diff --git a/.github/scripts/rancher-grant-cluster-access.sh b/.github/scripts/rancher-grant-cluster-access.sh old mode 100644 new mode 100755 diff --git a/.github/scripts/rancher-register-cluster.sh b/.github/scripts/rancher-register-cluster.sh old mode 100644 new mode 100755 diff --git a/.github/workflows/helmsman_esignet.yml b/.github/workflows/helmsman_esignet.yml index 6410ee885..046af52db 100644 --- a/.github/workflows/helmsman_esignet.yml +++ b/.github/workflows/helmsman_esignet.yml @@ -12,6 +12,7 @@ on: - mosip-platform-1.2.0.x - mosip-platform-1.2.1.x - esignet-standalone + - esignet-standalone-2.0.0 mode: description: "Choose Helmsman mode: dry-run or apply" required: true @@ -38,17 +39,8 @@ on: description: "PostgreSQL port for eSignet databases (e.g. 5433 for MOSIP platform external postgres)" required: true type: string - mosipid1_domain_name: - description: "MOSIP-ID1 domain name for this environment (e.g. mosipenv1.xyz.net)" - required: false - type: string - enable_mosipid2: - description: "Enable MOSIP-ID2 eSignet instance (deploys softhsm, esignet, oidc-ui, mock-rp for mosipid2)" - required: false - default: false - type: boolean - mosipid2_domain_name: - description: "MOSIP-ID2 domain name for this environment (e.g. qabase.xyz.net)" + mosipid_domain_name: + description: "MOSIP-ID domain name for this environment (e.g. mosipenv.xyz.net) — required for esignet standalone profiles" required: false type: string env_name: @@ -88,22 +80,22 @@ jobs: echo "✓ domain_name = $DOMAIN" echo "✓ env_name = $ENV" echo "✓ esignet_db_port = $ESIGNET_DB_PORT" - # mosipid1_domain_name and mosipid2_domain_name are esignet standalone only. + # mosipid_domain_name is esignet standalone only (both esignet-standalone + # and esignet-standalone-2.0.0 each run a single consolidated mosipid instance). # Push events always target esignet (path filter); dispatch uses explicit profile input. - if [ -z "$PROFILE" ] || [ "$PROFILE" = "esignet-standalone" ]; then - MOSIPID1_DOMAIN="${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }}" - MOSIPID2_DOMAIN="${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }}" - echo "✓ mosipid1_domain_name = $MOSIPID1_DOMAIN (esignet standalone)" - echo "✓ mosipid2_domain_name = $MOSIPID2_DOMAIN (esignet standalone)" - MOSIPID1_SPRING_LABEL="${{ vars.ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL }}" - MOSIPID2_SPRING_LABEL="${{ vars.ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL }}" - echo "✓ mosipid1_spring_config_label = ${MOSIPID1_SPRING_LABEL:-develop} (esignet standalone, default: develop)" - echo "✓ mosipid2_spring_config_label = ${MOSIPID2_SPRING_LABEL:-develop} (esignet standalone, default: develop)" + if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then + MOSIPID_DOMAIN="${{ github.event.inputs.mosipid_domain_name || vars.MOSIPID_DOMAIN_NAME }}" + if [ -z "$MOSIPID_DOMAIN" ]; then + echo "❌ mosipid_domain_name is required for standalone profiles" + exit 1 + fi + echo "✓ mosipid_domain_name = $MOSIPID_DOMAIN (esignet standalone)" + MOSIPID_SPRING_LABEL="${{ vars.ESIGNET_MOSIPID_SPRING_CONFIG_LABEL }}" + echo "✓ mosipid_spring_config_label = ${MOSIPID_SPRING_LABEL:-develop} (esignet standalone, default: develop)" else - MOSIPID1_PROVIDED="${{ github.event.inputs.mosipid1_domain_name }}" - MOSIPID2_PROVIDED="${{ github.event.inputs.mosipid2_domain_name }}" - if [ -n "$MOSIPID1_PROVIDED" ] || [ -n "$MOSIPID2_PROVIDED" ]; then - echo "⚠ mosipid1_domain_name / mosipid2_domain_name are only used for esignet standalone profile — ignoring for profile=$PROFILE" + MOSIPID_PROVIDED="${{ github.event.inputs.mosipid_domain_name }}" + if [ -n "$MOSIPID_PROVIDED" ]; then + echo "⚠ mosipid_domain_name is only used for esignet standalone profiles — ignoring for profile=$PROFILE" fi fi @@ -118,10 +110,8 @@ jobs: KUBECTL_PATH: ${{ github.workspace }}/.local/bin/kubectl domain_name: ${{ github.event.inputs.domain_name || vars.DOMAIN_NAME }} esignet_db_port: ${{ github.event.inputs.esignet_db_port || vars.ESIGNET_DB_PORT }} - mosipid1_domain_name: ${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }} - mosipid2_domain_name: ${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }} + mosipid_domain_name: ${{ github.event.inputs.mosipid_domain_name || vars.MOSIPID_DOMAIN_NAME }} env_name: ${{ github.event.inputs.env_name || vars.ENV_NAME }} - MOSIPID2_ENABLED: ${{ github.event.inputs.enable_mosipid2 == 'true' && 'true' || 'false' }} # All secrets below are ENVIRONMENT secrets (not repository secrets) # Configure them in: Repository → Settings → Environments → → Secrets # Mock Relying Party Service secrets (base64 encoded PEM) @@ -130,23 +120,18 @@ jobs: # eSignet Captcha secrets (plain text from Google reCAPTCHA) ESIGNET_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_CAPTCHA_SITE_KEY }} ESIGNET_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_CAPTCHA_SECRET_KEY }} - # Per-namespace captcha secrets — required for esignet standalone profile only - ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY }} - ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY }} - ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY }} - ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY }} - # MOSIPID1 / MOSIPID2 remote Keycloak admin + Postgres passwords - MOSIPID1_KEYCLOAK_ADMIN_PASSWORD: ${{ secrets.MOSIPID1_KEYCLOAK_ADMIN_PASSWORD }} - MOSIPID2_KEYCLOAK_ADMIN_PASSWORD: ${{ secrets.MOSIPID2_KEYCLOAK_ADMIN_PASSWORD }} - MOSIPID1_POSTGRES_PASSWORD: ${{ secrets.MOSIPID1_POSTGRES_PASSWORD }} - MOSIPID2_POSTGRES_PASSWORD: ${{ secrets.MOSIPID2_POSTGRES_PASSWORD }} + # mosipid captcha secret — required for esignet standalone profiles + ESIGNET_MOSIPID_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_MOSIPID_CAPTCHA_SITE_KEY }} + ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY }} + # MOSIPID remote Keycloak admin + Postgres password (esignet standalone profiles) + MOSIPID_KEYCLOAK_ADMIN_PASSWORD: ${{ secrets.MOSIPID_KEYCLOAK_ADMIN_PASSWORD }} + MOSIPID_POSTGRES_PASSWORD: ${{ secrets.MOSIPID_POSTGRES_PASSWORD }} ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY: ${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY }} ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY: ${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY }} # Spring config label per namespace — controls which Git branch/tag the config-server uses # Set as Environment Variables in Repository → Settings → Environments → → Variables # If unset, hooks default to 'develop' - ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL: ${{ vars.ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL }} - ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL: ${{ vars.ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL }} + ESIGNET_MOSIPID_SPRING_CONFIG_LABEL: ${{ vars.ESIGNET_MOSIPID_SPRING_CONFIG_LABEL }} # Cluster access secrets KUBECONFIG_SECRET: ${{ secrets.KUBECONFIG }} CLUSTER_WIREGUARD_WG0: ${{ secrets.CLUSTER_WIREGUARD_WG0 }} @@ -189,8 +174,7 @@ jobs: } save_var "DOMAIN_NAME" "${{ github.event.inputs.domain_name }}" save_var "ESIGNET_DB_PORT" "${{ github.event.inputs.esignet_db_port }}" - save_var "MOSIPID1_DOMAIN_NAME" "${{ github.event.inputs.mosipid1_domain_name }}" - save_var "MOSIPID2_DOMAIN_NAME" "${{ github.event.inputs.mosipid2_domain_name }}" + save_var "MOSIPID_DOMAIN_NAME" "${{ github.event.inputs.mosipid_domain_name }}" save_var "ENV_NAME" "${{ github.event.inputs.env_name }}" - name: Mask sensitive data @@ -202,10 +186,8 @@ jobs: echo "::add-mask::${{ secrets.CLUSTER_WIREGUARD_WG0 }}" echo "::add-mask::${{ secrets.ESIGNET_CAPTCHA_SITE_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_CAPTCHA_SECRET_KEY }}" - echo "::add-mask::${{ secrets.ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY }}" - echo "::add-mask::${{ secrets.ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY }}" - echo "::add-mask::${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY }}" - echo "::add-mask::${{ secrets.ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY }}" + echo "::add-mask::${{ secrets.ESIGNET_MOSIPID_CAPTCHA_SITE_KEY }}" + echo "::add-mask::${{ secrets.ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY }}" @@ -325,7 +307,7 @@ jobs: kubectl cluster-info - name: Check if mosip-dsf label is completed - if: ${{ github.event.inputs.skip_mosip_dsf_check != 'true' && vars.ESIGNET_STANDALONE_MODE != 'true' && github.event.inputs.profile != 'esignet-standalone' }} + if: ${{ github.event.inputs.skip_mosip_dsf_check != 'true' && vars.ESIGNET_STANDALONE_MODE != 'true' && !startsWith(env.PROFILE, 'esignet-standalone') }} run: | STATUS=$(kubectl get namespace default -o jsonpath='{.metadata.labels.mosip-dsf}' 2>/dev/null || echo "") if [[ "$STATUS" != "completed" ]]; then @@ -379,10 +361,10 @@ jobs: echo "✅ ESIGNET_CAPTCHA_SECRET_KEY is configured" fi - # Per-namespace captcha secrets — only required for esignet standalone profile - if [ "$PROFILE" = "esignet-standalone" ]; then - echo "--- Validating esignet standalone mosipid1 captcha secrets ---" - for var in ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY \ + # Per-namespace captcha secrets — only required for esignet standalone profiles + if [[ "$PROFILE" == esignet-standalone* ]]; then + echo "--- Validating esignet standalone mosipid captcha secrets ---" + for var in ESIGNET_MOSIPID_CAPTCHA_SITE_KEY ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY \ ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY; do val="${!var:-}" if [ -z "$val" ]; then @@ -392,8 +374,8 @@ jobs: echo "✅ $var is configured" fi done - echo "--- Validating esignet standalone mosipid1 postgres + keycloak secrets ---" - for var in MOSIPID1_POSTGRES_PASSWORD MOSIPID1_KEYCLOAK_ADMIN_PASSWORD; do + echo "--- Validating esignet standalone mosipid postgres + keycloak secrets ---" + for var in MOSIPID_POSTGRES_PASSWORD MOSIPID_KEYCLOAK_ADMIN_PASSWORD; do val="${!var:-}" if [ -z "$val" ]; then echo "❌ $var secret is not configured (required for esignet standalone)" @@ -402,21 +384,6 @@ jobs: echo "✅ $var is configured" fi done - if [ "$MOSIPID2_ENABLED" = "true" ]; then - echo "--- Validating mosipid2 captcha + postgres + keycloak secrets ---" - for var in ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY \ - MOSIPID2_POSTGRES_PASSWORD MOSIPID2_KEYCLOAK_ADMIN_PASSWORD; do - val="${!var:-}" - if [ -z "$val" ]; then - echo "❌ $var secret is not configured (required when enable_mosipid2=true)" - MISSING_SECRETS=1 - else - echo "✅ $var is configured" - fi - done - else - echo "ℹ mosipid2 disabled — skipping mosipid2 secret validation" - fi fi if [ "$MISSING_SECRETS" -eq 1 ]; then @@ -431,14 +398,10 @@ jobs: echo " - MOCK_RELYING_PARTY_JWE_PRIVATE_KEY (base64 encoded PEM)" echo " - ESIGNET_CAPTCHA_SITE_KEY (reCAPTCHA site key - plain text)" echo " - ESIGNET_CAPTCHA_SECRET_KEY (reCAPTCHA secret key - plain text)" - if [ "$PROFILE" = "esignet-standalone" ]; then - echo " - ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY / ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY" + if [[ "$PROFILE" == esignet-standalone* ]]; then + echo " - ESIGNET_MOSIPID_CAPTCHA_SITE_KEY / ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY" echo " - ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY / ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY" - echo " - MOSIPID1_POSTGRES_PASSWORD / MOSIPID1_KEYCLOAK_ADMIN_PASSWORD" - if [ "$MOSIPID2_ENABLED" = "true" ]; then - echo " - ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY / ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY" - echo " - MOSIPID2_POSTGRES_PASSWORD / MOSIPID2_KEYCLOAK_ADMIN_PASSWORD" - fi + echo " - MOSIPID_POSTGRES_PASSWORD / MOSIPID_KEYCLOAK_ADMIN_PASSWORD" fi exit 1 fi @@ -472,7 +435,7 @@ jobs: fi - name: Get MinIO root password - if: ${{ env.PROFILE == 'esignet-standalone' }} + if: ${{ startsWith(env.PROFILE, 'esignet-standalone') }} run: | MINIO_ROOT_PASSWORD=$(kubectl -n minio get secret minio -o jsonpath='{.data.root-password}' | base64 -d) if [ -n "$MINIO_ROOT_PASSWORD" ]; then @@ -540,8 +503,7 @@ jobs: - name: Show deployment variables run: | echo "domain_name = $domain_name" - echo "mosipid1_domain_name = $mosipid1_domain_name" - echo "mosipid2_domain_name = $mosipid2_domain_name" + echo "mosipid_domain_name = $mosipid_domain_name" echo "env_name = $env_name" - name: Initiate helmsman to apply the DSF configurations @@ -579,9 +541,10 @@ jobs: # they read the new PIN but the PVC token has the old one → CKR_PIN_INCORRECT. # Fix: skip softhsm upgrade on re-runs so the PIN in the secret never changes. SKIP_RELEASES_ARG="" - if [ "$PROFILE" = "esignet-standalone" ]; then + if [[ "$PROFILE" == esignet-standalone* ]]; then + SOFTHSM_PAIRS=("esignet-softhsm:esignet-mock" "esignet-softhsm-mosipid:esignet-mosipid" "esignet-softhsm-sunbird:esignet-sunbird") SKIP_RELEASES="" - for pair in "esignet-softhsm:esignet-mock" "esignet-softhsm-mosipid1:esignet-mosipid1" "esignet-softhsm-mosipid2:esignet-mosipid2" "esignet-softhsm-sunbird:esignet-sunbird"; do + for pair in "${SOFTHSM_PAIRS[@]}"; do release="${pair%%:*}" ns="${pair##*:}" if helm status "$release" -n "$ns" &>/dev/null; then @@ -620,7 +583,7 @@ jobs: echo "Commit: ${{ github.sha }}" echo "" echo "Namespaces created/updated:" - kubectl get ns esignet-mock esignet-mosipid1 esignet-mosipid2 esignet-sunbird softhsm keycloak redis postgres 2>/dev/null || echo "Some namespaces may not exist yet" + kubectl get ns esignet-mock esignet-mosipid esignet-sunbird softhsm keycloak redis postgres 2>/dev/null || echo "Some namespaces may not exist yet" echo "" echo "eSignet pods status:" kubectl get pods -n esignet-mock 2>/dev/null || echo "esignet-mock namespace not ready" diff --git a/.github/workflows/helmsman_external.yml b/.github/workflows/helmsman_external.yml index 1700a13e7..fb011f045 100644 --- a/.github/workflows/helmsman_external.yml +++ b/.github/workflows/helmsman_external.yml @@ -224,9 +224,6 @@ jobs: - name: Mask sensitive secrets run: | - MINIO_ROOT_PASSWORD=$(kubectl -n minio get secret minio -o jsonpath='{.data.root-password}' 2>/dev/null | base64 -d || true) - if [ -n "$MINIO_ROOT_PASSWORD" ]; then echo "::add-mask::$MINIO_ROOT_PASSWORD"; fi - echo "MINIO_ROOT_PASSWORD=$MINIO_ROOT_PASSWORD" >> $GITHUB_ENV echo "::add-mask::${{ secrets.ESIGNET_CAPTCHA_SITE_KEY }}" echo "::add-mask::${{ secrets.ESIGNET_CAPTCHA_SECRET_KEY }}" echo "::add-mask::${{ secrets.PREREG_CAPTCHA_SITE_KEY }}" @@ -337,8 +334,20 @@ jobs: kubectl get nodes kubectl cluster-info - # Test istioctl functionality + # Test istioctl functionality istioctl version --remote=false + + - name: Fetch and mask minio root password + run: | + # Must run after WireGuard/kubeconfig are up - kubectl needs cluster + # access to look up the existing secret. Fetching this earlier (as + # part of "Mask sensitive secrets", before the tunnel is up) always + # returned empty, which then failed minio's helm upgrade with + # "auth.rootPassword must not be empty". + MINIO_ROOT_PASSWORD=$(kubectl -n minio get secret minio -o jsonpath='{.data.root-password}' 2>/dev/null | base64 -d || true) + if [ -n "$MINIO_ROOT_PASSWORD" ]; then echo "::add-mask::$MINIO_ROOT_PASSWORD"; fi + echo "MINIO_ROOT_PASSWORD=$MINIO_ROOT_PASSWORD" >> $GITHUB_ENV + - name: Export keycloak client secrets for esignet-keycloak-init if: contains(matrix.dsf_files, 'esignet-standalone/external-dsf.yaml') run: | diff --git a/.github/workflows/helmsman_signup.yml b/.github/workflows/helmsman_signup.yml index 5322df2e0..ff770b1ff 100644 --- a/.github/workflows/helmsman_signup.yml +++ b/.github/workflows/helmsman_signup.yml @@ -10,6 +10,7 @@ on: type: choice options: - esignet-standalone + - esignet-standalone-2.0.0 - mosip-platform-1.2.0.x - mosip-platform-1.2.1.x mode: diff --git a/.github/workflows/helmsman_testrigs.yml b/.github/workflows/helmsman_testrigs.yml index 63aa58462..c809c67a9 100644 --- a/.github/workflows/helmsman_testrigs.yml +++ b/.github/workflows/helmsman_testrigs.yml @@ -12,6 +12,7 @@ on: - mosip-platform-1.2.0.x - mosip-platform-1.2.1.x - esignet-standalone + - esignet-standalone-2.0.0 mode: description: "Choose Helmsman mode: dry-run or apply" required: true @@ -24,12 +25,8 @@ on: description: "Domain name for this environment (e.g. example.xyz.net)" required: true type: string - mosipid1_domain_name: - description: "MOSIP-ID1 domain name (e.g. mosipenv1.xyz.net) — required for esignet profile" - required: false - type: string - mosipid2_domain_name: - description: "MOSIP-ID2 domain name (e.g. mosipenv2.xyz.net) — required for esignet profile" + mosipid_domain_name: + description: "MOSIP-ID domain name (e.g. mosipenv.xyz.net) — required for esignet standalone profiles" required: false type: string db_port: @@ -67,6 +64,9 @@ jobs: name: ${{ github.ref_name }} steps: - name: Validate required variables + env: + IN_MOSIPID_DOMAIN: ${{ github.event.inputs.mosipid_domain_name }} + VAR_MOSIPID_DOMAIN: ${{ vars.MOSIPID_DOMAIN_NAME }} run: | errors=() PROFILE="${{ github.event.inputs.profile }}" @@ -80,12 +80,6 @@ jobs: [ -z "$SLACK_CH" ] && errors+=("slack_channel_name is empty — set vars.SLACK_CHANNEL_NAME under Environment '${{ github.ref_name }}'") [ -z "$DB_PORT" ] && errors+=("db_port is empty — set vars.DB_PORT under Environment '${{ github.ref_name }}'") [ -z "$ESIGNET_DB_PORT" ] && errors+=("esignet_db_port is empty — set vars.ESIGNET_DB_PORT under Environment '${{ github.ref_name }}'") - if [ -z "$PROFILE" ] || [ "$PROFILE" = "esignet-standalone" ]; then - MOSIPID1_DOMAIN="${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }}" - MOSIPID2_DOMAIN="${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }}" - [ -z "$MOSIPID1_DOMAIN" ] && errors+=("mosipid1_domain_name is empty — set vars.MOSIPID1_DOMAIN_NAME under Environment '${{ github.ref_name }}'") - [ -z "$MOSIPID2_DOMAIN" ] && errors+=("mosipid2_domain_name is empty — set vars.MOSIPID2_DOMAIN_NAME under Environment '${{ github.ref_name }}'") - fi if [ ${#errors[@]} -gt 0 ]; then echo "❌ Required variables missing:" printf ' - %s\n' "${errors[@]}" @@ -97,9 +91,21 @@ jobs: echo "✓ slack_channel_name = $SLACK_CH" echo "✓ db_port = $DB_PORT" echo "✓ esignet_db_port = $ESIGNET_DB_PORT" - if [ -z "$PROFILE" ] || [ "$PROFILE" = "esignet-standalone" ]; then - echo "✓ mosipid1_domain_name = $MOSIPID1_DOMAIN (esignet profile)" - echo "✓ mosipid2_domain_name = $MOSIPID2_DOMAIN (esignet profile)" + # mosipid_domain_name is esignet standalone only (both esignet-standalone + # and esignet-standalone-2.0.0 each run a single consolidated mosipid instance). + # Push events always target the esignet profile (path filter); dispatch uses explicit profile input. + if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then + MOSIPID_DOMAIN="${IN_MOSIPID_DOMAIN:-$VAR_MOSIPID_DOMAIN}" + if [ -z "$MOSIPID_DOMAIN" ]; then + echo "❌ mosipid_domain_name is required for standalone profiles" + exit 1 + fi + echo "✓ mosipid_domain_name = $MOSIPID_DOMAIN (esignet standalone)" + else + MOSIPID_PROVIDED="$IN_MOSIPID_DOMAIN" + if [ -n "$MOSIPID_PROVIDED" ]; then + echo "⚠ mosipid_domain_name is only used for esignet standalone profiles — ignoring for profile=$PROFILE" + fi fi deploy: @@ -112,13 +118,43 @@ jobs: PATH: ${{ github.workspace }}/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin KUBECTL_PATH: ${{ github.workspace }}/.local/bin/kubectl domain_name: ${{ github.event.inputs.domain_name || vars.DOMAIN_NAME }} - mosipid1_domain_name: ${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }} - mosipid2_domain_name: ${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }} + mosipid_domain_name: ${{ github.event.inputs.mosipid_domain_name || vars.MOSIPID_DOMAIN_NAME }} db_port: ${{ github.event.inputs.db_port || vars.DB_PORT }} esignet_db_port: ${{ github.event.inputs.esignet_db_port || vars.ESIGNET_DB_PORT }} env_name: ${{ github.event.inputs.env_name || vars.ENV_NAME }} slack_channel_name: ${{ github.event.inputs.slack_channel_name || vars.SLACK_CHANNEL_NAME }} SLACK_WEBHOOK_URL: ${{ github.event.inputs.slack_webhook_url || secrets.SLACK_WEBHOOK_URL }} + # esignet-standalone-2.0.0 only — esignet-apitestrig/esignet-uitestrig (the Go/Java + # rewrite testrig charts, replacing the generic apitestrig/uitestrig charts for this + # profile). Reused across all 3 instances (mock/mosipid/sunbird), same as + # mock-relying-party-service's own CLIENT_ID constant in esignet-dsf.yaml. + # Only actual credentials (passwords/client secrets) are GitHub Secrets below — + # everything else (IDs, test identities) is a plain Environment Variable. + # + # These testrig-only values are optional for deployment: when unset they default to + # the UPDATE_BEFORE_RUN placeholder so Helmsman can deploy the testrigs; set the real + # values in the testrig configmaps/secrets before triggering the cronjobs. + ESIGNET_UITESTRIG_OIDC_CLIENT_ID: ${{ vars.ESIGNET_UITESTRIG_OIDC_CLIENT_ID || 'UPDATE_BEFORE_RUN' }} + ESIGNET_UITESTRIG_CLIENT_SECRET: ${{ secrets.ESIGNET_UITESTRIG_CLIENT_SECRET || 'UPDATE_BEFORE_RUN' }} + # Single shared Keycloak admin password (one mosip/keycloak release for the whole + # profile — see external-dsf.yaml) — already provisioned for the MISP onboarder, so + # no placeholder fallback here: an empty value means the real one genuinely went + # missing, not that it was never expected to exist yet. + MOSIPID_KEYCLOAK_ADMIN_PASSWORD: ${{ secrets.MOSIPID_KEYCLOAK_ADMIN_PASSWORD }} + # esignet-mosipid apitestrig/uitestrig only — config.mosip.json (apitestrig) and the + # MOSIP-ID plugin path (uitestrig) are the only ones backed by a real IDA identity, so + # these are the only instance that needs real test-identity/onboarding values. esignet-mock + # (config.mock.json) and esignet-sunbird (config.sunbird.json) need none of this. + MOSIPID_TESTRIG_INDIVIDUAL_ID: ${{ vars.MOSIPID_TESTRIG_INDIVIDUAL_ID || 'UPDATE_BEFORE_RUN' }} + MOSIPID_TESTRIG_OTP_RECIPIENT: ${{ vars.MOSIPID_TESTRIG_OTP_RECIPIENT || 'UPDATE_BEFORE_RUN' }} + MOSIPID_TESTRIG_AUTH_PARTNER_ID: ${{ vars.MOSIPID_TESTRIG_AUTH_PARTNER_ID || 'UPDATE_BEFORE_RUN' }} + MOSIPID_TESTRIG_AUTH_POLICY_ID: ${{ vars.MOSIPID_TESTRIG_AUTH_POLICY_ID || 'UPDATE_BEFORE_RUN' }} + MOSIPID_TESTRIG_UIN: ${{ vars.MOSIPID_TESTRIG_UIN || 'UPDATE_BEFORE_RUN' }} + MOSIPID_TESTRIG_VID: ${{ vars.MOSIPID_TESTRIG_VID || 'UPDATE_BEFORE_RUN' }} + MOSIPID_TESTRIG_PHONE_NUMBER: ${{ vars.MOSIPID_TESTRIG_PHONE_NUMBER || 'UPDATE_BEFORE_RUN' }} + MOSIPID_TESTRIG_EMAIL_LOGIN_ID: ${{ vars.MOSIPID_TESTRIG_EMAIL_LOGIN_ID || 'UPDATE_BEFORE_RUN' }} + MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN: ${{ vars.MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN || 'UPDATE_BEFORE_RUN' }} + MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD: ${{ secrets.MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD || 'UPDATE_BEFORE_RUN' }} steps: - name: Checkout repository uses: actions/checkout@v4 @@ -156,8 +192,7 @@ jobs: fi } save_var "DOMAIN_NAME" "${{ github.event.inputs.domain_name }}" - save_var "MOSIPID1_DOMAIN_NAME" "${{ github.event.inputs.mosipid1_domain_name }}" - save_var "MOSIPID2_DOMAIN_NAME" "${{ github.event.inputs.mosipid2_domain_name }}" + save_var "MOSIPID_DOMAIN_NAME" "${{ github.event.inputs.mosipid_domain_name }}" save_var "DB_PORT" "${{ github.event.inputs.db_port }}" save_var "ESIGNET_DB_PORT" "${{ github.event.inputs.esignet_db_port }}" save_var "ENV_NAME" "${{ github.event.inputs.env_name }}" @@ -276,7 +311,7 @@ jobs: kubectl get nodes kubectl cluster-info - name: Get MinIO root password (esignet profile) - if: env.PROFILE == 'esignet-standalone' + if: startsWith(env.PROFILE, 'esignet-standalone') run: | if kubectl -n minio get secret minio &>/dev/null; then MINIO_ROOT_PASSWORD=$(kubectl -n minio get secret minio -o jsonpath='{.data.root-password}' | base64 -d) @@ -291,8 +326,44 @@ jobs: echo "❌ secret minio not found in minio namespace"; exit 1 fi + - name: Get PMS client secret (esignet-standalone-2.0.0 apitestrig) + if: env.PROFILE == 'esignet-standalone-2.0.0' + run: | + # esignet-apitestrig's KEYCLOAK_CLIENT_SECRET is the same mosip-pms-client secret + # esignet-preinstall-keycloak-init.sh/esignet-postinstall-keycloak-init.sh already use + # (PMS_CLIENT_SECRET_KEY='mosip_pms_client_secret') — by the time testrigs run, eSignet + # DSF has already completed, so keycloak-client-secrets is guaranteed to exist. + if ! kubectl -n keycloak get secret keycloak-client-secrets &>/dev/null; then + echo "❌ keycloak-client-secrets not found in keycloak namespace"; exit 1 + fi + PMS_CLIENT_SECRET_VALUE=$(kubectl -n keycloak get secret keycloak-client-secrets \ + -o jsonpath='{.data.mosip_pms_client_secret}' | base64 -d) + if [ -z "$PMS_CLIENT_SECRET_VALUE" ]; then + echo "❌ mosip_pms_client_secret is empty in keycloak-client-secrets"; exit 1 + fi + echo "::add-mask::$PMS_CLIENT_SECRET_VALUE" + echo "PMS_CLIENT_SECRET_VALUE=$PMS_CLIENT_SECRET_VALUE" >> $GITHUB_ENV + echo "✅ PMS_CLIENT_SECRET_VALUE retrieved" + + - name: Get consent DB password (esignet-standalone-2.0.0 uitestrig) + if: env.PROFILE == 'esignet-standalone-2.0.0' + run: | + # esignet-uitestrig's esignetDbPassword — same db-common-secrets/db-dbuser-password + # helmsman_esignet.yml's own "Get DB User Password" step already reads. + if ! kubectl -n postgres get secret db-common-secrets &>/dev/null; then + echo "❌ db-common-secrets not found in postgres namespace"; exit 1 + fi + DB_USER_PASSWORD=$(kubectl -n postgres get secret db-common-secrets \ + -o jsonpath='{.data.db-dbuser-password}' | base64 -d) + if [ -z "$DB_USER_PASSWORD" ]; then + echo "❌ db-dbuser-password is empty in db-common-secrets"; exit 1 + fi + echo "::add-mask::$DB_USER_PASSWORD" + echo "DB_USER_PASSWORD=$DB_USER_PASSWORD" >> $GITHUB_ENV + echo "✅ DB_USER_PASSWORD retrieved" + - name: Check if mosip-dsf label is completed - if: env.PROFILE != 'esignet-standalone' + if: ${{ !startsWith(env.PROFILE, 'esignet-standalone') }} run: | STATUS=$(kubectl get namespace default -o jsonpath='{.metadata.labels.mosip-dsf}') if [[ "$STATUS" != "completed" ]]; then @@ -301,7 +372,7 @@ jobs: fi - name: Check if esignet-dsf label is completed - if: env.PROFILE == 'esignet-standalone' + if: startsWith(env.PROFILE, 'esignet-standalone') run: | STATUS=$(kubectl get namespace default -o jsonpath='{.metadata.labels.esignet-dsf}' 2>/dev/null || echo "") if [[ "$STATUS" != "completed" ]]; then diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml new file mode 100644 index 000000000..69562adfb --- /dev/null +++ b/Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml @@ -0,0 +1,899 @@ +# ============================================================================= +# eSignet Profile - eSignet Services DSF (Desired State File) +# ============================================================================= +# This DSF deploys eSignet 2.0.0 (Go) services for the standalone eSignet profile. +# +# Components (in priority order): +# 1. Keycloak Init (eSignet-specific clients and roles) +# 2. eSignet service 2.0.0-develop (Go) +# 3. OIDC UI 2.0.0-develop (Go) +# 4. Mock Identity System (optional, disabled by default) +# 5. Mock Relying Party Service (optional) +# 6. Mock Relying Party UI (optional) +# 7. Partner Onboarder (eSignet + Resident OIDC) +# 8. Demo OIDC Partner Onboarder +# +# Based on eSignet 2.0.0 deploy scripts: +# - install-esignet.sh +# - initialise-prereq.sh (keycloak-init) +# ============================================================================= + +helmDefaults: + tillerNamespace: kube-system + tillerless: true + install: true + +helmRepos: + bitnami: https://charts.bitnami.com/bitnami + mosip: https://mosip.github.io/mosip-helm + +namespaces: + esignet-mock: + protected: false + softhsm: + protected: false + esignet-mosipid: + protected: false + esignet-sunbird: + protected: false + +apps: + # --------------------------------------------------------------------------- + # SoftHSM for eSignet + # --------------------------------------------------------------------------- + # Deployed here (not in external-dsf) so esignet-softhsm-share configmap is + # available in esignet namespace before eSignet service starts. + esignet-softhsm: + namespace: esignet-mock + enabled: true + version: 12.0.1 + chart: mosip/softhsm + valuesFile: "$WORKDIR/utils/softhsm-esignet-values.yaml" + timeout: 480 + priority: -16 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh" + + esignet-softhsm-mosipid: + namespace: esignet-mosipid + enabled: true + version: 12.0.1 + chart: mosip/softhsm + valuesFile: "$WORKDIR/utils/softhsm-esignet-mosipid-values.yaml" + timeout: 480 + priority: -16 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid-setup.sh" + + esignet-softhsm-sunbird: + namespace: esignet-sunbird + enabled: true + version: 12.0.1 + chart: mosip/softhsm + valuesFile: "$WORKDIR/utils/softhsm-esignet-sunbird-values.yaml" + timeout: 480 + priority: -16 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh" + + # --------------------------------------------------------------------------- + # eSignet + # --------------------------------------------------------------------------- + esignet-mock: + namespace: esignet-mock + enabled: true + version: 2.0.0-develop + chart: mosip/esignet + set: + image.repository: "mosipqa/esignet" + image.tag: "2.0.x" + enable_insecure: "false" + springConfigNameEnv: "" + activeProfileEnv: "" + pluginNameEnv: "esignet-mock-plugin.jar" + pluginUrlEnv: "" + extraEnvVarsCM[0]: "esignet-softhsm-share" + #extraEnvVarsCM[1]: "kafka-config" + metrics.serviceMonitor.enabled: "false" + domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" + domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" + domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" + domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" + domainConfig.installation-domain: "${domain_name}" + domainConfig.OIDC_UI_HOSTNAME: "esignet.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup.${domain_name}" + domainConfig.MOSIP_ESIGNET_BASE_URL: "https://esignet.${domain_name}/v1/esignet" + # Single-quoted YAML + two literal backslashes before the dot: strvals (Helm's --set + # parser) consumes one backslash as its own escape character, leaving exactly one in + # the final value - a bare "\." here would be silently dropped, and an unescaped "." + # would match any character instead of a literal dot. Verified via helm template. + extraEnvVars.MOSIP_ESIGNET_CORS_ALLOWED_ORIGIN_REGEX: '^https?://[^./]+\\.${domain_name}$' + # esignet-mock has no esignet-global configmap (only the mosipid/sunbird preinstall + # hooks create their own per-namespace esignet-global) - these chart-default extraEnvVars + # entries are tables (valueFrom.configMapKeyRef against esignet-global), so a plain + # string override at the same key produces a "cannot overwrite table with non table" + # coalesce warning (harmless on its own, but risks masking real errors in Helmsman's + # truncated output) and would still fail with CreateContainerConfigError if left as the + # chart default. Null them out entirely instead - MOSIP_API_INTERNAL_HOST/MOSIP_ESIGNET_HOST/ + # MOSIP_SIGNUP_HOST now come from domainConfig (above); MOSIP_ESIGNET_OIDC_UI_HOSTNAME has + # no domainConfig equivalent key so it's set via extraEnvVarsAdditional instead (renders + # after extraEnvVars, no chart-default table to conflict with). "null" (quoted) is + # required: Helmsman's YAML parsing turns a bare `null` into an empty string, not the + # literal text Helm needs to delete a key. + extraEnvVars.MOSIP_API_INTERNAL_HOST: "null" + extraEnvVars.MOSIP_ESIGNET_OIDC_UI_HOSTNAME: "null" + extraEnvVars.MOSIP_ESIGNET_HOST: "null" + extraEnvVars.MOSIP_SIGNUP_HOST: "null" + extraEnvVarsAdditional.MOSIP_ESIGNET_OIDC_UI_HOSTNAME: "esignet.${domain_name}" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignet" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_PROVIDER: "google-recaptcha" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_VALIDATOR_URL: "http://captcha.captcha/v1/captcha/validatecaptcha" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.key: "redis-port" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.name: "redis" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.key: "redis-password" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.key: "database-host" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.key: "database-port" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.key: "database-name" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" + extraEnvVars.MOSIP_ESIGNET_AUTHN_PROVIDER: "mock" + extraEnvVars.MOSIP_ESIGNET_MOCK_DOMAIN_URL: "http://mock-identity-system.esignet-mock" + extraEnvVars.NAMESPACE: "mock" + extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" + persistence.enabled: "true" + persistence.pvc_claim_name: "esignet-mock-pkcs12-keystore" + extraEnvVars.OIDC_UI_SCHEME: "https" + extraEnvVars.OIDC_UI_PORT: "443" + extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" + extraEnvVars.OIDC_UI_ERROR_PATH: "/error" + extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" + extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" + extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" + # Overridden directly under extraEnvVars (not extraEnvVarsAdditional) so the + # chart's own PKCS11 defaults for these same keys don't also render into the + # env: list - relying on extraEnvVarsAdditional's last-wins ordering left the + # redundant PKCS11 entries (module path, token label, slot id, PIN secretKeyRef) + # coexisting alongside these, which happened to still work here (esignet-softhsm + # secret exists in this namespace) but is fragile and confusing. + extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS12" + extraEnvVars.KEYMANAGER_PKCS12_FILE_PATH: "/home/mosip/config/keystore.p12" + extraEnvVars.KEYMANAGER_PKCS12_PASSWORD: "localtest" + extraEnvVars.KEYMANAGER_PKCS12_ALLOW_INSECURE_SOFTWARE_KEYSTORE: "true" + extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "" + extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "" + # KEYMANAGER_PKCS11_PIN's chart default is a table (valueFrom.secretKeyRef), unlike the + # three plain-string defaults above - an empty-string override here still triggers the + # coalesce "cannot overwrite table with non table" warning, so null it out instead. + extraEnvVars.KEYMANAGER_PKCS11_PIN: "null" + timeout: 600 + priority: -14 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh" + postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh" + + esignet-mosipid: + namespace: esignet-mosipid + enabled: true + version: 2.0.0-develop + chart: mosip/esignet + set: + image.repository: "mosipqa/esignet" + image.tag: "2.0.x" + enable_insecure: "false" + springConfigNameEnv: "" + activeProfileEnv: "" + pluginNameEnv: "mosip-identity-plugin.jar" + pluginUrlEnv: "" + extraEnvVarsCM[0]: "esignet-softhsm-mosipid-share" + metrics.serviceMonitor.enabled: "false" + domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" + domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" + domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" + domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" + domainConfig.installation-domain: "${domain_name}" + domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid_domain_name}" + domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid_domain_name}" + domainConfig.IDA_INTERNAL_URL: "https://api-internal.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL: "https://api-internal.${mosipid_domain_name}/mosip-certs/ida-partner.cer" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid_domain_name}/v1/authmanager/authenticate/clientidsecretkey" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid_domain_name}/v1/auditmanager/audits" + domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-mosipid.${domain_name}" + domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-mosipid.${domain_name}" + domainConfig.OIDC_UI_HOSTNAME: "esignet-mosipid.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-mosipid.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup-mosipid.${domain_name}" + domainConfig.MOSIP_ESIGNET_BASE_URL: "https://esignet-mosipid.${domain_name}/v1/esignet" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${mosipid_domain_name}" + # Single-quoted YAML + two literal backslashes before the dot: strvals (Helm's --set + # parser) consumes one backslash as its own escape character, leaving exactly one in + # the final value - a bare "\." here would be silently dropped, and an unescaped "." + # would match any character instead of a literal dot. Verified via helm template. + extraEnvVars.MOSIP_ESIGNET_CORS_ALLOWED_ORIGIN_REGEX: '^https?://[^./]+\\.${domain_name}$' + # Chart-default extraEnvVars.MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/MOSIP_API_INTERNAL_HOST + # are tables (valueFrom.configMapKeyRef against esignet-global). A plain string override + # at the same key produces a "cannot overwrite table with non table" coalesce warning + # (harmless on its own, but noisy) and still leaves domainConfig's own same-named entry + # as a genuinely separate list item - so null the chart-default keys out entirely + # instead, letting domainConfig (above) be the sole source, matching the pattern used + # for KEYMANAGER_PKCS11_* elsewhere in this file. "null" (quoted) is required: Helmsman's + # YAML parsing turns a bare `null` into an empty string, not the literal text Helm needs + # to delete a key. + extraEnvVars.MOSIP_ESIGNET_HOST: "null" + extraEnvVars.MOSIP_SIGNUP_HOST: "null" + extraEnvVars.MOSIP_API_INTERNAL_HOST: "null" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.key: "redis-port" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.name: "redis" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.key: "redis-password" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.key: "database-host" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.key: "database-port" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.key: "database-name" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" + # Chart-default extraEnvVars.KEYMANAGER_PKCS11_PIN points at a plain "esignet-softhsm" + # secret that doesn't exist in this namespace (only esignet-softhsm-mosipid does) - + # override directly under extraEnvVars (not extraEnvVarsAdditional) so the chart's + # own defaults for these same keys don't also coexist redundantly in the rendered env. + extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" + extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" + extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" + extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-mosipid" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets-mosipid" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" + extraEnvVars.MOSIP_ESIGNET_AUTHN_PROVIDER: "mosip" + extraEnvVars.NAMESPACE: "mosipid" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_PROVIDER: "google-recaptcha" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_VALIDATOR_URL: "http://captcha.captcha/v1/captcha/validatecaptcha" + extraEnvVarsAdditional.hsm_client_zip_url_env: "https://raw.githubusercontent.com/mosip/artifactory-ref-impl/master/artifacts/src/hsm/client.zip" + extraEnvVars.OIDC_UI_SCHEME: "https" + extraEnvVars.OIDC_UI_PORT: "443" + extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" + extraEnvVars.OIDC_UI_ERROR_PATH: "/error" + extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" + extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" + extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetmosipid" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha-mosipid" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" + extraEnvVarsAdditional.plugin_name_env: "mosip-identity-plugin.jar" + extraEnvVarsAdditional.SPRING_KAFKA_CONSUMER_GROUP_ID: "esignet-consumer-esignet-mosipid" + extraEnvVarsAdditional.MOSIP_ESIGNET_SIGNUP_ID_TOKEN_AUDIENCE: "esignet-mosipid-signup-esqa020" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATOR_IDA_OTP_CHANNELS: 'email,phone' + extraEnvVarsAdditional.MOSIP_ESIGNET_SEND_OTP_ATTEMPTS: "300" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: "300" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATION_EXPIRE_IN_SECS: "600" + extraEnvVarsAdditional.MOSIP_ESIGNET_PREAUTHENTICATION_EXPIRE_IN_SECS: "600" + extraEnvVarsAdditional.MOSIP_ESIGNET_UI_CONFIG_USERNAME_POSTFIX: "@phone" + extraEnvVarsAdditional.MOSIP_ESIGNET_UI_CONFIG_LOGIN_ID_OPTIONS.value: '\{\{ "\{\{" \}\} ''id'': ''mobile'', ''svg'': ''mobile_icon'', ''prefixes'': \{\{ "\{\{" \}\}''label'': ''IND'', ''value'': ''+91'', ''maxLength'': '''', ''regex'': ''''\},\{''label'': ''KHM'', ''value'': ''+855'', ''regex'': ''''\{\{ "\}\}" \}\}, ''postfix'': ''@phone'', ''maxLength'': '''', ''regex'': '''' \}, \{ ''id'': ''nrc'', ''svg'': ''nrc_id_icon'', ''prefixes'': '''', ''postfix'': ''@nrc'', ''maxLength'': '''', ''regex'': '''' \}, \{ ''id'': ''vid'', ''svg'': ''vid_icon'', ''prefixes'': '''', ''postfix'': '''', ''maxLength'': '''', ''regex'': '''' \}, \{ ''id'': ''email'', ''svg'': ''email_icon'', ''prefixes'': '''', ''postfix'': ''@email'', ''maxLength'': '''', ''regex'': '''' \{\{ "\}\}" \}\}' + extraEnvVarsAdditional.LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT: "INFO" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_URL: "http://captcha.captcha" + extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY.valueFrom.secretKeyRef.name: "esignet-misp-onboarder-key" + extraEnvVarsAdditional.MOSIP_ESIGNET_MISP_KEY.valueFrom.secretKeyRef.key: "mosip-esignet-misp-key" + timeout: 600 + priority: -14 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh" + + esignet-sunbird: + namespace: esignet-sunbird + enabled: true + version: 2.0.0-develop + chart: mosip/esignet + set: + image.repository: "mosipqa/esignet" + image.tag: "2.0.x" + enable_insecure: "false" + springConfigNameEnv: "" + activeProfileEnv: "" + pluginNameEnv: "sunbird-rc-plugin.jar" + pluginUrlEnv: "" + extraEnvVarsCM[0]: "esignet-softhsm-sunbird-share" + #extraEnvVarsCM[1]: "kafka-config" + metrics.serviceMonitor.enabled: "false" + domainConfig.MOSIP_API_HOST: "https://api.