domain_name = $DOMAIN" echo "✓ env_name = $ENV" echo "✓ esignet_db_port = $ESIGNET_DB_PORT" - # mosipid1/mosipid2_domain_name are esignet-standalone (v1.7.1) only — that - # profile still runs two separate mosipid1/mosipid2 instances. - # mosipid_domain_name is esignet-standalone-2.0.0 (Go) only — that profile - # consolidates mosipid1+mosipid2 into a single mosipid instance. + # mosipid_domain_name is esignet standalone only (both esignet-standalone + # and esignet-standalone-2.0.0 each run a single consolidated mosipid instance). # Push events always target esignet (path filter); dispatch uses explicit profile input. - if [ -z "$PROFILE" ] || [ "$PROFILE" = "esignet-standalone" ]; then - MOSIPID1_DOMAIN="${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }}" - MOSIPID2_DOMAIN="${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }}" - if [ -z "$MOSIPID1_DOMAIN" ]; then - echo "❌ mosipid1_domain_name is required for esignet-standalone" - exit 1 - fi - if [ "$IN_ENABLE_MOSIPID2" = "true" ] && - [ -z "$MOSIPID2_DOMAIN" ]; then - echo "❌ mosipid2_domain_name is required when enable_mosipid2 is true" - exit 1 - fi - echo "✓ mosipid1_domain_name = $MOSIPID1_DOMAIN (esignet standalone)" - echo "✓ mosipid2_domain_name = $MOSIPID2_DOMAIN (esignet standalone)" - MOSIPID1_SPRING_LABEL="${{ vars.ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL }}" - MOSIPID2_SPRING_LABEL="${{ vars.ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL }}" - echo "✓ mosipid1_spring_config_label = ${MOSIPID1_SPRING_LABEL:-develop} (esignet standalone, default: develop)" - echo "✓ mosipid2_spring_config_label = ${MOSIPID2_SPRING_LABEL:-develop} (esignet standalone, default: develop)" - fi - if [ -z "$PROFILE" ] || [ "$PROFILE" = "esignet-standalone-2.0.0" ]; then + if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then MOSIPID_DOMAIN="${{ github.event.inputs.mosipid_domain_name || vars.MOSIPID_DOMAIN_NAME }}" if [ -z "$MOSIPID_DOMAIN" ]; then - echo "❌ mosipid_domain_name is required for esignet-standalone-2.0.0" + echo "❌ mosipid_domain_name is required for standalone profiles" exit 1 fi - echo "✓ mosipid_domain_name = $MOSIPID_DOMAIN (esignet standalone 2.0.0 / Go)" + echo "✓ mosipid_domain_name = $MOSIPID_DOMAIN (esignet standalone)" MOSIPID_SPRING_LABEL="${{ vars.ESIGNET_MOSIPID_SPRING_CONFIG_LABEL }}" - echo "✓ mosipid_spring_config_label = ${MOSIPID_SPRING_LABEL:-develop} (esignet standalone 2.0.0, default: develop)" - fi - if [ -n "$PROFILE" ] && [ "$PROFILE" != "esignet-standalone" ] && [ "$PROFILE" != "esignet-standalone-2.0.0" ]; then - MOSIPID1_PROVIDED="${{ github.event.inputs.mosipid1_domain_name }}" - MOSIPID2_PROVIDED="${{ github.event.inputs.mosipid2_domain_name }}" + echo "✓ mosipid_spring_config_label = ${MOSIPID_SPRING_LABEL:-develop} (esignet standalone, default: develop)" + else MOSIPID_PROVIDED="${{ github.event.inputs.mosipid_domain_name }}" - if [ -n "$MOSIPID1_PROVIDED" ] || [ -n "$MOSIPID2_PROVIDED" ] || [ -n "$MOSIPID_PROVIDED" ]; then - echo "⚠ mosipid1_domain_name / mosipid2_domain_name / mosipid_domain_name are only used for esignet standalone profiles — ignoring for profile=$PROFILE" + if [ -n "$MOSIPID_PROVIDED" ]; then + echo "⚠ mosipid_domain_name is only used for esignet standalone profiles — ignoring for profile=$PROFILE" fi fi @@ -149,11 +110,8 @@ jobs: KUBECTL_PATH: ${{ github.workspace }}/.local/bin/kubectl domain_name: ${{ github.event.inputs.domain_name || vars.DOMAIN_NAME }} esignet_db_port: ${{ github.event.inputs.esignet_db_port || vars.ESIGNET_DB_PORT }} - mosipid1_domain_name: ${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }} - mosipid2_domain_name: ${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }} mosipid_domain_name: ${{ github.event.inputs.mosipid_domain_name || vars.MOSIPID_DOMAIN_NAME }} env_name: ${{ github.event.inputs.env_name || vars.ENV_NAME }} - MOSIPID2_ENABLED: ${{ github.event.inputs.enable_mosipid2 == 'true' && 'true' || 'false' }} # All secrets below are ENVIRONMENT secrets (not repository secrets) # Configure them in: Repository → Settings → Environments → → Secrets # Mock Relying Party Service secrets (base64 encoded PEM) @@ -162,20 +120,10 @@ jobs: # eSignet Captcha secrets (plain text from Google reCAPTCHA) ESIGNET_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_CAPTCHA_SITE_KEY }} ESIGNET_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_CAPTCHA_SECRET_KEY }} - # Per-namespace captcha secrets — required for esignet standalone profile only - ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY }} - ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY }} - ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY }} - ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY }} - # mosipid captcha secret — required for esignet-standalone-2.0.0 (Go) profile only + # mosipid captcha secret — required for esignet standalone profiles ESIGNET_MOSIPID_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_MOSIPID_CAPTCHA_SITE_KEY }} ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY }} - # MOSIPID1 / MOSIPID2 remote Keycloak admin + Postgres passwords (esignet-standalone) - MOSIPID1_KEYCLOAK_ADMIN_PASSWORD: ${{ secrets.MOSIPID1_KEYCLOAK_ADMIN_PASSWORD }} - MOSIPID2_KEYCLOAK_ADMIN_PASSWORD: ${{ secrets.MOSIPID2_KEYCLOAK_ADMIN_PASSWORD }} - MOSIPID1_POSTGRES_PASSWORD: ${{ secrets.MOSIPID1_POSTGRES_PASSWORD }} - MOSIPID2_POSTGRES_PASSWORD: ${{ secrets.MOSIPID2_POSTGRES_PASSWORD }} - # MOSIPID remote Keycloak admin + Postgres password (esignet-standalone-2.0.0 / Go) + # MOSIPID remote Keycloak admin + Postgres password (esignet standalone profiles) MOSIPID_KEYCLOAK_ADMIN_PASSWORD: ${{ secrets.MOSIPID_KEYCLOAK_ADMIN_PASSWORD }} MOSIPID_POSTGRES_PASSWORD: ${{ secrets.MOSIPID_POSTGRES_PASSWORD }} ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY }} @@ -183,8 +131,6 @@ jobs: # Spring config label per namespace — controls which Git branch/tag the config-server uses # Set as Environment Variables in Repository → Settings → Environments → → Variables # If unset, hooks default to 'develop' - ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL: ${{ vars.ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL }} - ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL: ${{ vars.ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL }} ESIGNET_MOSIPID_SPRING_CONFIG_LABEL: ${{ vars.ESIGNET_MOSIPID_SPRING_CONFIG_LABEL }} # Cluster access secrets KUBECONFIG_SECRET: ${{ secrets.KUBECONFIG }} @@ -228,8 +174,6 @@ jobs: } save_var "DOMAIN_NAME" "${{ github.event.inputs.domain_name }}" save_var "ESIGNET_DB_PORT" "${{ github.event.inputs.esignet_db_port }}" - save_var "MOSIPID1_DOMAIN_NAME" "${{ github.event.inputs.mosipid1_domain_name }}" - save_var "MOSIPID2_DOMAIN_NAME" "${{ github.event.inputs.mosipid2_domain_name }}" save_var "MOSIPID_DOMAIN_NAME" "${{ github.event.inputs.mosipid_domain_name }}" save_var "ENV_NAME" "${{ github.event.inputs.env_name }}" @@ -242,10 +186,6 @@ jobs: echo "::add-mask::${{ secrets.CLUSTER_WIREGUARD_WG0 }}" echo "::add-mask::${{ secrets.ESIGNET_CAPTCHA_SITE_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_CAPTCHA_SECRET_KEY }}" - echo "::add-mask::${{ secrets.ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY }}" - echo "::add-mask::${{ secrets.ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY }}" - echo "::add-mask::${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY }}" - echo "::add-mask::${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_MOSIPID_CAPTCHA_SITE_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY }}" @@ -422,60 +362,23 @@ jobs: fi # Per-namespace captcha secrets — only required for esignet standalone profiles - if [ "$PROFILE" = "esignet-standalone" ]; then - echo "--- Validating esignet standalone mosipid1 captcha secrets ---" - for var in ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY \ - ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY; do - val="${!var:-}" - if [ -z "$val" ]; then - echo "❌ $var secret is not configured (required for esignet standalone)" - MISSING_SECRETS=1 - else - echo "✅ $var is configured" - fi - done - echo "--- Validating esignet standalone mosipid1 postgres + keycloak secrets ---" - for var in MOSIPID1_POSTGRES_PASSWORD MOSIPID1_KEYCLOAK_ADMIN_PASSWORD; do - val="${!var:-}" - if [ -z "$val" ]; then - echo "❌ $var secret is not configured (required for esignet standalone)" - MISSING_SECRETS=1 - else - echo "✅ $var is configured" - fi - done - if [ "$MOSIPID2_ENABLED" = "true" ]; then - echo "--- Validating mosipid2 captcha + postgres + keycloak secrets ---" - for var in ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY \ - MOSIPID2_POSTGRES_PASSWORD MOSIPID2_KEYCLOAK_ADMIN_PASSWORD; do - val="${!var:-}" - if [ -z "$val" ]; then - echo "❌ $var secret is not configured (required when enable_mosipid2=true)" - MISSING_SECRETS=1 - else - echo "✅ $var is configured" - fi - done - else - echo "ℹ mosipid2 disabled — skipping mosipid2 secret validation" - fi - elif [ "$PROFILE" = "esignet-standalone-2.0.0" ]; then - echo "--- Validating esignet standalone 2.0.0 (Go) mosipid captcha secrets ---" + if [[ "$PROFILE" == esignet-standalone* ]]; then + echo "--- Validating esignet standalone mosipid captcha secrets ---" for var in ESIGNET_MOSIPID_CAPTCHA_SITE_KEY ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY \ ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY; do val="${!var:-}" if [ -z "$val" ]; then - echo "❌ $var secret is not configured (required for esignet standalone 2.0.0)" + echo "❌ $var secret is not configured (required for esignet standalone)" MISSING_SECRETS=1 else echo "✅ $var is configured" fi done - echo "--- Validating esignet standalone 2.0.0 (Go) mosipid postgres + keycloak secrets ---" + echo "--- Validating esignet standalone mosipid postgres + keycloak secrets ---" for var in MOSIPID_POSTGRES_PASSWORD MOSIPID_KEYCLOAK_ADMIN_PASSWORD; do val="${!var:-}" if [ -z "$val" ]; then - echo "❌ $var secret is not configured (required for esignet standalone 2.0.0)" + echo "❌ $var secret is not configured (required for esignet standalone)" MISSING_SECRETS=1 else echo "✅ $var is configured" @@ -495,15 +398,7 @@ jobs: echo " - MOCK_RELYING_PARTY_JWE_PRIVATE_KEY (base64 encoded PEM)" echo " - ESIGNET_CAPTCHA_SITE_KEY (reCAPTCHA site key - plain text)" echo " - ESIGNET_CAPTCHA_SECRET_KEY (reCAPTCHA secret key - plain text)" - if [ "$PROFILE" = "esignet-standalone" ]; then - echo " - ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY / ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY" - echo " - ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY / ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY" - echo " - MOSIPID1_POSTGRES_PASSWORD / MOSIPID1_KEYCLOAK_ADMIN_PASSWORD" - if [ "$MOSIPID2_ENABLED" = "true" ]; then - echo " - ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY / ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY" - echo " - MOSIPID2_POSTGRES_PASSWORD / MOSIPID2_KEYCLOAK_ADMIN_PASSWORD" - fi - elif [ "$PROFILE" = "esignet-standalone-2.0.0" ]; then + if [[ "$PROFILE" == esignet-standalone* ]]; then echo " - ESIGNET_MOSIPID_CAPTCHA_SITE_KEY / ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY" echo " - ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY / ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY" echo " - MOSIPID_POSTGRES_PASSWORD / MOSIPID_KEYCLOAK_ADMIN_PASSWORD" @@ -608,8 +503,6 @@ jobs: - name: Show deployment variables run: | echo "domain_name = $domain_name" - echo "mosipid1_domain_name = $mosipid1_domain_name" - echo "mosipid2_domain_name = $mosipid2_domain_name" echo "mosipid_domain_name = $mosipid_domain_name" echo "env_name = $env_name" @@ -649,17 +542,7 @@ jobs: # Fix: skip softhsm upgrade on re-runs so the PIN in the secret never changes. SKIP_RELEASES_ARG="" if [[ "$PROFILE" == esignet-standalone* ]]; then - case "$PROFILE" in - esignet-standalone) - SOFTHSM_PAIRS=("esignet-softhsm:esignet-mock" "esignet-softhsm-mosipid1:esignet-mosipid1" "esignet-softhsm-mosipid2:esignet-mosipid2" "esignet-softhsm-sunbird:esignet-sunbird") - ;; - esignet-standalone-2.0.0) - SOFTHSM_PAIRS=("esignet-softhsm:esignet-mock" "esignet-softhsm-mosipid:esignet-mosipid" "esignet-softhsm-sunbird:esignet-sunbird") - ;; - *) - SOFTHSM_PAIRS=() - ;; - esac + SOFTHSM_PAIRS=("esignet-softhsm:esignet-mock" "esignet-softhsm-mosipid:esignet-mosipid" "esignet-softhsm-sunbird:esignet-sunbird") SKIP_RELEASES="" for pair in "${SOFTHSM_PAIRS[@]}"; do release="${pair%%:*}" @@ -700,7 +583,7 @@ jobs: echo "Commit: ${{ github.sha }}" echo "" echo "Namespaces created/updated:" - kubectl get ns esignet-mock esignet-mosipid1 esignet-mosipid2 esignet-mosipid esignet-sunbird softhsm keycloak redis postgres 2>/dev/null || echo "Some namespaces may not exist yet" + kubectl get ns esignet-mock esignet-mosipid esignet-sunbird softhsm keycloak redis postgres 2>/dev/null || echo "Some namespaces may not exist yet" echo "" echo "eSignet pods status:" kubectl get pods -n esignet-mock 2>/dev/null || echo "esignet-mock namespace not ready" diff --git a/.github/workflows/helmsman_testrigs.yml b/.github/workflows/helmsman_testrigs.yml index 93e5f52d1..cdd80f7f9 100644 --- a/.github/workflows/helmsman_testrigs.yml +++ b/.github/workflows/helmsman_testrigs.yml @@ -25,21 +25,8 @@ on: description: "Domain name for this environment (e.g. example.xyz.net)" required: true type: string - mosipid1_domain_name: - description: "MOSIP-ID1 domain name (e.g. mosipenv1.xyz.net) — required for esignet profile" - required: false - type: string - enable_mosipid2: - description: "Enable MOSIP-ID2 testrig (only needed if mosipid2 eSignet instance is enabled)" - required: false - default: false - type: boolean - mosipid2_domain_name: - description: "MOSIP-ID2 domain name (e.g. mosipenv2.xyz.net) — required only when enable_mosipid2 is set" - required: false - type: string mosipid_domain_name: - description: "MOSIP-ID domain name for esignet-standalone-2.0.0 (Go) profile only (e.g. mosipenv.xyz.net)" + description: "MOSIP-ID domain name (e.g. mosipenv.xyz.net) — required for esignet standalone profiles" required: false type: string db_port: @@ -78,11 +65,6 @@ jobs: steps: - name: Validate required variables env: - IN_MOSIPID1_DOMAIN: ${{ github.event.inputs.mosipid1_domain_name }} - IN_MOSIPID2_DOMAIN: ${{ github.event.inputs.mosipid2_domain_name }} - VAR_MOSIPID1_DOMAIN: ${{ vars.MOSIPID1_DOMAIN_NAME }} - VAR_MOSIPID2_DOMAIN: ${{ vars.MOSIPID2_DOMAIN_NAME }} - IN_ENABLE_MOSIPID2: ${{ github.event.inputs.enable_mosipid2 }} IN_MOSIPID_DOMAIN: ${{ github.event.inputs.mosipid_domain_name }} VAR_MOSIPID_DOMAIN: ${{ vars.MOSIPID_DOMAIN_NAME }} run: | @@ -109,40 +91,20 @@ jobs: echo "✓ slack_channel_name = $SLACK_CH" echo "✓ db_port = $DB_PORT" echo "✓ esignet_db_port = $ESIGNET_DB_PORT" - # mosipid1/mosipid2_domain_name are esignet-standalone (v1.7.1) only — that - # profile still runs two separate mosipid1/mosipid2 instances. - # mosipid_domain_name is esignet-standalone-2.0.0 (Go) only — that profile - # consolidates mosipid1+mosipid2 into a single mosipid instance. + # mosipid_domain_name is esignet standalone only (both esignet-standalone + # and esignet-standalone-2.0.0 each run a single consolidated mosipid instance). # Push events always target the esignet profile (path filter); dispatch uses explicit profile input. - if [ -z "$PROFILE" ] || [ "$PROFILE" = "esignet-standalone" ]; then - MOSIPID1_DOMAIN="${IN_MOSIPID1_DOMAIN:-$VAR_MOSIPID1_DOMAIN}" - MOSIPID2_DOMAIN="${IN_MOSIPID2_DOMAIN:-$VAR_MOSIPID2_DOMAIN}" - if [ -z "$MOSIPID1_DOMAIN" ]; then - echo "❌ mosipid1_domain_name is required for esignet-standalone" - exit 1 - fi - if [ "$IN_ENABLE_MOSIPID2" = "true" ] && - [ -z "$MOSIPID2_DOMAIN" ]; then - echo "❌ mosipid2_domain_name is required when enable_mosipid2 is true" - exit 1 - fi - echo "✓ mosipid1_domain_name = $MOSIPID1_DOMAIN (esignet standalone)" - echo "✓ mosipid2_domain_name = $MOSIPID2_DOMAIN (esignet standalone)" - fi - if [ -z "$PROFILE" ] || [ "$PROFILE" = "esignet-standalone-2.0.0" ]; then + if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then MOSIPID_DOMAIN="${IN_MOSIPID_DOMAIN:-$VAR_MOSIPID_DOMAIN}" if [ -z "$MOSIPID_DOMAIN" ]; then - echo "❌ mosipid_domain_name is required for esignet-standalone-2.0.0" + echo "❌ mosipid_domain_name is required for standalone profiles" exit 1 fi - echo "✓ mosipid_domain_name = $MOSIPID_DOMAIN (esignet standalone 2.0.0 / Go)" - fi - if [ -n "$PROFILE" ] && [ "$PROFILE" != "esignet-standalone" ] && [ "$PROFILE" != "esignet-standalone-2.0.0" ]; then - MOSIPID1_PROVIDED="$IN_MOSIPID1_DOMAIN" - MOSIPID2_PROVIDED="$IN_MOSIPID2_DOMAIN" + echo "✓ mosipid_domain_name = $MOSIPID_DOMAIN (esignet standalone)" + else MOSIPID_PROVIDED="$IN_MOSIPID_DOMAIN" - if [ -n "$MOSIPID1_PROVIDED" ] || [ -n "$MOSIPID2_PROVIDED" ] || [ -n "$MOSIPID_PROVIDED" ]; then - echo "⚠ mosipid1_domain_name / mosipid2_domain_name / mosipid_domain_name are only used for esignet standalone profiles — ignoring for profile=$PROFILE" + if [ -n "$MOSIPID_PROVIDED" ]; then + echo "⚠ mosipid_domain_name is only used for esignet standalone profiles — ignoring for profile=$PROFILE" fi fi @@ -156,10 +118,7 @@ jobs: PATH: ${{ github.workspace }}/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin KUBECTL_PATH: ${{ github.workspace }}/.local/bin/kubectl domain_name: ${{ github.event.inputs.domain_name || vars.DOMAIN_NAME }} - mosipid1_domain_name: ${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }} - mosipid2_domain_name: ${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }} mosipid_domain_name: ${{ github.event.inputs.mosipid_domain_name || vars.MOSIPID_DOMAIN_NAME }} - MOSIPID2_ENABLED: ${{ github.event.inputs.enable_mosipid2 == 'true' && 'true' || 'false' }} db_port: ${{ github.event.inputs.db_port || vars.DB_PORT }} esignet_db_port: ${{ github.event.inputs.esignet_db_port || vars.ESIGNET_DB_PORT }} env_name: ${{ github.event.inputs.env_name || vars.ENV_NAME }} @@ -202,8 +161,6 @@ jobs: fi } save_var "DOMAIN_NAME" "${{ github.event.inputs.domain_name }}" - save_var "MOSIPID1_DOMAIN_NAME" "${{ github.event.inputs.mosipid1_domain_name }}" - save_var "MOSIPID2_DOMAIN_NAME" "${{ github.event.inputs.mosipid2_domain_name }}" save_var "MOSIPID_DOMAIN_NAME" "${{ github.event.inputs.mosipid_domain_name }}" save_var "DB_PORT" "${{ github.event.inputs.db_port }}" save_var "ESIGNET_DB_PORT" "${{ github.event.inputs.esignet_db_port }}" From b3b773bf0972a3760b57fb2b6d8915a24684ec6d Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 17:34:29 +0530 Subject: [PATCH 32/61] Consolidate mosipid1/mosipid2 DNS subdomains in esignet-standalone terraform profile The subdomain_public list still enumerated separate mosipid1/mosipid2 (and go-mosipid1/go-mosipid2) subdomains from before both the -go removal and the mosipid1+mosipid2 consolidation were completed in the Helmsman DSF/hooks. Rewrites it to the single, deduplicated subdomain set that matches what both profiles actually configure today (esignet, healthservices, signup, esignet-sunbird, healthservices-sunbird, healthservices-mosipid, esignet-mosipid, pms-mosipid, signup-mosipid), verified against the DSF-configured hostnames in both profiles' esignet-dsf.yaml files. Co-Authored-By: Claude Sonnet 5 Signed-off-by: bhumi46 --- .../aws/infra/profiles/esignet-standalone/aws.tfvars | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars index 98b68ff23..644320705 100644 --- a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars +++ b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars @@ -77,11 +77,12 @@ enable_rancher_import = true rancher_import_url = "\"\"" # DNS Records to map — only eSignet-relevant subdomains -# Includes hosts for both the esignet-standalone profile and the isolated -# esignet-standalone-2.0.0 profile (suffixed "-go"), since both are deployed -# side-by-side against this same cluster/domain. +# Shared by both the esignet-standalone profile and the esignet-standalone-2.0.0 +# profile — both use identical hostnames (no "-go" suffix, single consolidated +# mosipid instance instead of separate mosipid1/mosipid2), since only one of +# the two profiles is ever live on a given cluster/domain at a time. -subdomain_public = ["esignet", "healthservices", "signup", "esignet-sunbird", "healthservices-sunbird", "healthservices-mosipid1", "esignet-mosipid1", "pms-mosipid1", "signup-mosipid1", "healthservices-mosipid2", "esignet-mosipid2", "pms-mosipid2", "signup-mosipid2", "esignet-go", "healthservices-go", "signup-go", "esignet-go-sunbird", "healthservices-go-sunbird", "healthservices-go-mosipid1", "esignet-go-mosipid1", "pms-go-mosipid1", "signup-go-mosipid1", "healthservices-go-mosipid2", "esignet-go-mosipid2", "pms-go-mosipid2", "signup-go-mosipid2"] +subdomain_public = ["esignet", "healthservices", "signup", "esignet-sunbird", "healthservices-sunbird", "healthservices-mosipid", "esignet-mosipid", "pms-mosipid", "signup-mosipid"] subdomain_internal = ["iam", "activemq", "kafka", "kibana", "postgres", "smtp", "pmp", "minio"] # PostgreSQL Configuration From e4853dfb69ac1ac1bf46ea13855d58bc8eb58bd5 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 17:34:52 +0530 Subject: [PATCH 33/61] Rewrite mosipid1/mosipid2 documentation to describe the consolidated mosipid instance MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Updates 7 docs/*.md files that still described the retired two-instance architecture (separate mosipid1/mosipid2 namespaces, the enable_mosipid2 toggle, split MOSIPID1_*/MOSIPID2_* secrets and variables). Several sections needed real restructuring rather than renaming — e.g. the deployment guide's "When do you need mosipid1?" / "When do you need mosipid2?" subsections collapse into one, since mosipid is now always deployed with no toggle, and its "up to 4 instances" framing becomes 3. Also corrects now-stale "-go" references intermixed in the same sentences/tables (separate -go-suffixed namespaces/hostnames, a two-column esignet-standalone vs esignet-standalone-2.0.0 URL table) left over from the earlier, separately-completed -go removal work — both profiles use identical namespaces/hostnames now, so most of these collapse to a single description instead of two parallel ones. Co-Authored-By: Claude Sonnet 5 Signed-off-by: bhumi46 --- docs/DSF_CONFIGURATION_GUIDE.md | 12 +- docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md | 201 ++++++-------------- docs/HELMSMAN_DESTROY_GUIDE.md | 4 +- docs/HELMSMAN_EXTERNAL_GUIDE.md | 2 +- docs/HELMSMAN_TESTRIGS_GUIDE.md | 34 ++-- docs/WORKFLOW_GUIDE.md | 30 ++- docs/esignet_README.md | 12 +- 7 files changed, 101 insertions(+), 194 deletions(-) diff --git a/docs/DSF_CONFIGURATION_GUIDE.md b/docs/DSF_CONFIGURATION_GUIDE.md index 5fc532b58..daa5d8ecd 100644 --- a/docs/DSF_CONFIGURATION_GUIDE.md +++ b/docs/DSF_CONFIGURATION_GUIDE.md @@ -539,9 +539,8 @@ apps: #### 1. Test Endpoints -All API endpoints in `testrigs-dsf.yaml` use `${domain_name}` substitution — no manual edits needed. For the eSignet profile, `${mosipid1_domain_name}` and `${mosipid2_domain_name}` are also used for the MOSIP-ID1 and MOSIP-ID2 testrig database hosts. Set these as GitHub Environment Variables: -- `vars.MOSIPID1_DOMAIN_NAME` (e.g. `mosipid1.example.net`) -- `vars.MOSIPID2_DOMAIN_NAME` (e.g. `mosipid2.example.net`) +All API endpoints in `testrigs-dsf.yaml` use `${domain_name}` substitution — no manual edits needed. For the eSignet profile, `${mosipid_domain_name}` is also used for the MOSIP-ID testrig database host. Set this as a GitHub Environment Variable: +- `vars.MOSIPID_DOMAIN_NAME` (e.g. `mosipid.example.net`) #### 2. Test Data Configuration @@ -692,7 +691,7 @@ apps: - [ ] GitHub Environment Variables set for your branch (`vars.DOMAIN_NAME`, `vars.ENV_NAME`, `vars.CLUSTER_ID`, `vars.SLACK_CHANNEL_NAME`) - [ ] Port variables set: `vars.DB_PORT` (MOSIP platform profiles), `vars.ESIGNET_DB_PORT` (eSignet profile) -- [ ] For eSignet profile: `vars.MOSIPID1_DOMAIN_NAME` and `vars.MOSIPID2_DOMAIN_NAME` also set +- [ ] For eSignet profile: `vars.MOSIPID_DOMAIN_NAME` also set - [ ] No manual `` or domain placeholder edits needed in DSF files ### Before Deploying prereq-dsf.yaml @@ -719,7 +718,7 @@ apps: - [ ] All MOSIP/eSignet services running - [ ] Test data branch matches MOSIP version -- [ ] `vars.MOSIPID1_DOMAIN_NAME` and `vars.MOSIPID2_DOMAIN_NAME` set (esignet-standalone profile) +- [ ] `vars.MOSIPID_DOMAIN_NAME` set (esignet-standalone profile) --- @@ -795,8 +794,7 @@ apps: | Slack channel | `vars.SLACK_CHANNEL_NAME` | GitHub Environment Variables | Alerting in prereq-dsf | | MOSIP postgres port | `vars.DB_PORT` | GitHub Environment Variables | MOSIP platform external postgres (5433) | | eSignet postgres port | `vars.ESIGNET_DB_PORT` | GitHub Environment Variables | eSignet container postgres (5432) | -| MOSIP-ID1 domain | `vars.MOSIPID1_DOMAIN_NAME` | GitHub Environment Variables | esignet-standalone profile — MOSIP-ID1 testrig hosts | -| MOSIP-ID2 domain | `vars.MOSIPID2_DOMAIN_NAME` | GitHub Environment Variables | esignet-standalone profile — MOSIP-ID2 testrig hosts | +| MOSIP-ID domain | `vars.MOSIPID_DOMAIN_NAME` | GitHub Environment Variables | esignet-standalone profile — MOSIP-ID testrig hosts | **DSF file manual edits (one-time per environment):** diff --git a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md index 8d8e29d8d..70afb2730 100644 --- a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md +++ b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md @@ -4,20 +4,20 @@ This guide walks you through deploying eSignet standalone on your Kubernetes clu You do **not** need to run any commands on your local machine — everything runs in the cloud via GitHub workflows. **What gets deployed:** -- Up to 4 eSignet instances (esignet, esignet-mosipid1, esignet-mosipid2, esignet-sunbird) — **mosipid1 is enabled by default; mosipid2 is optional** -- OIDC UI for each enabled instance +- 3 eSignet instances (esignet, esignet-mosipid, esignet-sunbird) — all enabled by default +- OIDC UI for each instance - Mock Relying Party service and UI - Supporting infrastructure: Postgres, Redis, Kafka, Keycloak, SoftHSM, Captcha, MinIO **Estimated time:** ~90–120 minutes end to end (Terraform ~30 min, external services ~20 min, eSignet ~25 min). -> **A second, isolated profile — `esignet-standalone-2.0.0`** — is also available in the `profile` dropdown of -> `helmsman_esignet.yml`, `helmsman_testrigs.yml`, and `helmsman_signup.yml`. It deploys its own namespaces, Helm -> releases, hostnames (e.g. `esignet-go-mock`, `esignet-go-mosipid1`), and databases, so it can run side by side -> with `esignet-standalone` in the same cluster without colliding. It shares the same external infrastructure -> (Postgres server, Keycloak, Redis, Kafka, Minio, Captcha instances) and Terraform profile — deploy/manage those via `helmsman_external.yml` and -> Terraform using the `esignet-standalone` profile as usual; there is no separate `esignet-standalone-2.0.0` entry -> for either of those. +> **A second, isolated profile — `esignet-standalone-2.0.0`** (the Go rewrite of eSignet) — is also available in +> the `profile` dropdown of `helmsman_esignet.yml`, `helmsman_testrigs.yml`, and `helmsman_signup.yml`. It deploys +> its own Helm releases and databases under **the same namespaces and hostnames** as `esignet-standalone` — the +> two profiles are not meant to run side by side on the same cluster/domain, only one at a time. It shares the +> same external infrastructure (Postgres server, Keycloak, Redis, Kafka, Minio, Captcha instances) and Terraform +> profile — deploy/manage those via `helmsman_external.yml` and Terraform using the `esignet-standalone` profile +> as usual; there is no separate `esignet-standalone-2.0.0` entry for either of those. --- @@ -37,50 +37,28 @@ You do **not** need to run any commands on your local machine — everything run - [Step 4 — Deploy Testrigs (optional)](#step-4--deploy-testrigs-optional) 5. [Re-deploying or Re-running](#4-re-deploying-or-re-running) 6. [Verifying Deployment](#5-verifying-deployment) -7. [MOSIP ID Plugin Onboarding (mosipid1 / mosipid2)](#6-mosip-id-plugin-onboarding-mosipid1--mosipid2) +7. [MOSIP ID Plugin Onboarding (mosipid)](#6-mosip-id-plugin-onboarding-mosipid) --- ## 0. Understanding the eSignet Instances -This deployment can run up to **4 separate eSignet instances** on the same cluster, each isolated in its own Kubernetes namespace. Think of each instance as a completely independent eSignet service — it has its own database, its own Keycloak clients, its own domain name, and its own identity plugin. +This deployment runs **3 separate eSignet instances** on the same cluster, each isolated in its own Kubernetes namespace. Think of each instance as a completely independent eSignet service — it has its own database, its own Keycloak clients, its own domain name, and its own identity plugin. | Instance | Namespace | What it connects to | Enabled by default | |---|---|---|---| | **eSignet (main)** | `esignet-mock` | Mock identity — for demos and testing without a live MOSIP system | Yes | -| **eSignet MOSIP-ID1** | `esignet-mosipid1` | A real MOSIP identity system at `MOSIPID1_DOMAIN_NAME` | **Yes** | -| **eSignet MOSIP-ID2** | `esignet-mosipid2` | A second real MOSIP identity system at `MOSIPID2_DOMAIN_NAME` | No | +| **eSignet MOSIP-ID** | `esignet-mosipid` | A real MOSIP identity system at `MOSIPID_DOMAIN_NAME` | Yes | | **eSignet Sunbird** | `esignet-sunbird` | A Sunbird RC credential registry | Yes | -> **Deploying `esignet-standalone-2.0.0` instead?** Same 4 instances, `-go`-suffixed namespaces: -> `esignet-go-mock`, `esignet-go-mosipid1`, `esignet-go-mosipid2`, `esignet-go-sunbird`. +> **Deploying `esignet-standalone-2.0.0` instead?** Identical 3 instances, same namespaces and hostnames — the +> two profiles are interchangeable, not additive; deploy one or the other, not both, on a given cluster/domain. -### When do you need mosipid1? +### When do you need mosipid? -Use `esignet-mosipid1` when you want eSignet to authenticate citizens against a **real MOSIP identity system**. You give it the domain of your MOSIP environment (e.g. `mosipenv.your-org.net`) via the `MOSIPID1_DOMAIN_NAME` variable, and the deployment automatically connects eSignet to that system's identity APIs, database, and Keycloak. +Use `esignet-mosipid` when you want eSignet to authenticate citizens against a **real MOSIP identity system**. You give it the domain of your MOSIP environment (e.g. `mosipenv.your-org.net`) via the `MOSIPID_DOMAIN_NAME` variable, and the deployment automatically connects eSignet to that system's identity APIs, database, and Keycloak. -**This is enabled by default** — if you have a MOSIP system to connect to, fill in the `MOSIPID1_DOMAIN_NAME` variable and the related secrets and it will be deployed as part of the normal workflow run. - -### When do you need mosipid2? - -`esignet-mosipid2` is **disabled by default**. Enable it only if you need to run **two eSignet instances that each connect to a different MOSIP environment** on the same cluster — for example, one pointing at a production MOSIP environment and another at a staging one. - -If you only have one MOSIP system to connect to, leave mosipid2 disabled. You do not need to configure any mosipid2 secrets or variables. - -**To enable mosipid2:** - -1. Add the `MOSIPID2_DOMAIN_NAME` environment variable in your GitHub Environment (Section 2B) -2. Add these secrets in your GitHub Environment (Section 2A): - - `ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY` and `ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY` - - `MOSIPID2_POSTGRES_PASSWORD` and `MOSIPID2_KEYCLOAK_ADMIN_PASSWORD` -3. When running the eSignet workflow (Step 2), toggle **`enable_mosipid2`** to `true` and fill in the `mosipid2_domain_name` field - -> No DSF file edits needed — `enable_mosipid2` is a workflow input toggle that controls deployment at runtime. - -> **`esignet-standalone-2.0.0` note:** `MOSIPID1_DOMAIN_NAME` and `MOSIPID2_DOMAIN_NAME` are the same variables -> used by both profiles — if you run `esignet-standalone` and `esignet-standalone-2.0.0` side by side, their -> mosipid1/mosipid2 instances point at the **same** remote MOSIP environment(s). There's no separate `_GO`-suffixed -> domain variable. +**This is enabled by default** — if you have a MOSIP system to connect to, fill in the `MOSIPID_DOMAIN_NAME` variable and the related secrets and it will be deployed as part of the normal workflow run. --- @@ -91,12 +69,11 @@ Complete this checklist before triggering any workflow: - [ ] Kubernetes cluster is up and running - [ ] `KUBECONFIG` file is available for your cluster - [ ] DNS records for all domain names are pointed to your cluster's load balancer -- [ ] Google reCAPTCHA v2 keys are generated — you need **at minimum 4 site/secret key pairs** (one per enabled instance): +- [ ] Google reCAPTCHA v2 keys are generated — you need **4 site/secret key pairs** (one per instance): - one for `esignet-mock` namespace - - one for `esignet-mosipid1` namespace + - one for `esignet-mosipid` namespace - one for `esignet-sunbird` namespace - one for `signup` namespace - - one for `esignet-mosipid2` namespace *(only if you are enabling mosipid2 — see [Section 0](#0-understanding-the-esignet-instances))* - See [reCAPTCHA Setup Guide](RECAPTCHA_SETUP_GUIDE.md) - [ ] Mock Relying Party PEM key pair is generated (client private key + JWE private key) - [ ] GitHub Environment named after your branch (e.g. `MOSIP-44613`) exists under: @@ -168,25 +145,19 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings |---|---| | `MOCK_RELYING_PARTY_CLIENT_PRIVATE_KEY` | Base64-encoded PEM — mock relying party client private key | | `MOCK_RELYING_PARTY_JWE_PRIVATE_KEY` | Base64-encoded PEM — JWE userinfo private key | -| `ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for `esignet-mosipid1` namespace | -| `ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-mosipid1` namespace | -| `ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for `esignet-mosipid2` namespace *(only needed if mosipid2 is enabled)* | -| `ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-mosipid2` namespace *(only needed if mosipid2 is enabled)* | +| `ESIGNET_MOSIPID_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for `esignet-mosipid` namespace | +| `ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-mosipid` namespace | | `ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for `esignet-sunbird` namespace | | `ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-sunbird` namespace | -| `MOSIPID1_POSTGRES_PASSWORD` | Postgres superuser password for the MOSIP-ID1 remote MOSIP environment | -| `MOSIPID2_POSTGRES_PASSWORD` | Postgres superuser password for the MOSIP-ID2 remote MOSIP environment *(only needed if mosipid2 is enabled)* | -| `MOSIPID1_KEYCLOAK_ADMIN_PASSWORD` | Keycloak admin password for the MOSIP-ID1 remote MOSIP environment | -| `MOSIPID2_KEYCLOAK_ADMIN_PASSWORD` | Keycloak admin password for the MOSIP-ID2 remote MOSIP environment *(only needed if mosipid2 is enabled)* | +| `MOSIPID_POSTGRES_PASSWORD` | Postgres superuser password for the remote MOSIP environment | +| `MOSIPID_KEYCLOAK_ADMIN_PASSWORD` | Keycloak admin password for the remote MOSIP environment | -> ⚠️ `MOSIPID1_KEYCLOAK_ADMIN_PASSWORD` and `MOSIPID2_KEYCLOAK_ADMIN_PASSWORD` are the admin passwords of the **remote** MOSIP-ID1 and MOSIP-ID2 Keycloak instances (not the local one deployed by this stack). The preinstall hook calls those Keycloak REST APIs to fetch client secrets. A wrong domain or wrong password here will cause the preinstall to fail with a curl error. +> ⚠️ `MOSIPID_KEYCLOAK_ADMIN_PASSWORD` is the admin password of the **remote** MOSIP-ID Keycloak instance (not the local one deployed by this stack). The preinstall hook calls that Keycloak's REST API to fetch client secrets. A wrong domain or wrong password here will cause the preinstall to fail with a curl error. > > **`esignet-standalone-2.0.0` note:** All of the secrets above are **reused as-is** by `esignet-standalone-2.0.0` -> — there are no separate `_GO`-suffixed GitHub secrets. Internally, the 2.0.0 hooks create differently-named -> Kubernetes secrets (e.g. `esignet-captcha-go`, `esignet-captcha-go-mosipid1`) and patch differently-named env -> vars onto the shared `captcha` deployment (e.g. `MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO`) so both -> profiles can coexist on the same captcha pod — but the underlying reCAPTCHA key **values** you configure here -> are shared between `esignet-standalone` and `esignet-standalone-2.0.0`. +> — both profiles create identically-named Kubernetes secrets (e.g. `esignet-captcha`, `esignet-captcha-mosipid`) +> and patch the same env var names onto the shared `captcha` deployment +> (e.g. `MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET`), since only one profile is ever deployed at a time. **For `helmsman_signup.yml` (set now even though signup is not yet active):** @@ -196,7 +167,7 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings | `MOSIP_SIGNUP_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for the `signup` namespace | > **`esignet-standalone-2.0.0` note:** Same secrets reused here too — signup for the 2.0.0 profile deploys into -> the `signup-go` namespace (vs `signup` for `esignet-standalone`) but shares these same GitHub secret values. +> the same `signup` namespace as `esignet-standalone` and shares these same GitHub secret values. --- @@ -213,10 +184,8 @@ Navigate to: `Repository → Settings → Environments → | `ENV_NAME` | `sandbox` | **Yes** | Short environment label shown on the landing page | | `CLUSTER_ID` | `c-xxxxx` | **Yes** | Rancher cluster ID used by monitoring setup — see [Finding your clusterid](../README.md#step-4a-configure-github-environment-variables) in the root README | | `SLACK_CHANNEL_NAME` | `#mosip-alerts` | **Yes** | Slack channel name for alert notifications | -| `MOSIPID1_DOMAIN_NAME` | `mosipid1.xyz.net` | Optional | Base domain of the MOSIP environment that `esignet-mosipid1` connects to (required if mosipid1 is enabled) | -| `MOSIPID2_DOMAIN_NAME` | `mosipid2.xyz.net` | Optional | Base domain of the second MOSIP environment — only set this if you have enabled mosipid2 (see [Section 0](#0-understanding-the-esignet-instances)) | -| `ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL` | `develop` | Optional | Git branch/tag for MOSIP-ID1 config-server (defaults to `develop`) | -| `ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL` | `develop` | Optional | Git branch/tag for MOSIP-ID2 config-server — only relevant if mosipid2 is enabled (defaults to `develop`) | +| `MOSIPID_DOMAIN_NAME` | `mosipid.xyz.net` | **Yes** | Base domain of the MOSIP environment that `esignet-mosipid` connects to | +| `ESIGNET_MOSIPID_SPRING_CONFIG_LABEL` | `develop` | Optional | Git branch/tag for MOSIP-ID config-server (defaults to `develop`) | | `ESIGNET_STANDALONE_MODE` | `true` | Optional | Set to `true` to skip the MOSIP DSF completion check | --- @@ -368,7 +337,7 @@ All pods should show `Running` or `Completed`. ### Step 2 — Deploy eSignet -> **What this does:** Deploys the eSignet application itself — 4 separate instances (main, MOSIP-ID1, MOSIP-ID2, Sunbird), the OIDC login UI for each, and the Mock Relying Party service for testing. +> **What this does:** Deploys the eSignet application itself — 3 separate instances (main, MOSIP-ID, Sunbird), the OIDC login UI for each, and the Mock Relying Party service for testing. > Only run this after Step 1 is fully complete. **GitHub Actions workflow name:** `Deploy eSignet using Helmsman` @@ -386,9 +355,7 @@ All pods should show `Running` or `Completed`. | `delete_existing_jobs` | tick only if re-running after a failure; leave unticked on first deploy | | `domain_name` | your base domain — e.g. `sandbox.xyz.net` | | `esignet_db_port` | `5432` | -| `mosipid1_domain_name` | MOSIP-ID1 base domain — e.g. `mosipid1.xyz.net` *(leave blank if not using MOSIP-ID1)* | -| `enable_mosipid2` | toggle `true` to deploy the MOSIP-ID2 eSignet instance; leave `false` to skip it | -| `mosipid2_domain_name` | MOSIP-ID2 base domain — e.g. `mosipid2.xyz.net` *(only required if `enable_mosipid2` is true)* | +| `mosipid_domain_name` | MOSIP-ID base domain — e.g. `mosipid.xyz.net` | | `env_name` | your environment name — e.g. `sandbox` | > **Important:** Always tick `skip_mosip_dsf_check` for standalone eSignet — without it, the workflow waits for a `mosip-dsf=completed` namespace label that will never appear (there is no full MOSIP deployment in this mode), and the workflow will fail. @@ -398,29 +365,16 @@ All pods should show `Running` or `Completed`. ![Deploy eSignet - Helmsman](_images/esignet.png) > **`esignet-standalone-2.0.0` note:** Selecting `esignet-standalone-2.0.0` runs `Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml` -> instead — it deploys the same 4 instances (main/mock, mosipid1, mosipid2, sunbird) plus their OIDC UIs and mock -> relying party service, but into `-go`-suffixed namespaces (`esignet-go-mock`, `esignet-go-mosipid1`, -> `esignet-go-mosipid2`, `esignet-go-sunbird`) with `-go`-suffixed hostnames (e.g. `esignet-go.sandbox.xyz.net`). -> All other fields (`domain_name`, `mosipid1_domain_name`, `enable_mosipid2`, etc.) work the same way as for -> `esignet-standalone`. You can run both profiles side by side in the same cluster — Step 1 only needs to be run -> once, with `profile: esignet-standalone`. +> instead — it deploys the same 3 instances (main/mock, mosipid, sunbird) plus their OIDC UIs and mock relying +> party service, into the **same namespaces and hostnames** as `esignet-standalone`. All other fields +> (`domain_name`, `mosipid_domain_name`, etc.) work the same way as for `esignet-standalone`. Deploy one profile +> or the other on a given cluster/domain, not both — Step 1 only needs to be run once either way, with +> `profile: esignet-standalone`. **How to know it succeeded:** -For `esignet-standalone`: - -```bash -kubectl get pods -n esignet-mock && kubectl get pods -n esignet-mosipid1 && kubectl get pods -n esignet-sunbird -# If enable_mosipid2 was set to true: -kubectl get pods -n esignet-mosipid2 -``` - -For `esignet-standalone-2.0.0`: - ```bash -kubectl get pods -n esignet-go-mock && kubectl get pods -n esignet-go-mosipid1 && kubectl get pods -n esignet-go-sunbird -# If enable_mosipid2 was set to true: -kubectl get pods -n esignet-go-mosipid2 +kubectl get pods -n esignet-mock && kubectl get pods -n esignet-mosipid && kubectl get pods -n esignet-sunbird ``` All pods should show `Running`. @@ -438,8 +392,8 @@ All pods should show `Running`. > This section will be updated with full instructions once signup deployment is ready. > > **`esignet-standalone-2.0.0` note:** `helmsman_signup.yml` already lists `esignet-standalone-2.0.0` in its -> `profile` dropdown (deploys into the `signup-go` namespace instead of `signup`), but it's equally not-yet-ready -> for either profile. +> `profile` dropdown (deploys into the same `signup` namespace as `esignet-standalone`), but it's equally +> not-yet-ready for either profile. --- @@ -460,8 +414,7 @@ All pods should show `Running`. | `profile` | `esignet-standalone` **or** `esignet-standalone-2.0.0` — matches whichever profile you deployed in Step 2 | | `mode` | `apply` | | `domain_name` | your base domain — e.g. `sandbox.xyz.net` | -| `mosipid1_domain_name` | MOSIP-ID1 base domain *(if MOSIP-ID1 was deployed in Step 2)* | -| `mosipid2_domain_name` | MOSIP-ID2 base domain *(if `enable_mosipid2` was `true` in Step 2)* | +| `mosipid_domain_name` | MOSIP-ID base domain — same value used in Step 2 | | `db_port` *(MOSIP platform external postgres)* | leave blank — not used by the `esignet-standalone` profile | | `esignet_db_port` *(esignet container postgres)* | `5432` | | `env_name` | your environment name | @@ -473,24 +426,10 @@ All pods should show `Running`. **How to know it succeeded:** The workflow log should show all Helmsman releases applied without errors. Verify that test cronjobs were created: -For `esignet-standalone`: - ```bash kubectl get cronjobs -n esignet-mock -kubectl get cronjobs -n esignet-mosipid1 +kubectl get cronjobs -n esignet-mosipid kubectl get cronjobs -n esignet-sunbird -# If enable_mosipid2 was set to true: -kubectl get cronjobs -n esignet-mosipid2 -``` - -For `esignet-standalone-2.0.0`: - -```bash -kubectl get cronjobs -n esignet-go-mock -kubectl get cronjobs -n esignet-go-mosipid1 -kubectl get cronjobs -n esignet-go-sunbird -# If enable_mosipid2 was set to true: -kubectl get cronjobs -n esignet-go-mosipid2 ``` --- @@ -512,8 +451,7 @@ Run these commands against your cluster to confirm everything is healthy: ```bash # Check all pods across eSignet namespaces kubectl get pods -n esignet-mock -kubectl get pods -n esignet-mosipid1 -kubectl get pods -n esignet-mosipid2 +kubectl get pods -n esignet-mosipid kubectl get pods -n esignet-sunbird # Check Istio virtual services (confirms domain routing) @@ -527,25 +465,24 @@ helm list -n keycloak kubectl get pods --all-namespaces | grep -v Running | grep -v Completed | grep -v Terminating ``` -> **Deployed `esignet-standalone-2.0.0`?** Swap in the `-go` namespaces: `esignet-go-mock`, `esignet-go-mosipid1`, -> `esignet-go-mosipid2`, `esignet-go-sunbird`. `keycloak` is shared, so `helm list -n keycloak` is unchanged. +> **Deployed `esignet-standalone-2.0.0`?** Same namespaces and commands as above — the two profiles share +> identical naming, so there's nothing to swap. -**Expected URLs after deployment** (replace `sandbox.xyz.net` with your domain): +**Expected URLs after deployment** (replace `sandbox.xyz.net` with your domain; identical for both profiles): -| Service | esignet-standalone URL | esignet-standalone-2.0.0 URL | -|---|---|---| -| eSignet OIDC UI | `https://esignet.sandbox.xyz.net` | `https://esignet-go.sandbox.xyz.net` | -| Mock Relying Party UI | `https://healthservices.sandbox.xyz.net` | `https://healthservices-go.sandbox.xyz.net` | -| Keycloak | `https://iam.sandbox.xyz.net` | *(shared — same URL)* | -| MOSIP-ID1 eSignet | `https://esignet-mosipid1.sandbox.xyz.net` | `https://esignet-go-mosipid1.sandbox.xyz.net` | -| MOSIP-ID2 eSignet | `https://esignet-mosipid2.sandbox.xyz.net` | `https://esignet-go-mosipid2.sandbox.xyz.net` | -| Sunbird eSignet | `https://esignet-sunbird.sandbox.xyz.net` | `https://esignet-go-sunbird.sandbox.xyz.net` | +| Service | URL | +|---|---| +| eSignet OIDC UI | `https://esignet.sandbox.xyz.net` | +| Mock Relying Party UI | `https://healthservices.sandbox.xyz.net` | +| Keycloak | `https://iam.sandbox.xyz.net` | +| MOSIP-ID eSignet | `https://esignet-mosipid.sandbox.xyz.net` | +| Sunbird eSignet | `https://esignet-sunbird.sandbox.xyz.net` | --- -## 6. MOSIP ID Plugin Onboarding (mosipid1 / mosipid2) +## 6. MOSIP ID Plugin Onboarding (mosipid) -> **This section applies only if you are deploying `esignet-mosipid1` or `esignet-mosipid2`** — instances that authenticate citizens against a real MOSIP platform. If you are using only the mock identity system (`esignet-mock`) or Sunbird, skip this section. +> **This section applies only if you are deploying `esignet-mosipid`** — the instance that authenticates citizens against a real MOSIP platform. If you are using only the mock identity system (`esignet-mock`) or Sunbird, skip this section. Onboarding eSignet to a MOSIP identity system involves two phases: **prerequisites** (config changes on the MOSIP platform side) and **manual onboarding** (Postman collection run against the deployed eSignet instance). @@ -553,7 +490,7 @@ Onboarding eSignet to a MOSIP identity system involves two phases: **prerequisit ### Prerequisites — Changes on the MOSIP platform's mosip-config branch -The following changes must be made on **each MOSIP platform's `mosip-config` repository branch** that the esignet-mosipid instance points to (the branch set via `ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL` / `ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL`). +The following changes must be made on the **MOSIP platform's `mosip-config` repository branch** that the esignet-mosipid instance points to (the branch set via `ESIGNET_MOSIPID_SPRING_CONFIG_LABEL`). #### 1. Add eSignet property files @@ -570,30 +507,16 @@ Reference commit: [mosip/mosip-config@e8961a2](https://github.com/mosip/mosip-co The MOSIP Identity Authentication service restricts which domains can call its APIs. Edit `id-authentication-default.properties` in the MOSIP platform's `mosip-config` branch and add your eSignet standalone hostnames to `mosip.ida.allowed.domain.uris`: -**For mosipid1 only:** - ```properties -mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1. -``` - -**For both mosipid1 and mosipid2:** - -```properties -mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1.,https://esignet-mosipid2. +mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid. ``` Replace `` with your eSignet standalone base domain (e.g. `sandbox.xyz.net`). -> **`esignet-standalone-2.0.0` note:** Since `MOSIPID1_DOMAIN_NAME`/`MOSIPID2_DOMAIN_NAME` are shared between both -> profiles (see [Section 0](#0-understanding-the-esignet-instances)), if you're running `esignet-mosipid1` (v1.7.1) -> and `esignet-go-mosipid1` (2.0.0) against the **same** remote MOSIP-ID1 environment (and similarly for -> MOSIP-ID2), add **both** hostnames for each shared environment to `mosip.ida.allowed.domain.uris`: -> -> ```properties -> mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1.,https://esignet-go-mosipid1.,https://esignet-mosipid2.,https://esignet-go-mosipid2. -> ``` -> -> Otherwise, only add the hostname for whichever profile(s) you actually deployed. +> **`esignet-standalone-2.0.0` note:** `MOSIPID_DOMAIN_NAME` is shared between both profiles (see +> [Section 0](#0-understanding-the-esignet-instances)), and both profiles use the identical +> `esignet-mosipid.` hostname — since only one profile is ever deployed at a time, no extra +> hostname needs to be added here regardless of which profile you're running. Reference commit: [mosip/mosip-config@27276cb](https://github.com/mosip/mosip-config/commit/27276cbb7fa01015492855baa3e00fe0a4db421c) @@ -611,4 +534,4 @@ Once the prerequisites above are complete, follow the manual onboarding steps us **[eSignet Postman Collection — MOSIP ID Plugin Onboarding](https://github.com/mosip/esignet/tree/master/postman-collection#esignet-collection)** -This collection covers partner onboarding, OIDC client registration, and end-to-end flow verification for the MOSIP ID plugin against your deployed `esignet-mosipid1` or `esignet-mosipid2` instance. +This collection covers partner onboarding, OIDC client registration, and end-to-end flow verification for the MOSIP ID plugin against your deployed `esignet-mosipid` instance. diff --git a/docs/HELMSMAN_DESTROY_GUIDE.md b/docs/HELMSMAN_DESTROY_GUIDE.md index 7360848d5..2cd0924cf 100644 --- a/docs/HELMSMAN_DESTROY_GUIDE.md +++ b/docs/HELMSMAN_DESTROY_GUIDE.md @@ -51,9 +51,9 @@ The destroy workflows follow a **reusable workflow pattern**: | Workflow | File | Purpose | Namespaces Affected | | ----------------------------------- | ------------------------------------------ | ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| **Destroy Testrigs** | `helmsman_testrigs_destroy.yml` | Removes test rig services | `apitestrig`, `dslrig`, `uitestrig` (MOSIP platform); `esignet`, `esignet-mosipid1`, `esignet-mosipid2`, `esignet-sunbird`, `signup` (esignet profile apitestrigs) | +| **Destroy Testrigs** | `helmsman_testrigs_destroy.yml` | Removes test rig services | `apitestrig`, `dslrig`, `uitestrig` (MOSIP platform); `esignet`, `esignet-mosipid`, `esignet-sunbird`, `signup` (esignet profile apitestrigs) | | **Destroy MOSIP Services** | `helmsman_mosip_destroy.yml` | Removes core MOSIP services | `admin`, `apitestrig`, `artifactory`, `config-server`, `dslrig`, `esignet`, `idrepo`, `kernel`, `masterdata`, `packet-manager`, `pmp`, `postgresdb`, `print`, `regproc`, `resident`, `uitestrig` | -| **Destroy eSignet Services** | (use `helmsman_esignet.yml` with `--destroy`) | Removes eSignet stack (esignet profile) | `esignet`, `esignet-mosipid1`, `esignet-mosipid2`, `esignet-sunbird`, `signup`, `kernel` | +| **Destroy eSignet Services** | (use `helmsman_esignet.yml` with `--destroy`) | Removes eSignet stack (esignet profile) | `esignet`, `esignet-mosipid`, `esignet-sunbird`, `signup`, `kernel` | | **Destroy External Services** | `helmsman_external_destroy_external.yml` | Removes external dependencies | `keycloak`, `kafka`, `minio`, `softhsm`, `clamav`, `activemq`, `captcha`, `redis`, `postgres`, `landing-page` | | **Destroy Prerequisites** | `helmsman_external_destroy_prereq.yml` | Removes monitoring and Istio | `cattle-logging-system`, `istio-system`, `monitoring` | diff --git a/docs/HELMSMAN_EXTERNAL_GUIDE.md b/docs/HELMSMAN_EXTERNAL_GUIDE.md index 0cd292106..5c90eef3b 100644 --- a/docs/HELMSMAN_EXTERNAL_GUIDE.md +++ b/docs/HELMSMAN_EXTERNAL_GUIDE.md @@ -23,7 +23,7 @@ Choose the profile that matches your deployment target: | Profile | Use when | |---------|----------| -| `esignet-standalone` | eSignet standalone — up to 4 parallel instances (esignet-mock, esignet-mosipid1, esignet-mosipid2, esignet-sunbird). mosipid2 is optional via `enable_mosipid2` toggle. No full MOSIP stack. | +| `esignet-standalone` | eSignet standalone — 3 parallel instances (esignet-mock, esignet-mosipid, esignet-sunbird). No full MOSIP stack. | | `mosip-platform-1.2.0.x` | Full MOSIP platform with Java 11 | | `mosip-platform-1.2.1.x` | Full MOSIP platform with Java 21 | diff --git a/docs/HELMSMAN_TESTRIGS_GUIDE.md b/docs/HELMSMAN_TESTRIGS_GUIDE.md index 1401d56ef..d171783ed 100644 --- a/docs/HELMSMAN_TESTRIGS_GUIDE.md +++ b/docs/HELMSMAN_TESTRIGS_GUIDE.md @@ -14,11 +14,11 @@ Deploy API, UI, and DSL test rigs after all services are running and partner onb | Profile | What deploys | Namespaces | |---------|-------------|------------| -| `esignet-standalone` | `esignet-apitestrig` into up to 4 namespaces; optional signup apitestrig + uitestrig | `esignet-mock`, `esignet-mosipid1`, `esignet-mosipid2` *(if enabled)*, `esignet-sunbird`, `signup` | +| `esignet-standalone` | `esignet-apitestrig` into 3 namespaces; optional signup apitestrig + uitestrig | `esignet-mock`, `esignet-mosipid`, `esignet-sunbird`, `signup` | | `mosip-platform-1.2.0.x` | API testrig, UI testrig, DSL testrig | MOSIP testrig namespaces | | `mosip-platform-1.2.1.x` | Same as above | MOSIP testrig namespaces | -> **eSignet standalone (`esignet-standalone` profile):** Requires `mosipid1_domain_name` for the MOSIP-ID1 apitestrig endpoint. `mosipid2_domain_name` is only required if mosipid2 was enabled during eSignet deployment (`enable_mosipid2: true`). +> **eSignet standalone (`esignet-standalone` profile):** Requires `mosipid_domain_name` for the MOSIP-ID apitestrig endpoint. --- @@ -74,10 +74,9 @@ No additional secrets required — MinIO root password is read automatically fro | Input | Description | Example | |-------|-------------|---------| -| `mosipid1_domain_name` | Domain for the MOSIP-ID1 eSignet instance | `mosipid1.mosip.net` | -| `mosipid2_domain_name` | Domain for the MOSIP-ID2 eSignet instance — only required if mosipid2 was enabled (`enable_mosipid2: true`) during eSignet deployment | `mosipid2.mosip.net` | +| `mosipid_domain_name` | Domain for the MOSIP-ID eSignet instance | `mosipid.mosip.net` | -> If not provided as inputs, values fall back to GitHub Environment Variables: `vars.MOSIPID1_DOMAIN_NAME` and `vars.MOSIPID2_DOMAIN_NAME`. +> If not provided as an input, the value falls back to the GitHub Environment Variable `vars.MOSIPID_DOMAIN_NAME`. --- @@ -92,16 +91,15 @@ No additional secrets required — MinIO root password is read automatically fro - **(4)** **Deployment profile to use** — pick the profile you want (e.g., `mosip-platform-1.2.0.x` or `esignet-standalone`). - **(5)** **Choose Helmsman mode: dry-run or apply** — always pick **`apply`**. - **(6)** **Domain name for this environment** — type the web domain this environment should use (e.g., `example.xyz.net`). -- **(7)** **MOSIP-ID1 domain name** *(eSignet profile only)* — type the base domain used by the MOSIP-ID1 eSignet instance (e.g., `mosipid1.xyz.net`). Leave blank for MOSIP platform profiles. -- **(8)** **QA base domain name** *(eSignet profile only)* — type the base domain used by the MOSIP-ID2 eSignet instance (e.g., `mosipid2.xyz.net`). Leave blank for MOSIP platform profiles. -- **(9)** **PostgreSQL port for MOSIP platform external postgres** — only fill this in if you picked a `mosip-platform-*` profile in step 4. Type `5433` (or whatever port your external PostgreSQL uses). -- **(10)** **PostgreSQL port for esignet standalone container postgres** — only fill this in if you picked the `esignet-standalone` profile in step 4. Type `5432`. -- **(11)** **Environment name** — a short nickname for this environment (e.g., `sandbox`, `dev`, `staging`). -- **(12)** **Slack channel name for alerting** (optional) — the Slack channel that should receive test result notifications (e.g., `#mosip-alerts`). Leave blank if you don't want Slack alerts. -- **(13)** **Slack webhook URL for alerting** (optional) — leave this blank; it's normally already saved as the `SLACK_WEBHOOK_URL` secret in your GitHub environment. -- **(14)** Click the green **Run workflow** button to start the deployment. +- **(7)** **MOSIP-ID domain name** *(eSignet profile only)* — type the base domain used by the MOSIP-ID eSignet instance (e.g., `mosipid.xyz.net`). Leave blank for MOSIP platform profiles. +- **(8)** **PostgreSQL port for MOSIP platform external postgres** — only fill this in if you picked a `mosip-platform-*` profile in step 4. Type `5433` (or whatever port your external PostgreSQL uses). +- **(9)** **PostgreSQL port for esignet standalone container postgres** — only fill this in if you picked the `esignet-standalone` profile in step 4. Type `5432`. +- **(10)** **Environment name** — a short nickname for this environment (e.g., `sandbox`, `dev`, `staging`). +- **(11)** **Slack channel name for alerting** (optional) — the Slack channel that should receive test result notifications (e.g., `#mosip-alerts`). Leave blank if you don't want Slack alerts. +- **(12)** **Slack webhook URL for alerting** (optional) — leave this blank; it's normally already saved as the `SLACK_WEBHOOK_URL` secret in your GitHub environment. +- **(13)** Click the green **Run workflow** button to start the deployment. -> **Note:** Steps 7–10 all appear in the form regardless of which profile you picked — fill in only the ones that match your profile (MOSIP-ID1/MOSIP-ID2 domains for `esignet-standalone`, PostgreSQL port for `mosip-platform-*`) and leave the rest blank. +> **Note:** Steps 7–9 all appear in the form regardless of which profile you picked — fill in only the ones that match your profile (MOSIP-ID domain for `esignet-standalone`, PostgreSQL port for `mosip-platform-*`) and leave the rest blank. > **Important:** Always pass `--keep-untracked-releases` — without it Helmsman will delete releases from previous DSFs (esignet, oidc-ui, etc.) that aren't listed in `testrigs-dsf.yaml`. The workflow handles this automatically. @@ -123,8 +121,7 @@ kubectl get cronjobs -n dslrig # For eSignet standalone kubectl get cronjobs -n esignet -kubectl get cronjobs -n esignet-mosipid1 -kubectl get cronjobs -n esignet-mosipid2 +kubectl