Repository navigation
Add esignet-standalone-2.0.0 profile (Go eSignet) support - #311
Merged
Merged
Conversation
Isolate signup-captcha secret/env-var for esignet-standalone-2.0.0 (same collision class as the earlier esignet-captcha fix, but live), and revert an over-eager rename of mosip_signup_client_secret since both profiles share the same hardcoded Keycloak client. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
feat(helmsman): add isolated esignet-standalone-2.0.0 profile
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
fix(helmsman): postgres-init-esignet su.secret nil pointer + postgres-init-signup default
Copy keycloak-host/keycloak-env-vars/keycloak/keycloak-client-secrets into the esignet-standalone-2.0.0 namespace, since the shared external-dsf.yaml fan-out hook only targets the original esignet-standalone namespaces. Onboarder apps in this namespace reference these directly. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Fix chart-auto-generated *-share configmap name mismatches (release-name-derived, not part of the original rename token vocabulary), and duplicate the 6 shared utils values files that hardcoded old secret names (esignet-captcha, esignet-softhsm*, softhsm-mock-identity-system) into a new Helmsman/utils/esignet-standalone-2.0.0/ directory, repointing esignet-dsf.yaml at the isolated copies. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
fix(helmsman): copy keycloak resources into esignet-standalone-2.0.0 namespaces
Revert mock-smtp public hostname back to shared smtp.${domain_name} for esignet-standalone-2.0.0, since smtp-2-0-0 was intentionally not added to the terraform DNS subdomain list. Internal cluster-DNS references (mock-smtp-2-0-0.mock-smtp-2-0-0) are unaffected, as they resolve via CoreDNS regardless of any Route53 record.
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
fix(helmsman): revert esignet-standalone-2.0.0 mock-smtp hostname to shared smtp
Rename esignet-mock/mosipid1/mosipid2/sunbird namespaces, Helm release names, and hostnames to esignet-go-* within the esignet-standalone-2.0.0 profile only, dropping the -2-0-0 suffix on every identifier touched. Also renames the base SoftHSM release and captcha secrets/env-vars (esignet-softhsm-2-0-0 -> esignet-softhsm-go, esignet-captcha-2-0-0 -> esignet-captcha-go, softhsm-mock-identity-system-2-0-0 -> softhsm-mock-identity-system-go, plus mosipid1/mosipid2/sunbird equivalents) for consistency with the new naming scheme, and fixes a latent bug where captcha-postinstall.sh created the base captcha secret with suffixed key names that didn't match what the values files expected. Restructures helmsman_esignet.yml's softhsm-upgrade-skip release:namespace pairs from a single suffix variable into an explicit per-profile list, since the 2.0.0 profile's release and namespace names no longer share one common suffix pattern. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Complete the -go rename across the rest of the esignet-standalone-2.0.0 profile: signup-captcha, and every remaining -2-0-0-suffixed namespace, release name, hostname, and Postgres database/user name (signup, kernel services, mock-relying-party base instances, mock-smtp, config-server, mock-identity-system, oidc-ui, softhsm, apitestrig releases, MISP/mock-RP onboarders, and the isolated postgres-init database entries in the shared external-dsf.yaml). Original esignet-standalone profile and its unsuffixed database entries are untouched. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Signed-off-by: bhumi46 <bhumi46@users.noreply.github.com>
fix: rename esignet-mock/mosipid1/mosipid2/sunbird to esignet-go-* in esignet-standalone-2.0.0 (mosip#302)
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <111699703+bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <bhumi46@users.noreply.github.com>
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Fix broken YAML in esignet-plugin-values-2-0-0.yaml: a block of extraEnvVars entries appended by the chart-versions update used 2-space list indentation while the rest of the file's extraEnvVars sequence uses 1-space indentation, causing "did not find expected '-' indicator" on deploy. Re-indented to match. Also removes the OIDC_UI_HOSTNAME entry (sourced from the esignet-global configmap) from the base, mosipid1, and mosipid2 plugin-values files. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…all.sh
The previous {.items[-1:].field} slice-plus-field-access pattern silently
returned nothing in a real run, leaving LATEST_POD empty and no logs
printed after the WARNING. Switch to the standard range+end idiom.