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "https://iam.${domain_name}" + domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" + domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" + domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" + domainConfig.installation-domain: "${domain_name}" + domainConfig.MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL: "https://registry.${mosipid_domain_name}/api/v1/Insurance/search" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid_domain_name}/api/v1/Insurance/" + domainConfig.OIDC_UI_HOSTNAME: "esignet-sunbird.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "https://esignet-sunbird.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "https://signup-sunbird.${domain_name}" + domainConfig.MOSIP_ESIGNET_BASE_URL: "https://esignet-sunbird.${domain_name}/v1/esignet" + domainConfig.MOSIP_API_INTERNAL_HOST: "https://api-internal.${domain_name}" + # Single-quoted YAML + two literal backslashes before the dot: strvals (Helm's --set + # parser) consumes one backslash as its own escape character, leaving exactly one in + # the final value - a bare "\." here would be silently dropped, and an unescaped "." + # would match any character instead of a literal dot. Verified via helm template. + extraEnvVars.MOSIP_ESIGNET_CORS_ALLOWED_ORIGIN_REGEX: '^https?://[^./]+\\.${domain_name}$' + # Chart-default extraEnvVars.MOSIP_ESIGNET_HOST/MOSIP_SIGNUP_HOST/MOSIP_API_INTERNAL_HOST + # are tables (valueFrom.configMapKeyRef against esignet-global). A plain string override + # at the same key produces a "cannot overwrite table with non table" coalesce warning + # (harmless on its own, but noisy) and still leaves domainConfig's own same-named entry + # as a genuinely separate list item - so null the chart-default keys out entirely + # instead, letting domainConfig (above) be the sole source, matching the pattern used + # for KEYMANAGER_PKCS11_* elsewhere in this file. "null" (quoted) is required: Helmsman's + # YAML parsing turns a bare `null` into an empty string, not the literal text Helm needs + # to delete a key. + extraEnvVars.MOSIP_ESIGNET_HOST: "null" + extraEnvVars.MOSIP_SIGNUP_HOST: "null" + extraEnvVars.MOSIP_API_INTERNAL_HOST: "null" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.name: "keycloak-host" + extraEnvVars.KEYCLOAK_EXTERNAL_URL.valueFrom.configMapKeyRef.key: "keycloak-external-url" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_MODULE_NAME: "esignetsunbird" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.key: "redis-port" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.name: "redis" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.key: "redis-password" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.key: "database-host" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.key: "database-port" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.key: "database-name" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.name: "postgres-config" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" + extraEnvVars.SOFTHSM_ESIGNET_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" + # Chart-default extraEnvVars.KEYMANAGER_PKCS11_PIN points at a plain "esignet-softhsm" + # secret that doesn't exist in this namespace (only esignet-softhsm-sunbird does) - + # override directly under extraEnvVars (not extraEnvVarsAdditional) so the chart's + # own defaults for these same keys don't also coexist redundantly in the rendered env. + extraEnvVars.KEYMANAGER_DB_SCHEMA: "esignet" + extraEnvVars.KEYMANAGER_KEYSTORE_TYPE: "PKCS11" + extraEnvVars.KEYMANAGER_PKCS11_MODULE_PATH: "/usr/local/lib/softhsm/libpkcs11-proxy.so" + extraEnvVars.KEYMANAGER_PKCS11_TOKEN_LABEL: "mosip-token" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.name: "esignet-softhsm-sunbird" + extraEnvVars.KEYMANAGER_PKCS11_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.name: "keycloak-client-secrets" + extraEnvVars.MOSIP_IDA_CLIENT_SECRET.valueFrom.secretKeyRef.key: "mosip_ida_client_secret" + extraEnvVars.MOSIP_ESIGNET_AUTHN_PROVIDER: "sunbird" + extraEnvVars.NAMESPACE: "sunbird" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_SITE_PROVIDER: "google-recaptcha" + extraEnvVars.MOSIP_ESIGNET_CAPTCHA_VALIDATOR_URL: "http://captcha.captcha/v1/captcha/validatecaptcha" + extraEnvVarsAdditional.hsm_client_zip_url_env: "https://raw.githubusercontent.com/mosip/artifactory-ref-impl/master/artifacts/src/hsm/client.zip" + extraEnvVars.OIDC_UI_SCHEME: "https" + extraEnvVars.OIDC_UI_PORT: "443" + extraEnvVars.OIDC_UI_LOGIN_PATH: "/signin" + extraEnvVars.OIDC_UI_ERROR_PATH: "/error" + extraEnvVars.DEFAULT_THEME_ID: "decl-theme-1" + extraEnvVars.DEFAULT_LAYOUT_ID: "decl-layout-1" + extraEnvVars.DEFAULT_AUTH_FLOW_ID: "decl-mosip-otp-flow-1" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.name: "esignet-captcha-sunbird" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_SITE_KEY.valueFrom.secretKeyRef.key: "esignet-captcha-site-key" + extraEnvVarsAdditional.MOSIP_ESIGNET_CAPTCHA_REQUIRED: "" + extraEnvVarsAdditional.MOSIP_ESIGNET_INTEGRATION_AUDIT_PLUGIN: "LoggerAuditService" + extraEnvVarsAdditional.MOSIP_ESIGNET_INTEGRATION_KEY_BINDER: "NoOpKeyBinder" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATE_ATTEMPTS: "300" + extraEnvVarsAdditional.MOSIP_ESIGNET_AUTHENTICATOR_DEFAULT_AUTH_FACTOR_KBI_INDIVIDUAL_ID_FIELD: "policyNumber" + timeout: 600 + priority: -14 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh" + + # --------------------------------------------------------------------------- + # OIDC UI + # --------------------------------------------------------------------------- + oidc-ui: + namespace: esignet-mock + enabled: true + version: 2.0.0-develop + chart: mosip/oidc-ui + set: + image.repository: "mosipqa/oidc-ui" + image.tag: "2.0.x" + istio.hosts[0]: "esignet.${domain_name}" + oidc_ui.oidc_service_host: "esignet-mock.esignet-mock" + oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mock.esignet-mock/v1/esignet" + oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mock.esignet-mock" + + timeout: 1200 + priority: -13 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh" + + oidc-ui-mosipid: + namespace: esignet-mosipid + enabled: true + version: 2.0.0-develop + chart: mosip/oidc-ui + set: + image.repository: "mosipqa/oidc-ui" + image.tag: "2.0.x" + istio.hosts[0]: "esignet-mosipid.${domain_name}" + oidc_ui.oidc_service_host: "esignet-mosipid.esignet-mosipid" + oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mosipid.esignet-mosipid/v1/esignet" + oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mosipid.esignet-mosipid" + timeout: 1200 + priority: -13 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid-preinstall.sh" + + oidc-ui-sunbird: + namespace: esignet-sunbird + enabled: true + version: 2.0.0-develop + chart: mosip/oidc-ui + set: + image.repository: "mosipqa/oidc-ui" + image.tag: "2.0.x" + istio.hosts[0]: "esignet-sunbird.${domain_name}" + oidc_ui.oidc_service_host: "esignet-sunbird.esignet-sunbird" + oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-sunbird.esignet-sunbird/v1/esignet" + oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-sunbird.esignet-sunbird" + timeout: 1200 + priority: -13 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-sunbird-preinstall.sh" + + # --------------------------------------------------------------------------- + # Mock Identity System (Optional) + # --------------------------------------------------------------------------- + # Enable for testing with mock identity data. + softhsm-mock-identity-system: + namespace: softhsm + enabled: true + version: 12.0.1 + chart: mosip/softhsm + valuesFile: "$WORKDIR/utils/softhsm-mock-identity-system-values.yaml" + wait: true + timeout: 480 + priority: -12 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh" + postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh" + preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh" + postUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh" + + mock-identity-system: + namespace: esignet-mock + enabled: true + version: 0.14.0-develop + chart: mosip/mock-identity-system + set: + image.repository: "mosipqa/mock-identity-system" + image.tag: "0.14.x" + enable_insecure: "false" + extraEnvVarsCM[0]: "softhsm-mock-identity-system-share" + domainConfig.MOSIP_ESIGNET_HOST: "esignet.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "signup.${domain_name}" + domainConfig.MOSIP_API_HOST: "api.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" + domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" + domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" + domainConfig.installation-domain: "${domain_name}" + domainConfig.MOSIP_MOCK_IDA_IDENTITY_SCHEMA_URL: "https://raw.githubusercontent.com/prathmeshj12/addidentityschema_testing/refs/heads/main/email-signup-schema-testing.json" + domainConfig.MOSIP_MOCK_UI_SPEC_SCHEMA_URL: "https://raw.githubusercontent.com/prathmeshj12/addidentityschema_testing/refs/heads/main/ui_spec_reset_password_phone.json" + # Chart-default extraEnvVars.MOSIP_ESIGNET_HOST is a table (valueFrom.configMapKeyRef + # against esignet-global), which doesn't exist in the esignet-mock namespace - left + # unset it would both crash with CreateContainerConfigError and duplicate the + # domainConfig.MOSIP_ESIGNET_HOST entry above in the rendered env: list. Null it out + # so domainConfig is the sole source, same pattern as the esignet chart apps. + extraEnvVars.MOSIP_ESIGNET_HOST: "null" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.name: "mockid-postgres-config" + extraEnvVars.DATABASE_HOST.valueFrom.configMapKeyRef.key: "database-host" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.name: "mockid-postgres-config" + extraEnvVars.DATABASE_PORT.valueFrom.configMapKeyRef.key: "database-port" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.name: "mockid-postgres-config" + extraEnvVars.DATABASE_NAME.valueFrom.configMapKeyRef.key: "database-name" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.name: "mockid-postgres-config" + extraEnvVars.DATABASE_USERNAME.valueFrom.configMapKeyRef.key: "database-username" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.name: "db-common-secrets" + extraEnvVars.DB_DBUSER_PASSWORD.valueFrom.secretKeyRef.key: "db-dbuser-password" + extraEnvVars.SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN.valueFrom.secretKeyRef.name: "softhsm-mock-identity-system" + extraEnvVars.SOFTHSM_MOCK_IDENTITY_SYSTEM_SECURITY_PIN.valueFrom.secretKeyRef.key: "security-pin" + extraEnvVars.hsm_local_dir_name: "hsm-client" + extraEnvVars.MOSIP_ESIGNET_MOCK_SUPPORTED_FIELDS: 'individualId,password' + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_HOST.valueFrom.configMapKeyRef.key: "redis-host" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.name: "redis-config" + extraEnvVars.REDIS_PORT.valueFrom.configMapKeyRef.key: "redis-port" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.name: "redis" + extraEnvVars.REDIS_PASSWORD.valueFrom.secretKeyRef.key: "redis-password" + timeout: 480 + priority: -11 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh" + + # --------------------------------------------------------------------------- + # Mock Relying Party (Optional) + # --------------------------------------------------------------------------- + mock-relying-party-service: + namespace: esignet-mock + enabled: true + version: 0.14.0-develop + chart: mosip/mock-relying-party-service + set: + image.repository: "mosipqa/mock-relying-party-service" + image.tag: "0.14.x" + mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet.${domain_name}/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet.${domain_name}" + mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet.${domain_name}/v1/esignet/oauth2/par" + mock_relying_party_service.REDIRECT_URI: "https://healthservices.${domain_name}/userprofile" + mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet.${domain_name}" + enable_insecure: "false" + domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + extraEnvVars.CLIENT_ID: "I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM" + extraEnvVars.ACRS.value: "mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet%20mosip:idp:acr:password%20mosip:idp:acr:knowledge" + extraEnvVars.DISPLAY: "page" + extraEnvVars.GRANT_TYPE: "authorization_code" + extraEnvVars.CLAIMS_LOCALES: "en" + extraEnvVars.SCOPE_USER_PROFILE: "openid profile" + extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\},"phone_number":\{"essential":true\},"email":\{"essential":true\},"picture":\{"essential":false\},"gender":\{"essential":false\},"birthdate":\{"essential":false\},"address":\{"essential":false\}\},"id_token":\{\}\}' + extraEnvVars.TOKEN_ENDPOINT: "/oauth2/token" + extraEnvVars.USERINFO_ENDPOINT: "/oauth2/userinfo" + mock_relying_party_service.host: "" + mock_relying_party_service.mountDir: "" + mock_relying_party_service.healthCheckUrl: null + mock_relying_party_service.mock_relying_party_serviceMountDIr: "/home/mosip/oidc/" + mock_relying_party_service.puburl: null + mock_relying_party_service.privurl: null + mock_relying_party_service.USERINFO_RESPONSE_TYPE: "jwt" + timeout: 480 + priority: -10 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh" + + mock-relying-party-service-mosipid: + namespace: esignet-mosipid + enabled: true + version: 0.14.0-develop + chart: mosip/mock-relying-party-service + set: + image.repository: "mosipqa/mock-relying-party-service" + image.tag: "0.14.x" + mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-mosipid.${domain_name}/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-mosipid.${domain_name}" + mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-mosipid.${domain_name}/v1/esignet/oauth2/par" + mock_relying_party_service.REDIRECT_URI: "https://healthservices-mosipid.${domain_name}/userprofile" + mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-mosipid.${domain_name}" + enable_insecure: "false" + domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + extraEnvVars.CLIENT_ID: "I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM" + extraEnvVars.ACRS.value: "mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet%20mosip:idp:acr:password%20mosip:idp:acr:knowledge" + extraEnvVars.DISPLAY: "page" + extraEnvVars.GRANT_TYPE: "authorization_code" + extraEnvVars.CLAIMS_LOCALES: "en" + extraEnvVars.SCOPE_USER_PROFILE: "openid profile" + extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\},"phone_number":\{"essential":true\},"email":\{"essential":true\},"picture":\{"essential":false\},"gender":\{"essential":false\},"birthdate":\{"essential":false\},"address":\{"essential":false\}\},"id_token":\{\}\}' + extraEnvVars.TOKEN_ENDPOINT: "/oauth2/token" + extraEnvVars.USERINFO_ENDPOINT: "/oauth2/userinfo" + mock_relying_party_service.host: "" + mock_relying_party_service.mountDir: "" + mock_relying_party_service.healthCheckUrl: null + mock_relying_party_service.mock_relying_party_serviceMountDIr: "/home/mosip/oidc/" + mock_relying_party_service.puburl: null + mock_relying_party_service.privurl: null + mock_relying_party_service.USERINFO_RESPONSE_TYPE: "jwt" + timeout: 480 + priority: -10 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid-preinstall.sh" + + mock-relying-party-service-sunbird: + namespace: esignet-sunbird + enabled: true + version: 0.14.0-develop + chart: mosip/mock-relying-party-service + set: + image.repository: "mosipqa/mock-relying-party-service" + image.tag: "0.14.x" + mock_relying_party_service.ESIGNET_SERVICE_URL: "https://esignet-sunbird.${domain_name}/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-sunbird.${domain_name}" + mock_relying_party_service.ESIGNET_PAR_ENDPOINT: "https://esignet-sunbird.${domain_name}/v1/esignet/oauth2/par" + mock_relying_party_service.REDIRECT_URI: "https://healthservices-sunbird.${domain_name}/userprofile" + mock_relying_party_service.ESIGNET_PAR_AUD_URL: "https://esignet-sunbird.${domain_name}" + enable_insecure: "false" + domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" + extraEnvVars.CLIENT_ID: "I6eXdnnLGGj2A2BcTL-jug_0ujpnQXlBpKAbBCkGWEM" + extraEnvVars.ACRS.value: "mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet%20mosip:idp:acr:password%20mosip:idp:acr:knowledge" + extraEnvVars.DISPLAY: "page" + extraEnvVars.GRANT_TYPE: "authorization_code" + extraEnvVars.CLAIMS_LOCALES: "en" + extraEnvVars.SCOPE_USER_PROFILE: "openid profile" + extraEnvVars.CLAIMS_USER_PROFILE.value: '\{"userinfo":\{"given_name":\{"essential":true\},"phone_number":\{"essential":true\},"email":\{"essential":true\},"picture":\{"essential":false\},"gender":\{"essential":false\},"birthdate":\{"essential":false\},"address":\{"essential":false\}\},"id_token":\{\}\}' + extraEnvVars.TOKEN_ENDPOINT: "/oauth2/token" + extraEnvVars.USERINFO_ENDPOINT: "/oauth2/userinfo" + mock_relying_party_service.host: "" + mock_relying_party_service.mountDir: "" + mock_relying_party_service.healthCheckUrl: null + mock_relying_party_service.mock_relying_party_serviceMountDIr: "/home/mosip/oidc/" + mock_relying_party_service.puburl: null + mock_relying_party_service.privurl: null + mock_relying_party_service.USERINFO_RESPONSE_TYPE: "jwt" + timeout: 480 + priority: -10 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh" + + mock-relying-party-ui: + namespace: esignet-mock + enabled: true + version: 0.14.0-develop + chart: mosip/mock-relying-party-ui + set: + image.repository: "mosipqa/mock-relying-party-ui" + image.tag: "0.14.x" + mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service.esignet-mock" + mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices.${domain_name}/mock-relying-party-service" + mock_relying_party_ui.REDIRECT_URI: "https://healthservices.${domain_name}/userprofile" + mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices.${domain_name}/registration" + mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + extraEnvVars.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + extraEnvVars.CODE_CHALLENGE: get_code_challenge + istio.hosts[0]: "healthservices.${domain_name}" + wait: true + timeout: 480 + priority: -9 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh" + + mock-relying-party-ui-mosipid: + namespace: esignet-mosipid + enabled: true + version: 0.14.0-develop + chart: mosip/mock-relying-party-ui + set: + image.repository: "mosipqa/mock-relying-party-ui" + image.tag: "0.14.x" + mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-mosipid.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-mosipid.esignet-mosipid" + mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-mosipid.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-mosipid.${domain_name}/mock-relying-party-service" + mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid.${domain_name}/userprofile" + mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid.${domain_name}/registration" + mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + extraEnvVars.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + extraEnvVars.CODE_CHALLENGE: get_code_challenge + istio.hosts[0]: "healthservices-mosipid.${domain_name}" + wait: true + timeout: 480 + priority: -9 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid-preinstall.sh" + + mock-relying-party-ui-sunbird: + namespace: esignet-sunbird + enabled: true + version: 0.14.0-develop + chart: mosip/mock-relying-party-ui + set: + image.repository: "mosipqa/mock-relying-party-ui" + image.tag: "0.14.x" + mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-sunbird.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-sunbird.esignet-sunbird" + mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-sunbird.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-sunbird.${domain_name}/mock-relying-party-service" + mock_relying_party_ui.REDIRECT_URI: "https://healthservices-sunbird.${domain_name}/userprofile" + mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-sunbird.${domain_name}/registration" + mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-sunbird.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + extraEnvVars.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + extraEnvVars.CODE_CHALLENGE: get_code_challenge + istio.hosts[0]: "healthservices-sunbird.${domain_name}" + wait: true + timeout: 480 + priority: -9 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh" + + # --------------------------------------------------------------------------- + # Partner Onboarders + # --------------------------------------------------------------------------- + # Two onboarders for eSignet standalone — enable the one matching your plugin: + # esignet-mock-rp-onboarder: for mock plugin (plugin 1) and sunbird-rc (plugin 3) + # esignet-misp-onboarder: for mosip-identity-plugin (plugin 2) only + + # eSignet MISP Partner Onboarder + # Onboards the eSignet MISP client — only needed with mosip-identity-plugin (plugin 2). + # Runs AFTER mock-rp-onboarder (separate namespaces/deployments — esignet-mosipid vs. + # esignet-mock — so there's no ordering dependency between the two either way). + # After completion, restarts the esignet deployment to pick up the new MISP license key. + esignet-misp-onboarder: + namespace: esignet-mosipid + enabled: true + version: 0.0.1-develop + chart: mosip/partner-onboarder + set: + image.registry: "docker.io" + image.repository: "mosipdev/partner-onboarder" + image.tag: "develop" + onboarding.modules[0].name: "esignet" + onboarding.modules[0].enabled: "true" + onboarding.configmaps.s3.s3-host: "http://minio.minio:9000" + onboarding.configmaps.s3.s3-user-key: "admin" + onboarding.configmaps.s3.s3-region: "" + onboarding.configmaps.s3.s3-bucket-name: "onboarder" + onboarding.secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" + onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-mosipid" + onboarding.variables.push_reports_to_s3: "true" + onboarding.variables.mosipid: "true" + # Properties-driven model for inline-hardcoded business values, per + # mosip-onboarding@c801268f. Values match the reference + # partner-onboarder/values.yaml in mosip/esignet@release-2.0.x for the + # esignet module (mosip-identity-plugin/MISP case), except EXTERNAL_URL, adapted to + # this instance. + onboarding.propertiesOverride.esignet.POLICY_NAME: "mpolicy-default-esignetkd" + onboarding.propertiesOverride.esignet.POLICY_GROUP_NAME: "mpolicygroup-default-esignetkd" + onboarding.propertiesOverride.esignet.PARTNER_KC_USERNAME: "mpartner-default-esignetkd" + onboarding.propertiesOverride.esignet.PARTNER_ORGANIZATION_NAME: "IIITB" + onboarding.propertiesOverride.esignet.PARTNER_TYPE: "Misp_Partner" + onboarding.propertiesOverride.esignet.PARTNER_DOMAIN: "MISP" + onboarding.propertiesOverride.esignet.PARTNER_MANAGER_USERNAME: "esignet-kc-mockusernamekd" + onboarding.propertiesOverride.esignet.PARTNER_MANAGER_PASSWORD: "esignet-kc-mockpasswordkd" + onboarding.propertiesOverride.esignet.EXTERNAL_URL: "https://esignet-mosipid.${domain_name}" + extraEnvVarsCM[0]: "keycloak-env-vars" + extraEnvVarsCM[1]: "keycloak-host-mosipid" + extraEnvVarsSecret[0]: "keycloak-mosipid" + extraEnvVarsSecret[1]: "keycloak-client-secrets-mosipid" + # mosip-esignet-host/mosip-api-internal-host are read by the onboarding script itself + # to derive EXTERNAL_URL/URL/AUTHMANAGER_URL/PMS_URL (confirmed via the chart's + # templates/jobs.yaml, which renders every domainConfig entry as a plain env var) - + # point them at esignet-mosipid's real values, not the generic/mock ones. + domainConfig.mosip-api-internal-host: "api-internal.${mosipid_domain_name}" + domainConfig.mosip-api-host: "api.${domain_name}" + domainConfig.mosip-esignet-host: "esignet-mosipid.${domain_name}" + domainConfig.mosip-esignet-insurance-host: "esignet-insurance.${domain_name}" + domainConfig.mosip-resident-host: "resident.${domain_name}" + domainConfig.installation-domain: "${domain_name}" + wait: true + waitForJobs: true + timeout: 600 + priority: -5 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-preinstall.sh" + preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-preinstall.sh" + postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-postinstall.sh" + postUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-postinstall.sh" + + # Mock RP OIDC Partner Onboarder + # Onboards the mock relying party as an OIDC client. + # Enable for plugin 1 (mock) or plugin 3 (sunbird-rc). Set mosipid: "true" for mosip-identity-plugin. + # Runs BEFORE esignet-misp-onboarder. + esignet-mock-rp-onboarder: + namespace: esignet-mock + enabled: true + version: 0.0.1-develop + chart: mosip/partner-onboarder + set: + image.registry: "docker.io" + image.repository: "mosipdev/partner-onboarder" + image.tag: "develop" + onboarding.modules[0].name: "mock-rp-oidc" + onboarding.modules[0].enabled: "true" + onboarding.configmaps.s3.s3-host: "http://minio.minio:9000" + onboarding.configmaps.s3.s3-user-key: "admin" + onboarding.configmaps.s3.s3-region: "" + onboarding.secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" + onboarding.configmaps.s3.s3-bucket-name: "onboarder" + onboarding.configmaps.onboarder-namespace.ns_esignet: "esignet-mock" + onboarding.variables.mosipid: "false" + onboarding.variables.push_reports_to_s3: "true" + # Properties-driven values for the mock-rp-oidc module, adapted to this instance + # (esignet-go-mock / healthservices-go-mock). KEYCLOAK_ADMIN_PASSWORD, + # KEYCLOAK_CLIENT_SECRET and mosip_pms_client_secret are intentionally not set here: + # propertiesOverride renders into a plain ConfigMap, and the job already gets them + # from the keycloak / keycloak-client-secrets Secrets (chart-default + # extraEnvVarsSecret, copied into this namespace by the preinstall hook). + onboarding.propertiesOverride.mock-rp-oidc.POLICY_NAME: "mpolicy-default-mock-rp-oidc" + onboarding.propertiesOverride.mock-rp-oidc.POLICY_GROUP_NAME: "mpolicygroup-default-mock-rp-oidc" + onboarding.propertiesOverride.mock-rp-oidc.PARTNER_KC_USERNAME: "mpartner-default-mock-rp-oidc" + onboarding.propertiesOverride.mock-rp-oidc.PARTNER_MANAGER_USERNAME: "mock-rp-oidc-kc-mockusername" + onboarding.propertiesOverride.mock-rp-oidc.PARTNER_MANAGER_PASSWORD: "mock-rp-oidc-kc-mockuserpassword" + onboarding.propertiesOverride.mock-rp-oidc.OIDC_CLIENTID: "default-non-mosipid-oidc-client" + onboarding.propertiesOverride.mock-rp-oidc.OIDC_CLIENT_NAME: "Health service OIDC Client" + onboarding.propertiesOverride.mock-rp-oidc.MOSIP_ID: "false" + onboarding.propertiesOverride.mock-rp-oidc.LOGO_URI: "https://healthservices-go-mock.${domain_name}/logo.png" + onboarding.propertiesOverride.mock-rp-oidc.REDIRECT_URIS: "https://healthservices-go-mock.${domain_name}/userprofile" + onboarding.propertiesOverride.mock-rp-oidc.URL: "https://api-internal.${domain_name}" + onboarding.propertiesOverride.mock-rp-oidc.AUTHMANAGER_URL: "https://api-internal.${domain_name}" + onboarding.propertiesOverride.mock-rp-oidc.PMS_URL: "https://api-internal.${domain_name}" + onboarding.propertiesOverride.mock-rp-oidc.KEYCLOAK_URL: "https://iam.${domain_name}" + onboarding.propertiesOverride.mock-rp-oidc.EXTERNAL_URL: "https://esignet-go-mock.${domain_name}" + onboarding.propertiesOverride.mock-rp-oidc.KEYCLOAK_ADMIN_USERNAME: "admin" + extraEnvVarsCM[0]: "keycloak-env-vars" + extraEnvVarsCM[1]: "keycloak-host" + # esignet-mock-rp-onboarder-preinstall.sh already copies both of these into + # esignet-mock — wiring them here is what actually gets KEYCLOAK_ADMIN_PASSWORD + # (from the "keycloak" secret) and KEYCLOAK_CLIENT_SECRET/mosip_pms_client_secret + # (from "keycloak-client-secrets") into the Job's environment, same pattern as + # esignet-misp-onboarder's own extraEnvVarsSecret below. + extraEnvVarsSecret[0]: "keycloak" + extraEnvVarsSecret[1]: "keycloak-client-secrets" + domainConfig.mosip-api-internal-host: "api-internal.${domain_name}" + domainConfig.mosip-api-host: "api.${domain_name}" + domainConfig.mosip-esignet-host: "esignet.${domain_name}" + domainConfig.mosip-esignet-insurance-host: "esignet-insurance.${domain_name}" + domainConfig.mosip-resident-host: "resident.${domain_name}" + domainConfig.installation-domain: "${domain_name}" + wait: true + waitForJobs: true + timeout: 600 + priority: -6 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh" + preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh" + postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh" + postUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh" diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml new file mode 100644 index 000000000..dc2f0a5e4 --- /dev/null +++ b/Helmsman/dsf/esignet-standalone-2.0.0/signup-dsf.yaml @@ -0,0 +1,185 @@ +# ============================================================================= +# eSignet Profile - Signup Services DSF (Desired State File) +# ============================================================================= +# This DSF deploys signup-service and its dependencies on top of the +# standalone eSignet profile. All apps are disabled by default — enable as +# needed alongside external-dsf.yaml (which provides postgres-init-signup). +# +# Prerequisites (from external-dsf.yaml): +# - postgres-init-signup enabled (mosip_audit, mosip_kernel, mosip_otp) +# - Redis, Kafka, Keycloak + keycloak-postinstall (keycloak-client-secrets) +# - Captcha (for signup captcha validation) +# +# Components (in priority order): +# 1. Signup Keycloak Init — mosip-signup-client roles and client secret +# 2. Kernel services — authmanager, auditmanager, otpmanager, notifier +# 3. Mock SMTP — for dev/test email/SMS (optional) +# 4. Signup service — signup-service with esignet-mock-plugin.jar +# 5. Signup UI — signup-ui +# +# Based on eSignet signup deploy scripts: +# - deploy/prereq.sh +# - deploy/keycloak/keycloak-init.sh +# - deploy/kernel/install.sh +# - deploy/mock-smtp/install.sh +# - deploy/signup-with-plugins/signup-with-mock-plugin/install.sh +# - deploy/signup-ui/install.sh +# ============================================================================= + +helmDefaults: + tillerNamespace: kube-system + tillerless: true + install: true + +helmRepos: + mosip: https://mosip.github.io/mosip-helm + +namespaces: + signup: + protected: false + kernel: + protected: false + mock-smtp: + protected: false + +apps: + # --------------------------------------------------------------------------- + # Signup Keycloak Init + # --------------------------------------------------------------------------- + # Creates mosip-signup-client with required roles in Keycloak. + # Propagates mosip_signup_client_secret between keycloak and signup namespaces. + signup-keycloak-init: + namespace: signup + enabled: false + version: 12.0.2 + chart: mosip/keycloak-init + valuesFile: "$WORKDIR/utils/keycloak-signup-init-values.yaml" + set: + keycloakInternalHost: "keycloak.keycloak" + keycloakExternalHost: "iam.${domain_name}" + wait: true + waitForJobs: true + timeout: 300 + priority: -10 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/signup-keycloak-init-preinstall.sh" + preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/signup-keycloak-init-preinstall.sh" + postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/signup-keycloak-init-postinstall.sh" + postUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/signup-keycloak-init-postinstall.sh" + + # --------------------------------------------------------------------------- + # Kernel Services + # --------------------------------------------------------------------------- + # Required for audit logging (auditmanager), OTP generation (otpmanager), + # auth token validation (authmanager), and email/SMS dispatch (notifier). + # kernel-preinstall.sh creates kernel namespace and domain-config configmap. + authmanager: + namespace: kernel + enabled: false + version: 12.0.1 + chart: mosip/authmanager + set: + enable_insecure: "false" + wait: true + timeout: 600 + priority: -8 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" + preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" + + auditmanager: + namespace: kernel + enabled: false + version: 12.0.1 + chart: mosip/auditmanager + set: + enable_insecure: "false" + wait: true + timeout: 600 + priority: -8 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" + preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" + + otpmanager: + namespace: kernel + enabled: false + version: 12.0.1 + chart: mosip/otpmanager + wait: true + timeout: 600 + priority: -8 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" + preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh" + + notifier: + namespace: kernel + enabled: false + version: 12.0.1 + chart: mosip/notifier + wait: true + timeout: 600 + priority: -7 + hooks: + postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh" + postUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh" + + # --------------------------------------------------------------------------- + # Mock SMTP (Optional — dev/test email and SMS) + # --------------------------------------------------------------------------- + mock-smtp: + namespace: mock-smtp + enabled: false + version: 1.0.0 + chart: mosip/mock-smtp + set: + istio.hosts[0]: "smtp.${domain_name}" + wait: true + timeout: 300 + priority: -5 + + # --------------------------------------------------------------------------- + # Signup Service (with esignet-mock-plugin) + # --------------------------------------------------------------------------- + # signup-service-preinstall.sh copies redis secrets, creates keycloak-host + # configmap, signup-captcha and signup-keystore secrets, and msg-gateway + # configmap/secret pointing to mock-smtp. + signup: + namespace: signup + enabled: false + version: 1.2.2 + chart: mosip/signup + set: + image.repository: "mosipid/signup-service" + image.tag: "1.2.2" + enable_insecure: "false" + plugin_name_env: "esignet-mock-plugin.jar" + domainConfig.MOSIP_ESIGNET_HOST: "esignet.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "signup.${domain_name}" + domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" + wait: true + timeout: 600 + priority: -4 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh" + preUpgrade: "$WORKDIR/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh" + + # --------------------------------------------------------------------------- + # Signup UI + # --------------------------------------------------------------------------- + signup-ui: + namespace: signup + enabled: false + version: 1.2.2 + chart: mosip/signup-ui + set: + image.repository: "mosipid/signup-ui" + image.tag: "1.2.2" + istio.hosts[0]: "signup.${domain_name}" + signup_ui.signup_service_host: "signup.signup" + signup_ui.configmaps.signup-ui.REACT_APP_API_BASE_URL: "http://signup.signup/v1/signup" + signup_ui.configmaps.signup-ui.REACT_APP_SBI_DOMAIN_URI: "http://signup.signup" + wait: true + timeout: 600 + priority: -3 diff --git a/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml new file mode 100644 index 000000000..3808f73cc --- /dev/null +++ b/Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml @@ -0,0 +1,283 @@ +# ============================================================================= +# eSignet Standalone 2.0.0 Profile - Testrigs DSF (Desired State File) +# ============================================================================= +# eSignet's own apitestrig/uitestrig apps below deploy the dedicated Go/Java-harness +# charts mosip/esignet-apitestrig and mosip/esignet-uitestrig (v2.0.0) — NOT the +# generic mosip/apitestrig / mosip/uitestrig charts the esignet-standalone (1.0/Java) +# profile still uses. These charts are purpose-built for eSignet 2.0.0 (Go) and have +# a completely different values schema (no modules.*/configmaps.* — see each chart's +# own values.yaml via `helm show values mosip/esignet-apitestrig --version 2.0.0`). +# +# Modeled directly on eSignet's own reference deploy scripts: +# https://github.com/mosip/esignet/blob/v2.0.0/deploy/esignet-apitestrig/install.sh +# https://github.com/mosip/esignet/blob/v2.0.0/deploy/esignet-uitestrig/install.sh +# translated from "helm install with two interactive prompts + a gitignored +# values.secret.yaml" into this DSF's declarative set: blocks, with every value +# either derived from this profile's existing ${domain_name}/${mosipid_domain_name} +# conventions or sourced from a required GitHub Environment secret/variable (see +# docs/HELMSMAN_TESTRIGS_GUIDE.md). +# +# Only esignet-mosipid gets real test-identity/onboarding values (INDIVIDUAL_ID, +# OTP recipient, auth partner/policy ID, UIN/VID/etc.) — it's the only instance +# backed by a real IDA identity (config.mosip.json / the "mosip" plugin). esignet-mock +# (config.mock.json / "mock" plugin) and esignet-sunbird (config.sunbird.json / +# "sunbird" plugin) need none of that. +# +# Report storage: reports.persistence (PVC) is used instead of reports.s3 — the S3 +# path needs a pre-existing bucket this repo has no established convention for yet. +# Switch to reports.s3.enabled once one exists (reuse the ${MINIO_ROOT_PASSWORD} +# pattern from esignet-signup-apitestrig/signup-uitestrig below). +# ============================================================================= + +helmDefaults: + tillerNamespace: kube-system + tillerless: true + install: true + +helmRepos: + bitnami: https://charts.bitnami.com/bitnami + mosip: https://mosip.github.io/mosip-helm + +# eSignet's own apitestrig deploys into the same namespace as the eSignet instance it +# tests (matches install.sh's own NS=esignet pattern, scaled to this profile's 3 +# instances). uitestrig gets its own namespace per instance, same as install.sh's +# NS=esignet-uitestrig (separate from esignet-apitestrig's namespace) and matching +# this DSF's existing signup-uitestrig precedent. +namespaces: + esignet-mock: + protected: false + esignet-mosipid: + protected: false + esignet-sunbird: + protected: false + esignet-uitestrig: + protected: false + esignet-mosipid-uitestrig: + protected: false + esignet-sunbird-uitestrig: + protected: false + signup: + protected: false + signup-uitestrig: + protected: false + +apps: + # --------------------------------------------------------------------------- + # eSignet API Testrig (Go harness) — esignet-mock namespace + # --------------------------------------------------------------------------- + esignet-apitestrig: + namespace: esignet-mock + enabled: true + version: 2.0.0 + chart: mosip/esignet-apitestrig + set: + apitestrig.configFile: /app/data/config/config.mock.json + # No plan JSON files provisioned for this profile — see header comment. + apitestrig.surfaces: "api,e2e" + apitestrig.extraEnvVars.MOSIP_ESIGNET_BASE_URL: "https://esignet.