get cronjobs -n esignet-mosipid kubectl get cronjobs -n esignet-sunbird ``` @@ -141,7 +138,7 @@ kubectl create job --from=cronjob/cronjob-dslorchestrator-full dslrig-manual-run **3. Trigger eSignet test jobs (eSignet standalone profile)** -The `trigger-test-jobs-esignet.sh` postInstall hook fires automatically after the last testrig deploys — it triggers all cronjobs across all 4 esignet namespaces sequentially and optionally signup/signup-uitestrig if deployed. +The `trigger-test-jobs-esignet.sh` postInstall hook fires automatically after the last testrig deploys — it triggers all cronjobs across all 3 esignet namespaces sequentially and optionally signup/signup-uitestrig if deployed. To trigger manually: @@ -163,8 +160,7 @@ kubectl get pods -n dslrig # Check testrig pods (eSignet standalone) kubectl get pods -n esignet # esignet-apitestrig cronjob -kubectl get pods -n esignet-mosipid1 -kubectl get pods -n esignet-mosipid2 +kubectl get pods -n esignet-mosipid kubectl get pods -n esignet-sunbird kubectl get pods -n signup # signup-apitestrig (if enabled) ``` diff --git a/docs/WORKFLOW_GUIDE.md b/docs/WORKFLOW_GUIDE.md index b86f68481..3a809b848 100644 --- a/docs/WORKFLOW_GUIDE.md +++ b/docs/WORKFLOW_GUIDE.md @@ -387,18 +387,16 @@ Mode: apply ✅ | **mode** | `apply` | MUST be apply! | | **domain_name** | `sandbox.example.net` | Or set `vars.DOMAIN_NAME` | | **esignet_db_port** | `5432` (esignet) / `5433` (MOSIP platform) | Or set `vars.ESIGNET_DB_PORT` | - | **mosipid1_domain_name** | `mosipid1.example.net` | esignet-standalone profile only — MOSIP-ID1 environment domain | - | **enable_mosipid2** | `false` (default) / `true` | Toggle to deploy MOSIP-ID2 instance; leave `false` to skip | - | **mosipid2_domain_name** | `mosipid2.example.net` | Required only if `enable_mosipid2` is `true` | + | **mosipid_domain_name** | `mosipid.example.net` | esignet-standalone profile only — MOSIP-ID environment domain | | **skip_mosip_dsf_check** | `true` for standalone, `false` when MOSIP is deployed | | | **delete_existing_jobs** | `true` when re-running after a failed attempt | Cleans up stale onboarder jobs | -3. **Monitor Progress** (25-35 minutes for esignet-standalone profile with up to 4 instances) +3. **Monitor Progress** (25-35 minutes for esignet-standalone profile with 3 instances) ``` - → SoftHSM (all 4 namespaces) + → SoftHSM (all 3 namespaces) → Config server - → eSignet core (all 4 namespaces in parallel) - → OIDC UI (all 4 namespaces) + → eSignet core (all 3 namespaces in parallel) + → OIDC UI (all 3 namespaces) → Mock identity system → Mock relying party ``` @@ -411,8 +409,7 @@ Mode: apply ✅ **Check Status:** ```bash kubectl get pods -n esignet -kubectl get pods -n esignet-mosipid1 # esignet profile only -kubectl get pods -n esignet-mosipid2 # esignet profile only +kubectl get pods -n esignet-mosipid # esignet profile only kubectl get pods -n esignet-sunbird # esignet profile only ``` @@ -445,14 +442,13 @@ kubectl get pods -n esignet-sunbird # esignet profile only | **profile** | Same as your deployment profile | | | **mode** | `apply` | | | **domain_name** | `sandbox.example.net` | Or `vars.DOMAIN_NAME` | - | **mosipid1_domain_name** | `mosipid1.example.net` | esignet-standalone profile only | - | **mosipid2_domain_name** | `mosipid2.example.net` | esignet-standalone only — required if mosipid2 was enabled | + | **mosipid_domain_name** | `mosipid.example.net` | esignet-standalone profile only | | **db_port** | `5433` | MOSIP platform only | | **esignet_db_port** | `5432` | eSignet profile | 4. **Monitor Progress** (10-20 minutes) ``` - → esignet-apitestrig (esignet profile: 4 instances across all namespaces) + → esignet-apitestrig (esignet profile: 3 instances across all namespaces) → signup-apitestrig (if signup was deployed) → API / DSL / UI test rigs (MOSIP platform profiles) ``` @@ -460,8 +456,7 @@ kubectl get pods -n esignet-sunbird # esignet profile only 5. **Verify CronJobs Created** ```bash kubectl get cronjobs -n esignet - kubectl get cronjobs -n esignet-mosipid1 # esignet profile - kubectl get cronjobs -n esignet-mosipid2 # esignet profile + kubectl get cronjobs -n esignet-mosipid # esignet profile kubectl get cronjobs -n esignet-sunbird # esignet profile ``` @@ -612,8 +607,7 @@ These inputs override the corresponding GitHub Environment Variables for a singl | `clusterid` | `vars.CLUSTER_ID` | Rancher cluster ID | | `db_port` | `vars.DB_PORT` | MOSIP platform postgres port | | `esignet_db_port` | `vars.ESIGNET_DB_PORT` | eSignet postgres port | -| `mosipid1_domain_name` | `vars.MOSIPID1_DOMAIN_NAME` | MOSIP-ID1 environment base domain (esignet profile) | -| `mosipid2_domain_name` | `vars.MOSIPID2_DOMAIN_NAME` | MOSIP-ID2 environment base domain (esignet profile) | +| `mosipid_domain_name` | `vars.MOSIPID_DOMAIN_NAME` | MOSIP-ID environment base domain (esignet profile) | --- @@ -772,10 +766,10 @@ DEPLOYMENT FLOW: └── PostgreSQL, Redis, Kafka, SoftHSM, Keycloak, Captcha, MinIO 4. Helmsman: eSignet [helmsman_esignet.yml, profile=esignet-standalone] - └── 3 instances always (esignet-mock / esignet-mosipid1 / esignet-sunbird) + esignet-mosipid2 if enable_mosipid2=true + └── 3 instances always (esignet-mock / esignet-mosipid / esignet-sunbird) 5. Helmsman: Test Rigs [helmsman_testrigs.yml, profile=esignet-standalone, manual] - └── API testrigs for all 4 esignet namespaces + └── API testrigs for all 3 esignet namespaces └── ✅ Deployment Complete! ``` diff --git a/docs/esignet_README.md b/docs/esignet_README.md index 73ad5b3ba..b38de8828 100644 --- a/docs/esignet_README.md +++ b/docs/esignet_README.md @@ -233,11 +233,9 @@ Custom Helm values are stored in: - **(7)** **Delete existing onboarder jobs before deploy** (checkbox) — only tick this when re-running after a failure. Leave unticked on a first-time deploy. - **(8)** **Domain name for this environment** — type the web domain this environment should use (e.g., `example.xyz.net`). - **(9)** **PostgreSQL port for esignet databases** — type `5432` for eSignet standalone, or `5433` if this is part of a MOSIP platform profile. -- **(10)** **MOSIP-ID1 domain name** *(eSignet standalone only)* — base domain for the MOSIP-ID1 eSignet instance (e.g., `mosipid1.xyz.net`). Leave blank if you're not deploying MOSIP-ID1. -- **(11)** **Enable MOSIP-ID2 eSignet instance** *(eSignet standalone only)* — toggle to `true` to deploy the MOSIP-ID2 instance (softhsm, esignet, oidc-ui, mock-rp). Leave `false` to skip it entirely. -- **(12)** **MOSIP-ID2 domain name** *(eSignet standalone only, required if enable_mosipid2 is true)* — base domain for the MOSIP-ID2 eSignet instance (e.g., `mosipid2.xyz.net`). -- **(13)** **Environment name** — a short nickname for this environment (e.g., `sandbox`, `dev`, `staging`). -- **(14)** Click the green **Run workflow** button to start the deployment. +- **(10)** **MOSIP-ID domain name** *(eSignet standalone only)* — base domain for the MOSIP-ID eSignet instance (e.g., `mosipid.xyz.net`). Leave blank if you're not deploying MOSIP-ID. +- **(11)** **Environment name** — a short nickname for this environment (e.g., `sandbox`, `dev`, `staging`). +- **(12)** Click the green **Run workflow** button to start the deployment. --- @@ -258,9 +256,7 @@ Custom Helm values are stored in: | `mode` | `dry-run` or `apply` | Yes | Always use `apply` — dry-run will fail | | `domain_name` | Your base domain | Yes | Or set `vars.DOMAIN_NAME` in GitHub Environment | | `esignet_db_port` | PostgreSQL port for esignet databases | Yes | `5433` for MOSIP platform external postgres, `5432` for eSignet standalone (or `vars.ESIGNET_DB_PORT`) | -| `mosipid1_domain_name` | Base domain for the MOSIP-ID1 eSignet instance | No | eSignet standalone only — leave blank otherwise (or `vars.MOSIPID1_DOMAIN_NAME`) | -| `enable_mosipid2` | Deploy MOSIP-ID2 eSignet instance | No | Toggle `true` to deploy softhsm, esignet, oidc-ui, mock-rp for mosipid2; default `false` | -| `mosipid2_domain_name` | Base domain for the MOSIP-ID2 eSignet instance | No | Required only if `enable_mosipid2` is `true` (or `vars.MOSIPID2_DOMAIN_NAME`) | +| `mosipid_domain_name` | Base domain for the MOSIP-ID eSignet instance | No | eSignet standalone only — leave blank otherwise (or `vars.MOSIPID_DOMAIN_NAME`) | | `env_name` | Environment name shown on the landing page | Yes | Or set `vars.ENV_NAME` in GitHub Environment | | `skip_mosip_dsf_check` | Skip MOSIP DSF completion check | No | Tick for eSignet standalone deploys; default `false` otherwise | | `delete_existing_jobs` | Delete stale onboarder jobs before deploy | No | Set `true` when re-running after a failure | From 6d1d5c824699bd16e05456c9fb3961771265bf1f Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Mon, 17 Aug 2026 17:54:46 +0530 Subject: [PATCH 34/61] Remove disabled config-server and pms apps from both eSignet standalone profiles MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit esignet-config-server, pms-partner-mosipid, and pms-policy-mosipid were already enabled: false in both esignet-standalone and esignet-standalone-2.0.0's esignet-dsf.yaml. Removes the app blocks entirely along with their dedicated hook scripts and values files, rather than leaving disabled dead weight in the DSFs. Also removes the now-dangling partnermanager=pms-mosipid.*/ policymanager=pms-mosipid.* entries from testrigs-dsf.yaml's mosip_components_base_urls (in both profiles), which would otherwise point the apitestrig at a service that no longer exists. Left untouched: the shared external-dsf.yaml's mosip_pms_client_secret Keycloak client-secret provisioning and the PMS_CLIENT_SECRET_KEY/VALUE fetch step in helmsman_esignet.yml — harmless if unused, and removing them would mean re-indexing a 5-entry array shared across profiles, a separate change from this app removal. Co-Authored-By: Claude Sonnet 5 Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 45 ------ .../testrigs-dsf.yaml | 2 +- .../dsf/esignet-standalone/esignet-dsf.yaml | 45 ------ .../dsf/esignet-standalone/testrigs-dsf.yaml | 2 +- .../config-server-esignet-postinstall.sh | 33 ----- .../config-server-esignet-setup.sh | 78 ---------- .../pms-partner-mosipid-preinstall.sh | 45 ------ .../config-server-esignet-postinstall.sh | 33 ----- .../config-server-esignet-setup.sh | 78 ---------- .../pms-partner-mosipid-preinstall.sh | 45 ------ .../utils/config-server-esignet-values.yaml | 139 ------------------ .../config-server-esignet-values-2-0-0.yaml | 139 ------------------ 12 files changed, 2 insertions(+), 682 deletions(-) delete mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh delete mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh delete mode 100755 Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid-preinstall.sh delete mode 100755 Helmsman/hooks/esignet-standalone/config-server-esignet-postinstall.sh delete mode 100755 Helmsman/hooks/esignet-standalone/config-server-esignet-setup.sh delete mode 100755 Helmsman/hooks/esignet-standalone/pms-partner-mosipid-preinstall.sh delete mode 100644 Helmsman/utils/config-server-esignet-values.yaml delete mode 100644 Helmsman/utils/esignet-standalone-2.0.0/config-server-esignet-values-2-0-0.yaml diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index c11e97a7e..647a9eaef 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -76,19 +76,6 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh" - esignet-config-server: - namespace: esignet-mock - enabled: false - version: 12.0.1 - chart: mosip/config-server - valuesFile: "$WORKDIR/utils/esignet-standalone-2.0.0/config-server-esignet-values-2-0-0.yaml" - wait: true - timeout: 1200 - priority: -15 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh" - postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh" - # --------------------------------------------------------------------------- # eSignet # --------------------------------------------------------------------------- @@ -675,38 +662,6 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh" - pms-partner-mosipid: - namespace: esignet-mosipid - enabled: false - version: 12.2.3 - chart: mosip/pms-partner - set: - # image.repository: "mosipid/partner-management-service" - # image.tag: "1.2.2.3" - istio.gateways[0]: "pms-partner-mosipid-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid.${domain_name}" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-share" - priority: -9 - timeout: 1200 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/pms-partner-mosipid-preinstall.sh" - - pms-policy-mosipid: - namespace: esignet-mosipid - enabled: false - version: 12.2.3 - chart: mosip/pms-policy - set: - # image.repository: "mosipid/policy-management-service" - # image.tag: "1.2.2.2" - istio.gateways[0]: "pms-partner-mosipid-gateway" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-share" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid.${domain_name}" - priority: -9 - timeout: 1200 - # --------------------------------------------------------------------------- # Partner Onboarders # --------------------------------------------------------------------------- diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml index 94ca20929..a23036792 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml @@ -110,7 +110,7 @@ apps: apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-mosipid.${domain_name}" apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid_domain_name};idrepository=api-internal.${mosipid_domain_name};authmanager=api-internal.${mosipid_domain_name};resident=api-internal.${mosipid_domain_name};partnermanager=pms-mosipid.${mosipid_domain_name};idauthentication=api-internal.${mosipid_domain_name};masterdata=api-internal.${mosipid_domain_name};idgenerator=api-internal.${mosipid_domain_name};policymanager=pms-mosipid.${mosipid_domain_name};preregistration=api-internal.${mosipid_domain_name};keymanager=api-internal.${mosipid_domain_name};" + apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid_domain_name};idrepository=api-internal.${mosipid_domain_name};authmanager=api-internal.${mosipid_domain_name};resident=api-internal.${mosipid_domain_name};idauthentication=api-internal.${mosipid_domain_name};masterdata=api-internal.${mosipid_domain_name};idgenerator=api-internal.${mosipid_domain_name};preregistration=api-internal.${mosipid_domain_name};keymanager=api-internal.${mosipid_domain_name};" secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" priority: -3 diff --git a/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml index 56d5a8fd4..8a5660497 100644 --- a/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml @@ -76,19 +76,6 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/softhsm-esignet-sunbird-setup.sh" - esignet-config-server: - namespace: esignet-mock - enabled: false - version: 12.0.1 - chart: mosip/config-server - valuesFile: "$WORKDIR/utils/config-server-esignet-values.yaml" - wait: true - timeout: 1200 - priority: -15 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/config-server-esignet-setup.sh" - postInstall: "$WORKDIR/hooks/esignet-standalone/config-server-esignet-postinstall.sh" - # --------------------------------------------------------------------------- # eSignet v1.7.1 # --------------------------------------------------------------------------- @@ -447,38 +434,6 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-ui-sunbird-preinstall.sh" - pms-partner-mosipid: - namespace: esignet-mosipid - enabled: false - version: 12.2.3 - chart: mosip/pms-partner - set: - # image.repository: "mosipid/partner-management-service" - # image.tag: "1.2.2.3" - istio.gateways[0]: "pms-partner-mosipid-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid.${domain_name}" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-share" - priority: -9 - timeout: 1200 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/pms-partner-mosipid-preinstall.sh" - - pms-policy-mosipid: - namespace: esignet-mosipid - enabled: false - version: 12.2.3 - chart: mosip/pms-policy - set: - # image.repository: "mosipid/policy-management-service" - # image.tag: "1.2.2.2" - istio.gateways[0]: "pms-partner-mosipid-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid.${domain_name}" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-share" - priority: -9 - timeout: 1200 - esignet-misp-onboarder: namespace: esignet-mock enabled: false diff --git a/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml b/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml index 2250af730..8acfb445c 100644 --- a/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml @@ -110,7 +110,7 @@ apps: apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-mosipid.${domain_name}" apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid_domain_name};idrepository=api-internal.${mosipid_domain_name};authmanager=api-internal.${mosipid_domain_name};resident=api-internal.${mosipid_domain_name};partnermanager=pms-mosipid.${mosipid_domain_name};idauthentication=api-internal.${mosipid_domain_name};masterdata=api-internal.${mosipid_domain_name};idgenerator=api-internal.${mosipid_domain_name};policymanager=pms-mosipid.${mosipid_domain_name};preregistration=api-internal.${mosipid_domain_name};keymanager=api-internal.${mosipid_domain_name};" + apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid_domain_name};idrepository=api-internal.${mosipid_domain_name};authmanager=api-internal.${mosipid_domain_name};resident=api-internal.${mosipid_domain_name};idauthentication=api-internal.${mosipid_domain_name};masterdata=api-internal.${mosipid_domain_name};idgenerator=api-internal.${mosipid_domain_name};preregistration=api-internal.${mosipid_domain_name};keymanager=api-internal.${mosipid_domain_name};" secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" priority: -4 diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh deleted file mode 100755 index 23d740745..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-postinstall.sh +++ /dev/null @@ -1,33 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 2.0.0 (Go) - Config-Server eSignet Post-install -# ============================================================================= -# Copies esignet-config-server-share CM from esignet-mock ns to mosipid/sunbird, -# then patches active_profile_env and spring_config_label_env per namespace -# so each instance points to the correct config server profile and Git label. -# -# Environment variables (set in GitHub Actions workflow): -# ESIGNET_MOSIPID_SPRING_CONFIG_LABEL - Git label for esignet-mosipid (default: develop) -# ============================================================================= -set -euo pipefail - -SOURCE_NS="esignet-mock" -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -CM_NAME="esignet-config-server-share" - -MOSIPID_SPRING_LABEL="${ESIGNET_MOSIPID_SPRING_CONFIG_LABEL:-develop}" - -echo "================================================" -echo "eSignet 2.0.0 (Go) - Config-Server eSignet Post-install" -echo "================================================" - -for TARGET_NS in esignet-mosipid esignet-sunbird; do - echo "Copying $CM_NAME from $SOURCE_NS to $TARGET_NS" - $COPY_UTIL configmap "$CM_NAME" "$SOURCE_NS" "$TARGET_NS" -done - -echo "Patching $CM_NAME in esignet-mosipid (active_profile_env=mosipid, spring_config_label_env=$MOSIPID_SPRING_LABEL)" -kubectl -n esignet-mosipid patch configmap "$CM_NAME" --type merge \ - -p "{\"data\":{\"active_profile_env\":\"mosipid\",\"spring_config_label_env\":\"$MOSIPID_SPRING_LABEL\"}}" - -echo "Config-server share configmap propagation and patching completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh deleted file mode 100755 index ee1798d92..