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…isp-onboarder-postinstall.sh --tail=30 alone doesn't say WHY the container died (e.g. OOMKilled vs a normal script failure), forcing a manual kubectl round-trip against the live cluster every time. Print containerStatuses.state/lastState and bump the log tail to 200 lines so the CI output is self-sufficient. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…postinstall.sh Under set -euo pipefail, a genuine kubectl API failure (not just "no jobs/pods found") on either lookup would abort the script before the istio-injection restore ran. Add || true so only istio-injection restore and the diagnostic path run, matching the rest of the script. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
… its result
helm upgrade returns as soon as the Job object is created, not when it
finishes. The real run's diagnostics (added in the previous commit)
showed phase=Running/restartCount=0/lastState={} with newman only one
request into its first folder - the job was never failing, we were
just checking way too early. Poll status.succeeded/status.failed for
up to 10 minutes (configurable via ONBOARDER_JOB_WAIT_TIMEOUT) instead
of checking once immediately.
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
…-ui containers mock_relying_party_ui.AUTHORIZE_ENDPOINT/CODE_CHALLENGE only exist as values.yaml defaults in the mock-relying-party-ui chart - deployment.yaml's env: block hardcodes a specific list of mock_relying_party_ui.* keys and never references these two, so setting them had no effect on the running container. Switch to extraEnvVars.*, which the chart does wire into env:. Verified via helm template that AUTHORIZE_ENDPOINT/CODE_CHALLENGE now render as real container env vars. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
mock_relying_party_service.TOKEN_ENDPOINT/USERINFO_ENDPOINT only exist as values.yaml defaults in the chart - deployment.yaml's env: block never references them, only ESIGNET_SERVICE_URL/ESIGNET_AUD_URL/ CLIENT_PRIVATE_KEY/JWE_USERINFO_PRIVATE_KEY/USERINFO_RESPONSE_TYPE are hardcoded there. Add via extraEnvVars.*, already the pattern this DSF uses for the chart's other keys. Verified via helm template that both render as real container env vars. ESIGNET_AUD_URL is already present and wired correctly (deployment.yaml does reference mock_relying_party_service.ESIGNET_AUD_URL directly) with per-instance domain-parameterized values, so left unchanged. Signed-off-by: bhumi46 <thisisbn46@gmail.com>
HELMSMAN_TESTRIGS_GUIDE.md was updated for the mosipid1/mosipid2 -> mosipid rename but never gained a row for esignet-standalone-2.0.0, even though helmsman_testrigs.yml's profile dropdown already supports it and Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml deploys the exact same apps into the exact same namespaces (only the hook scripts differ). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G1eGZbFM5tT9YS9rcQtwqS Signed-off-by: bhumi46 <thisisbn46@gmail.com>
This was referenced Sep 24, 2026
Replace the generic mosip/apitestrig chart with eSignet's own dedicated mosip/esignet-apitestrig (Go harness) chart, and add mosip/esignet-uitestrig (Java harness) — neither existed in this profile's testrigs-dsf.yaml before, which had just copy-pasted the esignet-standalone (1.0/Java) profile's generic-chart config unmodified. Modeled directly on: https://github.com/mosip/esignet/blob/v2.0.0/deploy/esignet-apitestrig/install.sh https://github.com/mosip/esignet/blob/v2.0.0/deploy/esignet-uitestrig/install.sh - testrigs-dsf.yaml: 3 apitestrig apps (mock/mosipid/sunbird, each in the eSignet instance's own namespace) now use mosip/esignet-apitestrig 2.0.0 with the correct configFile per instance (config.mock/mosip/sunbird.json). 