${domain_name}/v1/esignet" + apitestrig.extraEnvVars.KEYCLOAK_TOKEN_URL: "https://iam.${domain_name}/auth/realms/mosip/protocol/openid-connect/token" + apitestrig.extraEnvVars.KEYCLOAK_CLIENT_ID: "mosip-pms-client" + apitestrig.extraEnvVarsSecret.KEYCLOAK_CLIENT_SECRET: "${PMS_CLIENT_SECRET_VALUE}" + reports.persistence.enabled: "true" + timeout: 900 + priority: -8 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh" + + # --------------------------------------------------------------------------- + # eSignet-MOSIPID API Testrig (Go harness) — esignet-mosipid namespace + # Only instance with real test-identity/onboarding values — see header comment. + # --------------------------------------------------------------------------- + esignet-mosipid-apitestrig: + namespace: esignet-mosipid + enabled: true + version: 2.0.0 + chart: mosip/esignet-apitestrig + set: + apitestrig.configFile: /app/data/config/config.mosip.json + apitestrig.surfaces: "api,e2e" + apitestrig.extraEnvVars.MOSIP_ESIGNET_BASE_URL: "https://esignet-mosipid.${domain_name}/v1/esignet" + apitestrig.extraEnvVars.KEYCLOAK_TOKEN_URL: "https://iam.${domain_name}/auth/realms/mosip/protocol/openid-connect/token" + apitestrig.extraEnvVars.KEYCLOAK_CLIENT_ID: "mosip-pms-client" + apitestrig.extraEnvVars.ID_TYPE: "uin" + apitestrig.extraEnvVars.OTP_WS_URL: "https://smtp.${domain_name}" + apitestrig.extraEnvVars.OTP_RECIPIENT_EMAIL: "${MOSIPID_TESTRIG_OTP_RECIPIENT}" + apitestrig.extraEnvVars.PMS_BASE_URL: "https://api-internal.${mosipid_domain_name}/v1/partnermanager" + apitestrig.extraEnvVars.AUTH_PARTNER_ID: "${MOSIPID_TESTRIG_AUTH_PARTNER_ID}" + apitestrig.extraEnvVars.AUTH_POLICY_ID: "${MOSIPID_TESTRIG_AUTH_POLICY_ID}" + apitestrig.extraEnvVarsSecret.KEYCLOAK_CLIENT_SECRET: "${PMS_CLIENT_SECRET_VALUE}" + apitestrig.extraEnvVarsSecret.INDIVIDUAL_ID: "${MOSIPID_TESTRIG_INDIVIDUAL_ID}" + reports.persistence.enabled: "true" + timeout: 900 + priority: -7 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid-setup.sh" + + # --------------------------------------------------------------------------- + # eSignet-Sunbird API Testrig (Go harness) — esignet-sunbird namespace + # --------------------------------------------------------------------------- + esignet-sunbird-apitestrig: + namespace: esignet-sunbird + enabled: true + version: 2.0.0 + chart: mosip/esignet-apitestrig + set: + apitestrig.configFile: /app/data/config/config.sunbird.json + apitestrig.surfaces: "api,e2e" + apitestrig.extraEnvVars.MOSIP_ESIGNET_BASE_URL: "https://esignet-sunbird.${domain_name}/v1/esignet" + apitestrig.extraEnvVars.KEYCLOAK_TOKEN_URL: "https://iam.${domain_name}/auth/realms/mosip/protocol/openid-connect/token" + apitestrig.extraEnvVars.KEYCLOAK_CLIENT_ID: "mosip-pms-client" + apitestrig.extraEnvVarsSecret.KEYCLOAK_CLIENT_SECRET: "${PMS_CLIENT_SECRET_VALUE}" + reports.persistence.enabled: "true" + timeout: 900 + priority: -6 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh" + + # --------------------------------------------------------------------------- + # eSignet UI Testrig (Java harness, uitest-esignet image) — own namespace + # --------------------------------------------------------------------------- + esignet-uitestrig: + namespace: esignet-uitestrig + enabled: true + version: 2.0.0 + chart: mosip/esignet-uitestrig + set: + uitestrig.extraEnvVars.ENV_ENDPOINT: "https://api-internal.${domain_name}" + uitestrig.extraEnvVars.ENV_USER: "api-internal.${env_name}" + uitestrig.configMap.baseurl: "https://healthservices.${domain_name}/" + uitestrig.configMap.eSignetbaseurl: "https://esignet.${domain_name}" + uitestrig.configMap.pluginToExecute: "mock" + uitestrig.configMap.esignetDbHost: "postgres-postgresql.postgres" + uitestrig.configMap.esignetDbPort: "${esignet_db_port}" + uitestrig.secret.esignetDbPassword: "${DB_USER_PASSWORD}" + uitestrig.secret.keycloak_Password: "${MOSIPID_KEYCLOAK_ADMIN_PASSWORD}" + uitestrig.secret.mosip_testrig_client_secret: "${ESIGNET_UITESTRIG_CLIENT_SECRET}" + uitestrig.secret.oidcClientId: "${ESIGNET_UITESTRIG_OIDC_CLIENT_ID}" + reports.persistence.enabled: "true" + timeout: 1800 + priority: -5 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/uitestrig-esignet-setup.sh" + + # --------------------------------------------------------------------------- + # eSignet-MOSIPID UI Testrig — own namespace + # Only instance with real test-identity values — see header comment. + # --------------------------------------------------------------------------- + esignet-mosipid-uitestrig: + namespace: esignet-mosipid-uitestrig + enabled: true + version: 2.0.0 + chart: mosip/esignet-uitestrig + set: + uitestrig.extraEnvVars.ENV_ENDPOINT: "https://api-internal.${mosipid_domain_name}" + uitestrig.extraEnvVars.ENV_USER: "api-internal.${env_name}" + uitestrig.configMap.baseurl: "https://healthservices-mosipid.${domain_name}/" + uitestrig.configMap.eSignetbaseurl: "https://esignet-mosipid.${domain_name}" + uitestrig.configMap.pluginToExecute: "mosip" + uitestrig.configMap.esignetDbHost: "postgres-postgresql.postgres" + uitestrig.configMap.esignetDbPort: "${esignet_db_port}" + uitestrig.secret.esignetDbPassword: "${DB_USER_PASSWORD}" + uitestrig.secret.keycloak_Password: "${MOSIPID_KEYCLOAK_ADMIN_PASSWORD}" + uitestrig.secret.mosip_testrig_client_secret: "${ESIGNET_UITESTRIG_CLIENT_SECRET}" + uitestrig.secret.oidcClientId: "${ESIGNET_UITESTRIG_OIDC_CLIENT_ID}" + uitestrig.secret.uin: "${MOSIPID_TESTRIG_UIN}" + uitestrig.secret.vid: "${MOSIPID_TESTRIG_VID}" + uitestrig.secret.uinPhoneNumber: "${MOSIPID_TESTRIG_PHONE_NUMBER}" + uitestrig.secret.emailLoginId: "${MOSIPID_TESTRIG_EMAIL_LOGIN_ID}" + uitestrig.secret.passwordLoginUin: "${MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN}" + uitestrig.secret.passwordLoginPassword: "${MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD}" + reports.persistence.enabled: "true" + timeout: 1800 + priority: -4 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/uitestrig-esignet-mosipid-setup.sh" + + # --------------------------------------------------------------------------- + # eSignet-Sunbird UI Testrig — own namespace + # --------------------------------------------------------------------------- + esignet-sunbird-uitestrig: + namespace: esignet-sunbird-uitestrig + enabled: true + version: 2.0.0 + chart: mosip/esignet-uitestrig + set: + uitestrig.extraEnvVars.ENV_ENDPOINT: "https://api-internal.${domain_name}" + uitestrig.extraEnvVars.ENV_USER: "api-internal.${env_name}" + uitestrig.configMap.baseurl: "https://healthservices-sunbird.${domain_name}/" + uitestrig.configMap.eSignetbaseurl: "https://esignet-sunbird.${domain_name}" + uitestrig.configMap.pluginToExecute: "sunbird" + uitestrig.configMap.esignetDbHost: "postgres-postgresql.postgres" + uitestrig.configMap.esignetDbPort: "${esignet_db_port}" + uitestrig.secret.esignetDbPassword: "${DB_USER_PASSWORD}" + uitestrig.secret.keycloak_Password: "${MOSIPID_KEYCLOAK_ADMIN_PASSWORD}" + uitestrig.secret.mosip_testrig_client_secret: "${ESIGNET_UITESTRIG_CLIENT_SECRET}" + uitestrig.secret.oidcClientId: "${ESIGNET_UITESTRIG_OIDC_CLIENT_ID}" + reports.persistence.enabled: "true" + timeout: 1800 + priority: -3 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/uitestrig-esignet-sunbird-setup.sh" + + # --------------------------------------------------------------------------- + # Signup API Test Rig — disabled by default + # Enable only if signup stack (signup-dsf) is deployed. Still the generic + # mosip/apitestrig chart — eSignet's own esignet-apitestrig deploy scripts don't + # cover signup. + # --------------------------------------------------------------------------- + esignet-signup-apitestrig: + namespace: signup + enabled: false + version: 0.0.1-develop + chart: mosip/apitestrig + valuesFile: "$WORKDIR/utils/esignet-signup-apitestrig-values.yaml" + set: + crontime: "0 2 * * *" + apitestrig.configmaps.s3.s3-host: 'http://minio.minio:9000' + apitestrig.configmaps.s3.s3-user-key: 'admin' + apitestrig.configmaps.s3.s3-region: '' + apitestrig.configmaps.db.db-server: "api-internal.${domain_name}" + apitestrig.configmaps.db.db-su-user: "postgres" + apitestrig.configmaps.db.db-port: "${esignet_db_port}" + apitestrig.configmaps.apitestrig.ENV_USER: "api-internal.${env_name}" + apitestrig.configmaps.apitestrig.ENV_ENDPOINT: "https://api-internal.${domain_name}" + apitestrig.configmaps.apitestrig.ENV_TESTLEVEL: "smokeAndRegression" + apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" + apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" + apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" + apitestrig.configmaps.apitestrig.NS: "signup" + apitestrig.configmaps.apitestrig.servicesNotDeployed: '' + secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" + apitestrig.variables.push_reports_to_s3: "yes" + priority: -2 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-signup-setup.sh" + + # --------------------------------------------------------------------------- + # Signup UI Test Rig — disabled by default + # Enable only if signup stack (signup-dsf) is deployed. + # --------------------------------------------------------------------------- + signup-uitestrig: + namespace: signup-uitestrig + enabled: false + version: 0.0.1-develop + chart: mosip/uitestrig + valuesFile: "$WORKDIR/utils/signup-uitestrig-values.yaml" + set: + crontime: "0 3 * * *" + uitestrig.configmaps.s3.s3-host: "http://minio.minio:9000" + uitestrig.configmaps.s3.s3-user-key: "admin" + uitestrig.configmaps.s3.s3-region: "" + uitestrig.configmaps.db.db-server: "api-internal.${domain_name}" + uitestrig.configmaps.db.db-su-user: "postgres" + uitestrig.configmaps.db.db-port: "${esignet_db_port}" + uitestrig.configmaps.uitestrig.ENV_USER: "api-internal.${env_name}" + uitestrig.configmaps.uitestrig.ENV_ENDPOINT: "https://api-internal.${domain_name}" + uitestrig.configmaps.uitestrig.reportExpirationInDays: "3" + uitestrig.configmaps.uitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" + uitestrig.configmaps.uitestrig.eSignetDeployed: "yes" + uitestrig.configmaps.uitestrig.NS: "signup-uitestrig" + uitestrig.variables.push_reports_to_s3: "yes" + priority: -1 + hooks: + preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh" diff --git a/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml b/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml index bdeb831ef..8a5660497 100644 --- a/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/esignet-dsf.yaml @@ -32,9 +32,7 @@ namespaces: protected: false softhsm: protected: false - esignet-mosipid1: - protected: false - esignet-mosipid2: + esignet-mosipid: protected: false esignet-sunbird: protected: false @@ -56,27 +54,16 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/softhsm-esignet-setup.sh" - esignet-softhsm-mosipid1: - namespace: esignet-mosipid1 + esignet-softhsm-mosipid: + namespace: esignet-mosipid enabled: true version: 12.0.1 chart: mosip/softhsm - valuesFile: "$WORKDIR/utils/softhsm-esignet-mosipid1-values.yaml" + valuesFile: "$WORKDIR/utils/softhsm-esignet-mosipid-values.yaml" timeout: 480 priority: -16 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/softhsm-esignet-mosipid1-setup.sh" - - esignet-softhsm-mosipid2: - namespace: esignet-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 12.0.1 - chart: mosip/softhsm - valuesFile: "$WORKDIR/utils/softhsm-esignet-mosipid2-values.yaml" - timeout: 480 - priority: -16 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/softhsm-esignet-mosipid2-setup.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/softhsm-esignet-mosipid-setup.sh" esignet-softhsm-sunbird: namespace: esignet-sunbird @@ -89,19 +76,6 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/softhsm-esignet-sunbird-setup.sh" - esignet-config-server: - namespace: esignet-mock - enabled: false - version: 12.0.1 - chart: mosip/config-server - valuesFile: "$WORKDIR/utils/config-server-esignet-values.yaml" - wait: true - timeout: 1200 - priority: -15 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/config-server-esignet-setup.sh" - postInstall: "$WORKDIR/hooks/esignet-standalone/config-server-esignet-postinstall.sh" - # --------------------------------------------------------------------------- # eSignet v1.7.1 # --------------------------------------------------------------------------- @@ -136,12 +110,12 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/esignet-preinstall.sh" - esignet-mosipid1: - namespace: esignet-mosipid1 + esignet-mosipid: + namespace: esignet-mosipid enabled: true version: 0.1.0-develop chart: mosip/esignet - valuesFile: "$WORKDIR/utils/esignet-mosipid1-plugin-values.yaml" + valuesFile: "$WORKDIR/utils/esignet-mosipid-plugin-values.yaml" set: image.repository: "mosipqa/esignet-with-plugins" image.tag: "develop" @@ -150,71 +124,31 @@ apps: activeProfileEnv: "" pluginNameEnv: "mosip-identity-plugin.jar" pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-mosipid1-share" + extraEnvVarsCM[0]: "esignet-softhsm-mosipid-share" extraEnvVarsCM[1]: "esignet-global" metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-mosipid1.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-mosipid1.${domain_name}" + domainConfig.MOSIP_ESIGNET_HOST: "esignet-mosipid.${domain_name}" + domainConfig.MOSIP_SIGNUP_HOST: "signup-mosipid.${domain_name}" domainConfig.MOSIP_API_HOST: "api.${domain_name}" domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid1_domain_name}" + domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid_domain_name}" domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" - domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid1_domain_name}" - domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid1_domain_name}" - domainConfig.IDA_INTERNAL_URL: "https://api-internal.${mosipid1_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL: "https://api-internal.${mosipid1_domain_name}/mosip-certs/ida-partner.cer" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid1_domain_name}/v1/authmanager/authenticate/clientidsecretkey" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid1_domain_name}/v1/auditmanager/audits" - domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid1_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-mosipid1.${domain_name}" - domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-mosipid1.${domain_name}" + domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid_domain_name}" + domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid_domain_name}" + domainConfig.IDA_INTERNAL_URL: "https://api-internal.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL: "https://api-internal.${mosipid_domain_name}/mosip-certs/ida-partner.cer" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid_domain_name}/v1/authmanager/authenticate/clientidsecretkey" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid_domain_name}/v1/auditmanager/audits" + domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-mosipid.${domain_name}" + domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-mosipid.${domain_name}" timeout: 600 priority: -14 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/esignet-mosipid1-preinstall.sh" - - esignet-mosipid2: - namespace: esignet-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/esignet - valuesFile: "$WORKDIR/utils/esignet-mosipid2-plugin-values.yaml" - set: - image.repository: "mosipqa/esignet-with-plugins" - image.tag: "develop" - enable_insecure: "false" - springConfigNameEnv: "" - activeProfileEnv: "" - pluginNameEnv: "mosip-identity-plugin.jar" - pluginUrlEnv: "" - extraEnvVarsCM[0]: "esignet-softhsm-mosipid2-share" - extraEnvVarsCM[1]: "esignet-global" - metrics.serviceMonitor.enabled: "false" - domainConfig.MOSIP_ESIGNET_HOST: "esignet-mosipid2.${domain_name}" - domainConfig.MOSIP_SIGNUP_HOST: "signup-mosipid2.${domain_name}" - domainConfig.MOSIP_API_HOST: "api.${domain_name}" - domainConfig.MOSIP_IAM_EXTERNAL_HOST: "iam.${domain_name}" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${mosipid2_domain_name}" - domainConfig.MOSIP_KAFKA_HOST: "kafka.${domain_name}" - domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" - domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" - domainConfig.installation-domain: "${domain_name}" - domainConfig.IDA_AUTH_URL: "https://api-internal.${mosipid2_domain_name}" - domainConfig.IDA_OTP_URL: "https://api-internal.${mosipid2_domain_name}" - domainConfig.IDA_INTERNAL_URL: "https://api-internal.${mosipid2_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_CERT_URL: "https://api-internal.${mosipid2_domain_name}/mosip-certs/ida-partner.cer" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUTH_TOKEN_URL: "https://api-internal.${mosipid2_domain_name}/v1/authmanager/authenticate/clientidsecretkey" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_AUDIT_MANAGER_URL: "https://api-internal.${mosipid2_domain_name}/v1/auditmanager/audits" - domainConfig.MOSIP_ESIGNET_IDA_AUTH_DOMAIN: "https://api-internal.${mosipid2_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_IDA_DOMAINURI: "https://esignet-mosipid2.${domain_name}" - domainConfig.MOSIP_ESIGNET_DOMAIN_URL: "https://esignet-mosipid2.${domain_name}" - timeout: 600 - priority: -14 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/esignet-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/esignet-mosipid-preinstall.sh" esignet-sunbird: namespace: esignet-sunbird @@ -242,9 +176,9 @@ apps: domainConfig.MOSIP_POSTGRES_HOST: "postgres.${domain_name}" domainConfig.MOSIP_SMTP_HOST: "smtp.${domain_name}" domainConfig.installation-domain: "${domain_name}" - domainConfig.MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid1_domain_name}" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL: "https://registry.${mosipid1_domain_name}/api/v1/Insurance/search" - domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid1_domain_name}/api/v1/Insurance/" + domainConfig.MOSIP_ESIGNET_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid_domain_name}" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_AUTH_FACTOR_KBI_REGISTRY_SEARCH_URL: "https://registry.${mosipid_domain_name}/api/v1/Insurance/search" + domainConfig.MOSIP_ESIGNET_AUTHENTICATOR_SUNBIRD_RC_REGISTRY_GET_URL: "https://registry.${mosipid_domain_name}/api/v1/Insurance/" timeout: 600 priority: -14 hooks: @@ -270,39 +204,22 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/oidc-ui-preinstall.sh" - oidc-ui-mosipid1: - namespace: esignet-mosipid1 + oidc-ui-mosipid: + namespace: esignet-mosipid enabled: true version: 0.1.0-develop chart: mosip/oidc-ui set: image.repository: "mosipqa/oidc-ui" image.tag: "develop" - istio.hosts[0]: "esignet-mosipid1.${domain_name}" - oidc_ui.oidc_service_host: "esignet-mosipid1.esignet-mosipid1" - oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mosipid1.esignet-mosipid1/v1/esignet" - oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mosipid1.esignet-mosipid1" - timeout: 1200 - priority: -13 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/oidc-ui-mosipid1-preinstall.sh" - - oidc-ui-mosipid2: - namespace: esignet-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/oidc-ui - set: - image.repository: "mosipqa/oidc-ui" - image.tag: "develop" - istio.hosts[0]: "esignet-mosipid2.${domain_name}" - oidc_ui.oidc_service_host: "esignet-mosipid2.esignet-mosipid2" - oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mosipid2.esignet-mosipid2/v1/esignet" - oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mosipid2.esignet-mosipid2" + istio.hosts[0]: "esignet-mosipid.${domain_name}" + oidc_ui.oidc_service_host: "esignet-mosipid.esignet-mosipid" + oidc_ui.configmaps.oidc-ui.REACT_APP_API_BASE_URL: "http://esignet-mosipid.esignet-mosipid/v1/esignet" + oidc_ui.configmaps.oidc-ui.REACT_APP_SBI_DOMAIN_URI: "http://esignet-mosipid.esignet-mosipid" timeout: 1200 priority: -13 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/oidc-ui-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/oidc-ui-mosipid-preinstall.sh" oidc-ui-sunbird: namespace: esignet-sunbird @@ -385,35 +302,20 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-service-preinstall.sh" - mock-relying-party-service-mosipid1: - namespace: esignet-mosipid1 + mock-relying-party-service-mosipid: + namespace: esignet-mosipid enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-service set: - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-mosipid1.esignet-mosipid1/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-mosipid1.${domain_name}/v1/esignet/oauth/v2/token" - enable_insecure: "false" - domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" - timeout: 480 - priority: -10 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-service-mosipid1-preinstall.sh" - - mock-relying-party-service-mosipid2: - namespace: esignet-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/mock-relying-party-service - set: - mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-mosipid2.esignet-mosipid2/v1/esignet" - mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-mosipid2.${domain_name}/v1/esignet/oauth/v2/token" + mock_relying_party_service.ESIGNET_SERVICE_URL: "http://esignet-mosipid.esignet-mosipid/v1/esignet" + mock_relying_party_service.ESIGNET_AUD_URL: "https://esignet-mosipid.${domain_name}/v1/esignet/oauth/v2/token" enable_insecure: "false" domainConfig.MOSIP_API_INTERNAL_HOST: "api-internal.${domain_name}" timeout: 480 priority: -10 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-service-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-service-mosipid-preinstall.sh" mock-relying-party-service-sunbird: namespace: esignet-sunbird @@ -443,6 +345,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices.${domain_name}" wait: true timeout: 480 @@ -450,45 +366,39 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-ui-preinstall.sh" - mock-relying-party-ui-mosipid1: - namespace: esignet-mosipid1 + mock-relying-party-ui-mosipid: + namespace: esignet-mosipid enabled: true version: 0.0.1-develop chart: mosip/mock-relying-party-ui set: - mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-mosipid1.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-mosipid1.esignet-mosipid1" - mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-mosipid1.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-mosipid1.${domain_name}/mock-relying-party-service" - mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid1.${domain_name}/userprofile" - mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid1.${domain_name}/registration" - mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid1.${domain_name}/plugins/sign-in-button-plugin.js" - istio.hosts[0]: "healthservices-mosipid1.${domain_name}" + mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-mosipid.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-mosipid.esignet-mosipid" + mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-mosipid.${domain_name}" + mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-mosipid.${domain_name}/mock-relying-party-service" + mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid.${domain_name}/userprofile" + mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid.${domain_name}/registration" + mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge + istio.hosts[0]: "healthservices-mosipid.${domain_name}" wait: true timeout: 480 priority: -9 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-ui-mosipid1-preinstall.sh" - - mock-relying-party-ui-mosipid2: - namespace: esignet-mosipid2 - enabled: ${MOSIPID2_ENABLED} - version: 0.0.1-develop - chart: mosip/mock-relying-party-ui - set: - mock_relying_party_ui.mock_relying_party_ui_service_host: "healthservices-mosipid2.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVICE_INTERNAL_URL: "http://mock-relying-party-service-mosipid2.esignet-mosipid2" - mock_relying_party_ui.ESIGNET_UI_BASE_URL: "https://esignet-mosipid2.${domain_name}" - mock_relying_party_ui.MOCK_RELYING_PARTY_SERVER_URL: "https://healthservices-mosipid2.${domain_name}/mock-relying-party-service" - mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid2.${domain_name}/userprofile" - mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid2.${domain_name}/registration" - mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid2.${domain_name}/plugins/sign-in-button-plugin.js" - istio.hosts[0]: "healthservices-mosipid2.${domain_name}" - wait: true - timeout: 480 - priority: -9 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-ui-mosipid2-preinstall.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-ui-mosipid-preinstall.sh" mock-relying-party-ui-sunbird: namespace: esignet-sunbird @@ -503,6 +413,20 @@ apps: mock_relying_party_ui.REDIRECT_URI: "https://healthservices-sunbird.${domain_name}/userprofile" mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-sunbird.${domain_name}/registration" mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-sunbird.${domain_name}/plugins/sign-in-button-plugin.js" + mock_relying_party_ui.mock_relying_party_ui_port: '5000' + mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ + mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet + mock_relying_party_ui.DISPLAY: page + mock_relying_party_ui.PROMPT: consent + mock_relying_party_ui.GRANT_TYPE: authorization_code + mock_relying_party_ui.CLAIMS_LOCALES: en + mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile + mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D' + mock_relying_party_ui.DEFAULT_LANG: en + mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D' + mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize + mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge istio.hosts[0]: "healthservices-sunbird.${domain_name}" wait: true timeout: 480 @@ -510,81 +434,6 @@ apps: hooks: preInstall: "$WORKDIR/hooks/esignet-standalone/mock-relying-party-ui-sunbird-preinstall.sh" - pms-partner-mosipid1: - namespace: esignet-mosipid1 - enabled: false - version: 12.2.3 - chart: mosip/pms-partner - set: - # image.repository: "mosipid/partner-management-service" - # image.tag: "1.2.2.3" - istio.gateways[0]: "pms-partner-mosipid1-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid1.${domain_name}" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-share" - priority: -9 - timeout: 1200 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/pms-partner-mosipid1-preinstall.sh" - - pms-policy-mosipid1: - namespace: esignet-mosipid1 - enabled: false - version: 12.2.3 - chart: mosip/pms-policy - set: - # image.repository: "mosipid/policy-management-service" - # image.tag: "1.2.2.2" - istio.gateways[0]: "pms-partner-mosipid1-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid1.${domain_name}" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-share" - priority: -9 - timeout: 1200 - - pms-partner-mosipid2: - namespace: esignet-mosipid2 - enabled: false - version: 12.2.3 - chart: mosip/pms-partner - set: - # image.repository: "mosipid/partner-management-service" - # image.tag: "1.2.2.3" - istio.gateways[0]: "pms-partner-mosipid2-gateway" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid2.${domain_name}" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-share" - priority: -9 - timeout: 1200 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/pms-partner-mosipid2-preinstall.sh" - - pms-policy-mosipid2: - namespace: esignet-mosipid2 - enabled: false - version: 12.2.3 - chart: mosip/pms-policy - set: - # image.repository: "mosipid/policy-management-service" - # image.tag: "1.2.2.2" - istio.gateways[0]: "pms-partner-mosipid2-gateway" - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "esignet-config-server-share" - istio.corsPolicy.allowOrigins[0].prefix: "https://pms-mosipid2.${domain_name}" - priority: -9 - timeout: 1200 - - # --------------------------------------------------------------------------- - # Partner Onboarders - # --------------------------------------------------------------------------- - # Two onboarders for eSignet standalone — enable the one matching your plugin: - # esignet-mock-rp-onboarder: for mock plugin (plugin 1) and sunbird-rc (plugin 3) - # esignet-misp-onboarder: for mosip-identity-plugin (plugin 2) only - - # eSignet MISP Partner Onboarder - # Onboards the eSignet MISP client — only needed with mosip-identity-plugin (plugin 2). - # Runs FIRST so the MISP license key is written before mock-rp-onboarder starts. - # After completion, restarts the esignet deployment to pick up the new MISP license key. esignet-misp-onboarder: namespace: esignet-mock enabled: false diff --git a/Helmsman/dsf/esignet-standalone/external-dsf.yaml b/Helmsman/dsf/esignet-standalone/external-dsf.yaml index d927abbaf..9b1ec09e4 100644 --- a/Helmsman/dsf/esignet-standalone/external-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/external-dsf.yaml @@ -109,43 +109,32 @@ apps: databases.mosip_esignet.host: "postgres.${domain_name}" databases.mosip_esignet.port: ${esignet_db_port} databases.mosip_esignet.dml: 1 - databases.mosip_esignet_mosipid1.repoUrl: "https://github.com/mosip/esignet.git" - databases.mosip_esignet_mosipid1.defaultDb: "postgres" - databases.mosip_esignet_mosipid1.su.user: "postgres" - databases.mosip_esignet_mosipid1.su.secret.name: "postgres-postgresql" - databases.mosip_esignet_mosipid1.su.secret.key: "postgres-password" + databases.mosip_esignet.repoUrl: "https://github.com/mosip/esignet.git" + databases.mosip_esignet.defaultDb: "postgres" + databases.mosip_esignet.su.user: "postgres" + databases.mosip_esignet.su.secret.name: "postgres-postgresql" + databases.mosip_esignet.su.secret.key: "postgres-password" + databases.mosip_esignet_mosipid.repoUrl: "https://github.com/mosip/esignet.git" + databases.mosip_esignet_mosipid.defaultDb: "postgres" + databases.mosip_esignet_mosipid.su.user: "postgres" + databases.mosip_esignet_mosipid.su.secret.name: "postgres-postgresql" + databases.mosip_esignet_mosipid.su.secret.key: "postgres-password" # --------------------------------------------------------------------------- - # esignet-mosipid1 namespace (plugin 2 - mosip-identity) + # esignet-mosipid namespace (plugin 2 - mosip-identity) # --------------------------------------------------------------------------- - databases.mosip_esignet_mosipid1.enabled: "true" - databases.mosip_esignet_mosipid1.scriptsDir: "mosip_esignet" - databases.mosip_esignet_mosipid1.dbName: "mosip_esignet_mosipid1" - databases.mosip_esignet_mosipid1.dbUser: "esignetuser_mosipid1" - databases.mosip_esignet_mosipid1.branch: "develop" - databases.mosip_esignet_mosipid1.host: "postgres.${domain_name}" - databases.mosip_esignet_mosipid1.port: ${esignet_db_port} - databases.mosip_esignet_mosipid1.dml: 1 - databases.mosip_esignet_mosipid1.repoUrl: "https://github.com/mosip/esignet.git" - databases.mosip_esignet_mosipid1.defaultDb: "postgres" - databases.mosip_esignet_mosipid1.su.user: "postgres" - databases.mosip_esignet_mosipid1.su.secret.name: "postgres-postgresql" - databases.mosip_esignet_mosipid1.su.secret.key: "postgres-password" - # --------------------------------------------------------------------------- - # esignet-mosipid2 namespace (plugin 2 - mosip-identity) - # --------------------------------------------------------------------------- - databases.mosip_esignet_mosipid2.enabled: "true" - databases.mosip_esignet_mosipid2.scriptsDir: "mosip_esignet" - databases.mosip_esignet_mosipid2.dbName: "mosip_esignet_mosipid2" - databases.mosip_esignet_mosipid2.dbUser: "esignetuser_mosipid2" - databases.mosip_esignet_mosipid2.branch: "develop" - databases.mosip_esignet_mosipid2.host: "postgres.${domain_name}" - databases.mosip_esignet_mosipid2.port: ${esignet_db_port} - databases.mosip_esignet_mosipid2.dml: 1 - databases.mosip_esignet_mosipid2.repoUrl: "https://github.com/mosip/esignet.git" - databases.mosip_esignet_mosipid2.defaultDb: "postgres" - databases.mosip_esignet_mosipid2.su.user: "postgres" - databases.mosip_esignet_mosipid2.su.secret.name: "postgres-postgresql" - databases.mosip_esignet_mosipid2.su.secret.key: "postgres-password" + databases.mosip_esignet_mosipid.enabled: "true" + databases.mosip_esignet_mosipid.scriptsDir: "mosip_esignet" + databases.mosip_esignet_mosipid.dbName: "mosip_esignet_mosipid" + databases.mosip_esignet_mosipid.dbUser: "esignetuser_mosipid" + databases.mosip_esignet_mosipid.branch: "develop" + databases.mosip_esignet_mosipid.host: "postgres.${domain_name}" + databases.mosip_esignet_mosipid.port: ${esignet_db_port} + databases.mosip_esignet_mosipid.dml: 1 + databases.mosip_esignet_mosipid.repoUrl: "https://github.com/mosip/esignet.git" + databases.mosip_esignet_mosipid.defaultDb: "postgres" + databases.mosip_esignet_mosipid.su.user: "postgres" + databases.mosip_esignet_mosipid.su.secret.name: "postgres-postgresql" + databases.mosip_esignet_mosipid.su.secret.key: "postgres-password" # --------------------------------------------------------------------------- # esignet-sunbird namespace (plugin 3 - sunbird-rc) # --------------------------------------------------------------------------- @@ -174,6 +163,74 @@ apps: databases.mosip_mockidentitysystem.repoUrl: "https://github.com/mosip/esignet-mock-services.git" databases.mosip_mockidentitysystem.port: ${esignet_db_port} databases.mosip_mockidentitysystem.dml: 1 + databases.mosip_mockidentitysystem.defaultDb: "postgres" + databases.mosip_mockidentitysystem.su.user: "postgres" + databases.mosip_mockidentitysystem.su.secret.name: "postgres-postgresql" + databases.mosip_mockidentitysystem.su.secret.key: "postgres-password" + # --------------------------------------------------------------------------- + # esignet-standalone-2.0.0 profile databases + # --------------------------------------------------------------------------- + # mosip_esignet_go / mosip_esignet_go_sunbird / mosip_esignet_go_mosipid are + # isolated databases dedicated to the Go profile, separate from the (retired) + # v1.7.1 profile's mosip_esignet / mosip_esignet_sunbird / mosip_esignet_mosipid + # above. Kept with the _go suffix so the key stays distinct from the v1.7.1 + # entries above in this flat set: map. branch: develop-go matches the esignet + # repo branch these three namespaces' images/DB-init scripts are built from. + # The esignet-standalone-2.0.0 preinstall hooks (esignet-preinstall.sh, + # esignet-sunbird-preinstall.sh, esignet-mosipid-preinstall.sh) must point + # postgres-config at these same db names/users. + databases.mosip_esignet_go.enabled: "true" + databases.mosip_esignet_go.scriptsDir: "mosip_esignet" + databases.mosip_esignet_go.dbName: "mosip_esignet_go" + databases.mosip_esignet_go.dbUser: "esignetuser_go" + databases.mosip_esignet_go.branch: "develop-go" + databases.mosip_esignet_go.host: "postgres.${domain_name}" + databases.mosip_esignet_go.port: ${esignet_db_port} + databases.mosip_esignet_go.dml: 1 + databases.mosip_esignet_go.repoUrl: "https://github.com/mosip/esignet.git" + databases.mosip_esignet_go.defaultDb: "postgres" + databases.mosip_esignet_go.su.user: "postgres" + databases.mosip_esignet_go.su.secret.name: "postgres-postgresql" + databases.mosip_esignet_go.su.secret.key: "postgres-password" + databases.mosip_esignet_go_mosipid.enabled: "true" + databases.mosip_esignet_go_mosipid.scriptsDir: "mosip_esignet" + databases.mosip_esignet_go_mosipid.dbName: "mosip_esignet_go_mosipid" + databases.mosip_esignet_go_mosipid.dbUser: "esignetuser_go_mosipid" + databases.mosip_esignet_go_mosipid.branch: "develop-go" + databases.mosip_esignet_go_mosipid.host: "postgres.${domain_name}" + databases.mosip_esignet_go_mosipid.port: ${esignet_db_port} + databases.mosip_esignet_go_mosipid.dml: 1 + databases.mosip_esignet_go_mosipid.repoUrl: "https://github.com/mosip/esignet.git" + databases.mosip_esignet_go_mosipid.defaultDb: "postgres" + databases.mosip_esignet_go_mosipid.su.user: "postgres" + databases.mosip_esignet_go_mosipid.su.secret.name: "postgres-postgresql" + databases.mosip_esignet_go_mosipid.su.secret.key: "postgres-password" + databases.mosip_esignet_go_sunbird.enabled: "true" + databases.mosip_esignet_go_sunbird.scriptsDir: "mosip_esignet" + databases.mosip_esignet_go_sunbird.dbName: "mosip_esignet_go_sunbird" + databases.mosip_esignet_go_sunbird.dbUser: "esignetuser_go_sunbird" + databases.mosip_esignet_go_sunbird.branch: "develop-go" + databases.mosip_esignet_go_sunbird.host: "postgres.${domain_name}" + databases.mosip_esignet_go_sunbird.port: ${esignet_db_port} + databases.mosip_esignet_go_sunbird.dml: 1 + databases.mosip_esignet_go_sunbird.repoUrl: "https://github.com/mosip/esignet.git" + databases.mosip_esignet_go_sunbird.defaultDb: "postgres" + databases.mosip_esignet_go_sunbird.su.user: "postgres" + databases.mosip_esignet_go_sunbird.su.secret.name: "postgres-postgresql" + databases.mosip_esignet_go_sunbird.su.secret.key: "postgres-password" + databases.mosip_mockidentitysystem_go.enabled: "false" + databases.mosip_mockidentitysystem_go.scriptsDir: "mosip_mockidentitysystem" + databases.mosip_mockidentitysystem_go.dbName: "mosip_mockidentitysystem_go" + databases.mosip_mockidentitysystem_go.dbUser: "mockidentityuser_go" + databases.mosip_mockidentitysystem_go.branch: "develop" + databases.mosip_mockidentitysystem_go.host: "postgres.${domain_name}" + databases.mosip_mockidentitysystem_go.repoUrl: "https://github.com/mosip/esignet-mock-services.git" + databases.mosip_mockidentitysystem_go.port: ${esignet_db_port} + databases.mosip_mockidentitysystem_go.dml: 1 + databases.mosip_mockidentitysystem_go.defaultDb: "postgres" + databases.mosip_mockidentitysystem_go.su.user: "postgres" + databases.mosip_mockidentitysystem_go.su.secret.name: "postgres-postgresql" + databases.mosip_mockidentitysystem_go.su.secret.key: "postgres-password" wait: true timeout: 300 priority: -16 @@ -188,7 +245,7 @@ apps: # Initializes mosip_audit, mosip_kernel, mosip_otp (v1.2.0.1 branch). postgres-init-signup: namespace: signup - enabled: true + enabled: false version: 12.0.1 chart: mosip/postgres-init set: @@ -230,6 +287,31 @@ apps: databases.mosip_otp.host: "postgres.${domain_name}" databases.mosip_otp.port: ${esignet_db_port} databases.mosip_otp.dml: 0 + # --------------------------------------------------------------------------- + # esignet-standalone-2.0.0 profile — signup/kernel databases + # --------------------------------------------------------------------------- + # Disabled — the Go profile shares the same physical mosip_audit/mosip_kernel/ + # mosip_otp databases as above instead of maintaining isolated duplicates. Kept + # with the _go suffix (rather than deleted) so the key stays distinct from the + # entries above in this flat set: map. + databases.mosip_audit_go.enabled: "false" + databases.mosip_audit_go.branch: "v1.2.0.1" + databases.mosip_audit_go.repoUrl: "https://github.com/mosip/audit-manager.git" + databases.mosip_audit_go.host: "postgres.${domain_name}" + databases.mosip_audit_go.port: ${esignet_db_port} + databases.mosip_audit_go.dml: 0 + databases.mosip_kernel_go.enabled: "false" + databases.mosip_kernel_go.branch: "v1.2.0.1" + databases.mosip_kernel_go.repoUrl: "https://github.com/mosip/commons.git" + databases.mosip_kernel_go.host: "postgres.${domain_name}" + databases.mosip_kernel_go.port: ${esignet_db_port} + databases.mosip_kernel_go.dml: 0 + databases.mosip_otp_go.enabled: "false" + databases.mosip_otp_go.branch: "v1.2.0.1" + databases.mosip_otp_go.repoUrl: "https://github.com/mosip/otp-manager.git" + databases.mosip_otp_go.host: "postgres.