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/config-server-esignet-setup.sh +++ /dev/null @@ -1,78 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - Config-Server eSignet Pre-install -# ============================================================================= -# Based on: esignet/deploy/config-server/install.sh -# -# Prepares esignet namespace for config-server deployment: -# 1. Ensures namespace exists with Istio injection enabled -# 2. Copies db-common-secrets from postgres ns -# 3. Creates esignet-global ConfigMap from workflow env vars -# (domain_name set by helmsman_esignet.yml; available as shell env var -# in all hooks run within the same workflow step) -# 4. Pre-creates empty esignet-misp-onboarder-key secret as placeholder -# (MISP onboarder at priority -6 writes the real key; config-server is -# restarted by esignet-misp-onboarder-postinstall.sh afterwards) -# -# NOTE: esignet-softhsm secret is NOT copied here — the softhsm helm chart -# installs directly into the esignet namespace, so no cross-namespace copy needed. -# -# NOTE: keycloak resources (keycloak-host, keycloak-env-vars, keycloak, -# keycloak-client-secrets) are NOT copied here. They are populated in all -# esignet namespaces by esignet-postinstall-keycloak-init.sh which runs as -# part of external-dsf (esignet-keycloak-init at priority -11 in keycloak ns). -# By the time esignet-dsf runs, these resources are already present. -# -# Environment Variables: -# ESIGNET_NS - eSignet namespace (default: esignet) -# domain_name - base domain (set by workflow, e.g. sandbox.example.net) -# ============================================================================= -set -euo pipefail - -ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" -POSTGRES_NS="postgres" -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" - -echo "================================================" -echo "eSignet 1.7.1 - Config-Server eSignet Pre-install" -echo "================================================" - -# --- Step 1: Ensure namespace with Istio --- -kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - -kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite - -# --- Step 2: Copy db-common-secrets --- -# NOTE: esignet-softhsm secret is NOT copied here — the softhsm helm chart -# creates it directly in the esignet namespace as a helm-managed resource. -echo "Copying db-common-secrets from $POSTGRES_NS" -$COPY_UTIL secret db-common-secrets "$POSTGRES_NS" "$ESIGNET_NS" - -# --- Step 3: Create esignet-global from workflow env vars --- -# domain_name is exported by the helmsman_esignet.yml workflow step -echo "Creating esignet-global configmap (domain_name=${domain_name:-UNSET})" -kubectl -n "$ESIGNET_NS" create configmap esignet-global \ - --from-literal=installation-domain="${domain_name}" \ - --from-literal=mosip-api-host="api.${domain_name}" \ - --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet.${domain_name}" \ - --from-literal=mosip-iam-external-host="iam.${domain_name}" \ - --from-literal=mosip-kafka-host="kafka.${domain_name}" \ - --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup.${domain_name}" \ - --from-literal=mosip-smtp-host="smtp.${domain_name}" \ - --from-literal=mosip-version="develop" \ - --dry-run=client -o yaml | kubectl apply -f - -echo "esignet-global created/updated." - -# --- Step 4: Pre-create empty MISP key secret as placeholder --- -# Allows config-server pod to start. Real value written by MISP onboarder (-6). -# esignet-misp-onboarder-postinstall.sh restarts config-server after writing. -if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then - kubectl -n "$ESIGNET_NS" create secret generic esignet-misp-onboarder-key \ - --from-literal=mosip-esignet-misp-key="" - echo "esignet-misp-onboarder-key placeholder created." -else - echo "esignet-misp-onboarder-key already exists, skipping placeholder." -fi - -echo "Config-server eSignet pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid-preinstall.sh deleted file mode 100755 index ecea9f0b0..000000000 --- a/Helmsman/hooks/esignet-standalone-2.0.0/pms-partner-mosipid-preinstall.sh +++ /dev/null @@ -1,45 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - PMS Partner MOSIPID Pre-install -# ============================================================================= -# Creates the Istio Gateway for pms-partner in esignet-mosipid namespace. -# ============================================================================= -set -euo pipefail - -ESIGNET_NS="esignet-mosipid" - -echo "================================================" -echo "eSignet 1.7.1 - PMS Partner MOSIPID Pre-install" -echo "================================================" - -kubectl apply -f - </dev/null; then - kubectl -n "$ESIGNET_NS" create secret generic esignet-misp-onboarder-key \ - --from-literal=mosip-esignet-misp-key="" - echo "esignet-misp-onboarder-key placeholder created." -else - echo "esignet-misp-onboarder-key already exists, skipping placeholder." -fi - -echo "Config-server eSignet pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone/pms-partner-mosipid-preinstall.sh b/Helmsman/hooks/esignet-standalone/pms-partner-mosipid-preinstall.sh deleted file mode 100755 index ecea9f0b0..000000000 --- a/Helmsman/hooks/esignet-standalone/pms-partner-mosipid-preinstall.sh +++ /dev/null @@ -1,45 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - PMS Partner MOSIPID Pre-install -# ============================================================================= -# Creates the Istio Gateway for pms-partner in esignet-mosipid namespace. -# ============================================================================= -set -euo pipefail - -ESIGNET_NS="esignet-mosipid" - -echo "================================================" -echo "eSignet 1.7.1 - PMS Partner MOSIPID Pre-install" -echo "================================================" - -kubectl apply -f - < Date: Tue, 18 Aug 2026 12:58:26 +0530 Subject: [PATCH 35/61] Switch esignet-mock to PKCS12 keystore with a persistent volume (esignet-standalone-2.0.0) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit esignet-mock now uses KEYMANAGER_KEYSTORE_TYPE=PKCS12 instead of SoftHSM/ PKCS11, with a PVC (persistence.enabled, chart-managed) mounted at the chart's default /home/mosip/config/ so the keystore file survives pod restarts. The app generates the PKCS12 keystore itself on first run when it doesn't already exist at KEYMANAGER_PKCS12_FILE_PATH — no init container or preinstall hook needed. Uses a fixed known password ("localtest"), matching the precedent this repo already established for the same throwaway/self-signed keystore use case (mosipid1's now-removed PKCS12 setup) — esignet-mock is a mock/ demo instance, not production key material. esignet-mosipid and esignet-sunbird are untouched and remain on PKCS11/ SoftHSM. Verified via `helm template` against the local esignet chart checkout (PVC created, env vars wired to the right mount) and `helmsman -dry-run -debug` against the DSF (19 apps, correct per-instance keystore values). Signed-off-by: bhumi46 --- .../dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 647a9eaef..4ef4d6f6d 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -132,12 +132,11 @@ apps: extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" extraEnvVars.AUTHN_PROVIDER: "mosip" extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" - extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" - extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/lib/softhsm/libsofthsm2.so" - extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "esignet" - extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" - extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm" - extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS12" + extraEnvVars.KEYMANAGER_PKCS12_FILE_PATH: "/home/mosip/config/esignet.pfx" + extraEnvVars.KEYMANAGER_PKCS12_PASSWORD: "localtest" + persistence.enabled: "true" + persistence.pvc_claim_name: "esignet-mock-pkcs12-keystore" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" From 5ab2a07b3f66e45f9751d55890e15b83fff3473b Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Tue, 18 Aug 2026 13:04:40 +0530 Subject: [PATCH 36/61] Move esignet-mock's PKCS12 keymanager overrides to extraEnvVarsAdditional extraEnvVars is merged with the chart's own default extraEnvVars map before rendering, so removing the previous explicit PKCS11 overrides just let the chart's PKCS11 defaults resurface for the same keys instead of disappearing. extraEnvVarsAdditional renders after extraEnvVars in the container's env: list, so with Kubernetes' last-wins behavior for duplicate env var names, setting KEYMANAGER_KEYSTORE_TYPE/KEYMANAGER_PKCS12_FILE_PATH/ KEYMANAGER_PKCS12_PASSWORD there correctly overrides the chart's PKCS11 defaults instead of merely coexisting with them. Verified via `helm template` against the local esignet chart checkout: both a PKCS11 (chart default, from extraEnvVars) and PKCS12 (from extraEnvVarsAdditional) KEYMANAGER_KEYSTORE_TYPE entry appear in the rendered container env list, in that order, with PKCS12 taking effect. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 4ef4d6f6d..e46e427be 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -132,9 +132,6 @@ apps: extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" extraEnvVars.AUTHN_PROVIDER: "mosip" extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" - extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS12" - extraEnvVars.KEYMANAGER_PKCS12_FILE_PATH: "/home/mosip/config/esignet.pfx" - extraEnvVars.KEYMANAGER_PKCS12_PASSWORD: "localtest" persistence.enabled: "true" persistence.pvc_claim_name: "esignet-mock-pkcs12-keystore" extraEnvVars.OIDC_UI_SCHEME: "https" @@ -147,6 +144,12 @@ apps: extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" + # Overrides via extraEnvVarsAdditional (rendered after extraEnvVars in the + # container's env: list, so last-wins semantics correctly override the + # chart's own PKCS11 extraEnvVars defaults for this same instance). + extraEnvVarsAdditional.KEYMANAGER_KEYSTORE_TYPE: "PKCS12" + extraEnvVarsAdditional.KEYMANAGER_PKCS12_FILE_PATH: "/home/mosip/config/esignet.pfx" + extraEnvVarsAdditional.KEYMANAGER_PKCS12_PASSWORD: "localtest" timeout: 600 priority: -14 hooks: From 7e93a74c174c9c5f13bb311805f56e2793b7af6c Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Tue, 18 Aug 2026 13:48:27 +0530 Subject: [PATCH 37/61] Move esignet-mosipid/esignet-sunbird keymanager config to extraEnvVarsAdditional Relocates KEYMANAGER_DB_SCHEMA/KEYMANAGER_KEYSTORE_TYPE/KEYMANAGER_PKCS11_* from extraEnvVars to extraEnvVarsAdditional for both instances, using the generic chart-default values (pkcs11-proxy module path/token label, shared esignet-softhsm secret name) as specified, replacing the previous per-instance values (real softhsm module path, "esignet" token label, esignet-softhsm-mosipid/esignet-softhsm-sunbird secrets). Verified via `helmsman -dry-run -debug`: 19 apps, both instances' resolved values match exactly. Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index e46e427be..027c8f293 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -214,13 +214,13 @@ apps: extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets-mosipid" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" extraEnvVars.AUTHN_PROVIDER: "mosip" - extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" - extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" - extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/lib/softhsm/libsofthsm2.so" - extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "esignet" - extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" - extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" - extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVarsAdditional.KEYMANAGER_DB_SCHEMA: "esignet" + extraEnvVarsAdditional.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_TOKEN_LABEL: "pkcs11-proxy" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_SLOT_ID: "0" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" @@ -305,13 +305,13 @@ apps: extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" extraEnvVars.AUTHN_PROVIDER: "mosip" - extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" - extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" - extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/lib/softhsm/libsofthsm2.so" - extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "esignet" - extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" - extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" - extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVarsAdditional.KEYMANAGER_DB_SCHEMA: "esignet" + extraEnvVarsAdditional.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_TOKEN_LABEL: "pkcs11-proxy" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_SLOT_ID: "0" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" From 191875a9cb53d7bafd650d35be5d8443e2944773 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Tue, 18 Aug 2026 13:57:26 +0530 Subject: [PATCH 38/61] Use per-instance SoftHSM secret for KEYMANAGER_PKCS11_PIN on mosipid/sunbird Keeps the generic pkcs11-proxy module path/token label, but the PIN secret must be the instance-specific one (esignet-softhsm-mosipid, esignet-softhsm-sunbird) since that's where each instance's actual SoftHSM PIN lives - a shared esignet-softhsm secret doesn't exist in those namespaces. Verified via helmsman -dry-run -debug: 19 apps, both instances resolve to their correct per-instance secret name. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 027c8f293..e89861ea2 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -219,7 +219,7 @@ apps: extraEnvVarsAdditional.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" extraEnvVarsAdditional.KEYMANAGER_PKCS11_TOKEN_LABEL: "pkcs11-proxy" extraEnvVarsAdditional.KEYMANAGER_PKCS11_SLOT_ID: "0" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" @@ -310,7 +310,7 @@ apps: extraEnvVarsAdditional.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" extraEnvVarsAdditional.KEYMANAGER_PKCS11_TOKEN_LABEL: "pkcs11-proxy" extraEnvVarsAdditional.KEYMANAGER_PKCS11_SLOT_ID: "0" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" From 2376fb2e9f34301978de637a00ed976ad0085f3e Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Tue, 18 Aug 2026 17:26:08 +0530 Subject: [PATCH 39/61] Remove preregistration captcha env var from the shared captcha chart MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit mosip/captcha's chart default extraEnvVars only contains MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_PREREGISTRATION, sourced from a mosip-captcha/prereg-captcha-secret-key secret that doesn't exist in this deployment (no preregistration module in the esignet-standalone profiles), causing a config error on the captcha pod. Sets extraEnvVars: "" to empty it out — the chart's extraEnvVars is a raw YAML block string (common.tplvalues.render'd, not a list or map like other charts in this repo), so an empty string is what skips the {{- if .Values.extraEnvVars }} block entirely. esignet/mosipid/sunbird/signup captcha secrets are unaffected — those are wired up separately via kubectl patch in the *-preinstall.sh / captcha-postinstall.sh hooks, not through this chart value. Verified via `helm template` against the actual mosip/captcha v0.1.1 chart (env var gone, everything else byte-identical) and `helmsman -dry-run -debug` against external-dsf.yaml. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone/external-dsf.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/Helmsman/dsf/esignet-standalone/external-dsf.yaml b/Helmsman/dsf/esignet-standalone/external-dsf.yaml index 646442d9a..a84a09971 100644 --- a/Helmsman/dsf/esignet-standalone/external-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/external-dsf.yaml @@ -497,6 +497,13 @@ apps: chart: mosip/captcha set: metrics.serviceMonitor.enabled: "false" + # Chart default extraEnvVars only contains MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_PREREGISTRATION, + # sourced from a mosip-captcha/prereg-captcha-secret-key secret that doesn't exist in this + # deployment (no preregistration module here) — empty it out so the chart doesn't try to + # wire up a nonexistent secret. esignet/mosipid/sunbird/signup captcha env vars are added + # separately via kubectl patch in the *-preinstall.sh / captcha-postinstall.sh hooks, not + # through this chart value. + extraEnvVars: "" wait: true timeout: 480 priority: -10 From 38aadb580a1cea7cbbfac6b5b1de9c12123fa9f4 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 19 Aug 2026 12:50:34 +0530 Subject: [PATCH 40/61] Fix PKCS11 token label and add HSM client zip download for mosipid/sunbird KEYMANAGER_PKCS11_TOKEN_LABEL corrected from pkcs11-proxy to mosip-token for esignet-mosipid and esignet-sunbird. Adds hsm_client_zip_url_env, a plain container env var (not a chart value) read directly by esignet-service's docker-entrypoint.sh at startup - if set, it downloads and unzips a PKCS11 client library from the given URL into hsm_local_dir_env before the app starts. The esignet-service Dockerfile only bakes this in via a build-arg with no default, so without setting it at runtime the KEYMANAGER_PKCS11_MODULE_PATH (/usr/local/lib/softhsm/libpkcs11-proxy.so) referenced by these two instances may not actually exist in the container. Note: hsm_local_dir_env defaults to a relative "hsm-client" dir (under work_dir, i.e. /home/mosip/hsm-client) per the Dockerfile, not /usr/local/lib/softhsm - not touched here since it wasn't part of what was asked, but worth checking that the downloaded zip's contents actually land at the configured module path. Verified via helmsman -dry-run -debug: 19 apps, both instances resolve to the correct values. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index e89861ea2..8f6610055 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -217,10 +217,11 @@ apps: extraEnvVarsAdditional.KEYMANAGER_DB_SCHEMA: "esignet" extraEnvVarsAdditional.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" extraEnvVarsAdditional.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_TOKEN_LABEL: "pkcs11-proxy" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" extraEnvVarsAdditional.KEYMANAGER_PKCS11_SLOT_ID: "0" extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVarsAdditional.hsm_client_zip_url_env: "https://raw.githubusercontent.com/mosip/artifactory-ref-impl/master/artifacts/src/hsm/client.zip" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" @@ -308,10 +309,11 @@ apps: extraEnvVarsAdditional.KEYMANAGER_DB_SCHEMA: "esignet" extraEnvVarsAdditional.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" extraEnvVarsAdditional.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_TOKEN_LABEL: "pkcs11-proxy" + extraEnvVarsAdditional.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" extraEnvVarsAdditional.KEYMANAGER_PKCS11_SLOT_ID: "0" extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVarsAdditional.hsm_client_zip_url_env: "https://raw.githubusercontent.com/mosip/artifactory-ref-impl/master/artifacts/src/hsm/client.zip" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" From a1fe88d2b978c9d565b7e3b093c49ecf938b16bb Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 19 Aug 2026 12:54:24 +0530 Subject: [PATCH 41/61] Remove esignet-global configmap ref from esignet-mosipid extraEnvVarsCM[1]: "esignet-global" removed from esignet-mosipid's set block. extraEnvVarsCM[0] (esignet-softhsm-mosipid-share) is untouched. Verified via helmsman -dry-run -debug: 19 apps, esignet-mosipid's extraEnvVarsCM resolves to just the softhsm-share entry. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 8f6610055..e3dcdb27f 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -170,7 +170,6 @@ apps: pluginNameEnv: "mosip-identity-plugin.jar" pluginUrlEnv: "" extraEnvVarsCM[0]: "esignet-softhsm-mosipid-share" - extraEnvVarsCM[1]: "esignet-global" metrics.serviceMonitor.enabled: "false" domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-mosipid.