3 new uitestrig apps use mosip/esignet-uitestrig 2.0.0, each in its own namespace (esignet-uitestrig/esignet-mosipid-uitestrig/esignet-sunbird-uitestrig), matching install.sh's own NS/SOURCE_NS split. Only esignet-mosipid (the only instance backed by a real IDA identity) gets real test-identity/onboarding values — esignet-mock and esignet-sunbird need none. - KEYCLOAK_CLIENT_SECRET reuses the existing PMS_CLIENT_SECRET_VALUE convention (same mosip_pms_client_secret key esignet-preinstall-keycloak-init.sh already reads); consent DB password reuses db-common-secrets/db-dbuser-password (same secret helmsman_esignet.yml's own DB-password step reads). Both fetched fresh in new helmsman_testrigs.yml steps since testrigs always run after eSignet DSF has completed. - apitestrig/uitestrig preInstall hooks are now much lighter: the new charts manage their own Secret/ConfigMap from set: values directly, so hooks only need to clean up the old chart's unmanaged CM/secret leftovers (apitestrig) or bootstrap the new namespace (uitestrig) — no more pre-staging secrets. - trigger-test-jobs-esignet.sh now also triggers the 3 new uitestrig namespaces. - helmsman_testrigs.yml: new required Environment secrets/vars for the mosipid-only test identity plus the shared UI-testrig OIDC client, validated up front with a clear error listing what's missing. - docs/HELMSMAN_TESTRIGS_GUIDE.md: documents all of the above — the profile table, the new namespaces, and every new required secret/variable. Report storage uses reports.persistence (PVC) rather than reports.s3 — no established MinIO bucket convention exists yet for these charts in this repo. Signed-off-by: bhumi46 <thisisbn46@gmail.com> Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G1eGZbFM5tT9YS9rcQtwqS
…H Secrets
10 of the 13 new esignet-standalone-2.0.0 testrig values were GitHub Secrets
even though most are just IDs or test identities (UIN/VID/phone/email), not
actual credentials. Demote everything except the three that are genuinely a
password or client secret down to plain Environment Variables:
stays a Secret: MOSIPID_KEYCLOAK_ADMIN_PASSWORD
ESIGNET_UITESTRIG_CLIENT_SECRET
MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD
now a Variable: MOSIPID_TESTRIG_INDIVIDUAL_ID
MOSIPID_TESTRIG_OTP_RECIPIENT
MOSIPID_TESTRIG_UIN
MOSIPID_TESTRIG_VID
MOSIPID_TESTRIG_PHONE_NUMBER
MOSIPID_TESTRIG_EMAIL_LOGIN_ID
MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN
(AUTH_PARTNER_ID/AUTH_POLICY_ID/OIDC_CLIENT_ID were
already Variables)
Updates helmsman_testrigs.yml's job env: block and validation-step labels,
plus the Required Environment Secrets/Variables table in
docs/HELMSMAN_TESTRIGS_GUIDE.md. testrigs-dsf.yaml itself needs no change —
it references these by name only, not by whether GitHub classifies them as
a secret or a variable.
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01G1eGZbFM5tT9YS9rcQtwqS
Member
|
🔗 Linked PR
|
…ck-rp-onboarder first
esignet-mock-rp-onboarder had no onboarding.propertiesOverride.mock-rp-oidc.*
values at all - only generic module/s3/domainConfig config, unlike
esignet-misp-onboarder's own propertiesOverride.esignet.* block. Add the
mock-rp-oidc module's business values (POLICY_NAME, OIDC_CLIENTID,
REDIRECT_URIS, etc.), adapted to this instance with ${domain_name}
substitution in place of the reference's sandbox.mosip.net placeholders.
KEYCLOAK_ADMIN_PASSWORD/KEYCLOAK_CLIENT_SECRET/mosip_pms_client_secret are
deliberately left out of propertiesOverride - putting real credentials in a
committed DSF file would be wrong. They reach the onboarding Job as real
secret env vars instead, via the same extraEnvVarsSecret mechanism
esignet-misp-onboarder already uses - esignet-mock-rp-onboarder-preinstall.sh
already copies both the "keycloak" and "keycloak-client-secrets" secrets into
esignet-mock, but the DSF never actually wired them in via extraEnvVarsSecret
until now.
Also swap priorities so esignet-mock-rp-onboarder (-6) now runs before
esignet-misp-onboarder (-5), reversing the previous order. The two run in
separate namespaces against separate deployments (esignet-mock vs.
esignet-mosipid), so there's no real ordering dependency either way -
comments updated to match.