${domain_name}" + databases.mosip_otp_go.port: ${esignet_db_port} + databases.mosip_otp_go.dml: 0 wait: true timeout: 300 priority: -16 @@ -414,10 +496,17 @@ apps: captcha: namespace: captcha enabled: true - version: 0.1.0-beta.1 + version: 0.1.1 chart: mosip/captcha set: metrics.serviceMonitor.enabled: "false" + # Chart default extraEnvVars only contains MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_PREREGISTRATION, + # sourced from a mosip-captcha/prereg-captcha-secret-key secret that doesn't exist in this + # deployment (no preregistration module here) — empty it out so the chart doesn't try to + # wire up a nonexistent secret. esignet/mosipid/sunbird/signup captcha env vars are added + # separately via kubectl patch in the *-preinstall.sh / captcha-postinstall.sh hooks, not + # through this chart value. + extraEnvVars: "" wait: true timeout: 480 priority: -10 @@ -432,6 +521,11 @@ apps: set: image.repository: "mosipid/minio" image.tag: "2022.2.7-debian-10-r0" + # Required on upgrade - the chart's Bitnami-based validation rejects an + # empty auth.rootPassword once the release already exists. MINIO_ROOT_PASSWORD + # is fetched from the existing "minio" secret by the CI workflow before + # helmsman runs; empty on first install, which the chart auto-generates for. + auth.rootPassword: "${MINIO_ROOT_PASSWORD}" metrics.serviceMonitor.enabled: "true" extraEnvVars[0].name: "MINIO_PROMETHEUS_URL" extraEnvVars[0].value: "http://rancher-monitoring-prometheus.cattle-monitoring-system:9090" @@ -454,4 +548,4 @@ apps: timeout: 1200 hooks: postInstall: "$WORKDIR/hooks/s3-setup.sh" - priority: -2 \ No newline at end of file + priority: -2 diff --git a/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml b/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml index b6d8a16f8..8acfb445c 100644 --- a/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml +++ b/Helmsman/dsf/esignet-standalone/testrigs-dsf.yaml @@ -9,18 +9,15 @@ helmRepos: # Apitestrigs deploy into service namespaces (no dedicated testrig namespaces): # esignet-apitestrig → esignet ns -# esignet-mosipid1-apitestrig → esignet-mosipid1 ns -# esignet-mosipid2-apitestrig → esignet-mosipid2 ns +# esignet-mosipid-apitestrig → esignet-mosipid ns # esignet-sunbird-apitestrig → esignet-sunbird ns # esignet-signup-apitestrig → signup ns (disabled — enable if signup deployed) # signup-uitestrig → signup-uitestrig (disabled — enable if signup deployed) namespaces: - esignet-mosipid1: + esignet-mosipid: protected: false esignet-mock: protected: false - esignet-mosipid2: - protected: false esignet-sunbird: protected: false signup: @@ -75,10 +72,10 @@ apps: preInstall: "$WORKDIR/hooks/esignet-standalone/apitestrig-esignet-setup.sh" # --------------------------------------------------------------------------- - # eSignet API Testrig — esignet-mosipid1 namespace (mosip-identity-plugin) + # eSignet API Testrig — esignet-mosipid namespace (mosip-identity-plugin) # --------------------------------------------------------------------------- - esignet-mosipid1-apitestrig: - namespace: esignet-mosipid1 + esignet-mosipid-apitestrig: + namespace: esignet-mosipid enabled: true version: 0.0.1-develop chart: mosip/apitestrig @@ -89,15 +86,15 @@ apps: extraEnvVarsCM[2]: "keycloak-host" extraEnvVarsCM[3]: "db" extraEnvVarsCM[4]: "apitestrig" - extraEnvVarsSecret[0]: "apitestrig-esignet-mosipid1-apitestrig" - extraEnvVarsSecret[1]: "s3-esignet-mosipid1-apitestrig" + extraEnvVarsSecret[0]: "apitestrig-esignet-mosipid-apitestrig" + extraEnvVarsSecret[1]: "s3-esignet-mosipid-apitestrig" extraEnvVarsSecret[2]: "keycloak-client-secrets" extraEnvVarsSecret[3]: "postgres-postgresql" crontime: "0 2 * * *" apitestrig.configmaps.s3.s3-host: 'http://minio.minio:9000' apitestrig.configmaps.s3.s3-user-key: 'admin' apitestrig.configmaps.s3.s3-region: '' - apitestrig.configmaps.db.db-server: "api-internal.${mosipid1_domain_name}" + apitestrig.configmaps.db.db-server: "api-internal.${mosipid_domain_name}" apitestrig.configmaps.db.db-su-user: "postgres" apitestrig.configmaps.db.db-port: "${esignet_db_port}" apitestrig.configmaps.apitestrig.ENV_USER: "api-internal.${env_name}" @@ -106,70 +103,20 @@ apps: apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-mosipid1" + apitestrig.configmaps.apitestrig.NS: "esignet-mosipid" apitestrig.configmaps.apitestrig.servicesNotDeployed: 'sunbirdrc' apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-mosipid1.${domain_name}" + apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-mosipid.${domain_name}" apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid1_domain_name};idrepository=api-internal.${mosipid1_domain_name};authmanager=api-internal.${mosipid1_domain_name};resident=api-internal.${mosipid1_domain_name};partnermanager=pms-mosipid1.${mosipid1_domain_name};idauthentication=api-internal.${mosipid1_domain_name};masterdata=api-internal.${mosipid1_domain_name};idgenerator=api-internal.${mosipid1_domain_name};policymanager=pms-mosipid1.${mosipid1_domain_name};preregistration=api-internal.${mosipid1_domain_name};keymanager=api-internal.${mosipid1_domain_name};" + apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid_domain_name};idrepository=api-internal.${mosipid_domain_name};authmanager=api-internal.${mosipid_domain_name};resident=api-internal.${mosipid_domain_name};idauthentication=api-internal.${mosipid_domain_name};masterdata=api-internal.${mosipid_domain_name};idgenerator=api-internal.${mosipid_domain_name};preregistration=api-internal.${mosipid_domain_name};keymanager=api-internal.${mosipid_domain_name};" secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" priority: -4 hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/apitestrig-esignet-mosipid1-setup.sh" - - # --------------------------------------------------------------------------- - # eSignet API Testrig — esignet-mosipid2 namespace (mosip-identity-plugin) - # --------------------------------------------------------------------------- - esignet-mosipid2-apitestrig: - namespace: esignet-mosipid2 - enabled: true - version: 0.0.1-develop - chart: mosip/apitestrig - valuesFile: "$WORKDIR/utils/esignet-apitestrig-values.yaml" - set: - extraEnvVarsCM[0]: "esignet-global" - extraEnvVarsCM[1]: "s3" - extraEnvVarsCM[2]: "keycloak-host" - extraEnvVarsCM[3]: "db" - extraEnvVarsCM[4]: "apitestrig" - extraEnvVarsSecret[0]: "apitestrig-esignet-mosipid2-apitestrig" - extraEnvVarsSecret[1]: "s3-esignet-mosipid2-apitestrig" - extraEnvVarsSecret[2]: "keycloak-client-secrets" - extraEnvVarsSecret[3]: "postgres-postgresql" - crontime: "0 2 * * *" - apitestrig.configmaps.s3.s3-host: 'http://minio.minio:9000' - apitestrig.configmaps.s3.s3-user-key: 'admin' - apitestrig.configmaps.s3.s3-region: '' - apitestrig.configmaps.db.db-server: "api-internal.${mosipid2_domain_name}" - apitestrig.configmaps.db.db-su-user: "postgres" - apitestrig.configmaps.db.db-port: "${esignet_db_port}" - apitestrig.configmaps.apitestrig.ENV_USER: "api-internal.${env_name}" - apitestrig.configmaps.apitestrig.ENV_ENDPOINT: "https://api-internal.${domain_name}" - apitestrig.configmaps.apitestrig.ENV_TESTLEVEL: "smokeAndRegression" - apitestrig.configmaps.apitestrig.reportExpirationInDays: "3" - apitestrig.configmaps.apitestrig.slack-webhook-url: "${SLACK_WEBHOOK_URL}" - apitestrig.configmaps.apitestrig.eSignetDeployed: "yes" - apitestrig.configmaps.apitestrig.NS: "esignet-mosipid2" - apitestrig.configmaps.apitestrig.servicesNotDeployed: 'sunbirdrc' - apitestrig.configmaps.apitestrig.uinGenerationProcessingDelayTimeInMilliSeconds: "90000" - apitestrig.configmaps.apitestrig.vidGenerationProcessingDelayTimeInMilliSeconds: "90000" - apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" - apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-mosipid2.${domain_name}" - apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.mosip_components_base_urls: "auditmanager=api-internal.${mosipid2_domain_name};idrepository=api-internal.${mosipid2_domain_name};authmanager=api-internal.${mosipid2_domain_name};resident=api-internal.${mosipid2_domain_name};partnermanager=pms-mosipid2.${mosipid2_domain_name};idauthentication=api-internal.${mosipid2_domain_name};masterdata=api-internal.${mosipid2_domain_name};idgenerator=api-internal.${mosipid2_domain_name};policymanager=pms-mosipid2.${mosipid2_domain_name};preregistration=api-internal.${mosipid2_domain_name};keymanager=api-internal.${mosipid2_domain_name};" - secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" - apitestrig.variables.push_reports_to_s3: "yes" - priority: -3 - hooks: - preInstall: "$WORKDIR/hooks/esignet-standalone/apitestrig-esignet-mosipid2-setup.sh" + preInstall: "$WORKDIR/hooks/esignet-standalone/apitestrig-esignet-mosipid-setup.sh" - # --------------------------------------------------------------------------- - # eSignet API Testrig — esignet-sunbird namespace (sunbird-rc-plugin) - # postInstall triggers all four testrig namespaces after last one deploys. - # --------------------------------------------------------------------------- esignet-sunbird-apitestrig: namespace: esignet-sunbird enabled: true @@ -206,7 +153,7 @@ apps: apitestrig.configmaps.apitestrig.uinGenMaxLoopCount: "20" apitestrig.configmaps.apitestrig.eSignetbaseurl: "https://esignet-sunbird.${domain_name}" apitestrig.configmaps.apitestrig.esignetActuatorPropertySection: "classpath:/application-default.properties" - apitestrig.configmaps.apitestrig.sunBirdBaseURL: "https://registry.${mosipid1_domain_name}" + apitestrig.configmaps.apitestrig.sunBirdBaseURL: "https://registry.${mosipid_domain_name}" secrets.s3.s3-user-secret: "${MINIO_ROOT_PASSWORD}" apitestrig.variables.push_reports_to_s3: "yes" priority: -2 diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid-setup.sh new file mode 100755 index 000000000..8b582384a --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid-setup.sh @@ -0,0 +1,27 @@ +#!/bin/bash +# ============================================================================= +# eSignet Standalone 2.0.0 - eSignet-MOSIPID API Testrig Pre-install Setup +# ============================================================================= +# esignet-mosipid-apitestrig now deploys the dedicated mosip/esignet-apitestrig chart +# (the Go-harness rewrite - see https://github.com/mosip/esignet/blob/v2.0.0/deploy/esignet-apitestrig/install.sh), +# which manages its own Secret/ConfigMap from set: values directly - no pre-staged +# secrets needed, unlike the old generic mosip/apitestrig chart this replaces. +# +# The only job left here: delete the unmanaged s3/db/apitestrig ConfigMaps and the +# s3-esignet-mosipid-apitestrig/apitestrig-esignet-mosipid-apitestrig Secrets the OLD +# chart's own preInstall hook used to create directly via kubectl (Helm never owned +# them, so switching charts under the same release name won't clean them up on its own). +# ============================================================================= +set -euo pipefail + +NS=esignet-mosipid + +echo "================================================" +echo "eSignet Standalone 2.0.0 - eSignet-MOSIPID API Testrig Pre-install" +echo "================================================" + +echo "Deleting stale testrig resources from the old mosip/apitestrig-based release in $NS" +kubectl -n "$NS" delete --ignore-not-found=true configmap s3 db apitestrig +kubectl -n "$NS" delete --ignore-not-found=true secret s3-esignet-mosipid-apitestrig apitestrig-esignet-mosipid-apitestrig + +echo "eSignet-MOSIPID API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh new file mode 100755 index 000000000..3dfe1e529 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-setup.sh @@ -0,0 +1,27 @@ +#!/bin/bash +# ============================================================================= +# eSignet Standalone 2.0.0 - eSignet API Testrig Pre-install Setup +# ============================================================================= +# esignet-apitestrig now deploys the dedicated mosip/esignet-apitestrig chart (the +# Go-harness rewrite - see https://github.com/mosip/esignet/blob/v2.0.0/deploy/esignet-apitestrig/install.sh), +# which manages its own Secret/ConfigMap from set: values directly - no pre-staged +# secrets needed, unlike the old generic mosip/apitestrig chart this replaces. +# +# The only job left here: delete the unmanaged s3/db/apitestrig ConfigMaps and the +# s3-esignet-apitestrig/apitestrig-esignet-apitestrig Secrets the OLD chart's own +# preInstall hook used to create directly via kubectl (Helm never owned them, so +# switching charts under the same release name won't clean them up on its own). +# ============================================================================= +set -euo pipefail + +NS=esignet-mock + +echo "================================================" +echo "eSignet Standalone 2.0.0 - eSignet API Testrig Pre-install" +echo "================================================" + +echo "Deleting stale testrig resources from the old mosip/apitestrig-based release in $NS" +kubectl -n "$NS" delete --ignore-not-found=true configmap s3 db apitestrig +kubectl -n "$NS" delete --ignore-not-found=true secret s3-esignet-apitestrig apitestrig-esignet-apitestrig + +echo "eSignet API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh new file mode 100755 index 000000000..50635219b --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh @@ -0,0 +1,27 @@ +#!/bin/bash +# ============================================================================= +# eSignet Standalone 2.0.0 - eSignet-Sunbird API Testrig Pre-install Setup +# ============================================================================= +# esignet-sunbird-apitestrig now deploys the dedicated mosip/esignet-apitestrig chart +# (the Go-harness rewrite - see https://github.com/mosip/esignet/blob/v2.0.0/deploy/esignet-apitestrig/install.sh), +# which manages its own Secret/ConfigMap from set: values directly - no pre-staged +# secrets needed, unlike the old generic mosip/apitestrig chart this replaces. +# +# The only job left here: delete the unmanaged s3/db/apitestrig ConfigMaps and the +# s3-esignet-sunbird-apitestrig/apitestrig-esignet-sunbird-apitestrig Secrets the OLD +# chart's own preInstall hook used to create directly via kubectl (Helm never owned +# them, so switching charts under the same release name won't clean them up on its own). +# ============================================================================= +set -euo pipefail + +NS=esignet-sunbird + +echo "================================================" +echo "eSignet Standalone 2.0.0 - eSignet-Sunbird API Testrig Pre-install" +echo "================================================" + +echo "Deleting stale testrig resources from the old mosip/apitestrig-based release in $NS" +kubectl -n "$NS" delete --ignore-not-found=true configmap s3 db apitestrig +kubectl -n "$NS" delete --ignore-not-found=true secret s3-esignet-sunbird-apitestrig apitestrig-esignet-sunbird-apitestrig + +echo "eSignet-Sunbird API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid2-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-signup-setup.sh similarity index 70% rename from Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid2-setup.sh rename to Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-signup-setup.sh index 9f5f75258..d03208a1e 100755 --- a/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid2-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-signup-setup.sh @@ -1,19 +1,19 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet-MOSIPID2 API Testrig Pre-install Setup +# eSignet 1.7.1 - Signup API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-mosipid2 namespace for the esignet-mosipid2-apitestrig release. -# keycloak-host and keycloak-client-secrets are already present in esignet-mosipid2 -# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql +# Prepares the signup namespace for the esignet-signup-apitestrig release. +# keycloak-host and keycloak-client-secrets are already present in signup ns +# (copied by signup-keycloak-init-postinstall.sh). Only postgres-postgresql # needs to be copied; stale testrig CMs are deleted so the chart recreates them. # ============================================================================= set -euo pipefail -NS=esignet-mosipid2 +NS=signup COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" -echo "eSignet 1.7.1 - eSignet-MOSIPID2 API Testrig Pre-install" +echo "eSignet 1.7.1 - Signup API Testrig Pre-install" echo "================================================" echo "Deleting stale testrig configmaps in $NS" @@ -24,4 +24,4 @@ kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig echo "Copying postgres-postgresql secret to $NS" $COPY_UTIL secret postgres-postgresql postgres "$NS" -echo "eSignet-MOSIPID2 API Testrig pre-install setup completed." +echo "Signup API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh new file mode 100755 index 000000000..a6e42e923 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/captcha-postinstall.sh @@ -0,0 +1,70 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Captcha Post-install +# ============================================================================= +# Based on: deploy/captcha/install.sh +# Configures captcha secrets for eSignet and patches captcha deployment +# with the secret key environment variable. +# +# Environment Variables: +# ESIGNET_CAPTCHA_SITE_KEY - reCAPTCHA site key (REQUIRED) +# ESIGNET_CAPTCHA_SECRET_KEY - reCAPTCHA secret key (REQUIRED) +# ESIGNET_NS - eSignet namespace (default: esignet-mock) +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" +CAPTCHA_NS="captcha" +CAPTCHA_SITE_KEY="${ESIGNET_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_CAPTCHA_SITE_KEY environment variable must be set}" +CAPTCHA_SECRET_KEY="${ESIGNET_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_CAPTCHA_SECRET_KEY environment variable must be set}" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - Captcha Post-install" +echo "================================================" + +# --- Step 1: Create captcha secrets for eSignet --- +echo "Creating esignet-captcha secret in $ESIGNET_NS namespace" +kubectl -n "$ESIGNET_NS" create secret generic esignet-captcha \ + --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ + --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ + --dry-run=client -o yaml | kubectl apply -f - + +# --- Step 2: Copy captcha secret to captcha namespace --- +echo "Copying esignet-captcha secret to $CAPTCHA_NS namespace" +$COPY_UTIL secret esignet-captcha "$ESIGNET_NS" "$CAPTCHA_NS" + +# --- Step 3: Patch captcha deployment with secret env var --- +echo "Patching captcha deployment with secret key environment variable" + +# Remove the old pre-rename env var name if still present, so it doesn't linger +# pointing at a secret that no longer exists (esignet-captcha-go was renamed to +# esignet-captcha). +OLD_ENV_INDEX=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ + -o jsonpath="{range .spec.template.spec.containers[0].env[*]}{.name}{'\n'}{end}" 2>/dev/null \ + | grep -n -x "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO" | cut -d: -f1 || echo "") +if [[ -n "$OLD_ENV_INDEX" ]]; then + OLD_ENV_ARRAY_INDEX=$((OLD_ENV_INDEX - 1)) + echo "Removing stale MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET_GO env var (index $OLD_ENV_ARRAY_INDEX)" + kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ + -p="[{\"op\": \"remove\", \"path\": \"/spec/template/spec/containers/0/env/$OLD_ENV_ARRAY_INDEX\"}]" +fi + +ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET')].name}" 2>/dev/null || echo "") + +if [[ -z "$ENV_VAR_EXISTS" ]]; then + echo "Adding MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET env var..." + ENV_ARRAY_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ + -o jsonpath="{.spec.template.spec.containers[0].env}" 2>/dev/null || echo "") + if [[ -z "$ENV_ARRAY_EXISTS" ]]; then + echo "env array not found, initializing..." + kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env", "value": []}]' + fi + kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha", "key": "esignet-captcha-secret-key"}}}}]' +else + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET env var already exists." +fi + +echo "Captcha post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-postinstall.sh new file mode 100755 index 000000000..c483bb902 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-postinstall.sh @@ -0,0 +1,14 @@ +#!/bin/bash +# ============================================================================= +# eSignet MISP Partner Onboarder - MOSIPID Post-install +# ============================================================================= +# Wrapper: sets ESIGNET_NS=esignet-mosipid and DEPLOYMENT_NAME=esignet-mosipid, +# then runs the base MISP onboarder post-install (validates job completion, +# restarts the esignet-mosipid deployment to pick up the new MISP license key). +# ============================================================================= +set -euo pipefail + +export ESIGNET_NS="esignet-mosipid" +export DEPLOYMENT_NAME="esignet-mosipid" + +"$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-preinstall.sh new file mode 100755 index 000000000..e1af1bb47 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-mosipid-preinstall.sh @@ -0,0 +1,27 @@ +#!/bin/bash +# ============================================================================= +# eSignet MISP Partner Onboarder - MOSIPID Pre-install +# ============================================================================= +# Wrapper: sets ESIGNET_NS=esignet-mosipid, then runs the base MISP onboarder +# pre-install (copies keycloak resources, cleans up stale artifacts). Skips +# the shared Keycloak admin/client secrets - this onboarder authenticates +# against mosipid's own dedicated Keycloak instead: +# - keycloak-host-mosipid / keycloak-client-secrets-mosipid already exist in +# esignet-mosipid (created by esignet-mosipid-preinstall.sh, which runs +# earlier), referenced directly via the DSF's extraEnvVarsCM/Secret. +# - keycloak-mosipid (admin-password) is created here, since no stored +# secret for mosipid's Keycloak admin password exists yet anywhere. +# ============================================================================= +set -euo pipefail + +export ESIGNET_NS="esignet-mosipid" +export SKIP_SHARED_KEYCLOAK_SECRETS="true" + +MOSIPID_KC_ADMIN_PASS="${MOSIPID_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID_KEYCLOAK_ADMIN_PASSWORD must be set}" + +"$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh" + +echo "Creating keycloak-mosipid secret (admin-password) in $ESIGNET_NS" +kubectl -n "$ESIGNET_NS" create secret generic keycloak-mosipid \ + --from-literal=admin-password="${MOSIPID_KC_ADMIN_PASS}" \ + --dry-run=client -o yaml | kubectl apply -f - diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh new file mode 100755 index 000000000..4fe56bdff --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-postinstall.sh @@ -0,0 +1,97 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - eSignet MISP Partner Onboarder Post-install +# ============================================================================= +# Validates onboarding job completion and restarts the esignet deployment +# so it picks up the new MISP license key. +# Only used with mosip-identity-plugin (plugin 2). +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" +DEPLOYMENT_NAME="${DEPLOYMENT_NAME:-esignet-mock}" +# The onboarding job runs a long newman flow (~15 folders, each with one or more +# requests, plus a mandatory 2s --delay-request between every request) that easily +# takes several minutes end to end. helm upgrade returns as soon as the Job object is +# created, not when it finishes, so checking job status immediately reports a false +# failure while the job is still mid-flight - confirmed via a real run that showed +# phase=Running/restartCount=0/lastState={} with newman only one request into its very +# first folder. Poll until the job reaches a terminal state instead of checking once. +ONBOARDER_JOB_WAIT_TIMEOUT="${ONBOARDER_JOB_WAIT_TIMEOUT:-300}" +ONBOARDER_JOB_POLL_INTERVAL=10 + +echo "================================================" +echo "eSignet 1.7.1 - MISP Onboarder Post-install" +echo "================================================" + +# Jobs/pods from previous runs aren't cleaned up automatically, so multiple can match +# this label at once - always sort by creation time and take the newest, not the +# API-returned .items[0] (order isn't guaranteed) or a bare -l selector (which would +# match every stale pod too, producing confusing concatenated logs). Using +# range+tail -1 rather than a jsonpath slice index (e.g. items[-1:].field): applying a +# field accessor directly after a slice doesn't reliably drill into the single +# resulting element in kubectl's jsonpath engine - confirmed empirically, it silently +# returned nothing. Trailing `|| true`: under set -euo pipefail, a genuine kubectl API +# failure (not just "no jobs found") would otherwise abort the script here, skipping the +# istio-injection restore below - an empty LATEST_JOB already routes into the same +# WARNING/diagnostic path as "job not done", which is the right outcome either way. +LATEST_JOB=$(kubectl -n "$ESIGNET_NS" get jobs \ + -l app.kubernetes.io/instance=esignet-misp-onboarder \ + --sort-by=.metadata.creationTimestamp \ + -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' 2>/dev/null | tail -1) || true + +JOB_STATUS="" +if [ -n "$LATEST_JOB" ]; then + echo "Waiting up to ${ONBOARDER_JOB_WAIT_TIMEOUT}s for job/$LATEST_JOB to reach a terminal state..." + ELAPSED=0 + while [ "$ELAPSED" -lt "$ONBOARDER_JOB_WAIT_TIMEOUT" ]; do + JOB_STATUS=$(kubectl -n "$ESIGNET_NS" get job "$LATEST_JOB" -o jsonpath='{.status.succeeded}' 2>/dev/null) || true + JOB_FAILED=$(kubectl -n "$ESIGNET_NS" get job "$LATEST_JOB" -o jsonpath='{.status.failed}' 2>/dev/null) || true + if [[ "$JOB_STATUS" =~ ^[1-9][0-9]*$ ]] || [[ "$JOB_FAILED" =~ ^[1-9][0-9]*$ ]]; then + break + fi + sleep "$ONBOARDER_JOB_POLL_INTERVAL" + ELAPSED=$((ELAPSED + ONBOARDER_JOB_POLL_INTERVAL)) + done +fi + +# Always restore namespace injection before returning from this hook. +kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite +echo "Istio injection re-enabled on namespace $ESIGNET_NS." + +if ! [[ "$JOB_STATUS" =~ ^[1-9][0-9]*$ ]]; then + echo "WARNING: onboarding job may not have completed. Check logs from the latest pod only:" + LATEST_POD=$(kubectl -n "$ESIGNET_NS" get pods \ + -l app.kubernetes.io/instance=esignet-misp-onboarder \ + --sort-by=.metadata.creationTimestamp \ + -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' 2>/dev/null | tail -1) || true + if [ -n "$LATEST_POD" ]; then + echo "--- pod/container status (state, restarts, last termination reason/exit code) ---" + kubectl -n "$ESIGNET_NS" get pod "$LATEST_POD" \ + -o jsonpath='phase={.status.phase}{"\n"}{range .status.containerStatuses[*]}container={.name} restartCount={.restartCount}{"\n"}state={.state}{"\n"}lastState={.lastState}{"\n"}{end}' 2>/dev/null || true + echo "--- pod logs (last 200 lines) ---" + kubectl -n "$ESIGNET_NS" logs "$LATEST_POD" --tail=200 2>/dev/null || true + fi + exit 1 +fi +echo "eSignet MISP partner onboarding completed successfully." + +# Restart config-server first so it reloads the MISP key from the secret, +# then restart esignet so it fetches the updated config from config-server. +if kubectl -n "$ESIGNET_NS" get deployment esignet-config-server &>/dev/null; then + kubectl -n "$ESIGNET_NS" rollout restart deployment esignet-config-server + kubectl -n "$ESIGNET_NS" rollout status deployment esignet-config-server --timeout=300s + echo "esignet-config-server restarted." +else + echo "esignet-config-server deployment not found — skipping restart." +fi + +if kubectl -n "$ESIGNET_NS" get deployment "$DEPLOYMENT_NAME" &>/dev/null; then + kubectl -n "$ESIGNET_NS" rollout restart deployment "$DEPLOYMENT_NAME" + kubectl -n "$ESIGNET_NS" rollout status deployment "$DEPLOYMENT_NAME" --timeout=300s + echo "esignet deployment restarted." +else + echo "esignet deployment ($DEPLOYMENT_NAME) not found — skipping restart." +fi + +echo "MISP onboarder post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh new file mode 100755 index 000000000..bd287db96 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-misp-onboarder-preinstall.sh @@ -0,0 +1,61 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - eSignet MISP Partner Onboarder Pre-install +# ============================================================================= +# Prepares the esignet namespace for the MISP onboarder Job: +# - Disables Istio sidecar injection so the Job pod can reach Completed state +# - Deletes stale MISP onboarder artifacts from previous runs (idempotency) +# - Copies keycloak resources needed by the onboarder Job +# - Deletes onboarder-namespace ConfigMap so this release owns it cleanly +# Does NOT wait for the esignet pod to be ready: MISP onboarding writes a +# license key that esignet then consumes on startup - it doesn't call +# esignet's own API, so it doesn't need esignet up first. Waiting here would +# deadlock when the pod can't become ready without the key this job provides +# (empty MOSIP_ESIGNET_MISP_KEY makes esignet Fatal before /health ever +# serves). +# Only used with mosip-identity-plugin (plugin 2). +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" +KEYCLOAK_NS="keycloak" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - MISP Onboarder Pre-install" +echo "================================================" + +kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - + +# Disable Istio sidecar injection — Job pods with sidecars never reach Completed state +kubectl label namespace "$ESIGNET_NS" istio-injection=disabled --overwrite +echo "Istio injection disabled on namespace $ESIGNET_NS." + +restore_istio_injection_on_failure() { + local status=$? + if [ "$status" -ne 0 ]; then + kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite || true + fi +} +trap restore_istio_injection_on_failure EXIT + +# Delete stale MISP onboarder artifacts from any previous run +kubectl -n "$ESIGNET_NS" delete configmap esignet-onboarder-config --ignore-not-found=true +kubectl -n "$ESIGNET_NS" delete secret esignet-onboarder-secrets --ignore-not-found=true +echo "Stale MISP onboarder artifacts cleaned up." + +# Copy keycloak resources needed by the onboarder Job. keycloak-env-vars is generic/ +# realm-agnostic (no per-instance equivalent exists anywhere in this DSF) so it always +# comes from the shared keycloak namespace. The admin secret and client secrets are +# skippable via SKIP_SHARED_KEYCLOAK_SECRETS for instances (like mosipid) that +# authenticate against their own dedicated Keycloak instead. +$COPY_UTIL configmap keycloak-env-vars "$KEYCLOAK_NS" "$ESIGNET_NS" +if [ "${SKIP_SHARED_KEYCLOAK_SECRETS:-false}" != "true" ]; then + $COPY_UTIL secret keycloak "$KEYCLOAK_NS" "$ESIGNET_NS" + $COPY_UTIL secret keycloak-client-secrets "$KEYCLOAK_NS" "$ESIGNET_NS" +fi + +# Delete onboarder-namespace ConfigMap so this release owns it with the correct annotation +kubectl -n "$ESIGNET_NS" delete configmap onboarder-namespace --ignore-not-found=true + +echo "MISP onboarder pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh new file mode 100755 index 000000000..43204af80 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-postinstall.sh @@ -0,0 +1,41 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Mock RP OIDC Partner Onboarder Post-install +# ============================================================================= +# Validates onboarding job completion and restarts mock-relying-party-service +# so it picks up the newly registered OIDC client. +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" + +echo "================================================" +echo "eSignet 1.7.1 - Mock RP Onboarder Post-install" +echo "================================================" + +JOB_STATUS=$(kubectl -n "$ESIGNET_NS" get jobs \ + -l app.kubernetes.io/instance=esignet-mock-rp-onboarder \ + -o jsonpath='{.items[0].status.succeeded}' 2>/dev/null || echo "") + +if [ "$JOB_STATUS" = "1" ]; then + echo "Mock RP OIDC partner onboarding completed successfully." +else + echo "WARNING: onboarding job may not have completed. Check logs:" + kubectl -n "$ESIGNET_NS" logs -l app.kubernetes.io/instance=esignet-mock-rp-onboarder --tail=30 2>/dev/null || true +fi + +# Re-enable Istio sidecar injection now that the Job has completed +kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite +echo "Istio injection re-enabled on namespace $ESIGNET_NS." + +# Restart mock-relying-party-service so it picks up the newly onboarded OIDC client +if kubectl -n "$ESIGNET_NS" get deployment mock-relying-party-service &>/dev/null; then + kubectl -n "$ESIGNET_NS" rollout restart deployment mock-relying-party-service + kubectl -n "$ESIGNET_NS" rollout status deployment mock-relying-party-service --timeout=300s || \ + echo "WARNING: mock-relying-party-service rollout did not complete within timeout." >&2 + echo "mock-relying-party-service restarted." +else + echo "mock-relying-party-service deployment not found — skipping restart." +fi + +echo "Mock RP onboarder post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh new file mode 100755 index 000000000..3cf764670 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mock-rp-onboarder-preinstall.sh @@ -0,0 +1,37 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Mock RP OIDC Partner Onboarder Pre-install +# ============================================================================= +# Copies required secrets/configmaps to esignet namespace before the +# partner-onboarder Job runs. +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" +KEYCLOAK_NS="keycloak" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - Mock RP Onboarder Pre-install" +echo "================================================" + +kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - + +# Disable Istio sidecar injection — Job pods with sidecars never reach Completed state +kubectl label namespace "$ESIGNET_NS" istio-injection=disabled --overwrite +echo "Istio injection disabled on namespace $ESIGNET_NS." + +# Copy keycloak resources needed by the onboarder Job +$COPY_UTIL configmap keycloak-env-vars "$KEYCLOAK_NS" "$ESIGNET_NS" +$COPY_UTIL secret keycloak "$KEYCLOAK_NS" "$ESIGNET_NS" +$COPY_UTIL secret keycloak-client-secrets "$KEYCLOAK_NS" "$ESIGNET_NS" + +# Both partner-onboarder charts create a ConfigMap named "onboarder-namespace". +# Delete it before install so this release owns it with the correct annotation. +kubectl -n "$ESIGNET_NS" delete configmap onboarder-namespace --ignore-not-found=true + +# Verify eSignet service is running +kubectl -n "$ESIGNET_NS" wait --for=condition=ready pod -l app.kubernetes.io/name=esignet --timeout=480s || \ + { echo "ERROR: eSignet pods not ready after timeout" >&2; exit 1; } + +echo "Mock RP onboarder pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh new file mode 100755 index 000000000..2496cb6a8 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-mosipid-preinstall.sh @@ -0,0 +1,147 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - eSignet MOSIPID Service Pre-install +# ============================================================================= +# Wrapper: sets ESIGNET_NS=esignet-mosipid, runs base esignet preinstall (copies +# postgres + redis config/secrets), then creates esignet-captcha-mosipid secret +# in the captcha namespace from workflow env vars, copies it to esignet-mosipid, +# and patches the captcha deployment with the MOSIPID secret key. +# ============================================================================= +set -euo pipefail + +export ESIGNET_NS="esignet-mosipid" +CAPTCHA_NS="captcha" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" +CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID_CAPTCHA_SITE_KEY must be set}" +CAPTCHA_SECRET_KEY="${ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY must be set}" +MOSIPID_POSTGRES_PASS="${MOSIPID_POSTGRES_PASSWORD:?ERROR: MOSIPID_POSTGRES_PASSWORD must be set}" +MOSIPID_KC_ADMIN_PASS="${MOSIPID_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID_KEYCLOAK_ADMIN_PASSWORD must be set}" + +"$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh" + +# Create MOSIPID-specific esignet-global — same domain_name, but esignet/signup hosts differ +kubectl -n "$ESIGNET_NS" create configmap esignet-global \ + --from-literal=installation-domain="${domain_name}" \ + --from-literal=mosip-api-host="api.${domain_name}" \ + --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ + --from-literal=mosip-esignet-host="esignet-mosipid.${domain_name}" \ + --from-literal=mosip-iam-external-host="iam.${domain_name}" \ + --from-literal=mosip-kafka-host="kafka.${domain_name}" \ + --from-literal=mosip-postgres-host="postgres.${domain_name}" \ + --from-literal=mosip-signup-host="signup-mosipid.${domain_name}" \ + --from-literal=mosip-smtp-host="smtp.${domain_name}" \ + --from-literal=mosip-version="develop" \ + --dry-run=client -o yaml | kubectl apply -f - + +# Override postgres-config with MOSIPID-specific DB values (2.0.0: isolated database) +kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ + -p '{"data":{"database-name":"mosip_esignet_go_mosipid","database-username":"esignetuser_go_mosipid"}}' + +# Create esignet-misp-onboarder-key with a random placeholder value — real value written +# by MISP onboarder if/when that's wired up. An empty value makes the Go esignet service +# Fatal on startup during plugin provider init, so this can't be left blank. Only generated +# once (create-if-missing, not overwritten on every run) so the value stays stable across +# redeploys - regenerating it on every run would be pointless churn since nothing else reads +# or depends on this specific value being consistent. +if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then + kubectl -n "$ESIGNET_NS" create secret generic esignet-misp-onboarder-key \ + --from-literal=mosip-esignet-misp-key="$(openssl rand -hex 16)" + echo "esignet-misp-onboarder-key (random placeholder) created in $ESIGNET_NS" +fi + +echo "Creating esignet-captcha-mosipid secret in $CAPTCHA_NS namespace" +kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-mosipid \ + --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ + --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Copying esignet-captcha-mosipid secret from $CAPTCHA_NS to $ESIGNET_NS" +$COPY_UTIL secret esignet-captcha-mosipid "$CAPTCHA_NS" "$ESIGNET_NS" + +echo "Patching captcha deployment with ESIGNETMOSIPID secret key" + +# Remove stale pre-rename/pre-consolidation env var names if still present, so they +# don't linger pointing at secrets that no longer exist. +for OLD_NAME in MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID1 MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOMOSIPID2; do + OLD_ENV_INDEX=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ + -o jsonpath="{range .spec.template.spec.containers[0].env[*]}{.name}{'\n'}{end}" 2>/dev/null \ + | grep -n -x "$OLD_NAME" | cut -d: -f1 || echo "") + if [[ -n "$OLD_ENV_INDEX" ]]; then + OLD_ENV_ARRAY_INDEX=$((OLD_ENV_INDEX - 1)) + echo "Removing stale $OLD_NAME env var (index $OLD_ENV_ARRAY_INDEX)" + kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ + -p="[{\"op\": \"remove\", \"path\": \"/spec/template/spec/containers/0/env/$OLD_ENV_ARRAY_INDEX\"}]" + fi +done + +ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ + -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID')].name}" 2>/dev/null || echo "") +if [[ -z "$ENV_VAR_EXISTS" ]]; then + kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-mosipid", "key": "esignet-captcha-secret-key"}}}}]' +else + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID already exists." +fi + +# --- postgres-postgresql-mosipid secret (MOSIPID remote postgres password) --- +echo "Creating postgres-postgresql-mosipid secret in $ESIGNET_NS" +kubectl -n "$ESIGNET_NS" create secret generic postgres-postgresql-mosipid \ + --from-literal=postgres-password="${MOSIPID_POSTGRES_PASS}" \ + --dry-run=client -o yaml | kubectl apply -f - + +# --- keycloak-host-mosipid CM (external URL points to MOSIPID Keycloak) --- +echo "Creating keycloak-host-mosipid configmap in $ESIGNET_NS" +kubectl -n "$ESIGNET_NS" create configmap keycloak-host-mosipid \ + --from-literal=keycloak-external-host="iam.