${domain_name}" domainConfig.MOSIP_SIGNUP_HOST: "https://signup-mosipid.${domain_name}" From eb76f07ac0885797e93d71e4576df8612e3ffdf4 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 19 Aug 2026 14:08:10 +0530 Subject: [PATCH 42/61] Fix double comma-escaping causing 'key "phone" has no value' on esignet-mosipid Root cause (verified against Helmsman v3.17.1 source, internal/app/release.go getSetValues()): Helmsman unconditionally escapes every literal comma in every set: value via strings.ReplaceAll(v, ",", "\\,") before passing it to `helm --set`, regardless of whether the value already contains a manually-escaped \, sequence. Values in this file that were hand-escaped per Helm's own strvals convention (\, for a literal comma) got double-escaped into \\, by Helmsman, which strvals then parses as "literal backslash followed by an unescaped separator comma" - splitting the value mid-string and producing dangling tokens like the "phone" segment of MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS's postfix values. Fix: remove the manual \, escaping (plain commas), since Helmsman already adds it automatically. \{ and \} escaping is untouched - Helmsman's ReplaceAll only touches commas. None of this was caught by this session's earlier helmsman -dry-run verifications because dry-run against a fake/unreachable kubeconfig fails at namespace creation, before Helmsman ever reaches the getSetValues() call that happens right before invoking `helm upgrade --install`. Verified by replicating Helmsman's exact getSetValues() transform (one --set flag per key, ReplaceAll(",", "\\,") per value) against the real esignet-mock/esignet-mosipid/esignet-sunbird set: blocks with a local helm template call: reproduced the exact "key \"phone\" has no value" failure before the fix, confirmed clean parsing with the correct final values (e.g. LOGIN_ID_OPTIONS renders its Handlebars wrapper and postfix values intact, IDA_OTP_CHANNELS renders as "email,phone") after it. Also re-ran helmsman -dry-run -debug: 19 apps parse correctly. Signed-off-by: bhumi46 --- .../dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index e3dcdb27f..e6c4e21b5 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -235,13 +235,13 @@ apps: extraEnvVarsAdditional.plugin_name_env: "mosip-identity-plugin.jar" extraEnvVarsAdditional.SPRING_KAFKA_CONSUMER_GROUP_ID: "esignet-consumer-esignet-mosipid" extraEnvVarsAdditional.MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE: "esignet-mosipid-signup-esqa020" - extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS: 'email\,phone' + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS: 'email,phone' extraEnvVarsAdditional.MOSIP_ESIGNET_SEND_OTP_ATTEMPTS: "300" extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: "300" extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS: "600" extraEnvVarsAdditional.MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS: "600" extraEnvVarsAdditional.MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX: "@phone" - extraEnvVarsAdditional.MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS.value: '\{\{ "\{\{" \}\} ''id'': ''mobile''\, ''svg'': ''mobile_icon''\, ''prefixes'': \{\{ "\{\{" \}\}''label'': ''IND''\, ''value'': ''+91''\, ''maxLength'': ''''\, ''regex'': ''''\}\,\{''label'': ''KHM''\, ''value'': ''+855''\, ''regex'': ''''\{\{ "\}\}" \}\}\, ''postfix'': ''@phone''\, ''maxLength'': ''''\, ''regex'': '''' \}\, \{ ''id'': ''nrc''\, ''svg'': ''nrc_id_icon''\, ''prefixes'': ''''\, ''postfix'': ''@nrc''\, ''maxLength'': ''''\, ''regex'': '''' \}\, \{ ''id'': ''vid''\, ''svg'': ''vid_icon''\, ''prefixes'': ''''\, ''postfix'': ''''\, ''maxLength'': ''''\, ''regex'': '''' \}\, \{ ''id'': ''email''\, ''svg'': ''email_icon''\, ''prefixes'': ''''\, ''postfix'': ''@email''\, ''maxLength'': ''''\, ''regex'': '''' \{\{ "\}\}" \}\}' + extraEnvVarsAdditional.MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS.value: '\{\{ "\{\{" \}\} ''id'': ''mobile'', ''svg'': ''mobile_icon'', ''prefixes'': \{\{ "\{\{" \}\}''label'': ''IND'', ''value'': ''+91'', ''maxLength'': '''', ''regex'': ''''\},\{''label'': ''KHM'', ''value'': ''+855'', ''regex'': ''''\{\{ "\}\}" \}\}, ''postfix'': ''@phone'', ''maxLength'': '''', ''regex'': '''' \}, \{ ''id'': ''nrc'', ''svg'': ''nrc_id_icon'', ''prefixes'': '''', ''postfix'': ''@nrc'', ''maxLength'': '''', ''regex'': '''' \}, \{ ''id'': ''vid'', ''svg'': ''vid_icon'', ''prefixes'': '''', ''postfix'': '''', ''maxLength'': '''', ''regex'': '''' \}, \{ ''id'': ''email'', ''svg'': ''email_icon'', ''prefixes'': '''', ''postfix'': ''@email'', ''maxLength'': '''', ''regex'': '''' \{\{ "\}\}" \}\}' extraEnvVarsAdditional.LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT: "INFO" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_URL: "http://captcha.captcha" @@ -440,7 +440,7 @@ apps: extraEnvVars.SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN.valueFrom.secretKeyRef.name: "softhsm-mock-identity-system" extraEnvVars.SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.hsm_local_dir_name: "hsm-client" - extraEnvVars.MOSIP_ESIGNET_MOCK_SUPPORTED_FIELDS: 'individualId\,password' + extraEnvVars.MOSIP_ESIGNET_MOCK_SUPPORTED_FIELDS: 'individualId,password' extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" @@ -476,7 +476,7 @@ apps: extraEnvVars.GRANT_TYPE: "authorization_code" extraEnvVars.CLAIMS_LOCALES: "en" extraEnvVars.SCOPE_USER_PROFILE: "openid profile" - extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\}\,"phone_number":\{"essential":true\}\,"email":\{"essential":true\}\,"picture":\{"essential":false\}\,"gender":\{"essential":false\}\,"birthdate":\{"essential":false\}\,"address":\{"essential":false\}\}\,"id_token":\{\}\}' + extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\},"phone_number":\{"essential":true\},"email":\{"essential":true\},"picture":\{"essential":false\},"gender":\{"essential":false\},"birthdate":\{"essential":false\},"address":\{"essential":false\}\},"id_token":\{\}\}' mock_relying_party_service.host: "" mock_relying_party_service.mountDir: "" mock_relying_party_service.healthCheckUrl: null @@ -510,7 +510,7 @@ apps: extraEnvVars.GRANT_TYPE: "authorization_code" extraEnvVars.CLAIMS_LOCALES: "en" extraEnvVars.SCOPE_USER_PROFILE: "openid profile" - extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\}\,"phone_number":\{"essential":true\}\,"email":\{"essential":true\}\,"picture":\{"essential":false\}\,"gender":\{"essential":false\}\,"birthdate":\{"essential":false\}\,"address":\{"essential":false\}\}\,"id_token":\{\}\}' + extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\},"phone_number":\{"essential":true\},"email":\{"essential":true\},"picture":\{"essential":false\},"gender":\{"essential":false\},"birthdate":\{"essential":false\},"address":\{"essential":false\}\},"id_token":\{\}\}' mock_relying_party_service.host: "" mock_relying_party_service.mountDir: "" mock_relying_party_service.healthCheckUrl: null @@ -544,7 +544,7 @@ apps: extraEnvVars.GRANT_TYPE: "authorization_code" extraEnvVars.CLAIMS_LOCALES: "en" extraEnvVars.SCOPE_USER_PROFILE: "openid profile" - extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\}\,"phone_number":\{"essential":true\}\,"email":\{"essential":true\}\,"picture":\{"essential":false\}\,"gender":\{"essential":false\}\,"birthdate":\{"essential":false\}\,"address":\{"essential":false\}\}\,"id_token":\{\}\}' + extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\},"phone_number":\{"essential":true\},"email":\{"essential":true\},"picture":\{"essential":false\},"gender":\{"essential":false\},"birthdate":\{"essential":false\},"address":\{"essential":false\}\},"id_token":\{\}\}' mock_relying_party_service.host: "" mock_relying_party_service.mountDir: "" mock_relying_party_service.healthCheckUrl: null From ed37a879768fa803e998606c20e120b8802ac5aa Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 19 Aug 2026 14:39:31 +0530 Subject: [PATCH 43/61] Fix CreateContainerConfigError on esignet-mock and esignet-mosipid/sunbird Root cause: the mosip/esignet chart's own default extraEnvVars entries reference cluster resources that don't exist in every namespace this profile deploys into, and Kubernetes fails the whole pod if any single env entry references a missing ConfigMap/Secret key - even when a working duplicate (added via our own extraEnvVars/extraEnvVarsAdditional overrides) exists elsewhere in the same env: list. esignet-mock: MOSIP_API_INTERNAL_HOST, MOSIP_ESIGNET_OIDC_UI_HOSTNAME, MOSIP_ESIGNET_HOST, MOSIP_SIGNUP_HOST default to configMapKeyRefs against an "esignet-global" configmap that only exists for the mosipid/sunbird instances (created by their own preinstall hooks) - esignet-mock's hook never creates one. Overridden to plain hostname strings matching domainConfig's already-correct values. esignet-mosipid/esignet-sunbird: KEYMANAGER_PKCS11_PIN defaults to a secretKeyRef against a plain "esignet-softhsm" secret that only exists in the mock namespace. Each instance already had this correctly overridden under extraEnvVarsAdditional, but that doesn't remove the broken chart-default entry under extraEnvVars - both instances now also override it directly under extraEnvVars, pointing at their own esignet-softhsm-mosipid/esignet-softhsm-sunbird secret. Verified via helmsman -dry-run -debug: 19 apps, all three instances' resolved values are correct and consistent with their domainConfig/ extraEnvVarsAdditional counterparts. Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index e6c4e21b5..9933b4856 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -105,6 +105,14 @@ apps: domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" domainConfig.OIDC_UI_HOSTNAME: "esignet.${domain_name}" + # esignet-mock has no esignet-global configmap (only the mosipid/sunbird preinstall + # hooks create their own per-namespace esignet-global) - override these chart-default + # extraEnvVars entries that otherwise reference it, or the pod fails to start with + # CreateContainerConfigError (configmap "esignet-global" not found). + extraEnvVars.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" + extraEnvVars.MOSIP_ESIGNET_OIDC_UI_HOSTNAME: "esignet.${domain_name}" + extraEnvVars.MOSIP_ESIGNET_HOST: "https://esignet.${domain_name}" + extraEnvVars.MOSIP_SIGNUP_HOST: "https://signup.${domain_name}" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha" @@ -210,6 +218,13 @@ apps: extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" + # Chart-default extraEnvVars.KEYMANAGER_PKCS11_PIN points at a plain "esignet-softhsm" + # secret that doesn't exist in this namespace (only esignet-softhsm-mosipid does) - + # the extraEnvVarsAdditional override below doesn't remove this broken chart-default + # entry, and Kubernetes fails the whole pod if any single env entry references a + # missing secret, even with a working duplicate elsewhere in the list. + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets-mosipid" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" extraEnvVars.AUTHN_PROVIDER: "mosip" @@ -302,6 +317,13 @@ apps: extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" + # Chart-default extraEnvVars.KEYMANAGER_PKCS11_PIN points at a plain "esignet-softhsm" + # secret that doesn't exist in this namespace (only esignet-softhsm-sunbird does) - + # the extraEnvVarsAdditional override below doesn't remove this broken chart-default + # entry, and Kubernetes fails the whole pod if any single env entry references a + # missing secret, even with a working duplicate elsewhere in the list. + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" extraEnvVars.AUTHN_PROVIDER: "mosip" From 851817b2ad788d265e7c02163d6ea396e370b6fe Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 19 Aug 2026 16:04:50 +0530 Subject: [PATCH 44/61] Add KEYMANAGER_PKCS12_ALLOW_INSECURE_SOFTWARE_KEYSTORE for esignet-mock Set via extraEnvVarsAdditional alongside the other PKCS12 keymanager overrides for this instance, consistent with the existing convention (renders after extraEnvVars, so it reliably takes effect regardless of chart defaults for the same key). Verified via helmsman -dry-run -debug: 19 apps, value resolves correctly for esignet-mock only. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 9933b4856..0a6515548 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -158,6 +158,7 @@ apps: extraEnvVarsAdditional.KEYMANAGER_KEYSTORE_TYPE: "PKCS12" extraEnvVarsAdditional.KEYMANAGER_PKCS12_FILE_PATH: "/home/mosip/config/esignet.pfx" extraEnvVarsAdditional.KEYMANAGER_PKCS12_PASSWORD: "localtest" + extraEnvVarsAdditional.KEYMANAGER_PKCS12_ALLOW_INSECURE_SOFTWARE_KEYSTORE: "true" timeout: 600 priority: -14 hooks: From e2edddd79b929173d0be519231b954753aa8e43b Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Wed, 19 Aug 2026 16:33:44 +0530 Subject: [PATCH 45/61] Rename esignet-mock's PKCS12 keystore file to keystore.p12 Keeps persistence.mountDir at the chart default (/home/mosip/config/) rather than /home/mosip - the latter is the container's WORKDIR where entrypoint.sh, esignet.exe, and data/ are baked in per the Dockerfile (ENTRYPOINT ["/home/mosip/entrypoint.sh"], CMD ["/home/mosip/esignet.exe"]), so mounting the PVC there would hide them and likely crash the container on start. The file still lands on the persistent volume, just renamed from esignet.pfx to keystore.p12. Verified via helmsman -dry-run -debug: 19 apps, value resolves correctly. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 0a6515548..5a0277c9a 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -156,7 +156,7 @@ apps: # container's env: list, so last-wins semantics correctly override the # chart's own PKCS11 extraEnvVars defaults for this same instance). extraEnvVarsAdditional.KEYMANAGER_KEYSTORE_TYPE: "PKCS12" - extraEnvVarsAdditional.KEYMANAGER_PKCS12_FILE_PATH: "/home/mosip/config/esignet.pfx" + extraEnvVarsAdditional.KEYMANAGER_PKCS12_FILE_PATH: "/home/mosip/config/keystore.p12" extraEnvVarsAdditional.KEYMANAGER_PKCS12_PASSWORD: "localtest" extraEnvVarsAdditional.KEYMANAGER_PKCS12_ALLOW_INSECURE_SOFTWARE_KEYSTORE: "true" timeout: 600 From 4c54ea268924cb0887393ab0e46d9eca68680eff Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 09:29:37 +0530 Subject: [PATCH 46/61] Fix esignet-mosipid CAPTCHA_SITE_KEY typo (was SITE-KEY) extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY (hyphen) never matched the real MOSIP_ESIGNET_CAPTCHA_SITE_KEY env var read by the chart, so the captcha site key was silently unset for esignet-mosipid. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 5a0277c9a..94e3222e4 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -245,8 +245,8 @@ apps: extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetmosipid" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.name: "esignet-captcha-mosipid" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE-KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha-mosipid" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" extraEnvVarsAdditional.NAMESPACE: "mosipid" extraEnvVarsAdditional.plugin_name_env: "mosip-identity-plugin.jar" extraEnvVarsAdditional.SPRING_KAFKA_CONSUMER_GROUP_ID: "esignet-consumer-esignet-mosipid" From 3dd733f5d71216642218d828c40e711a55708bfb Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 09:29:55 +0530 Subject: [PATCH 47/61] Consolidate KEYMANAGER_* overrides into extraEnvVars for mock/mosipid/sunbird Chart-default extraEnvVars.KEYMANAGER_KEYSTORE_TYPE/PKCS11_MODULE_PATH/ PKCS11_TOKEN_LABEL/PKCS11_SLOT_ID/PKCS11_PIN/DB_SCHEMA were being overridden only via extraEnvVarsAdditional, which relies on rendering order to win rather than replacing the chart-default extraEnvVars entries. That left redundant/confusing duplicate env entries in the rendered manifest for all three esignet-standalone-2.0.0 instances. Override these keys directly under extraEnvVars instead so only one entry per key renders. Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 54 ++++++++++--------- 1 file changed, 28 insertions(+), 26 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 94e3222e4..c685ba834 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -152,12 +152,20 @@ apps: extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" - # Overrides via extraEnvVarsAdditional (rendered after extraEnvVars in the - # container's env: list, so last-wins semantics correctly override the - # chart's own PKCS11 extraEnvVars defaults for this same instance). - extraEnvVarsAdditional.KEYMANAGER_KEYSTORE_TYPE: "PKCS12" - extraEnvVarsAdditional.KEYMANAGER_PKCS12_FILE_PATH: "/home/mosip/config/keystore.p12" - extraEnvVarsAdditional.KEYMANAGER_PKCS12_PASSWORD: "localtest" + # Overridden directly under extraEnvVars (not extraEnvVarsAdditional) so the + # chart's own PKCS11 defaults for these same keys don't also render into the + # env: list - relying on extraEnvVarsAdditional's last-wins ordering left the + # redundant PKCS11 entries (module path, token label, slot id, PIN secretKeyRef) + # coexisting alongside these, which happened to still work here (esignet-softhsm + # secret exists in this namespace) but is fragile and confusing. + extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS12" + extraEnvVars.KEYMANAGER_PKCS12_FILE_PATH: "/home/mosip/config/keystore.p12" + extraEnvVars.KEYMANAGER_PKCS12_PASSWORD: "localtest" + extraEnvVars.KEYMANAGER_PKCS12_ALLOW_INSECURE_SOFTWARE_KEYSTORE: "true" + extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "" + extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "" + extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "" + extraEnvVars.KEYMANAGER_PKCS11_PIN: "" extraEnvVarsAdditional.KEYMANAGER_PKCS12_ALLOW_INSECURE_SOFTWARE_KEYSTORE: "true" timeout: 600 priority: -14 @@ -221,21 +229,18 @@ apps: extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" # Chart-default extraEnvVars.KEYMANAGER_PKCS11_PIN points at a plain "esignet-softhsm" # secret that doesn't exist in this namespace (only esignet-softhsm-mosipid does) - - # the extraEnvVarsAdditional override below doesn't remove this broken chart-default - # entry, and Kubernetes fails the whole pod if any single env entry references a - # missing secret, even with a working duplicate elsewhere in the list. + # override directly under extraEnvVars (not extraEnvVarsAdditional) so the chart's + # own defaults for these same keys don't also coexist redundantly in the rendered env. + extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" + extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" + extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" + extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" + extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets-mosipid" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" extraEnvVars.AUTHN_PROVIDER: "mosip" - extraEnvVarsAdditional.KEYMANAGER_DB_SCHEMA: "esignet" - extraEnvVarsAdditional.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_SLOT_ID: "0" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVarsAdditional.hsm_client_zip_url_env: "https://raw.githubusercontent.com/mosip/artifactory-ref-impl/master/artifacts/src/hsm/client.zip" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" @@ -320,21 +325,18 @@ apps: extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" # Chart-default extraEnvVars.KEYMANAGER_PKCS11_PIN points at a plain "esignet-softhsm" # secret that doesn't exist in this namespace (only esignet-softhsm-sunbird does) - - # the extraEnvVarsAdditional override below doesn't remove this broken chart-default - # entry, and Kubernetes fails the whole pod if any single env entry references a - # missing secret, even with a working duplicate elsewhere in the list. + # override directly under extraEnvVars (not extraEnvVarsAdditional) so the chart's + # own defaults for these same keys don't also coexist redundantly in the rendered env. + extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" + extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" + extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" + extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" + extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" extraEnvVars.AUTHN_PROVIDER: "mosip" - extraEnvVarsAdditional.KEYMANAGER_DB_SCHEMA: "esignet" - extraEnvVarsAdditional.