Signed-off-by: bhumi46 <thisisbn46@gmail.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01G1eGZbFM5tT9YS9rcQtwqS
…thservices-go-mock Use esignet-go-mock/healthservices-go-mock hostnames for LOGO_URI/REDIRECT_URIS/ EXTERNAL_URL instead of the plain esignet/healthservices ones, and tighten the propertiesOverride block's own explanatory comment. Signed-off-by: bhumi46 <thisisbn46@gmail.com> Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G1eGZbFM5tT9YS9rcQtwqS
…on gate The hard "Validate esignet-standalone-2.0.0 testrig secrets/variables" step failed the whole helmsman apply whenever any of the 13 new testrig secrets/vars weren't already configured - which none of them were yet, so every 2.0.0 testrig deploy failed outright. Remove that step, and give every one of those values a changeme fallback (matching eSignet's own testrig values.secret.yaml.example placeholder convention) so deployment always succeeds. A changeme deployment still gets a working apitestrig/uitestrig on its normal cron schedule - real values only need to land before an actual test run, updated in the Environment and picked up on the next trigger, no redeploy required. Also remove trigger-test-jobs-esignet.sh for this profile - it was never actually wired as a postInstall hook anywhere in testrigs-dsf.yaml (the only reference to it was the doc's own, incorrect "fires automatically" claim), and there's no need to trigger cronjobs immediately after deploy - they already run on their own configured schedule. docs/HELMSMAN_TESTRIGS_GUIDE.md updated to match: the secrets/variables table now says "Optional" with the changeme-fallback explanation instead of "Required", and the Post-Deployment section no longer claims esignet-standalone-2.0.0 has an auto-trigger step. Signed-off-by: bhumi46 <thisisbn46@gmail.com> Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G1eGZbFM5tT9YS9rcQtwqS
Member
|
🔗 Linked PR
|
Match mosip#402 (esqa1-DSD-10860, already merged) exactly instead of diverging on my own placeholder choice: - UPDATE_BEFORE_RUN instead of changeme, everywhere. - MOSIPID_KEYCLOAK_ADMIN_PASSWORD gets no fallback at all - it's already a required, properly-configured secret from the earlier onboarder work, so a fake placeholder there would mask a real config gap instead of papering over an expected-empty one. docs/HELMSMAN_TESTRIGS_GUIDE.md updated to match mosip#402's own wording for the same sections. Signed-off-by: bhumi46 <thisisbn46@gmail.com> Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G1eGZbFM5tT9YS9rcQtwqS
ckm007
approved these changes
Sep 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Brings the
esignet-standalone-2.0.0profile (Go-based eSignet instances) fromes-go-testintodevelop, including:Helmsman/dsf/esignet-standalone-2.0.0/DSF files andHelmsman/utils/esignet-standalone-2.0.0/values files for the Go eSignet, OIDC UI, mock-relying-party, and config-server deployments (-go-suffixed namespaces/hostnames, coexisting with the existing v1.7.1esignet-standaloneprofile on shared external infrastructure)esignet-standalone-2.0.0profile option added tohelmsman_esignet.yml,helmsman_testrigs.yml, andhelmsman_signup.ymlesignet-standaloneclusterdocs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md) updated withesignet-standalone-2.0.0instructions alongside the existingesignet-standaloneguideRelated: #2288
Update (2026-09-24)
Since this PR was opened,
esignet-standalone-2.0.0's testrig support was fixed up:testrigs-dsf.yamlnow uses eSignet's own dedicatedmosip/esignet-apitestrig/mosip/esignet-uitestrigcharts (Go/Java testrig harnesses) instead of the genericmosip/apitestrig/mosip/uitestrigcharts it had been copy-pasted from — see feat(helmsman): replace generic apitestrig/uitestrig charts with eSignet's own for esignet-standalone-2.0.0 #392.MOSIPID_KEYCLOAK_ADMIN_PASSWORD,ESIGNET_UITESTRIG_CLIENT_SECRET,MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD) are GitHub Secrets — everything else (test IDs/identities) is a plain Variable.docs/HELMSMAN_TESTRIGS_GUIDE.mddocuments all of the above, including the full secrets/variables table.Test plan
helmsman -f Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml --applydry-run validates cleanlyesignet-standalone-2.0.0profile end to end alongsideesignet-standaloneand confirm no namespace/hostname/captcha collisionsesignet-standaloneprofile applies without drift🤖 Generated with Claude Code
Summary by CodeRabbit