${mosipid_domain_name}" \ + --from-literal=keycloak-external-url="https://iam.${mosipid_domain_name}" \ + --from-literal=keycloak-internal-host="keycloak.keycloak" \ + --from-literal=keycloak-internal-service-url="http://keycloak.keycloak/auth/" \ + --from-literal=keycloak-internal-url="http://keycloak.keycloak" \ + --dry-run=client -o yaml | kubectl apply -f - + +# --- keycloak-client-secrets-mosipid: fetch all confidential clients from MOSIPID Keycloak --- +KC_HOST="iam.${mosipid_domain_name}" +REALM="mosip" + +echo "Fetching admin token from $KC_HOST" +TOKEN_RESPONSE=$(curl -sf -X POST \ + "https://${KC_HOST}/auth/realms/master/protocol/openid-connect/token" \ + -H "Content-Type: application/x-www-form-urlencoded" \ + -d "grant_type=password&client_id=admin-cli&username=admin&password=${MOSIPID_KC_ADMIN_PASS}") +ADMIN_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.access_token') +if [[ -z "$ADMIN_TOKEN" || "$ADMIN_TOKEN" == "null" ]]; then + echo "❌ Failed to get admin token from $KC_HOST" >&2; exit 1 +fi +echo "✓ Admin token obtained" + +echo "Fetching all clients from realm $REALM on $KC_HOST" +CLIENTS=$(curl -sf \ + "https://${KC_HOST}/auth/admin/realms/${REALM}/clients?max=500" \ + -H "Authorization: Bearer $ADMIN_TOKEN") + +SECRET_ARGS=() +while IFS= read -r client_json; do + client_id=$(echo "$client_json" | jq -r '.clientId') + uuid=$(echo "$client_json" | jq -r '.id') + auth_type=$(echo "$client_json" | jq -r '.clientAuthenticatorType') + is_public=$(echo "$client_json" | jq -r '.publicClient') + [[ "$auth_type" != "client-secret" || "$is_public" == "true" ]] && continue + secret_val=$(curl -sf \ + "https://${KC_HOST}/auth/admin/realms/${REALM}/clients/${uuid}/client-secret" \ + -H "Authorization: Bearer $ADMIN_TOKEN" | jq -r '.value // empty') + [[ -z "$secret_val" || "$secret_val" == "null" ]] && continue + key=$(echo "$client_id" | tr '-' '_')_secret + SECRET_ARGS+=("--from-literal=${key}=${secret_val}") + echo " ✓ $client_id" +done < <(echo "$CLIENTS" | jq -c '.[]') + +if [[ ${#SECRET_ARGS[@]} -eq 0 ]]; then + echo "❌ No client secrets fetched from MOSIPID Keycloak" >&2; exit 1 +fi +echo "Creating keycloak-client-secrets-mosipid in $ESIGNET_NS (${#SECRET_ARGS[@]} clients)" +kubectl -n "$ESIGNET_NS" create secret generic keycloak-client-secrets-mosipid \ + "${SECRET_ARGS[@]}" \ + --dry-run=client -o yaml | kubectl apply -f - +echo "✓ keycloak-client-secrets-mosipid created" + +echo "eSignet MOSIPID pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-postinstall-keycloak-init.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-postinstall-keycloak-init.sh new file mode 100755 index 000000000..8be5e8239 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-postinstall-keycloak-init.sh @@ -0,0 +1,32 @@ +#!/bin/bash +# Post-install hook for esignet-keycloak-init (eSignet 2.0.0 (Go) standalone) +# The chart runs in keycloak ns and creates keycloak-host CM and +# keycloak-client-secrets secret there. This hook fans those resources out to +# all esignet-mock namespaces so every esignet-mock instance can reference them without +# cross-namespace lookups. +set -euo pipefail + +KEYCLOAK_NS="keycloak" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +# All esignet-mock namespaces that need keycloak resources +ESIGNET_NAMESPACES=(esignet-mock esignet-mosipid esignet-sunbird) + +echo "================================================" +echo "eSignet 2.0.0 (Go) - Keycloak Init Post-install" +echo "================================================" + +echo "Sharing keycloak resources from $KEYCLOAK_NS to all esignet-mock namespaces" +for NS_TARGET in "${ESIGNET_NAMESPACES[@]}"; do + if ! kubectl get namespace "$NS_TARGET" &>/dev/null; then + echo "Namespace $NS_TARGET does not exist, skipping" + continue + fi + echo " → $NS_TARGET" + $COPY_UTIL configmap keycloak-host "$KEYCLOAK_NS" "$NS_TARGET" + $COPY_UTIL configmap keycloak-env-vars "$KEYCLOAK_NS" "$NS_TARGET" + $COPY_UTIL secret keycloak "$KEYCLOAK_NS" "$NS_TARGET" + $COPY_UTIL secret keycloak-client-secrets "$KEYCLOAK_NS" "$NS_TARGET" +done + +echo "Post-install setup complete." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall-keycloak-init.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall-keycloak-init.sh new file mode 100755 index 000000000..e8d7020e9 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall-keycloak-init.sh @@ -0,0 +1,51 @@ +#!/bin/bash +# Pre-install hook for esignet-keycloak-init (eSignet 1.7.1 standalone) +# Runs in the keycloak namespace — all required resources (keycloak secret, +# keycloak-env-vars CM) are already present from the bitnami keycloak chart. +# The chart creates keycloak-host CM and keycloak-client-secrets in keycloak ns. +# We clean up the previous release and chart-managed resources so the fresh +# helm install can recreate them cleanly. +set -euo pipefail + +KEYCLOAK_NS="keycloak" + +echo "================================================" +echo "eSignet 1.7.1 - Keycloak Init Pre-install" +echo "================================================" + +# Delete previous releases so helm install starts fresh. +# keycloak-host CM and keycloak-client-secrets secret are helm-managed — helm delete +# removes them automatically; no manual kubectl delete needed here. +helm -n "$KEYCLOAK_NS" delete esignet-keycloak-init 2>/dev/null || true +# Migration: remove old release from esignet ns if it was deployed there previously +helm -n esignet delete esignet-keycloak-init 2>/dev/null || true + +# Fetch existing client secrets from keycloak namespace for DSF ${VAR} substitution. +# Empty on fresh install — helm chart generates them; existing values preserved on re-run. +PMS_CLIENT_SECRET_KEY="mosip_pms_client_secret" +MPARTNER_DEFAULT_AUTH_SECRET_KEY="mpartner_default_auth_secret" +IDA_CLIENT_SECRET_KEY="mosip_ida_client_secret" +DEPLOYMENT_CLIENT_SECRET_KEY="mosip_deployment_client_secret" +MPARTNER_DEFAULT_MOBILE_SECRET_KEY="mpartner_default_mobile_secret" + +PMS_CLIENT_SECRET_VALUE="$(kubectl -n "$KEYCLOAK_NS" get secret keycloak-client-secrets \ + -o jsonpath="{.data.${PMS_CLIENT_SECRET_KEY}}" 2>/dev/null | base64 -d 2>/dev/null || echo "")" +export PMS_CLIENT_SECRET_KEY PMS_CLIENT_SECRET_VALUE + +MPARTNER_DEFAULT_AUTH_SECRET_VALUE="$(kubectl -n "$KEYCLOAK_NS" get secret keycloak-client-secrets \ + -o jsonpath="{.data.${MPARTNER_DEFAULT_AUTH_SECRET_KEY}}" 2>/dev/null | base64 -d 2>/dev/null || echo "")" +export MPARTNER_DEFAULT_AUTH_SECRET_KEY MPARTNER_DEFAULT_AUTH_SECRET_VALUE + +IDA_CLIENT_SECRET_VALUE="$(kubectl -n "$KEYCLOAK_NS" get secret keycloak-client-secrets \ + -o jsonpath="{.data.${IDA_CLIENT_SECRET_KEY}}" 2>/dev/null | base64 -d 2>/dev/null || echo "")" +export IDA_CLIENT_SECRET_KEY IDA_CLIENT_SECRET_VALUE + +DEPLOYMENT_CLIENT_SECRET_VALUE="$(kubectl -n "$KEYCLOAK_NS" get secret keycloak-client-secrets \ + -o jsonpath="{.data.${DEPLOYMENT_CLIENT_SECRET_KEY}}" 2>/dev/null | base64 -d 2>/dev/null || echo "")" +export DEPLOYMENT_CLIENT_SECRET_KEY DEPLOYMENT_CLIENT_SECRET_VALUE + +MPARTNER_DEFAULT_MOBILE_SECRET_VALUE="$(kubectl -n "$KEYCLOAK_NS" get secret keycloak-client-secrets \ + -o jsonpath="{.data.${MPARTNER_DEFAULT_MOBILE_SECRET_KEY}}" 2>/dev/null | base64 -d 2>/dev/null || echo "")" +export MPARTNER_DEFAULT_MOBILE_SECRET_KEY MPARTNER_DEFAULT_MOBILE_SECRET_VALUE + +echo "Pre-install setup complete. Helmsman will now deploy esignet-keycloak-init chart." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh new file mode 100755 index 000000000..90505c084 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh @@ -0,0 +1,83 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - eSignet Service Pre-install +# ============================================================================= +# Based on: deploy/esignet-mock/install.sh +# Prepares esignet-mock namespace with postgres and redis configmaps/secrets +# before eSignet helm chart deployment. +# +# softhsm-esignet-mock deploys in the esignet-mock namespace (priority -14, before +# esignet-mock at -12), so esignet-softhsm-share is already present — no copy needed. +# +# Environment Variables: +# ESIGNET_NS - eSignet namespace (default: esignet-mock) +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" +POSTGRES_NS="postgres" +REDIS_NS="redis" +KEYCLOAK_NS="keycloak" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - eSignet Service Pre-install" +echo "================================================" + +# --- Step 1: Ensure esignet-mock namespace exists with Istio --- +echo "Setting up $ESIGNET_NS namespace" +kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite + +# --- Step 2: Update helm repos --- +helm repo add mosip https://mosip.github.io/mosip-helm || true +helm repo update + +# --- Step 3: Copy configmaps from other namespaces --- +# All external services (postgres, redis) are guaranteed deployed before +# esignet-mock-dsf runs. +echo "Copying postgres-config configmap from $POSTGRES_NS" +$COPY_UTIL configmap postgres-config "$POSTGRES_NS" "$ESIGNET_NS" + +# Override postgres-config with 2.0.0-specific DB values (isolated database) +kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ + -p '{"data":{"database-name":"mosip_esignet_go","database-username":"esignetuser_go"}}' + +echo "Copying redis-config configmap from $REDIS_NS" +$COPY_UTIL configmap redis-config "$REDIS_NS" "$ESIGNET_NS" + +# --- Step 4: Copy secrets from other namespaces --- +echo "Copying postgres-postgresql secret from $POSTGRES_NS" +$COPY_UTIL secret postgres-postgresql "$POSTGRES_NS" "$ESIGNET_NS" + +echo "Copying redis secret from $REDIS_NS" +$COPY_UTIL secret redis "$REDIS_NS" "$ESIGNET_NS" + +# db-common-secrets is normally fanned out by esignet-db-postinstall.sh (part of the +# shared external-dsf.yaml postgres-init-esignet release), but that hook's namespace +# loop only covers the original esignet-standalone namespaces. Copy it directly here +# so the 2.0.0 namespace is self-sufficient without touching the shared hook. +echo "Copying db-common-secrets secret from $POSTGRES_NS" +$COPY_UTIL secret db-common-secrets "$POSTGRES_NS" "$ESIGNET_NS" + +# keycloak-host/keycloak-env-vars/keycloak/keycloak-client-secrets are normally fanned +# out by esignet-postinstall-keycloak-init.sh (postInstall hook of the shared +# external-dsf.yaml esignet-keycloak-init release), but that hook's namespace loop only +# covers the original esignet-standalone namespaces. Copy them directly here so the +# 2.0.0 namespace is self-sufficient without touching the shared hook. This runs for +# every instance that delegates to this script (esignet-mock plus the +# mosipid/sunbird wrappers), matching the original profile's fan-out to all +# four namespaces. +echo "Copying keycloak-host configmap from $KEYCLOAK_NS" +$COPY_UTIL configmap keycloak-host "$KEYCLOAK_NS" "$ESIGNET_NS" + +echo "Copying keycloak-env-vars configmap from $KEYCLOAK_NS" +$COPY_UTIL configmap keycloak-env-vars "$KEYCLOAK_NS" "$ESIGNET_NS" + +echo "Copying keycloak secret from $KEYCLOAK_NS" +$COPY_UTIL secret keycloak "$KEYCLOAK_NS" "$ESIGNET_NS" + +echo "Copying keycloak-client-secrets secret from $KEYCLOAK_NS" +$COPY_UTIL secret keycloak-client-secrets "$KEYCLOAK_NS" "$ESIGNET_NS" + +echo "eSignet pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh new file mode 100755 index 000000000..f2b29752c --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/esignet-sunbird-preinstall.sh @@ -0,0 +1,77 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - eSignet Sunbird Service Pre-install +# ============================================================================= +# Wrapper: sets ESIGNET_NS=esignet-sunbird, runs base esignet preinstall (copies +# postgres + redis config/secrets), then creates esignet-captcha-sunbird secret +# in the captcha namespace from workflow env vars, copies it to esignet-sunbird, +# and patches the captcha deployment with the Sunbird secret key. +# ============================================================================= +set -euo pipefail + +export ESIGNET_NS="esignet-sunbird" +CAPTCHA_NS="captcha" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" +CAPTCHA_SITE_KEY="${ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY must be set}" +CAPTCHA_SECRET_KEY="${ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY must be set}" + +"$WORKDIR/hooks/esignet-standalone-2.0.0/esignet-preinstall.sh" + +# Create Sunbird-specific esignet-global — same domain_name, but esignet/signup hosts differ +kubectl -n "$ESIGNET_NS" create configmap esignet-global \ + --from-literal=installation-domain="${domain_name}" \ + --from-literal=mosip-api-host="api.${domain_name}" \ + --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ + --from-literal=mosip-esignet-host="esignet-sunbird.${domain_name}" \ + --from-literal=mosip-iam-external-host="iam.${domain_name}" \ + --from-literal=mosip-kafka-host="kafka.${domain_name}" \ + --from-literal=mosip-postgres-host="postgres.${domain_name}" \ + --from-literal=mosip-signup-host="signup-sunbird.${domain_name}" \ + --from-literal=mosip-smtp-host="smtp.${domain_name}" \ + --from-literal=mosip-version="develop" \ + --dry-run=client -o yaml | kubectl apply -f - + +# Override postgres-config with Sunbird-specific DB values (2.0.0: isolated database) +kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ + -p '{"data":{"database-name":"mosip_esignet_go_sunbird","database-username":"esignetuser_go_sunbird"}}' + +# Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. +if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then + kubectl -n "$ESIGNET_NS" create secret generic esignet-misp-onboarder-key \ + --from-literal=mosip-esignet-misp-key="" + echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" +fi + +echo "Creating esignet-captcha-sunbird secret in $CAPTCHA_NS namespace" +kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-sunbird \ + --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ + --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Copying esignet-captcha-sunbird secret from $CAPTCHA_NS to $ESIGNET_NS" +$COPY_UTIL secret esignet-captcha-sunbird "$CAPTCHA_NS" "$ESIGNET_NS" + +echo "Patching captcha deployment with ESIGNETSUNBIRD secret key" +# Remove the old pre-rename env var name if still present, so it doesn't linger +# pointing at a secret that no longer exists (esignet-captcha-go-sunbird was renamed +# to esignet-captcha-sunbird). +OLD_ENV_INDEX=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ + -o jsonpath="{range .spec.template.spec.containers[0].env[*]}{.name}{'\n'}{end}" 2>/dev/null \ + | grep -n -x "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOSUNBIRD" | cut -d: -f1 || echo "") +if [[ -n "$OLD_ENV_INDEX" ]]; then + OLD_ENV_ARRAY_INDEX=$((OLD_ENV_INDEX - 1)) + echo "Removing stale MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETGOSUNBIRD env var (index $OLD_ENV_ARRAY_INDEX)" + kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ + -p="[{\"op\": \"remove\", \"path\": \"/spec/template/spec/containers/0/env/$OLD_ENV_ARRAY_INDEX\"}]" +fi + +ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ + -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETSUNBIRD')].name}" 2>/dev/null || echo "") +if [[ -z "$ENV_VAR_EXISTS" ]]; then + kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETSUNBIRD", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-sunbird", "key": "esignet-captcha-secret-key"}}}}]' +else + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETSUNBIRD already exists." +fi + +echo "eSignet Sunbird pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/kafka-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/kafka-postinstall.sh new file mode 100755 index 000000000..ea238f1b5 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/kafka-postinstall.sh @@ -0,0 +1,28 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Kafka Post-install +# ============================================================================= +# Based on: deploy/install-prereq.sh (kafka section) +# Creates kafka-config configmap in esignet namespace after Kafka deployment. +# +# Environment Variables: +# KAFKA_URL - Kafka bootstrap servers URL (default: internal kafka cluster) +# ESIGNET_NS - eSignet namespace (default: esignet) +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" +KAFKA_URL="${KAFKA_URL:-kafka-0.kafka-headless.kafka.svc.cluster.local:9092,kafka-1.kafka-headless.kafka.svc.cluster.local:9092,kafka-2.kafka-headless.kafka.svc.cluster.local:9092}" + +echo "================================================" +echo "eSignet 1.7.1 - Kafka Post-install" +echo "================================================" + +# --- Create kafka-config configmap in esignet namespace --- +# Source: deploy/install-prereq.sh - kafka configmap creation +echo "Creating kafka-config configmap in $ESIGNET_NS namespace" +kubectl -n "$ESIGNET_NS" create configmap kafka-config \ + --from-literal=SPRING_KAFKA_BOOTSTRAP-SERVERS="$KAFKA_URL" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Kafka post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh new file mode 100755 index 000000000..9d1ae319a --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/kernel-preinstall.sh @@ -0,0 +1,53 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Kernel Services Pre-install +# ============================================================================= +# Based on: esignet-signup/deploy/kernel/install.sh +# Creates kernel namespace, domain-config configmap, and optionally copies +# artifactory-share and config-server-share configmaps if available. +# +# This script is idempotent — safe to run multiple times (used as preInstall +# for authmanager, auditmanager, and otpmanager which run in parallel). +# +# Environment Variables: +# MOSIP_API_HOST - External API host (e.g. api.sandbox.xyz.net) +# MOSIP_API_INTERNAL_HOST - Internal API host (e.g. api-internal.sandbox.xyz.net) +# ============================================================================= +set -euo pipefail + +KERNEL_NS="kernel" +API_HOST="${MOSIP_API_HOST:-}" +API_INTERNAL_HOST="${MOSIP_API_INTERNAL_HOST:-}" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +if [ -z "$API_HOST" ]; then + echo "ERROR: MOSIP_API_HOST must be set" >&2 + exit 1 +fi +if [ -z "$API_INTERNAL_HOST" ]; then + echo "ERROR: MOSIP_API_INTERNAL_HOST must be set" >&2 + exit 1 +fi + +echo "================================================" +echo "eSignet 1.7.1 - Kernel Pre-install" +echo "================================================" + +# --- Step 1: Ensure kernel namespace exists with istio --- +kubectl create namespace "$KERNEL_NS" --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace "$KERNEL_NS" istio-injection=enabled --overwrite + +# --- Step 2: Create domain-config configmap --- +echo "Creating domain-config configmap in $KERNEL_NS" +kubectl -n "$KERNEL_NS" create configmap domain-config \ + --from-literal=mosip-api-host="$API_HOST" \ + --from-literal=mosip-api-internal-host="$API_INTERNAL_HOST" \ + --dry-run=client -o yaml | kubectl apply -f - + +# --- Step 3: Copy optional configmaps from artifactory and config-server --- +$COPY_UTIL configmap artifactory-share artifactory "$KERNEL_NS" 2>/dev/null || \ + echo "WARNING: artifactory-share not found in artifactory namespace, skipping" +$COPY_UTIL configmap config-server-share config-server "$KERNEL_NS" 2>/dev/null || \ + echo "WARNING: config-server-share not found in config-server namespace, skipping" + +echo "Kernel pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/keycloak-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/keycloak-postinstall.sh new file mode 100755 index 000000000..9192e2bdc --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/keycloak-postinstall.sh @@ -0,0 +1,103 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Keycloak Post-install (Keycloak Init) +# ============================================================================= +# Based on: deploy/keycloak/keycloak-init.sh + deploy/initialise-prereq.sh +# Copies keycloak configmaps/secrets to esignet namespace and runs +# keycloak-init helm chart to create eSignet-specific clients and roles. +# +# Environment Variables: +# INSTALLATION_DOMAIN - Base domain (default: sandbox.xyz.net) +# KEYCLOAK_INIT_VERSION - keycloak-init chart version (default: 12.0.2) +# ESIGNET_NS - eSignet namespace (default: esignet) +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" +KEYCLOAK_NS="keycloak" +CHART_VERSION="${KEYCLOAK_INIT_VERSION:-12.0.2}" +INSTALLATION_DOMAIN="${INSTALLATION_DOMAIN:-sandbox.xyz.net}" +IAMHOST_URL="iam.${INSTALLATION_DOMAIN}" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - Keycloak Post-install (Init)" +echo "================================================" + +# --- Step 1: Copy keycloak configmaps and secrets to esignet namespace --- +echo "Copying keycloak configmaps and secrets to $ESIGNET_NS namespace" + +$COPY_UTIL configmap keycloak-host "$KEYCLOAK_NS" "$ESIGNET_NS" 2>/dev/null || { + echo "keycloak-host not found in $KEYCLOAK_NS - creating directly" + kubectl -n "$ESIGNET_NS" create configmap keycloak-host \ + --from-literal=keycloak-external-url="https://$IAMHOST_URL" \ + --from-literal=keycloak-internal-url="http://keycloak.$KEYCLOAK_NS" \ + --dry-run=client -o yaml | kubectl apply -f - +} + +$COPY_UTIL configmap keycloak-env-vars "$KEYCLOAK_NS" "$ESIGNET_NS" 2>/dev/null || \ + echo "WARNING: keycloak-env-vars not found in $KEYCLOAK_NS" + +$COPY_UTIL secret keycloak "$KEYCLOAK_NS" "$ESIGNET_NS" 2>/dev/null || \ + echo "WARNING: keycloak secret not found in $KEYCLOAK_NS" + +# --- Step 2: Read existing client secrets if any --- +echo "Checking for existing keycloak-client-secrets" +HELM_SET_SECRETS=() + +escape_helm_value() { + local value="$1" + value="${value//\\/\\\\}" + value="${value//,/\\,}" + value="${value//=/\\=}" + printf '%s' "$value" +} + +declare -A SECRET_KEYS=( + ["mosip_pms_client_secret"]="0" + ["mpartner_default_auth_secret"]="1" + ["mosip_ida_client_secret"]="2" + ["mosip_deployment_client_secret"]="3" + ["mpartner_default_mobile_secret"]="4" +) + +if kubectl -n "$KEYCLOAK_NS" get secret keycloak-client-secrets &>/dev/null; then + echo "Found existing keycloak-client-secrets. Preserving client secrets." + for key in "${!SECRET_KEYS[@]}"; do + idx="${SECRET_KEYS[$key]}" + val=$(kubectl -n "$KEYCLOAK_NS" get secret keycloak-client-secrets \ + -o jsonpath="{.data.$key}" 2>/dev/null | base64 -d 2>/dev/null || echo "") + if [[ -n "$val" ]]; then + HELM_SET_SECRETS+=( + --set-string "clientSecrets[$idx].name=$key" + --set-string "clientSecrets[$idx].secret=$(escape_helm_value "$val")" + ) + fi + done +else + echo "No existing keycloak-client-secrets found. Fresh install." +fi + +# --- Step 3: Run keycloak-init helm chart --- +echo "Installing esignet-keycloak-init" +helm repo add mosip https://mosip.github.io/mosip-helm || true +helm repo update + +kubectl -n "$ESIGNET_NS" delete secret --ignore-not-found=true keycloak-client-secrets +helm -n "$ESIGNET_NS" delete esignet-keycloak-init 2>/dev/null || true + +helm -n "$ESIGNET_NS" install esignet-keycloak-init mosip/keycloak-init \ + ${HELM_SET_SECRETS[@]+"${HELM_SET_SECRETS[@]}"} \ + --set keycloak.realms.mosip.realm_config.attributes.frontendUrl="https://$IAMHOST_URL/auth" \ + --set keycloakInternalHost="keycloak.$KEYCLOAK_NS" \ + --set keycloakExternalHost="$IAMHOST_URL" \ + --version "$CHART_VERSION" --wait --wait-for-jobs + +# --- Step 4: Sync updated client secrets back to keycloak namespace --- +echo "Syncing keycloak-client-secrets back to $KEYCLOAK_NS namespace" +if kubectl -n "$ESIGNET_NS" get secret keycloak-client-secrets &>/dev/null; then + $COPY_UTIL secret keycloak-client-secrets "$ESIGNET_NS" "$KEYCLOAK_NS" + echo "keycloak-client-secrets synced to $KEYCLOAK_NS namespace." +fi + +echo "Keycloak post-install (init) completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh new file mode 100755 index 000000000..be79632da --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-init-db.sh @@ -0,0 +1,30 @@ +#!/bin/bash +# ============================================================================= +# eSignet Standalone 2.0.0 - Mock Identity System DB Init Pre-install +# ============================================================================= +# Based on: esignet-mock-services/deploy/postgres/init_db.sh +# Ensures postgres-postgresql secret is present in the esignet namespace +# before postgres-init-mock-identity helm chart runs DB initialization. +# +# Environment Variables: +# ESIGNET_NS - eSignet namespace (default: esignet-mock) +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" +POSTGRES_NS="postgres" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet Standalone 2.0.0 - Mock Identity DB Init Pre-install" +echo "================================================" + +# --- Step 1: Ensure esignet namespace exists with istio --- +kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite + +# --- Step 2: Copy postgres-postgresql secret to esignet namespace --- +echo "Copying postgres-postgresql secret to $ESIGNET_NS namespace" +$COPY_UTIL secret postgres-postgresql "$POSTGRES_NS" "$ESIGNET_NS" + +echo "Mock identity DB init pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh new file mode 100755 index 000000000..9455bbdec --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-identity-system-preinstall.sh @@ -0,0 +1,61 @@ +#!/bin/bash +# ============================================================================= +# eSignet Standalone 2.0.0 - Mock Identity System Pre-install +# ============================================================================= +# Prepares esignet namespace for mock identity system deployment: +# - Copies softhsm-mock-identity-system secret from softhsm ns +# - Creates mockid-postgres-config with mock identity DB values +# - Verifies softhsm-mock-identity-system-share ConfigMap is present +# +# Environment Variables: +# MOCKID_DB_NAME - Mock identity DB name (default: mosip_mockidentitysystem) +# MOCKID_DB_USER - Mock identity DB user (default: mockidentityuser) +# MOCKID_DB_PORT - Postgres port (default: 5432) +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" +SOFTHSM_NS="softhsm" +MOCKID_DB_NAME="${MOCKID_DB_NAME:-mosip_mockidentitysystem}" +MOCKID_DB_USER="${MOCKID_DB_USER:-mockidentityuser}" +MOCKID_DB_PORT="${MOCKID_DB_PORT:-5432}" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet Standalone 2.0.0 - Mock Identity System Pre-install" +echo "================================================" + +kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - + +# Copy softhsm-mock-identity-system secret to esignet ns +# The chart references it directly via secretKeyRef — pod and secret must be in same namespace +$COPY_UTIL secret softhsm-mock-identity-system "$SOFTHSM_NS" "$ESIGNET_NS" +echo "softhsm-mock-identity-system secret copied to $ESIGNET_NS." + +# Read internal host from postgres-config (already present from esignet-preinstall.sh) +DB_HOST=$(kubectl -n "$ESIGNET_NS" get configmap postgres-config \ + -o jsonpath='{.data.database-host}' 2>/dev/null || echo "") +if [ -z "$DB_HOST" ]; then + echo "ERROR: postgres-config not found in $ESIGNET_NS — ensure esignet-preinstall.sh has run." >&2 + exit 1 +fi + +# Build mockid-postgres-config — DB name/user/port are fixed for mock identity system +kubectl -n "$ESIGNET_NS" create configmap mockid-postgres-config \ + --from-literal=database-host="$DB_HOST" \ + --from-literal=database-port="$MOCKID_DB_PORT" \ + --from-literal=database-name="$MOCKID_DB_NAME" \ + --from-literal=database-username="$MOCKID_DB_USER" \ + --dry-run=client -o yaml | kubectl apply -f - +echo "mockid-postgres-config created/updated in $ESIGNET_NS (host=$DB_HOST db=$MOCKID_DB_NAME user=$MOCKID_DB_USER)." + +# Verify SoftHSM mock identity configmap exists in esignet namespace +if kubectl -n "$ESIGNET_NS" get configmap softhsm-mock-identity-system-share &>/dev/null; then + echo "SoftHSM mock identity system configmap found." +else + echo "ERROR: softhsm-mock-identity-system-share configmap not found in $ESIGNET_NS namespace." + echo "Deploy softhsm-mock-identity-system before running mock identity system install." + exit 1 +fi + +echo "Mock identity system pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid-preinstall.sh similarity index 54% rename from Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid2-preinstall.sh rename to Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid-preinstall.sh index b8cbdf9fa..f86affce4 100755 --- a/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid2-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-mosipid-preinstall.sh @@ -1,10 +1,10 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party Service MOSIPID2 Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party Service MOSIPID Pre-install # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base mock-rp-service +# Wrapper: sets ESIGNET_NS=esignet-mosipid and delegates to base mock-rp-service # preinstall (creates private key secrets in the target namespace). # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-mosipid2" -exec "$WORKDIR/hooks/esignet-standalone/mock-relying-party-service-preinstall.sh" +export ESIGNET_NS="esignet-mosipid" +exec "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh new file mode 100755 index 000000000..aa3a24fb6 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh @@ -0,0 +1,73 @@ +#!/bin/bash +# ============================================================================= +# eSignet Standalone 2.0.0 - Mock Relying Party Service Pre-install +# ============================================================================= +# Creates K8s secrets for mock relying party private keys from GitHub Actions +# environment secrets, then verifies the esignet service is running. +# +# Required env vars (set in workflow env: block from GitHub Actions secrets): +# MOCK_RELYING_PARTY_CLIENT_PRIVATE_KEY — base64-encoded PEM client private key +# MOCK_RELYING_PARTY_JWE_PRIVATE_KEY — base64-encoded PEM JWE userinfo private key +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" + +CLIENT_KEY_TMPFILE="" +JWE_KEY_TMPFILE="" + +cleanup_temp_files() { + [ -n "$CLIENT_KEY_TMPFILE" ] && [ -f "$CLIENT_KEY_TMPFILE" ] && \ + { shred -u "$CLIENT_KEY_TMPFILE" 2>/dev/null || rm -f "$CLIENT_KEY_TMPFILE"; } + [ -n "$JWE_KEY_TMPFILE" ] && [ -f "$JWE_KEY_TMPFILE" ] && \ + { shred -u "$JWE_KEY_TMPFILE" 2>/dev/null || rm -f "$JWE_KEY_TMPFILE"; } +} +trap cleanup_temp_files EXIT INT TERM + +echo "================================================" +echo "eSignet Standalone 2.0.0 - Mock Relying Party Service Pre-install" +echo "================================================" + +kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - + +# Create mock-relying-party-private-key-jwk (client private key) +EXISTING=$(kubectl -n "$ESIGNET_NS" get secret mock-relying-party-private-key-jwk \ + -o jsonpath='{.data.client-private-key}' 2>/dev/null || echo "") +if [ -z "$EXISTING" ]; then + if [ -n "${MOCK_RELYING_PARTY_CLIENT_PRIVATE_KEY:-}" ]; then + CLIENT_KEY_TMPFILE=$(mktemp) + chmod 600 "$CLIENT_KEY_TMPFILE" + echo "$MOCK_RELYING_PARTY_CLIENT_PRIVATE_KEY" | base64 -d | sed "s/'//g" | sed -z 's/\n/\\n/g' > "$CLIENT_KEY_TMPFILE" + kubectl -n "$ESIGNET_NS" delete secret mock-relying-party-private-key-jwk --ignore-not-found=true + kubectl -n "$ESIGNET_NS" create secret generic mock-relying-party-private-key-jwk \ + --from-file=client-private-key="$CLIENT_KEY_TMPFILE" + echo "mock-relying-party-private-key-jwk created." + else + echo "ERROR: MOCK_RELYING_PARTY_CLIENT_PRIVATE_KEY is not set." >&2 + exit 1 + fi +else + echo "mock-relying-party-private-key-jwk already exists, skipping." +fi + +# Create jwe-userinfo-service-secrets (JWE userinfo private key) +EXISTING=$(kubectl -n "$ESIGNET_NS" get secret jwe-userinfo-service-secrets \ + -o jsonpath='{.data.jwe-userinfo-private-key}' 2>/dev/null || echo "") +if [ -z "$EXISTING" ]; then + if [ -n "${MOCK_RELYING_PARTY_JWE_PRIVATE_KEY:-}" ]; then + JWE_KEY_TMPFILE=$(mktemp) + chmod 600 "$JWE_KEY_TMPFILE" + echo "$MOCK_RELYING_PARTY_JWE_PRIVATE_KEY" | base64 -d | sed "s/'//g" | sed -z 's/\n/\\n/g' > "$JWE_KEY_TMPFILE" + kubectl -n "$ESIGNET_NS" delete secret jwe-userinfo-service-secrets --ignore-not-found=true + kubectl -n "$ESIGNET_NS" create secret generic jwe-userinfo-service-secrets \ + --from-file=jwe-userinfo-private-key="$JWE_KEY_TMPFILE" + echo "jwe-userinfo-service-secrets created." + else + echo "ERROR: MOCK_RELYING_PARTY_JWE_PRIVATE_KEY is not set." >&2 + exit 1 + fi +else + echo "jwe-userinfo-service-secrets already exists, skipping." +fi + +echo "Mock relying party service pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh new file mode 100755 index 000000000..077947de5 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-service-sunbird-preinstall.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# ============================================================================= +# eSignet Standalone 2.0.0 - Mock Relying Party Service Sunbird Pre-install +# ============================================================================= +# Wrapper: sets ESIGNET_NS=esignet-sunbird and delegates to base mock-rp-service +# preinstall (creates private key secrets in the target namespace). +# ============================================================================= +set -euo pipefail +export ESIGNET_NS="esignet-sunbird" +exec "$WORKDIR/hooks/esignet-standalone-2.0.0/mock-relying-party-service-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid-preinstall.sh similarity index 65% rename from Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid2-preinstall.sh rename to Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid-preinstall.sh index ec8551819..7e960eba9 100755 --- a/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid2-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-mosipid-preinstall.sh @@ -1,16 +1,16 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party UI MOSIPID2 Pre-install +# eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID Pre-install # ============================================================================= -# Ensures esignet-mosipid2 namespace exists and verifies mock-relying-party-service -# is available in the esignet-mosipid2 namespace before UI deployment. +# Ensures esignet-mosipid namespace exists and verifies mock-relying-party-service +# is available in the esignet-mosipid namespace before UI deployment. # ============================================================================= set -euo pipefail -ESIGNET_NS="esignet-mosipid2" +ESIGNET_NS="esignet-mosipid" echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID2 Pre-install" +echo "eSignet Standalone 2.0.0 - Mock Relying Party UI MOSIPID Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - @@ -21,4 +21,4 @@ else echo "WARNING: Mock relying party service not found in $ESIGNET_NS. UI depends on the service being deployed." fi -echo "Mock relying party UI MOSIPID2 pre-install completed." +echo "Mock relying party UI MOSIPID pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh new file mode 100755 index 000000000..aeb2c84a9 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-preinstall.sh @@ -0,0 +1,23 @@ +#!/bin/bash +# ============================================================================= +# eSignet Standalone 2.0.0 - Mock Relying Party UI Pre-install +# ============================================================================= +# Prepares for mock relying party UI deployment. +# ============================================================================= +set -euo pipefail + +echo "================================================" +echo "eSignet Standalone 2.0.0 - Mock Relying Party UI Pre-install" +echo "================================================" + +# Ensure esignet namespace exists +kubectl create namespace esignet-mock --dry-run=client -o yaml | kubectl apply -f - + +# Verify mock relying party service is available +if kubectl -n esignet-mock get svc mock-relying-party-service &>/dev/null; then + echo "Mock relying party service found." +else + echo "WARNING: Mock relying party service not found. UI depends on the service being deployed." +fi + +echo "Mock relying party UI pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh new file mode 100755 index 000000000..d98a62acc --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/mock-relying-party-ui-sunbird-preinstall.sh @@ -0,0 +1,24 @@ +#!/bin/bash +# ============================================================================= +# eSignet Standalone 2.0.0 - Mock Relying Party UI Sunbird Pre-install +# ============================================================================= +# Ensures esignet-sunbird namespace exists and verifies mock-relying-party-service +# is available in the esignet-sunbird namespace before UI deployment. +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="esignet-sunbird" + +echo "================================================" +echo "eSignet Standalone 2.0.0 - Mock Relying Party UI Sunbird Pre-install" +echo "================================================" + +kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - + +if kubectl -n "$ESIGNET_NS" get svc mock-relying-party-service &>/dev/null; then + echo "Mock relying party service found in $ESIGNET_NS." +else + echo "WARNING: Mock relying party service not found in $ESIGNET_NS. UI depends on the service being deployed." +fi + +echo "Mock relying party UI Sunbird pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh new file mode 100755 index 000000000..a42a62267 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/notifier-postinstall.sh @@ -0,0 +1,22 @@ +#!/bin/bash +# ============================================================================= +# eSignet Standalone 2.0.0 - Notifier Post-install +# ============================================================================= +# Based on: esignet-signup/deploy/kernel/install.sh +# Patches notifier deployment with SMS number length env vars after install. +# ============================================================================= +set -euo pipefail + +KERNEL_NS="kernel" + +echo "================================================" +echo "eSignet Standalone 2.0.0 - Notifier Post-install" +echo "================================================" + +# Source: deploy/kernel/install.sh - kubectl set env deployment/notifier +echo "Setting SMS number length env vars on notifier deployment" +kubectl -n "$KERNEL_NS" set env deployment/notifier \ + MOSIP_KERNEL_SMS_NUMBER_MIN_LENGTH=7 \ + MOSIP_KERNEL_SMS_NUMBER_MAX_LENGTH=10 + +echo "Notifier post-install completed." diff --git a/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid-preinstall.sh similarity index 53% rename from Helmsman/hooks/esignet-standalone/oidc-ui-mosipid2-preinstall.sh rename to Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid-preinstall.sh index 6afd2350d..fca557915 100755 --- a/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid2-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-mosipid-preinstall.sh @@ -1,9 +1,9 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - OIDC UI MOSIPID2 Pre-install +# eSignet 1.7.1 - OIDC UI MOSIPID Pre-install # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base oidc-ui preinstall. +# Wrapper: sets ESIGNET_NS=esignet-mosipid and delegates to base oidc-ui preinstall. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-mosipid2" -exec "$WORKDIR/hooks/esignet-standalone/oidc-ui-preinstall.sh" +export ESIGNET_NS="esignet-mosipid" +exec "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh new file mode 100755 index 000000000..d25717fb5 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh @@ -0,0 +1,34 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - OIDC UI Pre-install +# ============================================================================= +# Based on: deploy/oidc-ui/install.sh +# Waits for eSignet service readiness before deploying OIDC UI. +# Theme, language, and provider name are configured via DSF helm set values. +# +# Environment Variables: +# ESIGNET_NS - eSignet namespace (default: esignet) +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" + +echo "================================================" +echo "eSignet 1.7.1 - OIDC UI Pre-install" +echo "================================================" + +# --- Step 1: Ensure esignet namespace exists --- +kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite + +# --- Step 2: Update helm repos --- +helm repo add mosip https://mosip.github.io/mosip-helm || true +helm repo update + +# --- Step 3: Wait for eSignet service to be available --- +# Source: deploy/oidc-ui/install.sh - eSignet must be running before OIDC UI +echo "Waiting for eSignet service to be ready..." +kubectl -n "$ESIGNET_NS" wait --for=condition=ready pod -l app.kubernetes.io/name=esignet --timeout=480s || \ + { echo "ERROR: eSignet pods not ready after timeout" >&2; exit 1; } + +echo "OIDC UI pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone/softhsm-esignet-mosipid2-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-sunbird-preinstall.sh similarity index 52% rename from Helmsman/hooks/esignet-standalone/softhsm-esignet-mosipid2-setup.sh rename to Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-sunbird-preinstall.sh index c4714b378..b7e0826cf 100755 --- a/Helmsman/hooks/esignet-standalone/softhsm-esignet-mosipid2-setup.sh +++ b/Helmsman/hooks/esignet-standalone-2.0.0/oidc-ui-sunbird-preinstall.sh @@ -1,9 +1,9 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - SoftHSM eSignet MOSIPID2 Pre-install Setup +# eSignet 1.7.1 - OIDC UI Sunbird Pre-install # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid2 and delegates to base softhsm setup. +# Wrapper: sets ESIGNET_NS=esignet-sunbird and delegates to base oidc-ui preinstall. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-mosipid2" -exec "$WORKDIR/hooks/esignet-standalone/softhsm-esignet-setup.sh" +export ESIGNET_NS="esignet-sunbird" +exec "$WORKDIR/hooks/esignet-standalone-2.0.0/oidc-ui-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/postgres-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/postgres-postinstall.sh new file mode 100755 index 000000000..c30a38be3 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/postgres-postinstall.sh @@ -0,0 +1,40 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Postgres Post-install +# ============================================================================= +# Based on: deploy/postgres/generate-secret-cm.py +# Creates postgres secrets (db-common-secrets) and configmap (postgres-config) +# after PostgreSQL helm chart deployment. Replaces interactive Python script +# with environment variable driven approach. +# +# Environment Variables: +# DB_USER_PASSWORD - Database user password (REQUIRED) +# POSTGRES_HOST - PostgreSQL host (default: postgres-postgresql.postgres) +# POSTGRES_PORT - PostgreSQL port (default: 5432) +# DB_USER - Database username (default: esignetuser) +# DB_NAME - Database name (default: mosip_esignet) +# ============================================================================= +set -euo pipefail + +POSTGRES_NS="postgres" +POSTGRES_HOST="${POSTGRES_HOST:-postgres-postgresql.postgres}" +POSTGRES_PORT="${POSTGRES_PORT:-5432}" +DB_USER="${DB_USER:-esignetuser}" +DB_NAME="${DB_NAME:-mosip_esignet}" + +echo "================================================" +echo "eSignet 1.7.1 - Postgres Post-install" +echo "================================================" + + +# --- Step 1: Create postgres-config configmap --- +# Source: deploy/postgres/generate-secret-cm.py -> create_or_update_configmap() +echo "Creating postgres-config configmap in $POSTGRES_NS namespace" +kubectl -n "$POSTGRES_NS" create configmap postgres-config \ + --from-literal=database-host="$POSTGRES_HOST" \ + --from-literal=database-port="$POSTGRES_PORT" \ + --from-literal=database-username="$DB_USER" \ + --from-literal=database-name="$DB_NAME" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Postgres post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/postgres-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/postgres-preinstall.sh new file mode 100755 index 000000000..b3fa198e7 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/postgres-preinstall.sh @@ -0,0 +1,32 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Postgres Pre-install +# ============================================================================= +# Based on: deploy/install-prereq.sh +# Creates esignet namespace, applies esignet-global configmap, and prepares +# postgres namespace before PostgreSQL helm chart deployment. +# +# Environment Variables: +# INSTALLATION_DOMAIN - Base domain (default: sandbox.xyz.net) +# ESIGNET_NS - eSignet namespace (default: esignet) +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" +INSTALLATION_DOMAIN="${INSTALLATION_DOMAIN:-sandbox.xyz.net}" + +echo "================================================" +echo "eSignet 1.7.1 - Postgres Pre-install" +echo "================================================" + +# --- Step 1: Create esignet namespace (referenced by esignet-global configmap) --- +echo "Creating $ESIGNET_NS namespace" +kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite + +# --- Step 2: Prepare postgres namespace --- +echo "Creating postgres namespace" +kubectl create namespace postgres --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace postgres istio-injection=enabled --overwrite + +echo "Postgres pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/redis-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/redis-setup.sh new file mode 100755 index 000000000..c210c2861 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/redis-setup.sh @@ -0,0 +1,50 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Redis Post-install Setup +# ============================================================================= +# Based on: deploy/redis/install.sh + deploy/install-prereq.sh (redis section) +# Creates redis-config configmap and shares Redis credentials with the +# esignet namespace after Redis deployment. +# +# Environment Variables: +# ESIGNET_NS - eSignet namespace (default: esignet) +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" +REDIS_NS="redis" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - Redis Post-install Setup" +echo "================================================" + +# --- Step 1: Wait for Redis to be ready --- +echo "Waiting for Redis pods to be ready..." +kubectl -n "$REDIS_NS" wait --for=condition=ready pod -l app.kubernetes.io/name=redis --timeout=480s || \ + { echo "ERROR: Redis pods not ready after timeout" >&2; exit 1; } + +# --- Step 2: Apply redis-config configmap in redis namespace --- +echo "Creating redis-config configmap in $REDIS_NS namespace" +cat </dev/null; then + SECRET_B64=$(kubectl -n "$SIGNUP_NS" get secret keycloak-client-secrets \ + -o jsonpath="{.data.$SECRET_KEY}" 2>/dev/null || echo "") + if [[ -n "$SECRET_B64" ]]; then + echo "Syncing $SECRET_KEY back to $KEYCLOAK_NS namespace" + if kubectl -n "$KEYCLOAK_NS" get secret keycloak-client-secrets &>/dev/null; then + kubectl -n "$KEYCLOAK_NS" patch secret keycloak-client-secrets \ + --type=merge \ + -p "{\"data\":{\"$SECRET_KEY\":\"$SECRET_B64\"}}" || true + else + kubectl -n "$KEYCLOAK_NS" create secret generic keycloak-client-secrets \ + --from-literal=dummy=placeholder \ + --dry-run=client -o yaml | kubectl apply -f - + kubectl -n "$KEYCLOAK_NS" patch secret keycloak-client-secrets \ + --type=merge \ + -p "{\"data\":{\"$SECRET_KEY\":\"$SECRET_B64\"}}" || true + fi + echo "$SECRET_KEY synced to $KEYCLOAK_NS namespace." + fi +fi + +echo "Signup keycloak init post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/signup-keycloak-init-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/signup-keycloak-init-preinstall.sh new file mode 100755 index 000000000..cd45201ec --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/signup-keycloak-init-preinstall.sh @@ -0,0 +1,59 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Signup Keycloak Init Pre-install +# ============================================================================= +# Based on: esignet-signup/deploy/keycloak/keycloak-init.sh +# Copies keycloak configmaps/secrets to signup namespace and ensures +# keycloak-client-secrets contains mosip_signup_client_secret before +# the keycloak-init helm chart runs. +# +# On first deploy: generates a UUID secret if none exists in keycloak ns. +# On re-deploy: propagates the existing secret from keycloak namespace. +# +# Environment Variables: +# SIGNUP_NS - Signup namespace (default: signup) +# ============================================================================= +set -euo pipefail + +SIGNUP_NS="${SIGNUP_NS:-signup}" +KEYCLOAK_NS="keycloak" +SECRET_KEY="mosip_signup_client_secret" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - Signup Keycloak Init Pre-install" +echo "================================================" + +# --- Step 1: Ensure signup namespace exists with istio --- +kubectl create namespace "$SIGNUP_NS" --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace "$SIGNUP_NS" istio-injection=enabled --overwrite + +# --- Step 2: Copy keycloak-env-vars configmap --- +echo "Copying keycloak-env-vars to $SIGNUP_NS namespace" +$COPY_UTIL configmap keycloak-env-vars "$KEYCLOAK_NS" "$SIGNUP_NS" + +# --- Step 3: Copy keycloak secret --- +echo "Copying keycloak secret to $SIGNUP_NS namespace" +$COPY_UTIL secret keycloak "$KEYCLOAK_NS" "$SIGNUP_NS" + +# --- Step 4: Ensure keycloak-client-secrets has mosip_signup_client_secret --- +echo "Ensuring mosip_signup_client_secret exists in $SIGNUP_NS" +if kubectl -n "$KEYCLOAK_NS" get secret keycloak-client-secrets &>/dev/null && \ + kubectl -n "$KEYCLOAK_NS" get secret keycloak-client-secrets \ + -o jsonpath="{.data.$SECRET_KEY}" 2>/dev/null | grep -q '.'; then + echo "Found existing $SECRET_KEY in keycloak namespace — propagating to $SIGNUP_NS" + SECRET_B64=$(kubectl -n "$KEYCLOAK_NS" get secret keycloak-client-secrets \ + -o jsonpath="{.data.$SECRET_KEY}") +else + echo "No existing $SECRET_KEY found — generating new secret" + SECRET_B64=$(python3 -c "import uuid, base64; print(base64.b64encode(str(uuid.uuid4()).encode()).decode())") +fi + +kubectl -n "$SIGNUP_NS" create secret generic keycloak-client-secrets \ + --from-literal=dummy=placeholder \ + --dry-run=client -o yaml | kubectl apply -f - +kubectl -n "$SIGNUP_NS" patch secret keycloak-client-secrets \ + --type=merge \ + -p "{\"data\":{\"$SECRET_KEY\":\"$SECRET_B64\"}}" + +echo "Signup keycloak init pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh new file mode 100755 index 000000000..8a32a8b82 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/signup-service-preinstall.sh @@ -0,0 +1,97 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - Signup Service Pre-install +# ============================================================================= +# Based on: esignet-signup/deploy/prereq.sh + deploy/msg-gateway/install.sh +# Sets up all prerequisites for signup-service: +# - Copies redis-config configmap and redis secret +# - Creates keycloak-host configmap (KEYCLOAK_EXTERNAL_URL) +# - Creates empty signup-captcha secret (update site/secret keys for prod) +# - Creates empty signup-keystore and signup-keystore-password secrets +# - Creates msg-gateway configmap and secret (default: mock-smtp) +# +# Environment Variables: +# SIGNUP_NS - Signup namespace (default: signup) +# MOSIP_IAM_EXTERNAL_HOST - Keycloak external host (e.g. iam.sandbox.xyz.net) +# MOSIP_SIGNUP_CAPTCHA_SITE_KEY - reCAPTCHA site key (default: empty) +# MOSIP_SIGNUP_CAPTCHA_SECRET_KEY - reCAPTCHA secret key (default: empty) +# ============================================================================= +set -euo pipefail + +SIGNUP_NS="${SIGNUP_NS:-signup}" +REDIS_NS="redis" +KEYCLOAK_NS="keycloak" +IAM_EXTERNAL_HOST="${MOSIP_IAM_EXTERNAL_HOST:-}" +CAPTCHA_SITE_KEY="${MOSIP_SIGNUP_CAPTCHA_SITE_KEY:-}" +CAPTCHA_SECRET_KEY="${MOSIP_SIGNUP_CAPTCHA_SECRET_KEY:-}" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - Signup Service Pre-install" +echo "================================================" + +# --- Step 1: Ensure signup namespace exists with istio --- +kubectl create namespace "$SIGNUP_NS" --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace "$SIGNUP_NS" istio-injection=enabled --overwrite + +# --- Step 2: Copy redis configmap and secret --- +echo "Copying redis-config to $SIGNUP_NS namespace" +$COPY_UTIL configmap redis-config "$REDIS_NS" "$SIGNUP_NS" +echo "Copying redis secret to $SIGNUP_NS namespace" +$COPY_UTIL secret redis "$REDIS_NS" "$SIGNUP_NS" + +# --- Step 3: Create keycloak-host configmap --- +echo "Creating keycloak-host configmap in $SIGNUP_NS" +kubectl -n "$SIGNUP_NS" create configmap keycloak-host \ + --from-literal=keycloak-external-url="https://$IAM_EXTERNAL_HOST/auth" \ + --from-literal=keycloak-internal-url="http://keycloak.$KEYCLOAK_NS" \ + --dry-run=client -o yaml | kubectl apply -f - + +# --- Step 4: Create signup-captcha secret --- +echo "Creating signup-captcha secret in $SIGNUP_NS" +kubectl -n "$SIGNUP_NS" create secret generic signup-captcha \ + --from-literal=signup-captcha-site-key="$CAPTCHA_SITE_KEY" \ + --from-literal=signup-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Copying signup-captcha secret to captcha namespace" +$COPY_UTIL secret signup-captcha "$SIGNUP_NS" "captcha" + +echo "Patching captcha deployment with signup secret key" +ENV_VAR_EXISTS=$(kubectl -n captcha get deployment captcha \ + -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP')].name}" 2>/dev/null || echo "") +if [[ -z "$ENV_VAR_EXISTS" ]]; then + kubectl patch deployment -n captcha captcha --type='json' \ + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_SIGNUP", "valueFrom": {"secretKeyRef": {"name": "signup-captcha", "key": "signup-captcha-secret-key"}}}}]' +else + echo "Restarting captcha to load the updated signup secret." + kubectl -n captcha rollout restart deployment/captcha + kubectl -n captcha rollout status deployment/captcha --timeout=480s +fi + +# --- Step 5: Create signup-keystore secrets --- +echo "Creating signup-keystore secrets in $SIGNUP_NS" +kubectl -n "$SIGNUP_NS" create secret generic signup-keystore-password \ + --from-literal=signup-keystore-password='' \ + --dry-run=client -o yaml | kubectl apply -f - +kubectl -n "$SIGNUP_NS" create secret generic signup-keystore \ + --from-literal=oidckeystore.p12='' \ + --dry-run=client -o yaml | kubectl apply -f - + +# --- Step 6: Create msg-gateway configmap and secret (pointing to mock-smtp) --- +echo "Creating msg-gateway configmap and secret in $SIGNUP_NS" +kubectl -n "$SIGNUP_NS" create configmap msg-gateway \ + --from-literal=smtp-host="mock-smtp.mock-smtp" \ + --from-literal=sms-host="mock-smtp.mock-smtp" \ + --from-literal=smtp-port="8025" \ + --from-literal=sms-port="8080" \ + --from-literal=smtp-username="" \ + --from-literal=sms-username="" \ + --dry-run=client -o yaml | kubectl apply -f - +kubectl -n "$SIGNUP_NS" create secret generic msg-gateway \ + --from-literal=smtp-secret='' \ + --from-literal=sms-secret='' \ + --from-literal=sms-authkey='authkey' \ + --dry-run=client -o yaml | kubectl apply -f - + +echo "Signup service pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid-setup.sh new file mode 100755 index 000000000..120c2b1e0 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-mosipid-setup.sh @@ -0,0 +1,9 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - SoftHSM eSignet MOSIPID Pre-install Setup +# ============================================================================= +# Wrapper: sets ESIGNET_NS=esignet-mosipid and delegates to base softhsm setup. +# ============================================================================= +set -euo pipefail +export ESIGNET_NS="esignet-mosipid" +exec "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh new file mode 100755 index 000000000..4b990127c --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-postinstall.sh @@ -0,0 +1,36 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - SoftHSM eSignet Post-install +# ============================================================================= +# Based on: deploy/esignet/install.sh (copy_cm_func.sh calls for softhsm) +# Shares SoftHSM configmap and secrets from softhsm namespace to esignet +# namespace after SoftHSM deployment. +# +# Environment Variables: +# SOFTHSM_NS - SoftHSM namespace (default: softhsm) +# ESIGNET_NS - eSignet namespace (default: esignet) +# ============================================================================= +set -euo pipefail + +SOFTHSM_NS="${SOFTHSM_NS:-softhsm}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - SoftHSM eSignet Post-install" +echo "================================================" + +# --- Step 1: Wait for SoftHSM pod to be ready --- +echo "Waiting for SoftHSM pod to be ready..." +kubectl -n "$SOFTHSM_NS" wait --for=condition=ready pod -l app.kubernetes.io/instance=esignet-softhsm --timeout=480s || \ + { echo "ERROR: SoftHSM pod not ready after timeout" >&2; exit 1; } + +# --- Step 2: Copy esignet-softhsm-share configmap to esignet namespace --- +echo "Copying esignet-softhsm-share configmap to $ESIGNET_NS namespace" +$COPY_UTIL configmap esignet-softhsm-share "$SOFTHSM_NS" "$ESIGNET_NS" + +# --- Step 3: Copy esignet-softhsm secret to esignet namespace --- +echo "Copying esignet-softhsm secret to $ESIGNET_NS namespace" +$COPY_UTIL secret esignet-softhsm "$SOFTHSM_NS" "$ESIGNET_NS" + +echo "SoftHSM eSignet post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh new file mode 100755 index 000000000..54fa57156 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh @@ -0,0 +1,29 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - SoftHSM eSignet Pre-install Setup +# ============================================================================= +# Based on: deploy/softhsm/install.sh +# softhsm-esignet deploys in the esignet namespace (v1.7.1 pattern) so +# esignet-softhsm-share configmap is created there directly — no cross-ns copy. +# +# Environment Variables: +# ESIGNET_NS - eSignet namespace (default: esignet) +# ============================================================================= +set -euo pipefail + +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" + +echo "================================================" +echo "eSignet 1.7.1 - SoftHSM eSignet Pre-install" +echo "================================================" + +# Ensure esignet namespace exists with Istio injection enabled +echo "Ensuring $ESIGNET_NS namespace exists" +kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite + +# Update helm repos +echo "Updating helm repos" +helm repo update + +echo "SoftHSM eSignet pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh new file mode 100755 index 000000000..5007357b3 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-esignet-sunbird-setup.sh @@ -0,0 +1,9 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - SoftHSM eSignet Sunbird Pre-install Setup +# ============================================================================= +# Wrapper: sets ESIGNET_NS=esignet-sunbird and delegates to base softhsm setup. +# ============================================================================= +set -euo pipefail +export ESIGNET_NS="esignet-sunbird" +exec "$WORKDIR/hooks/esignet-standalone-2.0.0/softhsm-esignet-setup.sh" diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh new file mode 100755 index 000000000..5349e447c --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-postinstall.sh @@ -0,0 +1,27 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - SoftHSM Mock Identity System Post-install +# ============================================================================= +# Copies chart-generated softhsm-mock-identity-system-share configmap +# (PKCS11 slot/token config) from softhsm namespace to esignet-mock namespace. +# The security PIN is handled separately via secret copy in preinstall. +# ============================================================================= +set -euo pipefail + +SOFTHSM_NS="${SOFTHSM_NS:-softhsm}" +ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet 1.7.1 - SoftHSM Mock Identity System Post-install" +echo "================================================" + +# Wait for SoftHSM mock identity pod to be ready +kubectl -n "$SOFTHSM_NS" wait --for=condition=ready pod -l app.kubernetes.io/instance=softhsm-mock-identity-system --timeout=480s || \ + { echo "ERROR: SoftHSM mock identity system pod not ready after timeout" >&2; exit 1; } + +# Copy chart-generated PKCS11 configmap to esignet-mock namespace +echo "Copying softhsm-mock-identity-system-share configmap to $ESIGNET_NS" +$COPY_UTIL configmap softhsm-mock-identity-system-share "$SOFTHSM_NS" "$ESIGNET_NS" + +echo "SoftHSM mock identity system post-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh new file mode 100755 index 000000000..99a1ea0dc --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/softhsm-mock-identity-system-preinstall.sh @@ -0,0 +1,17 @@ +#!/bin/bash +# ============================================================================= +# eSignet 1.7.1 - SoftHSM Mock Identity System Pre-install +# ============================================================================= +# Prepares SoftHSM for the mock identity system. +# ============================================================================= +set -euo pipefail + +echo "================================================" +echo "eSignet 1.7.1 - SoftHSM Mock Identity System Pre-install" +echo "================================================" + +# Ensure softhsm namespace exists +kubectl create namespace softhsm --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace softhsm istio-injection=enabled --overwrite + +echo "SoftHSM mock identity system pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-esignet-mosipid-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-esignet-mosipid-setup.sh new file mode 100755 index 000000000..f5feaff8d --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-esignet-mosipid-setup.sh @@ -0,0 +1,27 @@ +#!/bin/bash +# ============================================================================= +# eSignet Standalone 2.0.0 - eSignet-MOSIPID UI Testrig Pre-install Setup +# ============================================================================= +# esignet-mosipid-uitestrig deploys the dedicated mosip/esignet-uitestrig chart (the +# Java-harness rewrite for eSignet 2.0.0 - see +# https://github.com/mosip/esignet/blob/v2.0.0/deploy/esignet-uitestrig/install.sh), +# into its own esignet-mosipid-uitestrig namespace, separate from eSignet's own +# esignet-mosipid namespace (matches install.sh's own NS/SOURCE_NS split). +# +# The chart manages its own ConfigMap/Secret entirely from set: values - no +# pre-staged secrets needed. The only job here is namespace bootstrap, same as +# uitestrig-signup-setup.sh's existing pattern for signup-uitestrig. +# ============================================================================= +set -euo pipefail + +NS=esignet-mosipid-uitestrig + +echo "================================================" +echo "eSignet Standalone 2.0.0 - eSignet-MOSIPID UI Testrig Pre-install" +echo "================================================" + +echo "Ensuring $NS namespace exists with Istio injection disabled" +kubectl create namespace "$NS" --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace "$NS" istio-injection=disabled --overwrite + +echo "eSignet-MOSIPID UI Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-esignet-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-esignet-setup.sh new file mode 100755 index 000000000..cbcf5d505 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-esignet-setup.sh @@ -0,0 +1,27 @@ +#!/bin/bash +# ============================================================================= +# eSignet Standalone 2.0.0 - eSignet UI Testrig Pre-install Setup +# ============================================================================= +# esignet-uitestrig deploys the dedicated mosip/esignet-uitestrig chart (the +# Java-harness rewrite for eSignet 2.0.0 - see +# https://github.com/mosip/esignet/blob/v2.0.0/deploy/esignet-uitestrig/install.sh), +# into its own esignet-uitestrig namespace, separate from eSignet's own esignet-mock +# namespace (matches install.sh's own NS=esignet-uitestrig / SOURCE_NS=esignet split). +# +# The chart manages its own ConfigMap/Secret entirely from set: values - no +# pre-staged secrets needed. The only job here is namespace bootstrap, same as +# uitestrig-signup-setup.sh's existing pattern for signup-uitestrig. +# ============================================================================= +set -euo pipefail + +NS=esignet-uitestrig + +echo "================================================" +echo "eSignet Standalone 2.0.0 - eSignet UI Testrig Pre-install" +echo "================================================" + +echo "Ensuring $NS namespace exists with Istio injection disabled" +kubectl create namespace "$NS" --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace "$NS" istio-injection=disabled --overwrite + +echo "eSignet UI Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-esignet-sunbird-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-esignet-sunbird-setup.sh new file mode 100755 index 000000000..fda37f698 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-esignet-sunbird-setup.sh @@ -0,0 +1,27 @@ +#!/bin/bash +# ============================================================================= +# eSignet Standalone 2.0.0 - eSignet-Sunbird UI Testrig Pre-install Setup +# ============================================================================= +# esignet-sunbird-uitestrig deploys the dedicated mosip/esignet-uitestrig chart (the +# Java-harness rewrite for eSignet 2.0.0 - see +# https://github.com/mosip/esignet/blob/v2.0.0/deploy/esignet-uitestrig/install.sh), +# into its own esignet-sunbird-uitestrig namespace, separate from eSignet's own +# esignet-sunbird namespace (matches install.sh's own NS/SOURCE_NS split). +# +# The chart manages its own ConfigMap/Secret entirely from set: values - no +# pre-staged secrets needed. The only job here is namespace bootstrap, same as +# uitestrig-signup-setup.sh's existing pattern for signup-uitestrig. +# ============================================================================= +set -euo pipefail + +NS=esignet-sunbird-uitestrig + +echo "================================================" +echo "eSignet Standalone 2.0.0 - eSignet-Sunbird UI Testrig Pre-install" +echo "================================================" + +echo "Ensuring $NS namespace exists with Istio injection disabled" +kubectl create namespace "$NS" --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace "$NS" istio-injection=disabled --overwrite + +echo "eSignet-Sunbird UI Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh new file mode 100755 index 000000000..8564065a5 --- /dev/null +++ b/Helmsman/hooks/esignet-standalone-2.0.0/uitestrig-signup-setup.sh @@ -0,0 +1,34 @@ +#!/bin/bash +# ============================================================================= +# eSignet Standalone 2.0.0 - Signup UI Testrig Pre-install Setup +# ============================================================================= +# Prepares the signup-uitestrig namespace. +# Copies keycloak resources from keycloak ns, MinIO s3 secret from minio ns, +# and postgres-postgresql from postgres ns. +# Stale uitestrig CMs are deleted so the chart recreates them from set: values. +# ============================================================================= +set -euo pipefail + +NS=signup-uitestrig +COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" + +echo "================================================" +echo "eSignet Standalone 2.0.0 - Signup UI Testrig Pre-install" +echo "================================================" + +echo "Ensuring $NS namespace exists with Istio injection disabled" +kubectl create namespace "$NS" --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace "$NS" istio-injection=disabled --overwrite + +echo "Deleting stale uitestrig configmaps in $NS" +kubectl -n "$NS" delete --ignore-not-found=true configmap s3 +kubectl -n "$NS" delete --ignore-not-found=true configmap db +kubectl -n "$NS" delete --ignore-not-found=true configmap uitestrig + +echo "Copying resources to $NS" +$COPY_UTIL configmap keycloak-host keycloak "$NS" +$COPY_UTIL secret keycloak-client-secrets keycloak "$NS" +$COPY_UTIL secret s3 minio "$NS" +$COPY_UTIL secret postgres-postgresql postgres "$NS" + +echo "Signup UI Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid1-setup.sh b/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid-setup.sh similarity index 75% rename from Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid1-setup.sh rename to Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid-setup.sh index 89ef80915..a1047daa2 100755 --- a/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid1-setup.sh +++ b/Helmsman/hooks/esignet-standalone/apitestrig-esignet-mosipid-setup.sh @@ -1,19 +1,19 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet-MOSIPID1 API Testrig Pre-install Setup +# eSignet 1.7.1 - eSignet-MOSIPID API Testrig Pre-install Setup # ============================================================================= -# Prepares the esignet-mosipid1 namespace for the esignet-mosipid1-apitestrig release. -# keycloak-host and keycloak-client-secrets are already present in esignet-mosipid1 +# Prepares the esignet-mosipid namespace for the esignet-mosipid-apitestrig release. +# keycloak-host and keycloak-client-secrets are already present in esignet-mosipid # (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql # needs to be copied; stale testrig CMs are deleted so the chart recreates them. # ============================================================================= set -euo pipefail -NS=esignet-mosipid1 +NS=esignet-mosipid COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" echo "================================================" -echo "eSignet 1.7.1 - eSignet-MOSIPID1 API Testrig Pre-install" +echo "eSignet 1.7.1 - eSignet-MOSIPID API Testrig Pre-install" echo "================================================" echo "Deleting stale testrig configmaps in $NS" @@ -24,4 +24,4 @@ kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig echo "Copying postgres-postgresql secret to $NS" $COPY_UTIL secret postgres-postgresql postgres "$NS" -echo "eSignet-MOSIPID1 API Testrig pre-install setup completed." +echo "eSignet-MOSIPID API Testrig pre-install setup completed." diff --git a/Helmsman/hooks/esignet-standalone/config-server-esignet-postinstall.sh b/Helmsman/hooks/esignet-standalone/config-server-esignet-postinstall.sh deleted file mode 100755 index 1c799425e..000000000 --- a/Helmsman/hooks/esignet-standalone/config-server-esignet-postinstall.sh +++ /dev/null @@ -1,39 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - Config-Server eSignet Post-install -# ============================================================================= -# Copies esignet-config-server-share CM from esignet-mock ns to mosipid1/mosipid2/sunbird, -# then patches active_profile_env and spring_config_label_env per namespace -# so each instance points to the correct config server profile and Git label. -# -# Environment variables (set in GitHub Actions workflow): -# ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL - Git label for esignet-mosipid1 (default: develop) -# ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL - Git label for esignet-mosipid2 (default: develop) -# ============================================================================= -set -euo pipefail - -SOURCE_NS="esignet-mock" -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -CM_NAME="esignet-config-server-share" - -MOSIPID1_SPRING_LABEL="${ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL:-develop}" -MOSIPID2_SPRING_LABEL="${ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL:-develop}" - -echo "================================================" -echo "eSignet 1.7.1 - Config-Server eSignet Post-install" -echo "================================================" - -for TARGET_NS in esignet-mosipid1 esignet-mosipid2 esignet-sunbird; do - echo "Copying $CM_NAME from $SOURCE_NS to $TARGET_NS" - $COPY_UTIL configmap "$CM_NAME" "$SOURCE_NS" "$TARGET_NS" -done - -echo "Patching $CM_NAME in esignet-mosipid1 (active_profile_env=mosipid1, spring_config_label_env=$MOSIPID1_SPRING_LABEL)" -kubectl -n esignet-mosipid1 patch configmap "$CM_NAME" --type merge \ - -p "{\"data\":{\"active_profile_env\":\"mosipid1\",\"spring_config_label_env\":\"$MOSIPID1_SPRING_LABEL\"}}" - -echo "Patching $CM_NAME in esignet-mosipid2 (active_profile_env=mosipid2, spring_config_label_env=$MOSIPID2_SPRING_LABEL)" -kubectl -n esignet-mosipid2 patch configmap "$CM_NAME" --type merge \ - -p "{\"data\":{\"active_profile_env\":\"mosipid2\",\"spring_config_label_env\":\"$MOSIPID2_SPRING_LABEL\"}}" - -echo "Config-server share configmap propagation and patching completed." diff --git a/Helmsman/hooks/esignet-standalone/config-server-esignet-setup.sh b/Helmsman/hooks/esignet-standalone/config-server-esignet-setup.sh deleted file mode 100755 index ee1798d92..000000000 --- a/Helmsman/hooks/esignet-standalone/config-server-esignet-setup.sh +++ /dev/null @@ -1,78 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - Config-Server eSignet Pre-install -# ============================================================================= -# Based on: esignet/deploy/config-server/install.sh -# -# Prepares esignet namespace for config-server deployment: -# 1. Ensures namespace exists with Istio injection enabled -# 2. Copies db-common-secrets from postgres ns -# 3. Creates esignet-global ConfigMap from workflow env vars -# (domain_name set by helmsman_esignet.yml; available as shell env var -# in all hooks run within the same workflow step) -# 4. Pre-creates empty esignet-misp-onboarder-key secret as placeholder -# (MISP onboarder at priority -6 writes the real key; config-server is -# restarted by esignet-misp-onboarder-postinstall.sh afterwards) -# -# NOTE: esignet-softhsm secret is NOT copied here — the softhsm helm chart -# installs directly into the esignet namespace, so no cross-namespace copy needed. -# -# NOTE: keycloak resources (keycloak-host, keycloak-env-vars, keycloak, -# keycloak-client-secrets) are NOT copied here. They are populated in all -# esignet namespaces by esignet-postinstall-keycloak-init.sh which runs as -# part of external-dsf (esignet-keycloak-init at priority -11 in keycloak ns). -# By the time esignet-dsf runs, these resources are already present. -# -# Environment Variables: -# ESIGNET_NS - eSignet namespace (default: esignet) -# domain_name - base domain (set by workflow, e.g. sandbox.example.net) -# ============================================================================= -set -euo pipefail - -ESIGNET_NS="${ESIGNET_NS:-esignet-mock}" -POSTGRES_NS="postgres" -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" - -echo "================================================" -echo "eSignet 1.7.1 - Config-Server eSignet Pre-install" -echo "================================================" - -# --- Step 1: Ensure namespace with Istio --- -kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - -kubectl label namespace "$ESIGNET_NS" istio-injection=enabled --overwrite - -# --- Step 2: Copy db-common-secrets --- -# NOTE: esignet-softhsm secret is NOT copied here — the softhsm helm chart -# creates it directly in the esignet namespace as a helm-managed resource. -echo "Copying db-common-secrets from $POSTGRES_NS" -$COPY_UTIL secret db-common-secrets "$POSTGRES_NS" "$ESIGNET_NS" - -# --- Step 3: Create esignet-global from workflow env vars --- -# domain_name is exported by the helmsman_esignet.yml workflow step -echo "Creating esignet-global configmap (domain_name=${domain_name:-UNSET})" -kubectl -n "$ESIGNET_NS" create configmap esignet-global \ - --from-literal=installation-domain="${domain_name}" \ - --from-literal=mosip-api-host="api.${domain_name}" \ - --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet.${domain_name}" \ - --from-literal=mosip-iam-external-host="iam.${domain_name}" \ - --from-literal=mosip-kafka-host="kafka.${domain_name}" \ - --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup.${domain_name}" \ - --from-literal=mosip-smtp-host="smtp.${domain_name}" \ - --from-literal=mosip-version="develop" \ - --dry-run=client -o yaml | kubectl apply -f - -echo "esignet-global created/updated." - -# --- Step 4: Pre-create empty MISP key secret as placeholder --- -# Allows config-server pod to start. Real value written by MISP onboarder (-6). -# esignet-misp-onboarder-postinstall.sh restarts config-server after writing. -if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then - kubectl -n "$ESIGNET_NS" create secret generic esignet-misp-onboarder-key \ - --from-literal=mosip-esignet-misp-key="" - echo "esignet-misp-onboarder-key placeholder created." -else - echo "esignet-misp-onboarder-key already exists, skipping placeholder." -fi - -echo "Config-server eSignet pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone/esignet-db-postinstall.sh b/Helmsman/hooks/esignet-standalone/esignet-db-postinstall.sh index cf716aa72..a671a62c8 100755 --- a/Helmsman/hooks/esignet-standalone/esignet-db-postinstall.sh +++ b/Helmsman/hooks/esignet-standalone/esignet-db-postinstall.sh @@ -15,7 +15,7 @@ echo "================================================" echo "eSignet 1.7.1 - Database Init Post-install" echo "================================================" -for NS in esignet-mock esignet-mosipid1 esignet-mosipid2 esignet-sunbird; do +for NS in esignet-mock esignet-mosipid esignet-sunbird; do echo "Copying db-common-secrets from $POSTGRES_NS to $NS" $COPY_UTIL secret db-common-secrets "$POSTGRES_NS" "$NS" done diff --git a/Helmsman/hooks/esignet-standalone/esignet-init-db.sh b/Helmsman/hooks/esignet-standalone/esignet-init-db.sh index d382f7848..9c15c6fb5 100755 --- a/Helmsman/hooks/esignet-standalone/esignet-init-db.sh +++ b/Helmsman/hooks/esignet-standalone/esignet-init-db.sh @@ -7,7 +7,7 @@ # postgres-postgresql secret natively. This hook pre-creates all esignet-mock # namespaces so the postInstall hook can copy db-common-secrets into each. # Namespaces are created here at priority -16 because the namespace-specific -# preinstall hooks (esignet-mosipid1/mosipid2/sunbird) only run at priority -14. +# preinstall hooks (esignet-mosipid/sunbird) only run at priority -14. # ============================================================================= set -euo pipefail @@ -15,7 +15,7 @@ echo "================================================" echo "eSignet 1.7.1 - Database Init Pre-install" echo "================================================" -for NS in esignet-mock esignet-mosipid1 esignet-mosipid2 esignet-sunbird; do +for NS in esignet-mock esignet-mosipid esignet-sunbird; do kubectl create namespace "$NS" --dry-run=client -o yaml | kubectl apply -f - kubectl label namespace "$NS" istio-injection=enabled --overwrite echo "Namespace $NS ready." diff --git a/Helmsman/hooks/esignet-standalone/esignet-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone/esignet-mosipid-preinstall.sh similarity index 53% rename from Helmsman/hooks/esignet-standalone/esignet-mosipid1-preinstall.sh rename to Helmsman/hooks/esignet-standalone/esignet-mosipid-preinstall.sh index e768ad1d8..ef54cc13a 100755 --- a/Helmsman/hooks/esignet-standalone/esignet-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone/esignet-mosipid-preinstall.sh @@ -1,41 +1,41 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - eSignet MOSIPID1 Service Pre-install +# eSignet 1.7.1 - eSignet MOSIPID Service Pre-install # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid1, runs base esignet preinstall (copies -# postgres + redis config/secrets), then creates esignet-captcha-mosipid1 secret -# in the captcha namespace from workflow env vars, copies it to esignet-mosipid1, -# and patches the captcha deployment with the MOSIPID1 secret key. +# Wrapper: sets ESIGNET_NS=esignet-mosipid, runs base esignet preinstall (copies +# postgres + redis config/secrets), then creates esignet-captcha-mosipid secret +# in the captcha namespace from workflow env vars, copies it to esignet-mosipid, +# and patches the captcha deployment with the MOSIPID secret key. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-mosipid1" +export ESIGNET_NS="esignet-mosipid" CAPTCHA_NS="captcha" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY must be set}" -CAPTCHA_SECRET_KEY="${ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY must be set}" -MOSIPID1_POSTGRES_PASS="${MOSIPID1_POSTGRES_PASSWORD:?ERROR: MOSIPID1_POSTGRES_PASSWORD must be set}" -MOSIPID1_KC_ADMIN_PASS="${MOSIPID1_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID1_KEYCLOAK_ADMIN_PASSWORD must be set}" +CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID_CAPTCHA_SITE_KEY must be set}" +CAPTCHA_SECRET_KEY="${ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY must be set}" +MOSIPID_POSTGRES_PASS="${MOSIPID_POSTGRES_PASSWORD:?ERROR: MOSIPID_POSTGRES_PASSWORD must be set}" +MOSIPID_KC_ADMIN_PASS="${MOSIPID_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID_KEYCLOAK_ADMIN_PASSWORD must be set}" "$WORKDIR/hooks/esignet-standalone/esignet-preinstall.sh" -# Create MOSIPID1-specific esignet-global — same domain_name, but esignet/signup hosts differ +# Create MOSIPID-specific esignet-global — same domain_name, but esignet/signup hosts differ kubectl -n "$ESIGNET_NS" create configmap esignet-global \ --from-literal=installation-domain="${domain_name}" \ --from-literal=mosip-api-host="api.${domain_name}" \ --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet-mosipid1.${domain_name}" \ + --from-literal=mosip-esignet-host="esignet-mosipid.${domain_name}" \ --from-literal=mosip-iam-external-host="iam.${domain_name}" \ --from-literal=mosip-kafka-host="kafka.${domain_name}" \ --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup-mosipid1.${domain_name}" \ + --from-literal=mosip-signup-host="signup-mosipid.${domain_name}" \ --from-literal=mosip-smtp-host="smtp.${domain_name}" \ --from-literal=mosip-version="develop" \ --dry-run=client -o yaml | kubectl apply -f - -# Override postgres-config with MOSIPID1-specific DB values +# Override postgres-config with MOSIPID-specific DB values kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_mosipid1","database-username":"esignetuser_mosipid1"}}' + -p '{"data":{"database-name":"mosip_esignet_mosipid","database-username":"esignetuser_mosipid"}}' # Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then @@ -44,50 +44,66 @@ if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" fi -echo "Creating esignet-captcha-mosipid1 secret in $CAPTCHA_NS namespace" -kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-mosipid1 \ +echo "Creating esignet-captcha-mosipid secret in $CAPTCHA_NS namespace" +kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-mosipid \ --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ --dry-run=client -o yaml | kubectl apply -f - -echo "Copying esignet-captcha-mosipid1 secret from $CAPTCHA_NS to $ESIGNET_NS" -$COPY_UTIL secret esignet-captcha-mosipid1 "$CAPTCHA_NS" "$ESIGNET_NS" +echo "Copying esignet-captcha-mosipid secret from $CAPTCHA_NS to $ESIGNET_NS" +$COPY_UTIL secret esignet-captcha-mosipid "$CAPTCHA_NS" "$ESIGNET_NS" + +echo "Patching captcha deployment with ESIGNETMOSIPID secret key" + +# Remove stale pre-consolidation env var names if still present, so they don't +# linger pointing at secrets that no longer exist (esignet-mosipid1 was renamed +# to esignet-mosipid; esignet-mosipid2 was removed). +for OLD_NAME in MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID1 MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID2; do + OLD_ENV_INDEX=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ + -o jsonpath="{range .spec.template.spec.containers[0].env[*]}{.name}{'\n'}{end}" 2>/dev/null \ + | grep -n -x "$OLD_NAME" | cut -d: -f1 || echo "") + if [[ -n "$OLD_ENV_INDEX" ]]; then + OLD_ENV_ARRAY_INDEX=$((OLD_ENV_INDEX - 1)) + echo "Removing stale $OLD_NAME env var (index $OLD_ENV_ARRAY_INDEX)" + kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ + -p="[{\"op\": \"remove\", \"path\": \"/spec/template/spec/containers/0/env/$OLD_ENV_ARRAY_INDEX\"}]" + fi +done -echo "Patching captcha deployment with ESIGNETMOSIPID1 secret key" ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ - -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID1')].name}" 2>/dev/null || echo "") + -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID')].name}" 2>/dev/null || echo "") if [[ -z "$ENV_VAR_EXISTS" ]]; then kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID1", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-mosipid1", "key": "esignet-captcha-secret-key"}}}}]' + -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-mosipid", "key": "esignet-captcha-secret-key"}}}}]' else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID1 already exists." + echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID already exists." fi -# --- postgres-postgresql-mosipid1 secret (MOSIPID1 remote postgres password) --- -echo "Creating postgres-postgresql-mosipid1 secret in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create secret generic postgres-postgresql-mosipid1 \ - --from-literal=postgres-password="${MOSIPID1_POSTGRES_PASS}" \ +# --- postgres-postgresql-mosipid secret (MOSIPID remote postgres password) --- +echo "Creating postgres-postgresql-mosipid secret in $ESIGNET_NS" +kubectl -n "$ESIGNET_NS" create secret generic postgres-postgresql-mosipid \ + --from-literal=postgres-password="${MOSIPID_POSTGRES_PASS}" \ --dry-run=client -o yaml | kubectl apply -f - -# --- keycloak-host-mosipid1 CM (external URL points to MOSIPID1 Keycloak) --- -echo "Creating keycloak-host-mosipid1 configmap in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create configmap keycloak-host-mosipid1 \ - --from-literal=keycloak-external-host="iam.${mosipid1_domain_name}" \ - --from-literal=keycloak-external-url="https://iam.${mosipid1_domain_name}" \ +# --- keycloak-host-mosipid CM (external URL points to MOSIPID Keycloak) --- +echo "Creating keycloak-host-mosipid configmap in $ESIGNET_NS" +kubectl -n "$ESIGNET_NS" create configmap keycloak-host-mosipid \ + --from-literal=keycloak-external-host="iam.${mosipid_domain_name}" \ + --from-literal=keycloak-external-url="https://iam.${mosipid_domain_name}" \ --from-literal=keycloak-internal-host="keycloak.keycloak" \ --from-literal=keycloak-internal-service-url="http://keycloak.keycloak/auth/" \ --from-literal=keycloak-internal-url="http://keycloak.keycloak" \ --dry-run=client -o yaml | kubectl apply -f - -# --- keycloak-client-secrets-mosipid1: fetch all confidential clients from MOSIPID1 Keycloak --- -KC_HOST="iam.${mosipid1_domain_name}" +# --- keycloak-client-secrets-mosipid: fetch all confidential clients from MOSIPID Keycloak --- +KC_HOST="iam.${mosipid_domain_name}" REALM="mosip" echo "Fetching admin token from $KC_HOST" TOKEN_RESPONSE=$(curl -sf -X POST \ "https://${KC_HOST}/auth/realms/master/protocol/openid-connect/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ - -d "grant_type=password&client_id=admin-cli&username=admin&password=${MOSIPID1_KC_ADMIN_PASS}") + -d "grant_type=password&client_id=admin-cli&username=admin&password=${MOSIPID_KC_ADMIN_PASS}") ADMIN_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.access_token') if [[ -z "$ADMIN_TOKEN" || "$ADMIN_TOKEN" == "null" ]]; then echo "❌ Failed to get admin token from $KC_HOST" >&2; exit 1 @@ -116,12 +132,12 @@ while IFS= read -r client_json; do done < <(echo "$CLIENTS" | jq -c '.[]') if [[ ${#SECRET_ARGS[@]} -eq 0 ]]; then - echo "❌ No client secrets fetched from MOSIPID1 Keycloak" >&2; exit 1 + echo "❌ No client secrets fetched from MOSIPID Keycloak" >&2; exit 1 fi -echo "Creating keycloak-client-secrets-mosipid1 in $ESIGNET_NS (${#SECRET_ARGS[@]} clients)" -kubectl -n "$ESIGNET_NS" create secret generic keycloak-client-secrets-mosipid1 \ +echo "Creating keycloak-client-secrets-mosipid in $ESIGNET_NS (${#SECRET_ARGS[@]} clients)" +kubectl -n "$ESIGNET_NS" create secret generic keycloak-client-secrets-mosipid \ "${SECRET_ARGS[@]}" \ --dry-run=client -o yaml | kubectl apply -f - -echo "✓ keycloak-client-secrets-mosipid1 created" +echo "✓ keycloak-client-secrets-mosipid created" -echo "eSignet MOSIPID1 pre-install completed." +echo "eSignet MOSIPID pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone/esignet-mosipid2-preinstall.sh b/Helmsman/hooks/esignet-standalone/esignet-mosipid2-preinstall.sh deleted file mode 100755 index 4580db97e..000000000 --- a/Helmsman/hooks/esignet-standalone/esignet-mosipid2-preinstall.sh +++ /dev/null @@ -1,127 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - eSignet MOSIPID2 Service Pre-install -# ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid2, runs base esignet preinstall (copies -# postgres + redis config/secrets), then creates esignet-captcha-mosipid2 secret -# in the captcha namespace from workflow env vars, copies it to esignet-mosipid2, -# and patches the captcha deployment with the MOSIPID2 secret key. -# ============================================================================= -set -euo pipefail - -export ESIGNET_NS="esignet-mosipid2" -CAPTCHA_NS="captcha" -COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" -CAPTCHA_SITE_KEY="${ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY:?ERROR: ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY must be set}" -CAPTCHA_SECRET_KEY="${ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY:?ERROR: ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY must be set}" -MOSIPID2_POSTGRES_PASS="${MOSIPID2_POSTGRES_PASSWORD:?ERROR: MOSIPID2_POSTGRES_PASSWORD must be set}" -MOSIPID2_KC_ADMIN_PASS="${MOSIPID2_KEYCLOAK_ADMIN_PASSWORD:?ERROR: MOSIPID2_KEYCLOAK_ADMIN_PASSWORD must be set}" - -"$WORKDIR/hooks/esignet-standalone/esignet-preinstall.sh" - -# Create MOSIPID2-specific esignet-global — same domain_name, but esignet/signup hosts differ -kubectl -n "$ESIGNET_NS" create configmap esignet-global \ - --from-literal=installation-domain="${domain_name}" \ - --from-literal=mosip-api-host="api.${domain_name}" \ - --from-literal=mosip-api-internal-host="api-internal.${domain_name}" \ - --from-literal=mosip-esignet-host="esignet-mosipid2.${domain_name}" \ - --from-literal=mosip-iam-external-host="iam.${domain_name}" \ - --from-literal=mosip-kafka-host="kafka.${domain_name}" \ - --from-literal=mosip-postgres-host="postgres.${domain_name}" \ - --from-literal=mosip-signup-host="signup-mosipid2.${domain_name}" \ - --from-literal=mosip-smtp-host="smtp.${domain_name}" \ - --from-literal=mosip-version="develop" \ - --dry-run=client -o yaml | kubectl apply -f - - -# Override postgres-config with MOSIPID2-specific DB values -kubectl -n "$ESIGNET_NS" patch configmap postgres-config --type merge \ - -p '{"data":{"database-name":"mosip_esignet_mosipid2","database-username":"esignetuser_mosipid2"}}' - -# Create esignet-misp-onboarder-key placeholder — real value written by MISP onboarder. -if ! kubectl -n "$ESIGNET_NS" get secret esignet-misp-onboarder-key &>/dev/null; then - kubectl -n "$ESIGNET_NS" create secret generic esignet-misp-onboarder-key \ - --from-literal=mosip-esignet-misp-key="" - echo "esignet-misp-onboarder-key placeholder created in $ESIGNET_NS" -fi - -echo "Creating esignet-captcha-mosipid2 secret in $CAPTCHA_NS namespace" -kubectl -n "$CAPTCHA_NS" create secret generic esignet-captcha-mosipid2 \ - --from-literal=esignet-captcha-site-key="$CAPTCHA_SITE_KEY" \ - --from-literal=esignet-captcha-secret-key="$CAPTCHA_SECRET_KEY" \ - --dry-run=client -o yaml | kubectl apply -f - - -echo "Copying esignet-captcha-mosipid2 secret from $CAPTCHA_NS to $ESIGNET_NS" -$COPY_UTIL secret esignet-captcha-mosipid2 "$CAPTCHA_NS" "$ESIGNET_NS" - -echo "Patching captcha deployment with ESIGNETMOSIPID2 secret key" -ENV_VAR_EXISTS=$(kubectl -n "$CAPTCHA_NS" get deployment captcha \ - -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID2')].name}" 2>/dev/null || echo "") -if [[ -z "$ENV_VAR_EXISTS" ]]; then - kubectl patch deployment -n "$CAPTCHA_NS" captcha --type='json' \ - -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env/-", "value": {"name": "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID2", "valueFrom": {"secretKeyRef": {"name": "esignet-captcha-mosipid2", "key": "esignet-captcha-secret-key"}}}}]' -else - echo "MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNETMOSIPID2 already exists." -fi - -# --- postgres-postgresql-mosipid2 secret (MOSIPID2 remote postgres password) --- -echo "Creating postgres-postgresql-mosipid2 secret in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create secret generic postgres-postgresql-mosipid2 \ - --from-literal=postgres-password="${MOSIPID2_POSTGRES_PASS}" \ - --dry-run=client -o yaml | kubectl apply -f - - -# --- keycloak-host-mosipid2 CM (external URL points to MOSIPID2 Keycloak) --- -echo "Creating keycloak-host-mosipid2 configmap in $ESIGNET_NS" -kubectl -n "$ESIGNET_NS" create configmap keycloak-host-mosipid2 \ - --from-literal=keycloak-external-host="iam.${mosipid2_domain_name}" \ - --from-literal=keycloak-external-url="https://iam.${mosipid2_domain_name}" \ - --from-literal=keycloak-internal-host="keycloak.keycloak" \ - --from-literal=keycloak-internal-service-url="http://keycloak.keycloak/auth/" \ - --from-literal=keycloak-internal-url="http://keycloak.keycloak" \ - --dry-run=client -o yaml | kubectl apply -f - - -# --- keycloak-client-secrets-mosipid2: fetch all confidential clients from MOSIPID2 Keycloak --- -KC_HOST="iam.${mosipid2_domain_name}" -REALM="mosip" - -echo "Fetching admin token from $KC_HOST" -TOKEN_RESPONSE=$(curl -sf -X POST \ - "https://${KC_HOST}/auth/realms/master/protocol/openid-connect/token" \ - -H "Content-Type: application/x-www-form-urlencoded" \ - -d "grant_type=password&client_id=admin-cli&username=admin&password=${MOSIPID2_KC_ADMIN_PASS}") -ADMIN_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.access_token') -if [[ -z "$ADMIN_TOKEN" || "$ADMIN_TOKEN" == "null" ]]; then - echo "❌ Failed to get admin token from $KC_HOST" >&2; exit 1 -fi -echo "✓ Admin token obtained" - -echo "Fetching all clients from realm $REALM on $KC_HOST" -CLIENTS=$(curl -sf \ - "https://${KC_HOST}/auth/admin/realms/${REALM}/clients?max=500" \ - -H "Authorization: Bearer $ADMIN_TOKEN") - -SECRET_ARGS=() -while IFS= read -r client_json; do - client_id=$(echo "$client_json" | jq -r '.clientId') - uuid=$(echo "$client_json" | jq -r '.id') - auth_type=$(echo "$client_json" | jq -r '.clientAuthenticatorType') - is_public=$(echo "$client_json" | jq -r '.publicClient') - [[ "$auth_type" != "client-secret" || "$is_public" == "true" ]] && continue - secret_val=$(curl -sf \ - "https://${KC_HOST}/auth/admin/realms/${REALM}/clients/${uuid}/client-secret" \ - -H "Authorization: Bearer $ADMIN_TOKEN" | jq -r '.value // empty') - [[ -z "$secret_val" || "$secret_val" == "null" ]] && continue - key=$(echo "$client_id" | tr '-' '_')_secret - SECRET_ARGS+=("--from-literal=${key}=${secret_val}") - echo " ✓ $client_id" -done < <(echo "$CLIENTS" | jq -c '.[]') - -if [[ ${#SECRET_ARGS[@]} -eq 0 ]]; then - echo "❌ No client secrets fetched from MOSIPID2 Keycloak" >&2; exit 1 -fi -echo "Creating keycloak-client-secrets-mosipid2 in $ESIGNET_NS (${#SECRET_ARGS[@]} clients)" -kubectl -n "$ESIGNET_NS" create secret generic keycloak-client-secrets-mosipid2 \ - "${SECRET_ARGS[@]}" \ - --dry-run=client -o yaml | kubectl apply -f - -echo "✓ keycloak-client-secrets-mosipid2 created" - -echo "eSignet MOSIPID2 pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone/esignet-postinstall-keycloak-init.sh b/Helmsman/hooks/esignet-standalone/esignet-postinstall-keycloak-init.sh index 811b19841..42357fd22 100755 --- a/Helmsman/hooks/esignet-standalone/esignet-postinstall-keycloak-init.sh +++ b/Helmsman/hooks/esignet-standalone/esignet-postinstall-keycloak-init.sh @@ -10,7 +10,7 @@ KEYCLOAK_NS="keycloak" COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh" # All esignet-mock namespaces that need keycloak resources -ESIGNET_NAMESPACES=(esignet-mock esignet-mosipid1 esignet-mosipid2 esignet-sunbird) +ESIGNET_NAMESPACES=(esignet-mock esignet-mosipid esignet-sunbird) echo "================================================" echo "eSignet 1.7.1 - Keycloak Init Post-install" diff --git a/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid-preinstall.sh similarity index 69% rename from Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid1-preinstall.sh rename to Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid-preinstall.sh index 001e00f21..86300fb61 100755 --- a/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone/mock-relying-party-service-mosipid-preinstall.sh @@ -1,10 +1,10 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party Service MOSIPID1 Pre-install +# eSignet 1.7.1 - Mock Relying Party Service MOSIPID Pre-install # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base mock-rp-service +# Wrapper: sets ESIGNET_NS=esignet-mosipid and delegates to base mock-rp-service # preinstall (creates private key secrets in the target namespace). # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-mosipid1" +export ESIGNET_NS="esignet-mosipid" exec "$WORKDIR/hooks/esignet-standalone/mock-relying-party-service-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid-preinstall.sh similarity index 66% rename from Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid1-preinstall.sh rename to Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid-preinstall.sh index dd3affbea..c00337b89 100755 --- a/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone/mock-relying-party-ui-mosipid-preinstall.sh @@ -1,16 +1,16 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - Mock Relying Party UI MOSIPID1 Pre-install +# eSignet 1.7.1 - Mock Relying Party UI MOSIPID Pre-install # ============================================================================= -# Ensures esignet-mosipid1 namespace exists and verifies mock-relying-party-service -# is available in the esignet-mosipid1 namespace before UI deployment. +# Ensures esignet-mosipid namespace exists and verifies mock-relying-party-service +# is available in the esignet-mosipid namespace before UI deployment. # ============================================================================= set -euo pipefail -ESIGNET_NS="esignet-mosipid1" +ESIGNET_NS="esignet-mosipid" echo "================================================" -echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID1 Pre-install" +echo "eSignet 1.7.1 - Mock Relying Party UI MOSIPID Pre-install" echo "================================================" kubectl create namespace "$ESIGNET_NS" --dry-run=client -o yaml | kubectl apply -f - @@ -21,4 +21,4 @@ else echo "WARNING: Mock relying party service not found in $ESIGNET_NS. UI depends on the service being deployed." fi -echo "Mock relying party UI MOSIPID1 pre-install completed." +echo "Mock relying party UI MOSIPID pre-install completed." diff --git a/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid-preinstall.sh similarity index 66% rename from Helmsman/hooks/esignet-standalone/oidc-ui-mosipid1-preinstall.sh rename to Helmsman/hooks/esignet-standalone/oidc-ui-mosipid-preinstall.sh index 6a93a51ed..f7e4aac72 100755 --- a/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid1-preinstall.sh +++ b/Helmsman/hooks/esignet-standalone/oidc-ui-mosipid-preinstall.sh @@ -1,9 +1,9 @@ #!/bin/bash # ============================================================================= -# eSignet 1.7.1 - OIDC UI MOSIPID1 Pre-install +# eSignet 1.7.1 - OIDC UI MOSIPID Pre-install # ============================================================================= -# Wrapper: sets ESIGNET_NS=esignet-mosipid1 and delegates to base oidc-ui preinstall. +# Wrapper: sets ESIGNET_NS=esignet-mosipid and delegates to base oidc-ui preinstall. # ============================================================================= set -euo pipefail -export ESIGNET_NS="esignet-mosipid1" +export ESIGNET_NS="esignet-mosipid" exec "$WORKDIR/hooks/esignet-standalone/oidc-ui-preinstall.sh" diff --git a/Helmsman/hooks/esignet-standalone/pms-partner-mosipid1-preinstall.sh b/Helmsman/hooks/esignet-standalone/pms-partner-mosipid1-preinstall.sh deleted file mode 100755 index c5faefc5c..000000000 --- a/Helmsman/hooks/esignet-standalone/pms-partner-mosipid1-preinstall.sh +++ /dev/null @@ -1,45 +0,0 @@ -#!/bin/bash -# ============================================================================= -# eSignet 1.7.1 - PMS Partner MOSIPID1 Pre-install -# ============================================================================= -# Creates the Istio Gateway for pms-partner in esignet-mosipid1 namespace. -# ============================================================================= -set -euo pipefail - -ESIGNET_NS="esignet-mosipid1" - -echo "================================================" -echo "eSignet 1.7.1 - PMS Partner MOSIPID1 Pre-install" -echo "================================================" - -kubectl apply -f - <- - {{ "{{" }} 'id': 'mobile', 'svg': 'mobile_icon', 'prefixes': {{ "{{" }}'label': - 'IND', 'value': '+91', 'maxLength': '', 'regex': ''},{'label': - 'KHM', 'value': '+855', 'regex': ''{{ "}}" }}, 'postfix': '@phone', - 'maxLength': '', 'regex': '' }, { 'id': 'nrc', 'svg': - 'nrc_id_icon', 'prefixes': '', 'postfix': '@nrc', 'maxLength': - '', 'regex': '' }, { 'id': 'vid', 'svg': 'vid_icon', 'prefixes': - '', 'postfix': '', 'maxLength': '', 'regex': '' }, { 'id': - 'email', 'svg': 'email_icon', 'prefixes': '', 'postfix': - '@email', 'maxLength': '', 'regex': '' {{ "}}" }} - - name: LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_WEB_CLIENT - value: DEBUG - - name: MOSIP_ESIGNET_CAPTCHA_REQUIRED - value: "" - - name: MOSIP_ESIGNET_CAPTCHA_URL - value: http://captcha.captcha - - name: "MOSIP_ESIGNET_MISP_KEY" - valueFrom: - secretKeyRef: - name: esignet-misp-onboarder-key - key: mosip-esignet-misp-key - diff --git a/Helmsman/utils/softhsm-esignet-mosipid1-values.yaml b/Helmsman/utils/softhsm-esignet-mosipid-values.yaml similarity index 90% rename from Helmsman/utils/softhsm-esignet-mosipid1-values.yaml rename to Helmsman/utils/softhsm-esignet-mosipid-values.yaml index 526bf77c7..0354bf98d 100644 --- a/Helmsman/utils/softhsm-esignet-mosipid1-values.yaml +++ b/Helmsman/utils/softhsm-esignet-mosipid-values.yaml @@ -1,4 +1,4 @@ -# SoftHSM values for esignet-mosipid1 namespace +# SoftHSM values for esignet-mosipid namespace # Identical to softhsm-esignet-values.yaml — separate file so each namespace # gets an independent SoftHSM PVC and pin secret. diff --git a/Helmsman/utils/softhsm-esignet-mosipid2-values.yaml b/Helmsman/utils/softhsm-esignet-mosipid2-values.yaml deleted file mode 100644 index 7df046d37..000000000 --- a/Helmsman/utils/softhsm-esignet-mosipid2-values.yaml +++ /dev/null @@ -1,28 +0,0 @@ -# SoftHSM values for esignet-mosipid2 namespace -# Identical to softhsm-esignet-values.yaml — separate file so each namespace -# gets an independent SoftHSM PVC and pin secret. - -replicaCount: 1 - -image: - repository: mosipid/softhsm - tag: v2 - pullPolicy: Always - -persistence: - enabled: true - size: 1Gi - storageClass: "" - -resources: - requests: - cpu: 100m - memory: 128Mi - limits: - cpu: 500m - memory: 512Mi - -securityContext: - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 diff --git a/docs/DSF_CONFIGURATION_GUIDE.md b/docs/DSF_CONFIGURATION_GUIDE.md index 5fc532b58..daa5d8ecd 100644 --- a/docs/DSF_CONFIGURATION_GUIDE.md +++ b/docs/DSF_CONFIGURATION_GUIDE.md @@ -539,9 +539,8 @@ apps: #### 1. Test Endpoints -All API endpoints in `testrigs-dsf.yaml` use `${domain_name}` substitution — no manual edits needed. For the eSignet profile, `${mosipid1_domain_name}` and `${mosipid2_domain_name}` are also used for the MOSIP-ID1 and MOSIP-ID2 testrig database hosts. Set these as GitHub Environment Variables: -- `vars.MOSIPID1_DOMAIN_NAME` (e.g. `mosipid1.example.net`) -- `vars.MOSIPID2_DOMAIN_NAME` (e.g. `mosipid2.example.net`) +All API endpoints in `testrigs-dsf.yaml` use `${domain_name}` substitution — no manual edits needed. For the eSignet profile, `${mosipid_domain_name}` is also used for the MOSIP-ID testrig database host. Set this as a GitHub Environment Variable: +- `vars.MOSIPID_DOMAIN_NAME` (e.g. `mosipid.example.net`) #### 2. Test Data Configuration @@ -692,7 +691,7 @@ apps: - [ ] GitHub Environment Variables set for your branch (`vars.DOMAIN_NAME`, `vars.ENV_NAME`, `vars.CLUSTER_ID`, `vars.SLACK_CHANNEL_NAME`) - [ ] Port variables set: `vars.DB_PORT` (MOSIP platform profiles), `vars.ESIGNET_DB_PORT` (eSignet profile) -- [ ] For eSignet profile: `vars.MOSIPID1_DOMAIN_NAME` and `vars.MOSIPID2_DOMAIN_NAME` also set +- [ ] For eSignet profile: `vars.MOSIPID_DOMAIN_NAME` also set - [ ] No manual `` or domain placeholder edits needed in DSF files ### Before Deploying prereq-dsf.yaml @@ -719,7 +718,7 @@ apps: - [ ] All MOSIP/eSignet services running - [ ] Test data branch matches MOSIP version -- [ ] `vars.MOSIPID1_DOMAIN_NAME` and `vars.MOSIPID2_DOMAIN_NAME` set (esignet-standalone profile) +- [ ] `vars.MOSIPID_DOMAIN_NAME` set (esignet-standalone profile) --- @@ -795,8 +794,7 @@ apps: | Slack channel | `vars.SLACK_CHANNEL_NAME` | GitHub Environment Variables | Alerting in prereq-dsf | | MOSIP postgres port | `vars.DB_PORT` | GitHub Environment Variables | MOSIP platform external postgres (5433) | | eSignet postgres port | `vars.ESIGNET_DB_PORT` | GitHub Environment Variables | eSignet container postgres (5432) | -| MOSIP-ID1 domain | `vars.MOSIPID1_DOMAIN_NAME` | GitHub Environment Variables | esignet-standalone profile — MOSIP-ID1 testrig hosts | -| MOSIP-ID2 domain | `vars.MOSIPID2_DOMAIN_NAME` | GitHub Environment Variables | esignet-standalone profile — MOSIP-ID2 testrig hosts | +| MOSIP-ID domain | `vars.MOSIPID_DOMAIN_NAME` | GitHub Environment Variables | esignet-standalone profile — MOSIP-ID testrig hosts | **DSF file manual edits (one-time per environment):** diff --git a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md index 014d94fd3..70afb2730 100644 --- a/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md +++ b/docs/ESIGNET_STANDALONE_DEPLOYMENT_GUIDE.md @@ -4,13 +4,21 @@ This guide walks you through deploying eSignet standalone on your Kubernetes clu You do **not** need to run any commands on your local machine — everything runs in the cloud via GitHub workflows. **What gets deployed:** -- Up to 4 eSignet instances (esignet, esignet-mosipid1, esignet-mosipid2, esignet-sunbird) — **mosipid1 is enabled by default; mosipid2 is optional** -- OIDC UI for each enabled instance +- 3 eSignet instances (esignet, esignet-mosipid, esignet-sunbird) — all enabled by default +- OIDC UI for each instance - Mock Relying Party service and UI - Supporting infrastructure: Postgres, Redis, Kafka, Keycloak, SoftHSM, Captcha, MinIO **Estimated time:** ~90–120 minutes end to end (Terraform ~30 min, external services ~20 min, eSignet ~25 min). +> **A second, isolated profile — `esignet-standalone-2.0.0`** (the Go rewrite of eSignet) — is also available in +> the `profile` dropdown of `helmsman_esignet.yml`, `helmsman_testrigs.yml`, and `helmsman_signup.yml`. It deploys +> its own Helm releases and databases under **the same namespaces and hostnames** as `esignet-standalone` — the +> two profiles are not meant to run side by side on the same cluster/domain, only one at a time. It shares the +> same external infrastructure (Postgres server, Keycloak, Redis, Kafka, Minio, Captcha instances) and Terraform +> profile — deploy/manage those via `helmsman_external.yml` and Terraform using the `esignet-standalone` profile +> as usual; there is no separate `esignet-standalone-2.0.0` entry for either of those. + --- ## Table of Contents @@ -29,42 +37,28 @@ You do **not** need to run any commands on your local machine — everything run - [Step 4 — Deploy Testrigs (optional)](#step-4--deploy-testrigs-optional) 5. [Re-deploying or Re-running](#4-re-deploying-or-re-running) 6. [Verifying Deployment](#5-verifying-deployment) -7. [MOSIP ID Plugin Onboarding (mosipid1 / mosipid2)](#6-mosip-id-plugin-onboarding-mosipid1--mosipid2) +7. [MOSIP ID Plugin Onboarding (mosipid)](#6-mosip-id-plugin-onboarding-mosipid) --- ## 0. Understanding the eSignet Instances -This deployment can run up to **4 separate eSignet instances** on the same cluster, each isolated in its own Kubernetes namespace. Think of each instance as a completely independent eSignet service — it has its own database, its own Keycloak clients, its own domain name, and its own identity plugin. +This deployment runs **3 separate eSignet instances** on the same cluster, each isolated in its own Kubernetes namespace. Think of each instance as a completely independent eSignet service — it has its own database, its own Keycloak clients, its own domain name, and its own identity plugin. | Instance | Namespace | What it connects to | Enabled by default | |---|---|---|---| | **eSignet (main)** | `esignet-mock` | Mock identity — for demos and testing without a live MOSIP system | Yes | -| **eSignet MOSIP-ID1** | `esignet-mosipid1` | A real MOSIP identity system at `MOSIPID1_DOMAIN_NAME` | **Yes** | -| **eSignet MOSIP-ID2** | `esignet-mosipid2` | A second real MOSIP identity system at `MOSIPID2_DOMAIN_NAME` | No | +| **eSignet MOSIP-ID** | `esignet-mosipid` | A real MOSIP identity system at `MOSIPID_DOMAIN_NAME` | Yes | | **eSignet Sunbird** | `esignet-sunbird` | A Sunbird RC credential registry | Yes | -### When do you need mosipid1? - -Use `esignet-mosipid1` when you want eSignet to authenticate citizens against a **real MOSIP identity system**. You give it the domain of your MOSIP environment (e.g. `mosipenv.your-org.net`) via the `MOSIPID1_DOMAIN_NAME` variable, and the deployment automatically connects eSignet to that system's identity APIs, database, and Keycloak. - -**This is enabled by default** — if you have a MOSIP system to connect to, fill in the `MOSIPID1_DOMAIN_NAME` variable and the related secrets and it will be deployed as part of the normal workflow run. - -### When do you need mosipid2? - -`esignet-mosipid2` is **disabled by default**. Enable it only if you need to run **two eSignet instances that each connect to a different MOSIP environment** on the same cluster — for example, one pointing at a production MOSIP environment and another at a staging one. - -If you only have one MOSIP system to connect to, leave mosipid2 disabled. You do not need to configure any mosipid2 secrets or variables. +> **Deploying `esignet-standalone-2.0.0` instead?** Identical 3 instances, same namespaces and hostnames — the +> two profiles are interchangeable, not additive; deploy one or the other, not both, on a given cluster/domain. -**To enable mosipid2:** +### When do you need mosipid? -1. Add the `MOSIPID2_DOMAIN_NAME` environment variable in your GitHub Environment (Section 2B) -2. Add these secrets in your GitHub Environment (Section 2A): - - `ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY` and `ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY` - - `MOSIPID2_POSTGRES_PASSWORD` and `MOSIPID2_KEYCLOAK_ADMIN_PASSWORD` -3. When running the eSignet workflow (Step 2), toggle **`enable_mosipid2`** to `true` and fill in the `mosipid2_domain_name` field +Use `esignet-mosipid` when you want eSignet to authenticate citizens against a **real MOSIP identity system**. You give it the domain of your MOSIP environment (e.g. `mosipenv.your-org.net`) via the `MOSIPID_DOMAIN_NAME` variable, and the deployment automatically connects eSignet to that system's identity APIs, database, and Keycloak. -> No DSF file edits needed — `enable_mosipid2` is a workflow input toggle that controls deployment at runtime. +**This is enabled by default** — if you have a MOSIP system to connect to, fill in the `MOSIPID_DOMAIN_NAME` variable and the related secrets and it will be deployed as part of the normal workflow run. --- @@ -75,12 +69,11 @@ Complete this checklist before triggering any workflow: - [ ] Kubernetes cluster is up and running - [ ] `KUBECONFIG` file is available for your cluster - [ ] DNS records for all domain names are pointed to your cluster's load balancer -- [ ] Google reCAPTCHA v2 keys are generated — you need **at minimum 4 site/secret key pairs** (one per enabled instance): +- [ ] Google reCAPTCHA v2 keys are generated — you need **4 site/secret key pairs** (one per instance): - one for `esignet-mock` namespace - - one for `esignet-mosipid1` namespace + - one for `esignet-mosipid` namespace - one for `esignet-sunbird` namespace - one for `signup` namespace - - one for `esignet-mosipid2` namespace *(only if you are enabling mosipid2 — see [Section 0](#0-understanding-the-esignet-instances))* - See [reCAPTCHA Setup Guide](RECAPTCHA_SETUP_GUIDE.md) - [ ] Mock Relying Party PEM key pair is generated (client private key + JWE private key) - [ ] GitHub Environment named after your branch (e.g. `MOSIP-44613`) exists under: @@ -140,24 +133,31 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings | `ESIGNET_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for the main `esignet-mock` namespace | | `ESIGNET_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for the main `esignet-mock` namespace | +> **`esignet-standalone-2.0.0` note:** `helmsman_external.yml` has no `esignet-standalone-2.0.0` option in its +> `profile` dropdown — it only ever deploys as `esignet-standalone`. The 2.0.0 profile has no `external-dsf.yaml` +> of its own; it reuses this same shared captcha/Postgres/Keycloak/Redis/Kafka/MinIO deployment (see the callout +> at the top of this guide). Always run Step 1 with `profile: esignet-standalone`, even if you only plan to +> deploy `esignet-standalone-2.0.0` in Step 2. + **For `helmsman_esignet.yml`:** | Secret Name | What it is | |---|---| | `MOCK_RELYING_PARTY_CLIENT_PRIVATE_KEY` | Base64-encoded PEM — mock relying party client private key | | `MOCK_RELYING_PARTY_JWE_PRIVATE_KEY` | Base64-encoded PEM — JWE userinfo private key | -| `ESIGNET_MOSIPID1_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for `esignet-mosipid1` namespace | -| `ESIGNET_MOSIPID1_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-mosipid1` namespace | -| `ESIGNET_MOSIPID2_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for `esignet-mosipid2` namespace *(only needed if mosipid2 is enabled)* | -| `ESIGNET_MOSIPID2_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-mosipid2` namespace *(only needed if mosipid2 is enabled)* | +| `ESIGNET_MOSIPID_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for `esignet-mosipid` namespace | +| `ESIGNET_MOSIPID_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-mosipid` namespace | | `ESIGNET_SUNBIRD_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for `esignet-sunbird` namespace | | `ESIGNET_SUNBIRD_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for `esignet-sunbird` namespace | -| `MOSIPID1_POSTGRES_PASSWORD` | Postgres superuser password for the MOSIP-ID1 remote MOSIP environment | -| `MOSIPID2_POSTGRES_PASSWORD` | Postgres superuser password for the MOSIP-ID2 remote MOSIP environment *(only needed if mosipid2 is enabled)* | -| `MOSIPID1_KEYCLOAK_ADMIN_PASSWORD` | Keycloak admin password for the MOSIP-ID1 remote MOSIP environment | -| `MOSIPID2_KEYCLOAK_ADMIN_PASSWORD` | Keycloak admin password for the MOSIP-ID2 remote MOSIP environment *(only needed if mosipid2 is enabled)* | +| `MOSIPID_POSTGRES_PASSWORD` | Postgres superuser password for the remote MOSIP environment | +| `MOSIPID_KEYCLOAK_ADMIN_PASSWORD` | Keycloak admin password for the remote MOSIP environment | -> ⚠️ `MOSIPID1_KEYCLOAK_ADMIN_PASSWORD` and `MOSIPID2_KEYCLOAK_ADMIN_PASSWORD` are the admin passwords of the **remote** MOSIP-ID1 and MOSIP-ID2 Keycloak instances (not the local one deployed by this stack). The preinstall hook calls those Keycloak REST APIs to fetch client secrets. A wrong domain or wrong password here will cause the preinstall to fail with a curl error. +> ⚠️ `MOSIPID_KEYCLOAK_ADMIN_PASSWORD` is the admin password of the **remote** MOSIP-ID Keycloak instance (not the local one deployed by this stack). The preinstall hook calls that Keycloak's REST API to fetch client secrets. A wrong domain or wrong password here will cause the preinstall to fail with a curl error. +> +> **`esignet-standalone-2.0.0` note:** All of the secrets above are **reused as-is** by `esignet-standalone-2.0.0` +> — both profiles create identically-named Kubernetes secrets (e.g. `esignet-captcha`, `esignet-captcha-mosipid`) +> and patch the same env var names onto the shared `captcha` deployment +> (e.g. `MOSIP_CAPTCHA_GOOGLERECAPTCHAV2_SECRET_ESIGNET`), since only one profile is ever deployed at a time. **For `helmsman_signup.yml` (set now even though signup is not yet active):** @@ -166,6 +166,9 @@ Path to create `GH_INFRA_PAT`: `Your profile → Settings → Developer settings | `MOSIP_SIGNUP_CAPTCHA_SITE_KEY` | reCAPTCHA **site** key for the `signup` namespace | | `MOSIP_SIGNUP_CAPTCHA_SECRET_KEY` | reCAPTCHA **secret** key for the `signup` namespace | +> **`esignet-standalone-2.0.0` note:** Same secrets reused here too — signup for the 2.0.0 profile deploys into +> the same `signup` namespace as `esignet-standalone` and shares these same GitHub secret values. + --- ### C. Environment Variables @@ -181,10 +184,8 @@ Navigate to: `Repository → Settings → Environments → | `ENV_NAME` | `sandbox` | **Yes** | Short environment label shown on the landing page | | `CLUSTER_ID` | `c-xxxxx` | **Yes** | Rancher cluster ID used by monitoring setup — see [Finding your clusterid](../README.md#step-4a-configure-github-environment-variables) in the root README | | `SLACK_CHANNEL_NAME` | `#mosip-alerts` | **Yes** | Slack channel name for alert notifications | -| `MOSIPID1_DOMAIN_NAME` | `mosipid1.xyz.net` | Optional | Base domain of the MOSIP environment that `esignet-mosipid1` connects to (required if mosipid1 is enabled) | -| `MOSIPID2_DOMAIN_NAME` | `mosipid2.xyz.net` | Optional | Base domain of the second MOSIP environment — only set this if you have enabled mosipid2 (see [Section 0](#0-understanding-the-esignet-instances)) | -| `ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL` | `develop` | Optional | Git branch/tag for MOSIP-ID1 config-server (defaults to `develop`) | -| `ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL` | `develop` | Optional | Git branch/tag for MOSIP-ID2 config-server — only relevant if mosipid2 is enabled (defaults to `develop`) | +| `MOSIPID_DOMAIN_NAME` | `mosipid.xyz.net` | **Yes** | Base domain of the MOSIP environment that `esignet-mosipid` connects to | +| `ESIGNET_MOSIPID_SPRING_CONFIG_LABEL` | `develop` | Optional | Git branch/tag for MOSIP-ID config-server (defaults to `develop`) | | `ESIGNET_STANDALONE_MODE` | `true` | Optional | Set to `true` to skip the MOSIP DSF completion check | --- @@ -198,12 +199,17 @@ Step 0 → Provision Infrastructure (terraform plan / apply) ├── 0b base-infra ~10 min ← once per AWS account; skip if already done ├── 0c observ-infra ~15 min ← optional monitoring