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_SLOT_ID: "0" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" - extraEnvVarsAdditional.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVarsAdditional.hsm_client_zip_url_env: "https://raw.githubusercontent.com/mosip/artifactory-ref-impl/master/artifacts/src/hsm/client.zip" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" From 1f864ac0df5fd8a58bd852eabc27342d8e6d79f6 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 11:21:06 +0530 Subject: [PATCH 48/61] Fix minio helm upgrade failing with empty auth.rootPassword The MINIO_ROOT_PASSWORD fetch in helmsman_external.yml ran before WireGuard/kubeconfig were set up, so kubectl could never reach the cluster and the value was always empty. Moved the fetch to its own step after cluster access is verified, and wired auth.rootPassword into the minio app's set: block in external-dsf.yaml so the fetched password actually reaches helm upgrade (previously it was fetched but never consumed by the minio release itself). Signed-off-by: bhumi46 --- .github/workflows/helmsman_external.yml | 17 +++++++++++++---- .../dsf/esignet-standalone/external-dsf.yaml | 5 +++++ 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/.github/workflows/helmsman_external.yml b/.github/workflows/helmsman_external.yml index 1700a13e7..fb011f045 100644 --- a/.github/workflows/helmsman_external.yml +++ b/.github/workflows/helmsman_external.yml @@ -224,9 +224,6 @@ jobs: - name: Mask sensitive secrets run: | - MINIO_ROOT_PASSWORD=$(kubectl -n minio get secret minio -o jsonpath='{.data.root-password}' 2>/dev/null | base64 -d || true) - if [ -n "$MINIO_ROOT_PASSWORD" ]; then echo "::add-mask::$MINIO_ROOT_PASSWORD"; fi - echo "MINIO_ROOT_PASSWORD=$MINIO_ROOT_PASSWORD" >> $GITHUB_ENV echo "::add-mask::${{ secrets.ESIGNET_CAPTCHA_SITE_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_CAPTCHA_SECRET_KEY }}" echo "::add-mask::${{ secrets.PREREG_CAPTCHA_SITE_KEY }}" @@ -337,8 +334,20 @@ jobs: kubectl get nodes kubectl cluster-info - # Test istioctl functionality + # Test istioctl functionality istioctl version --remote=false + + - name: Fetch and mask minio root password + run: | + # Must run after WireGuard/kubeconfig are up - kubectl needs cluster + # access to look up the existing secret. Fetching this earlier (as + # part of "Mask sensitive secrets", before the tunnel is up) always + # returned empty, which then failed minio's helm upgrade with + # "auth.rootPassword must not be empty". + MINIO_ROOT_PASSWORD=$(kubectl -n minio get secret minio -o jsonpath='{.data.root-password}' 2>/dev/null | base64 -d || true) + if [ -n "$MINIO_ROOT_PASSWORD" ]; then echo "::add-mask::$MINIO_ROOT_PASSWORD"; fi + echo "MINIO_ROOT_PASSWORD=$MINIO_ROOT_PASSWORD" >> $GITHUB_ENV + - name: Export keycloak client secrets for esignet-keycloak-init if: contains(matrix.dsf_files, 'esignet-standalone/external-dsf.yaml') run: | diff --git a/Helmsman/dsf/esignet-standalone/external-dsf.yaml b/Helmsman/dsf/esignet-standalone/external-dsf.yaml index a84a09971..1c2d51a8c 100644 --- a/Helmsman/dsf/esignet-standalone/external-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/external-dsf.yaml @@ -518,6 +518,11 @@ apps: set: image.repository: "mosipid/minio" image.tag: "2022.2.7-debian-10-r0" + # Required on upgrade - the chart's Bitnami-based validation rejects an + # empty auth.rootPassword once the release already exists. MINIO_ROOT_PASSWORD + # is fetched from the existing "minio" secret by the CI workflow before + # helmsman runs; empty on first install, which the chart auto-generates for. + auth.rootPassword: "${MINIO_ROOT_PASSWORD}" metrics.serviceMonitor.enabled: "true" extraEnvVars[0].name: "MINIO_PROMETHEUS_URL" extraEnvVars[0].value: "http://rancher-monitoring-prometheus.cattle-monitoring-system:9090" From 42baffb807ce5b73a2c726329613c896ba45be08 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 14:42:48 +0530 Subject: [PATCH 49/61] Isolate esignet-standalone-2.0.0 mock/sunbird/mosipid onto develop-go databases Previously these three namespaces silently shared their Postgres database with the retired v1.7.1 esignet-standalone profile (mosip_esignet / mosip_esignet_sunbird / mosip_esignet_mosipid, branch develop) despite comments claiming isolation. Enable the existing but unused/orphaned mosip_esignet_go / mosip_esignet_go_sunbird / mosip_esignet_go_mosipid entries, set their branch to develop-go, and repoint the three esignet-standalone-2.0.0 preinstall hooks' postgres-config patches at these dedicated db names/users so the isolation is actually real. Note: this starts these three namespaces on fresh, empty databases - no data carries over from the previously shared ones. Signed-off-by: bhumi46 --- .../dsf/esignet-standalone/external-dsf.yaml | 25 +++++++++++-------- .../esignet-mosipid-preinstall.sh | 2 +- .../esignet-preinstall.sh | 2 +- .../esignet-sunbird-preinstall.sh | 4 +-- 4 files changed, 18 insertions(+), 15 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone/external-dsf.yaml b/Helmsman/dsf/esignet-standalone/external-dsf.yaml index 1c2d51a8c..9b1ec09e4 100644 --- a/Helmsman/dsf/esignet-standalone/external-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/external-dsf.yaml @@ -170,17 +170,20 @@ apps: # --------------------------------------------------------------------------- # esignet-standalone-2.0.0 profile databases # --------------------------------------------------------------------------- - # mosip_esignet_go / mosip_esignet_go_sunbird / mosip_mockidentitysystem_go - # are disabled — the Go profile shares the same physical databases as the - # (retired) v1.7.1 profile above (mosip_esignet / mosip_esignet_sunbird / - # mosip_mockidentitysystem) instead of maintaining isolated duplicates. Kept - # with the _go suffix (rather than deleted) so the key stays distinct from - # the v1.7.1 entries above in this flat set: map. - databases.mosip_esignet_go.enabled: "false" + # mosip_esignet_go / mosip_esignet_go_sunbird / mosip_esignet_go_mosipid are + # isolated databases dedicated to the Go profile, separate from the (retired) + # v1.7.1 profile's mosip_esignet / mosip_esignet_sunbird / mosip_esignet_mosipid + # above. Kept with the _go suffix so the key stays distinct from the v1.7.1 + # entries above in this flat set: map. branch: develop-go matches the esignet + # repo branch these three namespaces' images/DB-init scripts are built from. + # The esignet-standalone-2.0.0 preinstall hooks (esignet-preinstall.sh, + # esignet-sunbird-preinstall.sh, esignet-mosipid-preinstall.sh) must point + # postgres-config at these same db names/users. + databases.mosip_esignet_go.enabled: "true" databases.mosip_esignet_go.scriptsDir: "mosip_esignet" databases.mosip_esignet_go.dbName: "mosip_esignet_go" databases.mosip_esignet_go.dbUser: "esignetuser_go" - databases.mosip_esignet_go.branch: "develop" + databases.mosip_esignet_go.branch: "develop-go" databases.mosip_esignet_go.host: "postgres.${domain_name}" databases.mosip_esignet_go.port: ${esignet_db_port} databases.mosip_esignet_go.dml: 1 @@ -193,7 +196,7 @@ apps: databases.mosip_esignet_go_mosipid.scriptsDir: "mosip_esignet" databases.mosip_esignet_go_mosipid.dbName: "mosip_esignet_go_mosipid" databases.mosip_esignet_go_mosipid.dbUser: "esignetuser_go_mosipid" - databases.mosip_esignet_go_mosipid.branch: "develop" + databases.mosip_esignet_go_mosipid.branch: "develop-go" databases.mosip_esignet_go_mosipid.host: "postgres.${domain_name}" databases.mosip_esignet_go_mosipid.port: ${esignet_db_port} databases.mosip_esignet_go_mosipid.dml: 1 @@ -202,11 +205,11 @@ apps: databases.mosip_esignet_go_mosipid.su.user: "postgres" databases.mosip_esignet_go_mosipid.su.secret.name: "postgres-postgresql" databases.mosip_esignet_go_mosipid.su.secret.key: "postgres-password" - databases.mosip_esignet_go_sunbird.enabled: "false" + databases.mosip_esignet_go_sunbird.enabled: "true" databases.mosip_esignet_go_sunbird.scriptsDir: "mosip_esignet" databases.mosip_esignet_go_sunbird.dbName: "mosip_esignet_go_sunbird" databases.mosip_esignet_go_sunbird.dbUser: "esignetuser_go_sunbird" - databases.mosip_esignet_go_sunbird.branch: "develop" + databases.mosip_esignet_go_sunbird.branch: "develop-go" databases.mosip_esignet_go_sunbird.host: "postgres.${domain_name}" databases.mosip_esignet_go_sunbird.port: ${esignet_db_port} databases.mosip_esignet_go_sunbird.dml: 1 diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh index 92b506c9e..df3e0c89d 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh @@ -35,7 +35,7 @@ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ # Override postgres-config with MOSIPID-specific DB values (2.0.0: isolated database) kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_mosipid","database-username":"esignetuser_mosipid"}}' + -p '{"data":{"database-name":"mosip_esignet_go_mosipid","database-username":"esignetuser_go_mosipid"}}' # Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh index 72f6052ba..90505c084 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh @@ -41,7 +41,7 @@ $COPY_UTIL configmap postgres-config "$POSTGRES_NS" "$ESIGNET_NS" # Override postgres-config with 2.0.0-specific DB values (isolated database) kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet","database-username":"esignetuser"}}' + -p '{"data":{"database-name":"mosip_esignet_go","database-username":"esignetuser_go"}}' echo "Copying redis-config configmap from $REDIS_NS" $COPY_UTIL configmap redis-config "$REDIS_NS" "$ESIGNET_NS" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh index a25dd63d6..f2b29752c 100755 --- a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh @@ -31,9 +31,9 @@ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ --from-literal=mosip-version="develop" \ --dry-run=client -o yaml | kubectl apply -f - -# Override postgres-config with Sunbird-specific DB values +# Override postgres-config with Sunbird-specific DB values (2.0.0: isolated database) kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_sunbird","database-username":"esignetuser_sunbird"}}' + -p '{"data":{"database-name":"mosip_esignet_go_sunbird","database-username":"esignetuser_go_sunbird"}}' # Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then From f8d4c96af1255d015860b5cadba8315e3699b35f Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 14:47:58 +0530 Subject: [PATCH 50/61] Switch esignet image to mosipdev/esignet for esignet-standalone-2.0.0 Changed image.repository from mosipqa/esignet to mosipdev/esignet for esignet-mock, esignet-mosipid, and esignet-sunbird (tag stays develop-go). Also removed the redundant extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID override for mosipid/sunbird - it duplicated the chart's own default (0), which already renders correctly without an explicit override. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index c685ba834..ede9eafe3 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -85,7 +85,7 @@ apps: version: 2.0.0-develop chart: mosip/esignet set: - image.repository: "mosipqa/esignet" + image.repository: "mosipdev/esignet" image.tag: "develop-go" enable_insecure: "false" springConfigNameEnv: "" @@ -179,7 +179,7 @@ apps: version: 2.0.0-develop chart: mosip/esignet set: - image.repository: "mosipqa/esignet" + image.repository: "mosipdev/esignet" image.tag: "develop-go" enable_insecure: "false" springConfigNameEnv: "" @@ -235,7 +235,6 @@ apps: extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" - extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets-mosipid" @@ -279,7 +278,7 @@ apps: version: 2.0.0-develop chart: mosip/esignet set: - image.repository: "mosipqa/esignet" + image.repository: "mosipdev/esignet" image.tag: "develop-go" enable_insecure: "false" springConfigNameEnv: "" @@ -331,7 +330,6 @@ apps: extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" - extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "0" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" From a512a69442c0046af07bfb23f750f485f58c63c6 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 15:50:24 +0530 Subject: [PATCH 51/61] Fix AUTHN_PROVIDER key name and add per-instance NAMESPACE for mock/mosipid/sunbird extraEnvVars.AUTHN_PROVIDER wasn't the env var the chart/app actually reads (chart default key is MOSIP_ESIGNET_AUTHN_PROVIDER: mosip) - our override under the wrong name never took effect, so all three instances silently ran with the chart default 'mosip' regardless of what we set. Renamed to MOSIP_ESIGNET_AUTHN_PROVIDER with correct per-instance values (mock/mosip/ sunbird), and added NAMESPACE (mock/mosipid/sunbird respectively) which previously only existed for mosipid, and only via extraEnvVarsAdditional. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index ede9eafe3..ac8273bfd 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -138,7 +138,8 @@ apps: extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" - extraEnvVars.AUTHN_PROVIDER: "mosip" + extraEnvVars.MOSIP_ESIGNET_AUTHN_PROVIDER: "mock" + extraEnvVars.NAMESPACE: "mock" extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" persistence.enabled: "true" persistence.pvc_claim_name: "esignet-mock-pkcs12-keystore" @@ -239,7 +240,8 @@ apps: extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets-mosipid" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" - extraEnvVars.AUTHN_PROVIDER: "mosip" + extraEnvVars.MOSIP_ESIGNET_AUTHN_PROVIDER: "mosip" + extraEnvVars.NAMESPACE: "mosipid" extraEnvVarsAdditional.hsm_client_zip_url_env: "https://raw.githubusercontent.com/mosip/artifactory-ref-impl/master/artifacts/src/hsm/client.zip" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" @@ -251,7 +253,6 @@ apps: extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetmosipid" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha-mosipid" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" - extraEnvVarsAdditional.NAMESPACE: "mosipid" extraEnvVarsAdditional.plugin_name_env: "mosip-identity-plugin.jar" extraEnvVarsAdditional.SPRING_KAFKA_CONSUMER_GROUP_ID: "esignet-consumer-esignet-mosipid" extraEnvVarsAdditional.MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE: "esignet-mosipid-signup-esqa020" @@ -334,7 +335,8 @@ apps: extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" - extraEnvVars.AUTHN_PROVIDER: "mosip" + extraEnvVars.MOSIP_ESIGNET_AUTHN_PROVIDER: "sunbird" + extraEnvVars.NAMESPACE: "sunbird" extraEnvVarsAdditional.hsm_client_zip_url_env: "https://raw.githubusercontent.com/mosip/artifactory-ref-impl/master/artifacts/src/hsm/client.zip" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" From 5f134db24182625335d4a5c3192fa162f46d1f2e Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 15:52:27 +0530 Subject: [PATCH 52/61] Add MOSIP_ESIGNET_CAPTCHA_SITE_PROVIDER and CAPTCHA_VALIDATOR_URL for esignet-mock/mosipid/sunbird Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index ac8273bfd..bad7e8b5a 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -118,6 +118,8 @@ apps: extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha" extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" extraEnvVars.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignet" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_PROVIDER: "google-recaptcha" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_VALIDATOR_URL: "http://captcha.captcha/v1/captcha/validatecaptcha" extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" @@ -242,6 +244,8 @@ apps: extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" extraEnvVars.MOSIP_ESIGNET_AUTHN_PROVIDER: "mosip" extraEnvVars.NAMESPACE: "mosipid" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_PROVIDER: "google-recaptcha" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_VALIDATOR_URL: "http://captcha.captcha/v1/captcha/validatecaptcha" extraEnvVarsAdditional.hsm_client_zip_url_env: "https://raw.githubusercontent.com/mosip/artifactory-ref-impl/master/artifacts/src/hsm/client.zip" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" @@ -337,6 +341,8 @@ apps: extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" extraEnvVars.MOSIP_ESIGNET_AUTHN_PROVIDER: "sunbird" extraEnvVars.NAMESPACE: "sunbird" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_PROVIDER: "google-recaptcha" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_VALIDATOR_URL: "http://captcha.captcha/v1/captcha/validatecaptcha" extraEnvVarsAdditional.hsm_client_zip_url_env: "https://raw.githubusercontent.com/mosip/artifactory-ref-impl/master/artifacts/src/hsm/client.zip" extraEnvVars.OIDC_UI_SCHEME: "https" extraEnvVars.OIDC_UI_PORT: "443" From 6a4a236c3008776704109213ab400b4aa7eda880 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 16:12:30 +0530 Subject: [PATCH 53/61] Fix duplicate MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/MOSIP_API_INTERNAL_HOST env entries Both domainConfig and the chart's own extraEnvVars defaults set these same three key names, rendering as two separate entries with the same 'name' in the container's env: list. Kubernetes' strategic-merge-patch can't compute a consistent $setElementOrder when the merge key isn't unique, causing 'Diffing release... failed' errors on upgrade for esignet-mosipid and esignet-sunbird. esignet-mock already had correct extraEnvVars overrides for these keys (needed separately to avoid a missing esignet-global configmap crash) - just removed the redundant domainConfig copies there. esignet-mosipid/esignet-sunbird only had domainConfig entries; moved them into extraEnvVars unchanged. This also matters for correctness, not just dedup: the chart-default extraEnvVars values (sourced from the esignet-global configmap) are missing the https:// scheme, and for mosipid specifically point at the wrong domain (domain_name instead of mosipid_domain_name) - letting the chart default become the sole source would have silently broken the mosip-identity-plugin's actual endpoints. Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 23 +++++++++++-------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index bad7e8b5a..3f53fd70c 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -95,11 +95,8 @@ apps: extraEnvVarsCM[0]: "esignet-softhsm-share" #extraEnvVarsCM[1]: "kafka-config" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "https://esignet.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "https://signup.${domain_name}" domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" @@ -191,11 +188,8 @@ apps: pluginUrlEnv: "" extraEnvVarsCM[0]: "esignet-softhsm-mosipid-share" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-mosipid.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "https://signup-mosipid.${domain_name}" domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid_domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" @@ -210,6 +204,13 @@ apps: domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-mosipid.${domain_name}" domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-mosipid.${domain_name}" domainConfig.OIDC_UI_HOSTNAME: "esignet-mosipid.${domain_name}" + # Moved from domainConfig to extraEnvVars (same key names as the chart's own + # extraEnvVars defaults) to avoid two same-named entries in the rendered env: list, + # which breaks Kubernetes' strategic-merge-patch $setElementOrder computation on + # upgrade. Values unchanged. + extraEnvVars.MOSIP_ESIGNET_HOST: "https://esignet-mosipid.