cluster └── 0d infra ~20 min profile: esignet-standalone ← the main cluster -Step 1 → Deploy External Services (helmsman_external.yml) ~20 min -Step 2 → Deploy eSignet (helmsman_esignet.yml) ~25 min +Step 1 → Deploy External Services (helmsman_external.yml) ~20 min profile: esignet-standalone (always) +Step 2 → Deploy eSignet (helmsman_esignet.yml) ~25 min profile: esignet-standalone or esignet-standalone-2.0.0 Step 3 → Deploy Signup (helmsman_signup.yml) ⚠️ IN PROGRESS — not ready yet -Step 4 → Deploy Testrigs (optional) (helmsman_testrigs.yml) ~10 min +Step 4 → Deploy Testrigs (optional) (helmsman_testrigs.yml) ~10 min profile: esignet-standalone or esignet-standalone-2.0.0 ``` +> Steps 2 and 4 accept either profile in their `profile` dropdown — pick `esignet-standalone-2.0.0` to deploy +> the Go-based instances instead of (or alongside) the v1.7.1 ones. Step 1 has no 2.0.0 option since both +> profiles share the same external infrastructure. Step 3's dropdown also lists `esignet-standalone-2.0.0`, +> but the step itself isn't usable yet for either profile — see the note below. + --- ### Step 0 — Provision Infrastructure (Terraform) @@ -320,16 +326,18 @@ Follow the full instructions in the root README: [Step 3ca: Observation Infrastr ![Deploy External Services - Helmsman](_images/helmsman-external-services.png) **How to know it succeeded:** Click into the running workflow. Wait for all jobs to show a green tick. Then run: + ```bash kubectl get pods -n postgres && kubectl get pods -n keycloak && kubectl get pods -n kafka ``` + All pods should show `Running` or `Completed`. --- ### Step 2 — Deploy eSignet -> **What this does:** Deploys the eSignet application itself — 4 separate instances (main, MOSIP-ID1, MOSIP-ID2, Sunbird), the OIDC login UI for each, and the Mock Relying Party service for testing. +> **What this does:** Deploys the eSignet application itself — 3 separate instances (main, MOSIP-ID, Sunbird), the OIDC login UI for each, and the Mock Relying Party service for testing. > Only run this after Step 1 is fully complete. **GitHub Actions workflow name:** `Deploy eSignet using Helmsman` @@ -341,15 +349,13 @@ All pods should show `Running` or `Completed`. | Field | Value to enter | |---|---| -| `profile` | `esignet-standalone` | +| `profile` | `esignet-standalone` **or** `esignet-standalone-2.0.0` — see note below | | `mode` | `apply` | | `skip_mosip_dsf_check` | **tick this** — standalone has no MOSIP deployment to wait for | | `delete_existing_jobs` | tick only if re-running after a failure; leave unticked on first deploy | | `domain_name` | your base domain — e.g. `sandbox.xyz.net` | | `esignet_db_port` | `5432` | -| `mosipid1_domain_name` | MOSIP-ID1 base domain — e.g. `mosipid1.xyz.net` *(leave blank if not using MOSIP-ID1)* | -| `enable_mosipid2` | toggle `true` to deploy the MOSIP-ID2 eSignet instance; leave `false` to skip it | -| `mosipid2_domain_name` | MOSIP-ID2 base domain — e.g. `mosipid2.xyz.net` *(only required if `enable_mosipid2` is true)* | +| `mosipid_domain_name` | MOSIP-ID base domain — e.g. `mosipid.xyz.net` | | `env_name` | your environment name — e.g. `sandbox` | > **Important:** Always tick `skip_mosip_dsf_check` for standalone eSignet — without it, the workflow waits for a `mosip-dsf=completed` namespace label that will never appear (there is no full MOSIP deployment in this mode), and the workflow will fail. @@ -358,12 +364,19 @@ All pods should show `Running` or `Completed`. ![Deploy eSignet - Helmsman](_images/esignet.png) +> **`esignet-standalone-2.0.0` note:** Selecting `esignet-standalone-2.0.0` runs `Helmsman/dsf/esignet-standalone-2.0.0/esignet-dsf.yaml` +> instead — it deploys the same 3 instances (main/mock, mosipid, sunbird) plus their OIDC UIs and mock relying +> party service, into the **same namespaces and hostnames** as `esignet-standalone`. All other fields +> (`domain_name`, `mosipid_domain_name`, etc.) work the same way as for `esignet-standalone`. Deploy one profile +> or the other on a given cluster/domain, not both — Step 1 only needs to be run once either way, with +> `profile: esignet-standalone`. + **How to know it succeeded:** + ```bash -kubectl get pods -n esignet-mock && kubectl get pods -n esignet-mosipid1 && kubectl get pods -n esignet-sunbird -# If enable_mosipid2 was set to true: -kubectl get pods -n esignet-mosipid2 +kubectl get pods -n esignet-mock && kubectl get pods -n esignet-mosipid && kubectl get pods -n esignet-sunbird ``` + All pods should show `Running`. --- @@ -377,6 +390,10 @@ All pods should show `Running`. > **What you need to do right now:** Nothing — skip this step for now. However, make sure the signup secrets (`MOSIP_SIGNUP_CAPTCHA_SITE_KEY` and `MOSIP_SIGNUP_CAPTCHA_SECRET_KEY`) are already added to the GitHub Environment (see Section 2) so you are ready when signup is enabled. > > This section will be updated with full instructions once signup deployment is ready. +> +> **`esignet-standalone-2.0.0` note:** `helmsman_signup.yml` already lists `esignet-standalone-2.0.0` in its +> `profile` dropdown (deploys into the same `signup` namespace as `esignet-standalone`), but it's equally +> not-yet-ready for either profile. --- @@ -394,11 +411,10 @@ All pods should show `Running`. | Field | Value to enter | |---|---| -| `profile` | `esignet-standalone` | +| `profile` | `esignet-standalone` **or** `esignet-standalone-2.0.0` — matches whichever profile you deployed in Step 2 | | `mode` | `apply` | | `domain_name` | your base domain — e.g. `sandbox.xyz.net` | -| `mosipid1_domain_name` | MOSIP-ID1 base domain *(if MOSIP-ID1 was deployed in Step 2)* | -| `mosipid2_domain_name` | MOSIP-ID2 base domain *(if `enable_mosipid2` was `true` in Step 2)* | +| `mosipid_domain_name` | MOSIP-ID base domain — same value used in Step 2 | | `db_port` *(MOSIP platform external postgres)* | leave blank — not used by the `esignet-standalone` profile | | `esignet_db_port` *(esignet container postgres)* | `5432` | | `env_name` | your environment name | @@ -409,10 +425,10 @@ All pods should show `Running`. ![Deploy Test Rigs - Helmsman](_images/helmsman-testrigs.png) **How to know it succeeded:** The workflow log should show all Helmsman releases applied without errors. Verify that test cronjobs were created: + ```bash kubectl get cronjobs -n esignet-mock -kubectl get cronjobs -n esignet-mosipid1 -kubectl get cronjobs -n esignet-mosipid2 +kubectl get cronjobs -n esignet-mosipid kubectl get cronjobs -n esignet-sunbird ``` @@ -435,8 +451,7 @@ Run these commands against your cluster to confirm everything is healthy: ```bash # Check all pods across eSignet namespaces kubectl get pods -n esignet-mock -kubectl get pods -n esignet-mosipid1 -kubectl get pods -n esignet-mosipid2 +kubectl get pods -n esignet-mosipid kubectl get pods -n esignet-sunbird # Check Istio virtual services (confirms domain routing) @@ -450,22 +465,24 @@ helm list -n keycloak kubectl get pods --all-namespaces | grep -v Running | grep -v Completed | grep -v Terminating ``` -**Expected URLs after deployment** (replace `sandbox.xyz.net` with your domain): +> **Deployed `esignet-standalone-2.0.0`?** Same namespaces and commands as above — the two profiles share +> identical naming, so there's nothing to swap. + +**Expected URLs after deployment** (replace `sandbox.xyz.net` with your domain; identical for both profiles): | Service | URL | |---|---| | eSignet OIDC UI | `https://esignet.sandbox.xyz.net` | | Mock Relying Party UI | `https://healthservices.sandbox.xyz.net` | | Keycloak | `https://iam.sandbox.xyz.net` | -| MOSIP-ID1 eSignet | `https://esignet-mosipid1.sandbox.xyz.net` | -| MOSIP-ID2 eSignet | `https://esignet-mosipid2.sandbox.xyz.net` | +| MOSIP-ID eSignet | `https://esignet-mosipid.sandbox.xyz.net` | | Sunbird eSignet | `https://esignet-sunbird.sandbox.xyz.net` | --- -## 6. MOSIP ID Plugin Onboarding (mosipid1 / mosipid2) +## 6. MOSIP ID Plugin Onboarding (mosipid) -> **This section applies only if you are deploying `esignet-mosipid1` or `esignet-mosipid2`** — instances that authenticate citizens against a real MOSIP platform. If you are using only the mock identity system (`esignet-mock`) or Sunbird, skip this section. +> **This section applies only if you are deploying `esignet-mosipid`** — the instance that authenticates citizens against a real MOSIP platform. If you are using only the mock identity system (`esignet-mock`) or Sunbird, skip this section. Onboarding eSignet to a MOSIP identity system involves two phases: **prerequisites** (config changes on the MOSIP platform side) and **manual onboarding** (Postman collection run against the deployed eSignet instance). @@ -473,7 +490,7 @@ Onboarding eSignet to a MOSIP identity system involves two phases: **prerequisit ### Prerequisites — Changes on the MOSIP platform's mosip-config branch -The following changes must be made on **each MOSIP platform's `mosip-config` repository branch** that the esignet-mosipid instance points to (the branch set via `ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL` / `ESIGNET_MOSIPID2_SPRING_CONFIG_LABEL`). +The following changes must be made on the **MOSIP platform's `mosip-config` repository branch** that the esignet-mosipid instance points to (the branch set via `ESIGNET_MOSIPID_SPRING_CONFIG_LABEL`). #### 1. Add eSignet property files @@ -490,18 +507,17 @@ Reference commit: [mosip/mosip-config@e8961a2](https://github.com/mosip/mosip-co The MOSIP Identity Authentication service restricts which domains can call its APIs. Edit `id-authentication-default.properties` in the MOSIP platform's `mosip-config` branch and add your eSignet standalone hostnames to `mosip.ida.allowed.domain.uris`: -**For mosipid1 only:** -```properties -mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1. -``` - -**For both mosipid1 and mosipid2:** ```properties -mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid1.,https://esignet-mosipid2. +mosip.ida.allowed.domain.uris=${mosip.api.internal.url},https://${mosip.esignet.host},https://esignet-mosipid. ``` Replace `` with your eSignet standalone base domain (e.g. `sandbox.xyz.net`). +> **`esignet-standalone-2.0.0` note:** `MOSIPID_DOMAIN_NAME` is shared between both profiles (see +> [Section 0](#0-understanding-the-esignet-instances)), and both profiles use the identical +> `esignet-mosipid.` hostname — since only one profile is ever deployed at a time, no extra +> hostname needs to be added here regardless of which profile you're running. + Reference commit: [mosip/mosip-config@27276cb](https://github.com/mosip/mosip-config/commit/27276cbb7fa01015492855baa3e00fe0a4db421c) After committing these changes, restart the `id-authentication` pods on the MOSIP platform so the config server picks up the new values: @@ -518,4 +534,4 @@ Once the prerequisites above are complete, follow the manual onboarding steps us **[eSignet Postman Collection — MOSIP ID Plugin Onboarding](https://github.com/mosip/esignet/tree/master/postman-collection#esignet-collection)** -This collection covers partner onboarding, OIDC client registration, and end-to-end flow verification for the MOSIP ID plugin against your deployed `esignet-mosipid1` or `esignet-mosipid2` instance. +This collection covers partner onboarding, OIDC client registration, and end-to-end flow verification for the MOSIP ID plugin against your deployed `esignet-mosipid` instance. diff --git a/docs/HELMSMAN_DESTROY_GUIDE.md b/docs/HELMSMAN_DESTROY_GUIDE.md index 7360848d5..2cd0924cf 100644 --- a/docs/HELMSMAN_DESTROY_GUIDE.md +++ b/docs/HELMSMAN_DESTROY_GUIDE.md @@ -51,9 +51,9 @@ The destroy workflows follow a **reusable workflow pattern**: | Workflow | File | Purpose | Namespaces Affected | | ----------------------------------- | ------------------------------------------ | ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| **Destroy Testrigs** | `helmsman_testrigs_destroy.yml` | Removes test rig services | `apitestrig`, `dslrig`, `uitestrig` (MOSIP platform); `esignet`, `esignet-mosipid1`, `esignet-mosipid2`, `esignet-sunbird`, `signup` (esignet profile apitestrigs) | +| **Destroy Testrigs** | `helmsman_testrigs_destroy.yml` | Removes test rig services | `apitestrig`, `dslrig`, `uitestrig` (MOSIP platform); `esignet`, `esignet-mosipid`, `esignet-sunbird`, `signup` (esignet profile apitestrigs) | | **Destroy MOSIP Services** | `helmsman_mosip_destroy.yml` | Removes core MOSIP services | `admin`, `apitestrig`, `artifactory`, `config-server`, `dslrig`, `esignet`, `idrepo`, `kernel`, `masterdata`, `packet-manager`, `pmp`, `postgresdb`, `print`, `regproc`, `resident`, `uitestrig` | -| **Destroy eSignet Services** | (use `helmsman_esignet.yml` with `--destroy`) | Removes eSignet stack (esignet profile) | `esignet`, `esignet-mosipid1`, `esignet-mosipid2`, `esignet-sunbird`, `signup`, `kernel` | +| **Destroy eSignet Services** | (use `helmsman_esignet.yml` with `--destroy`) | Removes eSignet stack (esignet profile) | `esignet`, `esignet-mosipid`, `esignet-sunbird`, `signup`, `kernel` | | **Destroy External Services** | `helmsman_external_destroy_external.yml` | Removes external dependencies | `keycloak`, `kafka`, `minio`, `softhsm`, `clamav`, `activemq`, `captcha`, `redis`, `postgres`, `landing-page` | | **Destroy Prerequisites** | `helmsman_external_destroy_prereq.yml` | Removes monitoring and Istio | `cattle-logging-system`, `istio-system`, `monitoring` | diff --git a/docs/HELMSMAN_EXTERNAL_GUIDE.md b/docs/HELMSMAN_EXTERNAL_GUIDE.md index 0cd292106..5c90eef3b 100644 --- a/docs/HELMSMAN_EXTERNAL_GUIDE.md +++ b/docs/HELMSMAN_EXTERNAL_GUIDE.md @@ -23,7 +23,7 @@ Choose the profile that matches your deployment target: | Profile | Use when | |---------|----------| -| `esignet-standalone` | eSignet standalone — up to 4 parallel instances (esignet-mock, esignet-mosipid1, esignet-mosipid2, esignet-sunbird). mosipid2 is optional via `enable_mosipid2` toggle. No full MOSIP stack. | +| `esignet-standalone` | eSignet standalone — 3 parallel instances (esignet-mock, esignet-mosipid, esignet-sunbird). No full MOSIP stack. | | `mosip-platform-1.2.0.x` | Full MOSIP platform with Java 11 | | `mosip-platform-1.2.1.x` | Full MOSIP platform with Java 21 | diff --git a/docs/HELMSMAN_TESTRIGS_GUIDE.md b/docs/HELMSMAN_TESTRIGS_GUIDE.md index 1401d56ef..fe14cbaf5 100644 --- a/docs/HELMSMAN_TESTRIGS_GUIDE.md +++ b/docs/HELMSMAN_TESTRIGS_GUIDE.md @@ -6,7 +6,7 @@ Deploy API, UI, and DSL test rigs after all services are running and partner onb **Workflow:** `helmsman_testrigs.yml` **DSF:** `Helmsman/dsf//testrigs-dsf.yaml` -**Time required:** 10–20 minutes +**Time required:** 10–20 minutes (`esignet-standalone-2.0.0`: up to ~45 minutes — its 3 UI testrigs each run headless Chrome + a JVM, which is slower than the API-only rigs) --- @@ -14,11 +14,16 @@ Deploy API, UI, and DSL test rigs after all services are running and partner onb | Profile | What deploys | Namespaces | |---------|-------------|------------| -| `esignet-standalone` | `esignet-apitestrig` into up to 4 namespaces; optional signup apitestrig + uitestrig | `esignet-mock`, `esignet-mosipid1`, `esignet-mosipid2` *(if enabled)*, `esignet-sunbird`, `signup` | +| `esignet-standalone` | Generic `mosip/apitestrig`/`mosip/uitestrig` charts: `esignet-apitestrig` into 3 namespaces; optional signup apitestrig + uitestrig | `esignet-mock`, `esignet-mosipid`, `esignet-sunbird`, `signup` | +| `esignet-standalone-2.0.0` | eSignet's own dedicated `mosip/esignet-apitestrig` (Go harness) + `mosip/esignet-uitestrig` (Java harness) charts — see note below; plus the same optional signup apitestrig/uitestrig as `esignet-standalone` | `esignet-mock`, `esignet-mosipid`, `esignet-sunbird`, `esignet-uitestrig`, `esignet-mosipid-uitestrig`, `esignet-sunbird-uitestrig`, `signup` | | `mosip-platform-1.2.0.x` | API testrig, UI testrig, DSL testrig | MOSIP testrig namespaces | | `mosip-platform-1.2.1.x` | Same as above | MOSIP testrig namespaces | -> **eSignet standalone (`esignet-standalone` profile):** Requires `mosipid1_domain_name` for the MOSIP-ID1 apitestrig endpoint. `mosipid2_domain_name` is only required if mosipid2 was enabled during eSignet deployment (`enable_mosipid2: true`). +> **eSignet standalone (`esignet-standalone` / `esignet-standalone-2.0.0` profiles):** Requires `mosipid_domain_name` for the MOSIP-ID apitestrig endpoint. +> +> **`esignet-standalone-2.0.0` note:** Unlike the profile-differences doc gap this used to have, `testrigs-dsf.yaml` here does **not** deploy the same apps as `esignet-standalone` — it deploys eSignet's own reference testrig charts instead, modeled directly on +> [`esignet-apitestrig/install.sh`](https://github.com/mosip/esignet/blob/v2.0.0/deploy/esignet-apitestrig/install.sh) and +> [`esignet-uitestrig/install.sh`](https://github.com/mosip/esignet/blob/v2.0.0/deploy/esignet-uitestrig/install.sh). Each eSignet instance's apitestrig lives in that instance's own namespace (matching install.sh's `NS=esignet` pattern); each uitestrig gets its **own** namespace, separate from the eSignet instance it tests (matching install.sh's `NS=esignet-uitestrig` / `SOURCE_NS=esignet` split) — see [Required Secrets](#required-secrets) below for the extra values this needs. Only `esignet-mosipid` (the only instance backed by a real IDA identity) needs real test-identity values; `esignet-mock` and `esignet-sunbird` don't. --- @@ -46,10 +51,49 @@ All secrets are **Environment Secrets** — configure at **Repository → Settin | `CLUSTER_WIREGUARD_WG0` | WireGuard VPN config for cluster access | | `SLACK_WEBHOOK_URL` | Slack incoming webhook URL (optional — for test result notifications) | -### eSignet standalone profile only +### `esignet-standalone` profile only No additional secrets required for testrigs — captcha and keycloak secrets were already created during eSignet deployment and are available in each namespace. +### `esignet-standalone-2.0.0` profile only + +`esignet-apitestrig`/`esignet-uitestrig` (eSignet's own reference charts) need a few values the generic testrig charts didn't. Some are read live from the cluster (no setup needed); the rest must be configured as **Environment Secrets/Variables**: + +**Read automatically from the cluster** (already provisioned by eSignet's own deployment — nothing to add): + +| Value | Source | +|-------|--------| +| `KEYCLOAK_CLIENT_SECRET` (apitestrig, all 3 instances) | `keycloak-client-secrets` secret in the `keycloak` namespace — the same `mosip_pms_client_secret` key `esignet-preinstall-keycloak-init.sh` already uses | +| `esignetDbPassword` (uitestrig, all 3 instances) | `db-common-secrets` secret in the `postgres` namespace | + +**Optional Environment Secrets/Variables** (Settings → Environments → ``): + +Except `MOSIPID_KEYCLOAK_ADMIN_PASSWORD` (already required by the eSignet deployment), each of these defaults to the placeholder `UPDATE_BEFORE_RUN` when unset, so Helmsman can deploy the testrigs without them. Update the real values in the testrig configmaps/secrets before triggering the test cronjobs. + +Only actual credentials (passwords, client secrets) are **Secrets** below — everything else (IDs, test identities) is a plain **Variable**, even where it's technically PII, to keep the GitHub Environment setup simple. + +| Secret/Variable | Type | Used by | Description | +|---|---|---|---| +| `MOSIPID_KEYCLOAK_ADMIN_PASSWORD` | Secret | uitestrig, all 3 instances | Reuses the same Keycloak admin password `esignet-misp-onboarder-mosipid-preinstall.sh` already needs — one shared `mosip/keycloak` release for the whole profile | +| `ESIGNET_UITESTRIG_OIDC_CLIENT_ID` | Variable | uitestrig, all 3 instances | Pre-provisioned OIDC client ID for browser login testing (reused across instances, same pattern as `mock-relying-party-service`'s shared `CLIENT_ID` in `esignet-dsf.yaml`) | +| `ESIGNET_UITESTRIG_CLIENT_SECRET` | Secret | uitestrig, all 3 instances | Secret for the client above | +| `MOSIPID_TESTRIG_INDIVIDUAL_ID` | Variable | apitestrig, `esignet-mosipid` only | Real IDA test identity (UIN) | +| `MOSIPID_TESTRIG_OTP_RECIPIENT` | Variable | apitestrig, `esignet-mosipid` only | Phone/email that receives the test OTP | +| `MOSIPID_TESTRIG_AUTH_PARTNER_ID` | Variable | apitestrig, `esignet-mosipid` only | Auth partner ID used to build the test client ID | +| `MOSIPID_TESTRIG_AUTH_POLICY_ID` | Variable | apitestrig, `esignet-mosipid` only | Policy ID used to build the test client ID | +| `MOSIPID_TESTRIG_UIN` | Variable | uitestrig, `esignet-mosipid` only | Test UIN | +| `MOSIPID_TESTRIG_VID` | Variable | uitestrig, `esignet-mosipid` only | Test VID | +| `MOSIPID_TESTRIG_PHONE_NUMBER` | Variable | uitestrig, `esignet-mosipid` only | Test UIN's phone number | +| `MOSIPID_TESTRIG_EMAIL_LOGIN_ID` | Variable | uitestrig, `esignet-mosipid` only | Test identity for email-OTP login scenarios | +| `MOSIPID_TESTRIG_PASSWORD_LOGIN_UIN` | Variable | uitestrig, `esignet-mosipid` only | Test identity for password-login scenarios | +| `MOSIPID_TESTRIG_PASSWORD_LOGIN_PASSWORD` | Secret | uitestrig, `esignet-mosipid` only | Password for the identity above | + +Only `esignet-mosipid` needs real test-identity/onboarding values — it's the only instance backed by a real IDA identity (`config.mosip.json`/the `mosip` plugin). `esignet-mock` (`config.mock.json`/`mock` plugin) and `esignet-sunbird` (`config.sunbird.json`/`sunbird` plugin) need none of the `MOSIPID_TESTRIG_*` values above. + +There is no validation step for these values; the placeholder defaults let the deployment succeed. + +Report storage uses a PVC (`reports.persistence.enabled: true`), not S3 — there's no established MinIO bucket convention for these charts yet in this repo. Switch to `reports.s3.*` once one exists. + ### MOSIP platform profiles only No additional secrets required — MinIO root password is read automatically from the `minio` secret in the `minio` namespace (`kubectl -n minio get secret minio`). @@ -62,7 +106,7 @@ No additional secrets required — MinIO root password is read automatically fro | Input | Description | Example | |-------|-------------|---------| -| `profile` | Deployment profile | `esignet-standalone` / `mosip-platform-1.2.0.x` / `mosip-platform-1.2.1.x` | +| `profile` | Deployment profile | `esignet-standalone` / `esignet-standalone-2.0.0` / `mosip-platform-1.2.0.x` / `mosip-platform-1.2.1.x` | | `mode` | Helmsman mode | Always `apply` — dry-run will fail | | `domain_name` | Base domain for this environment | `soil38.mosip.net` | | `db_port` | External postgres port — MOSIP platform only | `5433` | @@ -70,14 +114,13 @@ No additional secrets required — MinIO root password is read automatically fro | `env_name` | Environment name | `soil38` | | `slack_channel_name` | Slack channel for alerting (optional) | `#mosip-alerts` | -### eSignet standalone profile additionally +### eSignet standalone profiles (`esignet-standalone` / `esignet-standalone-2.0.0`) additionally | Input | Description | Example | |-------|-------------|---------| -| `mosipid1_domain_name` | Domain for the MOSIP-ID1 eSignet instance | `mosipid1.mosip.net` | -| `mosipid2_domain_name` | Domain for the MOSIP-ID2 eSignet instance — only required if mosipid2 was enabled (`enable_mosipid2: true`) during eSignet deployment | `mosipid2.mosip.net` | +| `mosipid_domain_name` | Domain for the MOSIP-ID eSignet instance | `mosipid.mosip.net` | -> If not provided as inputs, values fall back to GitHub Environment Variables: `vars.MOSIPID1_DOMAIN_NAME` and `vars.MOSIPID2_DOMAIN_NAME`. +> If not provided as an input, the value falls back to the GitHub Environment Variable `vars.MOSIPID_DOMAIN_NAME`. --- @@ -89,19 +132,18 @@ No additional secrets required — MinIO root password is read automatically fro > Can't find it? Search for "Testrig" or "Testrigs" in the workflows list. - **(2)** Click the **Run workflow** dropdown button (top right) — this opens the form shown above. - **(3)** **Branch** — pick the branch you're deploying from (e.g., `MOSIP-44613`). -- **(4)** **Deployment profile to use** — pick the profile you want (e.g., `mosip-platform-1.2.0.x` or `esignet-standalone`). +- **(4)** **Deployment profile to use** — pick the profile you want (e.g., `mosip-platform-1.2.0.x`, `esignet-standalone`, or `esignet-standalone-2.0.0` for the Go rewrite). - **(5)** **Choose Helmsman mode: dry-run or apply** — always pick **`apply`**. - **(6)** **Domain name for this environment** — type the web domain this environment should use (e.g., `example.xyz.net`). -- **(7)** **MOSIP-ID1 domain name** *(eSignet profile only)* — type the base domain used by the MOSIP-ID1 eSignet instance (e.g., `mosipid1.xyz.net`). Leave blank for MOSIP platform profiles. -- **(8)** **QA base domain name** *(eSignet profile only)* — type the base domain used by the MOSIP-ID2 eSignet instance (e.g., `mosipid2.xyz.net`). Leave blank for MOSIP platform profiles. -- **(9)** **PostgreSQL port for MOSIP platform external postgres** — only fill this in if you picked a `mosip-platform-*` profile in step 4. Type `5433` (or whatever port your external PostgreSQL uses). -- **(10)** **PostgreSQL port for esignet standalone container postgres** — only fill this in if you picked the `esignet-standalone` profile in step 4. Type `5432`. -- **(11)** **Environment name** — a short nickname for this environment (e.g., `sandbox`, `dev`, `staging`). -- **(12)** **Slack channel name for alerting** (optional) — the Slack channel that should receive test result notifications (e.g., `#mosip-alerts`). Leave blank if you don't want Slack alerts. -- **(13)** **Slack webhook URL for alerting** (optional) — leave this blank; it's normally already saved as the `SLACK_WEBHOOK_URL` secret in your GitHub environment. -- **(14)** Click the green **Run workflow** button to start the deployment. +- **(7)** **MOSIP-ID domain name** *(eSignet profile only)* — type the base domain used by the MOSIP-ID eSignet instance (e.g., `mosipid.xyz.net`). Leave blank for MOSIP platform profiles. +- **(8)** **PostgreSQL port for MOSIP platform external postgres** — only fill this in if you picked a `mosip-platform-*` profile in step 4. Type `5433` (or whatever port your external PostgreSQL uses). +- **(9)** **PostgreSQL port for esignet standalone container postgres** — only fill this in if you picked the `esignet-standalone` profile in step 4. Type `5432`. +- **(10)** **Environment name** — a short nickname for this environment (e.g., `sandbox`, `dev`, `staging`). +- **(11)** **Slack channel name for alerting** (optional) — the Slack channel that should receive test result notifications (e.g., `#mosip-alerts`). Leave blank if you don't want Slack alerts. +- **(12)** **Slack webhook URL for alerting** (optional) — leave this blank; it's normally already saved as the `SLACK_WEBHOOK_URL` secret in your GitHub environment. +- **(13)** Click the green **Run workflow** button to start the deployment. -> **Note:** Steps 7–10 all appear in the form regardless of which profile you picked — fill in only the ones that match your profile (MOSIP-ID1/MOSIP-ID2 domains for `esignet-standalone`, PostgreSQL port for `mosip-platform-*`) and leave the rest blank. +> **Note:** Steps 7–9 all appear in the form regardless of which profile you picked — fill in only the ones that match your profile (MOSIP-ID domain for `esignet-standalone`, PostgreSQL port for `mosip-platform-*`) and leave the rest blank. > **Important:** Always pass `--keep-untracked-releases` — without it Helmsman will delete releases from previous DSFs (esignet, oidc-ui, etc.) that aren't listed in `testrigs-dsf.yaml`. The workflow handles this automatically. @@ -123,9 +165,13 @@ kubectl get cronjobs -n dslrig # For eSignet standalone kubectl get cronjobs -n esignet -kubectl get cronjobs -n esignet-mosipid1 -kubectl get cronjobs -n esignet-mosipid2 +kubectl get cronjobs -n esignet-mosipid kubectl get cronjobs -n esignet-sunbird + +# esignet-standalone-2.0.0 only — separate uitestrig namespaces +kubectl get cronjobs -n esignet-uitestrig +kubectl get cronjobs -n esignet-mosipid-uitestrig +kubectl get cronjobs -n esignet-sunbird-uitestrig ``` **2. Trigger DSL orchestrator (MOSIP platform profiles)** @@ -139,15 +185,16 @@ kubectl create job --from=cronjob/cronjob-dslorchestrator-full dslrig-manual-run > kubectl logs -f job/dslrig-manual-run -n dslrig > ``` -**3. Trigger eSignet test jobs (eSignet standalone profile)** +**3. Trigger eSignet test jobs (eSignet standalone profiles)** -The `trigger-test-jobs-esignet.sh` postInstall hook fires automatically after the last testrig deploys — it triggers all cronjobs across all 4 esignet namespaces sequentially and optionally signup/signup-uitestrig if deployed. +Test cronjobs are not triggered automatically after deployment. For `esignet-standalone`, trigger them with `trigger-test-jobs-esignet.sh` (all cronjobs across the esignet namespaces, plus signup/signup-uitestrig if deployed). For `esignet-standalone-2.0.0`, update the testrig values first, then trigger the cronjobs manually (for example `kubectl -n create job --from=cronjob/ `). -To trigger manually: +To trigger the `esignet-standalone` jobs: ```bash export KUBECONFIG=/path/to/kubeconfig export WORKDIR=/path/to/Helmsman + ./hooks/esignet-standalone/trigger-test-jobs-esignet.sh ``` @@ -161,10 +208,14 @@ kubectl get pods -n apitestrig kubectl get pods -n uitestrig kubectl get pods -n dslrig -# Check testrig pods (eSignet standalone) +# Check testrig pods (eSignet standalone apitestrig — same namespaces for esignet-standalone-2.0.0) kubectl get pods -n esignet # esignet-apitestrig cronjob -kubectl get pods -n esignet-mosipid1 -kubectl get pods -n esignet-mosipid2 +kubectl get pods -n esignet-mosipid kubectl get pods -n esignet-sunbird kubectl get pods -n signup # signup-apitestrig (if enabled) + +# esignet-standalone-2.0.0 only — separate uitestrig namespaces +kubectl get pods -n esignet-uitestrig +kubectl get pods -n esignet-mosipid-uitestrig +kubectl get pods -n esignet-sunbird-uitestrig ``` diff --git a/docs/WORKFLOW_GUIDE.md b/docs/WORKFLOW_GUIDE.md index b86f68481..3a809b848 100644 --- a/docs/WORKFLOW_GUIDE.md +++ b/docs/WORKFLOW_GUIDE.md @@ -387,18 +387,16 @@ Mode: apply ✅ | **mode** | `apply` | MUST be apply! | | **domain_name** | `sandbox.example.net` | Or set `vars.DOMAIN_NAME` | | **esignet_db_port** | `5432` (esignet) / `5433` (MOSIP platform) | Or set `vars.ESIGNET_DB_PORT` | - | **mosipid1_domain_name** | `mosipid1.example.net` | esignet-standalone profile only — MOSIP-ID1 environment domain | - | **enable_mosipid2** | `false` (default) / `true` | Toggle to deploy MOSIP-ID2 instance; leave `false` to skip | - | **mosipid2_domain_name** | `mosipid2.example.net` | Required only if `enable_mosipid2` is `true` | + | **mosipid_domain_name** | `mosipid.example.net` | esignet-standalone profile only — MOSIP-ID environment domain | | **skip_mosip_dsf_check** | `true` for standalone, `false` when MOSIP is deployed | | | **delete_existing_jobs** | `true` when re-running after a failed attempt | Cleans up stale onboarder jobs | -3. **Monitor Progress** (25-35 minutes for esignet-standalone profile with up to 4 instances) +3. **Monitor Progress** (25-35 minutes for esignet-standalone profile with 3 instances) ``` - → SoftHSM (all 4 namespaces) + → SoftHSM (all 3 namespaces) → Config server - → eSignet core (all 4 namespaces in parallel) - → OIDC UI (all 4 namespaces) + → eSignet core (all 3 namespaces in parallel) + → OIDC UI (all 3 namespaces) → Mock identity system → Mock relying party ``` @@ -411,8 +409,7 @@ Mode: apply ✅ **Check Status:** ```bash kubectl get pods -n esignet -kubectl get pods -n esignet-mosipid1 # esignet profile only -kubectl get pods -n esignet-mosipid2 # esignet profile only +kubectl get pods -n esignet-mosipid # esignet profile only kubectl get pods -n esignet-sunbird # esignet profile only ``` @@ -445,14 +442,13 @@ kubectl get pods -n esignet-sunbird # esignet profile only | **profile** | Same as your deployment profile | | | **mode** | `apply` | | | **domain_name** | `sandbox.example.net` | Or `vars.DOMAIN_NAME` | - | **mosipid1_domain_name** | `mosipid1.example.net` | esignet-standalone profile only | - | **mosipid2_domain_name** | `mosipid2.example.net` | esignet-standalone only — required if mosipid2 was enabled | + | **mosipid_domain_name** | `mosipid.example.net` | esignet-standalone profile only | | **db_port** | `5433` | MOSIP platform only | | **esignet_db_port** | `5432` | eSignet profile | 4. **Monitor Progress** (10-20 minutes) ``` - → esignet-apitestrig (esignet profile: 4 instances across all namespaces) + → esignet-apitestrig (esignet profile: 3 instances across all namespaces) → signup-apitestrig (if signup was deployed) → API / DSL / UI test rigs (MOSIP platform profiles) ``` @@ -460,8 +456,7 @@ kubectl get pods -n esignet-sunbird # esignet profile only 5. **Verify CronJobs Created** ```bash kubectl get cronjobs -n esignet - kubectl get cronjobs -n esignet-mosipid1 # esignet profile - kubectl get cronjobs -n esignet-mosipid2 # esignet profile + kubectl get cronjobs -n esignet-mosipid # esignet profile kubectl get cronjobs -n esignet-sunbird # esignet profile ``` @@ -612,8 +607,7 @@ These inputs override the corresponding GitHub Environment Variables for a singl | `clusterid` | `vars.CLUSTER_ID` | Rancher cluster ID | | `db_port` | `vars.DB_PORT` | MOSIP platform postgres port | | `esignet_db_port` | `vars.ESIGNET_DB_PORT` | eSignet postgres port | -| `mosipid1_domain_name` | `vars.MOSIPID1_DOMAIN_NAME` | MOSIP-ID1 environment base domain (esignet profile) | -| `mosipid2_domain_name` | `vars.MOSIPID2_DOMAIN_NAME` | MOSIP-ID2 environment base domain (esignet profile) | +| `mosipid_domain_name` | `vars.MOSIPID_DOMAIN_NAME` | MOSIP-ID environment base domain (esignet profile) | --- @@ -772,10 +766,10 @@ DEPLOYMENT FLOW: └── PostgreSQL, Redis, Kafka, SoftHSM, Keycloak, Captcha, MinIO 4. Helmsman: eSignet [helmsman_esignet.yml, profile=esignet-standalone] - └── 3 instances always (esignet-mock / esignet-mosipid1 / esignet-sunbird) + esignet-mosipid2 if enable_mosipid2=true + └── 3 instances always (esignet-mock / esignet-mosipid / esignet-sunbird) 5. Helmsman: Test Rigs [helmsman_testrigs.yml, profile=esignet-standalone, manual] - └── API testrigs for all 4 esignet namespaces + └── API testrigs for all 3 esignet namespaces └── ✅ Deployment Complete! ``` diff --git a/docs/esignet_README.md b/docs/esignet_README.md index 73ad5b3ba..b38de8828 100644 --- a/docs/esignet_README.md +++ b/docs/esignet_README.md @@ -233,11 +233,9 @@ Custom Helm values are stored in: - **(7)** **Delete existing onboarder jobs before deploy** (checkbox) — only tick this when re-running after a failure. Leave unticked on a first-time deploy. - **(8)** **Domain name for this environment** — type the web domain this environment should use (e.g., `example.xyz.net`). - **(9)** **PostgreSQL port for esignet databases** — type `5432` for eSignet standalone, or `5433` if this is part of a MOSIP platform profile. -- **(10)** **MOSIP-ID1 domain name** *(eSignet standalone only)* — base domain for the MOSIP-ID1 eSignet instance (e.g., `mosipid1.xyz.net`). Leave blank if you're not deploying MOSIP-ID1. -- **(11)** **Enable MOSIP-ID2 eSignet instance** *(eSignet standalone only)* — toggle to `true` to deploy the MOSIP-ID2 instance (softhsm, esignet, oidc-ui, mock-rp). Leave `false` to skip it entirely. -- **(12)** **MOSIP-ID2 domain name** *(eSignet standalone only, required if enable_mosipid2 is true)* — base domain for the MOSIP-ID2 eSignet instance (e.g., `mosipid2.xyz.net`). -- **(13)** **Environment name** — a short nickname for this environment (e.g., `sandbox`, `dev`, `staging`). -- **(14)** Click the green **Run workflow** button to start the deployment. +- **(10)** **MOSIP-ID domain name** *(eSignet standalone only)* — base domain for the MOSIP-ID eSignet instance (e.g., `mosipid.xyz.net`). Leave blank if you're not deploying MOSIP-ID. +- **(11)** **Environment name** — a short nickname for this environment (e.g., `sandbox`, `dev`, `staging`). +- **(12)** Click the green **Run workflow** button to start the deployment. --- @@ -258,9 +256,7 @@ Custom Helm values are stored in: | `mode` | `dry-run` or `apply` | Yes | Always use `apply` — dry-run will fail | | `domain_name` | Your base domain | Yes | Or set `vars.DOMAIN_NAME` in GitHub Environment | | `esignet_db_port` | PostgreSQL port for esignet databases | Yes | `5433` for MOSIP platform external postgres, `5432` for eSignet standalone (or `vars.ESIGNET_DB_PORT`) | -| `mosipid1_domain_name` | Base domain for the MOSIP-ID1 eSignet instance | No | eSignet standalone only — leave blank otherwise (or `vars.MOSIPID1_DOMAIN_NAME`) | -| `enable_mosipid2` | Deploy MOSIP-ID2 eSignet instance | No | Toggle `true` to deploy softhsm, esignet, oidc-ui, mock-rp for mosipid2; default `false` | -| `mosipid2_domain_name` | Base domain for the MOSIP-ID2 eSignet instance | No | Required only if `enable_mosipid2` is `true` (or `vars.MOSIPID2_DOMAIN_NAME`) | +| `mosipid_domain_name` | Base domain for the MOSIP-ID eSignet instance | No | eSignet standalone only — leave blank otherwise (or `vars.MOSIPID_DOMAIN_NAME`) | | `env_name` | Environment name shown on the landing page | Yes | Or set `vars.ENV_NAME` in GitHub Environment | | `skip_mosip_dsf_check` | Skip MOSIP DSF completion check | No | Tick for eSignet standalone deploys; default `false` otherwise | | `delete_existing_jobs` | Delete stale onboarder jobs before deploy | No | Set `true` when re-running after a failure | diff --git a/terraform/implementations/aws/infra/backend.tf b/terraform/implementations/aws/infra/backend.tf deleted file mode 100644 index 59c22cf6f..000000000 --- a/terraform/implementations/aws/infra/backend.tf +++ /dev/null @@ -1,5 +0,0 @@ -terraform { - backend "local" { - path = "profiles/mosip/aws-infra-mosip-develop-terraform.tfstate" - } -} diff --git a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars index a5b60172f..644320705 100644 --- a/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars +++ b/terraform/implementations/aws/infra/profiles/esignet-standalone/aws.tfvars @@ -7,13 +7,13 @@ # ============================================================ # Environment name (infra component) -cluster_name = "" +cluster_name = "" # eSignet's domain (ex: esignet.xyz.net) -cluster_env_domain = "" +cluster_env_domain = "" # Email-ID will be used by certbot to notify SSL certificate expiry via email -mosip_email_id = "" +mosip_email_id = "" # SSH login key name for AWS node instances (ex: my-ssh-key) ssh_key_name = "" @@ -74,11 +74,15 @@ WIREGUARD_CIDR = "172.0.0.0/8" # Use your actual WireGuard VPN CIDR # Rancher Import Configuration enable_rancher_import = true -rancher_import_url = "\"\"" +rancher_import_url = "\"\"" # DNS Records to map — only eSignet-relevant subdomains +# Shared by both the esignet-standalone profile and the esignet-standalone-2.0.0 +# profile — both use identical hostnames (no "-go" suffix, single consolidated +# mosipid instance instead of separate mosipid1/mosipid2), since only one of +# the two profiles is ever live on a given cluster/domain at a time. -subdomain_public = ["esignet", "healthservices", "signup", "esignet-sunbird", "healthservices-sunbird", "healthservices-mosipid1", "esignet-mosipid1", "pms-mosipid1", "signup-mosipid1", "healthservices-mosipid2", "esignet-mosipid2", "pms-mosipid2", "signup-mosipid2"] +subdomain_public = ["esignet", "healthservices", "signup", "esignet-sunbird", "healthservices-sunbird", "healthservices-mosipid", "esignet-mosipid", "pms-mosipid", "signup-mosipid"] subdomain_internal = ["iam", "activemq", "kafka", "kibana", "postgres", "smtp", "pmp", "minio"] # PostgreSQL Configuration @@ -94,7 +98,7 @@ mosip_infra_repo_url = "https://github.com/mosip/infra.git" mosip_infra_branch = "develop" # VPC Configuration - Existing VPC to use (discovered by Name tag) -vpc_name = "" +vpc_name = "" # ── ActiveMQ Configuration ───────────────────────────────────────────────────── # Set enable_activemq_setup = true AND nginx_node_ebs_volume_size_3 > 0 to