${domain_name}" + extraEnvVars.MOSIP_SIGNUP_HOST: "https://signup-mosipid.${domain_name}" + extraEnvVars.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid_domain_name}" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" @@ -293,11 +294,8 @@ apps: extraEnvVarsCM[0]: "esignet-softhsm-sunbird-share" #extraEnvVarsCM[1]: "kafka-config" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-sunbird.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "https://signup-sunbird.${domain_name}" domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" @@ -306,6 +304,13 @@ apps: domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL: "https://registry.${mosipid_domain_name}/api/v1/Insurance/search" domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid_domain_name}/api/v1/Insurance/" domainConfig.OIDC_UI_HOSTNAME: "esignet-sunbird.${domain_name}" + # Moved from domainConfig to extraEnvVars (same key names as the chart's own + # extraEnvVars defaults) to avoid two same-named entries in the rendered env: list, + # which breaks Kubernetes' strategic-merge-patch $setElementOrder computation on + # upgrade. Values unchanged. + extraEnvVars.MOSIP_ESIGNET_HOST: "https://esignet-sunbird.${domain_name}" + extraEnvVars.MOSIP_SIGNUP_HOST: "https://signup-sunbird.${domain_name}" + extraEnvVars.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" extraEnvVars.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetsunbird" From 3c70d7b2ceb303da63e26e026408d5693966732c Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 16:36:20 +0530 Subject: [PATCH 54/61] Remove duplicate MOSIP_ESIGNET_CAPTCHA_SITE_KEY for esignet-mock Was set under both extraEnvVars and extraEnvVarsAdditional with identical values, rendering as two same-named entries in the env: list - same duplicate-key class as the recent MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/ MOSIP_API_INTERNAL_HOST fix, confirmed via the live deployed pod spec. Kept the extraEnvVars entry, removed the redundant extraEnvVarsAdditional copy. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 3f53fd70c..29c0ccf80 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -149,8 +149,6 @@ apps: extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha" - extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" # Overridden directly under extraEnvVars (not extraEnvVarsAdditional) so the # chart's own PKCS11 defaults for these same keys don't also render into the From a34b34dc9a26978a34fa13367eb7a53f4d5b93df Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 18:04:11 +0530 Subject: [PATCH 55/61] Remove duplicate KEYMANAGER_PKCS12_ALLOW_INSECURE_SOFTWARE_KEYSTORE for esignet-mock Same duplicate-key class as the recent env var fixes - set under both extraEnvVars and extraEnvVarsAdditional with identical values. Kept the extraEnvVars entry, removed the redundant extraEnvVarsAdditional copy. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 29c0ccf80..c2a0f5718 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -164,7 +164,6 @@ apps: extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "" extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "" extraEnvVars.KEYMANAGER_PKCS11_PIN: "" - extraEnvVarsAdditional.KEYMANAGER_PKCS12_ALLOW_INSECURE_SOFTWARE_KEYSTORE: "true" timeout: 600 priority: -14 hooks: From acf6b09d8d570c3b98734fe83187d7fdc26a5c0c Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 18:18:43 +0530 Subject: [PATCH 56/61] Null out chart-default MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/MOSIP_API_INTERNAL_HOST instead of string-overriding for mosipid/sunbird The previous fix overrode these chart-default extraEnvVars entries (tables, via valueFrom.configMapKeyRef) with plain string values at the same key. That still eliminated the duplicate-name issue, but Helm's coalesce logic emits a 'cannot overwrite table with non table' warning for every such override - confirmed via a real Helm 3.17.1 binary (matching what CI installs) that this warning is harmless on its own (the override still applies correctly), but it's very likely eating into Helmsman's truncated error output and masking whatever the actual 'Diffing release... failed with exit code 2' error is for esignet-mosipid/esignet-sunbird (esignet-mock has the same warning pattern today without failing, ruling out the warning itself as the cause). Switched to nulling the chart-default keys entirely (null, quoted - a bare YAML null unmarshals to an empty string via Helmsman's sigs.k8s.io/yaml parsing, not the literal text Helm needs) and moved the actual values back to domainConfig, which no longer conflicts since extraEnvVars no longer supplies these keys at all. Verified against a real Helm 3.17.1 binary: zero warnings, single correct entry per key. Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 44 +++++++++++++------ 1 file changed, 30 insertions(+), 14 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index c2a0f5718..fb80cec4e 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -201,13 +201,21 @@ apps: domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-mosipid.${domain_name}" domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-mosipid.${domain_name}" domainConfig.OIDC_UI_HOSTNAME: "esignet-mosipid.${domain_name}" - # Moved from domainConfig to extraEnvVars (same key names as the chart's own - # extraEnvVars defaults) to avoid two same-named entries in the rendered env: list, - # which breaks Kubernetes' strategic-merge-patch $setElementOrder computation on - # upgrade. Values unchanged. - extraEnvVars.MOSIP_ESIGNET_HOST: "https://esignet-mosipid.${domain_name}" - extraEnvVars.MOSIP_SIGNUP_HOST: "https://signup-mosipid.${domain_name}" - extraEnvVars.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-mosipid.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup-mosipid.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid_domain_name}" + # Chart-default extraEnvVars.MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/MOSIP_API_INTERNAL_HOST + # are tables (valueFrom.configMapKeyRef against esignet-global). A plain string override + # at the same key produces a "cannot overwrite table with non table" coalesce warning + # (harmless on its own, but noisy) and still leaves domainConfig's own same-named entry + # as a genuinely separate list item - so null the chart-default keys out entirely + # instead, letting domainConfig (above) be the sole source, matching the pattern used + # for KEYMANAGER_PKCS11_* elsewhere in this file. "null" (quoted) is required: Helmsman's + # YAML parsing turns a bare `null` into an empty string, not the literal text Helm needs + # to delete a key. + extraEnvVars.MOSIP_ESIGNET_HOST: "null" + extraEnvVars.MOSIP_SIGNUP_HOST: "null" + extraEnvVars.MOSIP_API_INTERNAL_HOST: "null" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" @@ -301,13 +309,21 @@ apps: domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL: "https://registry.${mosipid_domain_name}/api/v1/Insurance/search" domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid_domain_name}/api/v1/Insurance/" domainConfig.OIDC_UI_HOSTNAME: "esignet-sunbird.${domain_name}" - # Moved from domainConfig to extraEnvVars (same key names as the chart's own - # extraEnvVars defaults) to avoid two same-named entries in the rendered env: list, - # which breaks Kubernetes' strategic-merge-patch $setElementOrder computation on - # upgrade. Values unchanged. - extraEnvVars.MOSIP_ESIGNET_HOST: "https://esignet-sunbird.${domain_name}" - extraEnvVars.MOSIP_SIGNUP_HOST: "https://signup-sunbird.${domain_name}" - extraEnvVars.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-sunbird.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup-sunbird.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" + # Chart-default extraEnvVars.MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/MOSIP_API_INTERNAL_HOST + # are tables (valueFrom.configMapKeyRef against esignet-global). A plain string override + # at the same key produces a "cannot overwrite table with non table" coalesce warning + # (harmless on its own, but noisy) and still leaves domainConfig's own same-named entry + # as a genuinely separate list item - so null the chart-default keys out entirely + # instead, letting domainConfig (above) be the sole source, matching the pattern used + # for KEYMANAGER_PKCS11_* elsewhere in this file. "null" (quoted) is required: Helmsman's + # YAML parsing turns a bare `null` into an empty string, not the literal text Helm needs + # to delete a key. + extraEnvVars.MOSIP_ESIGNET_HOST: "null" + extraEnvVars.MOSIP_SIGNUP_HOST: "null" + extraEnvVars.MOSIP_API_INTERNAL_HOST: "null" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" extraEnvVars.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetsunbird" From 6113daadac4f2934cf4616e4b4652396dc8f7316 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 18:21:26 +0530 Subject: [PATCH 57/61] Eliminate coalesce warnings for esignet-mock's MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/MOSIP_API_INTERNAL_HOST/MOSIP_ESIGNET_OIDC_UI_HOSTNAME/KEYMANAGER_PKCS11_PIN Same fix as the recent mosipid/sunbird change, applied to mock for consistency. These five chart-default extraEnvVars entries are all tables (valueFrom.configMapKeyRef or secretKeyRef), and mock's plain-value overrides at the same keys triggered 'cannot overwrite table with non table' coalesce warnings - confirmed harmless on their own via a real Helm 3.17.1 binary, but still worth removing since verbose warnings risk masking real errors in Helmsman's truncated CI output. MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/MOSIP_API_INTERNAL_HOST: nulled under extraEnvVars, values moved to domainConfig (safe for mock specifically - no esignet-global configmap reference survives since the chart-default key is fully deleted, not just given a literal value). MOSIP_ESIGNET_OIDC_UI_HOSTNAME: nulled under extraEnvVars, value moved to extraEnvVarsAdditional (no domainConfig equivalent key exists for this one). KEYMANAGER_PKCS11_PIN: changed from an empty-string override to null - same functional result (PKCS11 unused, PKCS12 is the active keystore type) but as a real deletion instead of a type-conflicting empty string. Verified against a real Helm 3.17.1 binary with mock's full 90-key --set list: exit 0, zero warnings, single correct entry per key. Signed-off-by: bhumi46 --- .../esignet-standalone-2.0.0/esignet-dsf.yaml | 31 ++++++++++++++----- 1 file changed, 23 insertions(+), 8 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index fb80cec4e..5c9002ffa 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -102,14 +102,26 @@ apps: domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" domainConfig.OIDC_UI_HOSTNAME: "esignet.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup.${domain_name}" # esignet-mock has no esignet-global configmap (only the mosipid/sunbird preinstall - # hooks create their own per-namespace esignet-global) - override these chart-default - # extraEnvVars entries that otherwise reference it, or the pod fails to start with - # CreateContainerConfigError (configmap "esignet-global" not found). - extraEnvVars.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" - extraEnvVars.MOSIP_ESIGNET_OIDC_UI_HOSTNAME: "esignet.${domain_name}" - extraEnvVars.MOSIP_ESIGNET_HOST: "https://esignet.${domain_name}" - extraEnvVars.MOSIP_SIGNUP_HOST: "https://signup.${domain_name}" + # hooks create their own per-namespace esignet-global) - these chart-default extraEnvVars + # entries are tables (valueFrom.configMapKeyRef against esignet-global), so a plain + # string override at the same key produces a "cannot overwrite table with non table" + # coalesce warning (harmless on its own, but risks masking real errors in Helmsman's + # truncated output) and would still fail with CreateContainerConfigError if left as the + # chart default. Null them out entirely instead - MOSIP_API_INTERNAL_HOST/MOSIP_ESIGNET_HOST/ + # MOSIP_SIGNUP_HOST now come from domainConfig (above); MOSIP_ESIGNET_OIDC_UI_HOSTNAME has + # no domainConfig equivalent key so it's set via extraEnvVarsAdditional instead (renders + # after extraEnvVars, no chart-default table to conflict with). "null" (quoted) is + # required: Helmsman's YAML parsing turns a bare `null` into an empty string, not the + # literal text Helm needs to delete a key. + extraEnvVars.MOSIP_API_INTERNAL_HOST: "null" + extraEnvVars.MOSIP_ESIGNET_OIDC_UI_HOSTNAME: "null" + extraEnvVars.MOSIP_ESIGNET_HOST: "null" + extraEnvVars.MOSIP_SIGNUP_HOST: "null" + extraEnvVarsAdditional.MOSIP_ESIGNET_OIDC_UI_HOSTNAME: "esignet.${domain_name}" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha" @@ -163,7 +175,10 @@ apps: extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "" extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "" extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "" - extraEnvVars.KEYMANAGER_PKCS11_PIN: "" + # KEYMANAGER_PKCS11_PIN's chart default is a table (valueFrom.secretKeyRef), unlike the + # three plain-string defaults above - an empty-string override here still triggers the + # coalesce "cannot overwrite table with non table" warning, so null it out instead. + extraEnvVars.KEYMANAGER_PKCS11_PIN: "null" timeout: 600 priority: -14 hooks: From e9e077cfcc7fc225edf8cf47cc802dfc0411b03d Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 18:26:12 +0530 Subject: [PATCH 58/61] Fix duplicate/crash-risk MOSIP_ESIGNET_HOST for mock-identity-system Same class of bug as the recent esignet-mock/mosipid/sunbird fixes, found while auditing mock-identity-system, mock-relying-party-service/-ui, and oidc-ui for similar issues. domainConfig.MOSIP_ESIGNET_HOST was set, but the chart-default extraEnvVars.MOSIP_ESIGNET_HOST (a table referencing the esignet-global configmap, which doesn't exist in the esignet-mock namespace) was never nulled - producing both a duplicate-named env entry and a CreateContainerConfigError crash risk. Verified via helm template: single entry, correct value, zero warnings. mock-relying-party-service/-ui and oidc-ui were also audited - their chart defaults for extraEnvVars/domainConfig are empty or unused by this DSF, so no equivalent issue exists there. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 5c9002ffa..74ae39acd 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -491,6 +491,12 @@ apps: domainConfig.installation-domain: "${domain_name}" domainConfig.MOSIP_MOCK_IDA_IDENTITY_SCHEMA_URL: "https://raw.githubusercontent.com/prathmeshj12/addidentityschema_testing/refs/heads/main/email-signup-schema-testing.json" domainConfig.MOSIP_MOCK_UI_SPEC_SCHEMA_URL: "https://raw.githubusercontent.com/prathmeshj12/addidentityschema_testing/refs/heads/main/ui_spec_reset_password_phone.json" + # Chart-default extraEnvVars.MOSIP_ESIGNET_HOST is a table (valueFrom.configMapKeyRef + # against esignet-global), which doesn't exist in the esignet-mock namespace - left + # unset it would both crash with CreateContainerConfigError and duplicate the + # domainConfig.MOSIP_ESIGNET_HOST entry above in the rendered env: list. Null it out + # so domainConfig is the sole source, same pattern as the esignet chart apps. + extraEnvVars.MOSIP_ESIGNET_HOST: "null" extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.name: "mockid-postgres-config" extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.key: "database-host" extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.name: "mockid-postgres-config" From dcf119e57baa64dadf613740a7e99f55477f855b Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 18:49:17 +0530 Subject: [PATCH 59/61] Null out KEYMANAGER_PKCS11_SLOT_ID for esignet-mosipid/esignet-sunbird Previously left unset (chart default '0' rendered implicitly). Now explicitly deleted so it doesn't render at all, matching the pattern used for the other KEYMANAGER_* keys. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 74ae39acd..1529f23fa 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -259,6 +259,7 @@ apps: extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" + extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "null" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets-mosipid" @@ -368,6 +369,7 @@ apps: extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" + extraEnvVars.KEYMANAGER_PKCS11_SLOT_ID: "null" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" From 5cdfd1961f503764a514402ee1c5ca00d2fcde70 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 18:59:24 +0530 Subject: [PATCH 60/61] Set placeholder value for esignet-mosipid's MOSIP_ESIGNET_MISP_KEY The esignet-misp-onboarder-key secret only ever holds an empty value, since the onboarder app that would populate it with a real MISP license key is disabled (and has unrelated ordering/namespace-targeting issues of its own). An empty MISP key makes the Go esignet service Fatal on startup during plugin provider init, blocking esignet-mosipid entirely. Set a literal placeholder value directly instead, to be replaced with the real MISP license key once available. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 1529f23fa..2927baca0 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -292,8 +292,12 @@ apps: extraEnvVarsAdditional.LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT: "INFO" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_URL: "http://captcha.captcha" - extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY.valueFrom.secretKeyRef.name: "esignet-misp-onboarder-key" - extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY.valueFrom.secretKeyRef.key: "mosip-esignet-misp-key" + # Placeholder - esignet-misp-onboarder-key only ever holds an empty value (the + # onboarder app that would populate it with a real MISP license key is disabled), + # and an empty MISP key makes the Go esignet service Fatal on startup during plugin + # provider init. Direct value until a real MISP license key is available; replace + # with the actual key. + extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY: "placeholder-misp-key" timeout: 600 priority: -14 hooks: From fed50555a1c31fae638ff366abd62f01f01610e2 Mon Sep 17 00:00:00 2001 From: bhumi46 Date: Thu, 20 Aug 2026 19:08:40 +0530 Subject: [PATCH 61/61] Revert MOSIP_ESIGNET_MISP_KEY placeholder, restore secretKeyRef The secretKeyRef wiring itself is correct and was already there. The reason it wasn't reflecting on the live esignet-mosipid pod is almost certainly the value/valueFrom merge-patch conflict from before (commit acf6b09d) blocking upgrades entirely for that release, not a problem with this specific config. Once the live Deployment is deleted and recreated (as discussed), it should pick up correctly. The secret's value itself is still empty pending either the onboarder being properly wired for mosipid or a real MISP license key being supplied. Signed-off-by: bhumi46 --- Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml index 2927baca0..1529f23fa 100644 --- a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -292,12 +292,8 @@ apps: extraEnvVarsAdditional.LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT: "INFO" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_URL: "http://captcha.captcha" - # Placeholder - esignet-misp-onboarder-key only ever holds an empty value (the - # onboarder app that would populate it with a real MISP license key is disabled), - # and an empty MISP key makes the Go esignet service Fatal on startup during plugin - # provider init. Direct value until a real MISP license key is available; replace - # with the actual key. - extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY: "placeholder-misp-key" + extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY.valueFrom.secretKeyRef.name: "esignet-misp-onboarder-key" + extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY.valueFrom.secretKeyRef.key: "mosip-esignet-misp-key" timeout: 600 priority: -14 hooks: